339 files changed, 20462 insertions, 6641 deletions

diff --git a/drivers/net/wireless/adm8211.c b/drivers/net/wireless/adm8211.c
index 17fcaabb2687..f07a61899545 100644
--- a/drivers/net/wireless/adm8211.c
+++ b/drivers/net/wireless/adm8211.c
@@ -1837,6 +1837,7 @@ static int adm8211_probe(struct pci_dev *pdev,
         if (!priv->map) {
                 printk(KERN_ERR "%s (adm8211): Cannot map device memory\n",
                        pci_name(pdev));
+                err = -ENOMEM;
                 goto err_free_dev;
         }
 
diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h
index ccba4fea7269..1eebe2ea3dfb 100644
--- a/drivers/net/wireless/ath/ath.h
+++ b/drivers/net/wireless/ath/ath.h
@@ -64,6 +64,7 @@ enum ath_op_flags {
         ATH_OP_HW_RESET,
         ATH_OP_SCANNING,
         ATH_OP_MULTI_CHANNEL,
+        ATH_OP_WOW_ENABLED,
 };
 
 enum ath_bus_type {
diff --git a/drivers/net/wireless/ath/ath10k/Makefile b/drivers/net/wireless/ath/ath10k/Makefile
index 8b1b1adb477a..f4dbb3e93bf8 100644
--- a/drivers/net/wireless/ath/ath10k/Makefile
+++ b/drivers/net/wireless/ath/ath10k/Makefile
@@ -8,11 +8,15 @@ ath10k_core-y += mac.o \
                  htt_tx.o \
                  txrx.o \
                  wmi.o \
-                 bmi.o
+                 wmi-tlv.o \
+                 bmi.o \
+                 hw.o
 
 ath10k_core-$(CONFIG_ATH10K_DEBUGFS) += spectral.o
 ath10k_core-$(CONFIG_NL80211_TESTMODE) += testmode.o
 ath10k_core-$(CONFIG_ATH10K_TRACING) += trace.o
+ath10k_core-$(CONFIG_THERMAL) += thermal.o
+ath10k_core-$(CONFIG_MAC80211_DEBUGFS) += debugfs_sta.o
 
 obj-$(CONFIG_ATH10K_PCI) += ath10k_pci.o
 ath10k_pci-y += pci.o \
diff --git a/drivers/net/wireless/ath/ath10k/ce.c b/drivers/net/wireless/ath/ath10k/ce.c
index a156e6e48708..e508c65b6ba8 100644
--- a/drivers/net/wireless/ath/ath10k/ce.c
+++ b/drivers/net/wireless/ath/ath10k/ce.c
@@ -803,7 +803,7 @@ int ath10k_ce_disable_interrupts(struct ath10k *ar)
         int ce_id;
 
         for (ce_id = 0; ce_id < CE_COUNT; ce_id++) {
-                u32 ctrl_addr = ath10k_ce_base_address(ce_id);
+                u32 ctrl_addr = ath10k_ce_base_address(ar, ce_id);
 
                 ath10k_ce_copy_complete_intr_disable(ar, ctrl_addr);
                 ath10k_ce_error_intr_disable(ar, ctrl_addr);
@@ -832,7 +832,7 @@ static int ath10k_ce_init_src_ring(struct ath10k *ar,
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
         struct ath10k_ce_pipe *ce_state = &ar_pci->ce_states[ce_id];
         struct ath10k_ce_ring *src_ring = ce_state->src_ring;
-        u32 nentries, ctrl_addr = ath10k_ce_base_address(ce_id);
+        u32 nentries, ctrl_addr = ath10k_ce_base_address(ar, ce_id);
 
         nentries = roundup_pow_of_two(attr->src_nentries);
 
@@ -869,7 +869,7 @@ static int ath10k_ce_init_dest_ring(struct ath10k *ar,
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
         struct ath10k_ce_pipe *ce_state = &ar_pci->ce_states[ce_id];
         struct ath10k_ce_ring *dest_ring = ce_state->dest_ring;
-        u32 nentries, ctrl_addr = ath10k_ce_base_address(ce_id);
+        u32 nentries, ctrl_addr = ath10k_ce_base_address(ar, ce_id);
 
         nentries = roundup_pow_of_two(attr->dest_nentries);
 
@@ -1051,7 +1051,7 @@ int ath10k_ce_init_pipe(struct ath10k *ar, unsigned int ce_id,
 
 static void ath10k_ce_deinit_src_ring(struct ath10k *ar, unsigned int ce_id)
 {
-        u32 ctrl_addr = ath10k_ce_base_address(ce_id);
+        u32 ctrl_addr = ath10k_ce_base_address(ar, ce_id);
 
         ath10k_ce_src_ring_base_addr_set(ar, ctrl_addr, 0);
         ath10k_ce_src_ring_size_set(ar, ctrl_addr, 0);
@@ -1061,7 +1061,7 @@ static void ath10k_ce_deinit_src_ring(struct ath10k *ar, unsigned int ce_id)
 
 static void ath10k_ce_deinit_dest_ring(struct ath10k *ar, unsigned int ce_id)
 {
-        u32 ctrl_addr = ath10k_ce_base_address(ce_id);
+        u32 ctrl_addr = ath10k_ce_base_address(ar, ce_id);
 
         ath10k_ce_dest_ring_base_addr_set(ar, ctrl_addr, 0);
         ath10k_ce_dest_ring_size_set(ar, ctrl_addr, 0);
@@ -1093,10 +1093,12 @@ int ath10k_ce_alloc_pipe(struct ath10k *ar, int ce_id,
                      (CE_HTT_H2T_MSG_SRC_NENTRIES - 1));
         BUILD_BUG_ON(2*TARGET_10X_NUM_MSDU_DESC >
                      (CE_HTT_H2T_MSG_SRC_NENTRIES - 1));
+        BUILD_BUG_ON(2*TARGET_TLV_NUM_MSDU_DESC >
+                     (CE_HTT_H2T_MSG_SRC_NENTRIES - 1));
 
         ce_state->ar = ar;
         ce_state->id = ce_id;
-        ce_state->ctrl_addr = ath10k_ce_base_address(ce_id);
+        ce_state->ctrl_addr = ath10k_ce_base_address(ar, ce_id);
         ce_state->attr_flags = attr->flags;
         ce_state->src_sz_max = attr->src_sz_max;
 
diff --git a/drivers/net/wireless/ath/ath10k/ce.h b/drivers/net/wireless/ath/ath10k/ce.h
index 617a151e8ce4..c18647b87f71 100644
--- a/drivers/net/wireless/ath/ath10k/ce.h
+++ b/drivers/net/wireless/ath/ath10k/ce.h
@@ -394,7 +394,7 @@ struct ce_attr {
 #define DST_WATERMARK_HIGH_RESET                0
 #define DST_WATERMARK_ADDRESS                   0x0050
 
-static inline u32 ath10k_ce_base_address(unsigned int ce_id)
+static inline u32 ath10k_ce_base_address(struct ath10k *ar, unsigned int ce_id)
 {
         return CE0_BASE_ADDRESS + (CE1_BASE_ADDRESS - CE0_BASE_ADDRESS) * ce_id;
 }
diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
index 7762061a1944..310e12bc078a 100644
--- a/drivers/net/wireless/ath/ath10k/core.c
+++ b/drivers/net/wireless/ath/ath10k/core.c
@@ -17,6 +17,7 @@
 
 #include <linux/module.h>
 #include <linux/firmware.h>
+#include <linux/of.h>
 
 #include "core.h"
 #include "mac.h"
@@ -27,20 +28,18 @@
 #include "debug.h"
 #include "htt.h"
 #include "testmode.h"
+#include "wmi-ops.h"
 
 unsigned int ath10k_debug_mask;
 static bool uart_print;
-static unsigned int ath10k_p2p;
 static bool skip_otp;
 
 module_param_named(debug_mask, ath10k_debug_mask, uint, 0644);
 module_param(uart_print, bool, 0644);
-module_param_named(p2p, ath10k_p2p, uint, 0644);
 module_param(skip_otp, bool, 0644);
 
 MODULE_PARM_DESC(debug_mask, "Debugging mask");
 MODULE_PARM_DESC(uart_print, "Uart target debugging");
-MODULE_PARM_DESC(p2p, "Enable ath10k P2P support");
 MODULE_PARM_DESC(skip_otp, "Skip otp failure for calibration in testmode");
 
 static const struct ath10k_hw_params ath10k_hw_params_list[] = {
@@ -48,11 +47,57 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
                 .id = QCA988X_HW_2_0_VERSION,
                 .name = "qca988x hw2.0",
                 .patch_load_addr = QCA988X_HW_2_0_PATCH_LOAD_ADDR,
+                .uart_pin = 7,
                 .fw = {
                         .dir = QCA988X_HW_2_0_FW_DIR,
                         .fw = QCA988X_HW_2_0_FW_FILE,
                         .otp = QCA988X_HW_2_0_OTP_FILE,
                         .board = QCA988X_HW_2_0_BOARD_DATA_FILE,
+                        .board_size = QCA988X_BOARD_DATA_SZ,
+                        .board_ext_size = QCA988X_BOARD_EXT_DATA_SZ,
+                },
+        },
+        {
+                .id = QCA6174_HW_2_1_VERSION,
+                .name = "qca6174 hw2.1",
+                .patch_load_addr = QCA6174_HW_2_1_PATCH_LOAD_ADDR,
+                .uart_pin = 6,
+                .fw = {
+                        .dir = QCA6174_HW_2_1_FW_DIR,
+                        .fw = QCA6174_HW_2_1_FW_FILE,
+                        .otp = QCA6174_HW_2_1_OTP_FILE,
+                        .board = QCA6174_HW_2_1_BOARD_DATA_FILE,
+                        .board_size = QCA6174_BOARD_DATA_SZ,
+                        .board_ext_size = QCA6174_BOARD_EXT_DATA_SZ,
+                },
+        },
+        {
+                .id = QCA6174_HW_3_0_VERSION,
+                .name = "qca6174 hw3.0",
+                .patch_load_addr = QCA6174_HW_3_0_PATCH_LOAD_ADDR,
+                .uart_pin = 6,
+                .fw = {
+                        .dir = QCA6174_HW_3_0_FW_DIR,
+                        .fw = QCA6174_HW_3_0_FW_FILE,
+                        .otp = QCA6174_HW_3_0_OTP_FILE,
+                        .board = QCA6174_HW_3_0_BOARD_DATA_FILE,
+                        .board_size = QCA6174_BOARD_DATA_SZ,
+                        .board_ext_size = QCA6174_BOARD_EXT_DATA_SZ,
+                },
+        },
+        {
+                .id = QCA6174_HW_3_2_VERSION,
+                .name = "qca6174 hw3.2",
+                .patch_load_addr = QCA6174_HW_3_0_PATCH_LOAD_ADDR,
+                .uart_pin = 6,
+                .fw = {
+                        /* uses same binaries as hw3.0 */
+                        .dir = QCA6174_HW_3_0_FW_DIR,
+                        .fw = QCA6174_HW_3_0_FW_FILE,
+                        .otp = QCA6174_HW_3_0_OTP_FILE,
+                        .board = QCA6174_HW_3_0_BOARD_DATA_FILE,
+                        .board_size = QCA6174_BOARD_DATA_SZ,
+                        .board_ext_size = QCA6174_BOARD_EXT_DATA_SZ,
                 },
         },
 };
@@ -146,8 +191,8 @@ static const struct firmware *ath10k_fetch_fw_file(struct ath10k *ar,
 static int ath10k_push_board_ext_data(struct ath10k *ar, const void *data,
                                       size_t data_len)
 {
-        u32 board_data_size = QCA988X_BOARD_DATA_SZ;
-        u32 board_ext_data_size = QCA988X_BOARD_EXT_DATA_SZ;
+        u32 board_data_size = ar->hw_params.fw.board_size;
+        u32 board_ext_data_size = ar->hw_params.fw.board_ext_size;
         u32 board_ext_data_addr;
         int ret;
 
@@ -193,7 +238,7 @@ static int ath10k_push_board_ext_data(struct ath10k *ar, const void *data,
 static int ath10k_download_board_data(struct ath10k *ar, const void *data,
                                       size_t data_len)
 {
-        u32 board_data_size = QCA988X_BOARD_DATA_SZ;
+        u32 board_data_size = ar->hw_params.fw.board_size;
         u32 address;
         int ret;
 
@@ -249,6 +294,63 @@ static int ath10k_download_cal_file(struct ath10k *ar)
         return 0;
 }
 
+static int ath10k_download_cal_dt(struct ath10k *ar)
+{
+        struct device_node *node;
+        int data_len;
+        void *data;
+        int ret;
+
+        node = ar->dev->of_node;
+        if (!node)
+                /* Device Tree is optional, don't print any warnings if
+                 * there's no node for ath10k.
+                 */
+                return -ENOENT;
+
+        if (!of_get_property(node, "qcom,ath10k-calibration-data",
+                             &data_len)) {
+                /* The calibration data node is optional */
+                return -ENOENT;
+        }
+
+        if (data_len != QCA988X_CAL_DATA_LEN) {
+                ath10k_warn(ar, "invalid calibration data length in DT: %d\n",
+                            data_len);
+                ret = -EMSGSIZE;
+                goto out;
+        }
+
+        data = kmalloc(data_len, GFP_KERNEL);
+        if (!data) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        ret = of_property_read_u8_array(node, "qcom,ath10k-calibration-data",
+                                        data, data_len);
+        if (ret) {
+                ath10k_warn(ar, "failed to read calibration data from DT: %d\n",
+                            ret);
+                goto out_free;
+        }
+
+        ret = ath10k_download_board_data(ar, data, data_len);
+        if (ret) {
+                ath10k_warn(ar, "failed to download calibration data from Device Tree: %d\n",
+                            ret);
+                goto out_free;
+        }
+
+        ret = 0;
+
+out_free:
+        kfree(data);
+
+out:
+        return ret;
+}
+
 static int ath10k_download_and_run_otp(struct ath10k *ar)
 {
         u32 result, address = ar->hw_params.patch_load_addr;
@@ -447,7 +549,7 @@ static int ath10k_core_fetch_firmware_api_n(struct ath10k *ar, const char *name)
         int ie_id, i, index, bit, ret;
         struct ath10k_fw_ie *hdr;
         const u8 *data;
-        __le32 *timestamp;
+        __le32 *timestamp, *version;
 
         /* first fetch the firmware file (firmware-*.bin) */
         ar->firmware = ath10k_fetch_fw_file(ar, ar->hw_params.fw.dir, name);
@@ -562,6 +664,17 @@ static int ath10k_core_fetch_firmware_api_n(struct ath10k *ar, const char *name)
                         ar->otp_len = ie_len;
 
                         break;
+                case ATH10K_FW_IE_WMI_OP_VERSION:
+                        if (ie_len != sizeof(u32))
+                                break;
+
+                        version = (__le32 *)data;
+
+                        ar->wmi.op_version = le32_to_cpup(version);
+
+                        ath10k_dbg(ar, ATH10K_DBG_BOOT, "found fw ie wmi op version %d\n",
+                                   ar->wmi.op_version);
+                        break;
                 default:
                         ath10k_warn(ar, "Unknown FW IE: %u\n",
                                     le32_to_cpu(hdr->id));
@@ -582,13 +695,6 @@ static int ath10k_core_fetch_firmware_api_n(struct ath10k *ar, const char *name)
                 goto err;
         }
 
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10_2, ar->fw_features) &&
-            !test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
-                ath10k_err(ar, "feature bits corrupted: 10.2 feature requires 10.x feature to be set as well");
-                ret = -EINVAL;
-                goto err;
-        }
-
         /* now fetch the board file */
         if (ar->hw_params.fw.board == NULL) {
                 ath10k_err(ar, "board data file not defined");
@@ -624,6 +730,13 @@ static int ath10k_core_fetch_firmware_files(struct ath10k *ar)
         /* calibration file is optional, don't check for any errors */
         ath10k_fetch_cal_file(ar);
 
+        ar->fw_api = 4;
+        ath10k_dbg(ar, ATH10K_DBG_BOOT, "trying fw api %d\n", ar->fw_api);
+
+        ret = ath10k_core_fetch_firmware_api_n(ar, ATH10K_FW_API4_FILE);
+        if (ret == 0)
+                goto success;
+
         ar->fw_api = 3;
         ath10k_dbg(ar, ATH10K_DBG_BOOT, "trying fw api %d\n", ar->fw_api);
 
@@ -662,7 +775,17 @@ static int ath10k_download_cal_data(struct ath10k *ar)
         }
 
         ath10k_dbg(ar, ATH10K_DBG_BOOT,
-                   "boot did not find a calibration file, try OTP next: %d\n",
+                   "boot did not find a calibration file, try DT next: %d\n",
+                   ret);
+
+        ret = ath10k_download_cal_dt(ar);
+        if (ret == 0) {
+                ar->cal_mode = ATH10K_CAL_MODE_DT;
+                goto done;
+        }
+
+        ath10k_dbg(ar, ATH10K_DBG_BOOT,
+                   "boot did not find DT entry, try OTP next: %d\n",
                    ret);
 
         ret = ath10k_download_and_run_otp(ar);
@@ -696,7 +819,7 @@ static int ath10k_init_uart(struct ath10k *ar)
         if (!uart_print)
                 return 0;
 
-        ret = ath10k_bmi_write32(ar, hi_dbg_uart_txpin, 7);
+        ret = ath10k_bmi_write32(ar, hi_dbg_uart_txpin, ar->hw_params.uart_pin);
         if (ret) {
                 ath10k_warn(ar, "could not enable UART prints (%d)\n", ret);
                 return ret;
@@ -764,6 +887,7 @@ static void ath10k_core_restart(struct work_struct *work)
         complete_all(&ar->offchan_tx_completed);
         complete_all(&ar->install_key_done);
         complete_all(&ar->vdev_setup_done);
+        complete_all(&ar->thermal.wmi_sync);
         wake_up(&ar->htt.empty_tx_wq);
         wake_up(&ar->wmi.tx_credits_wq);
         wake_up(&ar->peer_mapping_wq);
@@ -799,15 +923,63 @@ static void ath10k_core_restart(struct work_struct *work)
         mutex_unlock(&ar->conf_mutex);
 }
 
-static void ath10k_core_init_max_sta_count(struct ath10k *ar)
+static int ath10k_core_init_firmware_features(struct ath10k *ar)
 {
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
-                ar->max_num_peers = TARGET_10X_NUM_PEERS;
-                ar->max_num_stations = TARGET_10X_NUM_STATIONS;
-        } else {
+        if (test_bit(ATH10K_FW_FEATURE_WMI_10_2, ar->fw_features) &&
+            !test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
+                ath10k_err(ar, "feature bits corrupted: 10.2 feature requires 10.x feature to be set as well");
+                return -EINVAL;
+        }
+
+        if (ar->wmi.op_version >= ATH10K_FW_WMI_OP_VERSION_MAX) {
+                ath10k_err(ar, "unsupported WMI OP version (max %d): %d\n",
+                           ATH10K_FW_WMI_OP_VERSION_MAX, ar->wmi.op_version);
+                return -EINVAL;
+        }
+
+        /* Backwards compatibility for firmwares without
+         * ATH10K_FW_IE_WMI_OP_VERSION.
+         */
+        if (ar->wmi.op_version == ATH10K_FW_WMI_OP_VERSION_UNSET) {
+                if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
+                        if (test_bit(ATH10K_FW_FEATURE_WMI_10_2,
+                                     ar->fw_features))
+                                ar->wmi.op_version = ATH10K_FW_WMI_OP_VERSION_10_2;
+                        else
+                                ar->wmi.op_version = ATH10K_FW_WMI_OP_VERSION_10_1;
+                } else {
+                        ar->wmi.op_version = ATH10K_FW_WMI_OP_VERSION_MAIN;
+                }
+        }
+
+        switch (ar->wmi.op_version) {
+        case ATH10K_FW_WMI_OP_VERSION_MAIN:
                 ar->max_num_peers = TARGET_NUM_PEERS;
                 ar->max_num_stations = TARGET_NUM_STATIONS;
+                ar->max_num_vdevs = TARGET_NUM_VDEVS;
+                ar->htt.max_num_pending_tx = TARGET_NUM_MSDU_DESC;
+                break;
+        case ATH10K_FW_WMI_OP_VERSION_10_1:
+        case ATH10K_FW_WMI_OP_VERSION_10_2:
+        case ATH10K_FW_WMI_OP_VERSION_10_2_4:
+                ar->max_num_peers = TARGET_10X_NUM_PEERS;
+                ar->max_num_stations = TARGET_10X_NUM_STATIONS;
+                ar->max_num_vdevs = TARGET_10X_NUM_VDEVS;
+                ar->htt.max_num_pending_tx = TARGET_10X_NUM_MSDU_DESC;
+                break;
+        case ATH10K_FW_WMI_OP_VERSION_TLV:
+                ar->max_num_peers = TARGET_TLV_NUM_PEERS;
+                ar->max_num_stations = TARGET_TLV_NUM_STATIONS;
+                ar->max_num_vdevs = TARGET_TLV_NUM_VDEVS;
+                ar->htt.max_num_pending_tx = TARGET_TLV_NUM_MSDU_DESC;
+                break;
+        case ATH10K_FW_WMI_OP_VERSION_UNSET:
+        case ATH10K_FW_WMI_OP_VERSION_MAX:
+                WARN_ON(1);
+                return -EINVAL;
         }
+
+        return 0;
 }
 
 int ath10k_core_start(struct ath10k *ar, enum ath10k_firmware_mode mode)
@@ -932,6 +1104,18 @@ int ath10k_core_start(struct ath10k *ar, enum ath10k_firmware_mode mode)
                 goto err_hif_stop;
         }
 
+        /* If firmware indicates Full Rx Reorder support it must be used in a
+         * slightly different manner. Let HTT code know.
+         */
+        ar->htt.rx_ring.in_ord_rx = !!(test_bit(WMI_SERVICE_RX_FULL_REORDER,
+                                                ar->wmi.svc_map));
+
+        status = ath10k_htt_rx_ring_refill(ar);
+        if (status) {
+                ath10k_err(ar, "failed to refill htt rx ring: %d\n", status);
+                goto err_hif_stop;
+        }
+
         /* we don't care about HTT in UTF mode */
         if (mode == ATH10K_FIRMWARE_MODE_NORMAL) {
                 status = ath10k_htt_setup(&ar->htt);
@@ -945,10 +1129,7 @@ int ath10k_core_start(struct ath10k *ar, enum ath10k_firmware_mode mode)
         if (status)
                 goto err_hif_stop;
 
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features))
-                ar->free_vdev_map = (1LL << TARGET_10X_NUM_VDEVS) - 1;
-        else
-                ar->free_vdev_map = (1LL << TARGET_NUM_VDEVS) - 1;
+        ar->free_vdev_map = (1LL << ar->max_num_vdevs) - 1;
 
         INIT_LIST_HEAD(&ar->arvifs);
 
@@ -1025,8 +1206,7 @@ static int ath10k_core_probe_fw(struct ath10k *ar)
         ret = ath10k_bmi_get_target_info(ar, &target_info);
         if (ret) {
                 ath10k_err(ar, "could not get target info (%d)\n", ret);
-                ath10k_hif_power_down(ar);
-                return ret;
+                goto err_power_down;
         }
 
         ar->target_version = target_info.version;
@@ -1035,28 +1215,28 @@ static int ath10k_core_probe_fw(struct ath10k *ar)
         ret = ath10k_init_hw_params(ar);
         if (ret) {
                 ath10k_err(ar, "could not get hw params (%d)\n", ret);
-                ath10k_hif_power_down(ar);
-                return ret;
+                goto err_power_down;
         }
 
         ret = ath10k_core_fetch_firmware_files(ar);
         if (ret) {
                 ath10k_err(ar, "could not fetch firmware files (%d)\n", ret);
-                ath10k_hif_power_down(ar);
-                return ret;
+                goto err_power_down;
         }
 
-        ath10k_core_init_max_sta_count(ar);
+        ret = ath10k_core_init_firmware_features(ar);
+        if (ret) {
+                ath10k_err(ar, "fatal problem with firmware features: %d\n",
+                           ret);
+                goto err_free_firmware_files;
+        }
 
         mutex_lock(&ar->conf_mutex);
 
         ret = ath10k_core_start(ar, ATH10K_FIRMWARE_MODE_NORMAL);
         if (ret) {
                 ath10k_err(ar, "could not init core (%d)\n", ret);
-                ath10k_core_free_firmware_files(ar);
-                ath10k_hif_power_down(ar);
-                mutex_unlock(&ar->conf_mutex);
-                return ret;
+                goto err_unlock;
         }
 
         ath10k_print_driver_info(ar);
@@ -1066,34 +1246,17 @@ static int ath10k_core_probe_fw(struct ath10k *ar)
 
         ath10k_hif_power_down(ar);
         return 0;
-}
-
-static int ath10k_core_check_chip_id(struct ath10k *ar)
-{
-        u32 hw_revision = MS(ar->chip_id, SOC_CHIP_ID_REV);
-
-        ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot chip_id 0x%08x hw_revision 0x%x\n",
-                   ar->chip_id, hw_revision);
 
-        /* Check that we are not using hw1.0 (some of them have same pci id
-         * as hw2.0) before doing anything else as ath10k crashes horribly
-         * due to missing hw1.0 workarounds. */
-        switch (hw_revision) {
-        case QCA988X_HW_1_0_CHIP_ID_REV:
-                ath10k_err(ar, "ERROR: qca988x hw1.0 is not supported\n");
-                return -EOPNOTSUPP;
+err_unlock:
+        mutex_unlock(&ar->conf_mutex);
 
-        case QCA988X_HW_2_0_CHIP_ID_REV:
-                /* known hardware revision, continue normally */
-                return 0;
+err_free_firmware_files:
+        ath10k_core_free_firmware_files(ar);
 
-        default:
-                ath10k_warn(ar, "Warning: hardware revision unknown (0x%x), expect problems\n",
-                            ar->chip_id);
-                return 0;
-        }
+err_power_down:
+        ath10k_hif_power_down(ar);
 
-        return 0;
+        return ret;
 }
 
 static void ath10k_core_register_work(struct work_struct *work)
@@ -1125,9 +1288,18 @@ static void ath10k_core_register_work(struct work_struct *work)
                 goto err_debug_destroy;
         }
 
+        status = ath10k_thermal_register(ar);
+        if (status) {
+                ath10k_err(ar, "could not register thermal device: %d\n",
+                           status);
+                goto err_spectral_destroy;
+        }
+
         set_bit(ATH10K_FLAG_CORE_REGISTERED, &ar->dev_flags);
         return;
 
+err_spectral_destroy:
+        ath10k_spectral_destroy(ar);
 err_debug_destroy:
         ath10k_debug_destroy(ar);
 err_unregister_mac:
@@ -1143,16 +1315,7 @@ err:
 
 int ath10k_core_register(struct ath10k *ar, u32 chip_id)
 {
-        int status;
-
         ar->chip_id = chip_id;
-
-        status = ath10k_core_check_chip_id(ar);
-        if (status) {
-                ath10k_err(ar, "Unsupported chip id 0x%08x\n", ar->chip_id);
-                return status;
-        }
-
         queue_work(ar->workqueue, &ar->register_work);
 
         return 0;
@@ -1166,6 +1329,7 @@ void ath10k_core_unregister(struct ath10k *ar)
         if (!test_bit(ATH10K_FLAG_CORE_REGISTERED, &ar->dev_flags))
                 return;
 
+        ath10k_thermal_unregister(ar);
         /* Stop spectral before unregistering from mac80211 to remove the
          * relayfs debugfs file cleanly. Otherwise the parent debugfs tree
          * would be already be free'd recursively, leading to a double free.
@@ -1187,6 +1351,7 @@ EXPORT_SYMBOL(ath10k_core_unregister);
 
 struct ath10k *ath10k_core_create(size_t priv_size, struct device *dev,
                                   enum ath10k_bus bus,
+                                  enum ath10k_hw_rev hw_rev,
                                   const struct ath10k_hif_ops *hif_ops)
 {
         struct ath10k *ar;
@@ -1198,13 +1363,25 @@ struct ath10k *ath10k_core_create(size_t priv_size, struct device *dev,
 
         ar->ath_common.priv = ar;
         ar->ath_common.hw = ar->hw;
-
-        ar->p2p = !!ath10k_p2p;
         ar->dev = dev;
-
+        ar->hw_rev = hw_rev;
         ar->hif.ops = hif_ops;
         ar->hif.bus = bus;
 
+        switch (hw_rev) {
+        case ATH10K_HW_QCA988X:
+                ar->regs = &qca988x_regs;
+                break;
+        case ATH10K_HW_QCA6174:
+                ar->regs = &qca6174_regs;
+                break;
+        default:
+                ath10k_err(ar, "unsupported core hardware revision %d\n",
+                           hw_rev);
+                ret = -ENOTSUPP;
+                goto err_free_mac;
+        }
+
         init_completion(&ar->scan.started);
         init_completion(&ar->scan.completed);
         init_completion(&ar->scan.on_channel);
@@ -1212,6 +1389,7 @@ struct ath10k *ath10k_core_create(size_t priv_size, struct device *dev,
 
         init_completion(&ar->install_key_done);
         init_completion(&ar->vdev_setup_done);
+        init_completion(&ar->thermal.wmi_sync);
 
         INIT_DELAYED_WORK(&ar->scan.timeout, ath10k_scan_timeout_work);
 
diff --git a/drivers/net/wireless/ath/ath10k/core.h b/drivers/net/wireless/ath/ath10k/core.h
index 514c219263a5..d60e46fe6d19 100644
--- a/drivers/net/wireless/ath/ath10k/core.h
+++ b/drivers/net/wireless/ath/ath10k/core.h
@@ -34,6 +34,7 @@
 #include "../regd.h"
 #include "../dfs_pattern_detector.h"
 #include "spectral.h"
+#include "thermal.h"
 
 #define MS(_v, _f) (((_v) & _f##_MASK) >> _f##_LSB)
 #define SM(_v, _f) (((_v) << _f##_LSB) & _f##_MASK)
@@ -96,6 +97,11 @@ struct ath10k_skb_cb {
         } bcn;
 } __packed;
 
+struct ath10k_skb_rxcb {
+        dma_addr_t paddr;
+        struct hlist_node hlist;
+};
+
 static inline struct ath10k_skb_cb *ATH10K_SKB_CB(struct sk_buff *skb)
 {
         BUILD_BUG_ON(sizeof(struct ath10k_skb_cb) >
@@ -103,6 +109,15 @@ static inline struct ath10k_skb_cb *ATH10K_SKB_CB(struct sk_buff *skb)
         return (struct ath10k_skb_cb *)&IEEE80211_SKB_CB(skb)->driver_data;
 }
 
+static inline struct ath10k_skb_rxcb *ATH10K_SKB_RXCB(struct sk_buff *skb)
+{
+        BUILD_BUG_ON(sizeof(struct ath10k_skb_rxcb) > sizeof(skb->cb));
+        return (struct ath10k_skb_rxcb *)skb->cb;
+}
+
+#define ATH10K_RXCB_SKB(rxcb) \
+                container_of((void *)rxcb, struct sk_buff, cb)
+
 static inline u32 host_interest_item_address(u32 item_offset)
 {
         return QCA988X_HOST_INTEREST_ADDRESS + item_offset;
@@ -120,6 +135,7 @@ struct ath10k_mem_chunk {
 };
 
 struct ath10k_wmi {
+        enum ath10k_fw_wmi_op_version op_version;
         enum ath10k_htc_ep_id eid;
         struct completion service_ready;
         struct completion unified_ready;
@@ -128,6 +144,7 @@ struct ath10k_wmi {
         struct wmi_cmd_map *cmd;
         struct wmi_vdev_param_map *vdev_param;
         struct wmi_pdev_param_map *pdev_param;
+        const struct wmi_ops *ops;
 
         u32 num_mem_chunks;
         struct ath10k_mem_chunk mem_chunks[WMI_MAX_MEM_REQS];
@@ -236,10 +253,21 @@ struct ath10k_sta {
         u32 smps;
 
         struct work_struct update_wk;
+
+#ifdef CONFIG_MAC80211_DEBUGFS
+        /* protected by conf_mutex */
+        bool aggr_mode;
+#endif
 };
 
 #define ATH10K_VDEV_SETUP_TIMEOUT_HZ (5*HZ)
 
+enum ath10k_beacon_state {
+        ATH10K_BEACON_SCHEDULED = 0,
+        ATH10K_BEACON_SENDING,
+        ATH10K_BEACON_SENT,
+};
+
 struct ath10k_vif {
         struct list_head list;
 
@@ -250,7 +278,7 @@ struct ath10k_vif {
         u32 dtim_period;
         struct sk_buff *beacon;
         /* protected by data_lock */
-        bool beacon_sent;
+        enum ath10k_beacon_state beacon_state;
         void *beacon_buf;
         dma_addr_t beacon_paddr;
 
@@ -263,10 +291,8 @@ struct ath10k_vif {
         u32 aid;
         u8 bssid[ETH_ALEN];
 
-        struct work_struct wep_key_work;
         struct ieee80211_key_conf *wep_keys[WMI_MAX_KEY_INDEX + 1];
-        u8 def_wep_key_idx;
-        u8 def_wep_key_newidx;
+        s8 def_wep_key_idx;
 
         u16 tx_seq_no;
 
@@ -293,6 +319,7 @@ struct ath10k_vif {
         bool use_cts_prot;
         int num_legacy_stations;
         int txpower;
+        struct wmi_wmm_params_all_arg wmm_params;
 };
 
 struct ath10k_vif_iter {
@@ -323,8 +350,10 @@ struct ath10k_debug {
 
         /* protected by conf_mutex */
         u32 fw_dbglog_mask;
+        u32 fw_dbglog_level;
         u32 pktlog_filter;
         u32 reg_addr;
+        u32 nf_cal_period;
 
         u8 htt_max_amsdu;
         u8 htt_max_ampdu;
@@ -369,7 +398,7 @@ enum ath10k_fw_features {
         /* wmi_mgmt_rx_hdr contains extra RSSI information */
         ATH10K_FW_FEATURE_EXT_WMI_MGMT_RX = 0,
 
-        /* firmware from 10X branch */
+        /* Firmware from 10X branch. Deprecated, don't use in new code. */
         ATH10K_FW_FEATURE_WMI_10X = 1,
 
         /* firmware support tx frame management over WMI, otherwise it's HTT */
@@ -378,8 +407,9 @@ enum ath10k_fw_features {
         /* Firmware does not support P2P */
         ATH10K_FW_FEATURE_NO_P2P = 3,
 
-        /* Firmware 10.2 feature bit. The ATH10K_FW_FEATURE_WMI_10X feature bit
-         * is required to be set as well.
+        /* Firmware 10.2 feature bit. The ATH10K_FW_FEATURE_WMI_10X feature
+         * bit is required to be set as well. Deprecated, don't use in new
+         * code.
          */
         ATH10K_FW_FEATURE_WMI_10_2 = 4,
 
@@ -401,6 +431,7 @@ enum ath10k_dev_flags {
 enum ath10k_cal_mode {
         ATH10K_CAL_MODE_FILE,
         ATH10K_CAL_MODE_OTP,
+        ATH10K_CAL_MODE_DT,
 };
 
 static inline const char *ath10k_cal_mode_str(enum ath10k_cal_mode mode)
@@ -410,6 +441,8 @@ static inline const char *ath10k_cal_mode_str(enum ath10k_cal_mode mode)
                 return "file";
         case ATH10K_CAL_MODE_OTP:
                 return "otp";
+        case ATH10K_CAL_MODE_DT:
+                return "dt";
         }
 
         return "unknown";
@@ -444,6 +477,7 @@ struct ath10k {
         struct device *dev;
         u8 mac_addr[ETH_ALEN];
 
+        enum ath10k_hw_rev hw_rev;
         u32 chip_id;
         u32 target_version;
         u8 fw_version_major;
@@ -459,9 +493,6 @@ struct ath10k {
 
         DECLARE_BITMAP(fw_features, ATH10K_FW_FEATURE_COUNT);
 
-        struct targetdef *targetdef;
-        struct hostdef *hostdef;
-
         bool p2p;
 
         struct {
@@ -471,6 +502,7 @@ struct ath10k {
 
         struct completion target_suspend;
 
+        const struct ath10k_hw_regs *regs;
         struct ath10k_bmi bmi;
         struct ath10k_wmi wmi;
         struct ath10k_htc htc;
@@ -480,12 +512,15 @@ struct ath10k {
                 u32 id;
                 const char *name;
                 u32 patch_load_addr;
+                int uart_pin;
 
                 struct ath10k_hw_params_fw {
                         const char *dir;
                         const char *fw;
                         const char *otp;
                         const char *board;
+                        size_t board_size;
+                        size_t board_ext_size;
                 } fw;
         } hw_params;
 
@@ -548,7 +583,6 @@ struct ath10k {
         u8 cfg_tx_chainmask;
         u8 cfg_rx_chainmask;
 
-        struct wmi_pdev_set_wmm_params_arg wmm_params;
         struct completion install_key_done;
 
         struct completion vdev_setup_done;
@@ -571,6 +605,7 @@ struct ath10k {
 
         int max_num_peers;
         int max_num_stations;
+        int max_num_vdevs;
 
         struct work_struct offchan_tx_work;
         struct sk_buff_head offchan_tx_queue;
@@ -610,6 +645,7 @@ struct ath10k {
                 /* protected by conf_mutex */
                 const struct firmware *utf;
                 DECLARE_BITMAP(orig_fw_features, ATH10K_FW_FEATURE_COUNT);
+                enum ath10k_fw_wmi_op_version orig_wmi_op_version;
 
                 /* protected by data_lock */
                 bool utf_monitor;
@@ -622,12 +658,15 @@ struct ath10k {
                 u32 fw_cold_reset_counter;
         } stats;
 
+        struct ath10k_thermal thermal;
+
         /* must be last */
         u8 drv_priv[0] __aligned(sizeof(void *));
 };
 
 struct ath10k *ath10k_core_create(size_t priv_size, struct device *dev,
                                   enum ath10k_bus bus,
+                                  enum ath10k_hw_rev hw_rev,
                                   const struct ath10k_hif_ops *hif_ops);
 void ath10k_core_destroy(struct ath10k *ar);
 
diff --git a/drivers/net/wireless/ath/ath10k/debug.c b/drivers/net/wireless/ath/ath10k/debug.c
index a716758f14b0..d2281e5c2ffe 100644
--- a/drivers/net/wireless/ath/ath10k/debug.c
+++ b/drivers/net/wireless/ath/ath10k/debug.c
@@ -23,6 +23,7 @@
 #include "core.h"
 #include "debug.h"
 #include "hif.h"
+#include "wmi-ops.h"
 
 /* ms */
 #define ATH10K_DEBUG_HTT_STATS_INTERVAL 1000
@@ -123,7 +124,7 @@ EXPORT_SYMBOL(ath10k_info);
 
 void ath10k_print_driver_info(struct ath10k *ar)
 {
-        ath10k_info(ar, "%s (0x%08x, 0x%08x) fw %s api %d htt %d.%d wmi %d.%d.%d.%d cal %s max_sta %d\n",
+        ath10k_info(ar, "%s (0x%08x, 0x%08x) fw %s api %d htt %d.%d wmi %d cal %s max_sta %d\n",
                     ar->hw_params.name,
                     ar->target_version,
                     ar->chip_id,
@@ -131,10 +132,7 @@ void ath10k_print_driver_info(struct ath10k *ar)
                     ar->fw_api,
                     ar->htt.target_version_major,
                     ar->htt.target_version_minor,
-                    ar->fw_version_major,
-                    ar->fw_version_minor,
-                    ar->fw_version_release,
-                    ar->fw_version_build,
+                    ar->wmi.op_version,
                     ath10k_cal_mode_str(ar->cal_mode),
                     ar->max_num_stations);
         ath10k_info(ar, "debug %d debugfs %d tracing %d dfs %d testmode %d\n",
@@ -373,7 +371,7 @@ static int ath10k_debug_fw_stats_request(struct ath10k *ar)
 
                 ret = wait_for_completion_timeout(&ar->debug.fw_stats_complete,
                                                   1*HZ);
-                if (ret <= 0)
+                if (ret == 0)
                         return -ETIMEDOUT;
 
                 spin_lock_bh(&ar->data_lock);
@@ -1320,10 +1318,10 @@ static ssize_t ath10k_read_fw_dbglog(struct file *file,
 {
         struct ath10k *ar = file->private_data;
         unsigned int len;
-        char buf[32];
+        char buf[64];
 
-        len = scnprintf(buf, sizeof(buf), "0x%08x\n",
-                        ar->debug.fw_dbglog_mask);
+        len = scnprintf(buf, sizeof(buf), "0x%08x %u\n",
+                        ar->debug.fw_dbglog_mask, ar->debug.fw_dbglog_level);
 
         return simple_read_from_buffer(user_buf, count, ppos, buf, len);
 }
@@ -1333,19 +1331,32 @@ static ssize_t ath10k_write_fw_dbglog(struct file *file,
                                       size_t count, loff_t *ppos)
 {
         struct ath10k *ar = file->private_data;
-        unsigned long mask;
         int ret;
+        char buf[64];
+        unsigned int log_level, mask;
 
-        ret = kstrtoul_from_user(user_buf, count, 0, &mask);
-        if (ret)
-                return ret;
+        simple_write_to_buffer(buf, sizeof(buf) - 1, ppos, user_buf, count);
+
+        /* make sure that buf is null terminated */
+        buf[sizeof(buf) - 1] = 0;
+
+        ret = sscanf(buf, "%x %u", &mask, &log_level);
+
+        if (!ret)
+                return -EINVAL;
+
+        if (ret == 1)
+                /* default if user did not specify */
+                log_level = ATH10K_DBGLOG_LEVEL_WARN;
 
         mutex_lock(&ar->conf_mutex);
 
         ar->debug.fw_dbglog_mask = mask;
+        ar->debug.fw_dbglog_level = log_level;
 
         if (ar->state == ATH10K_STATE_ON) {
-                ret = ath10k_wmi_dbglog_cfg(ar, ar->debug.fw_dbglog_mask);
+                ret = ath10k_wmi_dbglog_cfg(ar, ar->debug.fw_dbglog_mask,
+                                            ar->debug.fw_dbglog_level);
                 if (ret) {
                         ath10k_warn(ar, "dbglog cfg failed from debugfs: %d\n",
                                     ret);
@@ -1607,6 +1618,73 @@ static const struct file_operations fops_cal_data = {
         .llseek = default_llseek,
 };
 
+static ssize_t ath10k_read_nf_cal_period(struct file *file,
+                                         char __user *user_buf,
+                                         size_t count, loff_t *ppos)
+{
+        struct ath10k *ar = file->private_data;
+        unsigned int len;
+        char buf[32];
+
+        len = scnprintf(buf, sizeof(buf), "%d\n",
+                        ar->debug.nf_cal_period);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static ssize_t ath10k_write_nf_cal_period(struct file *file,
+                                          const char __user *user_buf,
+                                          size_t count, loff_t *ppos)
+{
+        struct ath10k *ar = file->private_data;
+        unsigned long period;
+        int ret;
+
+        ret = kstrtoul_from_user(user_buf, count, 0, &period);
+        if (ret)
+                return ret;
+
+        if (period > WMI_PDEV_PARAM_CAL_PERIOD_MAX)
+                return -EINVAL;
+
+        /* there's no way to switch back to the firmware default */
+        if (period == 0)
+                return -EINVAL;
+
+        mutex_lock(&ar->conf_mutex);
+
+        ar->debug.nf_cal_period = period;
+
+        if (ar->state != ATH10K_STATE_ON) {
+                /* firmware is not running, nothing else to do */
+                ret = count;
+                goto exit;
+        }
+
+        ret = ath10k_wmi_pdev_set_param(ar, ar->wmi.pdev_param->cal_period,
+                                        ar->debug.nf_cal_period);
+        if (ret) {
+                ath10k_warn(ar, "cal period cfg failed from debugfs: %d\n",
+                            ret);
+                goto exit;
+        }
+
+        ret = count;
+
+exit:
+        mutex_unlock(&ar->conf_mutex);
+
+        return ret;
+}
+
+static const struct file_operations fops_nf_cal_period = {
+        .read = ath10k_read_nf_cal_period,
+        .write = ath10k_write_nf_cal_period,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
 int ath10k_debug_start(struct ath10k *ar)
 {
         int ret;
@@ -1620,7 +1698,8 @@ int ath10k_debug_start(struct ath10k *ar)
                             ret);
 
         if (ar->debug.fw_dbglog_mask) {
-                ret = ath10k_wmi_dbglog_cfg(ar, ar->debug.fw_dbglog_mask);
+                ret = ath10k_wmi_dbglog_cfg(ar, ar->debug.fw_dbglog_mask,
+                                            ATH10K_DBGLOG_LEVEL_WARN);
                 if (ret)
                         /* not serious */
                         ath10k_warn(ar, "failed to enable dbglog during start: %d",
@@ -1642,6 +1721,16 @@ int ath10k_debug_start(struct ath10k *ar)
                         ath10k_warn(ar, "failed to disable pktlog: %d\n", ret);
         }
 
+        if (ar->debug.nf_cal_period) {
+                ret = ath10k_wmi_pdev_set_param(ar,
+                                                ar->wmi.pdev_param->cal_period,
+                                                ar->debug.nf_cal_period);
+                if (ret)
+                        /* not serious */
+                        ath10k_warn(ar, "cal period cfg failed from debug start: %d\n",
+                                    ret);
+        }
+
         return ret;
 }
 
@@ -1880,6 +1969,9 @@ int ath10k_debug_register(struct ath10k *ar)
         debugfs_create_file("cal_data", S_IRUSR, ar->debug.debugfs_phy,
                             ar, &fops_cal_data);
 
+        debugfs_create_file("nf_cal_period", S_IRUSR | S_IWUSR,
+                            ar->debug.debugfs_phy, ar, &fops_nf_cal_period);
+
         if (config_enabled(CONFIG_ATH10K_DFS_CERTIFIED)) {
                 debugfs_create_file("dfs_simulate_radar", S_IWUSR,
                                     ar->debug.debugfs_phy, ar,
diff --git a/drivers/net/wireless/ath/ath10k/debug.h b/drivers/net/wireless/ath/ath10k/debug.h
index 1b87a5dbec53..a12b8323f9f1 100644
--- a/drivers/net/wireless/ath/ath10k/debug.h
+++ b/drivers/net/wireless/ath/ath10k/debug.h
@@ -48,6 +48,12 @@ enum ath10k_pktlog_filter {
         ATH10K_PKTLOG_ANY        = 0x00000001f,
 };
 
+enum ath10k_dbg_aggr_mode {
+        ATH10K_DBG_AGGR_MODE_AUTO,
+        ATH10K_DBG_AGGR_MODE_MANUAL,
+        ATH10K_DBG_AGGR_MODE_MAX,
+};
+
 extern unsigned int ath10k_debug_mask;
 
 __printf(2, 3) void ath10k_info(struct ath10k *ar, const char *fmt, ...);
@@ -77,7 +83,6 @@ int ath10k_debug_get_et_sset_count(struct ieee80211_hw *hw,
 void ath10k_debug_get_et_stats(struct ieee80211_hw *hw,
                                struct ieee80211_vif *vif,
                                struct ethtool_stats *stats, u64 *data);
-
 #else
 static inline int ath10k_debug_start(struct ath10k *ar)
 {
@@ -129,6 +134,10 @@ ath10k_debug_get_new_fw_crash_data(struct ath10k *ar)
 #define ath10k_debug_get_et_stats NULL
 
 #endif /* CONFIG_ATH10K_DEBUGFS */
+#ifdef CONFIG_MAC80211_DEBUGFS
+void ath10k_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                            struct ieee80211_sta *sta, struct dentry *dir);
+#endif /* CONFIG_MAC80211_DEBUGFS */
 
 #ifdef CONFIG_ATH10K_DEBUG
 __printf(3, 4) void ath10k_dbg(struct ath10k *ar,
diff --git a/drivers/net/wireless/ath/ath10k/debugfs_sta.c b/drivers/net/wireless/ath/ath10k/debugfs_sta.c
new file mode 100644
index 000000000000..95b5c49374e0
--- /dev/null
+++ b/drivers/net/wireless/ath/ath10k/debugfs_sta.c
@@ -0,0 +1,243 @@
+/*
+ * Copyright (c) 2014 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "core.h"
+#include "wmi-ops.h"
+#include "debug.h"
+
+static ssize_t ath10k_dbg_sta_read_aggr_mode(struct file *file,
+                                             char __user *user_buf,
+                                             size_t count, loff_t *ppos)
+{
+        struct ieee80211_sta *sta = file->private_data;
+        struct ath10k_sta *arsta = (struct ath10k_sta *)sta->drv_priv;
+        struct ath10k *ar = arsta->arvif->ar;
+        char buf[32];
+        int len = 0;
+
+        mutex_lock(&ar->conf_mutex);
+        len = scnprintf(buf, sizeof(buf) - len, "aggregation mode: %s\n",
+                        (arsta->aggr_mode == ATH10K_DBG_AGGR_MODE_AUTO) ?
+                        "auto" : "manual");
+        mutex_unlock(&ar->conf_mutex);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static ssize_t ath10k_dbg_sta_write_aggr_mode(struct file *file,
+                                              const char __user *user_buf,
+                                              size_t count, loff_t *ppos)
+{
+        struct ieee80211_sta *sta = file->private_data;
+        struct ath10k_sta *arsta = (struct ath10k_sta *)sta->drv_priv;
+        struct ath10k *ar = arsta->arvif->ar;
+        u32 aggr_mode;
+        int ret;
+
+        if (kstrtouint_from_user(user_buf, count, 0, &aggr_mode))
+                return -EINVAL;
+
+        if (aggr_mode >= ATH10K_DBG_AGGR_MODE_MAX)
+                return -EINVAL;
+
+        mutex_lock(&ar->conf_mutex);
+        if ((ar->state != ATH10K_STATE_ON) ||
+            (aggr_mode == arsta->aggr_mode)) {
+                ret = count;
+                goto out;
+        }
+
+        ret = ath10k_wmi_addba_clear_resp(ar, arsta->arvif->vdev_id, sta->addr);
+        if (ret) {
+                ath10k_warn(ar, "failed to clear addba session ret: %d\n", ret);
+                goto out;
+        }
+
+        arsta->aggr_mode = aggr_mode;
+out:
+        mutex_unlock(&ar->conf_mutex);
+        return ret;
+}
+
+static const struct file_operations fops_aggr_mode = {
+        .read = ath10k_dbg_sta_read_aggr_mode,
+        .write = ath10k_dbg_sta_write_aggr_mode,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+static ssize_t ath10k_dbg_sta_write_addba(struct file *file,
+                                          const char __user *user_buf,
+                                          size_t count, loff_t *ppos)
+{
+        struct ieee80211_sta *sta = file->private_data;
+        struct ath10k_sta *arsta = (struct ath10k_sta *)sta->drv_priv;
+        struct ath10k *ar = arsta->arvif->ar;
+        u32 tid, buf_size;
+        int ret;
+        char buf[64];
+
+        simple_write_to_buffer(buf, sizeof(buf) - 1, ppos, user_buf, count);
+
+        /* make sure that buf is null terminated */
+        buf[sizeof(buf) - 1] = '\0';
+
+        ret = sscanf(buf, "%u %u", &tid, &buf_size);
+        if (ret != 2)
+                return -EINVAL;
+
+        /* Valid TID values are 0 through 15 */
+        if (tid > HTT_DATA_TX_EXT_TID_MGMT - 2)
+                return -EINVAL;
+
+        mutex_lock(&ar->conf_mutex);
+        if ((ar->state != ATH10K_STATE_ON) ||
+            (arsta->aggr_mode != ATH10K_DBG_AGGR_MODE_MANUAL)) {
+                ret = count;
+                goto out;
+        }
+
+        ret = ath10k_wmi_addba_send(ar, arsta->arvif->vdev_id, sta->addr,
+                                    tid, buf_size);
+        if (ret) {
+                ath10k_warn(ar, "failed to send addba request: vdev_id %u peer %pM tid %u buf_size %u\n",
+                            arsta->arvif->vdev_id, sta->addr, tid, buf_size);
+        }
+
+        ret = count;
+out:
+        mutex_unlock(&ar->conf_mutex);
+        return ret;
+}
+
+static const struct file_operations fops_addba = {
+        .write = ath10k_dbg_sta_write_addba,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+static ssize_t ath10k_dbg_sta_write_addba_resp(struct file *file,
+                                               const char __user *user_buf,
+                                               size_t count, loff_t *ppos)
+{
+        struct ieee80211_sta *sta = file->private_data;
+        struct ath10k_sta *arsta = (struct ath10k_sta *)sta->drv_priv;
+        struct ath10k *ar = arsta->arvif->ar;
+        u32 tid, status;
+        int ret;
+        char buf[64];
+
+        simple_write_to_buffer(buf, sizeof(buf) - 1, ppos, user_buf, count);
+
+        /* make sure that buf is null terminated */
+        buf[sizeof(buf) - 1] = '\0';
+
+        ret = sscanf(buf, "%u %u", &tid, &status);
+        if (ret != 2)
+                return -EINVAL;
+
+        /* Valid TID values are 0 through 15 */
+        if (tid > HTT_DATA_TX_EXT_TID_MGMT - 2)
+                return -EINVAL;
+
+        mutex_lock(&ar->conf_mutex);
+        if ((ar->state != ATH10K_STATE_ON) ||
+            (arsta->aggr_mode != ATH10K_DBG_AGGR_MODE_MANUAL)) {
+                ret = count;
+                goto out;
+        }
+
+        ret = ath10k_wmi_addba_set_resp(ar, arsta->arvif->vdev_id, sta->addr,
+                                        tid, status);
+        if (ret) {
+                ath10k_warn(ar, "failed to send addba response: vdev_id %u peer %pM tid %u status%u\n",
+                            arsta->arvif->vdev_id, sta->addr, tid, status);
+        }
+        ret = count;
+out:
+        mutex_unlock(&ar->conf_mutex);
+        return ret;
+}
+
+static const struct file_operations fops_addba_resp = {
+        .write = ath10k_dbg_sta_write_addba_resp,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+static ssize_t ath10k_dbg_sta_write_delba(struct file *file,
+                                          const char __user *user_buf,
+                                          size_t count, loff_t *ppos)
+{
+        struct ieee80211_sta *sta = file->private_data;
+        struct ath10k_sta *arsta = (struct ath10k_sta *)sta->drv_priv;
+        struct ath10k *ar = arsta->arvif->ar;
+        u32 tid, initiator, reason;
+        int ret;
+        char buf[64];
+
+        simple_write_to_buffer(buf, sizeof(buf) - 1, ppos, user_buf, count);
+
+        /* make sure that buf is null terminated */
+        buf[sizeof(buf) - 1] = '\0';
+
+        ret = sscanf(buf, "%u %u %u", &tid, &initiator, &reason);
+        if (ret != 3)
+                return -EINVAL;
+
+        /* Valid TID values are 0 through 15 */
+        if (tid > HTT_DATA_TX_EXT_TID_MGMT - 2)
+                return -EINVAL;
+
+        mutex_lock(&ar->conf_mutex);
+        if ((ar->state != ATH10K_STATE_ON) ||
+            (arsta->aggr_mode != ATH10K_DBG_AGGR_MODE_MANUAL)) {
+                ret = count;
+                goto out;
+        }
+
+        ret = ath10k_wmi_delba_send(ar, arsta->arvif->vdev_id, sta->addr,
+                                    tid, initiator, reason);
+        if (ret) {
+                ath10k_warn(ar, "failed to send delba: vdev_id %u peer %pM tid %u initiator %u reason %u\n",
+                            arsta->arvif->vdev_id, sta->addr, tid, initiator,
+                            reason);
+        }
+        ret = count;
+out:
+        mutex_unlock(&ar->conf_mutex);
+        return ret;
+}
+
+static const struct file_operations fops_delba = {
+        .write = ath10k_dbg_sta_write_delba,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+void ath10k_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                            struct ieee80211_sta *sta, struct dentry *dir)
+{
+        debugfs_create_file("aggr_mode", S_IRUGO | S_IWUSR, dir, sta,
+                            &fops_aggr_mode);
+        debugfs_create_file("addba", S_IWUSR, dir, sta, &fops_addba);
+        debugfs_create_file("addba_resp", S_IWUSR, dir, sta, &fops_addba_resp);
+        debugfs_create_file("delba", S_IWUSR, dir, sta, &fops_delba);
+}
diff --git a/drivers/net/wireless/ath/ath10k/htc.c b/drivers/net/wireless/ath/ath10k/htc.c
index f1946a6be442..2fd9e180272b 100644
--- a/drivers/net/wireless/ath/ath10k/htc.c
+++ b/drivers/net/wireless/ath/ath10k/htc.c
@@ -703,11 +703,9 @@ int ath10k_htc_connect_service(struct ath10k_htc *htc,
         /* wait for response */
         status = wait_for_completion_timeout(&htc->ctl_resp,
                                              ATH10K_HTC_CONN_SVC_TIMEOUT_HZ);
-        if (status <= 0) {
-                if (status == 0)
-                        status = -ETIMEDOUT;
+        if (status == 0) {
                 ath10k_err(ar, "Service connect timeout: %d\n", status);
-                return status;
+                return -ETIMEDOUT;
         }
 
         /* we controlled the buffer creation, it's aligned */
diff --git a/drivers/net/wireless/ath/ath10k/htt.c b/drivers/net/wireless/ath/ath10k/htt.c
index 56cb4aceb383..4f59ab923e48 100644
--- a/drivers/net/wireless/ath/ath10k/htt.c
+++ b/drivers/net/wireless/ath/ath10k/htt.c
@@ -53,7 +53,6 @@ int ath10k_htt_init(struct ath10k *ar)
         struct ath10k_htt *htt = &ar->htt;
 
         htt->ar = ar;
-        htt->max_throughput_mbps = 800;
 
         /*
          * Prefetch enough data to satisfy target
@@ -102,7 +101,7 @@ int ath10k_htt_setup(struct ath10k_htt *htt)
 
         status = wait_for_completion_timeout(&htt->target_version_received,
                                              HTT_TARGET_VERSION_TIMEOUT_HZ);
-        if (status <= 0) {
+        if (status == 0) {
                 ath10k_warn(ar, "htt version request timed out\n");
                 return -ETIMEDOUT;
         }
diff --git a/drivers/net/wireless/ath/ath10k/htt.h b/drivers/net/wireless/ath/ath10k/htt.h
index 1bd5545af903..874bf44ff7a2 100644
--- a/drivers/net/wireless/ath/ath10k/htt.h
+++ b/drivers/net/wireless/ath/ath10k/htt.h
@@ -21,6 +21,7 @@
 #include <linux/bug.h>
 #include <linux/interrupt.h>
 #include <linux/dmapool.h>
+#include <linux/hashtable.h>
 #include <net/mac80211.h>
 
 #include "htc.h"
@@ -286,7 +287,19 @@ enum htt_t2h_msg_type {
         HTT_T2H_MSG_TYPE_RC_UPDATE_IND          = 0xc,
         HTT_T2H_MSG_TYPE_TX_INSPECT_IND         = 0xd,
         HTT_T2H_MSG_TYPE_MGMT_TX_COMPLETION     = 0xe,
+        HTT_T2H_MSG_TYPE_TX_CREDIT_UPDATE_IND   = 0xf,
+        HTT_T2H_MSG_TYPE_RX_PN_IND              = 0x10,
+        HTT_T2H_MSG_TYPE_RX_OFFLOAD_DELIVER_IND = 0x11,
+        HTT_T2H_MSG_TYPE_RX_IN_ORD_PADDR_IND    = 0x12,
+        /* 0x13 reservd */
+        HTT_T2H_MSG_TYPE_WDI_IPA_OP_RESPONSE    = 0x14,
+
+        /* FIXME: Do not depend on this event id. Numbering of this event id is
+         * broken across different firmware revisions and HTT version fails to
+         * indicate this.
+         */
         HTT_T2H_MSG_TYPE_TEST,
+
         /* keep this last */
         HTT_T2H_NUM_MSGS
 };
@@ -655,6 +668,53 @@ struct htt_rx_fragment_indication {
 #define HTT_RX_FRAG_IND_INFO1_FLUSH_SEQ_NUM_END_MASK   0x00000FC0
 #define HTT_RX_FRAG_IND_INFO1_FLUSH_SEQ_NUM_END_LSB    6
 
+struct htt_rx_pn_ind {
+        __le16 peer_id;
+        u8 tid;
+        u8 seqno_start;
+        u8 seqno_end;
+        u8 pn_ie_count;
+        u8 reserved;
+        u8 pn_ies[0];
+} __packed;
+
+struct htt_rx_offload_msdu {
+        __le16 msdu_len;
+        __le16 peer_id;
+        u8 vdev_id;
+        u8 tid;
+        u8 fw_desc;
+        u8 payload[0];
+} __packed;
+
+struct htt_rx_offload_ind {
+        u8 reserved;
+        __le16 msdu_count;
+} __packed;
+
+struct htt_rx_in_ord_msdu_desc {
+        __le32 msdu_paddr;
+        __le16 msdu_len;
+        u8 fw_desc;
+        u8 reserved;
+} __packed;
+
+struct htt_rx_in_ord_ind {
+        u8 info;
+        __le16 peer_id;
+        u8 vdev_id;
+        u8 reserved;
+        __le16 msdu_count;
+        struct htt_rx_in_ord_msdu_desc msdu_descs[0];
+} __packed;
+
+#define HTT_RX_IN_ORD_IND_INFO_TID_MASK         0x0000001f
+#define HTT_RX_IN_ORD_IND_INFO_TID_LSB          0
+#define HTT_RX_IN_ORD_IND_INFO_OFFLOAD_MASK     0x00000020
+#define HTT_RX_IN_ORD_IND_INFO_OFFLOAD_LSB      5
+#define HTT_RX_IN_ORD_IND_INFO_FRAG_MASK        0x00000040
+#define HTT_RX_IN_ORD_IND_INFO_FRAG_LSB         6
+
 /*
  * target -> host test message definition
  *
@@ -1150,6 +1210,9 @@ struct htt_resp {
                 struct htt_rx_test rx_test;
                 struct htt_pktlog_msg pktlog_msg;
                 struct htt_stats_conf stats_conf;
+                struct htt_rx_pn_ind rx_pn_ind;
+                struct htt_rx_offload_ind rx_offload_ind;
+                struct htt_rx_in_ord_ind rx_in_ord_ind;
         };
 } __packed;
 
@@ -1182,7 +1245,6 @@ struct ath10k_htt {
         struct ath10k *ar;
         enum ath10k_htc_ep_id eid;
 
-        int max_throughput_mbps;
         u8 target_version_major;
         u8 target_version_minor;
         struct completion target_version_received;
@@ -1198,6 +1260,20 @@ struct ath10k_htt {
                  * filled.
                  */
                 struct sk_buff **netbufs_ring;
+
+                /* This is used only with firmware supporting IN_ORD_IND.
+                 *
+                 * With Full Rx Reorder the HTT Rx Ring is more of a temporary
+                 * buffer ring from which buffer addresses are copied by the
+                 * firmware to MAC Rx ring. Firmware then delivers IN_ORD_IND
+                 * pointing to specific (re-ordered) buffers.
+                 *
+                 * FIXME: With kernel generic hashing functions there's a lot
+                 * of hash collisions for sk_buffs.
+                 */
+                bool in_ord_rx;
+                DECLARE_HASHTABLE(skb_table, 4);
+
                 /*
                  * Ring of buffer addresses -
                  * This ring holds the "physical" device address of the
@@ -1252,12 +1328,11 @@ struct ath10k_htt {
 
         unsigned int prefetch_len;
 
-        /* Protects access to %pending_tx, %used_msdu_ids */
+        /* Protects access to pending_tx, num_pending_tx */
         spinlock_t tx_lock;
         int max_num_pending_tx;
         int num_pending_tx;
-        struct sk_buff **pending_tx;
-        unsigned long *used_msdu_ids; /* bitmap */
+        struct idr pending_tx;
         wait_queue_head_t empty_tx_wq;
         struct dma_pool *tx_pool;
 
@@ -1271,6 +1346,7 @@ struct ath10k_htt {
         struct tasklet_struct txrx_compl_task;
         struct sk_buff_head tx_compl_q;
         struct sk_buff_head rx_compl_q;
+        struct sk_buff_head rx_in_ord_compl_q;
 
         /* rx_status template */
         struct ieee80211_rx_status rx_status;
@@ -1334,6 +1410,7 @@ int ath10k_htt_tx_alloc(struct ath10k_htt *htt);
 void ath10k_htt_tx_free(struct ath10k_htt *htt);
 
 int ath10k_htt_rx_alloc(struct ath10k_htt *htt);
+int ath10k_htt_rx_ring_refill(struct ath10k *ar);
 void ath10k_htt_rx_free(struct ath10k_htt *htt);
 
 void ath10k_htt_htc_tx_complete(struct ath10k *ar, struct sk_buff *skb);
@@ -1346,7 +1423,7 @@ int ath10k_htt_h2t_aggr_cfg_msg(struct ath10k_htt *htt,
                                 u8 max_subfrms_amsdu);
 
 void __ath10k_htt_tx_dec_pending(struct ath10k_htt *htt);
-int ath10k_htt_tx_alloc_msdu_id(struct ath10k_htt *htt);
+int ath10k_htt_tx_alloc_msdu_id(struct ath10k_htt *htt, struct sk_buff *skb);
 void ath10k_htt_tx_free_msdu_id(struct ath10k_htt *htt, u16 msdu_id);
 int ath10k_htt_mgmt_tx(struct ath10k_htt *htt, struct sk_buff *);
 int ath10k_htt_tx(struct ath10k_htt *htt, struct sk_buff *);
diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
index 9c782a42665e..c1da44f65a4d 100644
--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
@@ -25,8 +25,8 @@
 
 #include <linux/log2.h>
 
-#define HTT_RX_RING_SIZE 1024
-#define HTT_RX_RING_FILL_LEVEL 1000
+#define HTT_RX_RING_SIZE HTT_RX_RING_SIZE_MAX
+#define HTT_RX_RING_FILL_LEVEL (((HTT_RX_RING_SIZE) / 2) - 1)
 
 /* when under memory pressure rx ring refill may fail and needs a retry */
 #define HTT_RX_RING_REFILL_RETRY_MS 50
@@ -34,31 +34,70 @@
 static int ath10k_htt_rx_get_csum_state(struct sk_buff *skb);
 static void ath10k_htt_txrx_compl_task(unsigned long ptr);
 
+static struct sk_buff *
+ath10k_htt_rx_find_skb_paddr(struct ath10k *ar, u32 paddr)
+{
+        struct ath10k_skb_rxcb *rxcb;
+
+        hash_for_each_possible(ar->htt.rx_ring.skb_table, rxcb, hlist, paddr)
+                if (rxcb->paddr == paddr)
+                        return ATH10K_RXCB_SKB(rxcb);
+
+        WARN_ON_ONCE(1);
+        return NULL;
+}
+
 static void ath10k_htt_rx_ring_free(struct ath10k_htt *htt)
 {
         struct sk_buff *skb;
-        struct ath10k_skb_cb *cb;
+        struct ath10k_skb_rxcb *rxcb;
+        struct hlist_node *n;
         int i;
 
-        for (i = 0; i < htt->rx_ring.fill_cnt; i++) {
-                skb = htt->rx_ring.netbufs_ring[i];
-                cb = ATH10K_SKB_CB(skb);
-                dma_unmap_single(htt->ar->dev, cb->paddr,
-                                 skb->len + skb_tailroom(skb),
-                                 DMA_FROM_DEVICE);
-                dev_kfree_skb_any(skb);
+        if (htt->rx_ring.in_ord_rx) {
+                hash_for_each_safe(htt->rx_ring.skb_table, i, n, rxcb, hlist) {
+                        skb = ATH10K_RXCB_SKB(rxcb);
+                        dma_unmap_single(htt->ar->dev, rxcb->paddr,
+                                         skb->len + skb_tailroom(skb),
+                                         DMA_FROM_DEVICE);
+                        hash_del(&rxcb->hlist);
+                        dev_kfree_skb_any(skb);
+                }
+        } else {
+                for (i = 0; i < htt->rx_ring.size; i++) {
+                        skb = htt->rx_ring.netbufs_ring[i];
+                        if (!skb)
+                                continue;
+
+                        rxcb = ATH10K_SKB_RXCB(skb);
+                        dma_unmap_single(htt->ar->dev, rxcb->paddr,
+                                         skb->len + skb_tailroom(skb),
+                                         DMA_FROM_DEVICE);
+                        dev_kfree_skb_any(skb);
+                }
         }
 
         htt->rx_ring.fill_cnt = 0;
+        hash_init(htt->rx_ring.skb_table);
+        memset(htt->rx_ring.netbufs_ring, 0,
+               htt->rx_ring.size * sizeof(htt->rx_ring.netbufs_ring[0]));
 }
 
 static int __ath10k_htt_rx_ring_fill_n(struct ath10k_htt *htt, int num)
 {
         struct htt_rx_desc *rx_desc;
+        struct ath10k_skb_rxcb *rxcb;
         struct sk_buff *skb;
         dma_addr_t paddr;
         int ret = 0, idx;
 
+        /* The Full Rx Reorder firmware has no way of telling the host
+         * implicitly when it copied HTT Rx Ring buffers to MAC Rx Ring.
+         * To keep things simple make sure ring is always half empty. This
+         * guarantees there'll be no replenishment overruns possible.
+         */
+        BUILD_BUG_ON(HTT_RX_RING_FILL_LEVEL >= HTT_RX_RING_SIZE / 2);
+
         idx = __le32_to_cpu(*htt->rx_ring.alloc_idx.vaddr);
         while (num > 0) {
                 skb = dev_alloc_skb(HTT_RX_BUF_SIZE + HTT_RX_DESC_ALIGN);
@@ -86,17 +125,29 @@ static int __ath10k_htt_rx_ring_fill_n(struct ath10k_htt *htt, int num)
                         goto fail;
                 }
 
-                ATH10K_SKB_CB(skb)->paddr = paddr;
+                rxcb = ATH10K_SKB_RXCB(skb);
+                rxcb->paddr = paddr;
                 htt->rx_ring.netbufs_ring[idx] = skb;
                 htt->rx_ring.paddrs_ring[idx] = __cpu_to_le32(paddr);
                 htt->rx_ring.fill_cnt++;
 
+                if (htt->rx_ring.in_ord_rx) {
+                        hash_add(htt->rx_ring.skb_table,
+                                 &ATH10K_SKB_RXCB(skb)->hlist,
+                                 (u32)paddr);
+                }
+
                 num--;
                 idx++;
                 idx &= htt->rx_ring.size_mask;
         }
 
 fail:
+        /*
+         * Make sure the rx buffer is updated before available buffer
+         * index to avoid any potential rx ring corruption.
+         */
+        mb();
         *htt->rx_ring.alloc_idx.vaddr = __cpu_to_le32(idx);
         return ret;
 }
@@ -153,22 +204,20 @@ static void ath10k_htt_rx_ring_refill_retry(unsigned long arg)
         ath10k_htt_rx_msdu_buff_replenish(htt);
 }
 
-static void ath10k_htt_rx_ring_clean_up(struct ath10k_htt *htt)
+int ath10k_htt_rx_ring_refill(struct ath10k *ar)
 {
-        struct sk_buff *skb;
-        int i;
+        struct ath10k_htt *htt = &ar->htt;
+        int ret;
 
-        for (i = 0; i < htt->rx_ring.size; i++) {
-                skb = htt->rx_ring.netbufs_ring[i];
-                if (!skb)
-                        continue;
+        spin_lock_bh(&htt->rx_ring.lock);
+        ret = ath10k_htt_rx_ring_fill_n(htt, (htt->rx_ring.fill_level -
+                                              htt->rx_ring.fill_cnt));
+        spin_unlock_bh(&htt->rx_ring.lock);
 
-                dma_unmap_single(htt->ar->dev, ATH10K_SKB_CB(skb)->paddr,
-                                 skb->len + skb_tailroom(skb),
-                                 DMA_FROM_DEVICE);
-                dev_kfree_skb_any(skb);
-                htt->rx_ring.netbufs_ring[i] = NULL;
-        }
+        if (ret)
+                ath10k_htt_rx_ring_free(htt);
+
+        return ret;
 }
 
 void ath10k_htt_rx_free(struct ath10k_htt *htt)
@@ -179,8 +228,9 @@ void ath10k_htt_rx_free(struct ath10k_htt *htt)
 
         skb_queue_purge(&htt->tx_compl_q);
         skb_queue_purge(&htt->rx_compl_q);
+        skb_queue_purge(&htt->rx_in_ord_compl_q);
 
-        ath10k_htt_rx_ring_clean_up(htt);
+        ath10k_htt_rx_ring_free(htt);
 
         dma_free_coherent(htt->ar->dev,
                           (htt->rx_ring.size *
@@ -212,6 +262,7 @@ static inline struct sk_buff *ath10k_htt_rx_netbuf_pop(struct ath10k_htt *htt)
         idx = htt->rx_ring.sw_rd_idx.msdu_payld;
         msdu = htt->rx_ring.netbufs_ring[idx];
         htt->rx_ring.netbufs_ring[idx] = NULL;
+        htt->rx_ring.paddrs_ring[idx] = 0;
 
         idx++;
         idx &= htt->rx_ring.size_mask;
@@ -219,7 +270,7 @@ static inline struct sk_buff *ath10k_htt_rx_netbuf_pop(struct ath10k_htt *htt)
         htt->rx_ring.fill_cnt--;
 
         dma_unmap_single(htt->ar->dev,
-                         ATH10K_SKB_CB(msdu)->paddr,
+                         ATH10K_SKB_RXCB(msdu)->paddr,
                          msdu->len + skb_tailroom(msdu),
                          DMA_FROM_DEVICE);
         ath10k_dbg_dump(ar, ATH10K_DBG_HTT_DUMP, NULL, "htt rx netbuf pop: ",
@@ -379,6 +430,82 @@ static void ath10k_htt_rx_replenish_task(unsigned long ptr)
         ath10k_htt_rx_msdu_buff_replenish(htt);
 }
 
+static struct sk_buff *ath10k_htt_rx_pop_paddr(struct ath10k_htt *htt,
+                                               u32 paddr)
+{
+        struct ath10k *ar = htt->ar;
+        struct ath10k_skb_rxcb *rxcb;
+        struct sk_buff *msdu;
+
+        lockdep_assert_held(&htt->rx_ring.lock);
+
+        msdu = ath10k_htt_rx_find_skb_paddr(ar, paddr);
+        if (!msdu)
+                return NULL;
+
+        rxcb = ATH10K_SKB_RXCB(msdu);
+        hash_del(&rxcb->hlist);
+        htt->rx_ring.fill_cnt--;
+
+        dma_unmap_single(htt->ar->dev, rxcb->paddr,
+                         msdu->len + skb_tailroom(msdu),
+                         DMA_FROM_DEVICE);
+        ath10k_dbg_dump(ar, ATH10K_DBG_HTT_DUMP, NULL, "htt rx netbuf pop: ",
+                        msdu->data, msdu->len + skb_tailroom(msdu));
+
+        return msdu;
+}
+
+static int ath10k_htt_rx_pop_paddr_list(struct ath10k_htt *htt,
+                                        struct htt_rx_in_ord_ind *ev,
+                                        struct sk_buff_head *list)
+{
+        struct ath10k *ar = htt->ar;
+        struct htt_rx_in_ord_msdu_desc *msdu_desc = ev->msdu_descs;
+        struct htt_rx_desc *rxd;
+        struct sk_buff *msdu;
+        int msdu_count;
+        bool is_offload;
+        u32 paddr;
+
+        lockdep_assert_held(&htt->rx_ring.lock);
+
+        msdu_count = __le16_to_cpu(ev->msdu_count);
+        is_offload = !!(ev->info & HTT_RX_IN_ORD_IND_INFO_OFFLOAD_MASK);
+
+        while (msdu_count--) {
+                paddr = __le32_to_cpu(msdu_desc->msdu_paddr);
+
+                msdu = ath10k_htt_rx_pop_paddr(htt, paddr);
+                if (!msdu) {
+                        __skb_queue_purge(list);
+                        return -ENOENT;
+                }
+
+                __skb_queue_tail(list, msdu);
+
+                if (!is_offload) {
+                        rxd = (void *)msdu->data;
+
+                        trace_ath10k_htt_rx_desc(ar, rxd, sizeof(*rxd));
+
+                        skb_put(msdu, sizeof(*rxd));
+                        skb_pull(msdu, sizeof(*rxd));
+                        skb_put(msdu, __le16_to_cpu(msdu_desc->msdu_len));
+
+                        if (!(__le32_to_cpu(rxd->attention.flags) &
+                              RX_ATTENTION_FLAGS_MSDU_DONE)) {
+                                ath10k_warn(htt->ar, "tried to pop an incomplete frame, oops!\n");
+                                return -EIO;
+                        }
+                }
+
+                msdu_desc++;
+        }
+
+        return 0;
+}
+
 int ath10k_htt_rx_alloc(struct ath10k_htt *htt)
 {
         struct ath10k *ar = htt->ar;
@@ -424,7 +551,7 @@ int ath10k_htt_rx_alloc(struct ath10k_htt *htt)
 
         htt->rx_ring.alloc_idx.vaddr = vaddr;
         htt->rx_ring.alloc_idx.paddr = paddr;
-        htt->rx_ring.sw_rd_idx.msdu_payld = 0;
+        htt->rx_ring.sw_rd_idx.msdu_payld = htt->rx_ring.size_mask;
         *htt->rx_ring.alloc_idx.vaddr = 0;
 
         /* Initialize the Rx refill retry timer */
@@ -433,14 +560,15 @@ int ath10k_htt_rx_alloc(struct ath10k_htt *htt)
         spin_lock_init(&htt->rx_ring.lock);
 
         htt->rx_ring.fill_cnt = 0;
-        if (__ath10k_htt_rx_ring_fill_n(htt, htt->rx_ring.fill_level))
-                goto err_fill_ring;
+        htt->rx_ring.sw_rd_idx.msdu_payld = 0;
+        hash_init(htt->rx_ring.skb_table);
 
         tasklet_init(&htt->rx_replenish_task, ath10k_htt_rx_replenish_task,
                      (unsigned long)htt);
 
         skb_queue_head_init(&htt->tx_compl_q);
         skb_queue_head_init(&htt->rx_compl_q);
+        skb_queue_head_init(&htt->rx_in_ord_compl_q);
 
         tasklet_init(&htt->txrx_compl_task, ath10k_htt_txrx_compl_task,
                      (unsigned long)htt);
@@ -449,12 +577,6 @@ int ath10k_htt_rx_alloc(struct ath10k_htt *htt)
                    htt->rx_ring.size, htt->rx_ring.fill_level);
         return 0;
 
-err_fill_ring:
-        ath10k_htt_rx_ring_free(htt);
-        dma_free_coherent(htt->ar->dev,
-                          sizeof(*htt->rx_ring.alloc_idx.vaddr),
-                          htt->rx_ring.alloc_idx.vaddr,
-                          htt->rx_ring.alloc_idx.paddr);
 err_dma_idx:
         dma_free_coherent(htt->ar->dev,
                           (htt->rx_ring.size *
@@ -691,7 +813,7 @@ static void ath10k_htt_rx_h_mactime(struct ath10k *ar,
          *
          * FIXME: Can we get/compute 64bit TSF?
          */
-        status->mactime = __le32_to_cpu(rxd->ppdu_end.tsf_timestamp);
+        status->mactime = __le32_to_cpu(rxd->ppdu_end.common.tsf_timestamp);
         status->flag |= RX_FLAG_MACTIME_END;
 }
 
@@ -1578,6 +1700,194 @@ static void ath10k_htt_rx_delba(struct ath10k *ar, struct htt_resp *resp)
         spin_unlock_bh(&ar->data_lock);
 }
 
+static int ath10k_htt_rx_extract_amsdu(struct sk_buff_head *list,
+                                       struct sk_buff_head *amsdu)
+{
+        struct sk_buff *msdu;
+        struct htt_rx_desc *rxd;
+
+        if (skb_queue_empty(list))
+                return -ENOBUFS;
+
+        if (WARN_ON(!skb_queue_empty(amsdu)))
+                return -EINVAL;
+
+        while ((msdu = __skb_dequeue(list))) {
+                __skb_queue_tail(amsdu, msdu);
+
+                rxd = (void *)msdu->data - sizeof(*rxd);
+                if (rxd->msdu_end.info0 &
+                    __cpu_to_le32(RX_MSDU_END_INFO0_LAST_MSDU))
+                        break;
+        }
+
+        msdu = skb_peek_tail(amsdu);
+        rxd = (void *)msdu->data - sizeof(*rxd);
+        if (!(rxd->msdu_end.info0 &
+              __cpu_to_le32(RX_MSDU_END_INFO0_LAST_MSDU))) {
+                skb_queue_splice_init(amsdu, list);
+                return -EAGAIN;
+        }
+
+        return 0;
+}
+
+static void ath10k_htt_rx_h_rx_offload_prot(struct ieee80211_rx_status *status,
+                                            struct sk_buff *skb)
+{
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+
+        if (!ieee80211_has_protected(hdr->frame_control))
+                return;
+
+        /* Offloaded frames are already decrypted but firmware insists they are
+         * protected in the 802.11 header. Strip the flag.  Otherwise mac80211
+         * will drop the frame.
+         */
+
+        hdr->frame_control &= ~__cpu_to_le16(IEEE80211_FCTL_PROTECTED);
+        status->flag |= RX_FLAG_DECRYPTED |
+                        RX_FLAG_IV_STRIPPED |
+                        RX_FLAG_MMIC_STRIPPED;
+}
+
+static void ath10k_htt_rx_h_rx_offload(struct ath10k *ar,
+                                       struct sk_buff_head *list)
+{
+        struct ath10k_htt *htt = &ar->htt;
+        struct ieee80211_rx_status *status = &htt->rx_status;
+        struct htt_rx_offload_msdu *rx;
+        struct sk_buff *msdu;
+        size_t offset;
+
+        while ((msdu = __skb_dequeue(list))) {
+                /* Offloaded frames don't have Rx descriptor. Instead they have
+                 * a short meta information header.
+                 */
+
+                rx = (void *)msdu->data;
+
+                skb_put(msdu, sizeof(*rx));
+                skb_pull(msdu, sizeof(*rx));
+
+                if (skb_tailroom(msdu) < __le16_to_cpu(rx->msdu_len)) {
+                        ath10k_warn(ar, "dropping frame: offloaded rx msdu is too long!\n");
+                        dev_kfree_skb_any(msdu);
+                        continue;
+                }
+
+                skb_put(msdu, __le16_to_cpu(rx->msdu_len));
+
+                /* Offloaded rx header length isn't multiple of 2 nor 4 so the
+                 * actual payload is unaligned. Align the frame.  Otherwise
+                 * mac80211 complains.  This shouldn't reduce performance much
+                 * because these offloaded frames are rare.
+                 */
+                offset = 4 - ((unsigned long)msdu->data & 3);
+                skb_put(msdu, offset);
+                memmove(msdu->data + offset, msdu->data, msdu->len);
+                skb_pull(msdu, offset);
+
+                /* FIXME: The frame is NWifi. Re-construct QoS Control
+                 * if possible later.
+                 */
+
+                memset(status, 0, sizeof(*status));
+                status->flag |= RX_FLAG_NO_SIGNAL_VAL;
+
+                ath10k_htt_rx_h_rx_offload_prot(status, msdu);
+                ath10k_htt_rx_h_channel(ar, status);
+                ath10k_process_rx(ar, status, msdu);
+        }
+}
+
+static void ath10k_htt_rx_in_ord_ind(struct ath10k *ar, struct sk_buff *skb)
+{
+        struct ath10k_htt *htt = &ar->htt;
+        struct htt_resp *resp = (void *)skb->data;
+        struct ieee80211_rx_status *status = &htt->rx_status;
+        struct sk_buff_head list;
+        struct sk_buff_head amsdu;
+        u16 peer_id;
+        u16 msdu_count;
+        u8 vdev_id;
+        u8 tid;
+        bool offload;
+        bool frag;
+        int ret;
+
+        lockdep_assert_held(&htt->rx_ring.lock);
+
+        if (htt->rx_confused)
+                return;
+
+        skb_pull(skb, sizeof(resp->hdr));
+        skb_pull(skb, sizeof(resp->rx_in_ord_ind));
+
+        peer_id = __le16_to_cpu(resp->rx_in_ord_ind.peer_id);
+        msdu_count = __le16_to_cpu(resp->rx_in_ord_ind.msdu_count);
+        vdev_id = resp->rx_in_ord_ind.vdev_id;
+        tid = SM(resp->rx_in_ord_ind.info, HTT_RX_IN_ORD_IND_INFO_TID);
+        offload = !!(resp->rx_in_ord_ind.info &
+                        HTT_RX_IN_ORD_IND_INFO_OFFLOAD_MASK);
+        frag = !!(resp->rx_in_ord_ind.info & HTT_RX_IN_ORD_IND_INFO_FRAG_MASK);
+
+        ath10k_dbg(ar, ATH10K_DBG_HTT,
+                   "htt rx in ord vdev %i peer %i tid %i offload %i frag %i msdu count %i\n",
+                   vdev_id, peer_id, tid, offload, frag, msdu_count);
+
+        if (skb->len < msdu_count * sizeof(*resp->rx_in_ord_ind.msdu_descs)) {
+                ath10k_warn(ar, "dropping invalid in order rx indication\n");
+                return;
+        }
+
+        /* The event can deliver more than 1 A-MSDU. Each A-MSDU is later
+         * extracted and processed.
+         */
+        __skb_queue_head_init(&list);
+        ret = ath10k_htt_rx_pop_paddr_list(htt, &resp->rx_in_ord_ind, &list);
+        if (ret < 0) {
+                ath10k_warn(ar, "failed to pop paddr list: %d\n", ret);
+                htt->rx_confused = true;
+                return;
+        }
+
+        /* Offloaded frames are very different and need to be handled
+         * separately.
+         */
+        if (offload)
+                ath10k_htt_rx_h_rx_offload(ar, &list);
+
+        while (!skb_queue_empty(&list)) {
+                __skb_queue_head_init(&amsdu);
+                ret = ath10k_htt_rx_extract_amsdu(&list, &amsdu);
+                switch (ret) {
+                case 0:
+                        /* Note: The in-order indication may report interleaved
+                         * frames from different PPDUs meaning reported rx rate
+                         * to mac80211 isn't accurate/reliable. It's still
+                         * better to report something than nothing though. This
+                         * should still give an idea about rx rate to the user.
+                         */
+                        ath10k_htt_rx_h_ppdu(ar, &amsdu, status);
+                        ath10k_htt_rx_h_filter(ar, &amsdu, status);
+                        ath10k_htt_rx_h_mpdu(ar, &amsdu, status);
+                        ath10k_htt_rx_h_deliver(ar, &amsdu, status);
+                        break;
+                case -EAGAIN:
+                        /* fall through */
+                default:
+                        /* Should not happen. */
+                        ath10k_warn(ar, "failed to extract amsdu: %d\n", ret);
+                        htt->rx_confused = true;
+                        __skb_queue_purge(&list);
+                        return;
+                }
+        }
+
+        tasklet_schedule(&htt->rx_replenish_task);
+}
+
 void ath10k_htt_t2h_msg_handler(struct ath10k *ar, struct sk_buff *skb)
 {
         struct ath10k_htt *htt = &ar->htt;
@@ -1700,6 +2010,20 @@ void ath10k_htt_t2h_msg_handler(struct ath10k *ar, struct sk_buff *skb)
                  */
                 break;
         }
+        case HTT_T2H_MSG_TYPE_RX_IN_ORD_PADDR_IND: {
+                spin_lock_bh(&htt->rx_ring.lock);
+                __skb_queue_tail(&htt->rx_in_ord_compl_q, skb);
+                spin_unlock_bh(&htt->rx_ring.lock);
+                tasklet_schedule(&htt->txrx_compl_task);
+                return;
+        }
+        case HTT_T2H_MSG_TYPE_TX_CREDIT_UPDATE_IND:
+                /* FIXME: This WMI-TLV event is overlapping with 10.2
+                 * CHAN_CHANGE - both being 0xF. Neither is being used in
+                 * practice so no immediate action is necessary. Nevertheless
+                 * HTT may need an abstraction layer like WMI has one day.
+                 */
+                break;
         default:
                 ath10k_warn(ar, "htt event (%d) not handled\n",
                             resp->hdr.msg_type);
@@ -1715,6 +2039,7 @@ void ath10k_htt_t2h_msg_handler(struct ath10k *ar, struct sk_buff *skb)
 static void ath10k_htt_txrx_compl_task(unsigned long ptr)
 {
         struct ath10k_htt *htt = (struct ath10k_htt *)ptr;
+        struct ath10k *ar = htt->ar;
         struct htt_resp *resp;
         struct sk_buff *skb;
 
@@ -1731,5 +2056,10 @@ static void ath10k_htt_txrx_compl_task(unsigned long ptr)
                 ath10k_htt_rx_handler(htt, &resp->rx_ind);
                 dev_kfree_skb_any(skb);
         }
+
+        while ((skb = __skb_dequeue(&htt->rx_in_ord_compl_q))) {
+                ath10k_htt_rx_in_ord_ind(ar, skb);
+                dev_kfree_skb_any(skb);
+        }
         spin_unlock_bh(&htt->rx_ring.lock);
 }
diff --git a/drivers/net/wireless/ath/ath10k/htt_tx.c b/drivers/net/wireless/ath/ath10k/htt_tx.c
index 4bc51d8a14a3..cbd2bc9e6202 100644
--- a/drivers/net/wireless/ath/ath10k/htt_tx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_tx.c
@@ -56,21 +56,18 @@ exit:
         return ret;
 }
 
-int ath10k_htt_tx_alloc_msdu_id(struct ath10k_htt *htt)
+int ath10k_htt_tx_alloc_msdu_id(struct ath10k_htt *htt, struct sk_buff *skb)
 {
         struct ath10k *ar = htt->ar;
-        int msdu_id;
+        int ret;
 
         lockdep_assert_held(&htt->tx_lock);
 
-        msdu_id = find_first_zero_bit(htt->used_msdu_ids,
-                                      htt->max_num_pending_tx);
-        if (msdu_id == htt->max_num_pending_tx)
-                return -ENOBUFS;
+        ret = idr_alloc(&htt->pending_tx, skb, 0, 0x10000, GFP_ATOMIC);
+
+        ath10k_dbg(ar, ATH10K_DBG_HTT, "htt tx alloc msdu_id %d\n", ret);
 
-        ath10k_dbg(ar, ATH10K_DBG_HTT, "htt tx alloc msdu_id %d\n", msdu_id);
-        __set_bit(msdu_id, htt->used_msdu_ids);
-        return msdu_id;
+        return ret;
 }
 
 void ath10k_htt_tx_free_msdu_id(struct ath10k_htt *htt, u16 msdu_id)
@@ -79,79 +76,53 @@ void ath10k_htt_tx_free_msdu_id(struct ath10k_htt *htt, u16 msdu_id)
 
         lockdep_assert_held(&htt->tx_lock);
 
-        if (!test_bit(msdu_id, htt->used_msdu_ids))
-                ath10k_warn(ar, "trying to free unallocated msdu_id %d\n",
-                            msdu_id);
-
         ath10k_dbg(ar, ATH10K_DBG_HTT, "htt tx free msdu_id %hu\n", msdu_id);
-        __clear_bit(msdu_id, htt->used_msdu_ids);
+
+        idr_remove(&htt->pending_tx, msdu_id);
 }
 
 int ath10k_htt_tx_alloc(struct ath10k_htt *htt)
 {
         struct ath10k *ar = htt->ar;
 
-        spin_lock_init(&htt->tx_lock);
-
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, htt->ar->fw_features))
-                htt->max_num_pending_tx = TARGET_10X_NUM_MSDU_DESC;
-        else
-                htt->max_num_pending_tx = TARGET_NUM_MSDU_DESC;
-
         ath10k_dbg(ar, ATH10K_DBG_BOOT, "htt tx max num pending tx %d\n",
                    htt->max_num_pending_tx);
 
-        htt->pending_tx = kzalloc(sizeof(*htt->pending_tx) *
-                                  htt->max_num_pending_tx, GFP_KERNEL);
-        if (!htt->pending_tx)
-                return -ENOMEM;
-
-        htt->used_msdu_ids = kzalloc(sizeof(unsigned long) *
-                                     BITS_TO_LONGS(htt->max_num_pending_tx),
-                                     GFP_KERNEL);
-        if (!htt->used_msdu_ids) {
-                kfree(htt->pending_tx);
-                return -ENOMEM;
-        }
+        spin_lock_init(&htt->tx_lock);
+        idr_init(&htt->pending_tx);
 
         htt->tx_pool = dma_pool_create("ath10k htt tx pool", htt->ar->dev,
                                        sizeof(struct ath10k_htt_txbuf), 4, 0);
         if (!htt->tx_pool) {
-                kfree(htt->used_msdu_ids);
-                kfree(htt->pending_tx);
+                idr_destroy(&htt->pending_tx);
                 return -ENOMEM;
         }
 
         return 0;
 }
 
-static void ath10k_htt_tx_free_pending(struct ath10k_htt *htt)
+static int ath10k_htt_tx_clean_up_pending(int msdu_id, void *skb, void *ctx)
 {
-        struct ath10k *ar = htt->ar;
+        struct ath10k *ar = ctx;
+        struct ath10k_htt *htt = &ar->htt;
         struct htt_tx_done tx_done = {0};
-        int msdu_id;
-
-        spin_lock_bh(&htt->tx_lock);
-        for (msdu_id = 0; msdu_id < htt->max_num_pending_tx; msdu_id++) {
-                if (!test_bit(msdu_id, htt->used_msdu_ids))
-                        continue;
 
-                ath10k_dbg(ar, ATH10K_DBG_HTT, "force cleanup msdu_id %hu\n",
-                           msdu_id);
+        ath10k_dbg(ar, ATH10K_DBG_HTT, "force cleanup msdu_id %hu\n", msdu_id);
 
-                tx_done.discard = 1;
-                tx_done.msdu_id = msdu_id;
+        tx_done.discard = 1;
+        tx_done.msdu_id = msdu_id;
 
-                ath10k_txrx_tx_unref(htt, &tx_done);
-        }
+        spin_lock_bh(&htt->tx_lock);
+        ath10k_txrx_tx_unref(htt, &tx_done);
         spin_unlock_bh(&htt->tx_lock);
+
+        return 0;
 }
 
 void ath10k_htt_tx_free(struct ath10k_htt *htt)
 {
-        ath10k_htt_tx_free_pending(htt);
-        kfree(htt->pending_tx);
-        kfree(htt->used_msdu_ids);
+        idr_for_each(&htt->pending_tx, ath10k_htt_tx_clean_up_pending, htt->ar);
+        idr_destroy(&htt->pending_tx);
         dma_pool_destroy(htt->tx_pool);
 }
 
@@ -383,13 +354,12 @@ int ath10k_htt_mgmt_tx(struct ath10k_htt *htt, struct sk_buff *msdu)
         len += sizeof(cmd->mgmt_tx);
 
         spin_lock_bh(&htt->tx_lock);
-        res = ath10k_htt_tx_alloc_msdu_id(htt);
+        res = ath10k_htt_tx_alloc_msdu_id(htt, msdu);
         if (res < 0) {
                 spin_unlock_bh(&htt->tx_lock);
                 goto err_tx_dec;
         }
         msdu_id = res;
-        htt->pending_tx[msdu_id] = msdu;
         spin_unlock_bh(&htt->tx_lock);
 
         txdesc = ath10k_htc_alloc_skb(ar, len);
@@ -428,7 +398,6 @@ err_free_txdesc:
         dev_kfree_skb_any(txdesc);
 err_free_msdu_id:
         spin_lock_bh(&htt->tx_lock);
-        htt->pending_tx[msdu_id] = NULL;
         ath10k_htt_tx_free_msdu_id(htt, msdu_id);
         spin_unlock_bh(&htt->tx_lock);
 err_tx_dec:
@@ -460,13 +429,12 @@ int ath10k_htt_tx(struct ath10k_htt *htt, struct sk_buff *msdu)
                 goto err;
 
         spin_lock_bh(&htt->tx_lock);
-        res = ath10k_htt_tx_alloc_msdu_id(htt);
+        res = ath10k_htt_tx_alloc_msdu_id(htt, msdu);
         if (res < 0) {
                 spin_unlock_bh(&htt->tx_lock);
                 goto err_tx_dec;
         }
         msdu_id = res;
-        htt->pending_tx[msdu_id] = msdu;
         spin_unlock_bh(&htt->tx_lock);
 
         prefetch_len = min(htt->prefetch_len, msdu->len);
@@ -480,10 +448,18 @@ int ath10k_htt_tx(struct ath10k_htt *htt, struct sk_buff *msdu)
 
         skb_cb->htt.txbuf = dma_pool_alloc(htt->tx_pool, GFP_ATOMIC,
                                            &paddr);
-        if (!skb_cb->htt.txbuf)
+        if (!skb_cb->htt.txbuf) {
+                res = -ENOMEM;
                 goto err_free_msdu_id;
+        }
         skb_cb->htt.txbuf_paddr = paddr;
 
+        if ((ieee80211_is_action(hdr->frame_control) ||
+             ieee80211_is_deauth(hdr->frame_control) ||
+             ieee80211_is_disassoc(hdr->frame_control)) &&
+             ieee80211_has_protected(hdr->frame_control))
+                skb_put(msdu, IEEE80211_CCMP_MIC_LEN);
+
         skb_cb->paddr = dma_map_single(dev, msdu->data, msdu->len,
                                        DMA_TO_DEVICE);
         res = dma_mapping_error(dev, skb_cb->paddr);
@@ -539,8 +515,10 @@ int ath10k_htt_tx(struct ath10k_htt *htt, struct sk_buff *msdu)
 
         flags1 |= SM((u16)vdev_id, HTT_DATA_TX_DESC_FLAGS1_VDEV_ID);
         flags1 |= SM((u16)tid, HTT_DATA_TX_DESC_FLAGS1_EXT_TID);
-        flags1 |= HTT_DATA_TX_DESC_FLAGS1_CKSUM_L3_OFFLOAD;
-        flags1 |= HTT_DATA_TX_DESC_FLAGS1_CKSUM_L4_OFFLOAD;
+        if (msdu->ip_summed == CHECKSUM_PARTIAL) {
+                flags1 |= HTT_DATA_TX_DESC_FLAGS1_CKSUM_L3_OFFLOAD;
+                flags1 |= HTT_DATA_TX_DESC_FLAGS1_CKSUM_L4_OFFLOAD;
+        }
 
         /* Prevent firmware from sending up tx inspection requests. There's
          * nothing ath10k can do with frames requested for inspection so force
@@ -598,7 +576,6 @@ err_free_txbuf:
                       skb_cb->htt.txbuf_paddr);
 err_free_msdu_id:
         spin_lock_bh(&htt->tx_lock);
-        htt->pending_tx[msdu_id] = NULL;
         ath10k_htt_tx_free_msdu_id(htt, msdu_id);
         spin_unlock_bh(&htt->tx_lock);
 err_tx_dec:
diff --git a/drivers/net/wireless/ath/ath10k/hw.c b/drivers/net/wireless/ath/ath10k/hw.c
new file mode 100644
index 000000000000..839a8791fb9e
--- /dev/null
+++ b/drivers/net/wireless/ath/ath10k/hw.c
@@ -0,0 +1,58 @@
+/*
+ * Copyright (c) 2014-2015 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/types.h>
+#include "hw.h"
+
+const struct ath10k_hw_regs qca988x_regs = {
+        .rtc_state_cold_reset_mask      = 0x00000400,
+        .rtc_soc_base_address           = 0x00004000,
+        .rtc_wmac_base_address          = 0x00005000,
+        .soc_core_base_address          = 0x00009000,
+        .ce_wrapper_base_address        = 0x00057000,
+        .ce0_base_address               = 0x00057400,
+        .ce1_base_address               = 0x00057800,
+        .ce2_base_address               = 0x00057c00,
+        .ce3_base_address               = 0x00058000,
+        .ce4_base_address               = 0x00058400,
+        .ce5_base_address               = 0x00058800,
+        .ce6_base_address               = 0x00058c00,
+        .ce7_base_address               = 0x00059000,
+        .soc_reset_control_si0_rst_mask = 0x00000001,
+        .soc_reset_control_ce_rst_mask  = 0x00040000,
+        .soc_chip_id_address            = 0x00ec,
+        .scratch_3_address              = 0x0030,
+};
+
+const struct ath10k_hw_regs qca6174_regs = {
+        .rtc_state_cold_reset_mask              = 0x00002000,
+        .rtc_soc_base_address                   = 0x00000800,
+        .rtc_wmac_base_address                  = 0x00001000,
+        .soc_core_base_address                  = 0x0003a000,
+        .ce_wrapper_base_address                = 0x00034000,
+        .ce0_base_address                       = 0x00034400,
+        .ce1_base_address                       = 0x00034800,
+        .ce2_base_address                       = 0x00034c00,
+        .ce3_base_address                       = 0x00035000,
+        .ce4_base_address                       = 0x00035400,
+        .ce5_base_address                       = 0x00035800,
+        .ce6_base_address                       = 0x00035c00,
+        .ce7_base_address                       = 0x00036000,
+        .soc_reset_control_si0_rst_mask         = 0x00000000,
+        .soc_reset_control_ce_rst_mask          = 0x00000001,
+        .soc_chip_id_address                    = 0x000f0,
+        .scratch_3_address                      = 0x0028,
+};
diff --git a/drivers/net/wireless/ath/ath10k/hw.h b/drivers/net/wireless/ath/ath10k/hw.h
index dfedfd0e0f34..460771fcfe9e 100644
--- a/drivers/net/wireless/ath/ath10k/hw.h
+++ b/drivers/net/wireless/ath/ath10k/hw.h
@@ -34,9 +34,50 @@
 #define QCA988X_HW_2_0_BOARD_DATA_FILE  "board.bin"
 #define QCA988X_HW_2_0_PATCH_LOAD_ADDR  0x1234
 
+/* QCA6174 target BMI version signatures */
+#define QCA6174_HW_1_0_VERSION          0x05000000
+#define QCA6174_HW_1_1_VERSION          0x05000001
+#define QCA6174_HW_1_3_VERSION          0x05000003
+#define QCA6174_HW_2_1_VERSION          0x05010000
+#define QCA6174_HW_3_0_VERSION          0x05020000
+#define QCA6174_HW_3_2_VERSION          0x05030000
+
+enum qca6174_pci_rev {
+        QCA6174_PCI_REV_1_1 = 0x11,
+        QCA6174_PCI_REV_1_3 = 0x13,
+        QCA6174_PCI_REV_2_0 = 0x20,
+        QCA6174_PCI_REV_3_0 = 0x30,
+};
+
+enum qca6174_chip_id_rev {
+        QCA6174_HW_1_0_CHIP_ID_REV = 0,
+        QCA6174_HW_1_1_CHIP_ID_REV = 1,
+        QCA6174_HW_1_3_CHIP_ID_REV = 2,
+        QCA6174_HW_2_1_CHIP_ID_REV = 4,
+        QCA6174_HW_2_2_CHIP_ID_REV = 5,
+        QCA6174_HW_3_0_CHIP_ID_REV = 8,
+        QCA6174_HW_3_1_CHIP_ID_REV = 9,
+        QCA6174_HW_3_2_CHIP_ID_REV = 10,
+};
+
+#define QCA6174_HW_2_1_FW_DIR           "ath10k/QCA6174/hw2.1"
+#define QCA6174_HW_2_1_FW_FILE          "firmware.bin"
+#define QCA6174_HW_2_1_OTP_FILE         "otp.bin"
+#define QCA6174_HW_2_1_BOARD_DATA_FILE  "board.bin"
+#define QCA6174_HW_2_1_PATCH_LOAD_ADDR  0x1234
+
+#define QCA6174_HW_3_0_FW_DIR           "ath10k/QCA6174/hw3.0"
+#define QCA6174_HW_3_0_FW_FILE          "firmware.bin"
+#define QCA6174_HW_3_0_OTP_FILE         "otp.bin"
+#define QCA6174_HW_3_0_BOARD_DATA_FILE  "board.bin"
+#define QCA6174_HW_3_0_PATCH_LOAD_ADDR  0x1234
+
 #define ATH10K_FW_API2_FILE             "firmware-2.bin"
 #define ATH10K_FW_API3_FILE             "firmware-3.bin"
 
+/* added support for ATH10K_FW_IE_WMI_OP_VERSION */
+#define ATH10K_FW_API4_FILE             "firmware-4.bin"
+
 #define ATH10K_FW_UTF_FILE              "utf.bin"
 
 /* includes also the null byte */
@@ -58,8 +99,57 @@ enum ath10k_fw_ie_type {
         ATH10K_FW_IE_FEATURES = 2,
         ATH10K_FW_IE_FW_IMAGE = 3,
         ATH10K_FW_IE_OTP_IMAGE = 4,
+
+        /* WMI "operations" interface version, 32 bit value. Supported from
+         * FW API 4 and above.
+         */
+        ATH10K_FW_IE_WMI_OP_VERSION = 5,
+};
+
+enum ath10k_fw_wmi_op_version {
+        ATH10K_FW_WMI_OP_VERSION_UNSET = 0,
+
+        ATH10K_FW_WMI_OP_VERSION_MAIN = 1,
+        ATH10K_FW_WMI_OP_VERSION_10_1 = 2,
+        ATH10K_FW_WMI_OP_VERSION_10_2 = 3,
+        ATH10K_FW_WMI_OP_VERSION_TLV = 4,
+        ATH10K_FW_WMI_OP_VERSION_10_2_4 = 5,
+
+        /* keep last */
+        ATH10K_FW_WMI_OP_VERSION_MAX,
+};
+
+enum ath10k_hw_rev {
+        ATH10K_HW_QCA988X,
+        ATH10K_HW_QCA6174,
+};
+
+struct ath10k_hw_regs {
+        u32 rtc_state_cold_reset_mask;
+        u32 rtc_soc_base_address;
+        u32 rtc_wmac_base_address;
+        u32 soc_core_base_address;
+        u32 ce_wrapper_base_address;
+        u32 ce0_base_address;
+        u32 ce1_base_address;
+        u32 ce2_base_address;
+        u32 ce3_base_address;
+        u32 ce4_base_address;
+        u32 ce5_base_address;
+        u32 ce6_base_address;
+        u32 ce7_base_address;
+        u32 soc_reset_control_si0_rst_mask;
+        u32 soc_reset_control_ce_rst_mask;
+        u32 soc_chip_id_address;
+        u32 scratch_3_address;
 };
 
+extern const struct ath10k_hw_regs qca988x_regs;
+extern const struct ath10k_hw_regs qca6174_regs;
+
+#define QCA_REV_988X(ar) ((ar)->hw_rev == ATH10K_HW_QCA988X)
+#define QCA_REV_6174(ar) ((ar)->hw_rev == ATH10K_HW_QCA6174)
+
 /* Known pecularities:
  *  - current FW doesn't support raw rx mode (last tested v599)
  *  - current FW dumps upon raw tx mode (last tested v599)
@@ -162,6 +252,18 @@ struct ath10k_pktlog_hdr {
 #define TARGET_10X_NUM_MSDU_DESC                (1024 + 400)
 #define TARGET_10X_MAX_FRAG_ENTRIES             0
 
+/* 10.2 parameters */
+#define TARGET_10_2_DMA_BURST_SIZE              1
+
+/* Target specific defines for WMI-TLV firmware */
+#define TARGET_TLV_NUM_VDEVS                    3
+#define TARGET_TLV_NUM_STATIONS                 32
+#define TARGET_TLV_NUM_PEERS                    ((TARGET_TLV_NUM_STATIONS) + \
+                                                 (TARGET_TLV_NUM_VDEVS) + \
+                                                 2)
+#define TARGET_TLV_NUM_TIDS                     ((TARGET_TLV_NUM_PEERS) * 2)
+#define TARGET_TLV_NUM_MSDU_DESC                (1024 + 32)
+
 /* Number of Copy Engines supported */
 #define CE_COUNT 8
 
@@ -192,7 +294,7 @@ struct ath10k_pktlog_hdr {
 /* as of IP3.7.1 */
 #define RTC_STATE_V_ON                          3
 
-#define RTC_STATE_COLD_RESET_MASK               0x00000400
+#define RTC_STATE_COLD_RESET_MASK               ar->regs->rtc_state_cold_reset_mask
 #define RTC_STATE_V_LSB                         0
 #define RTC_STATE_V_MASK                        0x00000007
 #define RTC_STATE_ADDRESS                       0x0000
@@ -201,12 +303,12 @@ struct ath10k_pktlog_hdr {
 #define PCIE_SOC_WAKE_RESET                     0x00000000
 #define SOC_GLOBAL_RESET_ADDRESS                0x0008
 
-#define RTC_SOC_BASE_ADDRESS                    0x00004000
-#define RTC_WMAC_BASE_ADDRESS                   0x00005000
+#define RTC_SOC_BASE_ADDRESS                    ar->regs->rtc_soc_base_address
+#define RTC_WMAC_BASE_ADDRESS                   ar->regs->rtc_wmac_base_address
 #define MAC_COEX_BASE_ADDRESS                   0x00006000
 #define BT_COEX_BASE_ADDRESS                    0x00007000
 #define SOC_PCIE_BASE_ADDRESS                   0x00008000
-#define SOC_CORE_BASE_ADDRESS                   0x00009000
+#define SOC_CORE_BASE_ADDRESS                   ar->regs->soc_core_base_address
 #define WLAN_UART_BASE_ADDRESS                  0x0000c000
 #define WLAN_SI_BASE_ADDRESS                    0x00010000
 #define WLAN_GPIO_BASE_ADDRESS                  0x00014000
@@ -215,23 +317,23 @@ struct ath10k_pktlog_hdr {
 #define EFUSE_BASE_ADDRESS                      0x00030000
 #define FPGA_REG_BASE_ADDRESS                   0x00039000
 #define WLAN_UART2_BASE_ADDRESS                 0x00054c00
-#define CE_WRAPPER_BASE_ADDRESS                 0x00057000
-#define CE0_BASE_ADDRESS                        0x00057400
-#define CE1_BASE_ADDRESS                        0x00057800
-#define CE2_BASE_ADDRESS                        0x00057c00
-#define CE3_BASE_ADDRESS                        0x00058000
-#define CE4_BASE_ADDRESS                        0x00058400
-#define CE5_BASE_ADDRESS                        0x00058800
-#define CE6_BASE_ADDRESS                        0x00058c00
-#define CE7_BASE_ADDRESS                        0x00059000
+#define CE_WRAPPER_BASE_ADDRESS                 ar->regs->ce_wrapper_base_address
+#define CE0_BASE_ADDRESS                        ar->regs->ce0_base_address
+#define CE1_BASE_ADDRESS                        ar->regs->ce1_base_address
+#define CE2_BASE_ADDRESS                        ar->regs->ce2_base_address
+#define CE3_BASE_ADDRESS                        ar->regs->ce3_base_address
+#define CE4_BASE_ADDRESS                        ar->regs->ce4_base_address
+#define CE5_BASE_ADDRESS                        ar->regs->ce5_base_address
+#define CE6_BASE_ADDRESS                        ar->regs->ce6_base_address
+#define CE7_BASE_ADDRESS                        ar->regs->ce7_base_address
 #define DBI_BASE_ADDRESS                        0x00060000
 #define WLAN_ANALOG_INTF_PCIE_BASE_ADDRESS      0x0006c000
 #define PCIE_LOCAL_BASE_ADDRESS                 0x00080000
 
 #define SOC_RESET_CONTROL_ADDRESS               0x00000000
 #define SOC_RESET_CONTROL_OFFSET                0x00000000
-#define SOC_RESET_CONTROL_SI0_RST_MASK          0x00000001
-#define SOC_RESET_CONTROL_CE_RST_MASK           0x00040000
+#define SOC_RESET_CONTROL_SI0_RST_MASK          ar->regs->soc_reset_control_si0_rst_mask
+#define SOC_RESET_CONTROL_CE_RST_MASK           ar->regs->soc_reset_control_ce_rst_mask
 #define SOC_RESET_CONTROL_CPU_WARM_RST_MASK     0x00000040
 #define SOC_CPU_CLOCK_OFFSET                    0x00000020
 #define SOC_CPU_CLOCK_STANDARD_LSB              0
@@ -245,7 +347,7 @@ struct ath10k_pktlog_hdr {
 #define SOC_LF_TIMER_CONTROL0_ADDRESS           0x00000050
 #define SOC_LF_TIMER_CONTROL0_ENABLE_MASK       0x00000004
 
-#define SOC_CHIP_ID_ADDRESS                     0x000000ec
+#define SOC_CHIP_ID_ADDRESS                     ar->regs->soc_chip_id_address
 #define SOC_CHIP_ID_REV_LSB                     8
 #define SOC_CHIP_ID_REV_MASK                    0x00000f00
 
@@ -301,7 +403,7 @@ struct ath10k_pktlog_hdr {
 #define PCIE_INTR_ENABLE_ADDRESS                0x0008
 #define PCIE_INTR_CAUSE_ADDRESS                 0x000c
 #define PCIE_INTR_CLR_ADDRESS                   0x0014
-#define SCRATCH_3_ADDRESS                       0x0030
+#define SCRATCH_3_ADDRESS                       ar->regs->scratch_3_address
 #define CPU_INTR_ADDRESS                        0x0010
 
 /* Firmware indications to the Host via SCRATCH_3 register. */
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index c4005670cba2..d6d2f0f00caa 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -27,6 +27,8 @@
 #include "htt.h"
 #include "txrx.h"
 #include "testmode.h"
+#include "wmi.h"
+#include "wmi-ops.h"
 
 /**********/
 /* Crypto */
@@ -35,7 +37,7 @@
 static int ath10k_send_key(struct ath10k_vif *arvif,
                            struct ieee80211_key_conf *key,
                            enum set_key_cmd cmd,
-                           const u8 *macaddr)
+                           const u8 *macaddr, bool def_idx)
 {
         struct ath10k *ar = arvif->ar;
         struct wmi_vdev_install_key_arg arg = {
@@ -56,10 +58,7 @@ static int ath10k_send_key(struct ath10k_vif *arvif,
         switch (key->cipher) {
         case WLAN_CIPHER_SUITE_CCMP:
                 arg.key_cipher = WMI_CIPHER_AES_CCM;
-                if (arvif->vdev_type == WMI_VDEV_TYPE_AP)
-                        key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV_MGMT;
-                else
-                        key->flags |= IEEE80211_KEY_FLAG_SW_MGMT_TX;
+                key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV_MGMT;
                 break;
         case WLAN_CIPHER_SUITE_TKIP:
                 arg.key_cipher = WMI_CIPHER_TKIP;
@@ -73,7 +72,13 @@ static int ath10k_send_key(struct ath10k_vif *arvif,
                  * Otherwise pairwise key must be set */
                 if (memcmp(macaddr, arvif->vif->addr, ETH_ALEN))
                         arg.key_flags = WMI_KEY_PAIRWISE;
+
+                if (def_idx)
+                        arg.key_flags |= WMI_KEY_TX_USAGE;
                 break;
+        case WLAN_CIPHER_SUITE_AES_CMAC:
+                /* this one needs to be done in software */
+                return 1;
         default:
                 ath10k_warn(ar, "cipher %d is not supported\n", key->cipher);
                 return -EOPNOTSUPP;
@@ -90,7 +95,7 @@ static int ath10k_send_key(struct ath10k_vif *arvif,
 static int ath10k_install_key(struct ath10k_vif *arvif,
                               struct ieee80211_key_conf *key,
                               enum set_key_cmd cmd,
-                              const u8 *macaddr)
+                              const u8 *macaddr, bool def_idx)
 {
         struct ath10k *ar = arvif->ar;
         int ret;
@@ -99,7 +104,7 @@ static int ath10k_install_key(struct ath10k_vif *arvif,
 
         reinit_completion(&ar->install_key_done);
 
-        ret = ath10k_send_key(arvif, key, cmd, macaddr);
+        ret = ath10k_send_key(arvif, key, cmd, macaddr, def_idx);
         if (ret)
                 return ret;
 
@@ -117,6 +122,7 @@ static int ath10k_install_peer_wep_keys(struct ath10k_vif *arvif,
         struct ath10k_peer *peer;
         int ret;
         int i;
+        bool def_idx;
 
         lockdep_assert_held(&ar->conf_mutex);
 
@@ -130,9 +136,14 @@ static int ath10k_install_peer_wep_keys(struct ath10k_vif *arvif,
         for (i = 0; i < ARRAY_SIZE(arvif->wep_keys); i++) {
                 if (arvif->wep_keys[i] == NULL)
                         continue;
+                /* set TX_USAGE flag for default key id */
+                if (arvif->def_wep_key_idx == i)
+                        def_idx = true;
+                else
+                        def_idx = false;
 
                 ret = ath10k_install_key(arvif, arvif->wep_keys[i], SET_KEY,
-                                         addr);
+                                         addr, def_idx);
                 if (ret)
                         return ret;
 
@@ -166,8 +177,9 @@ static int ath10k_clear_peer_keys(struct ath10k_vif *arvif,
                 if (peer->keys[i] == NULL)
                         continue;
 
+                /* key flags are not required to delete the key */
                 ret = ath10k_install_key(arvif, peer->keys[i],
-                                         DISABLE_KEY, addr);
+                                         DISABLE_KEY, addr, false);
                 if (ret && first_errno == 0)
                         first_errno = ret;
 
@@ -241,8 +253,8 @@ static int ath10k_clear_vdev_key(struct ath10k_vif *arvif,
 
                 if (i == ARRAY_SIZE(peer->keys))
                         break;
-
-                ret = ath10k_install_key(arvif, key, DISABLE_KEY, addr);
+                /* key flags are not required to delete the key */
+                ret = ath10k_install_key(arvif, key, DISABLE_KEY, addr, false);
                 if (ret && first_errno == 0)
                         first_errno = ret;
 
@@ -267,7 +279,10 @@ chan_to_phymode(const struct cfg80211_chan_def *chandef)
         case IEEE80211_BAND_2GHZ:
                 switch (chandef->width) {
                 case NL80211_CHAN_WIDTH_20_NOHT:
-                        phymode = MODE_11G;
+                        if (chandef->chan->flags & IEEE80211_CHAN_NO_OFDM)
+                                phymode = MODE_11B;
+                        else
+                                phymode = MODE_11G;
                         break;
                 case NL80211_CHAN_WIDTH_20:
                         phymode = MODE_11NG_HT20;
@@ -519,10 +534,14 @@ void ath10k_mac_vif_beacon_free(struct ath10k_vif *arvif)
                 dma_unmap_single(ar->dev, ATH10K_SKB_CB(arvif->beacon)->paddr,
                                  arvif->beacon->len, DMA_TO_DEVICE);
 
+        if (WARN_ON(arvif->beacon_state != ATH10K_BEACON_SCHEDULED &&
+                    arvif->beacon_state != ATH10K_BEACON_SENT))
+                return;
+
         dev_kfree_skb_any(arvif->beacon);
 
         arvif->beacon = NULL;
-        arvif->beacon_sent = false;
+        arvif->beacon_state = ATH10K_BEACON_SCHEDULED;
 }
 
 static void ath10k_mac_vif_beacon_cleanup(struct ath10k_vif *arvif)
@@ -962,6 +981,143 @@ static int ath10k_vdev_stop(struct ath10k_vif *arvif)
         return ret;
 }
 
+static int ath10k_mac_setup_bcn_p2p_ie(struct ath10k_vif *arvif,
+                                       struct sk_buff *bcn)
+{
+        struct ath10k *ar = arvif->ar;
+        struct ieee80211_mgmt *mgmt;
+        const u8 *p2p_ie;
+        int ret;
+
+        if (arvif->vdev_type != WMI_VDEV_TYPE_AP)
+                return 0;
+
+        if (arvif->vdev_subtype != WMI_VDEV_SUBTYPE_P2P_GO)
+                return 0;
+
+        mgmt = (void *)bcn->data;
+        p2p_ie = cfg80211_find_vendor_ie(WLAN_OUI_WFA, WLAN_OUI_TYPE_WFA_P2P,
+                                         mgmt->u.beacon.variable,
+                                         bcn->len - (mgmt->u.beacon.variable -
+                                                     bcn->data));
+        if (!p2p_ie)
+                return -ENOENT;
+
+        ret = ath10k_wmi_p2p_go_bcn_ie(ar, arvif->vdev_id, p2p_ie);
+        if (ret) {
+                ath10k_warn(ar, "failed to submit p2p go bcn ie for vdev %i: %d\n",
+                            arvif->vdev_id, ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+static int ath10k_mac_remove_vendor_ie(struct sk_buff *skb, unsigned int oui,
+                                       u8 oui_type, size_t ie_offset)
+{
+        size_t len;
+        const u8 *next;
+        const u8 *end;
+        u8 *ie;
+
+        if (WARN_ON(skb->len < ie_offset))
+                return -EINVAL;
+
+        ie = (u8 *)cfg80211_find_vendor_ie(oui, oui_type,
+                                           skb->data + ie_offset,
+                                           skb->len - ie_offset);
+        if (!ie)
+                return -ENOENT;
+
+        len = ie[1] + 2;
+        end = skb->data + skb->len;
+        next = ie + len;
+
+        if (WARN_ON(next > end))
+                return -EINVAL;
+
+        memmove(ie, next, end - next);
+        skb_trim(skb, skb->len - len);
+
+        return 0;
+}
+
+static int ath10k_mac_setup_bcn_tmpl(struct ath10k_vif *arvif)
+{
+        struct ath10k *ar = arvif->ar;
+        struct ieee80211_hw *hw = ar->hw;
+        struct ieee80211_vif *vif = arvif->vif;
+        struct ieee80211_mutable_offsets offs = {};
+        struct sk_buff *bcn;
+        int ret;
+
+        if (!test_bit(WMI_SERVICE_BEACON_OFFLOAD, ar->wmi.svc_map))
+                return 0;
+
+        bcn = ieee80211_beacon_get_template(hw, vif, &offs);
+        if (!bcn) {
+                ath10k_warn(ar, "failed to get beacon template from mac80211\n");
+                return -EPERM;
+        }
+
+        ret = ath10k_mac_setup_bcn_p2p_ie(arvif, bcn);
+        if (ret) {
+                ath10k_warn(ar, "failed to setup p2p go bcn ie: %d\n", ret);
+                kfree_skb(bcn);
+                return ret;
+        }
+
+        /* P2P IE is inserted by firmware automatically (as configured above)
+         * so remove it from the base beacon template to avoid duplicate P2P
+         * IEs in beacon frames.
+         */
+        ath10k_mac_remove_vendor_ie(bcn, WLAN_OUI_WFA, WLAN_OUI_TYPE_WFA_P2P,
+                                    offsetof(struct ieee80211_mgmt,
+                                             u.beacon.variable));
+
+        ret = ath10k_wmi_bcn_tmpl(ar, arvif->vdev_id, offs.tim_offset, bcn, 0,
+                                  0, NULL, 0);
+        kfree_skb(bcn);
+
+        if (ret) {
+                ath10k_warn(ar, "failed to submit beacon template command: %d\n",
+                            ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+static int ath10k_mac_setup_prb_tmpl(struct ath10k_vif *arvif)
+{
+        struct ath10k *ar = arvif->ar;
+        struct ieee80211_hw *hw = ar->hw;
+        struct ieee80211_vif *vif = arvif->vif;
+        struct sk_buff *prb;
+        int ret;
+
+        if (!test_bit(WMI_SERVICE_BEACON_OFFLOAD, ar->wmi.svc_map))
+                return 0;
+
+        prb = ieee80211_proberesp_get(hw, vif);
+        if (!prb) {
+                ath10k_warn(ar, "failed to get probe resp template from mac80211\n");
+                return -EPERM;
+        }
+
+        ret = ath10k_wmi_prb_tmpl(ar, arvif->vdev_id, prb);
+        kfree_skb(prb);
+
+        if (ret) {
+                ath10k_warn(ar, "failed to submit probe resp template command: %d\n",
+                            ret);
+                return ret;
+        }
+
+        return 0;
+}
+
 static void ath10k_control_beaconing(struct ath10k_vif *arvif,
                                      struct ieee80211_bss_conf *info)
 {
@@ -1046,28 +1202,85 @@ static void ath10k_control_ibss(struct ath10k_vif *arvif,
                             arvif->vdev_id, ret);
 }
 
-/*
- * Review this when mac80211 gains per-interface powersave support.
- */
+static int ath10k_mac_vif_recalc_ps_wake_threshold(struct ath10k_vif *arvif)
+{
+        struct ath10k *ar = arvif->ar;
+        u32 param;
+        u32 value;
+        int ret;
+
+        lockdep_assert_held(&arvif->ar->conf_mutex);
+
+        if (arvif->u.sta.uapsd)
+                value = WMI_STA_PS_TX_WAKE_THRESHOLD_NEVER;
+        else
+                value = WMI_STA_PS_TX_WAKE_THRESHOLD_ALWAYS;
+
+        param = WMI_STA_PS_PARAM_TX_WAKE_THRESHOLD;
+        ret = ath10k_wmi_set_sta_ps_param(ar, arvif->vdev_id, param, value);
+        if (ret) {
+                ath10k_warn(ar, "failed to submit ps wake threshold %u on vdev %i: %d\n",
+                            value, arvif->vdev_id, ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+static int ath10k_mac_vif_recalc_ps_poll_count(struct ath10k_vif *arvif)
+{
+        struct ath10k *ar = arvif->ar;
+        u32 param;
+        u32 value;
+        int ret;
+
+        lockdep_assert_held(&arvif->ar->conf_mutex);
+
+        if (arvif->u.sta.uapsd)
+                value = WMI_STA_PS_PSPOLL_COUNT_UAPSD;
+        else
+                value = WMI_STA_PS_PSPOLL_COUNT_NO_MAX;
+
+        param = WMI_STA_PS_PARAM_PSPOLL_COUNT;
+        ret = ath10k_wmi_set_sta_ps_param(ar, arvif->vdev_id,
+                                          param, value);
+        if (ret) {
+                ath10k_warn(ar, "failed to submit ps poll count %u on vdev %i: %d\n",
+                            value, arvif->vdev_id, ret);
+                return ret;
+        }
+
+        return 0;
+}
+
 static int ath10k_mac_vif_setup_ps(struct ath10k_vif *arvif)
 {
         struct ath10k *ar = arvif->ar;
+        struct ieee80211_vif *vif = arvif->vif;
         struct ieee80211_conf *conf = &ar->hw->conf;
         enum wmi_sta_powersave_param param;
         enum wmi_sta_ps_mode psmode;
         int ret;
+        int ps_timeout;
 
         lockdep_assert_held(&arvif->ar->conf_mutex);
 
         if (arvif->vif->type != NL80211_IFTYPE_STATION)
                 return 0;
 
-        if (conf->flags & IEEE80211_CONF_PS) {
+        if (vif->bss_conf.ps) {
                 psmode = WMI_STA_PS_MODE_ENABLED;
                 param = WMI_STA_PS_PARAM_INACTIVITY_TIME;
 
+                ps_timeout = conf->dynamic_ps_timeout;
+                if (ps_timeout == 0) {
+                        /* Firmware doesn't like 0 */
+                        ps_timeout = ieee80211_tu_to_usec(
+                                vif->bss_conf.beacon_int) / 1000;
+                }
+
                 ret = ath10k_wmi_set_sta_ps_param(ar, arvif->vdev_id, param,
-                                                  conf->dynamic_ps_timeout);
+                                                  ps_timeout);
                 if (ret) {
                         ath10k_warn(ar, "failed to set inactivity time for vdev %d: %i\n",
                                     arvif->vdev_id, ret);
@@ -1090,6 +1303,38 @@ static int ath10k_mac_vif_setup_ps(struct ath10k_vif *arvif)
         return 0;
 }
 
+static int ath10k_mac_vif_disable_keepalive(struct ath10k_vif *arvif)
+{
+        struct ath10k *ar = arvif->ar;
+        struct wmi_sta_keepalive_arg arg = {};
+        int ret;
+
+        lockdep_assert_held(&arvif->ar->conf_mutex);
+
+        if (arvif->vdev_type != WMI_VDEV_TYPE_STA)
+                return 0;
+
+        if (!test_bit(WMI_SERVICE_STA_KEEP_ALIVE, ar->wmi.svc_map))
+                return 0;
+
+        /* Some firmware revisions have a bug and ignore the `enabled` field.
+         * Instead use the interval to disable the keepalive.
+         */
+        arg.vdev_id = arvif->vdev_id;
+        arg.enabled = 1;
+        arg.method = WMI_STA_KEEPALIVE_METHOD_NULL_FRAME;
+        arg.interval = WMI_STA_KEEPALIVE_INTERVAL_DISABLE;
+
+        ret = ath10k_wmi_sta_keepalive(ar, &arg);
+        if (ret) {
+                ath10k_warn(ar, "failed to submit keepalive on vdev %i: %d\n",
+                            arvif->vdev_id, ret);
+                return ret;
+        }
+
+        return 0;
+}
+
 /**********************/
 /* Station management */
 /**********************/
@@ -1358,6 +1603,10 @@ static void ath10k_peer_assoc_h_vht(struct ath10k *ar,
                 return;
 
         arg->peer_flags |= WMI_PEER_VHT;
+
+        if (ar->hw->conf.chandef.chan->band == IEEE80211_BAND_2GHZ)
+                arg->peer_flags |= WMI_PEER_VHT_2G;
+
         arg->peer_vht_caps = vht_cap->cap;
 
         ampdu_factor = (vht_cap->cap &
@@ -1409,9 +1658,22 @@ static void ath10k_peer_assoc_h_qos(struct ath10k *ar,
                 if (vif->bss_conf.qos)
                         arg->peer_flags |= WMI_PEER_QOS;
                 break;
+        case WMI_VDEV_TYPE_IBSS:
+                if (sta->wme)
+                        arg->peer_flags |= WMI_PEER_QOS;
+                break;
         default:
                 break;
         }
+
+        ath10k_dbg(ar, ATH10K_DBG_MAC, "mac peer %pM qos %d\n",
+                   sta->addr, !!(arg->peer_flags & WMI_PEER_QOS));
+}
+
+static bool ath10k_mac_sta_has_11g_rates(struct ieee80211_sta *sta)
+{
+        /* First 4 rates in ath10k_rates are CCK (11b) rates. */
+        return sta->supp_rates[IEEE80211_BAND_2GHZ] >> 4;
 }
 
 static void ath10k_peer_assoc_h_phymode(struct ath10k *ar,
@@ -1423,13 +1685,20 @@ static void ath10k_peer_assoc_h_phymode(struct ath10k *ar,
 
         switch (ar->hw->conf.chandef.chan->band) {
         case IEEE80211_BAND_2GHZ:
-                if (sta->ht_cap.ht_supported) {
+                if (sta->vht_cap.vht_supported) {
+                        if (sta->bandwidth == IEEE80211_STA_RX_BW_40)
+                                phymode = MODE_11AC_VHT40;
+                        else
+                                phymode = MODE_11AC_VHT20;
+                } else if (sta->ht_cap.ht_supported) {
                         if (sta->bandwidth == IEEE80211_STA_RX_BW_40)
                                 phymode = MODE_11NG_HT40;
                         else
                                 phymode = MODE_11NG_HT20;
-                } else {
+                } else if (ath10k_mac_sta_has_11g_rates(sta)) {
                         phymode = MODE_11G;
+                } else {
+                        phymode = MODE_11B;
                 }
 
                 break;
@@ -1603,7 +1872,8 @@ static void ath10k_bss_disassoc(struct ieee80211_hw *hw,
                 ath10k_warn(ar, "faield to down vdev %i: %d\n",
                             arvif->vdev_id, ret);
 
-        arvif->def_wep_key_idx = 0;
+        arvif->def_wep_key_idx = -1;
+
         arvif->is_up = false;
 }
 
@@ -1662,11 +1932,14 @@ static int ath10k_station_assoc(struct ath10k *ar,
                         }
                 }
 
-                ret = ath10k_install_peer_wep_keys(arvif, sta->addr);
-                if (ret) {
-                        ath10k_warn(ar, "failed to install peer wep keys for vdev %i: %d\n",
-                                    arvif->vdev_id, ret);
-                        return ret;
+                /* Plumb cached keys only for static WEP */
+                if (arvif->def_wep_key_idx != -1) {
+                        ret = ath10k_install_peer_wep_keys(arvif, sta->addr);
+                        if (ret) {
+                                ath10k_warn(ar, "failed to install peer wep keys for vdev %i: %d\n",
+                                            arvif->vdev_id, ret);
+                                return ret;
+                        }
                 }
         }
 
@@ -1931,75 +2204,13 @@ static void ath10k_tx_h_nwifi(struct ieee80211_hw *hw, struct sk_buff *skb)
          * used only for CQM purposes (e.g. hostapd station keepalive ping) so
          * it is safe to downgrade to NullFunc.
          */
+        hdr = (void *)skb->data;
         if (ieee80211_is_qos_nullfunc(hdr->frame_control)) {
                 hdr->frame_control &= ~__cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
                 cb->htt.tid = HTT_DATA_TX_EXT_TID_NON_QOS_MCAST_BCAST;
         }
 }
 
-static void ath10k_tx_wep_key_work(struct work_struct *work)
-{
-        struct ath10k_vif *arvif = container_of(work, struct ath10k_vif,
-                                                wep_key_work);
-        struct ath10k *ar = arvif->ar;
-        int ret, keyidx = arvif->def_wep_key_newidx;
-
-        mutex_lock(&arvif->ar->conf_mutex);
-
-        if (arvif->ar->state != ATH10K_STATE_ON)
-                goto unlock;
-
-        if (arvif->def_wep_key_idx == keyidx)
-                goto unlock;
-
-        ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev %d set keyidx %d\n",
-                   arvif->vdev_id, keyidx);
-
-        ret = ath10k_wmi_vdev_set_param(arvif->ar,
-                                        arvif->vdev_id,
-                                        arvif->ar->wmi.vdev_param->def_keyid,
-                                        keyidx);
-        if (ret) {
-                ath10k_warn(ar, "failed to update wep key index for vdev %d: %d\n",
-                            arvif->vdev_id,
-                            ret);
-                goto unlock;
-        }
-
-        arvif->def_wep_key_idx = keyidx;
-
-unlock:
-        mutex_unlock(&arvif->ar->conf_mutex);
-}
-
-static void ath10k_tx_h_update_wep_key(struct ieee80211_vif *vif,
-                                       struct ieee80211_key_conf *key,
-                                       struct sk_buff *skb)
-{
-        struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
-        struct ath10k *ar = arvif->ar;
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
-
-        if (!ieee80211_has_protected(hdr->frame_control))
-                return;
-
-        if (!key)
-                return;
-
-        if (key->cipher != WLAN_CIPHER_SUITE_WEP40 &&
-            key->cipher != WLAN_CIPHER_SUITE_WEP104)
-                return;
-
-        if (key->keyidx == arvif->def_wep_key_idx)
-                return;
-
-        /* FIXME: Most likely a few frames will be TXed with an old key. Simply
-         * queueing frames until key index is updated is not an option because
-         * sk_buff may need more processing to be done, e.g. offchannel */
-        arvif->def_wep_key_newidx = key->keyidx;
-        ieee80211_queue_work(ar->hw, &arvif->wep_key_work);
-}
-
 static void ath10k_tx_h_add_p2p_noa_ie(struct ath10k *ar,
                                        struct ieee80211_vif *vif,
                                        struct sk_buff *skb)
@@ -2151,7 +2362,7 @@ void ath10k_offchan_tx_work(struct work_struct *work)
 
                 ret = wait_for_completion_timeout(&ar->offchan_tx_completed,
                                                   3 * HZ);
-                if (ret <= 0)
+                if (ret == 0)
                         ath10k_warn(ar, "timed out waiting for offchannel skb %p\n",
                                     skb);
 
@@ -2213,6 +2424,7 @@ void __ath10k_scan_finish(struct ath10k *ar)
         case ATH10K_SCAN_RUNNING:
                 if (ar->scan.is_roc)
                         ieee80211_remain_on_channel_expired(ar->hw);
+                /* fall through */
         case ATH10K_SCAN_ABORTING:
                 if (!ar->scan.is_roc)
                         ieee80211_scan_completed(ar->hw,
@@ -2359,7 +2571,6 @@ static void ath10k_tx(struct ieee80211_hw *hw,
         struct ath10k *ar = hw->priv;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct ieee80211_vif *vif = info->control.vif;
-        struct ieee80211_key_conf *key = info->control.hw_key;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 
         /* We should disable CCK RATE due to P2P */
@@ -2373,7 +2584,6 @@ static void ath10k_tx(struct ieee80211_hw *hw,
         /* it makes no sense to process injected frames like that */
         if (vif && vif->type != NL80211_IFTYPE_MONITOR) {
                 ath10k_tx_h_nwifi(hw, skb);
-                ath10k_tx_h_update_wep_key(vif, key, skb);
                 ath10k_tx_h_add_p2p_noa_ie(ar, vif, skb);
                 ath10k_tx_h_seq_no(vif, skb);
         }
@@ -2871,6 +3081,8 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
         int bit;
         u32 vdev_param;
 
+        vif->driver_flags |= IEEE80211_VIF_SUPPORTS_UAPSD;
+
         mutex_lock(&ar->conf_mutex);
 
         memset(arvif, 0, sizeof(*arvif));
@@ -2878,7 +3090,6 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
         arvif->ar = ar;
         arvif->vif = vif;
 
-        INIT_WORK(&arvif->wep_key_work, ath10k_tx_wep_key_work);
         INIT_LIST_HEAD(&arvif->list);
 
         if (ar->free_vdev_map == 0) {
@@ -2894,10 +3105,11 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
         arvif->vdev_id = bit;
         arvif->vdev_subtype = WMI_VDEV_SUBTYPE_NONE;
 
-        if (ar->p2p)
-                arvif->vdev_subtype = WMI_VDEV_SUBTYPE_P2P_DEVICE;
-
         switch (vif->type) {
+        case NL80211_IFTYPE_P2P_DEVICE:
+                arvif->vdev_type = WMI_VDEV_TYPE_STA;
+                arvif->vdev_subtype = WMI_VDEV_SUBTYPE_P2P_DEVICE;
+                break;
         case NL80211_IFTYPE_UNSPECIFIED:
         case NL80211_IFTYPE_STATION:
                 arvif->vdev_type = WMI_VDEV_TYPE_STA;
@@ -2966,15 +3178,18 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
         ar->free_vdev_map &= ~(1LL << arvif->vdev_id);
         list_add(&arvif->list, &ar->arvifs);
 
-        vdev_param = ar->wmi.vdev_param->def_keyid;
-        ret = ath10k_wmi_vdev_set_param(ar, 0, vdev_param,
-                                        arvif->def_wep_key_idx);
+        /* It makes no sense to have firmware do keepalives. mac80211 already
+         * takes care of this with idle connection polling.
+         */
+        ret = ath10k_mac_vif_disable_keepalive(arvif);
         if (ret) {
-                ath10k_warn(ar, "failed to set vdev %i default key id: %d\n",
+                ath10k_warn(ar, "failed to disable keepalive on vdev %i: %d\n",
                             arvif->vdev_id, ret);
                 goto err_vdev_delete;
         }
 
+        arvif->def_wep_key_idx = -1;
+
         vdev_param = ar->wmi.vdev_param->tx_encap_type;
         ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
                                         ATH10K_HW_TXRX_NATIVE_WIFI);
@@ -3026,22 +3241,16 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
                         goto err_peer_delete;
                 }
 
-                param = WMI_STA_PS_PARAM_TX_WAKE_THRESHOLD;
-                value = WMI_STA_PS_TX_WAKE_THRESHOLD_ALWAYS;
-                ret = ath10k_wmi_set_sta_ps_param(ar, arvif->vdev_id,
-                                                  param, value);
+                ret = ath10k_mac_vif_recalc_ps_wake_threshold(arvif);
                 if (ret) {
-                        ath10k_warn(ar, "failed to set vdev %i TX wake thresh: %d\n",
+                        ath10k_warn(ar, "failed to recalc ps wake threshold on vdev %i: %d\n",
                                     arvif->vdev_id, ret);
                         goto err_peer_delete;
                 }
 
-                param = WMI_STA_PS_PARAM_PSPOLL_COUNT;
-                value = WMI_STA_PS_PSPOLL_COUNT_NO_MAX;
-                ret = ath10k_wmi_set_sta_ps_param(ar, arvif->vdev_id,
-                                                  param, value);
+                ret = ath10k_mac_vif_recalc_ps_poll_count(arvif);
                 if (ret) {
-                        ath10k_warn(ar, "failed to set vdev %i PSPOLL count: %d\n",
+                        ath10k_warn(ar, "failed to recalc ps poll count on vdev %i: %d\n",
                                     arvif->vdev_id, ret);
                         goto err_peer_delete;
                 }
@@ -3099,8 +3308,6 @@ static void ath10k_remove_interface(struct ieee80211_hw *hw,
         struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
         int ret;
 
-        cancel_work_sync(&arvif->wep_key_work);
-
         mutex_lock(&ar->conf_mutex);
 
         spin_lock_bh(&ar->data_lock);
@@ -3211,9 +3418,21 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
                 if (ret)
                         ath10k_warn(ar, "failed to set beacon mode for vdev %d: %i\n",
                                     arvif->vdev_id, ret);
+
+                ret = ath10k_mac_setup_bcn_tmpl(arvif);
+                if (ret)
+                        ath10k_warn(ar, "failed to update beacon template: %d\n",
+                                    ret);
         }
 
-        if (changed & BSS_CHANGED_BEACON_INFO) {
+        if (changed & BSS_CHANGED_AP_PROBE_RESP) {
+                ret = ath10k_mac_setup_prb_tmpl(arvif);
+                if (ret)
+                        ath10k_warn(ar, "failed to setup probe resp template on vdev %i: %d\n",
+                                    arvif->vdev_id, ret);
+        }
+
+        if (changed & (BSS_CHANGED_BEACON_INFO | BSS_CHANGED_BEACON)) {
                 arvif->dtim_period = info->dtim_period;
 
                 ath10k_dbg(ar, ATH10K_DBG_MAC,
@@ -3314,6 +3533,13 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
                         ath10k_warn(ar, "failed to recalc tx power: %d\n", ret);
         }
 
+        if (changed & BSS_CHANGED_PS) {
+                ret = ath10k_mac_vif_setup_ps(arvif);
+                if (ret)
+                        ath10k_warn(ar, "failed to setup ps on vdev %i: %d\n",
+                                    arvif->vdev_id, ret);
+        }
+
         mutex_unlock(&ar->conf_mutex);
 }
 
@@ -3453,6 +3679,7 @@ static int ath10k_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
         const u8 *peer_addr;
         bool is_wep = key->cipher == WLAN_CIPHER_SUITE_WEP40 ||
                       key->cipher == WLAN_CIPHER_SUITE_WEP104;
+        bool def_idx = false;
         int ret = 0;
 
         if (key->keyidx > WMI_MAX_KEY_INDEX)
@@ -3498,7 +3725,14 @@ static int ath10k_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                         ath10k_clear_vdev_key(arvif, key);
         }
 
-        ret = ath10k_install_key(arvif, key, cmd, peer_addr);
+        /* set TX_USAGE flag for all the keys incase of dot1x-WEP. For
+         * static WEP, do not set this flag for the keys whose key id
+         * is  greater than default key id.
+         */
+        if (arvif->def_wep_key_idx == -1)
+                def_idx = true;
+
+        ret = ath10k_install_key(arvif, key, cmd, peer_addr, def_idx);
         if (ret) {
                 ath10k_warn(ar, "failed to install key for vdev %i peer %pM: %d\n",
                             arvif->vdev_id, peer_addr, ret);
@@ -3523,6 +3757,39 @@ exit:
         return ret;
 }
 
+static void ath10k_set_default_unicast_key(struct ieee80211_hw *hw,
+                                           struct ieee80211_vif *vif,
+                                           int keyidx)
+{
+        struct ath10k *ar = hw->priv;
+        struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
+        int ret;
+
+        mutex_lock(&arvif->ar->conf_mutex);
+
+        if (arvif->ar->state != ATH10K_STATE_ON)
+                goto unlock;
+
+        ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev %d set keyidx %d\n",
+                   arvif->vdev_id, keyidx);
+
+        ret = ath10k_wmi_vdev_set_param(arvif->ar,
+                                        arvif->vdev_id,
+                                        arvif->ar->wmi.vdev_param->def_keyid,
+                                        keyidx);
+
+        if (ret) {
+                ath10k_warn(ar, "failed to update wep key index for vdev %d: %d\n",
+                            arvif->vdev_id,
+                            ret);
+                goto unlock;
+        }
+
+        arvif->def_wep_key_idx = keyidx;
+unlock:
+        mutex_unlock(&arvif->ar->conf_mutex);
+}
+
 static void ath10k_sta_rc_update_wk(struct work_struct *wk)
 {
         struct ath10k *ar;
@@ -3583,8 +3850,9 @@ static void ath10k_sta_rc_update_wk(struct work_struct *wk)
                                     sta->addr, smps, err);
         }
 
-        if (changed & IEEE80211_RC_SUPP_RATES_CHANGED) {
-                ath10k_dbg(ar, ATH10K_DBG_MAC, "mac update sta %pM supp rates\n",
+        if (changed & IEEE80211_RC_SUPP_RATES_CHANGED ||
+            changed & IEEE80211_RC_NSS_CHANGED) {
+                ath10k_dbg(ar, ATH10K_DBG_MAC, "mac update sta %pM supp rates/nss\n",
                            sta->addr);
 
                 err = ath10k_station_assoc(ar, arvif->vif, sta, true);
@@ -3757,6 +4025,8 @@ static int ath10k_conf_tx_uapsd(struct ath10k *ar, struct ieee80211_vif *vif,
                                 u16 ac, bool enable)
 {
         struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
+        struct wmi_sta_uapsd_auto_trig_arg arg = {};
+        u32 prio = 0, acc = 0;
         u32 value = 0;
         int ret = 0;
 
@@ -3769,18 +4039,26 @@ static int ath10k_conf_tx_uapsd(struct ath10k *ar, struct ieee80211_vif *vif,
         case IEEE80211_AC_VO:
                 value = WMI_STA_PS_UAPSD_AC3_DELIVERY_EN |
                         WMI_STA_PS_UAPSD_AC3_TRIGGER_EN;
+                prio = 7;
+                acc = 3;
                 break;
         case IEEE80211_AC_VI:
                 value = WMI_STA_PS_UAPSD_AC2_DELIVERY_EN |
                         WMI_STA_PS_UAPSD_AC2_TRIGGER_EN;
+                prio = 5;
+                acc = 2;
                 break;
         case IEEE80211_AC_BE:
                 value = WMI_STA_PS_UAPSD_AC1_DELIVERY_EN |
                         WMI_STA_PS_UAPSD_AC1_TRIGGER_EN;
+                prio = 2;
+                acc = 1;
                 break;
         case IEEE80211_AC_BK:
                 value = WMI_STA_PS_UAPSD_AC0_DELIVERY_EN |
                         WMI_STA_PS_UAPSD_AC0_TRIGGER_EN;
+                prio = 0;
+                acc = 0;
                 break;
         }
 
@@ -3808,6 +4086,43 @@ static int ath10k_conf_tx_uapsd(struct ath10k *ar, struct ieee80211_vif *vif,
         if (ret)
                 ath10k_warn(ar, "failed to set rx wake param: %d\n", ret);
 
+        ret = ath10k_mac_vif_recalc_ps_wake_threshold(arvif);
+        if (ret) {
+                ath10k_warn(ar, "failed to recalc ps wake threshold on vdev %i: %d\n",
+                            arvif->vdev_id, ret);
+                return ret;
+        }
+
+        ret = ath10k_mac_vif_recalc_ps_poll_count(arvif);
+        if (ret) {
+                ath10k_warn(ar, "failed to recalc ps poll count on vdev %i: %d\n",
+                            arvif->vdev_id, ret);
+                return ret;
+        }
+
+        if (test_bit(WMI_SERVICE_STA_UAPSD_BASIC_AUTO_TRIG, ar->wmi.svc_map) ||
+            test_bit(WMI_SERVICE_STA_UAPSD_VAR_AUTO_TRIG, ar->wmi.svc_map)) {
+                /* Only userspace can make an educated decision when to send
+                 * trigger frame. The following effectively disables u-UAPSD
+                 * autotrigger in firmware (which is enabled by default
+                 * provided the autotrigger service is available).
+                 */
+
+                arg.wmm_ac = acc;
+                arg.user_priority = prio;
+                arg.service_interval = 0;
+                arg.suspend_interval = WMI_STA_UAPSD_MAX_INTERVAL_MSEC;
+                arg.delay_interval = WMI_STA_UAPSD_MAX_INTERVAL_MSEC;
+
+                ret = ath10k_wmi_vdev_sta_uapsd(ar, arvif->vdev_id,
+                                                arvif->bssid, &arg, 1);
+                if (ret) {
+                        ath10k_warn(ar, "failed to set uapsd auto trigger %d\n",
+                                    ret);
+                        return ret;
+                }
+        }
+
 exit:
         return ret;
 }
@@ -3817,6 +4132,7 @@ static int ath10k_conf_tx(struct ieee80211_hw *hw,
                           const struct ieee80211_tx_queue_params *params)
 {
         struct ath10k *ar = hw->priv;
+        struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
         struct wmi_wmm_params_arg *p = NULL;
         int ret;
 
@@ -3824,16 +4140,16 @@ static int ath10k_conf_tx(struct ieee80211_hw *hw,
 
         switch (ac) {
         case IEEE80211_AC_VO:
-                p = &ar->wmm_params.ac_vo;
+                p = &arvif->wmm_params.ac_vo;
                 break;
         case IEEE80211_AC_VI:
-                p = &ar->wmm_params.ac_vi;
+                p = &arvif->wmm_params.ac_vi;
                 break;
         case IEEE80211_AC_BE:
-                p = &ar->wmm_params.ac_be;
+                p = &arvif->wmm_params.ac_be;
                 break;
         case IEEE80211_AC_BK:
-                p = &ar->wmm_params.ac_bk;
+                p = &arvif->wmm_params.ac_bk;
                 break;
         }
 
@@ -3853,11 +4169,23 @@ static int ath10k_conf_tx(struct ieee80211_hw *hw,
          */
         p->txop = params->txop * 32;
 
-        /* FIXME: FW accepts wmm params per hw, not per vif */
-        ret = ath10k_wmi_pdev_set_wmm_params(ar, &ar->wmm_params);
-        if (ret) {
-                ath10k_warn(ar, "failed to set wmm params: %d\n", ret);
-                goto exit;
+        if (ar->wmi.ops->gen_vdev_wmm_conf) {
+                ret = ath10k_wmi_vdev_wmm_conf(ar, arvif->vdev_id,
+                                               &arvif->wmm_params);
+                if (ret) {
+                        ath10k_warn(ar, "failed to set vdev wmm params on vdev %i: %d\n",
+                                    arvif->vdev_id, ret);
+                        goto exit;
+                }
+        } else {
+                /* This won't work well with multi-interface cases but it's
+                 * better than nothing.
+                 */
+                ret = ath10k_wmi_pdev_set_wmm_params(ar, &arvif->wmm_params);
+                if (ret) {
+                        ath10k_warn(ar, "failed to set wmm params: %d\n", ret);
+                        goto exit;
+                }
         }
 
         ret = ath10k_conf_tx_uapsd(ar, vif, ac, params->uapsd);
@@ -3989,29 +4317,6 @@ static int ath10k_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
         return ret;
 }
 
-static int ath10k_set_frag_threshold(struct ieee80211_hw *hw, u32 value)
-{
-        struct ath10k *ar = hw->priv;
-        struct ath10k_vif *arvif;
-        int ret = 0;
-
-        mutex_lock(&ar->conf_mutex);
-        list_for_each_entry(arvif, &ar->arvifs, list) {
-                ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev %d fragmentation threshold %d\n",
-                           arvif->vdev_id, value);
-
-                ret = ath10k_mac_set_frag(arvif, value);
-                if (ret) {
-                        ath10k_warn(ar, "failed to set fragmentation threshold for vdev %d: %d\n",
-                                    arvif->vdev_id, ret);
-                        break;
-                }
-        }
-        mutex_unlock(&ar->conf_mutex);
-
-        return ret;
-}
-
 static void ath10k_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                          u32 queues, bool drop)
 {
@@ -4650,12 +4955,12 @@ static const struct ieee80211_ops ath10k_ops = {
         .hw_scan                        = ath10k_hw_scan,
         .cancel_hw_scan                 = ath10k_cancel_hw_scan,
         .set_key                        = ath10k_set_key,
+        .set_default_unicast_key        = ath10k_set_default_unicast_key,
         .sta_state                      = ath10k_sta_state,
         .conf_tx                        = ath10k_conf_tx,
         .remain_on_channel              = ath10k_remain_on_channel,
         .cancel_remain_on_channel       = ath10k_cancel_remain_on_channel,
         .set_rts_threshold              = ath10k_set_rts_threshold,
-        .set_frag_threshold             = ath10k_set_frag_threshold,
         .flush                          = ath10k_flush,
         .tx_last_beacon                 = ath10k_tx_last_beacon,
         .set_antenna                    = ath10k_set_antenna,
@@ -4676,6 +4981,9 @@ static const struct ieee80211_ops ath10k_ops = {
         .suspend                        = ath10k_suspend,
         .resume                         = ath10k_resume,
 #endif
+#ifdef CONFIG_MAC80211_DEBUGFS
+        .sta_add_debugfs                = ath10k_sta_add_debugfs,
+#endif
 };
 
 #define RATETAB_ENT(_rate, _rateid, _flags) { \
@@ -4746,6 +5054,9 @@ static const struct ieee80211_channel ath10k_5ghz_channels[] = {
         CHAN5G(165, 5825, 0),
 };
 
+/* Note: Be careful if you re-order these. There is code which depends on this
+ * ordering.
+ */
 static struct ieee80211_rate ath10k_rates[] = {
         /* CCK */
         RATETAB_ENT(10,  0x82, 0),
@@ -4799,6 +5110,10 @@ static const struct ieee80211_iface_limit ath10k_if_limits[] = {
         .types  = BIT(NL80211_IFTYPE_P2P_GO)
         },
         {
+        .max    = 1,
+        .types  = BIT(NL80211_IFTYPE_P2P_DEVICE)
+        },
+        {
         .max    = 7,
         .types  = BIT(NL80211_IFTYPE_AP)
         },
@@ -4956,6 +5271,13 @@ struct ath10k_vif *ath10k_get_arvif(struct ath10k *ar, u32 vdev_id)
 
 int ath10k_mac_register(struct ath10k *ar)
 {
+        static const u32 cipher_suites[] = {
+                WLAN_CIPHER_SUITE_WEP40,
+                WLAN_CIPHER_SUITE_WEP104,
+                WLAN_CIPHER_SUITE_TKIP,
+                WLAN_CIPHER_SUITE_CCMP,
+                WLAN_CIPHER_SUITE_AES_CMAC,
+        };
         struct ieee80211_supported_band *band;
         struct ieee80211_sta_vht_cap vht_cap;
         struct ieee80211_sta_ht_cap ht_cap;
@@ -4985,7 +5307,8 @@ int ath10k_mac_register(struct ath10k *ar)
                 band->bitrates = ath10k_g_rates;
                 band->ht_cap = ht_cap;
 
-                /* vht is not supported in 2.4 GHz */
+                /* Enable the VHT support at 2.4 GHz */
+                band->vht_cap = vht_cap;
 
                 ar->hw->wiphy->bands[IEEE80211_BAND_2GHZ] = band;
         }
@@ -5018,18 +5341,19 @@ int ath10k_mac_register(struct ath10k *ar)
 
         if (!test_bit(ATH10K_FW_FEATURE_NO_P2P, ar->fw_features))
                 ar->hw->wiphy->interface_modes |=
+                        BIT(NL80211_IFTYPE_P2P_DEVICE) |
                         BIT(NL80211_IFTYPE_P2P_CLIENT) |
                         BIT(NL80211_IFTYPE_P2P_GO);
 
         ar->hw->flags = IEEE80211_HW_SIGNAL_DBM |
                         IEEE80211_HW_SUPPORTS_PS |
                         IEEE80211_HW_SUPPORTS_DYNAMIC_PS |
-                        IEEE80211_HW_SUPPORTS_UAPSD |
                         IEEE80211_HW_MFP_CAPABLE |
                         IEEE80211_HW_REPORTS_TX_ACK_STATUS |
                         IEEE80211_HW_HAS_RATE_CONTROL |
                         IEEE80211_HW_AP_LINK_PS |
-                        IEEE80211_HW_SPECTRUM_MGMT;
+                        IEEE80211_HW_SPECTRUM_MGMT |
+                        IEEE80211_HW_SW_CRYPTO_CONTROL;
 
         ar->hw->wiphy->features |= NL80211_FEATURE_STATIC_SMPS;
 
@@ -5049,6 +5373,19 @@ int ath10k_mac_register(struct ath10k *ar)
 
         ar->hw->max_listen_interval = ATH10K_MAX_HW_LISTEN_INTERVAL;
 
+        if (test_bit(WMI_SERVICE_BEACON_OFFLOAD, ar->wmi.svc_map)) {
+                ar->hw->wiphy->flags |= WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD;
+
+                /* Firmware delivers WPS/P2P Probe Requests frames to driver so
+                 * that userspace (e.g. wpa_supplicant/hostapd) can generate
+                 * correct Probe Responses. This is more of a hack advert..
+                 */
+                ar->hw->wiphy->probe_resp_offload |=
+                        NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS |
+                        NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS2 |
+                        NL80211_PROBE_RESP_OFFLOAD_SUPPORT_P2P;
+        }
+
         ar->hw->wiphy->flags |= WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
         ar->hw->wiphy->flags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH;
         ar->hw->wiphy->max_remain_on_channel_duration = 5000;
@@ -5062,16 +5399,26 @@ int ath10k_mac_register(struct ath10k *ar)
          */
         ar->hw->queues = 4;
 
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
-                ar->hw->wiphy->iface_combinations = ath10k_10x_if_comb;
-                ar->hw->wiphy->n_iface_combinations =
-                        ARRAY_SIZE(ath10k_10x_if_comb);
-        } else {
+        switch (ar->wmi.op_version) {
+        case ATH10K_FW_WMI_OP_VERSION_MAIN:
+        case ATH10K_FW_WMI_OP_VERSION_TLV:
                 ar->hw->wiphy->iface_combinations = ath10k_if_comb;
                 ar->hw->wiphy->n_iface_combinations =
                         ARRAY_SIZE(ath10k_if_comb);
-
                 ar->hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_ADHOC);
+                break;
+        case ATH10K_FW_WMI_OP_VERSION_10_1:
+        case ATH10K_FW_WMI_OP_VERSION_10_2:
+        case ATH10K_FW_WMI_OP_VERSION_10_2_4:
+                ar->hw->wiphy->iface_combinations = ath10k_10x_if_comb;
+                ar->hw->wiphy->n_iface_combinations =
+                        ARRAY_SIZE(ath10k_10x_if_comb);
+                break;
+        case ATH10K_FW_WMI_OP_VERSION_UNSET:
+        case ATH10K_FW_WMI_OP_VERSION_MAX:
+                WARN_ON(1);
+                ret = -EINVAL;
+                goto err_free;
         }
 
         ar->hw->netdev_features = NETIF_F_HW_CSUM;
@@ -5093,6 +5440,9 @@ int ath10k_mac_register(struct ath10k *ar)
                 goto err_free;
         }
 
+        ar->hw->wiphy->cipher_suites = cipher_suites;
+        ar->hw->wiphy->n_cipher_suites = ARRAY_SIZE(cipher_suites);
+
         ret = ieee80211_register_hw(ar->hw);
         if (ret) {
                 ath10k_err(ar, "failed to register ieee80211: %d\n", ret);
diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
index 7abb8367119a..e6972b09333e 100644
--- a/drivers/net/wireless/ath/ath10k/pci.c
+++ b/drivers/net/wireless/ath/ath10k/pci.c
@@ -58,12 +58,27 @@ MODULE_PARM_DESC(reset_mode, "0: auto, 1: warm only (default: 0)");
 #define ATH10K_PCI_NUM_WARM_RESET_ATTEMPTS 3
 
 #define QCA988X_2_0_DEVICE_ID   (0x003c)
+#define QCA6174_2_1_DEVICE_ID   (0x003e)
 
 static const struct pci_device_id ath10k_pci_id_table[] = {
         { PCI_VDEVICE(ATHEROS, QCA988X_2_0_DEVICE_ID) }, /* PCI-E QCA988X V2 */
+        { PCI_VDEVICE(ATHEROS, QCA6174_2_1_DEVICE_ID) }, /* PCI-E QCA6174 V2.1 */
         {0}
 };
 
+static const struct ath10k_pci_supp_chip ath10k_pci_supp_chips[] = {
+        /* QCA988X pre 2.0 chips are not supported because they need some nasty
+         * hacks. ath10k doesn't have them and these devices crash horribly
+         * because of that.
+         */
+        { QCA988X_2_0_DEVICE_ID, QCA988X_HW_2_0_CHIP_ID_REV },
+        { QCA6174_2_1_DEVICE_ID, QCA6174_HW_2_1_CHIP_ID_REV },
+        { QCA6174_2_1_DEVICE_ID, QCA6174_HW_2_2_CHIP_ID_REV },
+        { QCA6174_2_1_DEVICE_ID, QCA6174_HW_3_0_CHIP_ID_REV },
+        { QCA6174_2_1_DEVICE_ID, QCA6174_HW_3_1_CHIP_ID_REV },
+        { QCA6174_2_1_DEVICE_ID, QCA6174_HW_3_2_CHIP_ID_REV },
+};
+
 static void ath10k_pci_buffer_cleanup(struct ath10k *ar);
 static int ath10k_pci_cold_reset(struct ath10k *ar);
 static int ath10k_pci_warm_reset(struct ath10k *ar);
@@ -395,7 +410,7 @@ static int __ath10k_pci_rx_post_buf(struct ath10k_pci_pipe *pipe)
                 return -EIO;
         }
 
-        ATH10K_SKB_CB(skb)->paddr = paddr;
+        ATH10K_SKB_RXCB(skb)->paddr = paddr;
 
         ret = __ath10k_ce_rx_post_buf(ce_pipe, skb, paddr);
         if (ret) {
@@ -864,7 +879,7 @@ static void ath10k_pci_ce_recv_data(struct ath10k_ce_pipe *ce_state)
                                              &flags) == 0) {
                 skb = transfer_context;
                 max_nbytes = skb->len + skb_tailroom(skb);
-                dma_unmap_single(ar->dev, ATH10K_SKB_CB(skb)->paddr,
+                dma_unmap_single(ar->dev, ATH10K_SKB_RXCB(skb)->paddr,
                                  max_nbytes, DMA_FROM_DEVICE);
 
                 if (unlikely(max_nbytes < nbytes)) {
@@ -1230,7 +1245,7 @@ static void ath10k_pci_rx_pipe_cleanup(struct ath10k_pci_pipe *pci_pipe)
 
                 ce_ring->per_transfer_context[i] = NULL;
 
-                dma_unmap_single(ar->dev, ATH10K_SKB_CB(skb)->paddr,
+                dma_unmap_single(ar->dev, ATH10K_SKB_RXCB(skb)->paddr,
                                  skb->len + skb_tailroom(skb),
                                  DMA_FROM_DEVICE);
                 dev_kfree_skb_any(skb);
@@ -1498,6 +1513,35 @@ static int ath10k_pci_wake_target_cpu(struct ath10k *ar)
         return 0;
 }
 
+static int ath10k_pci_get_num_banks(struct ath10k *ar)
+{
+        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
+
+        switch (ar_pci->pdev->device) {
+        case QCA988X_2_0_DEVICE_ID:
+                return 1;
+        case QCA6174_2_1_DEVICE_ID:
+                switch (MS(ar->chip_id, SOC_CHIP_ID_REV)) {
+                case QCA6174_HW_1_0_CHIP_ID_REV:
+                case QCA6174_HW_1_1_CHIP_ID_REV:
+                        return 3;
+                case QCA6174_HW_1_3_CHIP_ID_REV:
+                        return 2;
+                case QCA6174_HW_2_1_CHIP_ID_REV:
+                case QCA6174_HW_2_2_CHIP_ID_REV:
+                        return 6;
+                case QCA6174_HW_3_0_CHIP_ID_REV:
+                case QCA6174_HW_3_1_CHIP_ID_REV:
+                case QCA6174_HW_3_2_CHIP_ID_REV:
+                        return 9;
+                }
+                break;
+        }
+
+        ath10k_warn(ar, "unknown number of banks, assuming 1\n");
+        return 1;
+}
+
 static int ath10k_pci_init_config(struct ath10k *ar)
 {
         u32 interconnect_targ_addr;
@@ -1608,7 +1652,8 @@ static int ath10k_pci_init_config(struct ath10k *ar)
         /* first bank is switched to IRAM */
         ealloc_value |= ((HI_EARLY_ALLOC_MAGIC << HI_EARLY_ALLOC_MAGIC_SHIFT) &
                          HI_EARLY_ALLOC_MAGIC_MASK);
-        ealloc_value |= ((1 << HI_EARLY_ALLOC_IRAM_BANKS_SHIFT) &
+        ealloc_value |= ((ath10k_pci_get_num_banks(ar) <<
+                          HI_EARLY_ALLOC_IRAM_BANKS_SHIFT) &
                          HI_EARLY_ALLOC_IRAM_BANKS_MASK);
 
         ret = ath10k_pci_diag_write32(ar, ealloc_targ_addr, ealloc_value);
@@ -1804,12 +1849,12 @@ static int ath10k_pci_warm_reset(struct ath10k *ar)
         return 0;
 }
 
-static int ath10k_pci_chip_reset(struct ath10k *ar)
+static int ath10k_pci_qca988x_chip_reset(struct ath10k *ar)
 {
         int i, ret;
         u32 val;
 
-        ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot chip reset\n");
+        ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot 988x chip reset\n");
 
         /* Some hardware revisions (e.g. CUS223v2) has issues with cold reset.
          * It is thus preferred to use warm reset which is safer but may not be
@@ -1873,11 +1918,53 @@ static int ath10k_pci_chip_reset(struct ath10k *ar)
                 return ret;
         }
 
-        ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot chip reset complete (cold)\n");
+        ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot qca988x chip reset complete (cold)\n");
+
+        return 0;
+}
+
+static int ath10k_pci_qca6174_chip_reset(struct ath10k *ar)
+{
+        int ret;
+
+        ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot qca6174 chip reset\n");
+
+        /* FIXME: QCA6174 requires cold + warm reset to work. */
+
+        ret = ath10k_pci_cold_reset(ar);
+        if (ret) {
+                ath10k_warn(ar, "failed to cold reset: %d\n", ret);
+                return ret;
+        }
+
+        ret = ath10k_pci_wait_for_target_init(ar);
+        if (ret) {
+                ath10k_warn(ar, "failed to wait for target after cold reset: %d\n",
+                                ret);
+                return ret;
+        }
+
+        ret = ath10k_pci_warm_reset(ar);
+        if (ret) {
+                ath10k_warn(ar, "failed to warm reset: %d\n", ret);
+                return ret;
+        }
+
+        ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot qca6174 chip reset complete (cold)\n");
 
         return 0;
 }
 
+static int ath10k_pci_chip_reset(struct ath10k *ar)
+{
+        if (QCA_REV_988X(ar))
+                return ath10k_pci_qca988x_chip_reset(ar);
+        else if (QCA_REV_6174(ar))
+                return ath10k_pci_qca6174_chip_reset(ar);
+        else
+                return -ENOTSUPP;
+}
+
 static int ath10k_pci_hif_power_up(struct ath10k *ar)
 {
         int ret;
@@ -1902,6 +1989,12 @@ static int ath10k_pci_hif_power_up(struct ath10k *ar)
          */
         ret = ath10k_pci_chip_reset(ar);
         if (ret) {
+                if (ath10k_pci_has_fw_crashed(ar)) {
+                        ath10k_warn(ar, "firmware crashed during chip reset\n");
+                        ath10k_pci_fw_crashed_clear(ar);
+                        ath10k_pci_fw_crashed_dump(ar);
+                }
+
                 ath10k_err(ar, "failed to reset chip: %d\n", ret);
                 goto err_sleep;
         }
@@ -2033,6 +2126,7 @@ static void ath10k_msi_err_tasklet(unsigned long data)
                 return;
         }
 
+        ath10k_pci_irq_disable(ar);
         ath10k_pci_fw_crashed_clear(ar);
         ath10k_pci_fw_crashed_dump(ar);
 }
@@ -2102,6 +2196,7 @@ static void ath10k_pci_tasklet(unsigned long data)
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
 
         if (ath10k_pci_has_fw_crashed(ar)) {
+                ath10k_pci_irq_disable(ar);
                 ath10k_pci_fw_crashed_clear(ar);
                 ath10k_pci_fw_crashed_dump(ar);
                 return;
@@ -2344,8 +2439,6 @@ static int ath10k_pci_wait_for_target_init(struct ath10k *ar)
 
         if (val & FW_IND_EVENT_PENDING) {
                 ath10k_warn(ar, "device has crashed during init\n");
-                ath10k_pci_fw_crashed_clear(ar);
-                ath10k_pci_fw_crashed_dump(ar);
                 return -ECOMM;
         }
 
@@ -2476,17 +2569,46 @@ static void ath10k_pci_release(struct ath10k *ar)
         pci_disable_device(pdev);
 }
 
+static bool ath10k_pci_chip_is_supported(u32 dev_id, u32 chip_id)
+{
+        const struct ath10k_pci_supp_chip *supp_chip;
+        int i;
+        u32 rev_id = MS(chip_id, SOC_CHIP_ID_REV);
+
+        for (i = 0; i < ARRAY_SIZE(ath10k_pci_supp_chips); i++) {
+                supp_chip = &ath10k_pci_supp_chips[i];
+
+                if (supp_chip->dev_id == dev_id &&
+                    supp_chip->rev_id == rev_id)
+                        return true;
+        }
+
+        return false;
+}
+
 static int ath10k_pci_probe(struct pci_dev *pdev,
                             const struct pci_device_id *pci_dev)
 {
         int ret = 0;
         struct ath10k *ar;
         struct ath10k_pci *ar_pci;
+        enum ath10k_hw_rev hw_rev;
         u32 chip_id;
 
-        ar = ath10k_core_create(sizeof(*ar_pci), &pdev->dev,
-                                ATH10K_BUS_PCI,
-                                &ath10k_pci_hif_ops);
+        switch (pci_dev->device) {
+        case QCA988X_2_0_DEVICE_ID:
+                hw_rev = ATH10K_HW_QCA988X;
+                break;
+        case QCA6174_2_1_DEVICE_ID:
+                hw_rev = ATH10K_HW_QCA6174;
+                break;
+        default:
+                WARN_ON(1);
+                return -ENOTSUPP;
+        }
+
+        ar = ath10k_core_create(sizeof(*ar_pci), &pdev->dev, ATH10K_BUS_PCI,
+                                hw_rev, &ath10k_pci_hif_ops);
         if (!ar) {
                 dev_err(&pdev->dev, "failed to allocate core\n");
                 return -ENOMEM;
@@ -2515,12 +2637,6 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
                 goto err_release;
         }
 
-        chip_id = ath10k_pci_soc_read32(ar, SOC_CHIP_ID_ADDRESS);
-        if (chip_id == 0xffffffff) {
-                ath10k_err(ar, "failed to get chip id\n");
-                goto err_sleep;
-        }
-
         ret = ath10k_pci_alloc_pipes(ar);
         if (ret) {
                 ath10k_err(ar, "failed to allocate copy engine pipes: %d\n",
@@ -2547,6 +2663,24 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
                 goto err_deinit_irq;
         }
 
+        ret = ath10k_pci_chip_reset(ar);
+        if (ret) {
+                ath10k_err(ar, "failed to reset chip: %d\n", ret);
+                goto err_free_irq;
+        }
+
+        chip_id = ath10k_pci_soc_read32(ar, SOC_CHIP_ID_ADDRESS);
+        if (chip_id == 0xffffffff) {
+                ath10k_err(ar, "failed to get chip id\n");
+                goto err_free_irq;
+        }
+
+        if (!ath10k_pci_chip_is_supported(pdev->device, chip_id)) {
+                ath10k_err(ar, "device %04x with chip_id %08x isn't supported\n",
+                           pdev->device, chip_id);
+                goto err_sleep;
+        }
+
         ath10k_pci_sleep(ar);
 
         ret = ath10k_core_register(ar, chip_id);
diff --git a/drivers/net/wireless/ath/ath10k/pci.h b/drivers/net/wireless/ath/ath10k/pci.h
index cf36511c7f4d..bddf54320160 100644
--- a/drivers/net/wireless/ath/ath10k/pci.h
+++ b/drivers/net/wireless/ath/ath10k/pci.h
@@ -152,6 +152,11 @@ struct ath10k_pci_pipe {
         struct tasklet_struct intr;
 };
 
+struct ath10k_pci_supp_chip {
+        u32 dev_id;
+        u32 rev_id;
+};
+
 struct ath10k_pci {
         struct pci_dev *pdev;
         struct device *dev;
@@ -189,7 +194,7 @@ static inline struct ath10k_pci *ath10k_pci_priv(struct ath10k *ar)
 
 #define ATH10K_PCI_RX_POST_RETRY_MS 50
 #define ATH_PCI_RESET_WAIT_MAX 10 /* ms */
-#define PCIE_WAKE_TIMEOUT 5000  /* 5ms */
+#define PCIE_WAKE_TIMEOUT 10000 /* 10ms */
 
 #define BAR_NUM 0
 
diff --git a/drivers/net/wireless/ath/ath10k/rx_desc.h b/drivers/net/wireless/ath/ath10k/rx_desc.h
index e1ffdd57a18c..e9cc7787bf5f 100644
--- a/drivers/net/wireless/ath/ath10k/rx_desc.h
+++ b/drivers/net/wireless/ath/ath10k/rx_desc.h
@@ -850,7 +850,7 @@ struct rx_ppdu_start {
 
 #define RX_PPDU_END_INFO1_PPDU_DONE (1 << 15)
 
-struct rx_ppdu_end {
+struct rx_ppdu_end_common {
         __le32 evm_p0;
         __le32 evm_p1;
         __le32 evm_p2;
@@ -873,10 +873,33 @@ struct rx_ppdu_end {
         u8 phy_err_code;
         __le16 flags; /* %RX_PPDU_END_FLAGS_ */
         __le32 info0; /* %RX_PPDU_END_INFO0_ */
+} __packed;
+
+struct rx_ppdu_end_qca988x {
         __le16 bb_length;
         __le16 info1; /* %RX_PPDU_END_INFO1_ */
 } __packed;
 
+#define RX_PPDU_END_RTT_CORRELATION_VALUE_MASK 0x00ffffff
+#define RX_PPDU_END_RTT_CORRELATION_VALUE_LSB  0
+#define RX_PPDU_END_RTT_UNUSED_MASK            0x7f000000
+#define RX_PPDU_END_RTT_UNUSED_LSB             24
+#define RX_PPDU_END_RTT_NORMAL_MODE            BIT(31)
+
+struct rx_ppdu_end_qca6174 {
+        __le32 rtt; /* %RX_PPDU_END_RTT_ */
+        __le16 bb_length;
+        __le16 info1; /* %RX_PPDU_END_INFO1_ */
+} __packed;
+
+struct rx_ppdu_end {
+        struct rx_ppdu_end_common common;
+        union {
+                struct rx_ppdu_end_qca988x qca988x;
+                struct rx_ppdu_end_qca6174 qca6174;
+        } __packed;
+} __packed;
+
 /*
  * evm_p0
  *              EVM for pilot 0.  Contain EVM for streams: 0, 1, 2 and 3.
diff --git a/drivers/net/wireless/ath/ath10k/spectral.c b/drivers/net/wireless/ath/ath10k/spectral.c
index 63ce61fcdac8..d22addf6118b 100644
--- a/drivers/net/wireless/ath/ath10k/spectral.c
+++ b/drivers/net/wireless/ath/ath10k/spectral.c
@@ -17,6 +17,7 @@
 #include <linux/relay.h>
 #include "core.h"
 #include "debug.h"
+#include "wmi-ops.h"
 
 static void send_fft_sample(struct ath10k *ar,
                             const struct fft_sample_tlv *fft_sample_tlv)
diff --git a/drivers/net/wireless/ath/ath10k/targaddrs.h b/drivers/net/wireless/ath/ath10k/targaddrs.h
index 9d0ae30f9ff1..a417aae52623 100644
--- a/drivers/net/wireless/ath/ath10k/targaddrs.h
+++ b/drivers/net/wireless/ath/ath10k/targaddrs.h
@@ -18,6 +18,8 @@
 #ifndef __TARGADDRS_H__
 #define __TARGADDRS_H__
 
+#include "hw.h"
+
 /*
  * xxx_HOST_INTEREST_ADDRESS is the address in Target RAM of the
  * host_interest structure.  It must match the address of the _host_interest
@@ -445,4 +447,7 @@ Fw Mode/SubMode Mask
 #define QCA988X_BOARD_DATA_SZ     7168
 #define QCA988X_BOARD_EXT_DATA_SZ 0
 
+#define QCA6174_BOARD_DATA_SZ     8192
+#define QCA6174_BOARD_EXT_DATA_SZ 0
+
 #endif /* __TARGADDRS_H__ */
diff --git a/drivers/net/wireless/ath/ath10k/testmode.c b/drivers/net/wireless/ath/ath10k/testmode.c
index 483db9cb8c96..b084f88da102 100644
--- a/drivers/net/wireless/ath/ath10k/testmode.c
+++ b/drivers/net/wireless/ath/ath10k/testmode.c
@@ -187,13 +187,14 @@ static int ath10k_tm_cmd_utf_start(struct ath10k *ar, struct nlattr *tb[])
 
         memcpy(ar->testmode.orig_fw_features, ar->fw_features,
                sizeof(ar->fw_features));
+        ar->testmode.orig_wmi_op_version = ar->wmi.op_version;
 
         /* utf.bin firmware image does not advertise firmware features. Do
          * an ugly hack where we force the firmware features so that wmi.c
          * will use the correct WMI interface.
          */
         memset(ar->fw_features, 0, sizeof(ar->fw_features));
-        __set_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features);
+        ar->wmi.op_version = ATH10K_FW_WMI_OP_VERSION_10_1;
 
         ret = ath10k_hif_power_up(ar);
         if (ret) {
@@ -224,6 +225,7 @@ err_fw_features:
         /* return the original firmware features */
         memcpy(ar->fw_features, ar->testmode.orig_fw_features,
                sizeof(ar->fw_features));
+        ar->wmi.op_version = ar->testmode.orig_wmi_op_version;
 
         release_firmware(ar->testmode.utf);
         ar->testmode.utf = NULL;
@@ -250,6 +252,7 @@ static void __ath10k_tm_cmd_utf_stop(struct ath10k *ar)
         /* return the original firmware features */
         memcpy(ar->fw_features, ar->testmode.orig_fw_features,
                sizeof(ar->fw_features));
+        ar->wmi.op_version = ar->testmode.orig_wmi_op_version;
 
         release_firmware(ar->testmode.utf);
         ar->testmode.utf = NULL;
diff --git a/drivers/net/wireless/ath/ath10k/thermal.c b/drivers/net/wireless/ath/ath10k/thermal.c
new file mode 100644
index 000000000000..aede750809fe
--- /dev/null
+++ b/drivers/net/wireless/ath/ath10k/thermal.c
@@ -0,0 +1,244 @@
+/*
+ * Copyright (c) 2014 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/device.h>
+#include <linux/sysfs.h>
+#include <linux/thermal.h>
+#include <linux/hwmon.h>
+#include <linux/hwmon-sysfs.h>
+#include "core.h"
+#include "debug.h"
+#include "wmi-ops.h"
+
+static int ath10k_thermal_get_active_vifs(struct ath10k *ar,
+                                          enum wmi_vdev_type type)
+{
+        struct ath10k_vif *arvif;
+        int count = 0;
+
+        lockdep_assert_held(&ar->conf_mutex);
+
+        list_for_each_entry(arvif, &ar->arvifs, list) {
+                if (!arvif->is_started)
+                        continue;
+
+                if (!arvif->is_up)
+                        continue;
+
+                if (arvif->vdev_type != type)
+                        continue;
+
+                count++;
+        }
+        return count;
+}
+
+static int ath10k_thermal_get_max_dutycycle(struct thermal_cooling_device *cdev,
+                                            unsigned long *state)
+{
+        *state = ATH10K_QUIET_DUTY_CYCLE_MAX;
+
+        return 0;
+}
+
+static int ath10k_thermal_get_cur_dutycycle(struct thermal_cooling_device *cdev,
+                                            unsigned long *state)
+{
+        struct ath10k *ar = cdev->devdata;
+
+        mutex_lock(&ar->conf_mutex);
+        *state = ar->thermal.duty_cycle;
+        mutex_unlock(&ar->conf_mutex);
+
+        return 0;
+}
+
+static int ath10k_thermal_set_cur_dutycycle(struct thermal_cooling_device *cdev,
+                                            unsigned long duty_cycle)
+{
+        struct ath10k *ar = cdev->devdata;
+        u32 period, duration, enabled;
+        int num_bss, ret = 0;
+
+        mutex_lock(&ar->conf_mutex);
+        if (ar->state != ATH10K_STATE_ON) {
+                ret = -ENETDOWN;
+                goto out;
+        }
+
+        if (duty_cycle > ATH10K_QUIET_DUTY_CYCLE_MAX) {
+                ath10k_warn(ar, "duty cycle %ld is exceeding the limit %d\n",
+                            duty_cycle, ATH10K_QUIET_DUTY_CYCLE_MAX);
+                ret = -EINVAL;
+                goto out;
+        }
+        /* TODO: Right now, thermal mitigation is handled only for single/multi
+         * vif AP mode. Since quiet param is not validated in STA mode, it needs
+         * to be investigated further to handle multi STA and multi-vif (AP+STA)
+         * mode properly.
+         */
+        num_bss = ath10k_thermal_get_active_vifs(ar, WMI_VDEV_TYPE_AP);
+        if (!num_bss) {
+                ath10k_warn(ar, "no active AP interfaces\n");
+                ret = -ENETDOWN;
+                goto out;
+        }
+        period = max(ATH10K_QUIET_PERIOD_MIN,
+                     (ATH10K_QUIET_PERIOD_DEFAULT / num_bss));
+        duration = (period * duty_cycle) / 100;
+        enabled = duration ? 1 : 0;
+
+        ret = ath10k_wmi_pdev_set_quiet_mode(ar, period, duration,
+                                             ATH10K_QUIET_START_OFFSET,
+                                             enabled);
+        if (ret) {
+                ath10k_warn(ar, "failed to set quiet mode period %u duarion %u enabled %u ret %d\n",
+                            period, duration, enabled, ret);
+                goto out;
+        }
+        ar->thermal.duty_cycle = duty_cycle;
+out:
+        mutex_unlock(&ar->conf_mutex);
+        return ret;
+}
+
+static struct thermal_cooling_device_ops ath10k_thermal_ops = {
+        .get_max_state = ath10k_thermal_get_max_dutycycle,
+        .get_cur_state = ath10k_thermal_get_cur_dutycycle,
+        .set_cur_state = ath10k_thermal_set_cur_dutycycle,
+};
+
+static ssize_t ath10k_thermal_show_temp(struct device *dev,
+                                        struct device_attribute *attr,
+                                        char *buf)
+{
+        struct ath10k *ar = dev_get_drvdata(dev);
+        int ret, temperature;
+
+        mutex_lock(&ar->conf_mutex);
+
+        /* Can't get temperature when the card is off */
+        if (ar->state != ATH10K_STATE_ON) {
+                ret = -ENETDOWN;
+                goto out;
+        }
+
+        reinit_completion(&ar->thermal.wmi_sync);
+        ret = ath10k_wmi_pdev_get_temperature(ar);
+        if (ret) {
+                ath10k_warn(ar, "failed to read temperature %d\n", ret);
+                goto out;
+        }
+
+        if (test_bit(ATH10K_FLAG_CRASH_FLUSH, &ar->dev_flags)) {
+                ret = -ESHUTDOWN;
+                goto out;
+        }
+
+        ret = wait_for_completion_timeout(&ar->thermal.wmi_sync,
+                                          ATH10K_THERMAL_SYNC_TIMEOUT_HZ);
+        if (ret == 0) {
+                ath10k_warn(ar, "failed to synchronize thermal read\n");
+                ret = -ETIMEDOUT;
+                goto out;
+        }
+
+        spin_lock_bh(&ar->data_lock);
+        temperature = ar->thermal.temperature;
+        spin_unlock_bh(&ar->data_lock);
+
+        /* display in millidegree celcius */
+        ret = snprintf(buf, PAGE_SIZE, "%d\n", temperature * 1000);
+out:
+        mutex_unlock(&ar->conf_mutex);
+        return ret;
+}
+
+void ath10k_thermal_event_temperature(struct ath10k *ar, int temperature)
+{
+        spin_lock_bh(&ar->data_lock);
+        ar->thermal.temperature = temperature;
+        spin_unlock_bh(&ar->data_lock);
+        complete(&ar->thermal.wmi_sync);
+}
+
+static SENSOR_DEVICE_ATTR(temp1_input, S_IRUGO, ath10k_thermal_show_temp,
+                          NULL, 0);
+
+static struct attribute *ath10k_hwmon_attrs[] = {
+        &sensor_dev_attr_temp1_input.dev_attr.attr,
+        NULL,
+};
+ATTRIBUTE_GROUPS(ath10k_hwmon);
+
+int ath10k_thermal_register(struct ath10k *ar)
+{
+        struct thermal_cooling_device *cdev;
+        struct device *hwmon_dev;
+        int ret;
+
+        cdev = thermal_cooling_device_register("ath10k_thermal", ar,
+                                               &ath10k_thermal_ops);
+
+        if (IS_ERR(cdev)) {
+                ath10k_err(ar, "failed to setup thermal device result: %ld\n",
+                           PTR_ERR(cdev));
+                return -EINVAL;
+        }
+
+        ret = sysfs_create_link(&ar->dev->kobj, &cdev->device.kobj,
+                                "cooling_device");
+        if (ret) {
+                ath10k_err(ar, "failed to create thermal symlink\n");
+                goto err_cooling_destroy;
+        }
+
+        ar->thermal.cdev = cdev;
+
+        /* Do not register hwmon device when temperature reading is not
+         * supported by firmware
+         */
+        if (ar->wmi.op_version != ATH10K_FW_WMI_OP_VERSION_10_2_4)
+                return 0;
+
+        /* Avoid linking error on devm_hwmon_device_register_with_groups, I
+         * guess linux/hwmon.h is missing proper stubs. */
+        if (!config_enabled(CONFIG_HWMON))
+                return 0;
+
+        hwmon_dev = devm_hwmon_device_register_with_groups(ar->dev,
+                                                           "ath10k_hwmon", ar,
+                                                           ath10k_hwmon_groups);
+        if (IS_ERR(hwmon_dev)) {
+                ath10k_err(ar, "failed to register hwmon device: %ld\n",
+                           PTR_ERR(hwmon_dev));
+                ret = -EINVAL;
+                goto err_remove_link;
+        }
+        return 0;
+
+err_remove_link:
+        sysfs_remove_link(&ar->dev->kobj, "thermal_sensor");
+err_cooling_destroy:
+        thermal_cooling_device_unregister(cdev);
+        return ret;
+}
+
+void ath10k_thermal_unregister(struct ath10k *ar)
+{
+        thermal_cooling_device_unregister(ar->thermal.cdev);
+        sysfs_remove_link(&ar->dev->kobj, "cooling_device");
+}
diff --git a/drivers/net/wireless/ath/ath10k/thermal.h b/drivers/net/wireless/ath/ath10k/thermal.h
new file mode 100644
index 000000000000..bccc17ae0fde
--- /dev/null
+++ b/drivers/net/wireless/ath/ath10k/thermal.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (c) 2014 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#ifndef _THERMAL_
+#define _THERMAL_
+
+#define ATH10K_QUIET_PERIOD_DEFAULT     100
+#define ATH10K_QUIET_PERIOD_MIN         25
+#define ATH10K_QUIET_START_OFFSET       10
+#define ATH10K_QUIET_DUTY_CYCLE_MAX     70
+#define ATH10K_HWMON_NAME_LEN           15
+#define ATH10K_THERMAL_SYNC_TIMEOUT_HZ (5*HZ)
+
+struct ath10k_thermal {
+        struct thermal_cooling_device *cdev;
+        struct completion wmi_sync;
+
+        /* protected by conf_mutex */
+        u32 duty_cycle;
+        /* temperature value in Celcius degree
+         * protected by data_lock
+         */
+        int temperature;
+};
+
+#ifdef CONFIG_THERMAL
+int ath10k_thermal_register(struct ath10k *ar);
+void ath10k_thermal_unregister(struct ath10k *ar);
+void ath10k_thermal_event_temperature(struct ath10k *ar, int temperature);
+#else
+static inline int ath10k_thermal_register(struct ath10k *ar)
+{
+        return 0;
+}
+
+static inline void ath10k_thermal_unregister(struct ath10k *ar)
+{
+}
+
+static inline void ath10k_thermal_event_temperature(struct ath10k *ar,
+                                                    int temperature)
+{
+}
+
+#endif
+#endif /* _THERMAL_ */
diff --git a/drivers/net/wireless/ath/ath10k/trace.h b/drivers/net/wireless/ath/ath10k/trace.h
index b289378b6e3e..5407887380ab 100644
--- a/drivers/net/wireless/ath/ath10k/trace.h
+++ b/drivers/net/wireless/ath/ath10k/trace.h
@@ -453,6 +453,74 @@ TRACE_EVENT(ath10k_htt_rx_desc,
          )
 );
 
+TRACE_EVENT(ath10k_wmi_diag_container,
+            TP_PROTO(struct ath10k *ar,
+                     u8 type,
+                     u32 timestamp,
+                     u32 code,
+                     u16 len,
+                     const void *data),
+
+        TP_ARGS(ar, type, timestamp, code, len, data),
+
+        TP_STRUCT__entry(
+                __string(device, dev_name(ar->dev))
+                __string(driver, dev_driver_string(ar->dev))
+                __field(u8, type)
+                __field(u32, timestamp)
+                __field(u32, code)
+                __field(u16, len)
+                __dynamic_array(u8, data, len)
+        ),
+
+        TP_fast_assign(
+                __assign_str(device, dev_name(ar->dev));
+                __assign_str(driver, dev_driver_string(ar->dev));
+                __entry->type = type;
+                __entry->timestamp = timestamp;
+                __entry->code = code;
+                __entry->len = len;
+                memcpy(__get_dynamic_array(data), data, len);
+        ),
+
+        TP_printk(
+                "%s %s diag container type %hhu timestamp %u code %u len %d",
+                __get_str(driver),
+                __get_str(device),
+                __entry->type,
+                __entry->timestamp,
+                __entry->code,
+                __entry->len
+        )
+);
+
+TRACE_EVENT(ath10k_wmi_diag,
+            TP_PROTO(struct ath10k *ar, const void *data, size_t len),
+
+        TP_ARGS(ar, data, len),
+
+        TP_STRUCT__entry(
+                __string(device, dev_name(ar->dev))
+                __string(driver, dev_driver_string(ar->dev))
+                __field(u16, len)
+                __dynamic_array(u8, data, len)
+        ),
+
+        TP_fast_assign(
+                __assign_str(device, dev_name(ar->dev));
+                __assign_str(driver, dev_driver_string(ar->dev));
+                __entry->len = len;
+                memcpy(__get_dynamic_array(data), data, len);
+        ),
+
+        TP_printk(
+                "%s %s tlv diag len %d",
+                __get_str(driver),
+                __get_str(device),
+                __entry->len
+        )
+);
+
 #endif /* _TRACE_H_ || TRACE_HEADER_MULTI_READ*/
 
 /* we don't want to use include/trace/events */
diff --git a/drivers/net/wireless/ath/ath10k/txrx.c b/drivers/net/wireless/ath/ath10k/txrx.c
index 7579de8e7a8c..3f00cec8aef5 100644
--- a/drivers/net/wireless/ath/ath10k/txrx.c
+++ b/drivers/net/wireless/ath/ath10k/txrx.c
@@ -64,7 +64,13 @@ void ath10k_txrx_tx_unref(struct ath10k_htt *htt,
                 return;
         }
 
-        msdu = htt->pending_tx[tx_done->msdu_id];
+        msdu = idr_find(&htt->pending_tx, tx_done->msdu_id);
+        if (!msdu) {
+                ath10k_warn(ar, "received tx completion for invalid msdu_id: %d\n",
+                            tx_done->msdu_id);
+                return;
+        }
+
         skb_cb = ATH10K_SKB_CB(msdu);
 
         dma_unmap_single(dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE);
@@ -95,7 +101,6 @@ void ath10k_txrx_tx_unref(struct ath10k_htt *htt,
         /* we do not own the msdu anymore */
 
 exit:
-        htt->pending_tx[tx_done->msdu_id] = NULL;
         ath10k_htt_tx_free_msdu_id(htt, tx_done->msdu_id);
         __ath10k_htt_tx_dec_pending(htt);
         if (htt->num_pending_tx == 0)
diff --git a/drivers/net/wireless/ath/ath10k/wmi-ops.h b/drivers/net/wireless/ath/ath10k/wmi-ops.h
new file mode 100644
index 000000000000..04dc4b9db04e
--- /dev/null
+++ b/drivers/net/wireless/ath/ath10k/wmi-ops.h
@@ -0,0 +1,1064 @@
+/*
+ * Copyright (c) 2005-2011 Atheros Communications Inc.
+ * Copyright (c) 2011-2014 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _WMI_OPS_H_
+#define _WMI_OPS_H_
+
+struct ath10k;
+struct sk_buff;
+
+struct wmi_ops {
+        void (*rx)(struct ath10k *ar, struct sk_buff *skb);
+        void (*map_svc)(const __le32 *in, unsigned long *out, size_t len);
+
+        int (*pull_scan)(struct ath10k *ar, struct sk_buff *skb,
+                         struct wmi_scan_ev_arg *arg);
+        int (*pull_mgmt_rx)(struct ath10k *ar, struct sk_buff *skb,
+                            struct wmi_mgmt_rx_ev_arg *arg);
+        int (*pull_ch_info)(struct ath10k *ar, struct sk_buff *skb,
+                            struct wmi_ch_info_ev_arg *arg);
+        int (*pull_vdev_start)(struct ath10k *ar, struct sk_buff *skb,
+                               struct wmi_vdev_start_ev_arg *arg);
+        int (*pull_peer_kick)(struct ath10k *ar, struct sk_buff *skb,
+                              struct wmi_peer_kick_ev_arg *arg);
+        int (*pull_swba)(struct ath10k *ar, struct sk_buff *skb,
+                         struct wmi_swba_ev_arg *arg);
+        int (*pull_phyerr)(struct ath10k *ar, struct sk_buff *skb,
+                           struct wmi_phyerr_ev_arg *arg);
+        int (*pull_svc_rdy)(struct ath10k *ar, struct sk_buff *skb,
+                            struct wmi_svc_rdy_ev_arg *arg);
+        int (*pull_rdy)(struct ath10k *ar, struct sk_buff *skb,
+                        struct wmi_rdy_ev_arg *arg);
+        int (*pull_fw_stats)(struct ath10k *ar, struct sk_buff *skb,
+                             struct ath10k_fw_stats *stats);
+
+        struct sk_buff *(*gen_pdev_suspend)(struct ath10k *ar, u32 suspend_opt);
+        struct sk_buff *(*gen_pdev_resume)(struct ath10k *ar);
+        struct sk_buff *(*gen_pdev_set_rd)(struct ath10k *ar, u16 rd, u16 rd2g,
+                                           u16 rd5g, u16 ctl2g, u16 ctl5g,
+                                           enum wmi_dfs_region dfs_reg);
+        struct sk_buff *(*gen_pdev_set_param)(struct ath10k *ar, u32 id,
+                                              u32 value);
+        struct sk_buff *(*gen_init)(struct ath10k *ar);
+        struct sk_buff *(*gen_start_scan)(struct ath10k *ar,
+                                          const struct wmi_start_scan_arg *arg);
+        struct sk_buff *(*gen_stop_scan)(struct ath10k *ar,
+                                         const struct wmi_stop_scan_arg *arg);
+        struct sk_buff *(*gen_vdev_create)(struct ath10k *ar, u32 vdev_id,
+                                           enum wmi_vdev_type type,
+                                           enum wmi_vdev_subtype subtype,
+                                           const u8 macaddr[ETH_ALEN]);
+        struct sk_buff *(*gen_vdev_delete)(struct ath10k *ar, u32 vdev_id);
+        struct sk_buff *(*gen_vdev_start)(struct ath10k *ar,
+                                          const struct wmi_vdev_start_request_arg *arg,
+                                          bool restart);
+        struct sk_buff *(*gen_vdev_stop)(struct ath10k *ar, u32 vdev_id);
+        struct sk_buff *(*gen_vdev_up)(struct ath10k *ar, u32 vdev_id, u32 aid,
+                                       const u8 *bssid);
+        struct sk_buff *(*gen_vdev_down)(struct ath10k *ar, u32 vdev_id);
+        struct sk_buff *(*gen_vdev_set_param)(struct ath10k *ar, u32 vdev_id,
+                                              u32 param_id, u32 param_value);
+        struct sk_buff *(*gen_vdev_install_key)(struct ath10k *ar,
+                                                const struct wmi_vdev_install_key_arg *arg);
+        struct sk_buff *(*gen_vdev_spectral_conf)(struct ath10k *ar,
+                                                  const struct wmi_vdev_spectral_conf_arg *arg);
+        struct sk_buff *(*gen_vdev_spectral_enable)(struct ath10k *ar, u32 vdev_id,
+                                                    u32 trigger, u32 enable);
+        struct sk_buff *(*gen_vdev_wmm_conf)(struct ath10k *ar, u32 vdev_id,
+                                             const struct wmi_wmm_params_all_arg *arg);
+        struct sk_buff *(*gen_peer_create)(struct ath10k *ar, u32 vdev_id,
+                                           const u8 peer_addr[ETH_ALEN]);
+        struct sk_buff *(*gen_peer_delete)(struct ath10k *ar, u32 vdev_id,
+                                           const u8 peer_addr[ETH_ALEN]);
+        struct sk_buff *(*gen_peer_flush)(struct ath10k *ar, u32 vdev_id,
+                                          const u8 peer_addr[ETH_ALEN],
+                                          u32 tid_bitmap);
+        struct sk_buff *(*gen_peer_set_param)(struct ath10k *ar, u32 vdev_id,
+                                              const u8 *peer_addr,
+                                              enum wmi_peer_param param_id,
+                                              u32 param_value);
+        struct sk_buff *(*gen_peer_assoc)(struct ath10k *ar,
+                                          const struct wmi_peer_assoc_complete_arg *arg);
+        struct sk_buff *(*gen_set_psmode)(struct ath10k *ar, u32 vdev_id,
+                                          enum wmi_sta_ps_mode psmode);
+        struct sk_buff *(*gen_set_sta_ps)(struct ath10k *ar, u32 vdev_id,
+                                          enum wmi_sta_powersave_param param_id,
+                                          u32 value);
+        struct sk_buff *(*gen_set_ap_ps)(struct ath10k *ar, u32 vdev_id,
+                                         const u8 *mac,
+                                         enum wmi_ap_ps_peer_param param_id,
+                                         u32 value);
+        struct sk_buff *(*gen_scan_chan_list)(struct ath10k *ar,
+                                              const struct wmi_scan_chan_list_arg *arg);
+        struct sk_buff *(*gen_beacon_dma)(struct ath10k *ar, u32 vdev_id,
+                                          const void *bcn, size_t bcn_len,
+                                          u32 bcn_paddr, bool dtim_zero,
+                                          bool deliver_cab);
+        struct sk_buff *(*gen_pdev_set_wmm)(struct ath10k *ar,
+                                            const struct wmi_wmm_params_all_arg *arg);
+        struct sk_buff *(*gen_request_stats)(struct ath10k *ar,
+                                             enum wmi_stats_id stats_id);
+        struct sk_buff *(*gen_force_fw_hang)(struct ath10k *ar,
+                                             enum wmi_force_fw_hang_type type,
+                                             u32 delay_ms);
+        struct sk_buff *(*gen_mgmt_tx)(struct ath10k *ar, struct sk_buff *skb);
+        struct sk_buff *(*gen_dbglog_cfg)(struct ath10k *ar, u32 module_enable,
+                                          u32 log_level);
+        struct sk_buff *(*gen_pktlog_enable)(struct ath10k *ar, u32 filter);
+        struct sk_buff *(*gen_pktlog_disable)(struct ath10k *ar);
+        struct sk_buff *(*gen_pdev_set_quiet_mode)(struct ath10k *ar,
+                                                   u32 period, u32 duration,
+                                                   u32 next_offset,
+                                                   u32 enabled);
+        struct sk_buff *(*gen_pdev_get_temperature)(struct ath10k *ar);
+        struct sk_buff *(*gen_addba_clear_resp)(struct ath10k *ar, u32 vdev_id,
+                                                const u8 *mac);
+        struct sk_buff *(*gen_addba_send)(struct ath10k *ar, u32 vdev_id,
+                                          const u8 *mac, u32 tid, u32 buf_size);
+        struct sk_buff *(*gen_addba_set_resp)(struct ath10k *ar, u32 vdev_id,
+                                              const u8 *mac, u32 tid,
+                                              u32 status);
+        struct sk_buff *(*gen_delba_send)(struct ath10k *ar, u32 vdev_id,
+                                          const u8 *mac, u32 tid, u32 initiator,
+                                          u32 reason);
+        struct sk_buff *(*gen_bcn_tmpl)(struct ath10k *ar, u32 vdev_id,
+                                        u32 tim_ie_offset, struct sk_buff *bcn,
+                                        u32 prb_caps, u32 prb_erp,
+                                        void *prb_ies, size_t prb_ies_len);
+        struct sk_buff *(*gen_prb_tmpl)(struct ath10k *ar, u32 vdev_id,
+                                        struct sk_buff *bcn);
+        struct sk_buff *(*gen_p2p_go_bcn_ie)(struct ath10k *ar, u32 vdev_id,
+                                             const u8 *p2p_ie);
+        struct sk_buff *(*gen_vdev_sta_uapsd)(struct ath10k *ar, u32 vdev_id,
+                                              const u8 peer_addr[ETH_ALEN],
+                                              const struct wmi_sta_uapsd_auto_trig_arg *args,
+                                              u32 num_ac);
+        struct sk_buff *(*gen_sta_keepalive)(struct ath10k *ar,
+                                             const struct wmi_sta_keepalive_arg *arg);
+};
+
+int ath10k_wmi_cmd_send(struct ath10k *ar, struct sk_buff *skb, u32 cmd_id);
+
+static inline int
+ath10k_wmi_rx(struct ath10k *ar, struct sk_buff *skb)
+{
+        if (WARN_ON_ONCE(!ar->wmi.ops->rx))
+                return -EOPNOTSUPP;
+
+        ar->wmi.ops->rx(ar, skb);
+        return 0;
+}
+
+static inline int
+ath10k_wmi_map_svc(struct ath10k *ar, const __le32 *in, unsigned long *out,
+                   size_t len)
+{
+        if (!ar->wmi.ops->map_svc)
+                return -EOPNOTSUPP;
+
+        ar->wmi.ops->map_svc(in, out, len);
+        return 0;
+}
+
+static inline int
+ath10k_wmi_pull_scan(struct ath10k *ar, struct sk_buff *skb,
+                     struct wmi_scan_ev_arg *arg)
+{
+        if (!ar->wmi.ops->pull_scan)
+                return -EOPNOTSUPP;
+
+        return ar->wmi.ops->pull_scan(ar, skb, arg);
+}
+
+static inline int
+ath10k_wmi_pull_mgmt_rx(struct ath10k *ar, struct sk_buff *skb,
+                        struct wmi_mgmt_rx_ev_arg *arg)
+{
+        if (!ar->wmi.ops->pull_mgmt_rx)
+                return -EOPNOTSUPP;
+
+        return ar->wmi.ops->pull_mgmt_rx(ar, skb, arg);
+}
+
+static inline int
+ath10k_wmi_pull_ch_info(struct ath10k *ar, struct sk_buff *skb,
+                        struct wmi_ch_info_ev_arg *arg)
+{
+        if (!ar->wmi.ops->pull_ch_info)
+                return -EOPNOTSUPP;
+
+        return ar->wmi.ops->pull_ch_info(ar, skb, arg);
+}
+
+static inline int
+ath10k_wmi_pull_vdev_start(struct ath10k *ar, struct sk_buff *skb,
+                           struct wmi_vdev_start_ev_arg *arg)
+{
+        if (!ar->wmi.ops->pull_vdev_start)
+                return -EOPNOTSUPP;
+
+        return ar->wmi.ops->pull_vdev_start(ar, skb, arg);
+}
+
+static inline int
+ath10k_wmi_pull_peer_kick(struct ath10k *ar, struct sk_buff *skb,
+                          struct wmi_peer_kick_ev_arg *arg)
+{
+        if (!ar->wmi.ops->pull_peer_kick)
+                return -EOPNOTSUPP;
+
+        return ar->wmi.ops->pull_peer_kick(ar, skb, arg);
+}
+
+static inline int
+ath10k_wmi_pull_swba(struct ath10k *ar, struct sk_buff *skb,
+                     struct wmi_swba_ev_arg *arg)
+{
+        if (!ar->wmi.ops->pull_swba)
+                return -EOPNOTSUPP;
+
+        return ar->wmi.ops->pull_swba(ar, skb, arg);
+}
+
+static inline int
+ath10k_wmi_pull_phyerr(struct ath10k *ar, struct sk_buff *skb,
+                       struct wmi_phyerr_ev_arg *arg)
+{
+        if (!ar->wmi.ops->pull_phyerr)
+                return -EOPNOTSUPP;
+
+        return ar->wmi.ops->pull_phyerr(ar, skb, arg);
+}
+
+static inline int
+ath10k_wmi_pull_svc_rdy(struct ath10k *ar, struct sk_buff *skb,
+                        struct wmi_svc_rdy_ev_arg *arg)
+{
+        if (!ar->wmi.ops->pull_svc_rdy)
+                return -EOPNOTSUPP;
+
+        return ar->wmi.ops->pull_svc_rdy(ar, skb, arg);
+}
+
+static inline int
+ath10k_wmi_pull_rdy(struct ath10k *ar, struct sk_buff *skb,
+                    struct wmi_rdy_ev_arg *arg)
+{
+        if (!ar->wmi.ops->pull_rdy)
+                return -EOPNOTSUPP;
+
+        return ar->wmi.ops->pull_rdy(ar, skb, arg);
+}
+
+static inline int
+ath10k_wmi_pull_fw_stats(struct ath10k *ar, struct sk_buff *skb,
+                         struct ath10k_fw_stats *stats)
+{
+        if (!ar->wmi.ops->pull_fw_stats)
+                return -EOPNOTSUPP;
+
+        return ar->wmi.ops->pull_fw_stats(ar, skb, stats);
+}
+
+static inline int
+ath10k_wmi_mgmt_tx(struct ath10k *ar, struct sk_buff *msdu)
+{
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(msdu);
+        struct sk_buff *skb;
+        int ret;
+
+        if (!ar->wmi.ops->gen_mgmt_tx)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_mgmt_tx(ar, msdu);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        ret = ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->mgmt_tx_cmdid);
+        if (ret)
+                return ret;
+
+        /* FIXME There's no ACK event for Management Tx. This probably
+         * shouldn't be called here either. */
+        info->flags |= IEEE80211_TX_STAT_ACK;
+        ieee80211_tx_status_irqsafe(ar->hw, msdu);
+
+        return 0;
+}
+
+static inline int
+ath10k_wmi_pdev_set_regdomain(struct ath10k *ar, u16 rd, u16 rd2g, u16 rd5g,
+                              u16 ctl2g, u16 ctl5g,
+                              enum wmi_dfs_region dfs_reg)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_pdev_set_rd)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_pdev_set_rd(ar, rd, rd2g, rd5g, ctl2g, ctl5g,
+                                           dfs_reg);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->pdev_set_regdomain_cmdid);
+}
+
+static inline int
+ath10k_wmi_pdev_suspend_target(struct ath10k *ar, u32 suspend_opt)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_pdev_suspend)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_pdev_suspend(ar, suspend_opt);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->pdev_suspend_cmdid);
+}
+
+static inline int
+ath10k_wmi_pdev_resume_target(struct ath10k *ar)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_pdev_resume)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_pdev_resume(ar);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->pdev_resume_cmdid);
+}
+
+static inline int
+ath10k_wmi_pdev_set_param(struct ath10k *ar, u32 id, u32 value)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_pdev_set_param)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_pdev_set_param(ar, id, value);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->pdev_set_param_cmdid);
+}
+
+static inline int
+ath10k_wmi_cmd_init(struct ath10k *ar)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_init)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_init(ar);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->init_cmdid);
+}
+
+static inline int
+ath10k_wmi_start_scan(struct ath10k *ar,
+                      const struct wmi_start_scan_arg *arg)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_start_scan)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_start_scan(ar, arg);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->start_scan_cmdid);
+}
+
+static inline int
+ath10k_wmi_stop_scan(struct ath10k *ar, const struct wmi_stop_scan_arg *arg)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_stop_scan)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_stop_scan(ar, arg);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->stop_scan_cmdid);
+}
+
+static inline int
+ath10k_wmi_vdev_create(struct ath10k *ar, u32 vdev_id,
+                       enum wmi_vdev_type type,
+                       enum wmi_vdev_subtype subtype,
+                       const u8 macaddr[ETH_ALEN])
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_vdev_create)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_vdev_create(ar, vdev_id, type, subtype, macaddr);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->vdev_create_cmdid);
+}
+
+static inline int
+ath10k_wmi_vdev_delete(struct ath10k *ar, u32 vdev_id)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_vdev_delete)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_vdev_delete(ar, vdev_id);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->vdev_delete_cmdid);
+}
+
+static inline int
+ath10k_wmi_vdev_start(struct ath10k *ar,
+                      const struct wmi_vdev_start_request_arg *arg)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_vdev_start)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_vdev_start(ar, arg, false);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->vdev_start_request_cmdid);
+}
+
+static inline int
+ath10k_wmi_vdev_restart(struct ath10k *ar,
+                        const struct wmi_vdev_start_request_arg *arg)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_vdev_start)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_vdev_start(ar, arg, true);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->vdev_restart_request_cmdid);
+}
+
+static inline int
+ath10k_wmi_vdev_stop(struct ath10k *ar, u32 vdev_id)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_vdev_stop)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_vdev_stop(ar, vdev_id);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->vdev_stop_cmdid);
+}
+
+static inline int
+ath10k_wmi_vdev_up(struct ath10k *ar, u32 vdev_id, u32 aid, const u8 *bssid)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_vdev_up)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_vdev_up(ar, vdev_id, aid, bssid);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->vdev_up_cmdid);
+}
+
+static inline int
+ath10k_wmi_vdev_down(struct ath10k *ar, u32 vdev_id)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_vdev_down)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_vdev_down(ar, vdev_id);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->vdev_down_cmdid);
+}
+
+static inline int
+ath10k_wmi_vdev_set_param(struct ath10k *ar, u32 vdev_id, u32 param_id,
+                          u32 param_value)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_vdev_set_param)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_vdev_set_param(ar, vdev_id, param_id,
+                                              param_value);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->vdev_set_param_cmdid);
+}
+
+static inline int
+ath10k_wmi_vdev_install_key(struct ath10k *ar,
+                            const struct wmi_vdev_install_key_arg *arg)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_vdev_install_key)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_vdev_install_key(ar, arg);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->vdev_install_key_cmdid);
+}
+
+static inline int
+ath10k_wmi_vdev_spectral_conf(struct ath10k *ar,
+                              const struct wmi_vdev_spectral_conf_arg *arg)
+{
+        struct sk_buff *skb;
+        u32 cmd_id;
+
+        skb = ar->wmi.ops->gen_vdev_spectral_conf(ar, arg);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        cmd_id = ar->wmi.cmd->vdev_spectral_scan_configure_cmdid;
+        return ath10k_wmi_cmd_send(ar, skb, cmd_id);
+}
+
+static inline int
+ath10k_wmi_vdev_spectral_enable(struct ath10k *ar, u32 vdev_id, u32 trigger,
+                                u32 enable)
+{
+        struct sk_buff *skb;
+        u32 cmd_id;
+
+        skb = ar->wmi.ops->gen_vdev_spectral_enable(ar, vdev_id, trigger,
+                                                    enable);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        cmd_id = ar->wmi.cmd->vdev_spectral_scan_enable_cmdid;
+        return ath10k_wmi_cmd_send(ar, skb, cmd_id);
+}
+
+static inline int
+ath10k_wmi_vdev_sta_uapsd(struct ath10k *ar, u32 vdev_id,
+                          const u8 peer_addr[ETH_ALEN],
+                          const struct wmi_sta_uapsd_auto_trig_arg *args,
+                          u32 num_ac)
+{
+        struct sk_buff *skb;
+        u32 cmd_id;
+
+        if (!ar->wmi.ops->gen_vdev_sta_uapsd)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_vdev_sta_uapsd(ar, vdev_id, peer_addr, args,
+                                              num_ac);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        cmd_id = ar->wmi.cmd->sta_uapsd_auto_trig_cmdid;
+        return ath10k_wmi_cmd_send(ar, skb, cmd_id);
+}
+
+static inline int
+ath10k_wmi_vdev_wmm_conf(struct ath10k *ar, u32 vdev_id,
+                         const struct wmi_wmm_params_all_arg *arg)
+{
+        struct sk_buff *skb;
+        u32 cmd_id;
+
+        skb = ar->wmi.ops->gen_vdev_wmm_conf(ar, vdev_id, arg);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        cmd_id = ar->wmi.cmd->vdev_set_wmm_params_cmdid;
+        return ath10k_wmi_cmd_send(ar, skb, cmd_id);
+}
+
+static inline int
+ath10k_wmi_peer_create(struct ath10k *ar, u32 vdev_id,
+                       const u8 peer_addr[ETH_ALEN])
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_peer_create)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_peer_create(ar, vdev_id, peer_addr);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->peer_create_cmdid);
+}
+
+static inline int
+ath10k_wmi_peer_delete(struct ath10k *ar, u32 vdev_id,
+                       const u8 peer_addr[ETH_ALEN])
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_peer_delete)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_peer_delete(ar, vdev_id, peer_addr);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->peer_delete_cmdid);
+}
+
+static inline int
+ath10k_wmi_peer_flush(struct ath10k *ar, u32 vdev_id,
+                      const u8 peer_addr[ETH_ALEN], u32 tid_bitmap)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_peer_flush)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_peer_flush(ar, vdev_id, peer_addr, tid_bitmap);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->peer_flush_tids_cmdid);
+}
+
+static inline int
+ath10k_wmi_peer_set_param(struct ath10k *ar, u32 vdev_id, const u8 *peer_addr,
+                          enum wmi_peer_param param_id, u32 param_value)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_peer_set_param)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_peer_set_param(ar, vdev_id, peer_addr, param_id,
+                                              param_value);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->peer_set_param_cmdid);
+}
+
+static inline int
+ath10k_wmi_set_psmode(struct ath10k *ar, u32 vdev_id,
+                      enum wmi_sta_ps_mode psmode)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_set_psmode)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_set_psmode(ar, vdev_id, psmode);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->sta_powersave_mode_cmdid);
+}
+
+static inline int
+ath10k_wmi_set_sta_ps_param(struct ath10k *ar, u32 vdev_id,
+                            enum wmi_sta_powersave_param param_id, u32 value)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_set_sta_ps)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_set_sta_ps(ar, vdev_id, param_id, value);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->sta_powersave_param_cmdid);
+}
+
+static inline int
+ath10k_wmi_set_ap_ps_param(struct ath10k *ar, u32 vdev_id, const u8 *mac,
+                           enum wmi_ap_ps_peer_param param_id, u32 value)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_set_ap_ps)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_set_ap_ps(ar, vdev_id, mac, param_id, value);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->ap_ps_peer_param_cmdid);
+}
+
+static inline int
+ath10k_wmi_scan_chan_list(struct ath10k *ar,
+                          const struct wmi_scan_chan_list_arg *arg)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_scan_chan_list)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_scan_chan_list(ar, arg);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->scan_chan_list_cmdid);
+}
+
+static inline int
+ath10k_wmi_peer_assoc(struct ath10k *ar,
+                      const struct wmi_peer_assoc_complete_arg *arg)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_peer_assoc)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_peer_assoc(ar, arg);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->peer_assoc_cmdid);
+}
+
+static inline int
+ath10k_wmi_beacon_send_ref_nowait(struct ath10k *ar, u32 vdev_id,
+                                  const void *bcn, size_t bcn_len,
+                                  u32 bcn_paddr, bool dtim_zero,
+                                  bool deliver_cab)
+{
+        struct sk_buff *skb;
+        int ret;
+
+        if (!ar->wmi.ops->gen_beacon_dma)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_beacon_dma(ar, vdev_id, bcn, bcn_len, bcn_paddr,
+                                          dtim_zero, deliver_cab);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        ret = ath10k_wmi_cmd_send_nowait(ar, skb,
+                                         ar->wmi.cmd->pdev_send_bcn_cmdid);
+        if (ret) {
+                dev_kfree_skb(skb);
+                return ret;
+        }
+
+        return 0;
+}
+
+static inline int
+ath10k_wmi_pdev_set_wmm_params(struct ath10k *ar,
+                               const struct wmi_wmm_params_all_arg *arg)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_pdev_set_wmm)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_pdev_set_wmm(ar, arg);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->pdev_set_wmm_params_cmdid);
+}
+
+static inline int
+ath10k_wmi_request_stats(struct ath10k *ar, enum wmi_stats_id stats_id)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_request_stats)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_request_stats(ar, stats_id);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->request_stats_cmdid);
+}
+
+static inline int
+ath10k_wmi_force_fw_hang(struct ath10k *ar,
+                         enum wmi_force_fw_hang_type type, u32 delay_ms)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_force_fw_hang)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_force_fw_hang(ar, type, delay_ms);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->force_fw_hang_cmdid);
+}
+
+static inline int
+ath10k_wmi_dbglog_cfg(struct ath10k *ar, u32 module_enable, u32 log_level)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_dbglog_cfg)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_dbglog_cfg(ar, module_enable, log_level);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->dbglog_cfg_cmdid);
+}
+
+static inline int
+ath10k_wmi_pdev_pktlog_enable(struct ath10k *ar, u32 filter)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_pktlog_enable)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_pktlog_enable(ar, filter);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->pdev_pktlog_enable_cmdid);
+}
+
+static inline int
+ath10k_wmi_pdev_pktlog_disable(struct ath10k *ar)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_pktlog_disable)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_pktlog_disable(ar);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->pdev_pktlog_disable_cmdid);
+}
+
+static inline int
+ath10k_wmi_pdev_set_quiet_mode(struct ath10k *ar, u32 period, u32 duration,
+                               u32 next_offset, u32 enabled)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_pdev_set_quiet_mode)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_pdev_set_quiet_mode(ar, period, duration,
+                                                   next_offset, enabled);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->pdev_set_quiet_mode_cmdid);
+}
+
+static inline int
+ath10k_wmi_pdev_get_temperature(struct ath10k *ar)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_pdev_get_temperature)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_pdev_get_temperature(ar);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->pdev_get_temperature_cmdid);
+}
+
+static inline int
+ath10k_wmi_addba_clear_resp(struct ath10k *ar, u32 vdev_id, const u8 *mac)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_addba_clear_resp)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_addba_clear_resp(ar, vdev_id, mac);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->addba_clear_resp_cmdid);
+}
+
+static inline int
+ath10k_wmi_addba_send(struct ath10k *ar, u32 vdev_id, const u8 *mac,
+                      u32 tid, u32 buf_size)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_addba_send)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_addba_send(ar, vdev_id, mac, tid, buf_size);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->addba_send_cmdid);
+}
+
+static inline int
+ath10k_wmi_addba_set_resp(struct ath10k *ar, u32 vdev_id, const u8 *mac,
+                          u32 tid, u32 status)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_addba_set_resp)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_addba_set_resp(ar, vdev_id, mac, tid, status);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->addba_set_resp_cmdid);
+}
+
+static inline int
+ath10k_wmi_delba_send(struct ath10k *ar, u32 vdev_id, const u8 *mac,
+                      u32 tid, u32 initiator, u32 reason)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_delba_send)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_delba_send(ar, vdev_id, mac, tid, initiator,
+                                          reason);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb,
+                                   ar->wmi.cmd->delba_send_cmdid);
+}
+
+static inline int
+ath10k_wmi_bcn_tmpl(struct ath10k *ar, u32 vdev_id, u32 tim_ie_offset,
+                    struct sk_buff *bcn, u32 prb_caps, u32 prb_erp,
+                    void *prb_ies, size_t prb_ies_len)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_bcn_tmpl)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_bcn_tmpl(ar, vdev_id, tim_ie_offset, bcn,
+                                        prb_caps, prb_erp, prb_ies,
+                                        prb_ies_len);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->bcn_tmpl_cmdid);
+}
+
+static inline int
+ath10k_wmi_prb_tmpl(struct ath10k *ar, u32 vdev_id, struct sk_buff *prb)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_prb_tmpl)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_prb_tmpl(ar, vdev_id, prb);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->prb_tmpl_cmdid);
+}
+
+static inline int
+ath10k_wmi_p2p_go_bcn_ie(struct ath10k *ar, u32 vdev_id, const u8 *p2p_ie)
+{
+        struct sk_buff *skb;
+
+        if (!ar->wmi.ops->gen_p2p_go_bcn_ie)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_p2p_go_bcn_ie(ar, vdev_id, p2p_ie);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->p2p_go_set_beacon_ie);
+}
+
+static inline int
+ath10k_wmi_sta_keepalive(struct ath10k *ar,
+                         const struct wmi_sta_keepalive_arg *arg)
+{
+        struct sk_buff *skb;
+        u32 cmd_id;
+
+        if (!ar->wmi.ops->gen_sta_keepalive)
+                return -EOPNOTSUPP;
+
+        skb = ar->wmi.ops->gen_sta_keepalive(ar, arg);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        cmd_id = ar->wmi.cmd->sta_keepalive_cmd;
+        return ath10k_wmi_cmd_send(ar, skb, cmd_id);
+}
+
+#endif
diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
new file mode 100644
index 000000000000..71614ba1b145
--- /dev/null
+++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
@@ -0,0 +1,2696 @@
+/*
+ * Copyright (c) 2005-2011 Atheros Communications Inc.
+ * Copyright (c) 2011-2014 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#include "core.h"
+#include "debug.h"
+#include "hw.h"
+#include "wmi.h"
+#include "wmi-ops.h"
+#include "wmi-tlv.h"
+
+/***************/
+/* TLV helpers */
+/**************/
+
+struct wmi_tlv_policy {
+        size_t min_len;
+};
+
+static const struct wmi_tlv_policy wmi_tlv_policies[] = {
+        [WMI_TLV_TAG_ARRAY_BYTE]
+                = { .min_len = sizeof(u8) },
+        [WMI_TLV_TAG_ARRAY_UINT32]
+                = { .min_len = sizeof(u32) },
+        [WMI_TLV_TAG_STRUCT_SCAN_EVENT]
+                = { .min_len = sizeof(struct wmi_scan_event) },
+        [WMI_TLV_TAG_STRUCT_MGMT_RX_HDR]
+                = { .min_len = sizeof(struct wmi_tlv_mgmt_rx_ev) },
+        [WMI_TLV_TAG_STRUCT_CHAN_INFO_EVENT]
+                = { .min_len = sizeof(struct wmi_chan_info_event) },
+        [WMI_TLV_TAG_STRUCT_VDEV_START_RESPONSE_EVENT]
+                = { .min_len = sizeof(struct wmi_vdev_start_response_event) },
+        [WMI_TLV_TAG_STRUCT_PEER_STA_KICKOUT_EVENT]
+                = { .min_len = sizeof(struct wmi_peer_sta_kickout_event) },
+        [WMI_TLV_TAG_STRUCT_HOST_SWBA_EVENT]
+                = { .min_len = sizeof(struct wmi_host_swba_event) },
+        [WMI_TLV_TAG_STRUCT_TIM_INFO]
+                = { .min_len = sizeof(struct wmi_tim_info) },
+        [WMI_TLV_TAG_STRUCT_P2P_NOA_INFO]
+                = { .min_len = sizeof(struct wmi_p2p_noa_info) },
+        [WMI_TLV_TAG_STRUCT_SERVICE_READY_EVENT]
+                = { .min_len = sizeof(struct wmi_tlv_svc_rdy_ev) },
+        [WMI_TLV_TAG_STRUCT_HAL_REG_CAPABILITIES]
+                = { .min_len = sizeof(struct hal_reg_capabilities) },
+        [WMI_TLV_TAG_STRUCT_WLAN_HOST_MEM_REQ]
+                = { .min_len = sizeof(struct wlan_host_mem_req) },
+        [WMI_TLV_TAG_STRUCT_READY_EVENT]
+                = { .min_len = sizeof(struct wmi_tlv_rdy_ev) },
+        [WMI_TLV_TAG_STRUCT_OFFLOAD_BCN_TX_STATUS_EVENT]
+                = { .min_len = sizeof(struct wmi_tlv_bcn_tx_status_ev) },
+        [WMI_TLV_TAG_STRUCT_DIAG_DATA_CONTAINER_EVENT]
+                = { .min_len = sizeof(struct wmi_tlv_diag_data_ev) },
+};
+
+static int
+ath10k_wmi_tlv_iter(struct ath10k *ar, const void *ptr, size_t len,
+                    int (*iter)(struct ath10k *ar, u16 tag, u16 len,
+                                const void *ptr, void *data),
+                    void *data)
+{
+        const void *begin = ptr;
+        const struct wmi_tlv *tlv;
+        u16 tlv_tag, tlv_len;
+        int ret;
+
+        while (len > 0) {
+                if (len < sizeof(*tlv)) {
+                        ath10k_dbg(ar, ATH10K_DBG_WMI,
+                                   "wmi tlv parse failure at byte %zd (%zu bytes left, %zu expected)\n",
+                                   ptr - begin, len, sizeof(*tlv));
+                        return -EINVAL;
+                }
+
+                tlv = ptr;
+                tlv_tag = __le16_to_cpu(tlv->tag);
+                tlv_len = __le16_to_cpu(tlv->len);
+                ptr += sizeof(*tlv);
+                len -= sizeof(*tlv);
+
+                if (tlv_len > len) {
+                        ath10k_dbg(ar, ATH10K_DBG_WMI,
+                                   "wmi tlv parse failure of tag %hhu at byte %zd (%zu bytes left, %hhu expected)\n",
+                                   tlv_tag, ptr - begin, len, tlv_len);
+                        return -EINVAL;
+                }
+
+                if (tlv_tag < ARRAY_SIZE(wmi_tlv_policies) &&
+                    wmi_tlv_policies[tlv_tag].min_len &&
+                    wmi_tlv_policies[tlv_tag].min_len > tlv_len) {
+                        ath10k_dbg(ar, ATH10K_DBG_WMI,
+                                   "wmi tlv parse failure of tag %hhu at byte %zd (%hhu bytes is less than min length %zu)\n",
+                                   tlv_tag, ptr - begin, tlv_len,
+                                   wmi_tlv_policies[tlv_tag].min_len);
+                        return -EINVAL;
+                }
+
+                ret = iter(ar, tlv_tag, tlv_len, ptr, data);
+                if (ret)
+                        return ret;
+
+                ptr += tlv_len;
+                len -= tlv_len;
+        }
+
+        return 0;
+}
+
+static int ath10k_wmi_tlv_iter_parse(struct ath10k *ar, u16 tag, u16 len,
+                                     const void *ptr, void *data)
+{
+        const void **tb = data;
+
+        if (tag < WMI_TLV_TAG_MAX)
+                tb[tag] = ptr;
+
+        return 0;
+}
+
+static int ath10k_wmi_tlv_parse(struct ath10k *ar, const void **tb,
+                                const void *ptr, size_t len)
+{
+        return ath10k_wmi_tlv_iter(ar, ptr, len, ath10k_wmi_tlv_iter_parse,
+                                   (void *)tb);
+}
+
+static const void **
+ath10k_wmi_tlv_parse_alloc(struct ath10k *ar, const void *ptr,
+                           size_t len, gfp_t gfp)
+{
+        const void **tb;
+        int ret;
+
+        tb = kzalloc(sizeof(*tb) * WMI_TLV_TAG_MAX, gfp);
+        if (!tb)
+                return ERR_PTR(-ENOMEM);
+
+        ret = ath10k_wmi_tlv_parse(ar, tb, ptr, len);
+        if (ret) {
+                kfree(tb);
+                return ERR_PTR(ret);
+        }
+
+        return tb;
+}
+
+static u16 ath10k_wmi_tlv_len(const void *ptr)
+{
+        return __le16_to_cpu((((const struct wmi_tlv *)ptr) - 1)->len);
+}
+
+/**************/
+/* TLV events */
+/**************/
+static int ath10k_wmi_tlv_event_bcn_tx_status(struct ath10k *ar,
+                                              struct sk_buff *skb)
+{
+        const void **tb;
+        const struct wmi_tlv_bcn_tx_status_ev *ev;
+        u32 vdev_id, tx_status;
+        int ret;
+
+        tb = ath10k_wmi_tlv_parse_alloc(ar, skb->data, skb->len, GFP_ATOMIC);
+        if (IS_ERR(tb)) {
+                ret = PTR_ERR(tb);
+                ath10k_warn(ar, "failed to parse tlv: %d\n", ret);
+                return ret;
+        }
+
+        ev = tb[WMI_TLV_TAG_STRUCT_OFFLOAD_BCN_TX_STATUS_EVENT];
+        if (!ev) {
+                kfree(tb);
+                return -EPROTO;
+        }
+
+        tx_status = __le32_to_cpu(ev->tx_status);
+        vdev_id = __le32_to_cpu(ev->vdev_id);
+
+        switch (tx_status) {
+        case WMI_TLV_BCN_TX_STATUS_OK:
+                break;
+        case WMI_TLV_BCN_TX_STATUS_XRETRY:
+        case WMI_TLV_BCN_TX_STATUS_DROP:
+        case WMI_TLV_BCN_TX_STATUS_FILTERED:
+                /* FIXME: It's probably worth telling mac80211 to stop the
+                 * interface as it is crippled.
+                 */
+                ath10k_warn(ar, "received bcn tmpl tx status on vdev %i: %d",
+                            vdev_id, tx_status);
+                break;
+        }
+
+        kfree(tb);
+        return 0;
+}
+
+static int ath10k_wmi_tlv_event_diag_data(struct ath10k *ar,
+                                          struct sk_buff *skb)
+{
+        const void **tb;
+        const struct wmi_tlv_diag_data_ev *ev;
+        const struct wmi_tlv_diag_item *item;
+        const void *data;
+        int ret, num_items, len;
+
+        tb = ath10k_wmi_tlv_parse_alloc(ar, skb->data, skb->len, GFP_ATOMIC);
+        if (IS_ERR(tb)) {
+                ret = PTR_ERR(tb);
+                ath10k_warn(ar, "failed to parse tlv: %d\n", ret);
+                return ret;
+        }
+
+        ev = tb[WMI_TLV_TAG_STRUCT_DIAG_DATA_CONTAINER_EVENT];
+        data = tb[WMI_TLV_TAG_ARRAY_BYTE];
+        if (!ev || !data) {
+                kfree(tb);
+                return -EPROTO;
+        }
+
+        num_items = __le32_to_cpu(ev->num_items);
+        len = ath10k_wmi_tlv_len(data);
+
+        while (num_items--) {
+                if (len == 0)
+                        break;
+                if (len < sizeof(*item)) {
+                        ath10k_warn(ar, "failed to parse diag data: can't fit item header\n");
+                        break;
+                }
+
+                item = data;
+
+                if (len < sizeof(*item) + __le16_to_cpu(item->len)) {
+                        ath10k_warn(ar, "failed to parse diag data: item is too long\n");
+                        break;
+                }
+
+                trace_ath10k_wmi_diag_container(ar,
+                                                item->type,
+                                                __le32_to_cpu(item->timestamp),
+                                                __le32_to_cpu(item->code),
+                                                __le16_to_cpu(item->len),
+                                                item->payload);
+
+                len -= sizeof(*item);
+                len -= roundup(__le16_to_cpu(item->len), 4);
+
+                data += sizeof(*item);
+                data += roundup(__le16_to_cpu(item->len), 4);
+        }
+
+        if (num_items != -1 || len != 0)
+                ath10k_warn(ar, "failed to parse diag data event: num_items %d len %d\n",
+                            num_items, len);
+
+        kfree(tb);
+        return 0;
+}
+
+static int ath10k_wmi_tlv_event_diag(struct ath10k *ar,
+                                     struct sk_buff *skb)
+{
+        const void **tb;
+        const void *data;
+        int ret, len;
+
+        tb = ath10k_wmi_tlv_parse_alloc(ar, skb->data, skb->len, GFP_ATOMIC);
+        if (IS_ERR(tb)) {
+                ret = PTR_ERR(tb);
+                ath10k_warn(ar, "failed to parse tlv: %d\n", ret);
+                return ret;
+        }
+
+        data = tb[WMI_TLV_TAG_ARRAY_BYTE];
+        if (!data) {
+                kfree(tb);
+                return -EPROTO;
+        }
+        len = ath10k_wmi_tlv_len(data);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv diag event len %d\n", len);
+        trace_ath10k_wmi_diag(ar, data, len);
+
+        kfree(tb);
+        return 0;
+}
+
+/***********/
+/* TLV ops */
+/***********/
+
+static void ath10k_wmi_tlv_op_rx(struct ath10k *ar, struct sk_buff *skb)
+{
+        struct wmi_cmd_hdr *cmd_hdr;
+        enum wmi_tlv_event_id id;
+
+        cmd_hdr = (struct wmi_cmd_hdr *)skb->data;
+        id = MS(__le32_to_cpu(cmd_hdr->cmd_id), WMI_CMD_HDR_CMD_ID);
+
+        if (skb_pull(skb, sizeof(struct wmi_cmd_hdr)) == NULL)
+                return;
+
+        trace_ath10k_wmi_event(ar, id, skb->data, skb->len);
+
+        switch (id) {
+        case WMI_TLV_MGMT_RX_EVENTID:
+                ath10k_wmi_event_mgmt_rx(ar, skb);
+                /* mgmt_rx() owns the skb now! */
+                return;
+        case WMI_TLV_SCAN_EVENTID:
+                ath10k_wmi_event_scan(ar, skb);
+                break;
+        case WMI_TLV_CHAN_INFO_EVENTID:
+                ath10k_wmi_event_chan_info(ar, skb);
+                break;
+        case WMI_TLV_ECHO_EVENTID:
+                ath10k_wmi_event_echo(ar, skb);
+                break;
+        case WMI_TLV_DEBUG_MESG_EVENTID:
+                ath10k_wmi_event_debug_mesg(ar, skb);
+                break;
+        case WMI_TLV_UPDATE_STATS_EVENTID:
+                ath10k_wmi_event_update_stats(ar, skb);
+                break;
+        case WMI_TLV_VDEV_START_RESP_EVENTID:
+                ath10k_wmi_event_vdev_start_resp(ar, skb);
+                break;
+        case WMI_TLV_VDEV_STOPPED_EVENTID:
+                ath10k_wmi_event_vdev_stopped(ar, skb);
+                break;
+        case WMI_TLV_PEER_STA_KICKOUT_EVENTID:
+                ath10k_wmi_event_peer_sta_kickout(ar, skb);
+                break;
+        case WMI_TLV_HOST_SWBA_EVENTID:
+                ath10k_wmi_event_host_swba(ar, skb);
+                break;
+        case WMI_TLV_TBTTOFFSET_UPDATE_EVENTID:
+                ath10k_wmi_event_tbttoffset_update(ar, skb);
+                break;
+        case WMI_TLV_PHYERR_EVENTID:
+                ath10k_wmi_event_phyerr(ar, skb);
+                break;
+        case WMI_TLV_ROAM_EVENTID:
+                ath10k_wmi_event_roam(ar, skb);
+                break;
+        case WMI_TLV_PROFILE_MATCH:
+                ath10k_wmi_event_profile_match(ar, skb);
+                break;
+        case WMI_TLV_DEBUG_PRINT_EVENTID:
+                ath10k_wmi_event_debug_print(ar, skb);
+                break;
+        case WMI_TLV_PDEV_QVIT_EVENTID:
+                ath10k_wmi_event_pdev_qvit(ar, skb);
+                break;
+        case WMI_TLV_WLAN_PROFILE_DATA_EVENTID:
+                ath10k_wmi_event_wlan_profile_data(ar, skb);
+                break;
+        case WMI_TLV_RTT_MEASUREMENT_REPORT_EVENTID:
+                ath10k_wmi_event_rtt_measurement_report(ar, skb);
+                break;
+        case WMI_TLV_TSF_MEASUREMENT_REPORT_EVENTID:
+                ath10k_wmi_event_tsf_measurement_report(ar, skb);
+                break;
+        case WMI_TLV_RTT_ERROR_REPORT_EVENTID:
+                ath10k_wmi_event_rtt_error_report(ar, skb);
+                break;
+        case WMI_TLV_WOW_WAKEUP_HOST_EVENTID:
+                ath10k_wmi_event_wow_wakeup_host(ar, skb);
+                break;
+        case WMI_TLV_DCS_INTERFERENCE_EVENTID:
+                ath10k_wmi_event_dcs_interference(ar, skb);
+                break;
+        case WMI_TLV_PDEV_TPC_CONFIG_EVENTID:
+                ath10k_wmi_event_pdev_tpc_config(ar, skb);
+                break;
+        case WMI_TLV_PDEV_FTM_INTG_EVENTID:
+                ath10k_wmi_event_pdev_ftm_intg(ar, skb);
+                break;
+        case WMI_TLV_GTK_OFFLOAD_STATUS_EVENTID:
+                ath10k_wmi_event_gtk_offload_status(ar, skb);
+                break;
+        case WMI_TLV_GTK_REKEY_FAIL_EVENTID:
+                ath10k_wmi_event_gtk_rekey_fail(ar, skb);
+                break;
+        case WMI_TLV_TX_DELBA_COMPLETE_EVENTID:
+                ath10k_wmi_event_delba_complete(ar, skb);
+                break;
+        case WMI_TLV_TX_ADDBA_COMPLETE_EVENTID:
+                ath10k_wmi_event_addba_complete(ar, skb);
+                break;
+        case WMI_TLV_VDEV_INSTALL_KEY_COMPLETE_EVENTID:
+                ath10k_wmi_event_vdev_install_key_complete(ar, skb);
+                break;
+        case WMI_TLV_SERVICE_READY_EVENTID:
+                ath10k_wmi_event_service_ready(ar, skb);
+                break;
+        case WMI_TLV_READY_EVENTID:
+                ath10k_wmi_event_ready(ar, skb);
+                break;
+        case WMI_TLV_OFFLOAD_BCN_TX_STATUS_EVENTID:
+                ath10k_wmi_tlv_event_bcn_tx_status(ar, skb);
+                break;
+        case WMI_TLV_DIAG_DATA_CONTAINER_EVENTID:
+                ath10k_wmi_tlv_event_diag_data(ar, skb);
+                break;
+        case WMI_TLV_DIAG_EVENTID:
+                ath10k_wmi_tlv_event_diag(ar, skb);
+                break;
+        default:
+                ath10k_warn(ar, "Unknown eventid: %d\n", id);
+                break;
+        }
+
+        dev_kfree_skb(skb);
+}
+
+static int ath10k_wmi_tlv_op_pull_scan_ev(struct ath10k *ar,
+                                          struct sk_buff *skb,
+                                          struct wmi_scan_ev_arg *arg)
+{
+        const void **tb;
+        const struct wmi_scan_event *ev;
+        int ret;
+
+        tb = ath10k_wmi_tlv_parse_alloc(ar, skb->data, skb->len, GFP_ATOMIC);
+        if (IS_ERR(tb)) {
+                ret = PTR_ERR(tb);
+                ath10k_warn(ar, "failed to parse tlv: %d\n", ret);
+                return ret;
+        }
+
+        ev = tb[WMI_TLV_TAG_STRUCT_SCAN_EVENT];
+        if (!ev) {
+                kfree(tb);
+                return -EPROTO;
+        }
+
+        arg->event_type = ev->event_type;
+        arg->reason = ev->reason;
+        arg->channel_freq = ev->channel_freq;
+        arg->scan_req_id = ev->scan_req_id;
+        arg->scan_id = ev->scan_id;
+        arg->vdev_id = ev->vdev_id;
+
+        kfree(tb);
+        return 0;
+}
+
+static int ath10k_wmi_tlv_op_pull_mgmt_rx_ev(struct ath10k *ar,
+                                             struct sk_buff *skb,
+                                             struct wmi_mgmt_rx_ev_arg *arg)
+{
+        const void **tb;
+        const struct wmi_tlv_mgmt_rx_ev *ev;
+        const u8 *frame;
+        u32 msdu_len;
+        int ret;
+
+        tb = ath10k_wmi_tlv_parse_alloc(ar, skb->data, skb->len, GFP_ATOMIC);
+        if (IS_ERR(tb)) {
+                ret = PTR_ERR(tb);
+                ath10k_warn(ar, "failed to parse tlv: %d\n", ret);
+                return ret;
+        }
+
+        ev = tb[WMI_TLV_TAG_STRUCT_MGMT_RX_HDR];
+        frame = tb[WMI_TLV_TAG_ARRAY_BYTE];
+
+        if (!ev || !frame) {
+                kfree(tb);
+                return -EPROTO;
+        }
+
+        arg->channel = ev->channel;
+        arg->buf_len = ev->buf_len;
+        arg->status = ev->status;
+        arg->snr = ev->snr;
+        arg->phy_mode = ev->phy_mode;
+        arg->rate = ev->rate;
+
+        msdu_len = __le32_to_cpu(arg->buf_len);
+
+        if (skb->len < (frame - skb->data) + msdu_len) {
+                kfree(tb);
+                return -EPROTO;
+        }
+
+        /* shift the sk_buff to point to `frame` */
+        skb_trim(skb, 0);
+        skb_put(skb, frame - skb->data);
+        skb_pull(skb, frame - skb->data);
+        skb_put(skb, msdu_len);
+
+        kfree(tb);
+        return 0;
+}
+
+static int ath10k_wmi_tlv_op_pull_ch_info_ev(struct ath10k *ar,
+                                             struct sk_buff *skb,
+                                             struct wmi_ch_info_ev_arg *arg)
+{
+        const void **tb;
+        const struct wmi_chan_info_event *ev;
+        int ret;
+
+        tb = ath10k_wmi_tlv_parse_alloc(ar, skb->data, skb->len, GFP_ATOMIC);
+        if (IS_ERR(tb)) {
+                ret = PTR_ERR(tb);
+                ath10k_warn(ar, "failed to parse tlv: %d\n", ret);
+                return ret;
+        }
+
+        ev = tb[WMI_TLV_TAG_STRUCT_CHAN_INFO_EVENT];
+        if (!ev) {
+                kfree(tb);
+                return -EPROTO;
+        }
+
+        arg->err_code = ev->err_code;
+        arg->freq = ev->freq;
+        arg->cmd_flags = ev->cmd_flags;
+        arg->noise_floor = ev->noise_floor;
+        arg->rx_clear_count = ev->rx_clear_count;
+        arg->cycle_count = ev->cycle_count;
+
+        kfree(tb);
+        return 0;
+}
+
+static int
+ath10k_wmi_tlv_op_pull_vdev_start_ev(struct ath10k *ar, struct sk_buff *skb,
+                                     struct wmi_vdev_start_ev_arg *arg)
+{
+        const void **tb;
+        const struct wmi_vdev_start_response_event *ev;
+        int ret;
+
+        tb = ath10k_wmi_tlv_parse_alloc(ar, skb->data, skb->len, GFP_ATOMIC);
+        if (IS_ERR(tb)) {
+                ret = PTR_ERR(tb);
+                ath10k_warn(ar, "failed to parse tlv: %d\n", ret);
+                return ret;
+        }
+
+        ev = tb[WMI_TLV_TAG_STRUCT_VDEV_START_RESPONSE_EVENT];
+        if (!ev) {
+                kfree(tb);
+                return -EPROTO;
+        }
+
+        skb_pull(skb, sizeof(*ev));
+        arg->vdev_id = ev->vdev_id;
+        arg->req_id = ev->req_id;
+        arg->resp_type = ev->resp_type;
+        arg->status = ev->status;
+
+        kfree(tb);
+        return 0;
+}
+
+static int ath10k_wmi_tlv_op_pull_peer_kick_ev(struct ath10k *ar,
+                                               struct sk_buff *skb,
+                                               struct wmi_peer_kick_ev_arg *arg)
+{
+        const void **tb;
+        const struct wmi_peer_sta_kickout_event *ev;
+        int ret;
+
+        tb = ath10k_wmi_tlv_parse_alloc(ar, skb->data, skb->len, GFP_ATOMIC);
+        if (IS_ERR(tb)) {
+                ret = PTR_ERR(tb);
+                ath10k_warn(ar, "failed to parse tlv: %d\n", ret);
+                return ret;
+        }
+
+        ev = tb[WMI_TLV_TAG_STRUCT_PEER_STA_KICKOUT_EVENT];
+        if (!ev) {
+                kfree(tb);
+                return -EPROTO;
+        }
+
+        arg->mac_addr = ev->peer_macaddr.addr;
+
+        kfree(tb);
+        return 0;
+}
+
+struct wmi_tlv_swba_parse {
+        const struct wmi_host_swba_event *ev;
+        bool tim_done;
+        bool noa_done;
+        size_t n_tim;
+        size_t n_noa;
+        struct wmi_swba_ev_arg *arg;
+};
+
+static int ath10k_wmi_tlv_swba_tim_parse(struct ath10k *ar, u16 tag, u16 len,
+                                         const void *ptr, void *data)
+{
+        struct wmi_tlv_swba_parse *swba = data;
+
+        if (tag != WMI_TLV_TAG_STRUCT_TIM_INFO)
+                return -EPROTO;
+
+        if (swba->n_tim >= ARRAY_SIZE(swba->arg->tim_info))
+                return -ENOBUFS;
+
+        swba->arg->tim_info[swba->n_tim++] = ptr;
+        return 0;
+}
+
+static int ath10k_wmi_tlv_swba_noa_parse(struct ath10k *ar, u16 tag, u16 len,
+                                         const void *ptr, void *data)
+{
+        struct wmi_tlv_swba_parse *swba = data;
+
+        if (tag != WMI_TLV_TAG_STRUCT_P2P_NOA_INFO)
+                return -EPROTO;
+
+        if (swba->n_noa >= ARRAY_SIZE(swba->arg->noa_info))
+                return -ENOBUFS;
+
+        swba->arg->noa_info[swba->n_noa++] = ptr;
+        return 0;
+}
+
+static int ath10k_wmi_tlv_swba_parse(struct ath10k *ar, u16 tag, u16 len,
+                                     const void *ptr, void *data)
+{
+        struct wmi_tlv_swba_parse *swba = data;
+        int ret;
+
+        switch (tag) {
+        case WMI_TLV_TAG_STRUCT_HOST_SWBA_EVENT:
+                swba->ev = ptr;
+                break;
+        case WMI_TLV_TAG_ARRAY_STRUCT:
+                if (!swba->tim_done) {
+                        swba->tim_done = true;
+                        ret = ath10k_wmi_tlv_iter(ar, ptr, len,
+                                                  ath10k_wmi_tlv_swba_tim_parse,
+                                                  swba);
+                        if (ret)
+                                return ret;
+                } else if (!swba->noa_done) {
+                        swba->noa_done = true;
+                        ret = ath10k_wmi_tlv_iter(ar, ptr, len,
+                                                  ath10k_wmi_tlv_swba_noa_parse,
+                                                  swba);
+                        if (ret)
+                                return ret;
+                }
+                break;
+        default:
+                break;
+        }
+        return 0;
+}
+
+static int ath10k_wmi_tlv_op_pull_swba_ev(struct ath10k *ar,
+                                          struct sk_buff *skb,
+                                          struct wmi_swba_ev_arg *arg)
+{
+        struct wmi_tlv_swba_parse swba = { .arg = arg };
+        u32 map;
+        size_t n_vdevs;
+        int ret;
+
+        ret = ath10k_wmi_tlv_iter(ar, skb->data, skb->len,
+                                  ath10k_wmi_tlv_swba_parse, &swba);
+        if (ret) {
+                ath10k_warn(ar, "failed to parse tlv: %d\n", ret);
+                return ret;
+        }
+
+        if (!swba.ev)
+                return -EPROTO;
+
+        arg->vdev_map = swba.ev->vdev_map;
+
+        for (map = __le32_to_cpu(arg->vdev_map), n_vdevs = 0; map; map >>= 1)
+                if (map & BIT(0))
+                        n_vdevs++;
+
+        if (n_vdevs != swba.n_tim ||
+            n_vdevs != swba.n_noa)
+                return -EPROTO;
+
+        return 0;
+}
+
+static int ath10k_wmi_tlv_op_pull_phyerr_ev(struct ath10k *ar,
+                                            struct sk_buff *skb,
+                                            struct wmi_phyerr_ev_arg *arg)
+{
+        const void **tb;
+        const struct wmi_tlv_phyerr_ev *ev;
+        const void *phyerrs;
+        int ret;
+
+        tb = ath10k_wmi_tlv_parse_alloc(ar, skb->data, skb->len, GFP_ATOMIC);
+        if (IS_ERR(tb)) {
+                ret = PTR_ERR(tb);
+                ath10k_warn(ar, "failed to parse tlv: %d\n", ret);
+                return ret;
+        }
+
+        ev = tb[WMI_TLV_TAG_STRUCT_COMB_PHYERR_RX_HDR];
+        phyerrs = tb[WMI_TLV_TAG_ARRAY_BYTE];
+
+        if (!ev || !phyerrs) {
+                kfree(tb);
+                return -EPROTO;
+        }
+
+        arg->num_phyerrs  = ev->num_phyerrs;
+        arg->tsf_l32 = ev->tsf_l32;
+        arg->tsf_u32 = ev->tsf_u32;
+        arg->buf_len = ev->buf_len;
+        arg->phyerrs = phyerrs;
+
+        kfree(tb);
+        return 0;
+}
+
+#define WMI_TLV_ABI_VER_NS0 0x5F414351
+#define WMI_TLV_ABI_VER_NS1 0x00004C4D
+#define WMI_TLV_ABI_VER_NS2 0x00000000
+#define WMI_TLV_ABI_VER_NS3 0x00000000
+
+#define WMI_TLV_ABI_VER0_MAJOR 1
+#define WMI_TLV_ABI_VER0_MINOR 0
+#define WMI_TLV_ABI_VER0 ((((WMI_TLV_ABI_VER0_MAJOR) << 24) & 0xFF000000) | \
+                          (((WMI_TLV_ABI_VER0_MINOR) <<  0) & 0x00FFFFFF))
+#define WMI_TLV_ABI_VER1 53
+
+static int
+ath10k_wmi_tlv_parse_mem_reqs(struct ath10k *ar, u16 tag, u16 len,
+                              const void *ptr, void *data)
+{
+        struct wmi_svc_rdy_ev_arg *arg = data;
+        int i;
+
+        if (tag != WMI_TLV_TAG_STRUCT_WLAN_HOST_MEM_REQ)
+                return -EPROTO;
+
+        for (i = 0; i < ARRAY_SIZE(arg->mem_reqs); i++) {
+                if (!arg->mem_reqs[i]) {
+                        arg->mem_reqs[i] = ptr;
+                        return 0;
+                }
+        }
+
+        return -ENOMEM;
+}
+
+static int ath10k_wmi_tlv_op_pull_svc_rdy_ev(struct ath10k *ar,
+                                             struct sk_buff *skb,
+                                             struct wmi_svc_rdy_ev_arg *arg)
+{
+        const void **tb;
+        const struct hal_reg_capabilities *reg;
+        const struct wmi_tlv_svc_rdy_ev *ev;
+        const __le32 *svc_bmap;
+        const struct wlan_host_mem_req *mem_reqs;
+        int ret;
+
+        tb = ath10k_wmi_tlv_parse_alloc(ar, skb->data, skb->len, GFP_ATOMIC);
+        if (IS_ERR(tb)) {
+                ret = PTR_ERR(tb);
+                ath10k_warn(ar, "failed to parse tlv: %d\n", ret);
+                return ret;
+        }
+
+        ev = tb[WMI_TLV_TAG_STRUCT_SERVICE_READY_EVENT];
+        reg = tb[WMI_TLV_TAG_STRUCT_HAL_REG_CAPABILITIES];
+        svc_bmap = tb[WMI_TLV_TAG_ARRAY_UINT32];
+        mem_reqs = tb[WMI_TLV_TAG_ARRAY_STRUCT];
+
+        if (!ev || !reg || !svc_bmap || !mem_reqs) {
+                kfree(tb);
+                return -EPROTO;
+        }
+
+        /* This is an internal ABI compatibility check for WMI TLV so check it
+         * here instead of the generic WMI code.
+         */
+        ath10k_dbg(ar, ATH10K_DBG_WMI,
+                   "wmi tlv abi 0x%08x ?= 0x%08x, 0x%08x ?= 0x%08x, 0x%08x ?= 0x%08x, 0x%08x ?= 0x%08x, 0x%08x ?= 0x%08x\n",
+                   __le32_to_cpu(ev->abi.abi_ver0), WMI_TLV_ABI_VER0,
+                   __le32_to_cpu(ev->abi.abi_ver_ns0), WMI_TLV_ABI_VER_NS0,
+                   __le32_to_cpu(ev->abi.abi_ver_ns1), WMI_TLV_ABI_VER_NS1,
+                   __le32_to_cpu(ev->abi.abi_ver_ns2), WMI_TLV_ABI_VER_NS2,
+                   __le32_to_cpu(ev->abi.abi_ver_ns3), WMI_TLV_ABI_VER_NS3);
+
+        if (__le32_to_cpu(ev->abi.abi_ver0) != WMI_TLV_ABI_VER0 ||
+            __le32_to_cpu(ev->abi.abi_ver_ns0) != WMI_TLV_ABI_VER_NS0 ||
+            __le32_to_cpu(ev->abi.abi_ver_ns1) != WMI_TLV_ABI_VER_NS1 ||
+            __le32_to_cpu(ev->abi.abi_ver_ns2) != WMI_TLV_ABI_VER_NS2 ||
+            __le32_to_cpu(ev->abi.abi_ver_ns3) != WMI_TLV_ABI_VER_NS3) {
+                kfree(tb);
+                return -ENOTSUPP;
+        }
+
+        arg->min_tx_power = ev->hw_min_tx_power;
+        arg->max_tx_power = ev->hw_max_tx_power;
+        arg->ht_cap = ev->ht_cap_info;
+        arg->vht_cap = ev->vht_cap_info;
+        arg->sw_ver0 = ev->abi.abi_ver0;
+        arg->sw_ver1 = ev->abi.abi_ver1;
+        arg->fw_build = ev->fw_build_vers;
+        arg->phy_capab = ev->phy_capability;
+        arg->num_rf_chains = ev->num_rf_chains;
+        arg->eeprom_rd = reg->eeprom_rd;
+        arg->num_mem_reqs = ev->num_mem_reqs;
+        arg->service_map = svc_bmap;
+        arg->service_map_len = ath10k_wmi_tlv_len(svc_bmap);
+
+        ret = ath10k_wmi_tlv_iter(ar, mem_reqs, ath10k_wmi_tlv_len(mem_reqs),
+                                  ath10k_wmi_tlv_parse_mem_reqs, arg);
+        if (ret) {
+                kfree(tb);
+                ath10k_warn(ar, "failed to parse mem_reqs tlv: %d\n", ret);
+                return ret;
+        }
+
+        kfree(tb);
+        return 0;
+}
+
+static int ath10k_wmi_tlv_op_pull_rdy_ev(struct ath10k *ar,
+                                         struct sk_buff *skb,
+                                         struct wmi_rdy_ev_arg *arg)
+{
+        const void **tb;
+        const struct wmi_tlv_rdy_ev *ev;
+        int ret;
+
+        tb = ath10k_wmi_tlv_parse_alloc(ar, skb->data, skb->len, GFP_ATOMIC);
+        if (IS_ERR(tb)) {
+                ret = PTR_ERR(tb);
+                ath10k_warn(ar, "failed to parse tlv: %d\n", ret);
+                return ret;
+        }
+
+        ev = tb[WMI_TLV_TAG_STRUCT_READY_EVENT];
+        if (!ev) {
+                kfree(tb);
+                return -EPROTO;
+        }
+
+        arg->sw_version = ev->abi.abi_ver0;
+        arg->abi_version = ev->abi.abi_ver1;
+        arg->status = ev->status;
+        arg->mac_addr = ev->mac_addr.addr;
+
+        kfree(tb);
+        return 0;
+}
+
+static int ath10k_wmi_tlv_op_pull_fw_stats(struct ath10k *ar,
+                                           struct sk_buff *skb,
+                                           struct ath10k_fw_stats *stats)
+{
+        const void **tb;
+        const struct wmi_stats_event *ev;
+        const void *data;
+        u32 num_pdev_stats, num_vdev_stats, num_peer_stats;
+        size_t data_len;
+        int ret;
+
+        tb = ath10k_wmi_tlv_parse_alloc(ar, skb->data, skb->len, GFP_ATOMIC);
+        if (IS_ERR(tb)) {
+                ret = PTR_ERR(tb);
+                ath10k_warn(ar, "failed to parse tlv: %d\n", ret);
+                return ret;
+        }
+
+        ev = tb[WMI_TLV_TAG_STRUCT_STATS_EVENT];
+        data = tb[WMI_TLV_TAG_ARRAY_BYTE];
+
+        if (!ev || !data) {
+                kfree(tb);
+                return -EPROTO;
+        }
+
+        data_len = ath10k_wmi_tlv_len(data);
+        num_pdev_stats = __le32_to_cpu(ev->num_pdev_stats);
+        num_vdev_stats = __le32_to_cpu(ev->num_vdev_stats);
+        num_peer_stats = __le32_to_cpu(ev->num_peer_stats);
+
+        WARN_ON(1); /* FIXME: not implemented yet */
+
+        kfree(tb);
+        return 0;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_pdev_suspend(struct ath10k *ar, u32 opt)
+{
+        struct wmi_tlv_pdev_suspend *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_PDEV_SUSPEND_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->opt = __cpu_to_le32(opt);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv pdev suspend\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_pdev_resume(struct ath10k *ar)
+{
+        struct wmi_tlv_resume_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_PDEV_RESUME_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->reserved = __cpu_to_le32(0);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv pdev resume\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_pdev_set_rd(struct ath10k *ar,
+                                  u16 rd, u16 rd2g, u16 rd5g,
+                                  u16 ctl2g, u16 ctl5g,
+                                  enum wmi_dfs_region dfs_reg)
+{
+        struct wmi_tlv_pdev_set_rd_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_PDEV_SET_REGDOMAIN_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->regd = __cpu_to_le32(rd);
+        cmd->regd_2ghz = __cpu_to_le32(rd2g);
+        cmd->regd_5ghz = __cpu_to_le32(rd5g);
+        cmd->conform_limit_2ghz = __cpu_to_le32(rd2g);
+        cmd->conform_limit_5ghz = __cpu_to_le32(rd5g);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv pdev set rd\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_pdev_set_param(struct ath10k *ar, u32 param_id,
+                                     u32 param_value)
+{
+        struct wmi_tlv_pdev_set_param_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_PDEV_SET_PARAM_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->param_id = __cpu_to_le32(param_id);
+        cmd->param_value = __cpu_to_le32(param_value);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv pdev set param\n");
+        return skb;
+}
+
+static struct sk_buff *ath10k_wmi_tlv_op_gen_init(struct ath10k *ar)
+{
+        struct sk_buff *skb;
+        struct wmi_tlv *tlv;
+        struct wmi_tlv_init_cmd *cmd;
+        struct wmi_tlv_resource_config *cfg;
+        struct wmi_host_mem_chunks *chunks;
+        size_t len, chunks_len;
+        void *ptr;
+
+        chunks_len = ar->wmi.num_mem_chunks * sizeof(struct host_memory_chunk);
+        len = (sizeof(*tlv) + sizeof(*cmd)) +
+              (sizeof(*tlv) + sizeof(*cfg)) +
+              (sizeof(*tlv) + chunks_len);
+
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ptr = skb->data;
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_INIT_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cmd);
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_RESOURCE_CONFIG);
+        tlv->len = __cpu_to_le16(sizeof(*cfg));
+        cfg = (void *)tlv->value;
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cfg);
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_STRUCT);
+        tlv->len = __cpu_to_le16(chunks_len);
+        chunks = (void *)tlv->value;
+
+        ptr += sizeof(*tlv);
+        ptr += chunks_len;
+
+        cmd->abi.abi_ver0 = __cpu_to_le32(WMI_TLV_ABI_VER0);
+        cmd->abi.abi_ver1 = __cpu_to_le32(WMI_TLV_ABI_VER1);
+        cmd->abi.abi_ver_ns0 = __cpu_to_le32(WMI_TLV_ABI_VER_NS0);
+        cmd->abi.abi_ver_ns1 = __cpu_to_le32(WMI_TLV_ABI_VER_NS1);
+        cmd->abi.abi_ver_ns2 = __cpu_to_le32(WMI_TLV_ABI_VER_NS2);
+        cmd->abi.abi_ver_ns3 = __cpu_to_le32(WMI_TLV_ABI_VER_NS3);
+        cmd->num_host_mem_chunks = __cpu_to_le32(ar->wmi.num_mem_chunks);
+
+        cfg->num_vdevs = __cpu_to_le32(TARGET_TLV_NUM_VDEVS);
+        cfg->num_peers = __cpu_to_le32(TARGET_TLV_NUM_PEERS);
+
+        if (test_bit(WMI_SERVICE_RX_FULL_REORDER, ar->wmi.svc_map)) {
+                cfg->num_offload_peers = __cpu_to_le32(3);
+                cfg->num_offload_reorder_bufs = __cpu_to_le32(3);
+        } else {
+                cfg->num_offload_peers = __cpu_to_le32(0);
+                cfg->num_offload_reorder_bufs = __cpu_to_le32(0);
+        }
+
+        cfg->num_peer_keys = __cpu_to_le32(2);
+        cfg->num_tids = __cpu_to_le32(TARGET_TLV_NUM_TIDS);
+        cfg->ast_skid_limit = __cpu_to_le32(0x10);
+        cfg->tx_chain_mask = __cpu_to_le32(0x7);
+        cfg->rx_chain_mask = __cpu_to_le32(0x7);
+        cfg->rx_timeout_pri[0] = __cpu_to_le32(0x64);
+        cfg->rx_timeout_pri[1] = __cpu_to_le32(0x64);
+        cfg->rx_timeout_pri[2] = __cpu_to_le32(0x64);
+        cfg->rx_timeout_pri[3] = __cpu_to_le32(0x28);
+        cfg->rx_decap_mode = __cpu_to_le32(1);
+        cfg->scan_max_pending_reqs = __cpu_to_le32(4);
+        cfg->bmiss_offload_max_vdev = __cpu_to_le32(3);
+        cfg->roam_offload_max_vdev = __cpu_to_le32(3);
+        cfg->roam_offload_max_ap_profiles = __cpu_to_le32(8);
+        cfg->num_mcast_groups = __cpu_to_le32(0);
+        cfg->num_mcast_table_elems = __cpu_to_le32(0);
+        cfg->mcast2ucast_mode = __cpu_to_le32(0);
+        cfg->tx_dbg_log_size = __cpu_to_le32(0x400);
+        cfg->num_wds_entries = __cpu_to_le32(0x20);
+        cfg->dma_burst_size = __cpu_to_le32(0);
+        cfg->mac_aggr_delim = __cpu_to_le32(0);
+        cfg->rx_skip_defrag_timeout_dup_detection_check = __cpu_to_le32(0);
+        cfg->vow_config = __cpu_to_le32(0);
+        cfg->gtk_offload_max_vdev = __cpu_to_le32(2);
+        cfg->num_msdu_desc = __cpu_to_le32(TARGET_TLV_NUM_MSDU_DESC);
+        cfg->max_frag_entries = __cpu_to_le32(2);
+        cfg->num_tdls_vdevs = __cpu_to_le32(1);
+        cfg->num_tdls_conn_table_entries = __cpu_to_le32(0x20);
+        cfg->beacon_tx_offload_max_vdev = __cpu_to_le32(2);
+        cfg->num_multicast_filter_entries = __cpu_to_le32(5);
+        cfg->num_wow_filters = __cpu_to_le32(0x16);
+        cfg->num_keep_alive_pattern = __cpu_to_le32(6);
+        cfg->keep_alive_pattern_size = __cpu_to_le32(0);
+        cfg->max_tdls_concurrent_sleep_sta = __cpu_to_le32(1);
+        cfg->max_tdls_concurrent_buffer_sta = __cpu_to_le32(1);
+
+        ath10k_wmi_put_host_mem_chunks(ar, chunks);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv init\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_start_scan(struct ath10k *ar,
+                                 const struct wmi_start_scan_arg *arg)
+{
+        struct wmi_tlv_start_scan_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        size_t len, chan_len, ssid_len, bssid_len, ie_len;
+        __le32 *chans;
+        struct wmi_ssid *ssids;
+        struct wmi_mac_addr *addrs;
+        void *ptr;
+        int i, ret;
+
+        ret = ath10k_wmi_start_scan_verify(arg);
+        if (ret)
+                return ERR_PTR(ret);
+
+        chan_len = arg->n_channels * sizeof(__le32);
+        ssid_len = arg->n_ssids * sizeof(struct wmi_ssid);
+        bssid_len = arg->n_bssids * sizeof(struct wmi_mac_addr);
+        ie_len = roundup(arg->ie_len, 4);
+        len = (sizeof(*tlv) + sizeof(*cmd)) +
+              (arg->n_channels ? sizeof(*tlv) + chan_len : 0) +
+              (arg->n_ssids ? sizeof(*tlv) + ssid_len : 0) +
+              (arg->n_bssids ? sizeof(*tlv) + bssid_len : 0) +
+              (arg->ie_len ? sizeof(*tlv) + ie_len : 0);
+
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ptr = (void *)skb->data;
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_START_SCAN_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+
+        ath10k_wmi_put_start_scan_common(&cmd->common, arg);
+        cmd->burst_duration_ms = __cpu_to_le32(0);
+        cmd->num_channels = __cpu_to_le32(arg->n_channels);
+        cmd->num_ssids = __cpu_to_le32(arg->n_ssids);
+        cmd->num_bssids = __cpu_to_le32(arg->n_bssids);
+        cmd->ie_len = __cpu_to_le32(arg->ie_len);
+        cmd->num_probes = __cpu_to_le32(3);
+
+        /* FIXME: There are some scan flag inconsistencies across firmwares,
+         * e.g. WMI-TLV inverts the logic behind the following flag.
+         */
+        cmd->common.scan_ctrl_flags ^= __cpu_to_le32(WMI_SCAN_FILTER_PROBE_REQ);
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cmd);
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_UINT32);
+        tlv->len = __cpu_to_le16(chan_len);
+        chans = (void *)tlv->value;
+        for (i = 0; i < arg->n_channels; i++)
+                chans[i] = __cpu_to_le32(arg->channels[i]);
+
+        ptr += sizeof(*tlv);
+        ptr += chan_len;
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_FIXED_STRUCT);
+        tlv->len = __cpu_to_le16(ssid_len);
+        ssids = (void *)tlv->value;
+        for (i = 0; i < arg->n_ssids; i++) {
+                ssids[i].ssid_len = __cpu_to_le32(arg->ssids[i].len);
+                memcpy(ssids[i].ssid, arg->ssids[i].ssid, arg->ssids[i].len);
+        }
+
+        ptr += sizeof(*tlv);
+        ptr += ssid_len;
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_FIXED_STRUCT);
+        tlv->len = __cpu_to_le16(bssid_len);
+        addrs = (void *)tlv->value;
+        for (i = 0; i < arg->n_bssids; i++)
+                ether_addr_copy(addrs[i].addr, arg->bssids[i].bssid);
+
+        ptr += sizeof(*tlv);
+        ptr += bssid_len;
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_BYTE);
+        tlv->len = __cpu_to_le16(ie_len);
+        memcpy(tlv->value, arg->ie, arg->ie_len);
+
+        ptr += sizeof(*tlv);
+        ptr += ie_len;
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv start scan\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_stop_scan(struct ath10k *ar,
+                                const struct wmi_stop_scan_arg *arg)
+{
+        struct wmi_stop_scan_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        u32 scan_id;
+        u32 req_id;
+
+        if (arg->req_id > 0xFFF)
+                return ERR_PTR(-EINVAL);
+        if (arg->req_type == WMI_SCAN_STOP_ONE && arg->u.scan_id > 0xFFF)
+                return ERR_PTR(-EINVAL);
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        scan_id = arg->u.scan_id;
+        scan_id |= WMI_HOST_SCAN_REQ_ID_PREFIX;
+
+        req_id = arg->req_id;
+        req_id |= WMI_HOST_SCAN_REQUESTOR_ID_PREFIX;
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_STOP_SCAN_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->req_type = __cpu_to_le32(arg->req_type);
+        cmd->vdev_id = __cpu_to_le32(arg->u.vdev_id);
+        cmd->scan_id = __cpu_to_le32(scan_id);
+        cmd->scan_req_id = __cpu_to_le32(req_id);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv stop scan\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_vdev_create(struct ath10k *ar,
+                                  u32 vdev_id,
+                                  enum wmi_vdev_type vdev_type,
+                                  enum wmi_vdev_subtype vdev_subtype,
+                                  const u8 mac_addr[ETH_ALEN])
+{
+        struct wmi_vdev_create_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_VDEV_CREATE_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        cmd->vdev_type = __cpu_to_le32(vdev_type);
+        cmd->vdev_subtype = __cpu_to_le32(vdev_subtype);
+        ether_addr_copy(cmd->vdev_macaddr.addr, mac_addr);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv vdev create\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_vdev_delete(struct ath10k *ar, u32 vdev_id)
+{
+        struct wmi_vdev_delete_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_VDEV_DELETE_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv vdev delete\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_vdev_start(struct ath10k *ar,
+                                 const struct wmi_vdev_start_request_arg *arg,
+                                 bool restart)
+{
+        struct wmi_tlv_vdev_start_cmd *cmd;
+        struct wmi_channel *ch;
+        struct wmi_p2p_noa_descriptor *noa;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        size_t len;
+        void *ptr;
+        u32 flags = 0;
+
+        if (WARN_ON(arg->ssid && arg->ssid_len == 0))
+                return ERR_PTR(-EINVAL);
+        if (WARN_ON(arg->hidden_ssid && !arg->ssid))
+                return ERR_PTR(-EINVAL);
+        if (WARN_ON(arg->ssid_len > sizeof(cmd->ssid.ssid)))
+                return ERR_PTR(-EINVAL);
+
+        len = (sizeof(*tlv) + sizeof(*cmd)) +
+              (sizeof(*tlv) + sizeof(*ch)) +
+              (sizeof(*tlv) + 0);
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        if (arg->hidden_ssid)
+                flags |= WMI_VDEV_START_HIDDEN_SSID;
+        if (arg->pmf_enabled)
+                flags |= WMI_VDEV_START_PMF_ENABLED;
+
+        ptr = (void *)skb->data;
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_VDEV_START_REQUEST_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(arg->vdev_id);
+        cmd->bcn_intval = __cpu_to_le32(arg->bcn_intval);
+        cmd->dtim_period = __cpu_to_le32(arg->dtim_period);
+        cmd->flags = __cpu_to_le32(flags);
+        cmd->bcn_tx_rate = __cpu_to_le32(arg->bcn_tx_rate);
+        cmd->bcn_tx_power = __cpu_to_le32(arg->bcn_tx_power);
+        cmd->disable_hw_ack = __cpu_to_le32(arg->disable_hw_ack);
+
+        if (arg->ssid) {
+                cmd->ssid.ssid_len = __cpu_to_le32(arg->ssid_len);
+                memcpy(cmd->ssid.ssid, arg->ssid, arg->ssid_len);
+        }
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cmd);
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_CHANNEL);
+        tlv->len = __cpu_to_le16(sizeof(*ch));
+        ch = (void *)tlv->value;
+        ath10k_wmi_put_wmi_channel(ch, &arg->channel);
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*ch);
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_STRUCT);
+        tlv->len = 0;
+        noa = (void *)tlv->value;
+
+        /* Note: This is a nested TLV containing:
+         * [wmi_tlv][wmi_p2p_noa_descriptor][wmi_tlv]..
+         */
+
+        ptr += sizeof(*tlv);
+        ptr += 0;
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv vdev start\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_vdev_stop(struct ath10k *ar, u32 vdev_id)
+{
+        struct wmi_vdev_stop_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_VDEV_STOP_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv vdev stop\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_vdev_up(struct ath10k *ar, u32 vdev_id, u32 aid,
+                              const u8 *bssid)
+
+{
+        struct wmi_vdev_up_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_VDEV_UP_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        cmd->vdev_assoc_id = __cpu_to_le32(aid);
+        ether_addr_copy(cmd->vdev_bssid.addr, bssid);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv vdev up\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_vdev_down(struct ath10k *ar, u32 vdev_id)
+{
+        struct wmi_vdev_down_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_VDEV_DOWN_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv vdev down\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_vdev_set_param(struct ath10k *ar, u32 vdev_id,
+                                     u32 param_id, u32 param_value)
+{
+        struct wmi_vdev_set_param_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_VDEV_SET_PARAM_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        cmd->param_id = __cpu_to_le32(param_id);
+        cmd->param_value = __cpu_to_le32(param_value);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv vdev set param\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_vdev_install_key(struct ath10k *ar,
+                                       const struct wmi_vdev_install_key_arg *arg)
+{
+        struct wmi_vdev_install_key_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        size_t len;
+        void *ptr;
+
+        if (arg->key_cipher == WMI_CIPHER_NONE && arg->key_data != NULL)
+                return ERR_PTR(-EINVAL);
+        if (arg->key_cipher != WMI_CIPHER_NONE && arg->key_data == NULL)
+                return ERR_PTR(-EINVAL);
+
+        len = sizeof(*tlv) + sizeof(*cmd) +
+              sizeof(*tlv) + roundup(arg->key_len, sizeof(__le32));
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ptr = (void *)skb->data;
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_VDEV_INSTALL_KEY_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(arg->vdev_id);
+        cmd->key_idx = __cpu_to_le32(arg->key_idx);
+        cmd->key_flags = __cpu_to_le32(arg->key_flags);
+        cmd->key_cipher = __cpu_to_le32(arg->key_cipher);
+        cmd->key_len = __cpu_to_le32(arg->key_len);
+        cmd->key_txmic_len = __cpu_to_le32(arg->key_txmic_len);
+        cmd->key_rxmic_len = __cpu_to_le32(arg->key_rxmic_len);
+
+        if (arg->macaddr)
+                ether_addr_copy(cmd->peer_macaddr.addr, arg->macaddr);
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cmd);
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_BYTE);
+        tlv->len = __cpu_to_le16(roundup(arg->key_len, sizeof(__le32)));
+        if (arg->key_data)
+                memcpy(tlv->value, arg->key_data, arg->key_len);
+
+        ptr += sizeof(*tlv);
+        ptr += roundup(arg->key_len, sizeof(__le32));
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv vdev install key\n");
+        return skb;
+}
+
+static void *ath10k_wmi_tlv_put_uapsd_ac(struct ath10k *ar, void *ptr,
+                                         const struct wmi_sta_uapsd_auto_trig_arg *arg)
+{
+        struct wmi_sta_uapsd_auto_trig_param *ac;
+        struct wmi_tlv *tlv;
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_STA_UAPSD_AUTO_TRIG_PARAM);
+        tlv->len = __cpu_to_le16(sizeof(*ac));
+        ac = (void *)tlv->value;
+
+        ac->wmm_ac = __cpu_to_le32(arg->wmm_ac);
+        ac->user_priority = __cpu_to_le32(arg->user_priority);
+        ac->service_interval = __cpu_to_le32(arg->service_interval);
+        ac->suspend_interval = __cpu_to_le32(arg->suspend_interval);
+        ac->delay_interval = __cpu_to_le32(arg->delay_interval);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI,
+                   "wmi tlv vdev sta uapsd auto trigger ac %d prio %d svc int %d susp int %d delay int %d\n",
+                   ac->wmm_ac, ac->user_priority, ac->service_interval,
+                   ac->suspend_interval, ac->delay_interval);
+
+        return ptr + sizeof(*tlv) + sizeof(*ac);
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_vdev_sta_uapsd(struct ath10k *ar, u32 vdev_id,
+                                     const u8 peer_addr[ETH_ALEN],
+                                     const struct wmi_sta_uapsd_auto_trig_arg *args,
+                                     u32 num_ac)
+{
+        struct wmi_sta_uapsd_auto_trig_cmd_fixed_param *cmd;
+        struct wmi_sta_uapsd_auto_trig_param *ac;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        size_t len;
+        size_t ac_tlv_len;
+        void *ptr;
+        int i;
+
+        ac_tlv_len = num_ac * (sizeof(*tlv) + sizeof(*ac));
+        len = sizeof(*tlv) + sizeof(*cmd) +
+              sizeof(*tlv) + ac_tlv_len;
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ptr = (void *)skb->data;
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_STA_UAPSD_AUTO_TRIG_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        cmd->num_ac = __cpu_to_le32(num_ac);
+        ether_addr_copy(cmd->peer_macaddr.addr, peer_addr);
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cmd);
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_STRUCT);
+        tlv->len = __cpu_to_le16(ac_tlv_len);
+        ac = (void *)tlv->value;
+
+        ptr += sizeof(*tlv);
+        for (i = 0; i < num_ac; i++)
+                ptr = ath10k_wmi_tlv_put_uapsd_ac(ar, ptr, &args[i]);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv vdev sta uapsd auto trigger\n");
+        return skb;
+}
+
+static void *ath10k_wmi_tlv_put_wmm(void *ptr,
+                                    const struct wmi_wmm_params_arg *arg)
+{
+        struct wmi_wmm_params *wmm;
+        struct wmi_tlv *tlv;
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_WMM_PARAMS);
+        tlv->len = __cpu_to_le16(sizeof(*wmm));
+        wmm = (void *)tlv->value;
+        ath10k_wmi_set_wmm_param(wmm, arg);
+
+        return ptr + sizeof(*tlv) + sizeof(*wmm);
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_vdev_wmm_conf(struct ath10k *ar, u32 vdev_id,
+                                    const struct wmi_wmm_params_all_arg *arg)
+{
+        struct wmi_tlv_vdev_set_wmm_cmd *cmd;
+        struct wmi_wmm_params *wmm;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        size_t len;
+        void *ptr;
+
+        len = (sizeof(*tlv) + sizeof(*cmd)) +
+              (4 * (sizeof(*tlv) + sizeof(*wmm)));
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ptr = (void *)skb->data;
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_VDEV_SET_WMM_PARAMS_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cmd);
+
+        ptr = ath10k_wmi_tlv_put_wmm(ptr, &arg->ac_be);
+        ptr = ath10k_wmi_tlv_put_wmm(ptr, &arg->ac_bk);
+        ptr = ath10k_wmi_tlv_put_wmm(ptr, &arg->ac_vi);
+        ptr = ath10k_wmi_tlv_put_wmm(ptr, &arg->ac_vo);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv vdev wmm conf\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_sta_keepalive(struct ath10k *ar,
+                                    const struct wmi_sta_keepalive_arg *arg)
+{
+        struct wmi_tlv_sta_keepalive_cmd *cmd;
+        struct wmi_sta_keepalive_arp_resp *arp;
+        struct sk_buff *skb;
+        struct wmi_tlv *tlv;
+        void *ptr;
+        size_t len;
+
+        len = sizeof(*tlv) + sizeof(*cmd) +
+              sizeof(*tlv) + sizeof(*arp);
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ptr = (void *)skb->data;
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_STA_KEEPALIVE_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(arg->vdev_id);
+        cmd->enabled = __cpu_to_le32(arg->enabled);
+        cmd->method = __cpu_to_le32(arg->method);
+        cmd->interval = __cpu_to_le32(arg->interval);
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cmd);
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_STA_KEEPALVE_ARP_RESPONSE);
+        tlv->len = __cpu_to_le16(sizeof(*arp));
+        arp = (void *)tlv->value;
+
+        arp->src_ip4_addr = arg->src_ip4_addr;
+        arp->dest_ip4_addr = arg->dest_ip4_addr;
+        ether_addr_copy(arp->dest_mac_addr.addr, arg->dest_mac_addr);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv sta keepalive vdev %d enabled %d method %d inverval %d\n",
+                   arg->vdev_id, arg->enabled, arg->method, arg->interval);
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_peer_create(struct ath10k *ar, u32 vdev_id,
+                                  const u8 peer_addr[ETH_ALEN])
+{
+        struct wmi_tlv_peer_create_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_PEER_CREATE_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        cmd->peer_type = __cpu_to_le32(WMI_TLV_PEER_TYPE_DEFAULT); /* FIXME */
+        ether_addr_copy(cmd->peer_addr.addr, peer_addr);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv peer create\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_peer_delete(struct ath10k *ar, u32 vdev_id,
+                                  const u8 peer_addr[ETH_ALEN])
+{
+        struct wmi_peer_delete_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_PEER_DELETE_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        ether_addr_copy(cmd->peer_macaddr.addr, peer_addr);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv peer delete\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_peer_flush(struct ath10k *ar, u32 vdev_id,
+                                 const u8 peer_addr[ETH_ALEN], u32 tid_bitmap)
+{
+        struct wmi_peer_flush_tids_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_PEER_FLUSH_TIDS_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        cmd->peer_tid_bitmap = __cpu_to_le32(tid_bitmap);
+        ether_addr_copy(cmd->peer_macaddr.addr, peer_addr);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv peer flush\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_peer_set_param(struct ath10k *ar, u32 vdev_id,
+                                     const u8 *peer_addr,
+                                     enum wmi_peer_param param_id,
+                                     u32 param_value)
+{
+        struct wmi_peer_set_param_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_PEER_SET_PARAM_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        cmd->param_id = __cpu_to_le32(param_id);
+        cmd->param_value = __cpu_to_le32(param_value);
+        ether_addr_copy(cmd->peer_macaddr.addr, peer_addr);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv peer set param\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_peer_assoc(struct ath10k *ar,
+                                 const struct wmi_peer_assoc_complete_arg *arg)
+{
+        struct wmi_tlv_peer_assoc_cmd *cmd;
+        struct wmi_vht_rate_set *vht_rate;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        size_t len, legacy_rate_len, ht_rate_len;
+        void *ptr;
+
+        if (arg->peer_mpdu_density > 16)
+                return ERR_PTR(-EINVAL);
+        if (arg->peer_legacy_rates.num_rates > MAX_SUPPORTED_RATES)
+                return ERR_PTR(-EINVAL);
+        if (arg->peer_ht_rates.num_rates > MAX_SUPPORTED_RATES)
+                return ERR_PTR(-EINVAL);
+
+        legacy_rate_len = roundup(arg->peer_legacy_rates.num_rates,
+                                  sizeof(__le32));
+        ht_rate_len = roundup(arg->peer_ht_rates.num_rates, sizeof(__le32));
+        len = (sizeof(*tlv) + sizeof(*cmd)) +
+              (sizeof(*tlv) + legacy_rate_len) +
+              (sizeof(*tlv) + ht_rate_len) +
+              (sizeof(*tlv) + sizeof(*vht_rate));
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ptr = (void *)skb->data;
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_PEER_ASSOC_COMPLETE_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+
+        cmd->vdev_id = __cpu_to_le32(arg->vdev_id);
+        cmd->new_assoc = __cpu_to_le32(arg->peer_reassoc ? 0 : 1);
+        cmd->assoc_id = __cpu_to_le32(arg->peer_aid);
+        cmd->flags = __cpu_to_le32(arg->peer_flags);
+        cmd->caps = __cpu_to_le32(arg->peer_caps);
+        cmd->listen_intval = __cpu_to_le32(arg->peer_listen_intval);
+        cmd->ht_caps = __cpu_to_le32(arg->peer_ht_caps);
+        cmd->max_mpdu = __cpu_to_le32(arg->peer_max_mpdu);
+        cmd->mpdu_density = __cpu_to_le32(arg->peer_mpdu_density);
+        cmd->rate_caps = __cpu_to_le32(arg->peer_rate_caps);
+        cmd->nss = __cpu_to_le32(arg->peer_num_spatial_streams);
+        cmd->vht_caps = __cpu_to_le32(arg->peer_vht_caps);
+        cmd->phy_mode = __cpu_to_le32(arg->peer_phymode);
+        cmd->num_legacy_rates = __cpu_to_le32(arg->peer_legacy_rates.num_rates);
+        cmd->num_ht_rates = __cpu_to_le32(arg->peer_ht_rates.num_rates);
+        ether_addr_copy(cmd->mac_addr.addr, arg->addr);
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cmd);
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_BYTE);
+        tlv->len = __cpu_to_le16(legacy_rate_len);
+        memcpy(tlv->value, arg->peer_legacy_rates.rates,
+               arg->peer_legacy_rates.num_rates);
+
+        ptr += sizeof(*tlv);
+        ptr += legacy_rate_len;
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_BYTE);
+        tlv->len = __cpu_to_le16(ht_rate_len);
+        memcpy(tlv->value, arg->peer_ht_rates.rates,
+               arg->peer_ht_rates.num_rates);
+
+        ptr += sizeof(*tlv);
+        ptr += ht_rate_len;
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_VHT_RATE_SET);
+        tlv->len = __cpu_to_le16(sizeof(*vht_rate));
+        vht_rate = (void *)tlv->value;
+
+        vht_rate->rx_max_rate = __cpu_to_le32(arg->peer_vht_rates.rx_max_rate);
+        vht_rate->rx_mcs_set = __cpu_to_le32(arg->peer_vht_rates.rx_mcs_set);
+        vht_rate->tx_max_rate = __cpu_to_le32(arg->peer_vht_rates.tx_max_rate);
+        vht_rate->tx_mcs_set = __cpu_to_le32(arg->peer_vht_rates.tx_mcs_set);
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*vht_rate);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv peer assoc\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_set_psmode(struct ath10k *ar, u32 vdev_id,
+                                 enum wmi_sta_ps_mode psmode)
+{
+        struct wmi_sta_powersave_mode_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_STA_POWERSAVE_MODE_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        cmd->sta_ps_mode = __cpu_to_le32(psmode);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv set psmode\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_set_sta_ps(struct ath10k *ar, u32 vdev_id,
+                                 enum wmi_sta_powersave_param param_id,
+                                 u32 param_value)
+{
+        struct wmi_sta_powersave_param_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_STA_POWERSAVE_PARAM_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        cmd->param_id = __cpu_to_le32(param_id);
+        cmd->param_value = __cpu_to_le32(param_value);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv set sta ps\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_set_ap_ps(struct ath10k *ar, u32 vdev_id, const u8 *mac,
+                                enum wmi_ap_ps_peer_param param_id, u32 value)
+{
+        struct wmi_ap_ps_peer_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        if (!mac)
+                return ERR_PTR(-EINVAL);
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_AP_PS_PEER_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        cmd->param_id = __cpu_to_le32(param_id);
+        cmd->param_value = __cpu_to_le32(value);
+        ether_addr_copy(cmd->peer_macaddr.addr, mac);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv ap ps param\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_scan_chan_list(struct ath10k *ar,
+                                     const struct wmi_scan_chan_list_arg *arg)
+{
+        struct wmi_tlv_scan_chan_list_cmd *cmd;
+        struct wmi_channel *ci;
+        struct wmi_channel_arg *ch;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        size_t chans_len, len;
+        int i;
+        void *ptr, *chans;
+
+        chans_len = arg->n_channels * (sizeof(*tlv) + sizeof(*ci));
+        len = (sizeof(*tlv) + sizeof(*cmd)) +
+              (sizeof(*tlv) + chans_len);
+
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ptr = (void *)skb->data;
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_SCAN_CHAN_LIST_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->num_scan_chans = __cpu_to_le32(arg->n_channels);
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cmd);
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_STRUCT);
+        tlv->len = __cpu_to_le16(chans_len);
+        chans = (void *)tlv->value;
+
+        for (i = 0; i < arg->n_channels; i++) {
+                ch = &arg->channels[i];
+
+                tlv = chans;
+                tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_CHANNEL);
+                tlv->len = __cpu_to_le16(sizeof(*ci));
+                ci = (void *)tlv->value;
+
+                ath10k_wmi_put_wmi_channel(ci, ch);
+
+                chans += sizeof(*tlv);
+                chans += sizeof(*ci);
+        }
+
+        ptr += sizeof(*tlv);
+        ptr += chans_len;
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv scan chan list\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_beacon_dma(struct ath10k *ar, u32 vdev_id,
+                                 const void *bcn, size_t bcn_len,
+                                 u32 bcn_paddr, bool dtim_zero,
+                                 bool deliver_cab)
+
+{
+        struct wmi_bcn_tx_ref_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        struct ieee80211_hdr *hdr;
+        u16 fc;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        hdr = (struct ieee80211_hdr *)bcn;
+        fc = le16_to_cpu(hdr->frame_control);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_BCN_SEND_FROM_HOST_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        cmd->data_len = __cpu_to_le32(bcn_len);
+        cmd->data_ptr = __cpu_to_le32(bcn_paddr);
+        cmd->msdu_id = 0;
+        cmd->frame_control = __cpu_to_le32(fc);
+        cmd->flags = 0;
+
+        if (dtim_zero)
+                cmd->flags |= __cpu_to_le32(WMI_BCN_TX_REF_FLAG_DTIM_ZERO);
+
+        if (deliver_cab)
+                cmd->flags |= __cpu_to_le32(WMI_BCN_TX_REF_FLAG_DELIVER_CAB);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv beacon dma\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_pdev_set_wmm(struct ath10k *ar,
+                                   const struct wmi_wmm_params_all_arg *arg)
+{
+        struct wmi_tlv_pdev_set_wmm_cmd *cmd;
+        struct wmi_wmm_params *wmm;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        size_t len;
+        void *ptr;
+
+        len = (sizeof(*tlv) + sizeof(*cmd)) +
+              (4 * (sizeof(*tlv) + sizeof(*wmm)));
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ptr = (void *)skb->data;
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_PDEV_SET_WMM_PARAMS_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+
+        /* nothing to set here */
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cmd);
+
+        ptr = ath10k_wmi_tlv_put_wmm(ptr, &arg->ac_be);
+        ptr = ath10k_wmi_tlv_put_wmm(ptr, &arg->ac_bk);
+        ptr = ath10k_wmi_tlv_put_wmm(ptr, &arg->ac_vi);
+        ptr = ath10k_wmi_tlv_put_wmm(ptr, &arg->ac_vo);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv pdev set wmm\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_request_stats(struct ath10k *ar,
+                                    enum wmi_stats_id stats_id)
+{
+        struct wmi_request_stats_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_REQUEST_STATS_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->stats_id = __cpu_to_le32(stats_id);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv request stats\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_force_fw_hang(struct ath10k *ar,
+                                    enum wmi_force_fw_hang_type type,
+                                    u32 delay_ms)
+{
+        struct wmi_force_fw_hang_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*tlv) + sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        tlv = (void *)skb->data;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_FORCE_FW_HANG_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->type = __cpu_to_le32(type);
+        cmd->delay_ms = __cpu_to_le32(delay_ms);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv force fw hang\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_dbglog_cfg(struct ath10k *ar, u32 module_enable,
+                                 u32 log_level) {
+        struct wmi_tlv_dbglog_cmd *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        size_t len, bmap_len;
+        u32 value;
+        void *ptr;
+
+        if (module_enable) {
+                value = WMI_TLV_DBGLOG_LOG_LEVEL_VALUE(
+                                module_enable,
+                                WMI_TLV_DBGLOG_LOG_LEVEL_VERBOSE);
+        } else {
+                value = WMI_TLV_DBGLOG_LOG_LEVEL_VALUE(
+                                WMI_TLV_DBGLOG_ALL_MODULES,
+                                WMI_TLV_DBGLOG_LOG_LEVEL_WARN);
+        }
+
+        bmap_len = 0;
+        len = sizeof(*tlv) + sizeof(*cmd) + sizeof(*tlv) + bmap_len;
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ptr = (void *)skb->data;
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_DEBUG_LOG_CONFIG_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->param = __cpu_to_le32(WMI_TLV_DBGLOG_PARAM_LOG_LEVEL);
+        cmd->value = __cpu_to_le32(value);
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cmd);
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_UINT32);
+        tlv->len = __cpu_to_le16(bmap_len);
+
+        /* nothing to do here */
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(bmap_len);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv dbglog value 0x%08x\n", value);
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_pktlog_enable(struct ath10k *ar, u32 filter)
+{
+        struct wmi_tlv_pktlog_enable *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        void *ptr;
+        size_t len;
+
+        len = sizeof(*tlv) + sizeof(*cmd);
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ptr = (void *)skb->data;
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_PDEV_PKTLOG_ENABLE_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->filter = __cpu_to_le32(filter);
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cmd);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv pktlog enable filter 0x%08x\n",
+                   filter);
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_pktlog_disable(struct ath10k *ar)
+{
+        struct wmi_tlv_pktlog_disable *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        void *ptr;
+        size_t len;
+
+        len = sizeof(*tlv) + sizeof(*cmd);
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ptr = (void *)skb->data;
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_PDEV_PKTLOG_DISABLE_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cmd);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv pktlog disable\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_bcn_tmpl(struct ath10k *ar, u32 vdev_id,
+                               u32 tim_ie_offset, struct sk_buff *bcn,
+                               u32 prb_caps, u32 prb_erp, void *prb_ies,
+                               size_t prb_ies_len)
+{
+        struct wmi_tlv_bcn_tmpl_cmd *cmd;
+        struct wmi_tlv_bcn_prb_info *info;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        void *ptr;
+        size_t len;
+
+        if (WARN_ON(prb_ies_len > 0 && !prb_ies))
+                return ERR_PTR(-EINVAL);
+
+        len = sizeof(*tlv) + sizeof(*cmd) +
+              sizeof(*tlv) + sizeof(*info) + prb_ies_len +
+              sizeof(*tlv) + roundup(bcn->len, 4);
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ptr = (void *)skb->data;
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_BCN_TMPL_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        cmd->tim_ie_offset = __cpu_to_le32(tim_ie_offset);
+        cmd->buf_len = __cpu_to_le32(bcn->len);
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cmd);
+
+        /* FIXME: prb_ies_len should be probably aligned to 4byte boundary but
+         * then it is then impossible to pass original ie len.
+         * This chunk is not used yet so if setting probe resp template yields
+         * problems with beaconing or crashes firmware look here.
+         */
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_BCN_PRB_INFO);
+        tlv->len = __cpu_to_le16(sizeof(*info) + prb_ies_len);
+        info = (void *)tlv->value;
+        info->caps = __cpu_to_le32(prb_caps);
+        info->erp = __cpu_to_le32(prb_erp);
+        memcpy(info->ies, prb_ies, prb_ies_len);
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*info);
+        ptr += prb_ies_len;
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_BYTE);
+        tlv->len = __cpu_to_le16(roundup(bcn->len, 4));
+        memcpy(tlv->value, bcn->data, bcn->len);
+
+        /* FIXME: Adjust TSF? */
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv bcn tmpl vdev_id %i\n",
+                   vdev_id);
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_prb_tmpl(struct ath10k *ar, u32 vdev_id,
+                               struct sk_buff *prb)
+{
+        struct wmi_tlv_prb_tmpl_cmd *cmd;
+        struct wmi_tlv_bcn_prb_info *info;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        void *ptr;
+        size_t len;
+
+        len = sizeof(*tlv) + sizeof(*cmd) +
+              sizeof(*tlv) + sizeof(*info) +
+              sizeof(*tlv) + roundup(prb->len, 4);
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ptr = (void *)skb->data;
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_PRB_TMPL_CMD);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        cmd->buf_len = __cpu_to_le32(prb->len);
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cmd);
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_BCN_PRB_INFO);
+        tlv->len = __cpu_to_le16(sizeof(*info));
+        info = (void *)tlv->value;
+        info->caps = 0;
+        info->erp = 0;
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*info);
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_BYTE);
+        tlv->len = __cpu_to_le16(roundup(prb->len, 4));
+        memcpy(tlv->value, prb->data, prb->len);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv prb tmpl vdev_id %i\n",
+                   vdev_id);
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_tlv_op_gen_p2p_go_bcn_ie(struct ath10k *ar, u32 vdev_id,
+                                    const u8 *p2p_ie)
+{
+        struct wmi_tlv_p2p_go_bcn_ie *cmd;
+        struct wmi_tlv *tlv;
+        struct sk_buff *skb;
+        void *ptr;
+        size_t len;
+
+        len = sizeof(*tlv) + sizeof(*cmd) +
+              sizeof(*tlv) + roundup(p2p_ie[1] + 2, 4);
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ptr = (void *)skb->data;
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_STRUCT_P2P_GO_SET_BEACON_IE);
+        tlv->len = __cpu_to_le16(sizeof(*cmd));
+        cmd = (void *)tlv->value;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        cmd->ie_len = __cpu_to_le32(p2p_ie[1] + 2);
+
+        ptr += sizeof(*tlv);
+        ptr += sizeof(*cmd);
+
+        tlv = ptr;
+        tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_BYTE);
+        tlv->len = __cpu_to_le16(roundup(p2p_ie[1] + 2, 4));
+        memcpy(tlv->value, p2p_ie, p2p_ie[1] + 2);
+
+        ptr += sizeof(*tlv);
+        ptr += roundup(p2p_ie[1] + 2, 4);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi tlv p2p go bcn ie for vdev %i\n",
+                   vdev_id);
+        return skb;
+}
+
+/****************/
+/* TLV mappings */
+/****************/
+
+static struct wmi_cmd_map wmi_tlv_cmd_map = {
+        .init_cmdid = WMI_TLV_INIT_CMDID,
+        .start_scan_cmdid = WMI_TLV_START_SCAN_CMDID,
+        .stop_scan_cmdid = WMI_TLV_STOP_SCAN_CMDID,
+        .scan_chan_list_cmdid = WMI_TLV_SCAN_CHAN_LIST_CMDID,
+        .scan_sch_prio_tbl_cmdid = WMI_TLV_SCAN_SCH_PRIO_TBL_CMDID,
+        .pdev_set_regdomain_cmdid = WMI_TLV_PDEV_SET_REGDOMAIN_CMDID,
+        .pdev_set_channel_cmdid = WMI_TLV_PDEV_SET_CHANNEL_CMDID,
+        .pdev_set_param_cmdid = WMI_TLV_PDEV_SET_PARAM_CMDID,
+        .pdev_pktlog_enable_cmdid = WMI_TLV_PDEV_PKTLOG_ENABLE_CMDID,
+        .pdev_pktlog_disable_cmdid = WMI_TLV_PDEV_PKTLOG_DISABLE_CMDID,
+        .pdev_set_wmm_params_cmdid = WMI_TLV_PDEV_SET_WMM_PARAMS_CMDID,
+        .pdev_set_ht_cap_ie_cmdid = WMI_TLV_PDEV_SET_HT_CAP_IE_CMDID,
+        .pdev_set_vht_cap_ie_cmdid = WMI_TLV_PDEV_SET_VHT_CAP_IE_CMDID,
+        .pdev_set_dscp_tid_map_cmdid = WMI_TLV_PDEV_SET_DSCP_TID_MAP_CMDID,
+        .pdev_set_quiet_mode_cmdid = WMI_TLV_PDEV_SET_QUIET_MODE_CMDID,
+        .pdev_green_ap_ps_enable_cmdid = WMI_TLV_PDEV_GREEN_AP_PS_ENABLE_CMDID,
+        .pdev_get_tpc_config_cmdid = WMI_TLV_PDEV_GET_TPC_CONFIG_CMDID,
+        .pdev_set_base_macaddr_cmdid = WMI_TLV_PDEV_SET_BASE_MACADDR_CMDID,
+        .vdev_create_cmdid = WMI_TLV_VDEV_CREATE_CMDID,
+        .vdev_delete_cmdid = WMI_TLV_VDEV_DELETE_CMDID,
+        .vdev_start_request_cmdid = WMI_TLV_VDEV_START_REQUEST_CMDID,
+        .vdev_restart_request_cmdid = WMI_TLV_VDEV_RESTART_REQUEST_CMDID,
+        .vdev_up_cmdid = WMI_TLV_VDEV_UP_CMDID,
+        .vdev_stop_cmdid = WMI_TLV_VDEV_STOP_CMDID,
+        .vdev_down_cmdid = WMI_TLV_VDEV_DOWN_CMDID,
+        .vdev_set_param_cmdid = WMI_TLV_VDEV_SET_PARAM_CMDID,
+        .vdev_install_key_cmdid = WMI_TLV_VDEV_INSTALL_KEY_CMDID,
+        .peer_create_cmdid = WMI_TLV_PEER_CREATE_CMDID,
+        .peer_delete_cmdid = WMI_TLV_PEER_DELETE_CMDID,
+        .peer_flush_tids_cmdid = WMI_TLV_PEER_FLUSH_TIDS_CMDID,
+        .peer_set_param_cmdid = WMI_TLV_PEER_SET_PARAM_CMDID,
+        .peer_assoc_cmdid = WMI_TLV_PEER_ASSOC_CMDID,
+        .peer_add_wds_entry_cmdid = WMI_TLV_PEER_ADD_WDS_ENTRY_CMDID,
+        .peer_remove_wds_entry_cmdid = WMI_TLV_PEER_REMOVE_WDS_ENTRY_CMDID,
+        .peer_mcast_group_cmdid = WMI_TLV_PEER_MCAST_GROUP_CMDID,
+        .bcn_tx_cmdid = WMI_TLV_BCN_TX_CMDID,
+        .pdev_send_bcn_cmdid = WMI_TLV_PDEV_SEND_BCN_CMDID,
+        .bcn_tmpl_cmdid = WMI_TLV_BCN_TMPL_CMDID,
+        .bcn_filter_rx_cmdid = WMI_TLV_BCN_FILTER_RX_CMDID,
+        .prb_req_filter_rx_cmdid = WMI_TLV_PRB_REQ_FILTER_RX_CMDID,
+        .mgmt_tx_cmdid = WMI_TLV_MGMT_TX_CMDID,
+        .prb_tmpl_cmdid = WMI_TLV_PRB_TMPL_CMDID,
+        .addba_clear_resp_cmdid = WMI_TLV_ADDBA_CLEAR_RESP_CMDID,
+        .addba_send_cmdid = WMI_TLV_ADDBA_SEND_CMDID,
+        .addba_status_cmdid = WMI_TLV_ADDBA_STATUS_CMDID,
+        .delba_send_cmdid = WMI_TLV_DELBA_SEND_CMDID,
+        .addba_set_resp_cmdid = WMI_TLV_ADDBA_SET_RESP_CMDID,
+        .send_singleamsdu_cmdid = WMI_TLV_SEND_SINGLEAMSDU_CMDID,
+        .sta_powersave_mode_cmdid = WMI_TLV_STA_POWERSAVE_MODE_CMDID,
+        .sta_powersave_param_cmdid = WMI_TLV_STA_POWERSAVE_PARAM_CMDID,
+        .sta_mimo_ps_mode_cmdid = WMI_TLV_STA_MIMO_PS_MODE_CMDID,
+        .pdev_dfs_enable_cmdid = WMI_TLV_PDEV_DFS_ENABLE_CMDID,
+        .pdev_dfs_disable_cmdid = WMI_TLV_PDEV_DFS_DISABLE_CMDID,
+        .roam_scan_mode = WMI_TLV_ROAM_SCAN_MODE,
+        .roam_scan_rssi_threshold = WMI_TLV_ROAM_SCAN_RSSI_THRESHOLD,
+        .roam_scan_period = WMI_TLV_ROAM_SCAN_PERIOD,
+        .roam_scan_rssi_change_threshold =
+                                WMI_TLV_ROAM_SCAN_RSSI_CHANGE_THRESHOLD,
+        .roam_ap_profile = WMI_TLV_ROAM_AP_PROFILE,
+        .ofl_scan_add_ap_profile = WMI_TLV_ROAM_AP_PROFILE,
+        .ofl_scan_remove_ap_profile = WMI_TLV_OFL_SCAN_REMOVE_AP_PROFILE,
+        .ofl_scan_period = WMI_TLV_OFL_SCAN_PERIOD,
+        .p2p_dev_set_device_info = WMI_TLV_P2P_DEV_SET_DEVICE_INFO,
+        .p2p_dev_set_discoverability = WMI_TLV_P2P_DEV_SET_DISCOVERABILITY,
+        .p2p_go_set_beacon_ie = WMI_TLV_P2P_GO_SET_BEACON_IE,
+        .p2p_go_set_probe_resp_ie = WMI_TLV_P2P_GO_SET_PROBE_RESP_IE,
+        .p2p_set_vendor_ie_data_cmdid = WMI_TLV_P2P_SET_VENDOR_IE_DATA_CMDID,
+        .ap_ps_peer_param_cmdid = WMI_TLV_AP_PS_PEER_PARAM_CMDID,
+        .ap_ps_peer_uapsd_coex_cmdid = WMI_TLV_AP_PS_PEER_UAPSD_COEX_CMDID,
+        .peer_rate_retry_sched_cmdid = WMI_TLV_PEER_RATE_RETRY_SCHED_CMDID,
+        .wlan_profile_trigger_cmdid = WMI_TLV_WLAN_PROFILE_TRIGGER_CMDID,
+        .wlan_profile_set_hist_intvl_cmdid =
+                                WMI_TLV_WLAN_PROFILE_SET_HIST_INTVL_CMDID,
+        .wlan_profile_get_profile_data_cmdid =
+                                WMI_TLV_WLAN_PROFILE_GET_PROFILE_DATA_CMDID,
+        .wlan_profile_enable_profile_id_cmdid =
+                                WMI_TLV_WLAN_PROFILE_ENABLE_PROFILE_ID_CMDID,
+        .wlan_profile_list_profile_id_cmdid =
+                                WMI_TLV_WLAN_PROFILE_LIST_PROFILE_ID_CMDID,
+        .pdev_suspend_cmdid = WMI_TLV_PDEV_SUSPEND_CMDID,
+        .pdev_resume_cmdid = WMI_TLV_PDEV_RESUME_CMDID,
+        .add_bcn_filter_cmdid = WMI_TLV_ADD_BCN_FILTER_CMDID,
+        .rmv_bcn_filter_cmdid = WMI_TLV_RMV_BCN_FILTER_CMDID,
+        .wow_add_wake_pattern_cmdid = WMI_TLV_WOW_ADD_WAKE_PATTERN_CMDID,
+        .wow_del_wake_pattern_cmdid = WMI_TLV_WOW_DEL_WAKE_PATTERN_CMDID,
+        .wow_enable_disable_wake_event_cmdid =
+                                WMI_TLV_WOW_ENABLE_DISABLE_WAKE_EVENT_CMDID,
+        .wow_enable_cmdid = WMI_TLV_WOW_ENABLE_CMDID,
+        .wow_hostwakeup_from_sleep_cmdid =
+                                WMI_TLV_WOW_HOSTWAKEUP_FROM_SLEEP_CMDID,
+        .rtt_measreq_cmdid = WMI_TLV_RTT_MEASREQ_CMDID,
+        .rtt_tsf_cmdid = WMI_TLV_RTT_TSF_CMDID,
+        .vdev_spectral_scan_configure_cmdid = WMI_TLV_SPECTRAL_SCAN_CONF_CMDID,
+        .vdev_spectral_scan_enable_cmdid = WMI_TLV_SPECTRAL_SCAN_ENABLE_CMDID,
+        .request_stats_cmdid = WMI_TLV_REQUEST_STATS_CMDID,
+        .set_arp_ns_offload_cmdid = WMI_TLV_SET_ARP_NS_OFFLOAD_CMDID,
+        .network_list_offload_config_cmdid =
+                                WMI_TLV_NETWORK_LIST_OFFLOAD_CONFIG_CMDID,
+        .gtk_offload_cmdid = WMI_TLV_GTK_OFFLOAD_CMDID,
+        .csa_offload_enable_cmdid = WMI_TLV_CSA_OFFLOAD_ENABLE_CMDID,
+        .csa_offload_chanswitch_cmdid = WMI_TLV_CSA_OFFLOAD_CHANSWITCH_CMDID,
+        .chatter_set_mode_cmdid = WMI_TLV_CHATTER_SET_MODE_CMDID,
+        .peer_tid_addba_cmdid = WMI_TLV_PEER_TID_ADDBA_CMDID,
+        .peer_tid_delba_cmdid = WMI_TLV_PEER_TID_DELBA_CMDID,
+        .sta_dtim_ps_method_cmdid = WMI_TLV_STA_DTIM_PS_METHOD_CMDID,
+        .sta_uapsd_auto_trig_cmdid = WMI_TLV_STA_UAPSD_AUTO_TRIG_CMDID,
+        .sta_keepalive_cmd = WMI_TLV_STA_KEEPALIVE_CMDID,
+        .echo_cmdid = WMI_TLV_ECHO_CMDID,
+        .pdev_utf_cmdid = WMI_TLV_PDEV_UTF_CMDID,
+        .dbglog_cfg_cmdid = WMI_TLV_DBGLOG_CFG_CMDID,
+        .pdev_qvit_cmdid = WMI_TLV_PDEV_QVIT_CMDID,
+        .pdev_ftm_intg_cmdid = WMI_TLV_PDEV_FTM_INTG_CMDID,
+        .vdev_set_keepalive_cmdid = WMI_TLV_VDEV_SET_KEEPALIVE_CMDID,
+        .vdev_get_keepalive_cmdid = WMI_TLV_VDEV_GET_KEEPALIVE_CMDID,
+        .force_fw_hang_cmdid = WMI_TLV_FORCE_FW_HANG_CMDID,
+        .gpio_config_cmdid = WMI_TLV_GPIO_CONFIG_CMDID,
+        .gpio_output_cmdid = WMI_TLV_GPIO_OUTPUT_CMDID,
+        .pdev_get_temperature_cmdid = WMI_TLV_CMD_UNSUPPORTED,
+        .vdev_set_wmm_params_cmdid = WMI_TLV_VDEV_SET_WMM_PARAMS_CMDID,
+};
+
+static struct wmi_pdev_param_map wmi_tlv_pdev_param_map = {
+        .tx_chain_mask = WMI_TLV_PDEV_PARAM_TX_CHAIN_MASK,
+        .rx_chain_mask = WMI_TLV_PDEV_PARAM_RX_CHAIN_MASK,
+        .txpower_limit2g = WMI_TLV_PDEV_PARAM_TXPOWER_LIMIT2G,
+        .txpower_limit5g = WMI_TLV_PDEV_PARAM_TXPOWER_LIMIT5G,
+        .txpower_scale = WMI_TLV_PDEV_PARAM_TXPOWER_SCALE,
+        .beacon_gen_mode = WMI_TLV_PDEV_PARAM_BEACON_GEN_MODE,
+        .beacon_tx_mode = WMI_TLV_PDEV_PARAM_BEACON_TX_MODE,
+        .resmgr_offchan_mode = WMI_TLV_PDEV_PARAM_RESMGR_OFFCHAN_MODE,
+        .protection_mode = WMI_TLV_PDEV_PARAM_PROTECTION_MODE,
+        .dynamic_bw = WMI_TLV_PDEV_PARAM_DYNAMIC_BW,
+        .non_agg_sw_retry_th = WMI_TLV_PDEV_PARAM_NON_AGG_SW_RETRY_TH,
+        .agg_sw_retry_th = WMI_TLV_PDEV_PARAM_AGG_SW_RETRY_TH,
+        .sta_kickout_th = WMI_TLV_PDEV_PARAM_STA_KICKOUT_TH,
+        .ac_aggrsize_scaling = WMI_TLV_PDEV_PARAM_AC_AGGRSIZE_SCALING,
+        .ltr_enable = WMI_TLV_PDEV_PARAM_LTR_ENABLE,
+        .ltr_ac_latency_be = WMI_TLV_PDEV_PARAM_LTR_AC_LATENCY_BE,
+        .ltr_ac_latency_bk = WMI_TLV_PDEV_PARAM_LTR_AC_LATENCY_BK,
+        .ltr_ac_latency_vi = WMI_TLV_PDEV_PARAM_LTR_AC_LATENCY_VI,
+        .ltr_ac_latency_vo = WMI_TLV_PDEV_PARAM_LTR_AC_LATENCY_VO,
+        .ltr_ac_latency_timeout = WMI_TLV_PDEV_PARAM_LTR_AC_LATENCY_TIMEOUT,
+        .ltr_sleep_override = WMI_TLV_PDEV_PARAM_LTR_SLEEP_OVERRIDE,
+        .ltr_rx_override = WMI_TLV_PDEV_PARAM_LTR_RX_OVERRIDE,
+        .ltr_tx_activity_timeout = WMI_TLV_PDEV_PARAM_LTR_TX_ACTIVITY_TIMEOUT,
+        .l1ss_enable = WMI_TLV_PDEV_PARAM_L1SS_ENABLE,
+        .dsleep_enable = WMI_TLV_PDEV_PARAM_DSLEEP_ENABLE,
+        .pcielp_txbuf_flush = WMI_TLV_PDEV_PARAM_PCIELP_TXBUF_FLUSH,
+        .pcielp_txbuf_watermark = WMI_TLV_PDEV_PARAM_PCIELP_TXBUF_TMO_EN,
+        .pcielp_txbuf_tmo_en = WMI_TLV_PDEV_PARAM_PCIELP_TXBUF_TMO_EN,
+        .pcielp_txbuf_tmo_value = WMI_TLV_PDEV_PARAM_PCIELP_TXBUF_TMO_VALUE,
+        .pdev_stats_update_period = WMI_TLV_PDEV_PARAM_PDEV_STATS_UPDATE_PERIOD,
+        .vdev_stats_update_period = WMI_TLV_PDEV_PARAM_VDEV_STATS_UPDATE_PERIOD,
+        .peer_stats_update_period = WMI_TLV_PDEV_PARAM_PEER_STATS_UPDATE_PERIOD,
+        .bcnflt_stats_update_period =
+                                WMI_TLV_PDEV_PARAM_BCNFLT_STATS_UPDATE_PERIOD,
+        .pmf_qos = WMI_TLV_PDEV_PARAM_PMF_QOS,
+        .arp_ac_override = WMI_TLV_PDEV_PARAM_ARP_AC_OVERRIDE,
+        .dcs = WMI_TLV_PDEV_PARAM_DCS,
+        .ani_enable = WMI_TLV_PDEV_PARAM_ANI_ENABLE,
+        .ani_poll_period = WMI_TLV_PDEV_PARAM_ANI_POLL_PERIOD,
+        .ani_listen_period = WMI_TLV_PDEV_PARAM_ANI_LISTEN_PERIOD,
+        .ani_ofdm_level = WMI_TLV_PDEV_PARAM_ANI_OFDM_LEVEL,
+        .ani_cck_level = WMI_TLV_PDEV_PARAM_ANI_CCK_LEVEL,
+        .dyntxchain = WMI_TLV_PDEV_PARAM_DYNTXCHAIN,
+        .proxy_sta = WMI_TLV_PDEV_PARAM_PROXY_STA,
+        .idle_ps_config = WMI_TLV_PDEV_PARAM_IDLE_PS_CONFIG,
+        .power_gating_sleep = WMI_TLV_PDEV_PARAM_POWER_GATING_SLEEP,
+        .fast_channel_reset = WMI_TLV_PDEV_PARAM_UNSUPPORTED,
+        .burst_dur = WMI_TLV_PDEV_PARAM_BURST_DUR,
+        .burst_enable = WMI_TLV_PDEV_PARAM_BURST_ENABLE,
+        .cal_period = WMI_PDEV_PARAM_UNSUPPORTED,
+};
+
+static struct wmi_vdev_param_map wmi_tlv_vdev_param_map = {
+        .rts_threshold = WMI_TLV_VDEV_PARAM_RTS_THRESHOLD,
+        .fragmentation_threshold = WMI_TLV_VDEV_PARAM_FRAGMENTATION_THRESHOLD,
+        .beacon_interval = WMI_TLV_VDEV_PARAM_BEACON_INTERVAL,
+        .listen_interval = WMI_TLV_VDEV_PARAM_LISTEN_INTERVAL,
+        .multicast_rate = WMI_TLV_VDEV_PARAM_MULTICAST_RATE,
+        .mgmt_tx_rate = WMI_TLV_VDEV_PARAM_MGMT_TX_RATE,
+        .slot_time = WMI_TLV_VDEV_PARAM_SLOT_TIME,
+        .preamble = WMI_TLV_VDEV_PARAM_PREAMBLE,
+        .swba_time = WMI_TLV_VDEV_PARAM_SWBA_TIME,
+        .wmi_vdev_stats_update_period = WMI_TLV_VDEV_STATS_UPDATE_PERIOD,
+        .wmi_vdev_pwrsave_ageout_time = WMI_TLV_VDEV_PWRSAVE_AGEOUT_TIME,
+        .wmi_vdev_host_swba_interval = WMI_TLV_VDEV_HOST_SWBA_INTERVAL,
+        .dtim_period = WMI_TLV_VDEV_PARAM_DTIM_PERIOD,
+        .wmi_vdev_oc_scheduler_air_time_limit =
+                                WMI_TLV_VDEV_OC_SCHEDULER_AIR_TIME_LIMIT,
+        .wds = WMI_TLV_VDEV_PARAM_WDS,
+        .atim_window = WMI_TLV_VDEV_PARAM_ATIM_WINDOW,
+        .bmiss_count_max = WMI_TLV_VDEV_PARAM_BMISS_COUNT_MAX,
+        .bmiss_first_bcnt = WMI_TLV_VDEV_PARAM_BMISS_FIRST_BCNT,
+        .bmiss_final_bcnt = WMI_TLV_VDEV_PARAM_BMISS_FINAL_BCNT,
+        .feature_wmm = WMI_TLV_VDEV_PARAM_FEATURE_WMM,
+        .chwidth = WMI_TLV_VDEV_PARAM_CHWIDTH,
+        .chextoffset = WMI_TLV_VDEV_PARAM_CHEXTOFFSET,
+        .disable_htprotection = WMI_TLV_VDEV_PARAM_DISABLE_HTPROTECTION,
+        .sta_quickkickout = WMI_TLV_VDEV_PARAM_STA_QUICKKICKOUT,
+        .mgmt_rate = WMI_TLV_VDEV_PARAM_MGMT_RATE,
+        .protection_mode = WMI_TLV_VDEV_PARAM_PROTECTION_MODE,
+        .fixed_rate = WMI_TLV_VDEV_PARAM_FIXED_RATE,
+        .sgi = WMI_TLV_VDEV_PARAM_SGI,
+        .ldpc = WMI_TLV_VDEV_PARAM_LDPC,
+        .tx_stbc = WMI_TLV_VDEV_PARAM_TX_STBC,
+        .rx_stbc = WMI_TLV_VDEV_PARAM_RX_STBC,
+        .intra_bss_fwd = WMI_TLV_VDEV_PARAM_INTRA_BSS_FWD,
+        .def_keyid = WMI_TLV_VDEV_PARAM_DEF_KEYID,
+        .nss = WMI_TLV_VDEV_PARAM_NSS,
+        .bcast_data_rate = WMI_TLV_VDEV_PARAM_BCAST_DATA_RATE,
+        .mcast_data_rate = WMI_TLV_VDEV_PARAM_MCAST_DATA_RATE,
+        .mcast_indicate = WMI_TLV_VDEV_PARAM_MCAST_INDICATE,
+        .dhcp_indicate = WMI_TLV_VDEV_PARAM_DHCP_INDICATE,
+        .unknown_dest_indicate = WMI_TLV_VDEV_PARAM_UNKNOWN_DEST_INDICATE,
+        .ap_keepalive_min_idle_inactive_time_secs =
+                WMI_TLV_VDEV_PARAM_AP_KEEPALIVE_MIN_IDLE_INACTIVE_TIME_SECS,
+        .ap_keepalive_max_idle_inactive_time_secs =
+                WMI_TLV_VDEV_PARAM_AP_KEEPALIVE_MAX_IDLE_INACTIVE_TIME_SECS,
+        .ap_keepalive_max_unresponsive_time_secs =
+                WMI_TLV_VDEV_PARAM_AP_KEEPALIVE_MAX_UNRESPONSIVE_TIME_SECS,
+        .ap_enable_nawds = WMI_TLV_VDEV_PARAM_AP_ENABLE_NAWDS,
+        .mcast2ucast_set = WMI_TLV_VDEV_PARAM_UNSUPPORTED,
+        .enable_rtscts = WMI_TLV_VDEV_PARAM_ENABLE_RTSCTS,
+        .txbf = WMI_TLV_VDEV_PARAM_TXBF,
+        .packet_powersave = WMI_TLV_VDEV_PARAM_PACKET_POWERSAVE,
+        .drop_unencry = WMI_TLV_VDEV_PARAM_DROP_UNENCRY,
+        .tx_encap_type = WMI_TLV_VDEV_PARAM_TX_ENCAP_TYPE,
+        .ap_detect_out_of_sync_sleeping_sta_time_secs =
+                                        WMI_TLV_VDEV_PARAM_UNSUPPORTED,
+};
+
+static const struct wmi_ops wmi_tlv_ops = {
+        .rx = ath10k_wmi_tlv_op_rx,
+        .map_svc = wmi_tlv_svc_map,
+
+        .pull_scan = ath10k_wmi_tlv_op_pull_scan_ev,
+        .pull_mgmt_rx = ath10k_wmi_tlv_op_pull_mgmt_rx_ev,
+        .pull_ch_info = ath10k_wmi_tlv_op_pull_ch_info_ev,
+        .pull_vdev_start = ath10k_wmi_tlv_op_pull_vdev_start_ev,
+        .pull_peer_kick = ath10k_wmi_tlv_op_pull_peer_kick_ev,
+        .pull_swba = ath10k_wmi_tlv_op_pull_swba_ev,
+        .pull_phyerr = ath10k_wmi_tlv_op_pull_phyerr_ev,
+        .pull_svc_rdy = ath10k_wmi_tlv_op_pull_svc_rdy_ev,
+        .pull_rdy = ath10k_wmi_tlv_op_pull_rdy_ev,
+        .pull_fw_stats = ath10k_wmi_tlv_op_pull_fw_stats,
+
+        .gen_pdev_suspend = ath10k_wmi_tlv_op_gen_pdev_suspend,
+        .gen_pdev_resume = ath10k_wmi_tlv_op_gen_pdev_resume,
+        .gen_pdev_set_rd = ath10k_wmi_tlv_op_gen_pdev_set_rd,
+        .gen_pdev_set_param = ath10k_wmi_tlv_op_gen_pdev_set_param,
+        .gen_init = ath10k_wmi_tlv_op_gen_init,
+        .gen_start_scan = ath10k_wmi_tlv_op_gen_start_scan,
+        .gen_stop_scan = ath10k_wmi_tlv_op_gen_stop_scan,
+        .gen_vdev_create = ath10k_wmi_tlv_op_gen_vdev_create,
+        .gen_vdev_delete = ath10k_wmi_tlv_op_gen_vdev_delete,
+        .gen_vdev_start = ath10k_wmi_tlv_op_gen_vdev_start,
+        .gen_vdev_stop = ath10k_wmi_tlv_op_gen_vdev_stop,
+        .gen_vdev_up = ath10k_wmi_tlv_op_gen_vdev_up,
+        .gen_vdev_down = ath10k_wmi_tlv_op_gen_vdev_down,
+        .gen_vdev_set_param = ath10k_wmi_tlv_op_gen_vdev_set_param,
+        .gen_vdev_install_key = ath10k_wmi_tlv_op_gen_vdev_install_key,
+        .gen_vdev_wmm_conf = ath10k_wmi_tlv_op_gen_vdev_wmm_conf,
+        .gen_peer_create = ath10k_wmi_tlv_op_gen_peer_create,
+        .gen_peer_delete = ath10k_wmi_tlv_op_gen_peer_delete,
+        .gen_peer_flush = ath10k_wmi_tlv_op_gen_peer_flush,
+        .gen_peer_set_param = ath10k_wmi_tlv_op_gen_peer_set_param,
+        .gen_peer_assoc = ath10k_wmi_tlv_op_gen_peer_assoc,
+        .gen_set_psmode = ath10k_wmi_tlv_op_gen_set_psmode,
+        .gen_set_sta_ps = ath10k_wmi_tlv_op_gen_set_sta_ps,
+        .gen_set_ap_ps = ath10k_wmi_tlv_op_gen_set_ap_ps,
+        .gen_scan_chan_list = ath10k_wmi_tlv_op_gen_scan_chan_list,
+        .gen_beacon_dma = ath10k_wmi_tlv_op_gen_beacon_dma,
+        .gen_pdev_set_wmm = ath10k_wmi_tlv_op_gen_pdev_set_wmm,
+        .gen_request_stats = ath10k_wmi_tlv_op_gen_request_stats,
+        .gen_force_fw_hang = ath10k_wmi_tlv_op_gen_force_fw_hang,
+        /* .gen_mgmt_tx = not implemented; HTT is used */
+        .gen_dbglog_cfg = ath10k_wmi_tlv_op_gen_dbglog_cfg,
+        .gen_pktlog_enable = ath10k_wmi_tlv_op_gen_pktlog_enable,
+        .gen_pktlog_disable = ath10k_wmi_tlv_op_gen_pktlog_disable,
+        /* .gen_pdev_set_quiet_mode not implemented */
+        /* .gen_pdev_get_temperature not implemented */
+        /* .gen_addba_clear_resp not implemented */
+        /* .gen_addba_send not implemented */
+        /* .gen_addba_set_resp not implemented */
+        /* .gen_delba_send not implemented */
+        .gen_bcn_tmpl = ath10k_wmi_tlv_op_gen_bcn_tmpl,
+        .gen_prb_tmpl = ath10k_wmi_tlv_op_gen_prb_tmpl,
+        .gen_p2p_go_bcn_ie = ath10k_wmi_tlv_op_gen_p2p_go_bcn_ie,
+        .gen_vdev_sta_uapsd = ath10k_wmi_tlv_op_gen_vdev_sta_uapsd,
+        .gen_sta_keepalive = ath10k_wmi_tlv_op_gen_sta_keepalive,
+};
+
+/************/
+/* TLV init */
+/************/
+
+void ath10k_wmi_tlv_attach(struct ath10k *ar)
+{
+        ar->wmi.cmd = &wmi_tlv_cmd_map;
+        ar->wmi.vdev_param = &wmi_tlv_vdev_param_map;
+        ar->wmi.pdev_param = &wmi_tlv_pdev_param_map;
+        ar->wmi.ops = &wmi_tlv_ops;
+}
diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.h b/drivers/net/wireless/ath/ath10k/wmi-tlv.h
new file mode 100644
index 000000000000..de68fe76eae6
--- /dev/null
+++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.h
@@ -0,0 +1,1444 @@
+/*
+ * Copyright (c) 2005-2011 Atheros Communications Inc.
+ * Copyright (c) 2011-2014 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#ifndef _WMI_TLV_H
+#define _WMI_TLV_H
+
+#define WMI_TLV_CMD(grp_id) (((grp_id) << 12) | 0x1)
+#define WMI_TLV_EV(grp_id) (((grp_id) << 12) | 0x1)
+#define WMI_TLV_CMD_UNSUPPORTED 0
+#define WMI_TLV_PDEV_PARAM_UNSUPPORTED 0
+#define WMI_TLV_VDEV_PARAM_UNSUPPORTED 0
+
+enum wmi_tlv_grp_id {
+        WMI_TLV_GRP_START = 0x3,
+        WMI_TLV_GRP_SCAN = WMI_TLV_GRP_START,
+        WMI_TLV_GRP_PDEV,
+        WMI_TLV_GRP_VDEV,
+        WMI_TLV_GRP_PEER,
+        WMI_TLV_GRP_MGMT,
+        WMI_TLV_GRP_BA_NEG,
+        WMI_TLV_GRP_STA_PS,
+        WMI_TLV_GRP_DFS,
+        WMI_TLV_GRP_ROAM,
+        WMI_TLV_GRP_OFL_SCAN,
+        WMI_TLV_GRP_P2P,
+        WMI_TLV_GRP_AP_PS,
+        WMI_TLV_GRP_RATECTL,
+        WMI_TLV_GRP_PROFILE,
+        WMI_TLV_GRP_SUSPEND,
+        WMI_TLV_GRP_BCN_FILTER,
+        WMI_TLV_GRP_WOW,
+        WMI_TLV_GRP_RTT,
+        WMI_TLV_GRP_SPECTRAL,
+        WMI_TLV_GRP_STATS,
+        WMI_TLV_GRP_ARP_NS_OFL,
+        WMI_TLV_GRP_NLO_OFL,
+        WMI_TLV_GRP_GTK_OFL,
+        WMI_TLV_GRP_CSA_OFL,
+        WMI_TLV_GRP_CHATTER,
+        WMI_TLV_GRP_TID_ADDBA,
+        WMI_TLV_GRP_MISC,
+        WMI_TLV_GRP_GPIO,
+        WMI_TLV_GRP_FWTEST,
+        WMI_TLV_GRP_TDLS,
+        WMI_TLV_GRP_RESMGR,
+        WMI_TLV_GRP_STA_SMPS,
+        WMI_TLV_GRP_WLAN_HB,
+        WMI_TLV_GRP_RMC,
+        WMI_TLV_GRP_MHF_OFL,
+        WMI_TLV_GRP_LOCATION_SCAN,
+        WMI_TLV_GRP_OEM,
+        WMI_TLV_GRP_NAN,
+        WMI_TLV_GRP_COEX,
+        WMI_TLV_GRP_OBSS_OFL,
+        WMI_TLV_GRP_LPI,
+        WMI_TLV_GRP_EXTSCAN,
+        WMI_TLV_GRP_DHCP_OFL,
+        WMI_TLV_GRP_IPA,
+        WMI_TLV_GRP_MDNS_OFL,
+        WMI_TLV_GRP_SAP_OFL,
+};
+
+enum wmi_tlv_cmd_id {
+        WMI_TLV_INIT_CMDID = 0x1,
+        WMI_TLV_START_SCAN_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_SCAN),
+        WMI_TLV_STOP_SCAN_CMDID,
+        WMI_TLV_SCAN_CHAN_LIST_CMDID,
+        WMI_TLV_SCAN_SCH_PRIO_TBL_CMDID,
+        WMI_TLV_SCAN_UPDATE_REQUEST_CMDID,
+        WMI_TLV_SCAN_PROB_REQ_OUI_CMDID,
+        WMI_TLV_PDEV_SET_REGDOMAIN_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_PDEV),
+        WMI_TLV_PDEV_SET_CHANNEL_CMDID,
+        WMI_TLV_PDEV_SET_PARAM_CMDID,
+        WMI_TLV_PDEV_PKTLOG_ENABLE_CMDID,
+        WMI_TLV_PDEV_PKTLOG_DISABLE_CMDID,
+        WMI_TLV_PDEV_SET_WMM_PARAMS_CMDID,
+        WMI_TLV_PDEV_SET_HT_CAP_IE_CMDID,
+        WMI_TLV_PDEV_SET_VHT_CAP_IE_CMDID,
+        WMI_TLV_PDEV_SET_DSCP_TID_MAP_CMDID,
+        WMI_TLV_PDEV_SET_QUIET_MODE_CMDID,
+        WMI_TLV_PDEV_GREEN_AP_PS_ENABLE_CMDID,
+        WMI_TLV_PDEV_GET_TPC_CONFIG_CMDID,
+        WMI_TLV_PDEV_SET_BASE_MACADDR_CMDID,
+        WMI_TLV_PDEV_DUMP_CMDID,
+        WMI_TLV_PDEV_SET_LED_CONFIG_CMDID,
+        WMI_TLV_PDEV_GET_TEMPERATURE_CMDID,
+        WMI_TLV_PDEV_SET_LED_FLASHING_CMDID,
+        WMI_TLV_VDEV_CREATE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_VDEV),
+        WMI_TLV_VDEV_DELETE_CMDID,
+        WMI_TLV_VDEV_START_REQUEST_CMDID,
+        WMI_TLV_VDEV_RESTART_REQUEST_CMDID,
+        WMI_TLV_VDEV_UP_CMDID,
+        WMI_TLV_VDEV_STOP_CMDID,
+        WMI_TLV_VDEV_DOWN_CMDID,
+        WMI_TLV_VDEV_SET_PARAM_CMDID,
+        WMI_TLV_VDEV_INSTALL_KEY_CMDID,
+        WMI_TLV_VDEV_WNM_SLEEPMODE_CMDID,
+        WMI_TLV_VDEV_WMM_ADDTS_CMDID,
+        WMI_TLV_VDEV_WMM_DELTS_CMDID,
+        WMI_TLV_VDEV_SET_WMM_PARAMS_CMDID,
+        WMI_TLV_VDEV_SET_GTX_PARAMS_CMDID,
+        WMI_TLV_VDEV_IPSEC_NATKEEPALIVE_FILTER_CMDID,
+        WMI_TLV_VDEV_PLMREQ_START_CMDID,
+        WMI_TLV_VDEV_PLMREQ_STOP_CMDID,
+        WMI_TLV_PEER_CREATE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_PEER),
+        WMI_TLV_PEER_DELETE_CMDID,
+        WMI_TLV_PEER_FLUSH_TIDS_CMDID,
+        WMI_TLV_PEER_SET_PARAM_CMDID,
+        WMI_TLV_PEER_ASSOC_CMDID,
+        WMI_TLV_PEER_ADD_WDS_ENTRY_CMDID,
+        WMI_TLV_PEER_REMOVE_WDS_ENTRY_CMDID,
+        WMI_TLV_PEER_MCAST_GROUP_CMDID,
+        WMI_TLV_PEER_INFO_REQ_CMDID,
+        WMI_TLV_PEER_GET_ESTIMATED_LINKSPEED_CMDID,
+        WMI_TLV_BCN_TX_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_MGMT),
+        WMI_TLV_PDEV_SEND_BCN_CMDID,
+        WMI_TLV_BCN_TMPL_CMDID,
+        WMI_TLV_BCN_FILTER_RX_CMDID,
+        WMI_TLV_PRB_REQ_FILTER_RX_CMDID,
+        WMI_TLV_MGMT_TX_CMDID,
+        WMI_TLV_PRB_TMPL_CMDID,
+        WMI_TLV_ADDBA_CLEAR_RESP_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_BA_NEG),
+        WMI_TLV_ADDBA_SEND_CMDID,
+        WMI_TLV_ADDBA_STATUS_CMDID,
+        WMI_TLV_DELBA_SEND_CMDID,
+        WMI_TLV_ADDBA_SET_RESP_CMDID,
+        WMI_TLV_SEND_SINGLEAMSDU_CMDID,
+        WMI_TLV_STA_POWERSAVE_MODE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_STA_PS),
+        WMI_TLV_STA_POWERSAVE_PARAM_CMDID,
+        WMI_TLV_STA_MIMO_PS_MODE_CMDID,
+        WMI_TLV_PDEV_DFS_ENABLE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_DFS),
+        WMI_TLV_PDEV_DFS_DISABLE_CMDID,
+        WMI_TLV_DFS_PHYERR_FILTER_ENA_CMDID,
+        WMI_TLV_DFS_PHYERR_FILTER_DIS_CMDID,
+        WMI_TLV_ROAM_SCAN_MODE = WMI_TLV_CMD(WMI_TLV_GRP_ROAM),
+        WMI_TLV_ROAM_SCAN_RSSI_THRESHOLD,
+        WMI_TLV_ROAM_SCAN_PERIOD,
+        WMI_TLV_ROAM_SCAN_RSSI_CHANGE_THRESHOLD,
+        WMI_TLV_ROAM_AP_PROFILE,
+        WMI_TLV_ROAM_CHAN_LIST,
+        WMI_TLV_ROAM_SCAN_CMD,
+        WMI_TLV_ROAM_SYNCH_COMPLETE,
+        WMI_TLV_ROAM_SET_RIC_REQUEST_CMDID,
+        WMI_TLV_ROAM_INVOKE_CMDID,
+        WMI_TLV_OFL_SCAN_ADD_AP_PROFILE = WMI_TLV_CMD(WMI_TLV_GRP_OFL_SCAN),
+        WMI_TLV_OFL_SCAN_REMOVE_AP_PROFILE,
+        WMI_TLV_OFL_SCAN_PERIOD,
+        WMI_TLV_P2P_DEV_SET_DEVICE_INFO = WMI_TLV_CMD(WMI_TLV_GRP_P2P),
+        WMI_TLV_P2P_DEV_SET_DISCOVERABILITY,
+        WMI_TLV_P2P_GO_SET_BEACON_IE,
+        WMI_TLV_P2P_GO_SET_PROBE_RESP_IE,
+        WMI_TLV_P2P_SET_VENDOR_IE_DATA_CMDID,
+        WMI_TLV_P2P_DISC_OFFLOAD_CONFIG_CMDID,
+        WMI_TLV_P2P_DISC_OFFLOAD_APPIE_CMDID,
+        WMI_TLV_P2P_DISC_OFFLOAD_PATTERN_CMDID,
+        WMI_TLV_P2P_SET_OPPPS_PARAM_CMDID,
+        WMI_TLV_AP_PS_PEER_PARAM_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_AP_PS),
+        WMI_TLV_AP_PS_PEER_UAPSD_COEX_CMDID,
+        WMI_TLV_PEER_RATE_RETRY_SCHED_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_RATECTL),
+        WMI_TLV_WLAN_PROFILE_TRIGGER_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_PROFILE),
+        WMI_TLV_WLAN_PROFILE_SET_HIST_INTVL_CMDID,
+        WMI_TLV_WLAN_PROFILE_GET_PROFILE_DATA_CMDID,
+        WMI_TLV_WLAN_PROFILE_ENABLE_PROFILE_ID_CMDID,
+        WMI_TLV_WLAN_PROFILE_LIST_PROFILE_ID_CMDID,
+        WMI_TLV_PDEV_SUSPEND_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_SUSPEND),
+        WMI_TLV_PDEV_RESUME_CMDID,
+        WMI_TLV_ADD_BCN_FILTER_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_BCN_FILTER),
+        WMI_TLV_RMV_BCN_FILTER_CMDID,
+        WMI_TLV_WOW_ADD_WAKE_PATTERN_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_WOW),
+        WMI_TLV_WOW_DEL_WAKE_PATTERN_CMDID,
+        WMI_TLV_WOW_ENABLE_DISABLE_WAKE_EVENT_CMDID,
+        WMI_TLV_WOW_ENABLE_CMDID,
+        WMI_TLV_WOW_HOSTWAKEUP_FROM_SLEEP_CMDID,
+        WMI_TLV_WOW_ACER_IOAC_ADD_KEEPALIVE_CMDID,
+        WMI_TLV_WOW_ACER_IOAC_DEL_KEEPALIVE_CMDID,
+        WMI_TLV_WOW_ACER_IOAC_ADD_WAKE_PATTERN_CMDID,
+        WMI_TLV_WOW_ACER_IOAC_DEL_WAKE_PATTERN_CMDID,
+        WMI_TLV_D0_WOW_ENABLE_DISABLE_CMDID,
+        WMI_TLV_EXTWOW_ENABLE_CMDID,
+        WMI_TLV_EXTWOW_SET_APP_TYPE1_PARAMS_CMDID,
+        WMI_TLV_EXTWOW_SET_APP_TYPE2_PARAMS_CMDID,
+        WMI_TLV_RTT_MEASREQ_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_RTT),
+        WMI_TLV_RTT_TSF_CMDID,
+        WMI_TLV_SPECTRAL_SCAN_CONF_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_SPECTRAL),
+        WMI_TLV_SPECTRAL_SCAN_ENABLE_CMDID,
+        WMI_TLV_REQUEST_STATS_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_STATS),
+        WMI_TLV_MCC_SCHED_TRAFFIC_STATS_CMDID,
+        WMI_TLV_REQUEST_STATS_EXT_CMDID,
+        WMI_TLV_REQUEST_LINK_STATS_CMDID,
+        WMI_TLV_START_LINK_STATS_CMDID,
+        WMI_TLV_CLEAR_LINK_STATS_CMDID,
+        WMI_TLV_SET_ARP_NS_OFFLOAD_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_ARP_NS_OFL),
+        WMI_TLV_ADD_PROACTIVE_ARP_RSP_PATTERN_CMDID,
+        WMI_TLV_DEL_PROACTIVE_ARP_RSP_PATTERN_CMDID,
+        WMI_TLV_NETWORK_LIST_OFFLOAD_CONFIG_CMDID =
+                        WMI_TLV_CMD(WMI_TLV_GRP_NLO_OFL),
+        WMI_TLV_APFIND_CMDID,
+        WMI_TLV_GTK_OFFLOAD_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_GTK_OFL),
+        WMI_TLV_CSA_OFFLOAD_ENABLE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_CSA_OFL),
+        WMI_TLV_CSA_OFFLOAD_CHANSWITCH_CMDID,
+        WMI_TLV_CHATTER_SET_MODE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_CHATTER),
+        WMI_TLV_CHATTER_ADD_COALESCING_FILTER_CMDID,
+        WMI_TLV_CHATTER_DELETE_COALESCING_FILTER_CMDID,
+        WMI_TLV_CHATTER_COALESCING_QUERY_CMDID,
+        WMI_TLV_PEER_TID_ADDBA_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_TID_ADDBA),
+        WMI_TLV_PEER_TID_DELBA_CMDID,
+        WMI_TLV_STA_DTIM_PS_METHOD_CMDID,
+        WMI_TLV_STA_UAPSD_AUTO_TRIG_CMDID,
+        WMI_TLV_STA_KEEPALIVE_CMDID,
+        WMI_TLV_BA_REQ_SSN_CMDID,
+        WMI_TLV_ECHO_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_MISC),
+        WMI_TLV_PDEV_UTF_CMDID,
+        WMI_TLV_DBGLOG_CFG_CMDID,
+        WMI_TLV_PDEV_QVIT_CMDID,
+        WMI_TLV_PDEV_FTM_INTG_CMDID,
+        WMI_TLV_VDEV_SET_KEEPALIVE_CMDID,
+        WMI_TLV_VDEV_GET_KEEPALIVE_CMDID,
+        WMI_TLV_FORCE_FW_HANG_CMDID,
+        WMI_TLV_SET_MCASTBCAST_FILTER_CMDID,
+        WMI_TLV_THERMAL_MGMT_CMDID,
+        WMI_TLV_HOST_AUTO_SHUTDOWN_CFG_CMDID,
+        WMI_TLV_TPC_CHAINMASK_CONFIG_CMDID,
+        WMI_TLV_SET_ANTENNA_DIVERSITY_CMDID,
+        WMI_TLV_GPIO_CONFIG_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_GPIO),
+        WMI_TLV_GPIO_OUTPUT_CMDID,
+        WMI_TLV_TXBF_CMDID,
+        WMI_TLV_FWTEST_VDEV_MCC_SET_TBTT_MODE_CMDID =
+                        WMI_TLV_CMD(WMI_TLV_GRP_FWTEST),
+        WMI_TLV_FWTEST_P2P_SET_NOA_PARAM_CMDID,
+        WMI_TLV_UNIT_TEST_CMDID,
+        WMI_TLV_TDLS_SET_STATE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_TDLS),
+        WMI_TLV_TDLS_PEER_UPDATE_CMDID,
+        WMI_TLV_TDLS_SET_OFFCHAN_MODE_CMDID,
+        WMI_TLV_RESMGR_ADAPTIVE_OCS_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_RESMGR),
+        WMI_TLV_RESMGR_SET_CHAN_TIME_QUOTA_CMDID,
+        WMI_TLV_RESMGR_SET_CHAN_LATENCY_CMDID,
+        WMI_TLV_STA_SMPS_FORCE_MODE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_STA_SMPS),
+        WMI_TLV_STA_SMPS_PARAM_CMDID,
+        WMI_TLV_HB_SET_ENABLE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_WLAN_HB),
+        WMI_TLV_HB_SET_TCP_PARAMS_CMDID,
+        WMI_TLV_HB_SET_TCP_PKT_FILTER_CMDID,
+        WMI_TLV_HB_SET_UDP_PARAMS_CMDID,
+        WMI_TLV_HB_SET_UDP_PKT_FILTER_CMDID,
+        WMI_TLV_RMC_SET_MODE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_RMC),
+        WMI_TLV_RMC_SET_ACTION_PERIOD_CMDID,
+        WMI_TLV_RMC_CONFIG_CMDID,
+        WMI_TLV_MHF_OFFLOAD_SET_MODE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_MHF_OFL),
+        WMI_TLV_MHF_OFFLOAD_PLUMB_ROUTING_TBL_CMDID,
+        WMI_TLV_BATCH_SCAN_ENABLE_CMDID =
+                        WMI_TLV_CMD(WMI_TLV_GRP_LOCATION_SCAN),
+        WMI_TLV_BATCH_SCAN_DISABLE_CMDID,
+        WMI_TLV_BATCH_SCAN_TRIGGER_RESULT_CMDID,
+        WMI_TLV_OEM_REQ_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_OEM),
+        WMI_TLV_NAN_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_NAN),
+        WMI_TLV_MODEM_POWER_STATE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_COEX),
+        WMI_TLV_CHAN_AVOID_UPDATE_CMDID,
+        WMI_TLV_OBSS_SCAN_ENABLE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_OBSS_OFL),
+        WMI_TLV_OBSS_SCAN_DISABLE_CMDID,
+        WMI_TLV_LPI_MGMT_SNOOPING_CONFIG_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_LPI),
+        WMI_TLV_LPI_START_SCAN_CMDID,
+        WMI_TLV_LPI_STOP_SCAN_CMDID,
+        WMI_TLV_EXTSCAN_START_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_EXTSCAN),
+        WMI_TLV_EXTSCAN_STOP_CMDID,
+        WMI_TLV_EXTSCAN_CONFIGURE_WLAN_CHANGE_MONITOR_CMDID,
+        WMI_TLV_EXTSCAN_CONFIGURE_HOTLIST_MONITOR_CMDID,
+        WMI_TLV_EXTSCAN_GET_CACHED_RESULTS_CMDID,
+        WMI_TLV_EXTSCAN_GET_WLAN_CHANGE_RESULTS_CMDID,
+        WMI_TLV_EXTSCAN_SET_CAPABILITIES_CMDID,
+        WMI_TLV_EXTSCAN_GET_CAPABILITIES_CMDID,
+        WMI_TLV_SET_DHCP_SERVER_OFFLOAD_CMDID =
+                        WMI_TLV_CMD(WMI_TLV_GRP_DHCP_OFL),
+        WMI_TLV_IPA_OFFLOAD_ENABLE_DISABLE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_IPA),
+        WMI_TLV_MDNS_OFFLOAD_ENABLE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_MDNS_OFL),
+        WMI_TLV_MDNS_SET_FQDN_CMDID,
+        WMI_TLV_MDNS_SET_RESPONSE_CMDID,
+        WMI_TLV_MDNS_GET_STATS_CMDID,
+        WMI_TLV_SAP_OFL_ENABLE_CMDID = WMI_TLV_CMD(WMI_TLV_GRP_SAP_OFL),
+};
+
+enum wmi_tlv_event_id {
+        WMI_TLV_SERVICE_READY_EVENTID = 0x1,
+        WMI_TLV_READY_EVENTID,
+        WMI_TLV_SCAN_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_SCAN),
+        WMI_TLV_PDEV_TPC_CONFIG_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_PDEV),
+        WMI_TLV_CHAN_INFO_EVENTID,
+        WMI_TLV_PHYERR_EVENTID,
+        WMI_TLV_PDEV_DUMP_EVENTID,
+        WMI_TLV_TX_PAUSE_EVENTID,
+        WMI_TLV_DFS_RADAR_EVENTID,
+        WMI_TLV_PDEV_L1SS_TRACK_EVENTID,
+        WMI_TLV_PDEV_TEMPERATURE_EVENTID,
+        WMI_TLV_VDEV_START_RESP_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_VDEV),
+        WMI_TLV_VDEV_STOPPED_EVENTID,
+        WMI_TLV_VDEV_INSTALL_KEY_COMPLETE_EVENTID,
+        WMI_TLV_VDEV_MCC_BCN_INTERVAL_CHANGE_REQ_EVENTID,
+        WMI_TLV_PEER_STA_KICKOUT_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_PEER),
+        WMI_TLV_PEER_INFO_EVENTID,
+        WMI_TLV_PEER_TX_FAIL_CNT_THR_EVENTID,
+        WMI_TLV_PEER_ESTIMATED_LINKSPEED_EVENTID,
+        WMI_TLV_PEER_STATE_EVENTID,
+        WMI_TLV_MGMT_RX_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_MGMT),
+        WMI_TLV_HOST_SWBA_EVENTID,
+        WMI_TLV_TBTTOFFSET_UPDATE_EVENTID,
+        WMI_TLV_OFFLOAD_BCN_TX_STATUS_EVENTID,
+        WMI_TLV_OFFLOAD_PROB_RESP_TX_STATUS_EVENTID,
+        WMI_TLV_TX_DELBA_COMPLETE_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_BA_NEG),
+        WMI_TLV_TX_ADDBA_COMPLETE_EVENTID,
+        WMI_TLV_BA_RSP_SSN_EVENTID,
+        WMI_TLV_AGGR_STATE_TRIG_EVENTID,
+        WMI_TLV_ROAM_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_ROAM),
+        WMI_TLV_PROFILE_MATCH,
+        WMI_TLV_ROAM_SYNCH_EVENTID,
+        WMI_TLV_P2P_DISC_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_P2P),
+        WMI_TLV_P2P_NOA_EVENTID,
+        WMI_TLV_PDEV_RESUME_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_SUSPEND),
+        WMI_TLV_WOW_WAKEUP_HOST_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_WOW),
+        WMI_TLV_D0_WOW_DISABLE_ACK_EVENTID,
+        WMI_TLV_RTT_MEASUREMENT_REPORT_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_RTT),
+        WMI_TLV_TSF_MEASUREMENT_REPORT_EVENTID,
+        WMI_TLV_RTT_ERROR_REPORT_EVENTID,
+        WMI_TLV_STATS_EXT_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_STATS),
+        WMI_TLV_IFACE_LINK_STATS_EVENTID,
+        WMI_TLV_PEER_LINK_STATS_EVENTID,
+        WMI_TLV_RADIO_LINK_STATS_EVENTID,
+        WMI_TLV_NLO_MATCH_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_NLO_OFL),
+        WMI_TLV_NLO_SCAN_COMPLETE_EVENTID,
+        WMI_TLV_APFIND_EVENTID,
+        WMI_TLV_GTK_OFFLOAD_STATUS_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_GTK_OFL),
+        WMI_TLV_GTK_REKEY_FAIL_EVENTID,
+        WMI_TLV_CSA_HANDLING_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_CSA_OFL),
+        WMI_TLV_CHATTER_PC_QUERY_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_CHATTER),
+        WMI_TLV_ECHO_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_MISC),
+        WMI_TLV_PDEV_UTF_EVENTID,
+        WMI_TLV_DEBUG_MESG_EVENTID,
+        WMI_TLV_UPDATE_STATS_EVENTID,
+        WMI_TLV_DEBUG_PRINT_EVENTID,
+        WMI_TLV_DCS_INTERFERENCE_EVENTID,
+        WMI_TLV_PDEV_QVIT_EVENTID,
+        WMI_TLV_WLAN_PROFILE_DATA_EVENTID,
+        WMI_TLV_PDEV_FTM_INTG_EVENTID,
+        WMI_TLV_WLAN_FREQ_AVOID_EVENTID,
+        WMI_TLV_VDEV_GET_KEEPALIVE_EVENTID,
+        WMI_TLV_THERMAL_MGMT_EVENTID,
+        WMI_TLV_DIAG_DATA_CONTAINER_EVENTID,
+        WMI_TLV_HOST_AUTO_SHUTDOWN_EVENTID,
+        WMI_TLV_UPDATE_WHAL_MIB_STATS_EVENTID,
+        WMI_TLV_UPDATE_VDEV_RATE_STATS_EVENTID,
+        WMI_TLV_DIAG_EVENTID,
+        WMI_TLV_GPIO_INPUT_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_GPIO),
+        WMI_TLV_UPLOADH_EVENTID,
+        WMI_TLV_CAPTUREH_EVENTID,
+        WMI_TLV_RFKILL_STATE_CHANGE_EVENTID,
+        WMI_TLV_TDLS_PEER_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_TDLS),
+        WMI_TLV_BATCH_SCAN_ENABLED_EVENTID =
+                        WMI_TLV_EV(WMI_TLV_GRP_LOCATION_SCAN),
+        WMI_TLV_BATCH_SCAN_RESULT_EVENTID,
+        WMI_TLV_OEM_CAPABILITY_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_OEM),
+        WMI_TLV_OEM_MEASUREMENT_REPORT_EVENTID,
+        WMI_TLV_OEM_ERROR_REPORT_EVENTID,
+        WMI_TLV_NAN_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_NAN),
+        WMI_TLV_LPI_RESULT_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_LPI),
+        WMI_TLV_LPI_STATUS_EVENTID,
+        WMI_TLV_LPI_HANDOFF_EVENTID,
+        WMI_TLV_EXTSCAN_START_STOP_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_EXTSCAN),
+        WMI_TLV_EXTSCAN_OPERATION_EVENTID,
+        WMI_TLV_EXTSCAN_TABLE_USAGE_EVENTID,
+        WMI_TLV_EXTSCAN_CACHED_RESULTS_EVENTID,
+        WMI_TLV_EXTSCAN_WLAN_CHANGE_RESULTS_EVENTID,
+        WMI_TLV_EXTSCAN_HOTLIST_MATCH_EVENTID,
+        WMI_TLV_EXTSCAN_CAPABILITIES_EVENTID,
+        WMI_TLV_MDNS_STATS_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_MDNS_OFL),
+        WMI_TLV_SAP_OFL_ADD_STA_EVENTID = WMI_TLV_EV(WMI_TLV_GRP_SAP_OFL),
+        WMI_TLV_SAP_OFL_DEL_STA_EVENTID,
+};
+
+enum wmi_tlv_pdev_param {
+        WMI_TLV_PDEV_PARAM_TX_CHAIN_MASK = 0x1,
+        WMI_TLV_PDEV_PARAM_RX_CHAIN_MASK,
+        WMI_TLV_PDEV_PARAM_TXPOWER_LIMIT2G,
+        WMI_TLV_PDEV_PARAM_TXPOWER_LIMIT5G,
+        WMI_TLV_PDEV_PARAM_TXPOWER_SCALE,
+        WMI_TLV_PDEV_PARAM_BEACON_GEN_MODE,
+        WMI_TLV_PDEV_PARAM_BEACON_TX_MODE,
+        WMI_TLV_PDEV_PARAM_RESMGR_OFFCHAN_MODE,
+        WMI_TLV_PDEV_PARAM_PROTECTION_MODE,
+        WMI_TLV_PDEV_PARAM_DYNAMIC_BW,
+        WMI_TLV_PDEV_PARAM_NON_AGG_SW_RETRY_TH,
+        WMI_TLV_PDEV_PARAM_AGG_SW_RETRY_TH,
+        WMI_TLV_PDEV_PARAM_STA_KICKOUT_TH,
+        WMI_TLV_PDEV_PARAM_AC_AGGRSIZE_SCALING,
+        WMI_TLV_PDEV_PARAM_LTR_ENABLE,
+        WMI_TLV_PDEV_PARAM_LTR_AC_LATENCY_BE,
+        WMI_TLV_PDEV_PARAM_LTR_AC_LATENCY_BK,
+        WMI_TLV_PDEV_PARAM_LTR_AC_LATENCY_VI,
+        WMI_TLV_PDEV_PARAM_LTR_AC_LATENCY_VO,
+        WMI_TLV_PDEV_PARAM_LTR_AC_LATENCY_TIMEOUT,
+        WMI_TLV_PDEV_PARAM_LTR_SLEEP_OVERRIDE,
+        WMI_TLV_PDEV_PARAM_LTR_RX_OVERRIDE,
+        WMI_TLV_PDEV_PARAM_LTR_TX_ACTIVITY_TIMEOUT,
+        WMI_TLV_PDEV_PARAM_L1SS_ENABLE,
+        WMI_TLV_PDEV_PARAM_DSLEEP_ENABLE,
+        WMI_TLV_PDEV_PARAM_PCIELP_TXBUF_FLUSH,
+        WMI_TLV_PDEV_PARAM_PCIELP_TXBUF_WATERMARK,
+        WMI_TLV_PDEV_PARAM_PCIELP_TXBUF_TMO_EN,
+        WMI_TLV_PDEV_PARAM_PCIELP_TXBUF_TMO_VALUE,
+        WMI_TLV_PDEV_PARAM_PDEV_STATS_UPDATE_PERIOD,
+        WMI_TLV_PDEV_PARAM_VDEV_STATS_UPDATE_PERIOD,
+        WMI_TLV_PDEV_PARAM_PEER_STATS_UPDATE_PERIOD,
+        WMI_TLV_PDEV_PARAM_BCNFLT_STATS_UPDATE_PERIOD,
+        WMI_TLV_PDEV_PARAM_PMF_QOS,
+        WMI_TLV_PDEV_PARAM_ARP_AC_OVERRIDE,
+        WMI_TLV_PDEV_PARAM_DCS,
+        WMI_TLV_PDEV_PARAM_ANI_ENABLE,
+        WMI_TLV_PDEV_PARAM_ANI_POLL_PERIOD,
+        WMI_TLV_PDEV_PARAM_ANI_LISTEN_PERIOD,
+        WMI_TLV_PDEV_PARAM_ANI_OFDM_LEVEL,
+        WMI_TLV_PDEV_PARAM_ANI_CCK_LEVEL,
+        WMI_TLV_PDEV_PARAM_DYNTXCHAIN,
+        WMI_TLV_PDEV_PARAM_PROXY_STA,
+        WMI_TLV_PDEV_PARAM_IDLE_PS_CONFIG,
+        WMI_TLV_PDEV_PARAM_POWER_GATING_SLEEP,
+        WMI_TLV_PDEV_PARAM_RFKILL_ENABLE,
+        WMI_TLV_PDEV_PARAM_BURST_DUR,
+        WMI_TLV_PDEV_PARAM_BURST_ENABLE,
+        WMI_TLV_PDEV_PARAM_HW_RFKILL_CONFIG,
+        WMI_TLV_PDEV_PARAM_LOW_POWER_RF_ENABLE,
+        WMI_TLV_PDEV_PARAM_L1SS_TRACK,
+        WMI_TLV_PDEV_PARAM_HYST_EN,
+        WMI_TLV_PDEV_PARAM_POWER_COLLAPSE_ENABLE,
+        WMI_TLV_PDEV_PARAM_LED_SYS_STATE,
+        WMI_TLV_PDEV_PARAM_LED_ENABLE,
+        WMI_TLV_PDEV_PARAM_AUDIO_OVER_WLAN_LATENCY,
+        WMI_TLV_PDEV_PARAM_AUDIO_OVER_WLAN_ENABLE,
+        WMI_TLV_PDEV_PARAM_WHAL_MIB_STATS_UPDATE_ENABLE,
+        WMI_TLV_PDEV_PARAM_VDEV_RATE_STATS_UPDATE_PERIOD,
+        WMI_TLV_PDEV_PARAM_TXPOWER_REASON_NONE,
+        WMI_TLV_PDEV_PARAM_TXPOWER_REASON_SAR,
+        WMI_TLV_PDEV_PARAM_TXPOWER_REASON_MAX,
+};
+
+enum wmi_tlv_vdev_param {
+        WMI_TLV_VDEV_PARAM_RTS_THRESHOLD = 0x1,
+        WMI_TLV_VDEV_PARAM_FRAGMENTATION_THRESHOLD,
+        WMI_TLV_VDEV_PARAM_BEACON_INTERVAL,
+        WMI_TLV_VDEV_PARAM_LISTEN_INTERVAL,
+        WMI_TLV_VDEV_PARAM_MULTICAST_RATE,
+        WMI_TLV_VDEV_PARAM_MGMT_TX_RATE,
+        WMI_TLV_VDEV_PARAM_SLOT_TIME,
+        WMI_TLV_VDEV_PARAM_PREAMBLE,
+        WMI_TLV_VDEV_PARAM_SWBA_TIME,
+        WMI_TLV_VDEV_STATS_UPDATE_PERIOD,
+        WMI_TLV_VDEV_PWRSAVE_AGEOUT_TIME,
+        WMI_TLV_VDEV_HOST_SWBA_INTERVAL,
+        WMI_TLV_VDEV_PARAM_DTIM_PERIOD,
+        WMI_TLV_VDEV_OC_SCHEDULER_AIR_TIME_LIMIT,
+        WMI_TLV_VDEV_PARAM_WDS,
+        WMI_TLV_VDEV_PARAM_ATIM_WINDOW,
+        WMI_TLV_VDEV_PARAM_BMISS_COUNT_MAX,
+        WMI_TLV_VDEV_PARAM_BMISS_FIRST_BCNT,
+        WMI_TLV_VDEV_PARAM_BMISS_FINAL_BCNT,
+        WMI_TLV_VDEV_PARAM_FEATURE_WMM,
+        WMI_TLV_VDEV_PARAM_CHWIDTH,
+        WMI_TLV_VDEV_PARAM_CHEXTOFFSET,
+        WMI_TLV_VDEV_PARAM_DISABLE_HTPROTECTION,
+        WMI_TLV_VDEV_PARAM_STA_QUICKKICKOUT,
+        WMI_TLV_VDEV_PARAM_MGMT_RATE,
+        WMI_TLV_VDEV_PARAM_PROTECTION_MODE,
+        WMI_TLV_VDEV_PARAM_FIXED_RATE,
+        WMI_TLV_VDEV_PARAM_SGI,
+        WMI_TLV_VDEV_PARAM_LDPC,
+        WMI_TLV_VDEV_PARAM_TX_STBC,
+        WMI_TLV_VDEV_PARAM_RX_STBC,
+        WMI_TLV_VDEV_PARAM_INTRA_BSS_FWD,
+        WMI_TLV_VDEV_PARAM_DEF_KEYID,
+        WMI_TLV_VDEV_PARAM_NSS,
+        WMI_TLV_VDEV_PARAM_BCAST_DATA_RATE,
+        WMI_TLV_VDEV_PARAM_MCAST_DATA_RATE,
+        WMI_TLV_VDEV_PARAM_MCAST_INDICATE,
+        WMI_TLV_VDEV_PARAM_DHCP_INDICATE,
+        WMI_TLV_VDEV_PARAM_UNKNOWN_DEST_INDICATE,
+        WMI_TLV_VDEV_PARAM_AP_KEEPALIVE_MIN_IDLE_INACTIVE_TIME_SECS,
+        WMI_TLV_VDEV_PARAM_AP_KEEPALIVE_MAX_IDLE_INACTIVE_TIME_SECS,
+        WMI_TLV_VDEV_PARAM_AP_KEEPALIVE_MAX_UNRESPONSIVE_TIME_SECS,
+        WMI_TLV_VDEV_PARAM_AP_ENABLE_NAWDS,
+        WMI_TLV_VDEV_PARAM_ENABLE_RTSCTS,
+        WMI_TLV_VDEV_PARAM_TXBF,
+        WMI_TLV_VDEV_PARAM_PACKET_POWERSAVE,
+        WMI_TLV_VDEV_PARAM_DROP_UNENCRY,
+        WMI_TLV_VDEV_PARAM_TX_ENCAP_TYPE,
+        WMI_TLV_VDEV_PARAM_AP_DETECT_OUT_OF_SYNC_SLEEPING_STA_TIME_SECS,
+        WMI_TLV_VDEV_PARAM_EARLY_RX_ADJUST_ENABLE,
+        WMI_TLV_VDEV_PARAM_EARLY_RX_TGT_BMISS_NUM,
+        WMI_TLV_VDEV_PARAM_EARLY_RX_BMISS_SAMPLE_CYCLE,
+        WMI_TLV_VDEV_PARAM_EARLY_RX_SLOP_STEP,
+        WMI_TLV_VDEV_PARAM_EARLY_RX_INIT_SLOP,
+        WMI_TLV_VDEV_PARAM_EARLY_RX_ADJUST_PAUSE,
+        WMI_TLV_VDEV_PARAM_TX_PWRLIMIT,
+        WMI_TLV_VDEV_PARAM_SNR_NUM_FOR_CAL,
+        WMI_TLV_VDEV_PARAM_ROAM_FW_OFFLOAD,
+        WMI_TLV_VDEV_PARAM_ENABLE_RMC,
+        WMI_TLV_VDEV_PARAM_IBSS_MAX_BCN_LOST_MS,
+        WMI_TLV_VDEV_PARAM_MAX_RATE,
+        WMI_TLV_VDEV_PARAM_EARLY_RX_DRIFT_SAMPLE,
+        WMI_TLV_VDEV_PARAM_SET_IBSS_TX_FAIL_CNT_THR,
+        WMI_TLV_VDEV_PARAM_EBT_RESYNC_TIMEOUT,
+        WMI_TLV_VDEV_PARAM_AGGR_TRIG_EVENT_ENABLE,
+        WMI_TLV_VDEV_PARAM_IS_IBSS_POWER_SAVE_ALLOWED,
+        WMI_TLV_VDEV_PARAM_IS_POWER_COLLAPSE_ALLOWED,
+        WMI_TLV_VDEV_PARAM_IS_AWAKE_ON_TXRX_ENABLED,
+        WMI_TLV_VDEV_PARAM_INACTIVITY_CNT,
+        WMI_TLV_VDEV_PARAM_TXSP_END_INACTIVITY_TIME_MS,
+        WMI_TLV_VDEV_PARAM_DTIM_POLICY,
+        WMI_TLV_VDEV_PARAM_IBSS_PS_WARMUP_TIME_SECS,
+        WMI_TLV_VDEV_PARAM_IBSS_PS_1RX_CHAIN_IN_ATIM_WINDOW_ENABLE,
+};
+
+enum wmi_tlv_tag {
+        WMI_TLV_TAG_LAST_RESERVED = 15,
+
+        WMI_TLV_TAG_FIRST_ARRAY_ENUM,
+        WMI_TLV_TAG_ARRAY_UINT32 = WMI_TLV_TAG_FIRST_ARRAY_ENUM,
+        WMI_TLV_TAG_ARRAY_BYTE,
+        WMI_TLV_TAG_ARRAY_STRUCT,
+        WMI_TLV_TAG_ARRAY_FIXED_STRUCT,
+        WMI_TLV_TAG_LAST_ARRAY_ENUM = 31,
+
+        WMI_TLV_TAG_STRUCT_SERVICE_READY_EVENT,
+        WMI_TLV_TAG_STRUCT_HAL_REG_CAPABILITIES,
+        WMI_TLV_TAG_STRUCT_WLAN_HOST_MEM_REQ,
+        WMI_TLV_TAG_STRUCT_READY_EVENT,
+        WMI_TLV_TAG_STRUCT_SCAN_EVENT,
+        WMI_TLV_TAG_STRUCT_PDEV_TPC_CONFIG_EVENT,
+        WMI_TLV_TAG_STRUCT_CHAN_INFO_EVENT,
+        WMI_TLV_TAG_STRUCT_COMB_PHYERR_RX_HDR,
+        WMI_TLV_TAG_STRUCT_VDEV_START_RESPONSE_EVENT,
+        WMI_TLV_TAG_STRUCT_VDEV_STOPPED_EVENT,
+        WMI_TLV_TAG_STRUCT_VDEV_INSTALL_KEY_COMPLETE_EVENT,
+        WMI_TLV_TAG_STRUCT_PEER_STA_KICKOUT_EVENT,
+        WMI_TLV_TAG_STRUCT_MGMT_RX_HDR,
+        WMI_TLV_TAG_STRUCT_TBTT_OFFSET_EVENT,
+        WMI_TLV_TAG_STRUCT_TX_DELBA_COMPLETE_EVENT,
+        WMI_TLV_TAG_STRUCT_TX_ADDBA_COMPLETE_EVENT,
+        WMI_TLV_TAG_STRUCT_ROAM_EVENT,
+        WMI_TLV_TAG_STRUCT_WOW_EVENT_INFO,
+        WMI_TLV_TAG_STRUCT_WOW_EVENT_INFO_SECTION_BITMAP,
+        WMI_TLV_TAG_STRUCT_RTT_EVENT_HEADER,
+        WMI_TLV_TAG_STRUCT_RTT_ERROR_REPORT_EVENT,
+        WMI_TLV_TAG_STRUCT_RTT_MEAS_EVENT,
+        WMI_TLV_TAG_STRUCT_ECHO_EVENT,
+        WMI_TLV_TAG_STRUCT_FTM_INTG_EVENT,
+        WMI_TLV_TAG_STRUCT_VDEV_GET_KEEPALIVE_EVENT,
+        WMI_TLV_TAG_STRUCT_GPIO_INPUT_EVENT,
+        WMI_TLV_TAG_STRUCT_CSA_EVENT,
+        WMI_TLV_TAG_STRUCT_GTK_OFFLOAD_STATUS_EVENT,
+        WMI_TLV_TAG_STRUCT_IGTK_INFO,
+        WMI_TLV_TAG_STRUCT_DCS_INTERFERENCE_EVENT,
+        WMI_TLV_TAG_STRUCT_ATH_DCS_CW_INT,
+        WMI_TLV_TAG_STRUCT_ATH_DCS_WLAN_INT_STAT,
+        WMI_TLV_TAG_STRUCT_WLAN_PROFILE_CTX_T,
+        WMI_TLV_TAG_STRUCT_WLAN_PROFILE_T,
+        WMI_TLV_TAG_STRUCT_PDEV_QVIT_EVENT,
+        WMI_TLV_TAG_STRUCT_HOST_SWBA_EVENT,
+        WMI_TLV_TAG_STRUCT_TIM_INFO,
+        WMI_TLV_TAG_STRUCT_P2P_NOA_INFO,
+        WMI_TLV_TAG_STRUCT_STATS_EVENT,
+        WMI_TLV_TAG_STRUCT_AVOID_FREQ_RANGES_EVENT,
+        WMI_TLV_TAG_STRUCT_AVOID_FREQ_RANGE_DESC,
+        WMI_TLV_TAG_STRUCT_GTK_REKEY_FAIL_EVENT,
+        WMI_TLV_TAG_STRUCT_INIT_CMD,
+        WMI_TLV_TAG_STRUCT_RESOURCE_CONFIG,
+        WMI_TLV_TAG_STRUCT_WLAN_HOST_MEMORY_CHUNK,
+        WMI_TLV_TAG_STRUCT_START_SCAN_CMD,
+        WMI_TLV_TAG_STRUCT_STOP_SCAN_CMD,
+        WMI_TLV_TAG_STRUCT_SCAN_CHAN_LIST_CMD,
+        WMI_TLV_TAG_STRUCT_CHANNEL,
+        WMI_TLV_TAG_STRUCT_PDEV_SET_REGDOMAIN_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_SET_PARAM_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_SET_WMM_PARAMS_CMD,
+        WMI_TLV_TAG_STRUCT_WMM_PARAMS,
+        WMI_TLV_TAG_STRUCT_PDEV_SET_QUIET_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_CREATE_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_DELETE_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_START_REQUEST_CMD,
+        WMI_TLV_TAG_STRUCT_P2P_NOA_DESCRIPTOR,
+        WMI_TLV_TAG_STRUCT_P2P_GO_SET_BEACON_IE,
+        WMI_TLV_TAG_STRUCT_GTK_OFFLOAD_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_UP_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_STOP_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_DOWN_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_SET_PARAM_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_INSTALL_KEY_CMD,
+        WMI_TLV_TAG_STRUCT_PEER_CREATE_CMD,
+        WMI_TLV_TAG_STRUCT_PEER_DELETE_CMD,
+        WMI_TLV_TAG_STRUCT_PEER_FLUSH_TIDS_CMD,
+        WMI_TLV_TAG_STRUCT_PEER_SET_PARAM_CMD,
+        WMI_TLV_TAG_STRUCT_PEER_ASSOC_COMPLETE_CMD,
+        WMI_TLV_TAG_STRUCT_VHT_RATE_SET,
+        WMI_TLV_TAG_STRUCT_BCN_TMPL_CMD,
+        WMI_TLV_TAG_STRUCT_PRB_TMPL_CMD,
+        WMI_TLV_TAG_STRUCT_BCN_PRB_INFO,
+        WMI_TLV_TAG_STRUCT_PEER_TID_ADDBA_CMD,
+        WMI_TLV_TAG_STRUCT_PEER_TID_DELBA_CMD,
+        WMI_TLV_TAG_STRUCT_STA_POWERSAVE_MODE_CMD,
+        WMI_TLV_TAG_STRUCT_STA_POWERSAVE_PARAM_CMD,
+        WMI_TLV_TAG_STRUCT_STA_DTIM_PS_METHOD_CMD,
+        WMI_TLV_TAG_STRUCT_ROAM_SCAN_MODE,
+        WMI_TLV_TAG_STRUCT_ROAM_SCAN_RSSI_THRESHOLD,
+        WMI_TLV_TAG_STRUCT_ROAM_SCAN_PERIOD,
+        WMI_TLV_TAG_STRUCT_ROAM_SCAN_RSSI_CHANGE_THRESHOLD,
+        WMI_TLV_TAG_STRUCT_PDEV_SUSPEND_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_RESUME_CMD,
+        WMI_TLV_TAG_STRUCT_ADD_BCN_FILTER_CMD,
+        WMI_TLV_TAG_STRUCT_RMV_BCN_FILTER_CMD,
+        WMI_TLV_TAG_STRUCT_WOW_ENABLE_CMD,
+        WMI_TLV_TAG_STRUCT_WOW_HOSTWAKEUP_FROM_SLEEP_CMD,
+        WMI_TLV_TAG_STRUCT_STA_UAPSD_AUTO_TRIG_CMD,
+        WMI_TLV_TAG_STRUCT_STA_UAPSD_AUTO_TRIG_PARAM,
+        WMI_TLV_TAG_STRUCT_SET_ARP_NS_OFFLOAD_CMD,
+        WMI_TLV_TAG_STRUCT_ARP_OFFLOAD_TUPLE,
+        WMI_TLV_TAG_STRUCT_NS_OFFLOAD_TUPLE,
+        WMI_TLV_TAG_STRUCT_FTM_INTG_CMD,
+        WMI_TLV_TAG_STRUCT_STA_KEEPALIVE_CMD,
+        WMI_TLV_TAG_STRUCT_STA_KEEPALVE_ARP_RESPONSE,
+        WMI_TLV_TAG_STRUCT_P2P_SET_VENDOR_IE_DATA_CMD,
+        WMI_TLV_TAG_STRUCT_AP_PS_PEER_CMD,
+        WMI_TLV_TAG_STRUCT_PEER_RATE_RETRY_SCHED_CMD,
+        WMI_TLV_TAG_STRUCT_WLAN_PROFILE_TRIGGER_CMD,
+        WMI_TLV_TAG_STRUCT_WLAN_PROFILE_SET_HIST_INTVL_CMD,
+        WMI_TLV_TAG_STRUCT_WLAN_PROFILE_GET_PROF_DATA_CMD,
+        WMI_TLV_TAG_STRUCT_WLAN_PROFILE_ENABLE_PROFILE_ID_CMD,
+        WMI_TLV_TAG_STRUCT_WOW_DEL_PATTERN_CMD,
+        WMI_TLV_TAG_STRUCT_WOW_ADD_DEL_EVT_CMD,
+        WMI_TLV_TAG_STRUCT_RTT_MEASREQ_HEAD,
+        WMI_TLV_TAG_STRUCT_RTT_MEASREQ_BODY,
+        WMI_TLV_TAG_STRUCT_RTT_TSF_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_SPECTRAL_CONFIGURE_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_SPECTRAL_ENABLE_CMD,
+        WMI_TLV_TAG_STRUCT_REQUEST_STATS_CMD,
+        WMI_TLV_TAG_STRUCT_NLO_CONFIG_CMD,
+        WMI_TLV_TAG_STRUCT_NLO_CONFIGURED_PARAMETERS,
+        WMI_TLV_TAG_STRUCT_CSA_OFFLOAD_ENABLE_CMD,
+        WMI_TLV_TAG_STRUCT_CSA_OFFLOAD_CHANSWITCH_CMD,
+        WMI_TLV_TAG_STRUCT_CHATTER_SET_MODE_CMD,
+        WMI_TLV_TAG_STRUCT_ECHO_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_SET_KEEPALIVE_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_GET_KEEPALIVE_CMD,
+        WMI_TLV_TAG_STRUCT_FORCE_FW_HANG_CMD,
+        WMI_TLV_TAG_STRUCT_GPIO_CONFIG_CMD,
+        WMI_TLV_TAG_STRUCT_GPIO_OUTPUT_CMD,
+        WMI_TLV_TAG_STRUCT_PEER_ADD_WDS_ENTRY_CMD,
+        WMI_TLV_TAG_STRUCT_PEER_REMOVE_WDS_ENTRY_CMD,
+        WMI_TLV_TAG_STRUCT_BCN_TX_HDR,
+        WMI_TLV_TAG_STRUCT_BCN_SEND_FROM_HOST_CMD,
+        WMI_TLV_TAG_STRUCT_MGMT_TX_HDR,
+        WMI_TLV_TAG_STRUCT_ADDBA_CLEAR_RESP_CMD,
+        WMI_TLV_TAG_STRUCT_ADDBA_SEND_CMD,
+        WMI_TLV_TAG_STRUCT_DELBA_SEND_CMD,
+        WMI_TLV_TAG_STRUCT_ADDBA_SETRESPONSE_CMD,
+        WMI_TLV_TAG_STRUCT_SEND_SINGLEAMSDU_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_PKTLOG_ENABLE_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_PKTLOG_DISABLE_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_SET_HT_IE_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_SET_VHT_IE_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_SET_DSCP_TID_MAP_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_GREEN_AP_PS_ENABLE_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_GET_TPC_CONFIG_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_SET_BASE_MACADDR_CMD,
+        WMI_TLV_TAG_STRUCT_PEER_MCAST_GROUP_CMD,
+        WMI_TLV_TAG_STRUCT_ROAM_AP_PROFILE,
+        WMI_TLV_TAG_STRUCT_AP_PROFILE,
+        WMI_TLV_TAG_STRUCT_SCAN_SCH_PRIORITY_TABLE_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_DFS_ENABLE_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_DFS_DISABLE_CMD,
+        WMI_TLV_TAG_STRUCT_WOW_ADD_PATTERN_CMD,
+        WMI_TLV_TAG_STRUCT_WOW_BITMAP_PATTERN_T,
+        WMI_TLV_TAG_STRUCT_WOW_IPV4_SYNC_PATTERN_T,
+        WMI_TLV_TAG_STRUCT_WOW_IPV6_SYNC_PATTERN_T,
+        WMI_TLV_TAG_STRUCT_WOW_MAGIC_PATTERN_CMD,
+        WMI_TLV_TAG_STRUCT_SCAN_UPDATE_REQUEST_CMD,
+        WMI_TLV_TAG_STRUCT_CHATTER_PKT_COALESCING_FILTER,
+        WMI_TLV_TAG_STRUCT_CHATTER_COALESCING_ADD_FILTER_CMD,
+        WMI_TLV_TAG_STRUCT_CHATTER_COALESCING_DELETE_FILTER_CMD,
+        WMI_TLV_TAG_STRUCT_CHATTER_COALESCING_QUERY_CMD,
+        WMI_TLV_TAG_STRUCT_TXBF_CMD,
+        WMI_TLV_TAG_STRUCT_DEBUG_LOG_CONFIG_CMD,
+        WMI_TLV_TAG_STRUCT_NLO_EVENT,
+        WMI_TLV_TAG_STRUCT_CHATTER_QUERY_REPLY_EVENT,
+        WMI_TLV_TAG_STRUCT_UPLOAD_H_HDR,
+        WMI_TLV_TAG_STRUCT_CAPTURE_H_EVENT_HDR,
+        WMI_TLV_TAG_STRUCT_VDEV_WNM_SLEEPMODE_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_IPSEC_NATKEEPALIVE_FILTER_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_WMM_ADDTS_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_WMM_DELTS_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_SET_WMM_PARAMS_CMD,
+        WMI_TLV_TAG_STRUCT_TDLS_SET_STATE_CMD,
+        WMI_TLV_TAG_STRUCT_TDLS_PEER_UPDATE_CMD,
+        WMI_TLV_TAG_STRUCT_TDLS_PEER_EVENT,
+        WMI_TLV_TAG_STRUCT_TDLS_PEER_CAPABILITIES,
+        WMI_TLV_TAG_STRUCT_VDEV_MCC_SET_TBTT_MODE_CMD,
+        WMI_TLV_TAG_STRUCT_ROAM_CHAN_LIST,
+        WMI_TLV_TAG_STRUCT_VDEV_MCC_BCN_INTVL_CHANGE_EVENT,
+        WMI_TLV_TAG_STRUCT_RESMGR_ADAPTIVE_OCS_CMD,
+        WMI_TLV_TAG_STRUCT_RESMGR_SET_CHAN_TIME_QUOTA_CMD,
+        WMI_TLV_TAG_STRUCT_RESMGR_SET_CHAN_LATENCY_CMD,
+        WMI_TLV_TAG_STRUCT_BA_REQ_SSN_CMD,
+        WMI_TLV_TAG_STRUCT_BA_RSP_SSN_EVENT,
+        WMI_TLV_TAG_STRUCT_STA_SMPS_FORCE_MODE_CMD,
+        WMI_TLV_TAG_STRUCT_SET_MCASTBCAST_FILTER_CMD,
+        WMI_TLV_TAG_STRUCT_P2P_SET_OPPPS_CMD,
+        WMI_TLV_TAG_STRUCT_P2P_SET_NOA_CMD,
+        WMI_TLV_TAG_STRUCT_BA_REQ_SSN_CMD_SUB_STRUCT_PARAM,
+        WMI_TLV_TAG_STRUCT_BA_REQ_SSN_EVENT_SUB_STRUCT_PARAM,
+        WMI_TLV_TAG_STRUCT_STA_SMPS_PARAM_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_SET_GTX_PARAMS_CMD,
+        WMI_TLV_TAG_STRUCT_MCC_SCHED_TRAFFIC_STATS_CMD,
+        WMI_TLV_TAG_STRUCT_MCC_SCHED_STA_TRAFFIC_STATS,
+        WMI_TLV_TAG_STRUCT_OFFLOAD_BCN_TX_STATUS_EVENT,
+        WMI_TLV_TAG_STRUCT_P2P_NOA_EVENT,
+        WMI_TLV_TAG_STRUCT_HB_SET_ENABLE_CMD,
+        WMI_TLV_TAG_STRUCT_HB_SET_TCP_PARAMS_CMD,
+        WMI_TLV_TAG_STRUCT_HB_SET_TCP_PKT_FILTER_CMD,
+        WMI_TLV_TAG_STRUCT_HB_SET_UDP_PARAMS_CMD,
+        WMI_TLV_TAG_STRUCT_HB_SET_UDP_PKT_FILTER_CMD,
+        WMI_TLV_TAG_STRUCT_HB_IND_EVENT,
+        WMI_TLV_TAG_STRUCT_TX_PAUSE_EVENT,
+        WMI_TLV_TAG_STRUCT_RFKILL_EVENT,
+        WMI_TLV_TAG_STRUCT_DFS_RADAR_EVENT,
+        WMI_TLV_TAG_STRUCT_DFS_PHYERR_FILTER_ENA_CMD,
+        WMI_TLV_TAG_STRUCT_DFS_PHYERR_FILTER_DIS_CMD,
+        WMI_TLV_TAG_STRUCT_BATCH_SCAN_RESULT_SCAN_LIST,
+        WMI_TLV_TAG_STRUCT_BATCH_SCAN_RESULT_NETWORK_INFO,
+        WMI_TLV_TAG_STRUCT_BATCH_SCAN_ENABLE_CMD,
+        WMI_TLV_TAG_STRUCT_BATCH_SCAN_DISABLE_CMD,
+        WMI_TLV_TAG_STRUCT_BATCH_SCAN_TRIGGER_RESULT_CMD,
+        WMI_TLV_TAG_STRUCT_BATCH_SCAN_ENABLED_EVENT,
+        WMI_TLV_TAG_STRUCT_BATCH_SCAN_RESULT_EVENT,
+        WMI_TLV_TAG_STRUCT_VDEV_PLMREQ_START_CMD,
+        WMI_TLV_TAG_STRUCT_VDEV_PLMREQ_STOP_CMD,
+        WMI_TLV_TAG_STRUCT_THERMAL_MGMT_CMD,
+        WMI_TLV_TAG_STRUCT_THERMAL_MGMT_EVENT,
+        WMI_TLV_TAG_STRUCT_PEER_INFO_REQ_CMD,
+        WMI_TLV_TAG_STRUCT_PEER_INFO_EVENT,
+        WMI_TLV_TAG_STRUCT_PEER_INFO,
+        WMI_TLV_TAG_STRUCT_PEER_TX_FAIL_CNT_THR_EVENT,
+        WMI_TLV_TAG_STRUCT_RMC_SET_MODE_CMD,
+        WMI_TLV_TAG_STRUCT_RMC_SET_ACTION_PERIOD_CMD,
+        WMI_TLV_TAG_STRUCT_RMC_CONFIG_CMD,
+        WMI_TLV_TAG_STRUCT_MHF_OFFLOAD_SET_MODE_CMD,
+        WMI_TLV_TAG_STRUCT_MHF_OFFLOAD_PLUMB_ROUTING_TABLE_CMD,
+        WMI_TLV_TAG_STRUCT_ADD_PROACTIVE_ARP_RSP_PATTERN_CMD,
+        WMI_TLV_TAG_STRUCT_DEL_PROACTIVE_ARP_RSP_PATTERN_CMD,
+        WMI_TLV_TAG_STRUCT_NAN_CMD_PARAM,
+        WMI_TLV_TAG_STRUCT_NAN_EVENT_HDR,
+        WMI_TLV_TAG_STRUCT_PDEV_L1SS_TRACK_EVENT,
+        WMI_TLV_TAG_STRUCT_DIAG_DATA_CONTAINER_EVENT,
+        WMI_TLV_TAG_STRUCT_MODEM_POWER_STATE_CMD_PARAM,
+        WMI_TLV_TAG_STRUCT_PEER_GET_ESTIMATED_LINKSPEED_CMD,
+        WMI_TLV_TAG_STRUCT_PEER_ESTIMATED_LINKSPEED_EVENT,
+        WMI_TLV_TAG_STRUCT_AGGR_STATE_TRIG_EVENT,
+        WMI_TLV_TAG_STRUCT_MHF_OFFLOAD_ROUTING_TABLE_ENTRY,
+        WMI_TLV_TAG_STRUCT_ROAM_SCAN_CMD,
+        WMI_TLV_TAG_STRUCT_REQ_STATS_EXT_CMD,
+        WMI_TLV_TAG_STRUCT_STATS_EXT_EVENT,
+        WMI_TLV_TAG_STRUCT_OBSS_SCAN_ENABLE_CMD,
+        WMI_TLV_TAG_STRUCT_OBSS_SCAN_DISABLE_CMD,
+        WMI_TLV_TAG_STRUCT_OFFLOAD_PRB_RSP_TX_STATUS_EVENT,
+        WMI_TLV_TAG_STRUCT_PDEV_SET_LED_CONFIG_CMD,
+        WMI_TLV_TAG_STRUCT_HOST_AUTO_SHUTDOWN_CFG_CMD,
+        WMI_TLV_TAG_STRUCT_HOST_AUTO_SHUTDOWN_EVENT,
+        WMI_TLV_TAG_STRUCT_UPDATE_WHAL_MIB_STATS_EVENT,
+        WMI_TLV_TAG_STRUCT_CHAN_AVOID_UPDATE_CMD_PARAM,
+        WMI_TLV_TAG_STRUCT_WOW_ACER_IOAC_PKT_PATTERN_T,
+        WMI_TLV_TAG_STRUCT_WOW_ACER_IOAC_TMR_PATTERN_T,
+        WMI_TLV_TAG_STRUCT_WOW_IOAC_ADD_KEEPALIVE_CMD,
+        WMI_TLV_TAG_STRUCT_WOW_IOAC_DEL_KEEPALIVE_CMD,
+        WMI_TLV_TAG_STRUCT_WOW_IOAC_KEEPALIVE_T,
+        WMI_TLV_TAG_STRUCT_WOW_ACER_IOAC_ADD_PATTERN_CMD,
+        WMI_TLV_TAG_STRUCT_WOW_ACER_IOAC_DEL_PATTERN_CMD,
+        WMI_TLV_TAG_STRUCT_START_LINK_STATS_CMD,
+        WMI_TLV_TAG_STRUCT_CLEAR_LINK_STATS_CMD,
+        WMI_TLV_TAG_STRUCT_REQUEST_LINK_STATS_CMD,
+        WMI_TLV_TAG_STRUCT_IFACE_LINK_STATS_EVENT,
+        WMI_TLV_TAG_STRUCT_RADIO_LINK_STATS_EVENT,
+        WMI_TLV_TAG_STRUCT_PEER_STATS_EVENT,
+        WMI_TLV_TAG_STRUCT_CHANNEL_STATS,
+        WMI_TLV_TAG_STRUCT_RADIO_LINK_STATS,
+        WMI_TLV_TAG_STRUCT_RATE_STATS,
+        WMI_TLV_TAG_STRUCT_PEER_LINK_STATS,
+        WMI_TLV_TAG_STRUCT_WMM_AC_STATS,
+        WMI_TLV_TAG_STRUCT_IFACE_LINK_STATS,
+        WMI_TLV_TAG_STRUCT_LPI_MGMT_SNOOPING_CONFIG_CMD,
+        WMI_TLV_TAG_STRUCT_LPI_START_SCAN_CMD,
+        WMI_TLV_TAG_STRUCT_LPI_STOP_SCAN_CMD,
+        WMI_TLV_TAG_STRUCT_LPI_RESULT_EVENT,
+        WMI_TLV_TAG_STRUCT_PEER_STATE_EVENT,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_BUCKET_CMD,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_BUCKET_CHANNEL_EVENT,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_START_CMD,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_STOP_CMD,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_CONFIGURE_WLAN_CHANGE_MONITOR_CMD,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_WLAN_CHANGE_BSSID_PARAM_CMD,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_CONFIGURE_HOTLIST_MONITOR_CMD,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_GET_CACHED_RESULTS_CMD,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_GET_WLAN_CHANGE_RESULTS_CMD,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_SET_CAPABILITIES_CMD,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_GET_CAPABILITIES_CMD,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_OPERATION_EVENT,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_START_STOP_EVENT,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_TABLE_USAGE_EVENT,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_WLAN_DESCRIPTOR_EVENT,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_RSSI_INFO_EVENT,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_CACHED_RESULTS_EVENT,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_WLAN_CHANGE_RESULTS_EVENT,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_WLAN_CHANGE_RESULT_BSSID_EVENT,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_HOTLIST_MATCH_EVENT,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_CAPABILITIES_EVENT,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_CACHE_CAPABILITIES_EVENT,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_WLAN_CHANGE_MONITOR_CAPABILITIES_EVENT,
+        WMI_TLV_TAG_STRUCT_EXTSCAN_HOTLIST_MONITOR_CAPABILITIES_EVENT,
+        WMI_TLV_TAG_STRUCT_D0_WOW_ENABLE_DISABLE_CMD,
+        WMI_TLV_TAG_STRUCT_D0_WOW_DISABLE_ACK_EVENT,
+        WMI_TLV_TAG_STRUCT_UNIT_TEST_CMD,
+        WMI_TLV_TAG_STRUCT_ROAM_OFFLOAD_TLV_PARAM,
+        WMI_TLV_TAG_STRUCT_ROAM_11I_OFFLOAD_TLV_PARAM,
+        WMI_TLV_TAG_STRUCT_ROAM_11R_OFFLOAD_TLV_PARAM,
+        WMI_TLV_TAG_STRUCT_ROAM_ESE_OFFLOAD_TLV_PARAM,
+        WMI_TLV_TAG_STRUCT_ROAM_SYNCH_EVENT,
+        WMI_TLV_TAG_STRUCT_ROAM_SYNCH_COMPLETE,
+        WMI_TLV_TAG_STRUCT_EXTWOW_ENABLE_CMD,
+        WMI_TLV_TAG_STRUCT_EXTWOW_SET_APP_TYPE1_PARAMS_CMD,
+        WMI_TLV_TAG_STRUCT_EXTWOW_SET_APP_TYPE2_PARAMS_CMD,
+        WMI_TLV_TAG_STRUCT_LPI_STATUS_EVENT,
+        WMI_TLV_TAG_STRUCT_LPI_HANDOFF_EVENT,
+        WMI_TLV_TAG_STRUCT_VDEV_RATE_STATS_EVENT,
+        WMI_TLV_TAG_STRUCT_VDEV_RATE_HT_INFO,
+        WMI_TLV_TAG_STRUCT_RIC_REQUEST,
+        WMI_TLV_TAG_STRUCT_PDEV_GET_TEMPERATURE_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_TEMPERATURE_EVENT,
+        WMI_TLV_TAG_STRUCT_SET_DHCP_SERVER_OFFLOAD_CMD,
+        WMI_TLV_TAG_STRUCT_TPC_CHAINMASK_CONFIG_CMD,
+        WMI_TLV_TAG_STRUCT_RIC_TSPEC,
+        WMI_TLV_TAG_STRUCT_TPC_CHAINMASK_CONFIG,
+        WMI_TLV_TAG_STRUCT_IPA_OFFLOAD_CMD,
+        WMI_TLV_TAG_STRUCT_SCAN_PROB_REQ_OUI_CMD,
+        WMI_TLV_TAG_STRUCT_KEY_MATERIAL,
+        WMI_TLV_TAG_STRUCT_TDLS_SET_OFFCHAN_MODE_CMD,
+        WMI_TLV_TAG_STRUCT_SET_LED_FLASHING_CMD,
+        WMI_TLV_TAG_STRUCT_MDNS_OFFLOAD_CMD,
+        WMI_TLV_TAG_STRUCT_MDNS_SET_FQDN_CMD,
+        WMI_TLV_TAG_STRUCT_MDNS_SET_RESP_CMD,
+        WMI_TLV_TAG_STRUCT_MDNS_GET_STATS_CMD,
+        WMI_TLV_TAG_STRUCT_MDNS_STATS_EVENT,
+        WMI_TLV_TAG_STRUCT_ROAM_INVOKE_CMD,
+        WMI_TLV_TAG_STRUCT_PDEV_RESUME_EVENT,
+        WMI_TLV_TAG_STRUCT_PDEV_SET_ANTENNA_DIVERSITY_CMD,
+        WMI_TLV_TAG_STRUCT_SAP_OFL_ENABLE_CMD,
+        WMI_TLV_TAG_STRUCT_SAP_OFL_ADD_STA_EVENT,
+        WMI_TLV_TAG_STRUCT_SAP_OFL_DEL_STA_EVENT,
+        WMI_TLV_TAG_STRUCT_APFIND_CMD_PARAM,
+        WMI_TLV_TAG_STRUCT_APFIND_EVENT_HDR,
+
+        WMI_TLV_TAG_MAX
+};
+
+enum wmi_tlv_service {
+        WMI_TLV_SERVICE_BEACON_OFFLOAD = 0,
+        WMI_TLV_SERVICE_SCAN_OFFLOAD,
+        WMI_TLV_SERVICE_ROAM_SCAN_OFFLOAD,
+        WMI_TLV_SERVICE_BCN_MISS_OFFLOAD,
+        WMI_TLV_SERVICE_STA_PWRSAVE,
+        WMI_TLV_SERVICE_STA_ADVANCED_PWRSAVE,
+        WMI_TLV_SERVICE_AP_UAPSD,
+        WMI_TLV_SERVICE_AP_DFS,
+        WMI_TLV_SERVICE_11AC,
+        WMI_TLV_SERVICE_BLOCKACK,
+        WMI_TLV_SERVICE_PHYERR,
+        WMI_TLV_SERVICE_BCN_FILTER,
+        WMI_TLV_SERVICE_RTT,
+        WMI_TLV_SERVICE_WOW,
+        WMI_TLV_SERVICE_RATECTRL_CACHE,
+        WMI_TLV_SERVICE_IRAM_TIDS,
+        WMI_TLV_SERVICE_ARPNS_OFFLOAD,
+        WMI_TLV_SERVICE_NLO,
+        WMI_TLV_SERVICE_GTK_OFFLOAD,
+        WMI_TLV_SERVICE_SCAN_SCH,
+        WMI_TLV_SERVICE_CSA_OFFLOAD,
+        WMI_TLV_SERVICE_CHATTER,
+        WMI_TLV_SERVICE_COEX_FREQAVOID,
+        WMI_TLV_SERVICE_PACKET_POWER_SAVE,
+        WMI_TLV_SERVICE_FORCE_FW_HANG,
+        WMI_TLV_SERVICE_GPIO,
+        WMI_TLV_SERVICE_STA_DTIM_PS_MODULATED_DTIM,
+        WMI_TLV_SERVICE_STA_UAPSD_BASIC_AUTO_TRIG,
+        WMI_TLV_SERVICE_STA_UAPSD_VAR_AUTO_TRIG,
+        WMI_TLV_SERVICE_STA_KEEP_ALIVE,
+        WMI_TLV_SERVICE_TX_ENCAP,
+        WMI_TLV_SERVICE_AP_PS_DETECT_OUT_OF_SYNC,
+        WMI_TLV_SERVICE_EARLY_RX,
+        WMI_TLV_SERVICE_STA_SMPS,
+        WMI_TLV_SERVICE_FWTEST,
+        WMI_TLV_SERVICE_STA_WMMAC,
+        WMI_TLV_SERVICE_TDLS,
+        WMI_TLV_SERVICE_BURST,
+        WMI_TLV_SERVICE_MCC_BCN_INTERVAL_CHANGE,
+        WMI_TLV_SERVICE_ADAPTIVE_OCS,
+        WMI_TLV_SERVICE_BA_SSN_SUPPORT,
+        WMI_TLV_SERVICE_FILTER_IPSEC_NATKEEPALIVE,
+        WMI_TLV_SERVICE_WLAN_HB,
+        WMI_TLV_SERVICE_LTE_ANT_SHARE_SUPPORT,
+        WMI_TLV_SERVICE_BATCH_SCAN,
+        WMI_TLV_SERVICE_QPOWER,
+        WMI_TLV_SERVICE_PLMREQ,
+        WMI_TLV_SERVICE_THERMAL_MGMT,
+        WMI_TLV_SERVICE_RMC,
+        WMI_TLV_SERVICE_MHF_OFFLOAD,
+        WMI_TLV_SERVICE_COEX_SAR,
+        WMI_TLV_SERVICE_BCN_TXRATE_OVERRIDE,
+        WMI_TLV_SERVICE_NAN,
+        WMI_TLV_SERVICE_L1SS_STAT,
+        WMI_TLV_SERVICE_ESTIMATE_LINKSPEED,
+        WMI_TLV_SERVICE_OBSS_SCAN,
+        WMI_TLV_SERVICE_TDLS_OFFCHAN,
+        WMI_TLV_SERVICE_TDLS_UAPSD_BUFFER_STA,
+        WMI_TLV_SERVICE_TDLS_UAPSD_SLEEP_STA,
+        WMI_TLV_SERVICE_IBSS_PWRSAVE,
+        WMI_TLV_SERVICE_LPASS,
+        WMI_TLV_SERVICE_EXTSCAN,
+        WMI_TLV_SERVICE_D0WOW,
+        WMI_TLV_SERVICE_HSOFFLOAD,
+        WMI_TLV_SERVICE_ROAM_HO_OFFLOAD,
+        WMI_TLV_SERVICE_RX_FULL_REORDER,
+        WMI_TLV_SERVICE_DHCP_OFFLOAD,
+        WMI_TLV_SERVICE_STA_RX_IPA_OFFLOAD_SUPPORT,
+        WMI_TLV_SERVICE_MDNS_OFFLOAD,
+        WMI_TLV_SERVICE_SAP_AUTH_OFFLOAD,
+};
+
+#define WMI_SERVICE_IS_ENABLED(wmi_svc_bmap, svc_id, len) \
+        ((svc_id) < (len) && \
+         __le32_to_cpu((wmi_svc_bmap)[(svc_id)/(sizeof(u32))]) & \
+         BIT((svc_id)%(sizeof(u32))))
+
+#define SVCMAP(x, y, len) \
+        do { \
+                if (WMI_SERVICE_IS_ENABLED((in), (x), (len))) \
+                        __set_bit(y, out); \
+        } while (0)
+
+static inline void
+wmi_tlv_svc_map(const __le32 *in, unsigned long *out, size_t len)
+{
+        SVCMAP(WMI_TLV_SERVICE_BEACON_OFFLOAD,
+               WMI_SERVICE_BEACON_OFFLOAD, len);
+        SVCMAP(WMI_TLV_SERVICE_SCAN_OFFLOAD,
+               WMI_SERVICE_SCAN_OFFLOAD, len);
+        SVCMAP(WMI_TLV_SERVICE_ROAM_SCAN_OFFLOAD,
+               WMI_SERVICE_ROAM_SCAN_OFFLOAD, len);
+        SVCMAP(WMI_TLV_SERVICE_BCN_MISS_OFFLOAD,
+               WMI_SERVICE_BCN_MISS_OFFLOAD, len);
+        SVCMAP(WMI_TLV_SERVICE_STA_PWRSAVE,
+               WMI_SERVICE_STA_PWRSAVE, len);
+        SVCMAP(WMI_TLV_SERVICE_STA_ADVANCED_PWRSAVE,
+               WMI_SERVICE_STA_ADVANCED_PWRSAVE, len);
+        SVCMAP(WMI_TLV_SERVICE_AP_UAPSD,
+               WMI_SERVICE_AP_UAPSD, len);
+        SVCMAP(WMI_TLV_SERVICE_AP_DFS,
+               WMI_SERVICE_AP_DFS, len);
+        SVCMAP(WMI_TLV_SERVICE_11AC,
+               WMI_SERVICE_11AC, len);
+        SVCMAP(WMI_TLV_SERVICE_BLOCKACK,
+               WMI_SERVICE_BLOCKACK, len);
+        SVCMAP(WMI_TLV_SERVICE_PHYERR,
+               WMI_SERVICE_PHYERR, len);
+        SVCMAP(WMI_TLV_SERVICE_BCN_FILTER,
+               WMI_SERVICE_BCN_FILTER, len);
+        SVCMAP(WMI_TLV_SERVICE_RTT,
+               WMI_SERVICE_RTT, len);
+        SVCMAP(WMI_TLV_SERVICE_WOW,
+               WMI_SERVICE_WOW, len);
+        SVCMAP(WMI_TLV_SERVICE_RATECTRL_CACHE,
+               WMI_SERVICE_RATECTRL_CACHE, len);
+        SVCMAP(WMI_TLV_SERVICE_IRAM_TIDS,
+               WMI_SERVICE_IRAM_TIDS, len);
+        SVCMAP(WMI_TLV_SERVICE_ARPNS_OFFLOAD,
+               WMI_SERVICE_ARPNS_OFFLOAD, len);
+        SVCMAP(WMI_TLV_SERVICE_NLO,
+               WMI_SERVICE_NLO, len);
+        SVCMAP(WMI_TLV_SERVICE_GTK_OFFLOAD,
+               WMI_SERVICE_GTK_OFFLOAD, len);
+        SVCMAP(WMI_TLV_SERVICE_SCAN_SCH,
+               WMI_SERVICE_SCAN_SCH, len);
+        SVCMAP(WMI_TLV_SERVICE_CSA_OFFLOAD,
+               WMI_SERVICE_CSA_OFFLOAD, len);
+        SVCMAP(WMI_TLV_SERVICE_CHATTER,
+               WMI_SERVICE_CHATTER, len);
+        SVCMAP(WMI_TLV_SERVICE_COEX_FREQAVOID,
+               WMI_SERVICE_COEX_FREQAVOID, len);
+        SVCMAP(WMI_TLV_SERVICE_PACKET_POWER_SAVE,
+               WMI_SERVICE_PACKET_POWER_SAVE, len);
+        SVCMAP(WMI_TLV_SERVICE_FORCE_FW_HANG,
+               WMI_SERVICE_FORCE_FW_HANG, len);
+        SVCMAP(WMI_TLV_SERVICE_GPIO,
+               WMI_SERVICE_GPIO, len);
+        SVCMAP(WMI_TLV_SERVICE_STA_DTIM_PS_MODULATED_DTIM,
+               WMI_SERVICE_STA_DTIM_PS_MODULATED_DTIM, len);
+        SVCMAP(WMI_TLV_SERVICE_STA_UAPSD_BASIC_AUTO_TRIG,
+               WMI_SERVICE_STA_UAPSD_BASIC_AUTO_TRIG, len);
+        SVCMAP(WMI_TLV_SERVICE_STA_UAPSD_VAR_AUTO_TRIG,
+               WMI_SERVICE_STA_UAPSD_VAR_AUTO_TRIG, len);
+        SVCMAP(WMI_TLV_SERVICE_STA_KEEP_ALIVE,
+               WMI_SERVICE_STA_KEEP_ALIVE, len);
+        SVCMAP(WMI_TLV_SERVICE_TX_ENCAP,
+               WMI_SERVICE_TX_ENCAP, len);
+        SVCMAP(WMI_TLV_SERVICE_AP_PS_DETECT_OUT_OF_SYNC,
+               WMI_SERVICE_AP_PS_DETECT_OUT_OF_SYNC, len);
+        SVCMAP(WMI_TLV_SERVICE_EARLY_RX,
+               WMI_SERVICE_EARLY_RX, len);
+        SVCMAP(WMI_TLV_SERVICE_STA_SMPS,
+               WMI_SERVICE_STA_SMPS, len);
+        SVCMAP(WMI_TLV_SERVICE_FWTEST,
+               WMI_SERVICE_FWTEST, len);
+        SVCMAP(WMI_TLV_SERVICE_STA_WMMAC,
+               WMI_SERVICE_STA_WMMAC, len);
+        SVCMAP(WMI_TLV_SERVICE_TDLS,
+               WMI_SERVICE_TDLS, len);
+        SVCMAP(WMI_TLV_SERVICE_BURST,
+               WMI_SERVICE_BURST, len);
+        SVCMAP(WMI_TLV_SERVICE_MCC_BCN_INTERVAL_CHANGE,
+               WMI_SERVICE_MCC_BCN_INTERVAL_CHANGE, len);
+        SVCMAP(WMI_TLV_SERVICE_ADAPTIVE_OCS,
+               WMI_SERVICE_ADAPTIVE_OCS, len);
+        SVCMAP(WMI_TLV_SERVICE_BA_SSN_SUPPORT,
+               WMI_SERVICE_BA_SSN_SUPPORT, len);
+        SVCMAP(WMI_TLV_SERVICE_FILTER_IPSEC_NATKEEPALIVE,
+               WMI_SERVICE_FILTER_IPSEC_NATKEEPALIVE, len);
+        SVCMAP(WMI_TLV_SERVICE_WLAN_HB,
+               WMI_SERVICE_WLAN_HB, len);
+        SVCMAP(WMI_TLV_SERVICE_LTE_ANT_SHARE_SUPPORT,
+               WMI_SERVICE_LTE_ANT_SHARE_SUPPORT, len);
+        SVCMAP(WMI_TLV_SERVICE_BATCH_SCAN,
+               WMI_SERVICE_BATCH_SCAN, len);
+        SVCMAP(WMI_TLV_SERVICE_QPOWER,
+               WMI_SERVICE_QPOWER, len);
+        SVCMAP(WMI_TLV_SERVICE_PLMREQ,
+               WMI_SERVICE_PLMREQ, len);
+        SVCMAP(WMI_TLV_SERVICE_THERMAL_MGMT,
+               WMI_SERVICE_THERMAL_MGMT, len);
+        SVCMAP(WMI_TLV_SERVICE_RMC,
+               WMI_SERVICE_RMC, len);
+        SVCMAP(WMI_TLV_SERVICE_MHF_OFFLOAD,
+               WMI_SERVICE_MHF_OFFLOAD, len);
+        SVCMAP(WMI_TLV_SERVICE_COEX_SAR,
+               WMI_SERVICE_COEX_SAR, len);
+        SVCMAP(WMI_TLV_SERVICE_BCN_TXRATE_OVERRIDE,
+               WMI_SERVICE_BCN_TXRATE_OVERRIDE, len);
+        SVCMAP(WMI_TLV_SERVICE_NAN,
+               WMI_SERVICE_NAN, len);
+        SVCMAP(WMI_TLV_SERVICE_L1SS_STAT,
+               WMI_SERVICE_L1SS_STAT, len);
+        SVCMAP(WMI_TLV_SERVICE_ESTIMATE_LINKSPEED,
+               WMI_SERVICE_ESTIMATE_LINKSPEED, len);
+        SVCMAP(WMI_TLV_SERVICE_OBSS_SCAN,
+               WMI_SERVICE_OBSS_SCAN, len);
+        SVCMAP(WMI_TLV_SERVICE_TDLS_OFFCHAN,
+               WMI_SERVICE_TDLS_OFFCHAN, len);
+        SVCMAP(WMI_TLV_SERVICE_TDLS_UAPSD_BUFFER_STA,
+               WMI_SERVICE_TDLS_UAPSD_BUFFER_STA, len);
+        SVCMAP(WMI_TLV_SERVICE_TDLS_UAPSD_SLEEP_STA,
+               WMI_SERVICE_TDLS_UAPSD_SLEEP_STA, len);
+        SVCMAP(WMI_TLV_SERVICE_IBSS_PWRSAVE,
+               WMI_SERVICE_IBSS_PWRSAVE, len);
+        SVCMAP(WMI_TLV_SERVICE_LPASS,
+               WMI_SERVICE_LPASS, len);
+        SVCMAP(WMI_TLV_SERVICE_EXTSCAN,
+               WMI_SERVICE_EXTSCAN, len);
+        SVCMAP(WMI_TLV_SERVICE_D0WOW,
+               WMI_SERVICE_D0WOW, len);
+        SVCMAP(WMI_TLV_SERVICE_HSOFFLOAD,
+               WMI_SERVICE_HSOFFLOAD, len);
+        SVCMAP(WMI_TLV_SERVICE_ROAM_HO_OFFLOAD,
+               WMI_SERVICE_ROAM_HO_OFFLOAD, len);
+        SVCMAP(WMI_TLV_SERVICE_RX_FULL_REORDER,
+               WMI_SERVICE_RX_FULL_REORDER, len);
+        SVCMAP(WMI_TLV_SERVICE_DHCP_OFFLOAD,
+               WMI_SERVICE_DHCP_OFFLOAD, len);
+        SVCMAP(WMI_TLV_SERVICE_STA_RX_IPA_OFFLOAD_SUPPORT,
+               WMI_SERVICE_STA_RX_IPA_OFFLOAD_SUPPORT, len);
+        SVCMAP(WMI_TLV_SERVICE_MDNS_OFFLOAD,
+               WMI_SERVICE_MDNS_OFFLOAD, len);
+        SVCMAP(WMI_TLV_SERVICE_SAP_AUTH_OFFLOAD,
+               WMI_SERVICE_SAP_AUTH_OFFLOAD, len);
+}
+
+#undef SVCMAP
+
+struct wmi_tlv {
+        __le16 len;
+        __le16 tag;
+        u8 value[0];
+} __packed;
+
+#define WMI_TLV_MGMT_RX_NUM_RSSI 4
+
+struct wmi_tlv_mgmt_rx_ev {
+        __le32 channel;
+        __le32 snr;
+        __le32 rate;
+        __le32 phy_mode;
+        __le32 buf_len;
+        __le32 status;
+        __le32 rssi[WMI_TLV_MGMT_RX_NUM_RSSI];
+} __packed;
+
+struct wmi_tlv_abi_version {
+        __le32 abi_ver0;
+        __le32 abi_ver1;
+        __le32 abi_ver_ns0;
+        __le32 abi_ver_ns1;
+        __le32 abi_ver_ns2;
+        __le32 abi_ver_ns3;
+} __packed;
+
+enum wmi_tlv_hw_bd_id {
+        WMI_TLV_HW_BD_LEGACY = 0,
+        WMI_TLV_HW_BD_QCA6174 = 1,
+        WMI_TLV_HW_BD_QCA2582 = 2,
+};
+
+struct wmi_tlv_hw_bd_info {
+        u8 rev;
+        u8 project_id;
+        u8 custom_id;
+        u8 reference_design_id;
+} __packed;
+
+struct wmi_tlv_svc_rdy_ev {
+        __le32 fw_build_vers;
+        struct wmi_tlv_abi_version abi;
+        __le32 phy_capability;
+        __le32 max_frag_entry;
+        __le32 num_rf_chains;
+        __le32 ht_cap_info;
+        __le32 vht_cap_info;
+        __le32 vht_supp_mcs;
+        __le32 hw_min_tx_power;
+        __le32 hw_max_tx_power;
+        __le32 sys_cap_info;
+        __le32 min_pkt_size_enable;
+        __le32 max_bcn_ie_size;
+        __le32 num_mem_reqs;
+        __le32 max_num_scan_chans;
+        __le32 hw_bd_id; /* 0 means hw_bd_info is invalid */
+        struct wmi_tlv_hw_bd_info hw_bd_info[5];
+} __packed;
+
+struct wmi_tlv_rdy_ev {
+        struct wmi_tlv_abi_version abi;
+        struct wmi_mac_addr mac_addr;
+        __le32 status;
+} __packed;
+
+struct wmi_tlv_resource_config {
+        __le32 num_vdevs;
+        __le32 num_peers;
+        __le32 num_offload_peers;
+        __le32 num_offload_reorder_bufs;
+        __le32 num_peer_keys;
+        __le32 num_tids;
+        __le32 ast_skid_limit;
+        __le32 tx_chain_mask;
+        __le32 rx_chain_mask;
+        __le32 rx_timeout_pri[4];
+        __le32 rx_decap_mode;
+        __le32 scan_max_pending_reqs;
+        __le32 bmiss_offload_max_vdev;
+        __le32 roam_offload_max_vdev;
+        __le32 roam_offload_max_ap_profiles;
+        __le32 num_mcast_groups;
+        __le32 num_mcast_table_elems;
+        __le32 mcast2ucast_mode;
+        __le32 tx_dbg_log_size;
+        __le32 num_wds_entries;
+        __le32 dma_burst_size;
+        __le32 mac_aggr_delim;
+        __le32 rx_skip_defrag_timeout_dup_detection_check;
+        __le32 vow_config;
+        __le32 gtk_offload_max_vdev;
+        __le32 num_msdu_desc;
+        __le32 max_frag_entries;
+        __le32 num_tdls_vdevs;
+        __le32 num_tdls_conn_table_entries;
+        __le32 beacon_tx_offload_max_vdev;
+        __le32 num_multicast_filter_entries;
+        __le32 num_wow_filters;
+        __le32 num_keep_alive_pattern;
+        __le32 keep_alive_pattern_size;
+        __le32 max_tdls_concurrent_sleep_sta;
+        __le32 max_tdls_concurrent_buffer_sta;
+} __packed;
+
+struct wmi_tlv_init_cmd {
+        struct wmi_tlv_abi_version abi;
+        __le32 num_host_mem_chunks;
+} __packed;
+
+struct wmi_tlv_pdev_set_param_cmd {
+        __le32 pdev_id; /* not used yet */
+        __le32 param_id;
+        __le32 param_value;
+} __packed;
+
+struct wmi_tlv_pdev_set_rd_cmd {
+        __le32 pdev_id; /* not used yet */
+        __le32 regd;
+        __le32 regd_2ghz;
+        __le32 regd_5ghz;
+        __le32 conform_limit_2ghz;
+        __le32 conform_limit_5ghz;
+} __packed;
+
+struct wmi_tlv_scan_chan_list_cmd {
+        __le32 num_scan_chans;
+} __packed;
+
+struct wmi_tlv_start_scan_cmd {
+        struct wmi_start_scan_common common;
+        __le32 burst_duration_ms;
+        __le32 num_channels;
+        __le32 num_bssids;
+        __le32 num_ssids;
+        __le32 ie_len;
+        __le32 num_probes;
+} __packed;
+
+struct wmi_tlv_vdev_start_cmd {
+        __le32 vdev_id;
+        __le32 requestor_id;
+        __le32 bcn_intval;
+        __le32 dtim_period;
+        __le32 flags;
+        struct wmi_ssid ssid;
+        __le32 bcn_tx_rate;
+        __le32 bcn_tx_power;
+        __le32 num_noa_descr;
+        __le32 disable_hw_ack;
+} __packed;
+
+enum {
+        WMI_TLV_PEER_TYPE_DEFAULT = 0, /* generic / non-BSS / self-peer */
+        WMI_TLV_PEER_TYPE_BSS = 1,
+        WMI_TLV_PEER_TYPE_TDLS = 2,
+        WMI_TLV_PEER_TYPE_HOST_MAX = 127,
+        WMI_TLV_PEER_TYPE_ROAMOFFLOAD_TMP = 128,
+};
+
+struct wmi_tlv_peer_create_cmd {
+        __le32 vdev_id;
+        struct wmi_mac_addr peer_addr;
+        __le32 peer_type;
+} __packed;
+
+struct wmi_tlv_peer_assoc_cmd {
+        struct wmi_mac_addr mac_addr;
+        __le32 vdev_id;
+        __le32 new_assoc;
+        __le32 assoc_id;
+        __le32 flags;
+        __le32 caps;
+        __le32 listen_intval;
+        __le32 ht_caps;
+        __le32 max_mpdu;
+        __le32 mpdu_density;
+        __le32 rate_caps;
+        __le32 nss;
+        __le32 vht_caps;
+        __le32 phy_mode;
+        __le32 ht_info[2];
+        __le32 num_legacy_rates;
+        __le32 num_ht_rates;
+} __packed;
+
+struct wmi_tlv_pdev_suspend {
+        __le32 pdev_id; /* not used yet */
+        __le32 opt;
+} __packed;
+
+struct wmi_tlv_pdev_set_wmm_cmd {
+        __le32 pdev_id; /* not used yet */
+        __le32 dg_type; /* no idea.. */
+} __packed;
+
+struct wmi_tlv_vdev_set_wmm_cmd {
+        __le32 vdev_id;
+} __packed;
+
+struct wmi_tlv_phyerr_ev {
+        __le32 num_phyerrs;
+        __le32 tsf_l32;
+        __le32 tsf_u32;
+        __le32 buf_len;
+} __packed;
+
+enum wmi_tlv_dbglog_param {
+        WMI_TLV_DBGLOG_PARAM_LOG_LEVEL = 1,
+        WMI_TLV_DBGLOG_PARAM_VDEV_ENABLE,
+        WMI_TLV_DBGLOG_PARAM_VDEV_DISABLE,
+        WMI_TLV_DBGLOG_PARAM_VDEV_ENABLE_BITMAP,
+        WMI_TLV_DBGLOG_PARAM_VDEV_DISABLE_BITMAP,
+};
+
+enum wmi_tlv_dbglog_log_level {
+        WMI_TLV_DBGLOG_LOG_LEVEL_VERBOSE = 0,
+        WMI_TLV_DBGLOG_LOG_LEVEL_INFO,
+        WMI_TLV_DBGLOG_LOG_LEVEL_INFO_LVL_1,
+        WMI_TLV_DBGLOG_LOG_LEVEL_INFO_LVL_2,
+        WMI_TLV_DBGLOG_LOG_LEVEL_WARN,
+        WMI_TLV_DBGLOG_LOG_LEVEL_ERR,
+};
+
+#define WMI_TLV_DBGLOG_BITMAP_MAX_IDS 512
+#define WMI_TLV_DBGLOG_BITMAP_MAX_WORDS (WMI_TLV_DBGLOG_BITMAP_MAX_IDS / \
+                                         sizeof(__le32))
+#define WMI_TLV_DBGLOG_ALL_MODULES 0xffff
+#define WMI_TLV_DBGLOG_LOG_LEVEL_VALUE(module_id, log_level) \
+                (((module_id << 16) & 0xffff0000) | \
+                 ((log_level <<  0) & 0x000000ff))
+
+struct wmi_tlv_dbglog_cmd {
+        __le32 param;
+        __le32 value;
+} __packed;
+
+struct wmi_tlv_resume_cmd {
+        __le32 reserved;
+} __packed;
+
+struct wmi_tlv_req_stats_cmd {
+        __le32 stats_id; /* wmi_stats_id */
+        __le32 vdev_id;
+        struct wmi_mac_addr peer_macaddr;
+} __packed;
+
+struct wmi_tlv_vdev_stats {
+        __le32 vdev_id;
+        __le32 beacon_snr;
+        __le32 data_snr;
+        __le32 num_tx_frames[4]; /* per-AC */
+        __le32 num_rx_frames;
+        __le32 num_tx_frames_retries[4];
+        __le32 num_tx_frames_failures[4];
+        __le32 num_rts_fail;
+        __le32 num_rts_success;
+        __le32 num_rx_err;
+        __le32 num_rx_discard;
+        __le32 num_tx_not_acked;
+        __le32 tx_rate_history[10];
+        __le32 beacon_rssi_history[10];
+} __packed;
+
+struct wmi_tlv_pktlog_enable {
+        __le32 reserved;
+        __le32 filter;
+} __packed;
+
+struct wmi_tlv_pktlog_disable {
+        __le32 reserved;
+} __packed;
+
+enum wmi_tlv_bcn_tx_status {
+        WMI_TLV_BCN_TX_STATUS_OK,
+        WMI_TLV_BCN_TX_STATUS_XRETRY,
+        WMI_TLV_BCN_TX_STATUS_DROP,
+        WMI_TLV_BCN_TX_STATUS_FILTERED,
+};
+
+struct wmi_tlv_bcn_tx_status_ev {
+        __le32 vdev_id;
+        __le32 tx_status;
+} __packed;
+
+struct wmi_tlv_bcn_prb_info {
+        __le32 caps;
+        __le32 erp;
+        u8 ies[0];
+} __packed;
+
+struct wmi_tlv_bcn_tmpl_cmd {
+        __le32 vdev_id;
+        __le32 tim_ie_offset;
+        __le32 buf_len;
+} __packed;
+
+struct wmi_tlv_prb_tmpl_cmd {
+        __le32 vdev_id;
+        __le32 buf_len;
+} __packed;
+
+struct wmi_tlv_p2p_go_bcn_ie {
+        __le32 vdev_id;
+        __le32 ie_len;
+} __packed;
+
+enum wmi_tlv_diag_item_type {
+        WMI_TLV_DIAG_ITEM_TYPE_FW_EVENT,
+        WMI_TLV_DIAG_ITEM_TYPE_FW_LOG,
+        WMI_TLV_DIAG_ITEM_TYPE_FW_DEBUG_MSG,
+};
+
+struct wmi_tlv_diag_item {
+        u8 type;
+        u8 reserved;
+        __le16 len;
+        __le32 timestamp;
+        __le32 code;
+        u8 payload[0];
+} __packed;
+
+struct wmi_tlv_diag_data_ev {
+        __le32 num_items;
+} __packed;
+
+struct wmi_tlv_sta_keepalive_cmd {
+        __le32 vdev_id;
+        __le32 enabled;
+        __le32 method; /* WMI_STA_KEEPALIVE_METHOD_ */
+        __le32 interval; /* in seconds */
+} __packed;
+
+void ath10k_wmi_tlv_attach(struct ath10k *ar);
+
+#endif
diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
index c0f3e4d09263..aeea1c793943 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.c
+++ b/drivers/net/wireless/ath/ath10k/wmi.c
@@ -22,8 +22,10 @@
 #include "htc.h"
 #include "debug.h"
 #include "wmi.h"
+#include "wmi-tlv.h"
 #include "mac.h"
 #include "testmode.h"
+#include "wmi-ops.h"
 
 /* MAIN WMI cmd track */
 static struct wmi_cmd_map wmi_cmd_map = {
@@ -143,6 +145,7 @@ static struct wmi_cmd_map wmi_cmd_map = {
         .force_fw_hang_cmdid = WMI_FORCE_FW_HANG_CMDID,
         .gpio_config_cmdid = WMI_GPIO_CONFIG_CMDID,
         .gpio_output_cmdid = WMI_GPIO_OUTPUT_CMDID,
+        .pdev_get_temperature_cmdid = WMI_CMD_UNSUPPORTED,
 };
 
 /* 10.X WMI cmd track */
@@ -265,6 +268,129 @@ static struct wmi_cmd_map wmi_10x_cmd_map = {
         .force_fw_hang_cmdid = WMI_CMD_UNSUPPORTED,
         .gpio_config_cmdid = WMI_10X_GPIO_CONFIG_CMDID,
         .gpio_output_cmdid = WMI_10X_GPIO_OUTPUT_CMDID,
+        .pdev_get_temperature_cmdid = WMI_CMD_UNSUPPORTED,
+};
+
+/* 10.2.4 WMI cmd track */
+static struct wmi_cmd_map wmi_10_2_4_cmd_map = {
+        .init_cmdid = WMI_10_2_INIT_CMDID,
+        .start_scan_cmdid = WMI_10_2_START_SCAN_CMDID,
+        .stop_scan_cmdid = WMI_10_2_STOP_SCAN_CMDID,
+        .scan_chan_list_cmdid = WMI_10_2_SCAN_CHAN_LIST_CMDID,
+        .scan_sch_prio_tbl_cmdid = WMI_CMD_UNSUPPORTED,
+        .pdev_set_regdomain_cmdid = WMI_10_2_PDEV_SET_REGDOMAIN_CMDID,
+        .pdev_set_channel_cmdid = WMI_10_2_PDEV_SET_CHANNEL_CMDID,
+        .pdev_set_param_cmdid = WMI_10_2_PDEV_SET_PARAM_CMDID,
+        .pdev_pktlog_enable_cmdid = WMI_10_2_PDEV_PKTLOG_ENABLE_CMDID,
+        .pdev_pktlog_disable_cmdid = WMI_10_2_PDEV_PKTLOG_DISABLE_CMDID,
+        .pdev_set_wmm_params_cmdid = WMI_10_2_PDEV_SET_WMM_PARAMS_CMDID,
+        .pdev_set_ht_cap_ie_cmdid = WMI_10_2_PDEV_SET_HT_CAP_IE_CMDID,
+        .pdev_set_vht_cap_ie_cmdid = WMI_10_2_PDEV_SET_VHT_CAP_IE_CMDID,
+        .pdev_set_quiet_mode_cmdid = WMI_10_2_PDEV_SET_QUIET_MODE_CMDID,
+        .pdev_green_ap_ps_enable_cmdid = WMI_10_2_PDEV_GREEN_AP_PS_ENABLE_CMDID,
+        .pdev_get_tpc_config_cmdid = WMI_10_2_PDEV_GET_TPC_CONFIG_CMDID,
+        .pdev_set_base_macaddr_cmdid = WMI_10_2_PDEV_SET_BASE_MACADDR_CMDID,
+        .vdev_create_cmdid = WMI_10_2_VDEV_CREATE_CMDID,
+        .vdev_delete_cmdid = WMI_10_2_VDEV_DELETE_CMDID,
+        .vdev_start_request_cmdid = WMI_10_2_VDEV_START_REQUEST_CMDID,
+        .vdev_restart_request_cmdid = WMI_10_2_VDEV_RESTART_REQUEST_CMDID,
+        .vdev_up_cmdid = WMI_10_2_VDEV_UP_CMDID,
+        .vdev_stop_cmdid = WMI_10_2_VDEV_STOP_CMDID,
+        .vdev_down_cmdid = WMI_10_2_VDEV_DOWN_CMDID,
+        .vdev_set_param_cmdid = WMI_10_2_VDEV_SET_PARAM_CMDID,
+        .vdev_install_key_cmdid = WMI_10_2_VDEV_INSTALL_KEY_CMDID,
+        .peer_create_cmdid = WMI_10_2_PEER_CREATE_CMDID,
+        .peer_delete_cmdid = WMI_10_2_PEER_DELETE_CMDID,
+        .peer_flush_tids_cmdid = WMI_10_2_PEER_FLUSH_TIDS_CMDID,
+        .peer_set_param_cmdid = WMI_10_2_PEER_SET_PARAM_CMDID,
+        .peer_assoc_cmdid = WMI_10_2_PEER_ASSOC_CMDID,
+        .peer_add_wds_entry_cmdid = WMI_10_2_PEER_ADD_WDS_ENTRY_CMDID,
+        .peer_remove_wds_entry_cmdid = WMI_10_2_PEER_REMOVE_WDS_ENTRY_CMDID,
+        .peer_mcast_group_cmdid = WMI_10_2_PEER_MCAST_GROUP_CMDID,
+        .bcn_tx_cmdid = WMI_10_2_BCN_TX_CMDID,
+        .pdev_send_bcn_cmdid = WMI_10_2_PDEV_SEND_BCN_CMDID,
+        .bcn_tmpl_cmdid = WMI_CMD_UNSUPPORTED,
+        .bcn_filter_rx_cmdid = WMI_10_2_BCN_FILTER_RX_CMDID,
+        .prb_req_filter_rx_cmdid = WMI_10_2_PRB_REQ_FILTER_RX_CMDID,
+        .mgmt_tx_cmdid = WMI_10_2_MGMT_TX_CMDID,
+        .prb_tmpl_cmdid = WMI_CMD_UNSUPPORTED,
+        .addba_clear_resp_cmdid = WMI_10_2_ADDBA_CLEAR_RESP_CMDID,
+        .addba_send_cmdid = WMI_10_2_ADDBA_SEND_CMDID,
+        .addba_status_cmdid = WMI_10_2_ADDBA_STATUS_CMDID,
+        .delba_send_cmdid = WMI_10_2_DELBA_SEND_CMDID,
+        .addba_set_resp_cmdid = WMI_10_2_ADDBA_SET_RESP_CMDID,
+        .send_singleamsdu_cmdid = WMI_10_2_SEND_SINGLEAMSDU_CMDID,
+        .sta_powersave_mode_cmdid = WMI_10_2_STA_POWERSAVE_MODE_CMDID,
+        .sta_powersave_param_cmdid = WMI_10_2_STA_POWERSAVE_PARAM_CMDID,
+        .sta_mimo_ps_mode_cmdid = WMI_10_2_STA_MIMO_PS_MODE_CMDID,
+        .pdev_dfs_enable_cmdid = WMI_10_2_PDEV_DFS_ENABLE_CMDID,
+        .pdev_dfs_disable_cmdid = WMI_10_2_PDEV_DFS_DISABLE_CMDID,
+        .roam_scan_mode = WMI_10_2_ROAM_SCAN_MODE,
+        .roam_scan_rssi_threshold = WMI_10_2_ROAM_SCAN_RSSI_THRESHOLD,
+        .roam_scan_period = WMI_10_2_ROAM_SCAN_PERIOD,
+        .roam_scan_rssi_change_threshold =
+                                WMI_10_2_ROAM_SCAN_RSSI_CHANGE_THRESHOLD,
+        .roam_ap_profile = WMI_10_2_ROAM_AP_PROFILE,
+        .ofl_scan_add_ap_profile = WMI_10_2_OFL_SCAN_ADD_AP_PROFILE,
+        .ofl_scan_remove_ap_profile = WMI_10_2_OFL_SCAN_REMOVE_AP_PROFILE,
+        .ofl_scan_period = WMI_10_2_OFL_SCAN_PERIOD,
+        .p2p_dev_set_device_info = WMI_10_2_P2P_DEV_SET_DEVICE_INFO,
+        .p2p_dev_set_discoverability = WMI_10_2_P2P_DEV_SET_DISCOVERABILITY,
+        .p2p_go_set_beacon_ie = WMI_10_2_P2P_GO_SET_BEACON_IE,
+        .p2p_go_set_probe_resp_ie = WMI_10_2_P2P_GO_SET_PROBE_RESP_IE,
+        .p2p_set_vendor_ie_data_cmdid = WMI_CMD_UNSUPPORTED,
+        .ap_ps_peer_param_cmdid = WMI_10_2_AP_PS_PEER_PARAM_CMDID,
+        .ap_ps_peer_uapsd_coex_cmdid = WMI_CMD_UNSUPPORTED,
+        .peer_rate_retry_sched_cmdid = WMI_10_2_PEER_RATE_RETRY_SCHED_CMDID,
+        .wlan_profile_trigger_cmdid = WMI_10_2_WLAN_PROFILE_TRIGGER_CMDID,
+        .wlan_profile_set_hist_intvl_cmdid =
+                                WMI_10_2_WLAN_PROFILE_SET_HIST_INTVL_CMDID,
+        .wlan_profile_get_profile_data_cmdid =
+                                WMI_10_2_WLAN_PROFILE_GET_PROFILE_DATA_CMDID,
+        .wlan_profile_enable_profile_id_cmdid =
+                                WMI_10_2_WLAN_PROFILE_ENABLE_PROFILE_ID_CMDID,
+        .wlan_profile_list_profile_id_cmdid =
+                                WMI_10_2_WLAN_PROFILE_LIST_PROFILE_ID_CMDID,
+        .pdev_suspend_cmdid = WMI_10_2_PDEV_SUSPEND_CMDID,
+        .pdev_resume_cmdid = WMI_10_2_PDEV_RESUME_CMDID,
+        .add_bcn_filter_cmdid = WMI_10_2_ADD_BCN_FILTER_CMDID,
+        .rmv_bcn_filter_cmdid = WMI_10_2_RMV_BCN_FILTER_CMDID,
+        .wow_add_wake_pattern_cmdid = WMI_10_2_WOW_ADD_WAKE_PATTERN_CMDID,
+        .wow_del_wake_pattern_cmdid = WMI_10_2_WOW_DEL_WAKE_PATTERN_CMDID,
+        .wow_enable_disable_wake_event_cmdid =
+                                WMI_10_2_WOW_ENABLE_DISABLE_WAKE_EVENT_CMDID,
+        .wow_enable_cmdid = WMI_10_2_WOW_ENABLE_CMDID,
+        .wow_hostwakeup_from_sleep_cmdid =
+                                WMI_10_2_WOW_HOSTWAKEUP_FROM_SLEEP_CMDID,
+        .rtt_measreq_cmdid = WMI_10_2_RTT_MEASREQ_CMDID,
+        .rtt_tsf_cmdid = WMI_10_2_RTT_TSF_CMDID,
+        .vdev_spectral_scan_configure_cmdid =
+                                WMI_10_2_VDEV_SPECTRAL_SCAN_CONFIGURE_CMDID,
+        .vdev_spectral_scan_enable_cmdid =
+                                WMI_10_2_VDEV_SPECTRAL_SCAN_ENABLE_CMDID,
+        .request_stats_cmdid = WMI_10_2_REQUEST_STATS_CMDID,
+        .set_arp_ns_offload_cmdid = WMI_CMD_UNSUPPORTED,
+        .network_list_offload_config_cmdid = WMI_CMD_UNSUPPORTED,
+        .gtk_offload_cmdid = WMI_CMD_UNSUPPORTED,
+        .csa_offload_enable_cmdid = WMI_CMD_UNSUPPORTED,
+        .csa_offload_chanswitch_cmdid = WMI_CMD_UNSUPPORTED,
+        .chatter_set_mode_cmdid = WMI_CMD_UNSUPPORTED,
+        .peer_tid_addba_cmdid = WMI_CMD_UNSUPPORTED,
+        .peer_tid_delba_cmdid = WMI_CMD_UNSUPPORTED,
+        .sta_dtim_ps_method_cmdid = WMI_CMD_UNSUPPORTED,
+        .sta_uapsd_auto_trig_cmdid = WMI_CMD_UNSUPPORTED,
+        .sta_keepalive_cmd = WMI_CMD_UNSUPPORTED,
+        .echo_cmdid = WMI_10_2_ECHO_CMDID,
+        .pdev_utf_cmdid = WMI_10_2_PDEV_UTF_CMDID,
+        .dbglog_cfg_cmdid = WMI_10_2_DBGLOG_CFG_CMDID,
+        .pdev_qvit_cmdid = WMI_10_2_PDEV_QVIT_CMDID,
+        .pdev_ftm_intg_cmdid = WMI_CMD_UNSUPPORTED,
+        .vdev_set_keepalive_cmdid = WMI_CMD_UNSUPPORTED,
+        .vdev_get_keepalive_cmdid = WMI_CMD_UNSUPPORTED,
+        .force_fw_hang_cmdid = WMI_CMD_UNSUPPORTED,
+        .gpio_config_cmdid = WMI_10_2_GPIO_CONFIG_CMDID,
+        .gpio_output_cmdid = WMI_10_2_GPIO_OUTPUT_CMDID,
+        .pdev_get_temperature_cmdid = WMI_10_2_PDEV_GET_TEMPERATURE_CMDID,
 };
 
 /* MAIN WMI VDEV param map */
@@ -385,6 +511,64 @@ static struct wmi_vdev_param_map wmi_10x_vdev_param_map = {
                 WMI_10X_VDEV_PARAM_AP_DETECT_OUT_OF_SYNC_SLEEPING_STA_TIME_SECS,
 };
 
+static struct wmi_vdev_param_map wmi_10_2_4_vdev_param_map = {
+        .rts_threshold = WMI_10X_VDEV_PARAM_RTS_THRESHOLD,
+        .fragmentation_threshold = WMI_10X_VDEV_PARAM_FRAGMENTATION_THRESHOLD,
+        .beacon_interval = WMI_10X_VDEV_PARAM_BEACON_INTERVAL,
+        .listen_interval = WMI_10X_VDEV_PARAM_LISTEN_INTERVAL,
+        .multicast_rate = WMI_10X_VDEV_PARAM_MULTICAST_RATE,
+        .mgmt_tx_rate = WMI_10X_VDEV_PARAM_MGMT_TX_RATE,
+        .slot_time = WMI_10X_VDEV_PARAM_SLOT_TIME,
+        .preamble = WMI_10X_VDEV_PARAM_PREAMBLE,
+        .swba_time = WMI_10X_VDEV_PARAM_SWBA_TIME,
+        .wmi_vdev_stats_update_period = WMI_10X_VDEV_STATS_UPDATE_PERIOD,
+        .wmi_vdev_pwrsave_ageout_time = WMI_10X_VDEV_PWRSAVE_AGEOUT_TIME,
+        .wmi_vdev_host_swba_interval = WMI_10X_VDEV_HOST_SWBA_INTERVAL,
+        .dtim_period = WMI_10X_VDEV_PARAM_DTIM_PERIOD,
+        .wmi_vdev_oc_scheduler_air_time_limit =
+                                WMI_10X_VDEV_OC_SCHEDULER_AIR_TIME_LIMIT,
+        .wds = WMI_10X_VDEV_PARAM_WDS,
+        .atim_window = WMI_10X_VDEV_PARAM_ATIM_WINDOW,
+        .bmiss_count_max = WMI_10X_VDEV_PARAM_BMISS_COUNT_MAX,
+        .bmiss_first_bcnt = WMI_VDEV_PARAM_UNSUPPORTED,
+        .bmiss_final_bcnt = WMI_VDEV_PARAM_UNSUPPORTED,
+        .feature_wmm = WMI_10X_VDEV_PARAM_FEATURE_WMM,
+        .chwidth = WMI_10X_VDEV_PARAM_CHWIDTH,
+        .chextoffset = WMI_10X_VDEV_PARAM_CHEXTOFFSET,
+        .disable_htprotection = WMI_10X_VDEV_PARAM_DISABLE_HTPROTECTION,
+        .sta_quickkickout = WMI_10X_VDEV_PARAM_STA_QUICKKICKOUT,
+        .mgmt_rate = WMI_10X_VDEV_PARAM_MGMT_RATE,
+        .protection_mode = WMI_10X_VDEV_PARAM_PROTECTION_MODE,
+        .fixed_rate = WMI_10X_VDEV_PARAM_FIXED_RATE,
+        .sgi = WMI_10X_VDEV_PARAM_SGI,
+        .ldpc = WMI_10X_VDEV_PARAM_LDPC,
+        .tx_stbc = WMI_10X_VDEV_PARAM_TX_STBC,
+        .rx_stbc = WMI_10X_VDEV_PARAM_RX_STBC,
+        .intra_bss_fwd = WMI_10X_VDEV_PARAM_INTRA_BSS_FWD,
+        .def_keyid = WMI_10X_VDEV_PARAM_DEF_KEYID,
+        .nss = WMI_10X_VDEV_PARAM_NSS,
+        .bcast_data_rate = WMI_10X_VDEV_PARAM_BCAST_DATA_RATE,
+        .mcast_data_rate = WMI_10X_VDEV_PARAM_MCAST_DATA_RATE,
+        .mcast_indicate = WMI_10X_VDEV_PARAM_MCAST_INDICATE,
+        .dhcp_indicate = WMI_10X_VDEV_PARAM_DHCP_INDICATE,
+        .unknown_dest_indicate = WMI_10X_VDEV_PARAM_UNKNOWN_DEST_INDICATE,
+        .ap_keepalive_min_idle_inactive_time_secs =
+                WMI_10X_VDEV_PARAM_AP_KEEPALIVE_MIN_IDLE_INACTIVE_TIME_SECS,
+        .ap_keepalive_max_idle_inactive_time_secs =
+                WMI_10X_VDEV_PARAM_AP_KEEPALIVE_MAX_IDLE_INACTIVE_TIME_SECS,
+        .ap_keepalive_max_unresponsive_time_secs =
+                WMI_10X_VDEV_PARAM_AP_KEEPALIVE_MAX_UNRESPONSIVE_TIME_SECS,
+        .ap_enable_nawds = WMI_10X_VDEV_PARAM_AP_ENABLE_NAWDS,
+        .mcast2ucast_set = WMI_10X_VDEV_PARAM_MCAST2UCAST_SET,
+        .enable_rtscts = WMI_10X_VDEV_PARAM_ENABLE_RTSCTS,
+        .txbf = WMI_VDEV_PARAM_UNSUPPORTED,
+        .packet_powersave = WMI_VDEV_PARAM_UNSUPPORTED,
+        .drop_unencry = WMI_VDEV_PARAM_UNSUPPORTED,
+        .tx_encap_type = WMI_VDEV_PARAM_UNSUPPORTED,
+        .ap_detect_out_of_sync_sleeping_sta_time_secs =
+                WMI_10X_VDEV_PARAM_AP_DETECT_OUT_OF_SYNC_SLEEPING_STA_TIME_SECS,
+};
+
 static struct wmi_pdev_param_map wmi_pdev_param_map = {
         .tx_chain_mask = WMI_PDEV_PARAM_TX_CHAIN_MASK,
         .rx_chain_mask = WMI_PDEV_PARAM_RX_CHAIN_MASK,
@@ -434,6 +618,7 @@ static struct wmi_pdev_param_map wmi_pdev_param_map = {
         .fast_channel_reset = WMI_PDEV_PARAM_UNSUPPORTED,
         .burst_dur = WMI_PDEV_PARAM_UNSUPPORTED,
         .burst_enable = WMI_PDEV_PARAM_UNSUPPORTED,
+        .cal_period = WMI_PDEV_PARAM_UNSUPPORTED,
 };
 
 static struct wmi_pdev_param_map wmi_10x_pdev_param_map = {
@@ -486,6 +671,60 @@ static struct wmi_pdev_param_map wmi_10x_pdev_param_map = {
         .fast_channel_reset = WMI_10X_PDEV_PARAM_FAST_CHANNEL_RESET,
         .burst_dur = WMI_10X_PDEV_PARAM_BURST_DUR,
         .burst_enable = WMI_10X_PDEV_PARAM_BURST_ENABLE,
+        .cal_period = WMI_10X_PDEV_PARAM_CAL_PERIOD,
+};
+
+static struct wmi_pdev_param_map wmi_10_2_4_pdev_param_map = {
+        .tx_chain_mask = WMI_10X_PDEV_PARAM_TX_CHAIN_MASK,
+        .rx_chain_mask = WMI_10X_PDEV_PARAM_RX_CHAIN_MASK,
+        .txpower_limit2g = WMI_10X_PDEV_PARAM_TXPOWER_LIMIT2G,
+        .txpower_limit5g = WMI_10X_PDEV_PARAM_TXPOWER_LIMIT5G,
+        .txpower_scale = WMI_10X_PDEV_PARAM_TXPOWER_SCALE,
+        .beacon_gen_mode = WMI_10X_PDEV_PARAM_BEACON_GEN_MODE,
+        .beacon_tx_mode = WMI_10X_PDEV_PARAM_BEACON_TX_MODE,
+        .resmgr_offchan_mode = WMI_10X_PDEV_PARAM_RESMGR_OFFCHAN_MODE,
+        .protection_mode = WMI_10X_PDEV_PARAM_PROTECTION_MODE,
+        .dynamic_bw = WMI_10X_PDEV_PARAM_DYNAMIC_BW,
+        .non_agg_sw_retry_th = WMI_10X_PDEV_PARAM_NON_AGG_SW_RETRY_TH,
+        .agg_sw_retry_th = WMI_10X_PDEV_PARAM_AGG_SW_RETRY_TH,
+        .sta_kickout_th = WMI_10X_PDEV_PARAM_STA_KICKOUT_TH,
+        .ac_aggrsize_scaling = WMI_10X_PDEV_PARAM_AC_AGGRSIZE_SCALING,
+        .ltr_enable = WMI_10X_PDEV_PARAM_LTR_ENABLE,
+        .ltr_ac_latency_be = WMI_10X_PDEV_PARAM_LTR_AC_LATENCY_BE,
+        .ltr_ac_latency_bk = WMI_10X_PDEV_PARAM_LTR_AC_LATENCY_BK,
+        .ltr_ac_latency_vi = WMI_10X_PDEV_PARAM_LTR_AC_LATENCY_VI,
+        .ltr_ac_latency_vo = WMI_10X_PDEV_PARAM_LTR_AC_LATENCY_VO,
+        .ltr_ac_latency_timeout = WMI_10X_PDEV_PARAM_LTR_AC_LATENCY_TIMEOUT,
+        .ltr_sleep_override = WMI_10X_PDEV_PARAM_LTR_SLEEP_OVERRIDE,
+        .ltr_rx_override = WMI_10X_PDEV_PARAM_LTR_RX_OVERRIDE,
+        .ltr_tx_activity_timeout = WMI_10X_PDEV_PARAM_LTR_TX_ACTIVITY_TIMEOUT,
+        .l1ss_enable = WMI_10X_PDEV_PARAM_L1SS_ENABLE,
+        .dsleep_enable = WMI_10X_PDEV_PARAM_DSLEEP_ENABLE,
+        .pcielp_txbuf_flush = WMI_PDEV_PARAM_UNSUPPORTED,
+        .pcielp_txbuf_watermark = WMI_PDEV_PARAM_UNSUPPORTED,
+        .pcielp_txbuf_tmo_en = WMI_PDEV_PARAM_UNSUPPORTED,
+        .pcielp_txbuf_tmo_value = WMI_PDEV_PARAM_UNSUPPORTED,
+        .pdev_stats_update_period = WMI_10X_PDEV_PARAM_PDEV_STATS_UPDATE_PERIOD,
+        .vdev_stats_update_period = WMI_10X_PDEV_PARAM_VDEV_STATS_UPDATE_PERIOD,
+        .peer_stats_update_period = WMI_10X_PDEV_PARAM_PEER_STATS_UPDATE_PERIOD,
+        .bcnflt_stats_update_period =
+                                WMI_10X_PDEV_PARAM_BCNFLT_STATS_UPDATE_PERIOD,
+        .pmf_qos = WMI_10X_PDEV_PARAM_PMF_QOS,
+        .arp_ac_override = WMI_10X_PDEV_PARAM_ARPDHCP_AC_OVERRIDE,
+        .dcs = WMI_10X_PDEV_PARAM_DCS,
+        .ani_enable = WMI_10X_PDEV_PARAM_ANI_ENABLE,
+        .ani_poll_period = WMI_10X_PDEV_PARAM_ANI_POLL_PERIOD,
+        .ani_listen_period = WMI_10X_PDEV_PARAM_ANI_LISTEN_PERIOD,
+        .ani_ofdm_level = WMI_10X_PDEV_PARAM_ANI_OFDM_LEVEL,
+        .ani_cck_level = WMI_10X_PDEV_PARAM_ANI_CCK_LEVEL,
+        .dyntxchain = WMI_10X_PDEV_PARAM_DYNTXCHAIN,
+        .proxy_sta = WMI_PDEV_PARAM_UNSUPPORTED,
+        .idle_ps_config = WMI_PDEV_PARAM_UNSUPPORTED,
+        .power_gating_sleep = WMI_PDEV_PARAM_UNSUPPORTED,
+        .fast_channel_reset = WMI_10X_PDEV_PARAM_FAST_CHANNEL_RESET,
+        .burst_dur = WMI_10X_PDEV_PARAM_BURST_DUR,
+        .burst_enable = WMI_10X_PDEV_PARAM_BURST_ENABLE,
+        .cal_period = WMI_10X_PDEV_PARAM_CAL_PERIOD,
 };
 
 /* firmware 10.2 specific mappings */
@@ -607,11 +846,11 @@ static struct wmi_cmd_map wmi_10_2_cmd_map = {
         .force_fw_hang_cmdid = WMI_CMD_UNSUPPORTED,
         .gpio_config_cmdid = WMI_10_2_GPIO_CONFIG_CMDID,
         .gpio_output_cmdid = WMI_10_2_GPIO_OUTPUT_CMDID,
+        .pdev_get_temperature_cmdid = WMI_CMD_UNSUPPORTED,
 };
 
-static void
-ath10k_wmi_put_wmi_channel(struct wmi_channel *ch,
-                           const struct wmi_channel_arg *arg)
+void ath10k_wmi_put_wmi_channel(struct wmi_channel *ch,
+                                const struct wmi_channel_arg *arg)
 {
         u32 flags = 0;
 
@@ -685,8 +924,8 @@ static void ath10k_wmi_htc_tx_complete(struct ath10k *ar, struct sk_buff *skb)
         dev_kfree_skb(skb);
 }
 
-static int ath10k_wmi_cmd_send_nowait(struct ath10k *ar, struct sk_buff *skb,
-                                      u32 cmd_id)
+int ath10k_wmi_cmd_send_nowait(struct ath10k *ar, struct sk_buff *skb,
+                               u32 cmd_id)
 {
         struct ath10k_skb_cb *skb_cb = ATH10K_SKB_CB(skb);
         struct wmi_cmd_hdr *cmd_hdr;
@@ -717,23 +956,45 @@ err_pull:
 
 static void ath10k_wmi_tx_beacon_nowait(struct ath10k_vif *arvif)
 {
+        struct ath10k *ar = arvif->ar;
+        struct ath10k_skb_cb *cb;
+        struct sk_buff *bcn;
         int ret;
 
-        lockdep_assert_held(&arvif->ar->data_lock);
+        spin_lock_bh(&ar->data_lock);
 
-        if (arvif->beacon == NULL)
-                return;
+        bcn = arvif->beacon;
 
-        if (arvif->beacon_sent)
-                return;
+        if (!bcn)
+                goto unlock;
 
-        ret = ath10k_wmi_beacon_send_ref_nowait(arvif);
-        if (ret)
-                return;
+        cb = ATH10K_SKB_CB(bcn);
+
+        switch (arvif->beacon_state) {
+        case ATH10K_BEACON_SENDING:
+        case ATH10K_BEACON_SENT:
+                break;
+        case ATH10K_BEACON_SCHEDULED:
+                arvif->beacon_state = ATH10K_BEACON_SENDING;
+                spin_unlock_bh(&ar->data_lock);
+
+                ret = ath10k_wmi_beacon_send_ref_nowait(arvif->ar,
+                                                        arvif->vdev_id,
+                                                        bcn->data, bcn->len,
+                                                        cb->paddr,
+                                                        cb->bcn.dtim_zero,
+                                                        cb->bcn.deliver_cab);
+
+                spin_lock_bh(&ar->data_lock);
+
+                if (ret == 0)
+                        arvif->beacon_state = ATH10K_BEACON_SENT;
+                else
+                        arvif->beacon_state = ATH10K_BEACON_SCHEDULED;
+        }
 
-        /* We need to retain the arvif->beacon reference for DMA unmapping and
-         * freeing the skbuff later. */
-        arvif->beacon_sent = true;
+unlock:
+        spin_unlock_bh(&ar->data_lock);
 }
 
 static void ath10k_wmi_tx_beacons_iter(void *data, u8 *mac,
@@ -746,12 +1007,10 @@ static void ath10k_wmi_tx_beacons_iter(void *data, u8 *mac,
 
 static void ath10k_wmi_tx_beacons_nowait(struct ath10k *ar)
 {
-        spin_lock_bh(&ar->data_lock);
         ieee80211_iterate_active_interfaces_atomic(ar->hw,
                                                    IEEE80211_IFACE_ITER_NORMAL,
                                                    ath10k_wmi_tx_beacons_iter,
                                                    NULL);
-        spin_unlock_bh(&ar->data_lock);
 }
 
 static void ath10k_wmi_op_ep_tx_credits(struct ath10k *ar)
@@ -792,24 +1051,23 @@ int ath10k_wmi_cmd_send(struct ath10k *ar, struct sk_buff *skb, u32 cmd_id)
         return ret;
 }
 
-int ath10k_wmi_mgmt_tx(struct ath10k *ar, struct sk_buff *skb)
+static struct sk_buff *
+ath10k_wmi_op_gen_mgmt_tx(struct ath10k *ar, struct sk_buff *msdu)
 {
-        int ret = 0;
         struct wmi_mgmt_tx_cmd *cmd;
         struct ieee80211_hdr *hdr;
-        struct sk_buff *wmi_skb;
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct sk_buff *skb;
         int len;
-        u32 buf_len = skb->len;
+        u32 buf_len = msdu->len;
         u16 fc;
 
-        hdr = (struct ieee80211_hdr *)skb->data;
+        hdr = (struct ieee80211_hdr *)msdu->data;
         fc = le16_to_cpu(hdr->frame_control);
 
         if (WARN_ON_ONCE(!ieee80211_is_mgmt(hdr->frame_control)))
-                return -EINVAL;
+                return ERR_PTR(-EINVAL);
 
-        len = sizeof(cmd->hdr) + skb->len;
+        len = sizeof(cmd->hdr) + msdu->len;
 
         if ((ieee80211_is_action(hdr->frame_control) ||
              ieee80211_is_deauth(hdr->frame_control) ||
@@ -821,36 +1079,27 @@ int ath10k_wmi_mgmt_tx(struct ath10k *ar, struct sk_buff *skb)
 
         len = round_up(len, 4);
 
-        wmi_skb = ath10k_wmi_alloc_skb(ar, len);
-        if (!wmi_skb)
-                return -ENOMEM;
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
 
-        cmd = (struct wmi_mgmt_tx_cmd *)wmi_skb->data;
+        cmd = (struct wmi_mgmt_tx_cmd *)skb->data;
 
-        cmd->hdr.vdev_id = __cpu_to_le32(ATH10K_SKB_CB(skb)->vdev_id);
+        cmd->hdr.vdev_id = __cpu_to_le32(ATH10K_SKB_CB(msdu)->vdev_id);
         cmd->hdr.tx_rate = 0;
         cmd->hdr.tx_power = 0;
         cmd->hdr.buf_len = __cpu_to_le32(buf_len);
 
         ether_addr_copy(cmd->hdr.peer_macaddr.addr, ieee80211_get_DA(hdr));
-        memcpy(cmd->buf, skb->data, skb->len);
+        memcpy(cmd->buf, msdu->data, msdu->len);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi mgmt tx skb %p len %d ftype %02x stype %02x\n",
-                   wmi_skb, wmi_skb->len, fc & IEEE80211_FCTL_FTYPE,
+                   msdu, skb->len, fc & IEEE80211_FCTL_FTYPE,
                    fc & IEEE80211_FCTL_STYPE);
         trace_ath10k_tx_hdr(ar, skb->data, skb->len);
         trace_ath10k_tx_payload(ar, skb->data, skb->len);
 
-        /* Send the management frame buffer to the target */
-        ret = ath10k_wmi_cmd_send(ar, wmi_skb, ar->wmi.cmd->mgmt_tx_cmdid);
-        if (ret)
-                return ret;
-
-        /* TODO: report tx status to mac80211 - temporary just ACK */
-        info->flags |= IEEE80211_TX_STAT_ACK;
-        ieee80211_tx_status_irqsafe(ar->hw, skb);
-
-        return ret;
+        return skb;
 }
 
 static void ath10k_wmi_event_scan_started(struct ath10k *ar)
@@ -977,22 +1226,48 @@ ath10k_wmi_event_scan_type_str(enum wmi_scan_event_type type,
         }
 }
 
-static int ath10k_wmi_event_scan(struct ath10k *ar, struct sk_buff *skb)
+static int ath10k_wmi_op_pull_scan_ev(struct ath10k *ar, struct sk_buff *skb,
+                                      struct wmi_scan_ev_arg *arg)
 {
-        struct wmi_scan_event *event = (struct wmi_scan_event *)skb->data;
+        struct wmi_scan_event *ev = (void *)skb->data;
+
+        if (skb->len < sizeof(*ev))
+                return -EPROTO;
+
+        skb_pull(skb, sizeof(*ev));
+        arg->event_type = ev->event_type;
+        arg->reason = ev->reason;
+        arg->channel_freq = ev->channel_freq;
+        arg->scan_req_id = ev->scan_req_id;
+        arg->scan_id = ev->scan_id;
+        arg->vdev_id = ev->vdev_id;
+
+        return 0;
+}
+
+int ath10k_wmi_event_scan(struct ath10k *ar, struct sk_buff *skb)
+{
+        struct wmi_scan_ev_arg arg = {};
         enum wmi_scan_event_type event_type;
         enum wmi_scan_completion_reason reason;
         u32 freq;
         u32 req_id;
         u32 scan_id;
         u32 vdev_id;
+        int ret;
+
+        ret = ath10k_wmi_pull_scan(ar, skb, &arg);
+        if (ret) {
+                ath10k_warn(ar, "failed to parse scan event: %d\n", ret);
+                return ret;
+        }
 
-        event_type = __le32_to_cpu(event->event_type);
-        reason     = __le32_to_cpu(event->reason);
-        freq       = __le32_to_cpu(event->channel_freq);
-        req_id     = __le32_to_cpu(event->scan_req_id);
-        scan_id    = __le32_to_cpu(event->scan_id);
-        vdev_id    = __le32_to_cpu(event->vdev_id);
+        event_type = __le32_to_cpu(arg.event_type);
+        reason = __le32_to_cpu(arg.reason);
+        freq = __le32_to_cpu(arg.channel_freq);
+        req_id = __le32_to_cpu(arg.scan_req_id);
+        scan_id = __le32_to_cpu(arg.scan_id);
+        vdev_id = __le32_to_cpu(arg.vdev_id);
 
         spin_lock_bh(&ar->data_lock);
 
@@ -1147,11 +1422,51 @@ static void ath10k_wmi_handle_wep_reauth(struct ath10k *ar,
         }
 }
 
-static int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb)
+static int ath10k_wmi_op_pull_mgmt_rx_ev(struct ath10k *ar, struct sk_buff *skb,
+                                         struct wmi_mgmt_rx_ev_arg *arg)
 {
         struct wmi_mgmt_rx_event_v1 *ev_v1;
         struct wmi_mgmt_rx_event_v2 *ev_v2;
         struct wmi_mgmt_rx_hdr_v1 *ev_hdr;
+        size_t pull_len;
+        u32 msdu_len;
+
+        if (test_bit(ATH10K_FW_FEATURE_EXT_WMI_MGMT_RX, ar->fw_features)) {
+                ev_v2 = (struct wmi_mgmt_rx_event_v2 *)skb->data;
+                ev_hdr = &ev_v2->hdr.v1;
+                pull_len = sizeof(*ev_v2);
+        } else {
+                ev_v1 = (struct wmi_mgmt_rx_event_v1 *)skb->data;
+                ev_hdr = &ev_v1->hdr;
+                pull_len = sizeof(*ev_v1);
+        }
+
+        if (skb->len < pull_len)
+                return -EPROTO;
+
+        skb_pull(skb, pull_len);
+        arg->channel = ev_hdr->channel;
+        arg->buf_len = ev_hdr->buf_len;
+        arg->status = ev_hdr->status;
+        arg->snr = ev_hdr->snr;
+        arg->phy_mode = ev_hdr->phy_mode;
+        arg->rate = ev_hdr->rate;
+
+        msdu_len = __le32_to_cpu(arg->buf_len);
+        if (skb->len < msdu_len)
+                return -EPROTO;
+
+        /* the WMI buffer might've ended up being padded to 4 bytes due to HTC
+         * trailer with credit update. Trim the excess garbage.
+         */
+        skb_trim(skb, msdu_len);
+
+        return 0;
+}
+
+int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb)
+{
+        struct wmi_mgmt_rx_ev_arg arg = {};
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
         struct ieee80211_hdr *hdr;
         u32 rx_status;
@@ -1161,24 +1476,20 @@ static int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb)
         u32 rate;
         u32 buf_len;
         u16 fc;
-        int pull_len;
+        int ret;
 
-        if (test_bit(ATH10K_FW_FEATURE_EXT_WMI_MGMT_RX, ar->fw_features)) {
-                ev_v2 = (struct wmi_mgmt_rx_event_v2 *)skb->data;
-                ev_hdr = &ev_v2->hdr.v1;
-                pull_len = sizeof(*ev_v2);
-        } else {
-                ev_v1 = (struct wmi_mgmt_rx_event_v1 *)skb->data;
-                ev_hdr = &ev_v1->hdr;
-                pull_len = sizeof(*ev_v1);
+        ret = ath10k_wmi_pull_mgmt_rx(ar, skb, &arg);
+        if (ret) {
+                ath10k_warn(ar, "failed to parse mgmt rx event: %d\n", ret);
+                return ret;
         }
 
-        channel   = __le32_to_cpu(ev_hdr->channel);
-        buf_len   = __le32_to_cpu(ev_hdr->buf_len);
-        rx_status = __le32_to_cpu(ev_hdr->status);
-        snr       = __le32_to_cpu(ev_hdr->snr);
-        phy_mode  = __le32_to_cpu(ev_hdr->phy_mode);
-        rate      = __le32_to_cpu(ev_hdr->rate);
+        channel = __le32_to_cpu(arg.channel);
+        buf_len = __le32_to_cpu(arg.buf_len);
+        rx_status = __le32_to_cpu(arg.status);
+        snr = __le32_to_cpu(arg.snr);
+        phy_mode = __le32_to_cpu(arg.phy_mode);
+        rate = __le32_to_cpu(arg.rate);
 
         memset(status, 0, sizeof(*status));
 
@@ -1232,8 +1543,6 @@ static int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb)
         status->signal = snr + ATH10K_DEFAULT_NOISE_FLOOR;
         status->rate_idx = get_rate_idx(rate, status->band);
 
-        skb_pull(skb, pull_len);
-
         hdr = (struct ieee80211_hdr *)skb->data;
         fc = le16_to_cpu(hdr->frame_control);
 
@@ -1266,12 +1575,6 @@ static int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb)
                    status->freq, status->band, status->signal,
                    status->rate_idx);
 
-        /*
-         * packets from HTC come aligned to 4byte boundaries
-         * because they can originally come in along with a trailer
-         */
-        skb_trim(skb, buf_len);
-
         ieee80211_rx(ar->hw, skb);
         return 0;
 }
@@ -1295,21 +1598,44 @@ exit:
         return idx;
 }
 
-static void ath10k_wmi_event_chan_info(struct ath10k *ar, struct sk_buff *skb)
+static int ath10k_wmi_op_pull_ch_info_ev(struct ath10k *ar, struct sk_buff *skb,
+                                         struct wmi_ch_info_ev_arg *arg)
 {
-        struct wmi_chan_info_event *ev;
+        struct wmi_chan_info_event *ev = (void *)skb->data;
+
+        if (skb->len < sizeof(*ev))
+                return -EPROTO;
+
+        skb_pull(skb, sizeof(*ev));
+        arg->err_code = ev->err_code;
+        arg->freq = ev->freq;
+        arg->cmd_flags = ev->cmd_flags;
+        arg->noise_floor = ev->noise_floor;
+        arg->rx_clear_count = ev->rx_clear_count;
+        arg->cycle_count = ev->cycle_count;
+
+        return 0;
+}
+
+void ath10k_wmi_event_chan_info(struct ath10k *ar, struct sk_buff *skb)
+{
+        struct wmi_ch_info_ev_arg arg = {};
         struct survey_info *survey;
         u32 err_code, freq, cmd_flags, noise_floor, rx_clear_count, cycle_count;
-        int idx;
+        int idx, ret;
 
-        ev = (struct wmi_chan_info_event *)skb->data;
+        ret = ath10k_wmi_pull_ch_info(ar, skb, &arg);
+        if (ret) {
+                ath10k_warn(ar, "failed to parse chan info event: %d\n", ret);
+                return;
+        }
 
-        err_code = __le32_to_cpu(ev->err_code);
-        freq = __le32_to_cpu(ev->freq);
-        cmd_flags = __le32_to_cpu(ev->cmd_flags);
-        noise_floor = __le32_to_cpu(ev->noise_floor);
-        rx_clear_count = __le32_to_cpu(ev->rx_clear_count);
-        cycle_count = __le32_to_cpu(ev->cycle_count);
+        err_code = __le32_to_cpu(arg.err_code);
+        freq = __le32_to_cpu(arg.freq);
+        cmd_flags = __le32_to_cpu(arg.cmd_flags);
+        noise_floor = __le32_to_cpu(arg.noise_floor);
+        rx_clear_count = __le32_to_cpu(arg.rx_clear_count);
+        cycle_count = __le32_to_cpu(arg.cycle_count);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "chan info err_code %d freq %d cmd_flags %d noise_floor %d rx_clear_count %d cycle_count %d\n",
@@ -1344,11 +1670,11 @@ static void ath10k_wmi_event_chan_info(struct ath10k *ar, struct sk_buff *skb)
                 rx_clear_count -= ar->survey_last_rx_clear_count;
 
                 survey = &ar->survey[idx];
-                survey->channel_time = WMI_CHAN_INFO_MSEC(cycle_count);
-                survey->channel_time_rx = WMI_CHAN_INFO_MSEC(rx_clear_count);
+                survey->time = WMI_CHAN_INFO_MSEC(cycle_count);
+                survey->time_rx = WMI_CHAN_INFO_MSEC(rx_clear_count);
                 survey->noise = noise_floor;
-                survey->filled = SURVEY_INFO_CHANNEL_TIME |
-                                 SURVEY_INFO_CHANNEL_TIME_RX |
+                survey->filled = SURVEY_INFO_TIME |
+                                 SURVEY_INFO_TIME_RX |
                                  SURVEY_INFO_NOISE_DBM;
         }
 
@@ -1359,12 +1685,12 @@ exit:
         spin_unlock_bh(&ar->data_lock);
 }
 
-static void ath10k_wmi_event_echo(struct ath10k *ar, struct sk_buff *skb)
+void ath10k_wmi_event_echo(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_ECHO_EVENTID\n");
 }
 
-static int ath10k_wmi_event_debug_mesg(struct ath10k *ar, struct sk_buff *skb)
+int ath10k_wmi_event_debug_mesg(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi event debug mesg len %d\n",
                    skb->len);
@@ -1374,12 +1700,9 @@ static int ath10k_wmi_event_debug_mesg(struct ath10k *ar, struct sk_buff *skb)
         return 0;
 }
 
-static void ath10k_wmi_pull_pdev_stats(const struct wmi_pdev_stats *src,
-                                       struct ath10k_fw_stats_pdev *dst)
+void ath10k_wmi_pull_pdev_stats_base(const struct wmi_pdev_stats_base *src,
+                                     struct ath10k_fw_stats_pdev *dst)
 {
-        const struct wal_dbg_tx_stats *tx = &src->wal.tx;
-        const struct wal_dbg_rx_stats *rx = &src->wal.rx;
-
         dst->ch_noise_floor = __le32_to_cpu(src->chan_nf);
         dst->tx_frame_count = __le32_to_cpu(src->tx_frame_count);
         dst->rx_frame_count = __le32_to_cpu(src->rx_frame_count);
@@ -1387,57 +1710,76 @@ static void ath10k_wmi_pull_pdev_stats(const struct wmi_pdev_stats *src,
         dst->cycle_count = __le32_to_cpu(src->cycle_count);
         dst->phy_err_count = __le32_to_cpu(src->phy_err_count);
         dst->chan_tx_power = __le32_to_cpu(src->chan_tx_pwr);
+}
 
-        dst->comp_queued = __le32_to_cpu(tx->comp_queued);
-        dst->comp_delivered = __le32_to_cpu(tx->comp_delivered);
-        dst->msdu_enqued = __le32_to_cpu(tx->msdu_enqued);
-        dst->mpdu_enqued = __le32_to_cpu(tx->mpdu_enqued);
-        dst->wmm_drop = __le32_to_cpu(tx->wmm_drop);
-        dst->local_enqued = __le32_to_cpu(tx->local_enqued);
-        dst->local_freed = __le32_to_cpu(tx->local_freed);
-        dst->hw_queued = __le32_to_cpu(tx->hw_queued);
-        dst->hw_reaped = __le32_to_cpu(tx->hw_reaped);
-        dst->underrun = __le32_to_cpu(tx->underrun);
-        dst->tx_abort = __le32_to_cpu(tx->tx_abort);
-        dst->mpdus_requed = __le32_to_cpu(tx->mpdus_requed);
-        dst->tx_ko = __le32_to_cpu(tx->tx_ko);
-        dst->data_rc = __le32_to_cpu(tx->data_rc);
-        dst->self_triggers = __le32_to_cpu(tx->self_triggers);
-        dst->sw_retry_failure = __le32_to_cpu(tx->sw_retry_failure);
-        dst->illgl_rate_phy_err = __le32_to_cpu(tx->illgl_rate_phy_err);
-        dst->pdev_cont_xretry = __le32_to_cpu(tx->pdev_cont_xretry);
-        dst->pdev_tx_timeout = __le32_to_cpu(tx->pdev_tx_timeout);
-        dst->pdev_resets = __le32_to_cpu(tx->pdev_resets);
-        dst->phy_underrun = __le32_to_cpu(tx->phy_underrun);
-        dst->txop_ovf = __le32_to_cpu(tx->txop_ovf);
-
-        dst->mid_ppdu_route_change = __le32_to_cpu(rx->mid_ppdu_route_change);
-        dst->status_rcvd = __le32_to_cpu(rx->status_rcvd);
-        dst->r0_frags = __le32_to_cpu(rx->r0_frags);
-        dst->r1_frags = __le32_to_cpu(rx->r1_frags);
-        dst->r2_frags = __le32_to_cpu(rx->r2_frags);
-        dst->r3_frags = __le32_to_cpu(rx->r3_frags);
-        dst->htt_msdus = __le32_to_cpu(rx->htt_msdus);
-        dst->htt_mpdus = __le32_to_cpu(rx->htt_mpdus);
-        dst->loc_msdus = __le32_to_cpu(rx->loc_msdus);
-        dst->loc_mpdus = __le32_to_cpu(rx->loc_mpdus);
-        dst->oversize_amsdu = __le32_to_cpu(rx->oversize_amsdu);
-        dst->phy_errs = __le32_to_cpu(rx->phy_errs);
-        dst->phy_err_drop = __le32_to_cpu(rx->phy_err_drop);
-        dst->mpdu_errs = __le32_to_cpu(rx->mpdu_errs);
-}
-
-static void ath10k_wmi_pull_peer_stats(const struct wmi_peer_stats *src,
-                                       struct ath10k_fw_stats_peer *dst)
+void ath10k_wmi_pull_pdev_stats_tx(const struct wmi_pdev_stats_tx *src,
+                                   struct ath10k_fw_stats_pdev *dst)
+{
+        dst->comp_queued = __le32_to_cpu(src->comp_queued);
+        dst->comp_delivered = __le32_to_cpu(src->comp_delivered);
+        dst->msdu_enqued = __le32_to_cpu(src->msdu_enqued);
+        dst->mpdu_enqued = __le32_to_cpu(src->mpdu_enqued);
+        dst->wmm_drop = __le32_to_cpu(src->wmm_drop);
+        dst->local_enqued = __le32_to_cpu(src->local_enqued);
+        dst->local_freed = __le32_to_cpu(src->local_freed);
+        dst->hw_queued = __le32_to_cpu(src->hw_queued);
+        dst->hw_reaped = __le32_to_cpu(src->hw_reaped);
+        dst->underrun = __le32_to_cpu(src->underrun);
+        dst->tx_abort = __le32_to_cpu(src->tx_abort);
+        dst->mpdus_requed = __le32_to_cpu(src->mpdus_requed);
+        dst->tx_ko = __le32_to_cpu(src->tx_ko);
+        dst->data_rc = __le32_to_cpu(src->data_rc);
+        dst->self_triggers = __le32_to_cpu(src->self_triggers);
+        dst->sw_retry_failure = __le32_to_cpu(src->sw_retry_failure);
+        dst->illgl_rate_phy_err = __le32_to_cpu(src->illgl_rate_phy_err);
+        dst->pdev_cont_xretry = __le32_to_cpu(src->pdev_cont_xretry);
+        dst->pdev_tx_timeout = __le32_to_cpu(src->pdev_tx_timeout);
+        dst->pdev_resets = __le32_to_cpu(src->pdev_resets);
+        dst->phy_underrun = __le32_to_cpu(src->phy_underrun);
+        dst->txop_ovf = __le32_to_cpu(src->txop_ovf);
+}
+
+void ath10k_wmi_pull_pdev_stats_rx(const struct wmi_pdev_stats_rx *src,
+                                   struct ath10k_fw_stats_pdev *dst)
+{
+        dst->mid_ppdu_route_change = __le32_to_cpu(src->mid_ppdu_route_change);
+        dst->status_rcvd = __le32_to_cpu(src->status_rcvd);
+        dst->r0_frags = __le32_to_cpu(src->r0_frags);
+        dst->r1_frags = __le32_to_cpu(src->r1_frags);
+        dst->r2_frags = __le32_to_cpu(src->r2_frags);
+        dst->r3_frags = __le32_to_cpu(src->r3_frags);
+        dst->htt_msdus = __le32_to_cpu(src->htt_msdus);
+        dst->htt_mpdus = __le32_to_cpu(src->htt_mpdus);
+        dst->loc_msdus = __le32_to_cpu(src->loc_msdus);
+        dst->loc_mpdus = __le32_to_cpu(src->loc_mpdus);
+        dst->oversize_amsdu = __le32_to_cpu(src->oversize_amsdu);
+        dst->phy_errs = __le32_to_cpu(src->phy_errs);
+        dst->phy_err_drop = __le32_to_cpu(src->phy_err_drop);
+        dst->mpdu_errs = __le32_to_cpu(src->mpdu_errs);
+}
+
+void ath10k_wmi_pull_pdev_stats_extra(const struct wmi_pdev_stats_extra *src,
+                                      struct ath10k_fw_stats_pdev *dst)
+{
+        dst->ack_rx_bad = __le32_to_cpu(src->ack_rx_bad);
+        dst->rts_bad = __le32_to_cpu(src->rts_bad);
+        dst->rts_good = __le32_to_cpu(src->rts_good);
+        dst->fcs_bad = __le32_to_cpu(src->fcs_bad);
+        dst->no_beacons = __le32_to_cpu(src->no_beacons);
+        dst->mib_int_count = __le32_to_cpu(src->mib_int_count);
+}
+
+void ath10k_wmi_pull_peer_stats(const struct wmi_peer_stats *src,
+                                struct ath10k_fw_stats_peer *dst)
 {
         ether_addr_copy(dst->peer_macaddr, src->peer_macaddr.addr);
         dst->peer_rssi = __le32_to_cpu(src->peer_rssi);
         dst->peer_tx_rate = __le32_to_cpu(src->peer_tx_rate);
 }
 
-static int ath10k_wmi_main_pull_fw_stats(struct ath10k *ar,
-                                         struct sk_buff *skb,
-                                         struct ath10k_fw_stats *stats)
+static int ath10k_wmi_main_op_pull_fw_stats(struct ath10k *ar,
+                                            struct sk_buff *skb,
+                                            struct ath10k_fw_stats *stats)
 {
         const struct wmi_stats_event *ev = (void *)skb->data;
         u32 num_pdev_stats, num_vdev_stats, num_peer_stats;
@@ -1462,7 +1804,10 @@ static int ath10k_wmi_main_pull_fw_stats(struct ath10k *ar,
                 if (!dst)
                         continue;
 
-                ath10k_wmi_pull_pdev_stats(src, dst);
+                ath10k_wmi_pull_pdev_stats_base(&src->base, dst);
+                ath10k_wmi_pull_pdev_stats_tx(&src->tx, dst);
+                ath10k_wmi_pull_pdev_stats_rx(&src->rx, dst);
+
                 list_add_tail(&dst->list, &stats->pdevs);
         }
 
@@ -1487,9 +1832,9 @@ static int ath10k_wmi_main_pull_fw_stats(struct ath10k *ar,
         return 0;
 }
 
-static int ath10k_wmi_10x_pull_fw_stats(struct ath10k *ar,
-                                        struct sk_buff *skb,
-                                        struct ath10k_fw_stats *stats)
+static int ath10k_wmi_10x_op_pull_fw_stats(struct ath10k *ar,
+                                           struct sk_buff *skb,
+                                           struct ath10k_fw_stats *stats)
 {
         const struct wmi_stats_event *ev = (void *)skb->data;
         u32 num_pdev_stats, num_vdev_stats, num_peer_stats;
@@ -1514,14 +1859,10 @@ static int ath10k_wmi_10x_pull_fw_stats(struct ath10k *ar,
                 if (!dst)
                         continue;
 
-                ath10k_wmi_pull_pdev_stats(&src->old, dst);
-
-                dst->ack_rx_bad = __le32_to_cpu(src->ack_rx_bad);
-                dst->rts_bad = __le32_to_cpu(src->rts_bad);
-                dst->rts_good = __le32_to_cpu(src->rts_good);
-                dst->fcs_bad = __le32_to_cpu(src->fcs_bad);
-                dst->no_beacons = __le32_to_cpu(src->no_beacons);
-                dst->mib_int_count = __le32_to_cpu(src->mib_int_count);
+                ath10k_wmi_pull_pdev_stats_base(&src->base, dst);
+                ath10k_wmi_pull_pdev_stats_tx(&src->tx, dst);
+                ath10k_wmi_pull_pdev_stats_rx(&src->rx, dst);
+                ath10k_wmi_pull_pdev_stats_extra(&src->extra, dst);
 
                 list_add_tail(&dst->list, &stats->pdevs);
         }
@@ -1550,61 +1891,250 @@ static int ath10k_wmi_10x_pull_fw_stats(struct ath10k *ar,
         return 0;
 }
 
-int ath10k_wmi_pull_fw_stats(struct ath10k *ar, struct sk_buff *skb,
-                             struct ath10k_fw_stats *stats)
+static int ath10k_wmi_10_2_op_pull_fw_stats(struct ath10k *ar,
+                                            struct sk_buff *skb,
+                                            struct ath10k_fw_stats *stats)
 {
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features))
-                return ath10k_wmi_10x_pull_fw_stats(ar, skb, stats);
-        else
-                return ath10k_wmi_main_pull_fw_stats(ar, skb, stats);
+        const struct wmi_10_2_stats_event *ev = (void *)skb->data;
+        u32 num_pdev_stats;
+        u32 num_pdev_ext_stats;
+        u32 num_vdev_stats;
+        u32 num_peer_stats;
+        int i;
+
+        if (!skb_pull(skb, sizeof(*ev)))
+                return -EPROTO;
+
+        num_pdev_stats = __le32_to_cpu(ev->num_pdev_stats);
+        num_pdev_ext_stats = __le32_to_cpu(ev->num_pdev_ext_stats);
+        num_vdev_stats = __le32_to_cpu(ev->num_vdev_stats);
+        num_peer_stats = __le32_to_cpu(ev->num_peer_stats);
+
+        for (i = 0; i < num_pdev_stats; i++) {
+                const struct wmi_10_2_pdev_stats *src;
+                struct ath10k_fw_stats_pdev *dst;
+
+                src = (void *)skb->data;
+                if (!skb_pull(skb, sizeof(*src)))
+                        return -EPROTO;
+
+                dst = kzalloc(sizeof(*dst), GFP_ATOMIC);
+                if (!dst)
+                        continue;
+
+                ath10k_wmi_pull_pdev_stats_base(&src->base, dst);
+                ath10k_wmi_pull_pdev_stats_tx(&src->tx, dst);
+                ath10k_wmi_pull_pdev_stats_rx(&src->rx, dst);
+                ath10k_wmi_pull_pdev_stats_extra(&src->extra, dst);
+                /* FIXME: expose 10.2 specific values */
+
+                list_add_tail(&dst->list, &stats->pdevs);
+        }
+
+        for (i = 0; i < num_pdev_ext_stats; i++) {
+                const struct wmi_10_2_pdev_ext_stats *src;
+
+                src = (void *)skb->data;
+                if (!skb_pull(skb, sizeof(*src)))
+                        return -EPROTO;
+
+                /* FIXME: expose values to userspace
+                 *
+                 * Note: Even though this loop seems to do nothing it is
+                 * required to parse following sub-structures properly.
+                 */
+        }
+
+        /* fw doesn't implement vdev stats */
+
+        for (i = 0; i < num_peer_stats; i++) {
+                const struct wmi_10_2_peer_stats *src;
+                struct ath10k_fw_stats_peer *dst;
+
+                src = (void *)skb->data;
+                if (!skb_pull(skb, sizeof(*src)))
+                        return -EPROTO;
+
+                dst = kzalloc(sizeof(*dst), GFP_ATOMIC);
+                if (!dst)
+                        continue;
+
+                ath10k_wmi_pull_peer_stats(&src->old, dst);
+
+                dst->peer_rx_rate = __le32_to_cpu(src->peer_rx_rate);
+                /* FIXME: expose 10.2 specific values */
+
+                list_add_tail(&dst->list, &stats->peers);
+        }
+
+        return 0;
+}
+
+static int ath10k_wmi_10_2_4_op_pull_fw_stats(struct ath10k *ar,
+                                              struct sk_buff *skb,
+                                              struct ath10k_fw_stats *stats)
+{
+        const struct wmi_10_2_stats_event *ev = (void *)skb->data;
+        u32 num_pdev_stats;
+        u32 num_pdev_ext_stats;
+        u32 num_vdev_stats;
+        u32 num_peer_stats;
+        int i;
+
+        if (!skb_pull(skb, sizeof(*ev)))
+                return -EPROTO;
+
+        num_pdev_stats = __le32_to_cpu(ev->num_pdev_stats);
+        num_pdev_ext_stats = __le32_to_cpu(ev->num_pdev_ext_stats);
+        num_vdev_stats = __le32_to_cpu(ev->num_vdev_stats);
+        num_peer_stats = __le32_to_cpu(ev->num_peer_stats);
+
+        for (i = 0; i < num_pdev_stats; i++) {
+                const struct wmi_10_2_pdev_stats *src;
+                struct ath10k_fw_stats_pdev *dst;
+
+                src = (void *)skb->data;
+                if (!skb_pull(skb, sizeof(*src)))
+                        return -EPROTO;
+
+                dst = kzalloc(sizeof(*dst), GFP_ATOMIC);
+                if (!dst)
+                        continue;
+
+                ath10k_wmi_pull_pdev_stats_base(&src->base, dst);
+                ath10k_wmi_pull_pdev_stats_tx(&src->tx, dst);
+                ath10k_wmi_pull_pdev_stats_rx(&src->rx, dst);
+                ath10k_wmi_pull_pdev_stats_extra(&src->extra, dst);
+                /* FIXME: expose 10.2 specific values */
+
+                list_add_tail(&dst->list, &stats->pdevs);
+        }
+
+        for (i = 0; i < num_pdev_ext_stats; i++) {
+                const struct wmi_10_2_pdev_ext_stats *src;
+
+                src = (void *)skb->data;
+                if (!skb_pull(skb, sizeof(*src)))
+                        return -EPROTO;
+
+                /* FIXME: expose values to userspace
+                 *
+                 * Note: Even though this loop seems to do nothing it is
+                 * required to parse following sub-structures properly.
+                 */
+        }
+
+        /* fw doesn't implement vdev stats */
+
+        for (i = 0; i < num_peer_stats; i++) {
+                const struct wmi_10_2_4_peer_stats *src;
+                struct ath10k_fw_stats_peer *dst;
+
+                src = (void *)skb->data;
+                if (!skb_pull(skb, sizeof(*src)))
+                        return -EPROTO;
+
+                dst = kzalloc(sizeof(*dst), GFP_ATOMIC);
+                if (!dst)
+                        continue;
+
+                ath10k_wmi_pull_peer_stats(&src->common.old, dst);
+
+                dst->peer_rx_rate = __le32_to_cpu(src->common.peer_rx_rate);
+                /* FIXME: expose 10.2 specific values */
+
+                list_add_tail(&dst->list, &stats->peers);
+        }
+
+        return 0;
 }
 
-static void ath10k_wmi_event_update_stats(struct ath10k *ar,
-                                          struct sk_buff *skb)
+void ath10k_wmi_event_update_stats(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_UPDATE_STATS_EVENTID\n");
         ath10k_debug_fw_stats_process(ar, skb);
 }
 
-static void ath10k_wmi_event_vdev_start_resp(struct ath10k *ar,
-                                             struct sk_buff *skb)
+static int
+ath10k_wmi_op_pull_vdev_start_ev(struct ath10k *ar, struct sk_buff *skb,
+                                 struct wmi_vdev_start_ev_arg *arg)
+{
+        struct wmi_vdev_start_response_event *ev = (void *)skb->data;
+
+        if (skb->len < sizeof(*ev))
+                return -EPROTO;
+
+        skb_pull(skb, sizeof(*ev));
+        arg->vdev_id = ev->vdev_id;
+        arg->req_id = ev->req_id;
+        arg->resp_type = ev->resp_type;
+        arg->status = ev->status;
+
+        return 0;
+}
+
+void ath10k_wmi_event_vdev_start_resp(struct ath10k *ar, struct sk_buff *skb)
 {
-        struct wmi_vdev_start_response_event *ev;
+        struct wmi_vdev_start_ev_arg arg = {};
+        int ret;
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_VDEV_START_RESP_EVENTID\n");
 
-        ev = (struct wmi_vdev_start_response_event *)skb->data;
+        ret = ath10k_wmi_pull_vdev_start(ar, skb, &arg);
+        if (ret) {
+                ath10k_warn(ar, "failed to parse vdev start event: %d\n", ret);
+                return;
+        }
 
-        if (WARN_ON(__le32_to_cpu(ev->status)))
+        if (WARN_ON(__le32_to_cpu(arg.status)))
                 return;
 
         complete(&ar->vdev_setup_done);
 }
 
-static void ath10k_wmi_event_vdev_stopped(struct ath10k *ar,
-                                          struct sk_buff *skb)
+void ath10k_wmi_event_vdev_stopped(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_VDEV_STOPPED_EVENTID\n");
         complete(&ar->vdev_setup_done);
 }
 
-static void ath10k_wmi_event_peer_sta_kickout(struct ath10k *ar,
-                                              struct sk_buff *skb)
+static int
+ath10k_wmi_op_pull_peer_kick_ev(struct ath10k *ar, struct sk_buff *skb,
+                                struct wmi_peer_kick_ev_arg *arg)
 {
-        struct wmi_peer_sta_kickout_event *ev;
+        struct wmi_peer_sta_kickout_event *ev = (void *)skb->data;
+
+        if (skb->len < sizeof(*ev))
+                return -EPROTO;
+
+        skb_pull(skb, sizeof(*ev));
+        arg->mac_addr = ev->peer_macaddr.addr;
+
+        return 0;
+}
+
+void ath10k_wmi_event_peer_sta_kickout(struct ath10k *ar, struct sk_buff *skb)
+{
+        struct wmi_peer_kick_ev_arg arg = {};
         struct ieee80211_sta *sta;
+        int ret;
 
-        ev = (struct wmi_peer_sta_kickout_event *)skb->data;
+        ret = ath10k_wmi_pull_peer_kick(ar, skb, &arg);
+        if (ret) {
+                ath10k_warn(ar, "failed to parse peer kickout event: %d\n",
+                            ret);
+                return;
+        }
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi event peer sta kickout %pM\n",
-                   ev->peer_macaddr.addr);
+                   arg.mac_addr);
 
         rcu_read_lock();
 
-        sta = ieee80211_find_sta_by_ifaddr(ar->hw, ev->peer_macaddr.addr, NULL);
+        sta = ieee80211_find_sta_by_ifaddr(ar->hw, arg.mac_addr, NULL);
         if (!sta) {
                 ath10k_warn(ar, "Spurious quick kickout for STA %pM\n",
-                            ev->peer_macaddr.addr);
+                            arg.mac_addr);
                 goto exit;
         }
 
@@ -1641,7 +2171,7 @@ exit:
 static void ath10k_wmi_update_tim(struct ath10k *ar,
                                   struct ath10k_vif *arvif,
                                   struct sk_buff *bcn,
-                                  struct wmi_bcn_info *bcn_info)
+                                  const struct wmi_tim_info *tim_info)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)bcn->data;
         struct ieee80211_tim_ie *tim;
@@ -1652,14 +2182,14 @@ static void ath10k_wmi_update_tim(struct ath10k *ar,
 
         /* if next SWBA has no tim_changed the tim_bitmap is garbage.
          * we must copy the bitmap upon change and reuse it later */
-        if (__le32_to_cpu(bcn_info->tim_info.tim_changed)) {
+        if (__le32_to_cpu(tim_info->tim_changed)) {
                 int i;
 
                 BUILD_BUG_ON(sizeof(arvif->u.ap.tim_bitmap) !=
-                             sizeof(bcn_info->tim_info.tim_bitmap));
+                             sizeof(tim_info->tim_bitmap));
 
                 for (i = 0; i < sizeof(arvif->u.ap.tim_bitmap); i++) {
-                        t = bcn_info->tim_info.tim_bitmap[i / 4];
+                        t = tim_info->tim_bitmap[i / 4];
                         v = __le32_to_cpu(t);
                         arvif->u.ap.tim_bitmap[i] = (v >> ((i % 4) * 8)) & 0xFF;
                 }
@@ -1711,13 +2241,13 @@ static void ath10k_wmi_update_tim(struct ath10k *ar,
                 return;
         }
 
-        tim->bitmap_ctrl = !!__le32_to_cpu(bcn_info->tim_info.tim_mcast);
+        tim->bitmap_ctrl = !!__le32_to_cpu(tim_info->tim_mcast);
         memcpy(tim->virtual_map, arvif->u.ap.tim_bitmap, pvm_len);
 
         if (tim->dtim_count == 0) {
                 ATH10K_SKB_CB(bcn)->bcn.dtim_zero = true;
 
-                if (__le32_to_cpu(bcn_info->tim_info.tim_mcast) == 1)
+                if (__le32_to_cpu(tim_info->tim_mcast) == 1)
                         ATH10K_SKB_CB(bcn)->bcn.deliver_cab = true;
         }
 
@@ -1727,7 +2257,7 @@ static void ath10k_wmi_update_tim(struct ath10k *ar,
 }
 
 static void ath10k_p2p_fill_noa_ie(u8 *data, u32 len,
-                                   struct wmi_p2p_noa_info *noa)
+                                   const struct wmi_p2p_noa_info *noa)
 {
         struct ieee80211_p2p_noa_attr *noa_attr;
         u8  ctwindow_oppps = noa->ctwindow_oppps;
@@ -1769,7 +2299,7 @@ static void ath10k_p2p_fill_noa_ie(u8 *data, u32 len,
         *noa_attr_len = __cpu_to_le16(attr_len);
 }
 
-static u32 ath10k_p2p_calc_noa_ie_len(struct wmi_p2p_noa_info *noa)
+static u32 ath10k_p2p_calc_noa_ie_len(const struct wmi_p2p_noa_info *noa)
 {
         u32 len = 0;
         u8 noa_descriptors = noa->num_descriptors;
@@ -1789,9 +2319,8 @@ static u32 ath10k_p2p_calc_noa_ie_len(struct wmi_p2p_noa_info *noa)
 
 static void ath10k_wmi_update_noa(struct ath10k *ar, struct ath10k_vif *arvif,
                                   struct sk_buff *bcn,
-                                  struct wmi_bcn_info *bcn_info)
+                                  const struct wmi_p2p_noa_info *noa)
 {
-        struct wmi_p2p_noa_info *noa = &bcn_info->p2p_noa_info;
         u8 *new_data, *old_data = arvif->u.ap.noa_data;
         u32 new_len;
 
@@ -1832,22 +2361,59 @@ cleanup:
         kfree(old_data);
 }
 
-static void ath10k_wmi_event_host_swba(struct ath10k *ar, struct sk_buff *skb)
+static int ath10k_wmi_op_pull_swba_ev(struct ath10k *ar, struct sk_buff *skb,
+                                      struct wmi_swba_ev_arg *arg)
 {
-        struct wmi_host_swba_event *ev;
+        struct wmi_host_swba_event *ev = (void *)skb->data;
+        u32 map;
+        size_t i;
+
+        if (skb->len < sizeof(*ev))
+                return -EPROTO;
+
+        skb_pull(skb, sizeof(*ev));
+        arg->vdev_map = ev->vdev_map;
+
+        for (i = 0, map = __le32_to_cpu(ev->vdev_map); map; map >>= 1) {
+                if (!(map & BIT(0)))
+                        continue;
+
+                /* If this happens there were some changes in firmware and
+                 * ath10k should update the max size of tim_info array.
+                 */
+                if (WARN_ON_ONCE(i == ARRAY_SIZE(arg->tim_info)))
+                        break;
+
+                arg->tim_info[i] = &ev->bcn_info[i].tim_info;
+                arg->noa_info[i] = &ev->bcn_info[i].p2p_noa_info;
+                i++;
+        }
+
+        return 0;
+}
+
+void ath10k_wmi_event_host_swba(struct ath10k *ar, struct sk_buff *skb)
+{
+        struct wmi_swba_ev_arg arg = {};
         u32 map;
         int i = -1;
-        struct wmi_bcn_info *bcn_info;
+        const struct wmi_tim_info *tim_info;
+        const struct wmi_p2p_noa_info *noa_info;
         struct ath10k_vif *arvif;
         struct sk_buff *bcn;
         dma_addr_t paddr;
         int ret, vdev_id = 0;
 
-        ev = (struct wmi_host_swba_event *)skb->data;
-        map = __le32_to_cpu(ev->vdev_map);
+        ret = ath10k_wmi_pull_swba(ar, skb, &arg);
+        if (ret) {
+                ath10k_warn(ar, "failed to parse swba event: %d\n", ret);
+                return;
+        }
+
+        map = __le32_to_cpu(arg.vdev_map);
 
         ath10k_dbg(ar, ATH10K_DBG_MGMT, "mgmt swba vdev_map 0x%x\n",
-                   ev->vdev_map);
+                   map);
 
         for (; map; map >>= 1, vdev_id++) {
                 if (!(map & 0x1))
@@ -1860,19 +2426,20 @@ static void ath10k_wmi_event_host_swba(struct ath10k *ar, struct sk_buff *skb)
                         break;
                 }
 
-                bcn_info = &ev->bcn_info[i];
+                tim_info = arg.tim_info[i];
+                noa_info = arg.noa_info[i];
 
                 ath10k_dbg(ar, ATH10K_DBG_MGMT,
                            "mgmt event bcn_info %d tim_len %d mcast %d changed %d num_ps_pending %d bitmap 0x%08x%08x%08x%08x\n",
                            i,
-                           __le32_to_cpu(bcn_info->tim_info.tim_len),
-                           __le32_to_cpu(bcn_info->tim_info.tim_mcast),
-                           __le32_to_cpu(bcn_info->tim_info.tim_changed),
-                           __le32_to_cpu(bcn_info->tim_info.tim_num_ps_pending),
-                           __le32_to_cpu(bcn_info->tim_info.tim_bitmap[3]),
-                           __le32_to_cpu(bcn_info->tim_info.tim_bitmap[2]),
-                           __le32_to_cpu(bcn_info->tim_info.tim_bitmap[1]),
-                           __le32_to_cpu(bcn_info->tim_info.tim_bitmap[0]));
+                           __le32_to_cpu(tim_info->tim_len),
+                           __le32_to_cpu(tim_info->tim_mcast),
+                           __le32_to_cpu(tim_info->tim_changed),
+                           __le32_to_cpu(tim_info->tim_num_ps_pending),
+                           __le32_to_cpu(tim_info->tim_bitmap[3]),
+                           __le32_to_cpu(tim_info->tim_bitmap[2]),
+                           __le32_to_cpu(tim_info->tim_bitmap[1]),
+                           __le32_to_cpu(tim_info->tim_bitmap[0]));
 
                 arvif = ath10k_get_arvif(ar, vdev_id);
                 if (arvif == NULL) {
@@ -1899,15 +2466,25 @@ static void ath10k_wmi_event_host_swba(struct ath10k *ar, struct sk_buff *skb)
                 }
 
                 ath10k_tx_h_seq_no(arvif->vif, bcn);
-                ath10k_wmi_update_tim(ar, arvif, bcn, bcn_info);
-                ath10k_wmi_update_noa(ar, arvif, bcn, bcn_info);
+                ath10k_wmi_update_tim(ar, arvif, bcn, tim_info);
+                ath10k_wmi_update_noa(ar, arvif, bcn, noa_info);
 
                 spin_lock_bh(&ar->data_lock);
 
                 if (arvif->beacon) {
-                        if (!arvif->beacon_sent)
-                                ath10k_warn(ar, "SWBA overrun on vdev %d\n",
+                        switch (arvif->beacon_state) {
+                        case ATH10K_BEACON_SENT:
+                                break;
+                        case ATH10K_BEACON_SCHEDULED:
+                                ath10k_warn(ar, "SWBA overrun on vdev %d, skipped old beacon\n",
+                                            arvif->vdev_id);
+                                break;
+                        case ATH10K_BEACON_SENDING:
+                                ath10k_warn(ar, "SWBA overrun on vdev %d, skipped new beacon\n",
                                             arvif->vdev_id);
+                                dev_kfree_skb(bcn);
+                                goto skip;
+                        }
 
                         ath10k_mac_vif_beacon_free(arvif);
                 }
@@ -1935,19 +2512,19 @@ static void ath10k_wmi_event_host_swba(struct ath10k *ar, struct sk_buff *skb)
                 }
 
                 arvif->beacon = bcn;
-                arvif->beacon_sent = false;
+                arvif->beacon_state = ATH10K_BEACON_SCHEDULED;
 
                 trace_ath10k_tx_hdr(ar, bcn->data, bcn->len);
                 trace_ath10k_tx_payload(ar, bcn->data, bcn->len);
 
-                ath10k_wmi_tx_beacon_nowait(arvif);
 skip:
                 spin_unlock_bh(&ar->data_lock);
         }
+
+        ath10k_wmi_tx_beacons_nowait(ar);
 }
 
-static void ath10k_wmi_event_tbttoffset_update(struct ath10k *ar,
-                                               struct sk_buff *skb)
+void ath10k_wmi_event_tbttoffset_update(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_TBTTOFFSET_UPDATE_EVENTID\n");
 }
@@ -2068,9 +2645,9 @@ static int ath10k_dfs_fft_report(struct ath10k *ar,
         return 0;
 }
 
-static void ath10k_wmi_event_dfs(struct ath10k *ar,
-                                 const struct wmi_phyerr *phyerr,
-                                 u64 tsf)
+void ath10k_wmi_event_dfs(struct ath10k *ar,
+                          const struct wmi_phyerr *phyerr,
+                          u64 tsf)
 {
         int buf_len, tlv_len, res, i = 0;
         const struct phyerr_tlv *tlv;
@@ -2133,10 +2710,9 @@ static void ath10k_wmi_event_dfs(struct ath10k *ar,
         }
 }
 
-static void
-ath10k_wmi_event_spectral_scan(struct ath10k *ar,
-                               const struct wmi_phyerr *phyerr,
-                               u64 tsf)
+void ath10k_wmi_event_spectral_scan(struct ath10k *ar,
+                                    const struct wmi_phyerr *phyerr,
+                                    u64 tsf)
 {
         int buf_len, tlv_len, res, i = 0;
         struct phyerr_tlv *tlv;
@@ -2188,37 +2764,53 @@ ath10k_wmi_event_spectral_scan(struct ath10k *ar,
         }
 }
 
-static void ath10k_wmi_event_phyerr(struct ath10k *ar, struct sk_buff *skb)
+static int ath10k_wmi_op_pull_phyerr_ev(struct ath10k *ar, struct sk_buff *skb,
+                                        struct wmi_phyerr_ev_arg *arg)
 {
-        const struct wmi_phyerr_event *ev;
+        struct wmi_phyerr_event *ev = (void *)skb->data;
+
+        if (skb->len < sizeof(*ev))
+                return -EPROTO;
+
+        arg->num_phyerrs = ev->num_phyerrs;
+        arg->tsf_l32 = ev->tsf_l32;
+        arg->tsf_u32 = ev->tsf_u32;
+        arg->buf_len = __cpu_to_le32(skb->len - sizeof(*ev));
+        arg->phyerrs = ev->phyerrs;
+
+        return 0;
+}
+
+void ath10k_wmi_event_phyerr(struct ath10k *ar, struct sk_buff *skb)
+{
+        struct wmi_phyerr_ev_arg arg = {};
         const struct wmi_phyerr *phyerr;
         u32 count, i, buf_len, phy_err_code;
         u64 tsf;
-        int left_len = skb->len;
+        int left_len, ret;
 
         ATH10K_DFS_STAT_INC(ar, phy_errors);
 
-        /* Check if combined event available */
-        if (left_len < sizeof(*ev)) {
-                ath10k_warn(ar, "wmi phyerr combined event wrong len\n");
+        ret = ath10k_wmi_pull_phyerr(ar, skb, &arg);
+        if (ret) {
+                ath10k_warn(ar, "failed to parse phyerr event: %d\n", ret);
                 return;
         }
 
-        left_len -= sizeof(*ev);
+        left_len = __le32_to_cpu(arg.buf_len);
 
         /* Check number of included events */
-        ev = (const struct wmi_phyerr_event *)skb->data;
-        count = __le32_to_cpu(ev->num_phyerrs);
+        count = __le32_to_cpu(arg.num_phyerrs);
 
-        tsf = __le32_to_cpu(ev->tsf_u32);
+        tsf = __le32_to_cpu(arg.tsf_u32);
         tsf <<= 32;
-        tsf |= __le32_to_cpu(ev->tsf_l32);
+        tsf |= __le32_to_cpu(arg.tsf_l32);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi event phyerr count %d tsf64 0x%llX\n",
                    count, tsf);
 
-        phyerr = ev->phyerrs;
+        phyerr = arg.phyerrs;
         for (i = 0; i < count; i++) {
                 /* Check if we can read event header */
                 if (left_len < sizeof(*phyerr)) {
@@ -2258,19 +2850,17 @@ static void ath10k_wmi_event_phyerr(struct ath10k *ar, struct sk_buff *skb)
         }
 }
 
-static void ath10k_wmi_event_roam(struct ath10k *ar, struct sk_buff *skb)
+void ath10k_wmi_event_roam(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_ROAM_EVENTID\n");
 }
 
-static void ath10k_wmi_event_profile_match(struct ath10k *ar,
-                                           struct sk_buff *skb)
+void ath10k_wmi_event_profile_match(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_PROFILE_MATCH\n");
 }
 
-static void ath10k_wmi_event_debug_print(struct ath10k *ar,
-                                         struct sk_buff *skb)
+void ath10k_wmi_event_debug_print(struct ath10k *ar, struct sk_buff *skb)
 {
         char buf[101], c;
         int i;
@@ -2303,103 +2893,90 @@ static void ath10k_wmi_event_debug_print(struct ath10k *ar,
         ath10k_dbg(ar, ATH10K_DBG_WMI_PRINT, "wmi print '%s'\n", buf);
 }
 
-static void ath10k_wmi_event_pdev_qvit(struct ath10k *ar, struct sk_buff *skb)
+void ath10k_wmi_event_pdev_qvit(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_PDEV_QVIT_EVENTID\n");
 }
 
-static void ath10k_wmi_event_wlan_profile_data(struct ath10k *ar,
-                                               struct sk_buff *skb)
+void ath10k_wmi_event_wlan_profile_data(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_WLAN_PROFILE_DATA_EVENTID\n");
 }
 
-static void ath10k_wmi_event_rtt_measurement_report(struct ath10k *ar,
-                                                    struct sk_buff *skb)
+void ath10k_wmi_event_rtt_measurement_report(struct ath10k *ar,
+                                             struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_RTT_MEASUREMENT_REPORT_EVENTID\n");
 }
 
-static void ath10k_wmi_event_tsf_measurement_report(struct ath10k *ar,
-                                                    struct sk_buff *skb)
+void ath10k_wmi_event_tsf_measurement_report(struct ath10k *ar,
+                                             struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_TSF_MEASUREMENT_REPORT_EVENTID\n");
 }
 
-static void ath10k_wmi_event_rtt_error_report(struct ath10k *ar,
-                                              struct sk_buff *skb)
+void ath10k_wmi_event_rtt_error_report(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_RTT_ERROR_REPORT_EVENTID\n");
 }
 
-static void ath10k_wmi_event_wow_wakeup_host(struct ath10k *ar,
-                                             struct sk_buff *skb)
+void ath10k_wmi_event_wow_wakeup_host(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_WOW_WAKEUP_HOST_EVENTID\n");
 }
 
-static void ath10k_wmi_event_dcs_interference(struct ath10k *ar,
-                                              struct sk_buff *skb)
+void ath10k_wmi_event_dcs_interference(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_DCS_INTERFERENCE_EVENTID\n");
 }
 
-static void ath10k_wmi_event_pdev_tpc_config(struct ath10k *ar,
-                                             struct sk_buff *skb)
+void ath10k_wmi_event_pdev_tpc_config(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_PDEV_TPC_CONFIG_EVENTID\n");
 }
 
-static void ath10k_wmi_event_pdev_ftm_intg(struct ath10k *ar,
-                                           struct sk_buff *skb)
+void ath10k_wmi_event_pdev_ftm_intg(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_PDEV_FTM_INTG_EVENTID\n");
 }
 
-static void ath10k_wmi_event_gtk_offload_status(struct ath10k *ar,
-                                                struct sk_buff *skb)
+void ath10k_wmi_event_gtk_offload_status(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_GTK_OFFLOAD_STATUS_EVENTID\n");
 }
 
-static void ath10k_wmi_event_gtk_rekey_fail(struct ath10k *ar,
-                                            struct sk_buff *skb)
+void ath10k_wmi_event_gtk_rekey_fail(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_GTK_REKEY_FAIL_EVENTID\n");
 }
 
-static void ath10k_wmi_event_delba_complete(struct ath10k *ar,
-                                            struct sk_buff *skb)
+void ath10k_wmi_event_delba_complete(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_TX_DELBA_COMPLETE_EVENTID\n");
 }
 
-static void ath10k_wmi_event_addba_complete(struct ath10k *ar,
-                                            struct sk_buff *skb)
+void ath10k_wmi_event_addba_complete(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_TX_ADDBA_COMPLETE_EVENTID\n");
 }
 
-static void ath10k_wmi_event_vdev_install_key_complete(struct ath10k *ar,
-                                                       struct sk_buff *skb)
+void ath10k_wmi_event_vdev_install_key_complete(struct ath10k *ar,
+                                                struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_VDEV_INSTALL_KEY_COMPLETE_EVENTID\n");
 }
 
-static void ath10k_wmi_event_inst_rssi_stats(struct ath10k *ar,
-                                             struct sk_buff *skb)
+void ath10k_wmi_event_inst_rssi_stats(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_INST_RSSI_STATS_EVENTID\n");
 }
 
-static void ath10k_wmi_event_vdev_standby_req(struct ath10k *ar,
-                                              struct sk_buff *skb)
+void ath10k_wmi_event_vdev_standby_req(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_VDEV_STANDBY_REQ_EVENTID\n");
 }
 
-static void ath10k_wmi_event_vdev_resume_req(struct ath10k *ar,
-                                             struct sk_buff *skb)
+void ath10k_wmi_event_vdev_resume_req(struct ath10k *ar, struct sk_buff *skb)
 {
         ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_VDEV_RESUME_REQ_EVENTID\n");
 }
@@ -2435,8 +3012,9 @@ static int ath10k_wmi_alloc_host_mem(struct ath10k *ar, u32 req_id,
         return 0;
 }
 
-static int ath10k_wmi_main_pull_svc_rdy_ev(struct sk_buff *skb,
-                                           struct wmi_svc_rdy_ev_arg *arg)
+static int
+ath10k_wmi_main_op_pull_svc_rdy_ev(struct ath10k *ar, struct sk_buff *skb,
+                                   struct wmi_svc_rdy_ev_arg *arg)
 {
         struct wmi_service_ready_event *ev;
         size_t i, n;
@@ -2471,8 +3049,9 @@ static int ath10k_wmi_main_pull_svc_rdy_ev(struct sk_buff *skb,
         return 0;
 }
 
-static int ath10k_wmi_10x_pull_svc_rdy_ev(struct sk_buff *skb,
-                                          struct wmi_svc_rdy_ev_arg *arg)
+static int
+ath10k_wmi_10x_op_pull_svc_rdy_ev(struct ath10k *ar, struct sk_buff *skb,
+                                  struct wmi_svc_rdy_ev_arg *arg)
 {
         struct wmi_10x_service_ready_event *ev;
         int i, n;
@@ -2506,30 +3085,22 @@ static int ath10k_wmi_10x_pull_svc_rdy_ev(struct sk_buff *skb,
         return 0;
 }
 
-static void ath10k_wmi_event_service_ready(struct ath10k *ar,
-                                           struct sk_buff *skb)
+void ath10k_wmi_event_service_ready(struct ath10k *ar, struct sk_buff *skb)
 {
         struct wmi_svc_rdy_ev_arg arg = {};
         u32 num_units, req_id, unit_size, num_mem_reqs, num_unit_info, i;
         int ret;
 
-        memset(&ar->wmi.svc_map, 0, sizeof(ar->wmi.svc_map));
-
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
-                ret = ath10k_wmi_10x_pull_svc_rdy_ev(skb, &arg);
-                wmi_10x_svc_map(arg.service_map, ar->wmi.svc_map,
-                                arg.service_map_len);
-        } else {
-                ret = ath10k_wmi_main_pull_svc_rdy_ev(skb, &arg);
-                wmi_main_svc_map(arg.service_map, ar->wmi.svc_map,
-                                 arg.service_map_len);
-        }
-
+        ret = ath10k_wmi_pull_svc_rdy(ar, skb, &arg);
         if (ret) {
                 ath10k_warn(ar, "failed to parse service ready: %d\n", ret);
                 return;
         }
 
+        memset(&ar->wmi.svc_map, 0, sizeof(ar->wmi.svc_map));
+        ath10k_wmi_map_svc(ar, arg.service_map, ar->wmi.svc_map,
+                           arg.service_map_len);
+
         ar->hw_min_tx_power = __le32_to_cpu(arg.min_tx_power);
         ar->hw_max_tx_power = __le32_to_cpu(arg.max_tx_power);
         ar->ht_cap_info = __le32_to_cpu(arg.ht_cap);
@@ -2607,13 +3178,14 @@ static void ath10k_wmi_event_service_ready(struct ath10k *ar,
         }
 
         ath10k_dbg(ar, ATH10K_DBG_WMI,
-                   "wmi event service ready min_tx_power 0x%08x max_tx_power 0x%08x ht_cap 0x%08x vht_cap 0x%08x sw_ver0 0x%08x sw_ver1 0x%08x phy_capab 0x%08x num_rf_chains 0x%08x eeprom_rd 0x%08x num_mem_reqs 0x%08x\n",
+                   "wmi event service ready min_tx_power 0x%08x max_tx_power 0x%08x ht_cap 0x%08x vht_cap 0x%08x sw_ver0 0x%08x sw_ver1 0x%08x fw_build 0x%08x phy_capab 0x%08x num_rf_chains 0x%08x eeprom_rd 0x%08x num_mem_reqs 0x%08x\n",
                    __le32_to_cpu(arg.min_tx_power),
                    __le32_to_cpu(arg.max_tx_power),
                    __le32_to_cpu(arg.ht_cap),
                    __le32_to_cpu(arg.vht_cap),
                    __le32_to_cpu(arg.sw_ver0),
                    __le32_to_cpu(arg.sw_ver1),
+                   __le32_to_cpu(arg.fw_build),
                    __le32_to_cpu(arg.phy_capab),
                    __le32_to_cpu(arg.num_rf_chains),
                    __le32_to_cpu(arg.eeprom_rd),
@@ -2622,27 +3194,59 @@ static void ath10k_wmi_event_service_ready(struct ath10k *ar,
         complete(&ar->wmi.service_ready);
 }
 
-static int ath10k_wmi_event_ready(struct ath10k *ar, struct sk_buff *skb)
+static int ath10k_wmi_op_pull_rdy_ev(struct ath10k *ar, struct sk_buff *skb,
+                                     struct wmi_rdy_ev_arg *arg)
 {
-        struct wmi_ready_event *ev = (struct wmi_ready_event *)skb->data;
+        struct wmi_ready_event *ev = (void *)skb->data;
 
-        if (WARN_ON(skb->len < sizeof(*ev)))
-                return -EINVAL;
+        if (skb->len < sizeof(*ev))
+                return -EPROTO;
 
-        ether_addr_copy(ar->mac_addr, ev->mac_addr.addr);
+        skb_pull(skb, sizeof(*ev));
+        arg->sw_version = ev->sw_version;
+        arg->abi_version = ev->abi_version;
+        arg->status = ev->status;
+        arg->mac_addr = ev->mac_addr.addr;
+
+        return 0;
+}
+
+int ath10k_wmi_event_ready(struct ath10k *ar, struct sk_buff *skb)
+{
+        struct wmi_rdy_ev_arg arg = {};
+        int ret;
+
+        ret = ath10k_wmi_pull_rdy(ar, skb, &arg);
+        if (ret) {
+                ath10k_warn(ar, "failed to parse ready event: %d\n", ret);
+                return ret;
+        }
 
         ath10k_dbg(ar, ATH10K_DBG_WMI,
-                   "wmi event ready sw_version %u abi_version %u mac_addr %pM status %d skb->len %i ev-sz %zu\n",
-                   __le32_to_cpu(ev->sw_version),
-                   __le32_to_cpu(ev->abi_version),
-                   ev->mac_addr.addr,
-                   __le32_to_cpu(ev->status), skb->len, sizeof(*ev));
+                   "wmi event ready sw_version %u abi_version %u mac_addr %pM status %d\n",
+                   __le32_to_cpu(arg.sw_version),
+                   __le32_to_cpu(arg.abi_version),
+                   arg.mac_addr,
+                   __le32_to_cpu(arg.status));
 
+        ether_addr_copy(ar->mac_addr, arg.mac_addr);
         complete(&ar->wmi.unified_ready);
         return 0;
 }
 
-static void ath10k_wmi_main_process_rx(struct ath10k *ar, struct sk_buff *skb)
+static int ath10k_wmi_event_temperature(struct ath10k *ar, struct sk_buff *skb)
+{
+        const struct wmi_pdev_temperature_event *ev;
+
+        ev = (struct wmi_pdev_temperature_event *)skb->data;
+        if (WARN_ON(skb->len < sizeof(*ev)))
+                return -EPROTO;
+
+        ath10k_thermal_event_temperature(ar, __le32_to_cpu(ev->temperature));
+        return 0;
+}
+
+static void ath10k_wmi_op_rx(struct ath10k *ar, struct sk_buff *skb)
 {
         struct wmi_cmd_hdr *cmd_hdr;
         enum wmi_event_id id;
@@ -2758,7 +3362,7 @@ static void ath10k_wmi_main_process_rx(struct ath10k *ar, struct sk_buff *skb)
         dev_kfree_skb(skb);
 }
 
-static void ath10k_wmi_10x_process_rx(struct ath10k *ar, struct sk_buff *skb)
+static void ath10k_wmi_10_1_op_rx(struct ath10k *ar, struct sk_buff *skb)
 {
         struct wmi_cmd_hdr *cmd_hdr;
         enum wmi_10x_event_id id;
@@ -2882,7 +3486,7 @@ out:
         dev_kfree_skb(skb);
 }
 
-static void ath10k_wmi_10_2_process_rx(struct ath10k *ar, struct sk_buff *skb)
+static void ath10k_wmi_10_2_op_rx(struct ath10k *ar, struct sk_buff *skb)
 {
         struct wmi_cmd_hdr *cmd_hdr;
         enum wmi_10_2_event_id id;
@@ -2981,6 +3585,9 @@ static void ath10k_wmi_10_2_process_rx(struct ath10k *ar, struct sk_buff *skb)
         case WMI_10_2_READY_EVENTID:
                 ath10k_wmi_event_ready(ar, skb);
                 break;
+        case WMI_10_2_PDEV_TEMPERATURE_EVENTID:
+                ath10k_wmi_event_temperature(ar, skb);
+                break;
         case WMI_10_2_RTT_KEEPALIVE_EVENTID:
         case WMI_10_2_GPIO_INPUT_EVENTID:
         case WMI_10_2_PEER_RATECODE_LIST_EVENTID:
@@ -3001,14 +3608,11 @@ static void ath10k_wmi_10_2_process_rx(struct ath10k *ar, struct sk_buff *skb)
 
 static void ath10k_wmi_process_rx(struct ath10k *ar, struct sk_buff *skb)
 {
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
-                if (test_bit(ATH10K_FW_FEATURE_WMI_10_2, ar->fw_features))
-                        ath10k_wmi_10_2_process_rx(ar, skb);
-                else
-                        ath10k_wmi_10x_process_rx(ar, skb);
-        } else {
-                ath10k_wmi_main_process_rx(ar, skb);
-        }
+        int ret;
+
+        ret = ath10k_wmi_rx(ar, skb);
+        if (ret)
+                ath10k_warn(ar, "failed to process wmi rx: %d\n", ret);
 }
 
 int ath10k_wmi_connect(struct ath10k *ar)
@@ -3039,16 +3643,17 @@ int ath10k_wmi_connect(struct ath10k *ar)
         return 0;
 }
 
-static int ath10k_wmi_main_pdev_set_regdomain(struct ath10k *ar, u16 rd,
-                                              u16 rd2g, u16 rd5g, u16 ctl2g,
-                                              u16 ctl5g)
+static struct sk_buff *
+ath10k_wmi_op_gen_pdev_set_rd(struct ath10k *ar, u16 rd, u16 rd2g, u16 rd5g,
+                              u16 ctl2g, u16 ctl5g,
+                              enum wmi_dfs_region dfs_reg)
 {
         struct wmi_pdev_set_regdomain_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_pdev_set_regdomain_cmd *)skb->data;
         cmd->reg_domain = __cpu_to_le32(rd);
@@ -3060,22 +3665,20 @@ static int ath10k_wmi_main_pdev_set_regdomain(struct ath10k *ar, u16 rd,
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi pdev regdomain rd %x rd2g %x rd5g %x ctl2g %x ctl5g %x\n",
                    rd, rd2g, rd5g, ctl2g, ctl5g);
-
-        return ath10k_wmi_cmd_send(ar, skb,
-                                   ar->wmi.cmd->pdev_set_regdomain_cmdid);
+        return skb;
 }
 
-static int ath10k_wmi_10x_pdev_set_regdomain(struct ath10k *ar, u16 rd,
-                                             u16 rd2g, u16 rd5g,
-                                             u16 ctl2g, u16 ctl5g,
-                                             enum wmi_dfs_region dfs_reg)
+static struct sk_buff *
+ath10k_wmi_10x_op_gen_pdev_set_rd(struct ath10k *ar, u16 rd, u16 rd2g, u16
+                                  rd5g, u16 ctl2g, u16 ctl5g,
+                                  enum wmi_dfs_region dfs_reg)
 {
         struct wmi_pdev_set_regdomain_cmd_10x *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_pdev_set_regdomain_cmd_10x *)skb->data;
         cmd->reg_domain = __cpu_to_le32(rd);
@@ -3088,50 +3691,39 @@ static int ath10k_wmi_10x_pdev_set_regdomain(struct ath10k *ar, u16 rd,
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi pdev regdomain rd %x rd2g %x rd5g %x ctl2g %x ctl5g %x dfs_region %x\n",
                    rd, rd2g, rd5g, ctl2g, ctl5g, dfs_reg);
-
-        return ath10k_wmi_cmd_send(ar, skb,
-                                   ar->wmi.cmd->pdev_set_regdomain_cmdid);
-}
-
-int ath10k_wmi_pdev_set_regdomain(struct ath10k *ar, u16 rd, u16 rd2g,
-                                  u16 rd5g, u16 ctl2g, u16 ctl5g,
-                                  enum wmi_dfs_region dfs_reg)
-{
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features))
-                return ath10k_wmi_10x_pdev_set_regdomain(ar, rd, rd2g, rd5g,
-                                                        ctl2g, ctl5g, dfs_reg);
-        else
-                return ath10k_wmi_main_pdev_set_regdomain(ar, rd, rd2g, rd5g,
-                                                         ctl2g, ctl5g);
+        return skb;
 }
 
-int ath10k_wmi_pdev_suspend_target(struct ath10k *ar, u32 suspend_opt)
+static struct sk_buff *
+ath10k_wmi_op_gen_pdev_suspend(struct ath10k *ar, u32 suspend_opt)
 {
         struct wmi_pdev_suspend_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_pdev_suspend_cmd *)skb->data;
         cmd->suspend_opt = __cpu_to_le32(suspend_opt);
 
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->pdev_suspend_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_pdev_resume_target(struct ath10k *ar)
+static struct sk_buff *
+ath10k_wmi_op_gen_pdev_resume(struct ath10k *ar)
 {
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, 0);
-        if (skb == NULL)
-                return -ENOMEM;
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
 
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->pdev_resume_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_pdev_set_param(struct ath10k *ar, u32 id, u32 value)
+static struct sk_buff *
+ath10k_wmi_op_gen_pdev_set_param(struct ath10k *ar, u32 id, u32 value)
 {
         struct wmi_pdev_set_param_cmd *cmd;
         struct sk_buff *skb;
@@ -3139,12 +3731,12 @@ int ath10k_wmi_pdev_set_param(struct ath10k *ar, u32 id, u32 value)
         if (id == WMI_PDEV_PARAM_UNSUPPORTED) {
                 ath10k_warn(ar, "pdev param %d not supported by firmware\n",
                             id);
-                return -EOPNOTSUPP;
+                return ERR_PTR(-EOPNOTSUPP);
         }
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_pdev_set_param_cmd *)skb->data;
         cmd->param_id    = __cpu_to_le32(id);
@@ -3152,11 +3744,11 @@ int ath10k_wmi_pdev_set_param(struct ath10k *ar, u32 id, u32 value)
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi pdev set param %d value %d\n",
                    id, value);
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->pdev_set_param_cmdid);
+        return skb;
 }
 
-static void ath10k_wmi_put_host_mem_chunks(struct ath10k *ar,
-                                           struct wmi_host_mem_chunks *chunks)
+void ath10k_wmi_put_host_mem_chunks(struct ath10k *ar,
+                                    struct wmi_host_mem_chunks *chunks)
 {
         struct host_memory_chunk *chunk;
         int i;
@@ -3177,7 +3769,7 @@ static void ath10k_wmi_put_host_mem_chunks(struct ath10k *ar,
         }
 }
 
-static int ath10k_wmi_main_cmd_init(struct ath10k *ar)
+static struct sk_buff *ath10k_wmi_op_gen_init(struct ath10k *ar)
 {
         struct wmi_init_cmd *cmd;
         struct sk_buff *buf;
@@ -3240,7 +3832,7 @@ static int ath10k_wmi_main_cmd_init(struct ath10k *ar)
 
         buf = ath10k_wmi_alloc_skb(ar, len);
         if (!buf)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_init_cmd *)buf->data;
 
@@ -3248,10 +3840,10 @@ static int ath10k_wmi_main_cmd_init(struct ath10k *ar)
         ath10k_wmi_put_host_mem_chunks(ar, &cmd->mem_chunks);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi init\n");
-        return ath10k_wmi_cmd_send(ar, buf, ar->wmi.cmd->init_cmdid);
+        return buf;
 }
 
-static int ath10k_wmi_10x_cmd_init(struct ath10k *ar)
+static struct sk_buff *ath10k_wmi_10_1_op_gen_init(struct ath10k *ar)
 {
         struct wmi_init_cmd_10x *cmd;
         struct sk_buff *buf;
@@ -3306,7 +3898,7 @@ static int ath10k_wmi_10x_cmd_init(struct ath10k *ar)
 
         buf = ath10k_wmi_alloc_skb(ar, len);
         if (!buf)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_init_cmd_10x *)buf->data;
 
@@ -3314,15 +3906,15 @@ static int ath10k_wmi_10x_cmd_init(struct ath10k *ar)
         ath10k_wmi_put_host_mem_chunks(ar, &cmd->mem_chunks);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi init 10x\n");
-        return ath10k_wmi_cmd_send(ar, buf, ar->wmi.cmd->init_cmdid);
+        return buf;
 }
 
-static int ath10k_wmi_10_2_cmd_init(struct ath10k *ar)
+static struct sk_buff *ath10k_wmi_10_2_op_gen_init(struct ath10k *ar)
 {
         struct wmi_init_cmd_10_2 *cmd;
         struct sk_buff *buf;
         struct wmi_resource_config_10x config = {};
-        u32 len, val;
+        u32 len, val, features;
 
         config.num_vdevs = __cpu_to_le32(TARGET_10X_NUM_VDEVS);
         config.num_peers = __cpu_to_le32(TARGET_10X_NUM_PEERS);
@@ -3356,7 +3948,7 @@ static int ath10k_wmi_10_2_cmd_init(struct ath10k *ar)
         config.mcast2ucast_mode = __cpu_to_le32(TARGET_10X_MCAST2UCAST_MODE);
         config.tx_dbg_log_size = __cpu_to_le32(TARGET_10X_TX_DBG_LOG_SIZE);
         config.num_wds_entries = __cpu_to_le32(TARGET_10X_NUM_WDS_ENTRIES);
-        config.dma_burst_size = __cpu_to_le32(TARGET_10X_DMA_BURST_SIZE);
+        config.dma_burst_size = __cpu_to_le32(TARGET_10_2_DMA_BURST_SIZE);
         config.mac_aggr_delim = __cpu_to_le32(TARGET_10X_MAC_AGGR_DELIM);
 
         val = TARGET_10X_RX_SKIP_DEFRAG_TIMEOUT_DUP_DETECTION_CHECK;
@@ -3372,34 +3964,21 @@ static int ath10k_wmi_10_2_cmd_init(struct ath10k *ar)
 
         buf = ath10k_wmi_alloc_skb(ar, len);
         if (!buf)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_init_cmd_10_2 *)buf->data;
 
+        features = WMI_10_2_RX_BATCH_MODE;
+        cmd->resource_config.feature_mask = __cpu_to_le32(features);
+
         memcpy(&cmd->resource_config.common, &config, sizeof(config));
         ath10k_wmi_put_host_mem_chunks(ar, &cmd->mem_chunks);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi init 10.2\n");
-        return ath10k_wmi_cmd_send(ar, buf, ar->wmi.cmd->init_cmdid);
+        return buf;
 }
 
-int ath10k_wmi_cmd_init(struct ath10k *ar)
-{
-        int ret;
-
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
-                if (test_bit(ATH10K_FW_FEATURE_WMI_10_2, ar->fw_features))
-                        ret = ath10k_wmi_10_2_cmd_init(ar);
-                else
-                        ret = ath10k_wmi_10x_cmd_init(ar);
-        } else {
-                ret = ath10k_wmi_main_cmd_init(ar);
-        }
-
-        return ret;
-}
-
-static int ath10k_wmi_start_scan_verify(const struct wmi_start_scan_arg *arg)
+int ath10k_wmi_start_scan_verify(const struct wmi_start_scan_arg *arg)
 {
         if (arg->ie_len && !arg->ie)
                 return -EINVAL;
@@ -3450,9 +4029,8 @@ ath10k_wmi_start_scan_tlvs_len(const struct wmi_start_scan_arg *arg)
         return len;
 }
 
-static void
-ath10k_wmi_put_start_scan_common(struct wmi_start_scan_common *cmn,
-                                 const struct wmi_start_scan_arg *arg)
+void ath10k_wmi_put_start_scan_common(struct wmi_start_scan_common *cmn,
+                                      const struct wmi_start_scan_arg *arg)
 {
         u32 scan_id;
         u32 scan_req_id;
@@ -3546,46 +4124,60 @@ ath10k_wmi_put_start_scan_tlvs(struct wmi_start_scan_tlvs *tlvs,
         }
 }
 
-int ath10k_wmi_start_scan(struct ath10k *ar,
-                          const struct wmi_start_scan_arg *arg)
+static struct sk_buff *
+ath10k_wmi_op_gen_start_scan(struct ath10k *ar,
+                             const struct wmi_start_scan_arg *arg)
 {
+        struct wmi_start_scan_cmd *cmd;
         struct sk_buff *skb;
         size_t len;
         int ret;
 
         ret = ath10k_wmi_start_scan_verify(arg);
         if (ret)
-                return ret;
-
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features))
-                len = sizeof(struct wmi_10x_start_scan_cmd) +
-                      ath10k_wmi_start_scan_tlvs_len(arg);
-        else
-                len = sizeof(struct wmi_start_scan_cmd) +
-                      ath10k_wmi_start_scan_tlvs_len(arg);
+                return ERR_PTR(ret);
 
+        len = sizeof(*cmd) + ath10k_wmi_start_scan_tlvs_len(arg);
         skb = ath10k_wmi_alloc_skb(ar, len);
         if (!skb)
-                return -ENOMEM;
-
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
-                struct wmi_10x_start_scan_cmd *cmd;
+                return ERR_PTR(-ENOMEM);
 
-                cmd = (struct wmi_10x_start_scan_cmd *)skb->data;
-                ath10k_wmi_put_start_scan_common(&cmd->common, arg);
-                ath10k_wmi_put_start_scan_tlvs(&cmd->tlvs, arg);
-        } else {
-                struct wmi_start_scan_cmd *cmd;
+        cmd = (struct wmi_start_scan_cmd *)skb->data;
 
-                cmd = (struct wmi_start_scan_cmd *)skb->data;
-                cmd->burst_duration_ms = __cpu_to_le32(0);
+        ath10k_wmi_put_start_scan_common(&cmd->common, arg);
+        ath10k_wmi_put_start_scan_tlvs(&cmd->tlvs, arg);
 
-                ath10k_wmi_put_start_scan_common(&cmd->common, arg);
-                ath10k_wmi_put_start_scan_tlvs(&cmd->tlvs, arg);
-        }
+        cmd->burst_duration_ms = __cpu_to_le32(0);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi start scan\n");
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->start_scan_cmdid);
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_10x_op_gen_start_scan(struct ath10k *ar,
+                                 const struct wmi_start_scan_arg *arg)
+{
+        struct wmi_10x_start_scan_cmd *cmd;
+        struct sk_buff *skb;
+        size_t len;
+        int ret;
+
+        ret = ath10k_wmi_start_scan_verify(arg);
+        if (ret)
+                return ERR_PTR(ret);
+
+        len = sizeof(*cmd) + ath10k_wmi_start_scan_tlvs_len(arg);
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        cmd = (struct wmi_10x_start_scan_cmd *)skb->data;
+
+        ath10k_wmi_put_start_scan_common(&cmd->common, arg);
+        ath10k_wmi_put_start_scan_tlvs(&cmd->tlvs, arg);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi 10x start scan\n");
+        return skb;
 }
 
 void ath10k_wmi_start_scan_init(struct ath10k *ar,
@@ -3614,7 +4206,9 @@ void ath10k_wmi_start_scan_init(struct ath10k *ar,
         arg->bssids[0].bssid = "\xFF\xFF\xFF\xFF\xFF\xFF";
 }
 
-int ath10k_wmi_stop_scan(struct ath10k *ar, const struct wmi_stop_scan_arg *arg)
+static struct sk_buff *
+ath10k_wmi_op_gen_stop_scan(struct ath10k *ar,
+                            const struct wmi_stop_scan_arg *arg)
 {
         struct wmi_stop_scan_cmd *cmd;
         struct sk_buff *skb;
@@ -3622,13 +4216,13 @@ int ath10k_wmi_stop_scan(struct ath10k *ar, const struct wmi_stop_scan_arg *arg)
         u32 req_id;
 
         if (arg->req_id > 0xFFF)
-                return -EINVAL;
+                return ERR_PTR(-EINVAL);
         if (arg->req_type == WMI_SCAN_STOP_ONE && arg->u.scan_id > 0xFFF)
-                return -EINVAL;
+                return ERR_PTR(-EINVAL);
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         scan_id = arg->u.scan_id;
         scan_id |= WMI_HOST_SCAN_REQ_ID_PREFIX;
@@ -3645,20 +4239,21 @@ int ath10k_wmi_stop_scan(struct ath10k *ar, const struct wmi_stop_scan_arg *arg)
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi stop scan reqid %d req_type %d vdev/scan_id %d\n",
                    arg->req_id, arg->req_type, arg->u.scan_id);
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->stop_scan_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_vdev_create(struct ath10k *ar, u32 vdev_id,
-                           enum wmi_vdev_type type,
-                           enum wmi_vdev_subtype subtype,
-                           const u8 macaddr[ETH_ALEN])
+static struct sk_buff *
+ath10k_wmi_op_gen_vdev_create(struct ath10k *ar, u32 vdev_id,
+                              enum wmi_vdev_type type,
+                              enum wmi_vdev_subtype subtype,
+                              const u8 macaddr[ETH_ALEN])
 {
         struct wmi_vdev_create_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_vdev_create_cmd *)skb->data;
         cmd->vdev_id      = __cpu_to_le32(vdev_id);
@@ -3669,58 +4264,52 @@ int ath10k_wmi_vdev_create(struct ath10k *ar, u32 vdev_id,
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "WMI vdev create: id %d type %d subtype %d macaddr %pM\n",
                    vdev_id, type, subtype, macaddr);
-
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->vdev_create_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_vdev_delete(struct ath10k *ar, u32 vdev_id)
+static struct sk_buff *
+ath10k_wmi_op_gen_vdev_delete(struct ath10k *ar, u32 vdev_id)
 {
         struct wmi_vdev_delete_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_vdev_delete_cmd *)skb->data;
         cmd->vdev_id = __cpu_to_le32(vdev_id);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "WMI vdev delete id %d\n", vdev_id);
-
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->vdev_delete_cmdid);
+        return skb;
 }
 
-static int
-ath10k_wmi_vdev_start_restart(struct ath10k *ar,
-                              const struct wmi_vdev_start_request_arg *arg,
-                              u32 cmd_id)
+static struct sk_buff *
+ath10k_wmi_op_gen_vdev_start(struct ath10k *ar,
+                             const struct wmi_vdev_start_request_arg *arg,
+                             bool restart)
 {
         struct wmi_vdev_start_request_cmd *cmd;
         struct sk_buff *skb;
         const char *cmdname;
         u32 flags = 0;
 
-        if (cmd_id != ar->wmi.cmd->vdev_start_request_cmdid &&
-            cmd_id != ar->wmi.cmd->vdev_restart_request_cmdid)
-                return -EINVAL;
         if (WARN_ON(arg->ssid && arg->ssid_len == 0))
-                return -EINVAL;
+                return ERR_PTR(-EINVAL);
         if (WARN_ON(arg->hidden_ssid && !arg->ssid))
-                return -EINVAL;
+                return ERR_PTR(-EINVAL);
         if (WARN_ON(arg->ssid_len > sizeof(cmd->ssid.ssid)))
-                return -EINVAL;
+                return ERR_PTR(-EINVAL);
 
-        if (cmd_id == ar->wmi.cmd->vdev_start_request_cmdid)
-                cmdname = "start";
-        else if (cmd_id == ar->wmi.cmd->vdev_restart_request_cmdid)
+        if (restart)
                 cmdname = "restart";
         else
-                return -EINVAL; /* should not happen, we already check cmd_id */
+                cmdname = "start";
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         if (arg->hidden_ssid)
                 flags |= WMI_VDEV_START_HIDDEN_SSID;
@@ -3749,50 +4338,36 @@ ath10k_wmi_vdev_start_restart(struct ath10k *ar,
                    flags, arg->channel.freq, arg->channel.mode,
                    cmd->chan.flags, arg->channel.max_power);
 
-        return ath10k_wmi_cmd_send(ar, skb, cmd_id);
-}
-
-int ath10k_wmi_vdev_start(struct ath10k *ar,
-                          const struct wmi_vdev_start_request_arg *arg)
-{
-        u32 cmd_id = ar->wmi.cmd->vdev_start_request_cmdid;
-
-        return ath10k_wmi_vdev_start_restart(ar, arg, cmd_id);
-}
-
-int ath10k_wmi_vdev_restart(struct ath10k *ar,
-                            const struct wmi_vdev_start_request_arg *arg)
-{
-        u32 cmd_id = ar->wmi.cmd->vdev_restart_request_cmdid;
-
-        return ath10k_wmi_vdev_start_restart(ar, arg, cmd_id);
+        return skb;
 }
 
-int ath10k_wmi_vdev_stop(struct ath10k *ar, u32 vdev_id)
+static struct sk_buff *
+ath10k_wmi_op_gen_vdev_stop(struct ath10k *ar, u32 vdev_id)
 {
         struct wmi_vdev_stop_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_vdev_stop_cmd *)skb->data;
         cmd->vdev_id = __cpu_to_le32(vdev_id);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi vdev stop id 0x%x\n", vdev_id);
-
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->vdev_stop_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_vdev_up(struct ath10k *ar, u32 vdev_id, u32 aid, const u8 *bssid)
+static struct sk_buff *
+ath10k_wmi_op_gen_vdev_up(struct ath10k *ar, u32 vdev_id, u32 aid,
+                          const u8 *bssid)
 {
         struct wmi_vdev_up_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_vdev_up_cmd *)skb->data;
         cmd->vdev_id       = __cpu_to_le32(vdev_id);
@@ -3802,30 +4377,30 @@ int ath10k_wmi_vdev_up(struct ath10k *ar, u32 vdev_id, u32 aid, const u8 *bssid)
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi mgmt vdev up id 0x%x assoc id %d bssid %pM\n",
                    vdev_id, aid, bssid);
-
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->vdev_up_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_vdev_down(struct ath10k *ar, u32 vdev_id)
+static struct sk_buff *
+ath10k_wmi_op_gen_vdev_down(struct ath10k *ar, u32 vdev_id)
 {
         struct wmi_vdev_down_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_vdev_down_cmd *)skb->data;
         cmd->vdev_id = __cpu_to_le32(vdev_id);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi mgmt vdev down id 0x%x\n", vdev_id);
-
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->vdev_down_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_vdev_set_param(struct ath10k *ar, u32 vdev_id,
-                              u32 param_id, u32 param_value)
+static struct sk_buff *
+ath10k_wmi_op_gen_vdev_set_param(struct ath10k *ar, u32 vdev_id,
+                                 u32 param_id, u32 param_value)
 {
         struct wmi_vdev_set_param_cmd *cmd;
         struct sk_buff *skb;
@@ -3834,12 +4409,12 @@ int ath10k_wmi_vdev_set_param(struct ath10k *ar, u32 vdev_id,
                 ath10k_dbg(ar, ATH10K_DBG_WMI,
                            "vdev param %d not supported by firmware\n",
                             param_id);
-                return -EOPNOTSUPP;
+                return ERR_PTR(-EOPNOTSUPP);
         }
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_vdev_set_param_cmd *)skb->data;
         cmd->vdev_id     = __cpu_to_le32(vdev_id);
@@ -3849,24 +4424,24 @@ int ath10k_wmi_vdev_set_param(struct ath10k *ar, u32 vdev_id,
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi vdev id 0x%x set param %d value %d\n",
                    vdev_id, param_id, param_value);
-
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->vdev_set_param_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_vdev_install_key(struct ath10k *ar,
-                                const struct wmi_vdev_install_key_arg *arg)
+static struct sk_buff *
+ath10k_wmi_op_gen_vdev_install_key(struct ath10k *ar,
+                                   const struct wmi_vdev_install_key_arg *arg)
 {
         struct wmi_vdev_install_key_cmd *cmd;
         struct sk_buff *skb;
 
         if (arg->key_cipher == WMI_CIPHER_NONE && arg->key_data != NULL)
-                return -EINVAL;
+                return ERR_PTR(-EINVAL);
         if (arg->key_cipher != WMI_CIPHER_NONE && arg->key_data == NULL)
-                return -EINVAL;
+                return ERR_PTR(-EINVAL);
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd) + arg->key_len);
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_vdev_install_key_cmd *)skb->data;
         cmd->vdev_id       = __cpu_to_le32(arg->vdev_id);
@@ -3885,20 +4460,19 @@ int ath10k_wmi_vdev_install_key(struct ath10k *ar,
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi vdev install key idx %d cipher %d len %d\n",
                    arg->key_idx, arg->key_cipher, arg->key_len);
-        return ath10k_wmi_cmd_send(ar, skb,
-                                   ar->wmi.cmd->vdev_install_key_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_vdev_spectral_conf(struct ath10k *ar,
-                                  const struct wmi_vdev_spectral_conf_arg *arg)
+static struct sk_buff *
+ath10k_wmi_op_gen_vdev_spectral_conf(struct ath10k *ar,
+                                     const struct wmi_vdev_spectral_conf_arg *arg)
 {
         struct wmi_vdev_spectral_conf_cmd *cmd;
         struct sk_buff *skb;
-        u32 cmdid;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_vdev_spectral_conf_cmd *)skb->data;
         cmd->vdev_id = __cpu_to_le32(arg->vdev_id);
@@ -3921,39 +4495,38 @@ int ath10k_wmi_vdev_spectral_conf(struct ath10k *ar,
         cmd->scan_dbm_adj = __cpu_to_le32(arg->scan_dbm_adj);
         cmd->scan_chn_mask = __cpu_to_le32(arg->scan_chn_mask);
 
-        cmdid = ar->wmi.cmd->vdev_spectral_scan_configure_cmdid;
-        return ath10k_wmi_cmd_send(ar, skb, cmdid);
+        return skb;
 }
 
-int ath10k_wmi_vdev_spectral_enable(struct ath10k *ar, u32 vdev_id, u32 trigger,
-                                    u32 enable)
+static struct sk_buff *
+ath10k_wmi_op_gen_vdev_spectral_enable(struct ath10k *ar, u32 vdev_id,
+                                       u32 trigger, u32 enable)
 {
         struct wmi_vdev_spectral_enable_cmd *cmd;
         struct sk_buff *skb;
-        u32 cmdid;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_vdev_spectral_enable_cmd *)skb->data;
         cmd->vdev_id = __cpu_to_le32(vdev_id);
         cmd->trigger_cmd = __cpu_to_le32(trigger);
         cmd->enable_cmd = __cpu_to_le32(enable);
 
-        cmdid = ar->wmi.cmd->vdev_spectral_scan_enable_cmdid;
-        return ath10k_wmi_cmd_send(ar, skb, cmdid);
+        return skb;
 }
 
-int ath10k_wmi_peer_create(struct ath10k *ar, u32 vdev_id,
-                           const u8 peer_addr[ETH_ALEN])
+static struct sk_buff *
+ath10k_wmi_op_gen_peer_create(struct ath10k *ar, u32 vdev_id,
+                              const u8 peer_addr[ETH_ALEN])
 {
         struct wmi_peer_create_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_peer_create_cmd *)skb->data;
         cmd->vdev_id = __cpu_to_le32(vdev_id);
@@ -3962,18 +4535,19 @@ int ath10k_wmi_peer_create(struct ath10k *ar, u32 vdev_id,
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi peer create vdev_id %d peer_addr %pM\n",
                    vdev_id, peer_addr);
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->peer_create_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_peer_delete(struct ath10k *ar, u32 vdev_id,
-                           const u8 peer_addr[ETH_ALEN])
+static struct sk_buff *
+ath10k_wmi_op_gen_peer_delete(struct ath10k *ar, u32 vdev_id,
+                              const u8 peer_addr[ETH_ALEN])
 {
         struct wmi_peer_delete_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_peer_delete_cmd *)skb->data;
         cmd->vdev_id = __cpu_to_le32(vdev_id);
@@ -3982,18 +4556,19 @@ int ath10k_wmi_peer_delete(struct ath10k *ar, u32 vdev_id,
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi peer delete vdev_id %d peer_addr %pM\n",
                    vdev_id, peer_addr);
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->peer_delete_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_peer_flush(struct ath10k *ar, u32 vdev_id,
-                          const u8 peer_addr[ETH_ALEN], u32 tid_bitmap)
+static struct sk_buff *
+ath10k_wmi_op_gen_peer_flush(struct ath10k *ar, u32 vdev_id,
+                             const u8 peer_addr[ETH_ALEN], u32 tid_bitmap)
 {
         struct wmi_peer_flush_tids_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_peer_flush_tids_cmd *)skb->data;
         cmd->vdev_id         = __cpu_to_le32(vdev_id);
@@ -4003,19 +4578,21 @@ int ath10k_wmi_peer_flush(struct ath10k *ar, u32 vdev_id,
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi peer flush vdev_id %d peer_addr %pM tids %08x\n",
                    vdev_id, peer_addr, tid_bitmap);
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->peer_flush_tids_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_peer_set_param(struct ath10k *ar, u32 vdev_id,
-                              const u8 *peer_addr, enum wmi_peer_param param_id,
-                              u32 param_value)
+static struct sk_buff *
+ath10k_wmi_op_gen_peer_set_param(struct ath10k *ar, u32 vdev_id,
+                                 const u8 *peer_addr,
+                                 enum wmi_peer_param param_id,
+                                 u32 param_value)
 {
         struct wmi_peer_set_param_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_peer_set_param_cmd *)skb->data;
         cmd->vdev_id     = __cpu_to_le32(vdev_id);
@@ -4026,19 +4603,19 @@ int ath10k_wmi_peer_set_param(struct ath10k *ar, u32 vdev_id,
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi vdev %d peer 0x%pM set param %d value %d\n",
                    vdev_id, peer_addr, param_id, param_value);
-
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->peer_set_param_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_set_psmode(struct ath10k *ar, u32 vdev_id,
-                          enum wmi_sta_ps_mode psmode)
+static struct sk_buff *
+ath10k_wmi_op_gen_set_psmode(struct ath10k *ar, u32 vdev_id,
+                             enum wmi_sta_ps_mode psmode)
 {
         struct wmi_sta_powersave_mode_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_sta_powersave_mode_cmd *)skb->data;
         cmd->vdev_id     = __cpu_to_le32(vdev_id);
@@ -4047,21 +4624,20 @@ int ath10k_wmi_set_psmode(struct ath10k *ar, u32 vdev_id,
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi set powersave id 0x%x mode %d\n",
                    vdev_id, psmode);
-
-        return ath10k_wmi_cmd_send(ar, skb,
-                                   ar->wmi.cmd->sta_powersave_mode_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_set_sta_ps_param(struct ath10k *ar, u32 vdev_id,
-                                enum wmi_sta_powersave_param param_id,
-                                u32 value)
+static struct sk_buff *
+ath10k_wmi_op_gen_set_sta_ps(struct ath10k *ar, u32 vdev_id,
+                             enum wmi_sta_powersave_param param_id,
+                             u32 value)
 {
         struct wmi_sta_powersave_param_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_sta_powersave_param_cmd *)skb->data;
         cmd->vdev_id     = __cpu_to_le32(vdev_id);
@@ -4071,22 +4647,22 @@ int ath10k_wmi_set_sta_ps_param(struct ath10k *ar, u32 vdev_id,
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi sta ps param vdev_id 0x%x param %d value %d\n",
                    vdev_id, param_id, value);
-        return ath10k_wmi_cmd_send(ar, skb,
-                                   ar->wmi.cmd->sta_powersave_param_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_set_ap_ps_param(struct ath10k *ar, u32 vdev_id, const u8 *mac,
-                               enum wmi_ap_ps_peer_param param_id, u32 value)
+static struct sk_buff *
+ath10k_wmi_op_gen_set_ap_ps(struct ath10k *ar, u32 vdev_id, const u8 *mac,
+                            enum wmi_ap_ps_peer_param param_id, u32 value)
 {
         struct wmi_ap_ps_peer_cmd *cmd;
         struct sk_buff *skb;
 
         if (!mac)
-                return -EINVAL;
+                return ERR_PTR(-EINVAL);
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_ap_ps_peer_cmd *)skb->data;
         cmd->vdev_id = __cpu_to_le32(vdev_id);
@@ -4097,13 +4673,12 @@ int ath10k_wmi_set_ap_ps_param(struct ath10k *ar, u32 vdev_id, const u8 *mac,
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi ap ps param vdev_id 0x%X param %d value %d mac_addr %pM\n",
                    vdev_id, param_id, value, mac);
-
-        return ath10k_wmi_cmd_send(ar, skb,
-                                   ar->wmi.cmd->ap_ps_peer_param_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_scan_chan_list(struct ath10k *ar,
-                              const struct wmi_scan_chan_list_arg *arg)
+static struct sk_buff *
+ath10k_wmi_op_gen_scan_chan_list(struct ath10k *ar,
+                                 const struct wmi_scan_chan_list_arg *arg)
 {
         struct wmi_scan_chan_list_cmd *cmd;
         struct sk_buff *skb;
@@ -4116,7 +4691,7 @@ int ath10k_wmi_scan_chan_list(struct ath10k *ar,
 
         skb = ath10k_wmi_alloc_skb(ar, len);
         if (!skb)
-                return -EINVAL;
+                return ERR_PTR(-EINVAL);
 
         cmd = (struct wmi_scan_chan_list_cmd *)skb->data;
         cmd->num_scan_chans = __cpu_to_le32(arg->n_channels);
@@ -4128,7 +4703,7 @@ int ath10k_wmi_scan_chan_list(struct ath10k *ar,
                 ath10k_wmi_put_wmi_channel(ci, ch);
         }
 
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->scan_chan_list_cmdid);
+        return skb;
 }
 
 static void
@@ -4209,12 +4784,9 @@ ath10k_wmi_peer_assoc_fill_10_2(struct ath10k *ar, void *buf,
         cmd->info0 = __cpu_to_le32(info0);
 }
 
-int ath10k_wmi_peer_assoc(struct ath10k *ar,
-                          const struct wmi_peer_assoc_complete_arg *arg)
+static int
+ath10k_wmi_peer_assoc_check_arg(const struct wmi_peer_assoc_complete_arg *arg)
 {
-        struct sk_buff *skb;
-        int len;
-
         if (arg->peer_mpdu_density > 16)
                 return -EINVAL;
         if (arg->peer_legacy_rates.num_rates > MAX_SUPPORTED_RATES)
@@ -4222,79 +4794,135 @@ int ath10k_wmi_peer_assoc(struct ath10k *ar,
         if (arg->peer_ht_rates.num_rates > MAX_SUPPORTED_RATES)
                 return -EINVAL;
 
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
-                if (test_bit(ATH10K_FW_FEATURE_WMI_10_2, ar->fw_features))
-                        len = sizeof(struct wmi_10_2_peer_assoc_complete_cmd);
-                else
-                        len = sizeof(struct wmi_10_1_peer_assoc_complete_cmd);
-        } else {
-                len = sizeof(struct wmi_main_peer_assoc_complete_cmd);
-        }
+        return 0;
+}
+
+static struct sk_buff *
+ath10k_wmi_op_gen_peer_assoc(struct ath10k *ar,
+                             const struct wmi_peer_assoc_complete_arg *arg)
+{
+        size_t len = sizeof(struct wmi_main_peer_assoc_complete_cmd);
+        struct sk_buff *skb;
+        int ret;
+
+        ret = ath10k_wmi_peer_assoc_check_arg(arg);
+        if (ret)
+                return ERR_PTR(ret);
 
         skb = ath10k_wmi_alloc_skb(ar, len);
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
-                if (test_bit(ATH10K_FW_FEATURE_WMI_10_2, ar->fw_features))
-                        ath10k_wmi_peer_assoc_fill_10_2(ar, skb->data, arg);
-                else
-                        ath10k_wmi_peer_assoc_fill_10_1(ar, skb->data, arg);
-        } else {
-                ath10k_wmi_peer_assoc_fill_main(ar, skb->data, arg);
-        }
+        ath10k_wmi_peer_assoc_fill_main(ar, skb->data, arg);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI,
+                   "wmi peer assoc vdev %d addr %pM (%s)\n",
+                   arg->vdev_id, arg->addr,
+                   arg->peer_reassoc ? "reassociate" : "new");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_10_1_op_gen_peer_assoc(struct ath10k *ar,
+                                  const struct wmi_peer_assoc_complete_arg *arg)
+{
+        size_t len = sizeof(struct wmi_10_1_peer_assoc_complete_cmd);
+        struct sk_buff *skb;
+        int ret;
+
+        ret = ath10k_wmi_peer_assoc_check_arg(arg);
+        if (ret)
+                return ERR_PTR(ret);
+
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ath10k_wmi_peer_assoc_fill_10_1(ar, skb->data, arg);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI,
+                   "wmi peer assoc vdev %d addr %pM (%s)\n",
+                   arg->vdev_id, arg->addr,
+                   arg->peer_reassoc ? "reassociate" : "new");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_10_2_op_gen_peer_assoc(struct ath10k *ar,
+                                  const struct wmi_peer_assoc_complete_arg *arg)
+{
+        size_t len = sizeof(struct wmi_10_2_peer_assoc_complete_cmd);
+        struct sk_buff *skb;
+        int ret;
+
+        ret = ath10k_wmi_peer_assoc_check_arg(arg);
+        if (ret)
+                return ERR_PTR(ret);
+
+        skb = ath10k_wmi_alloc_skb(ar, len);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ath10k_wmi_peer_assoc_fill_10_2(ar, skb->data, arg);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI,
                    "wmi peer assoc vdev %d addr %pM (%s)\n",
                    arg->vdev_id, arg->addr,
                    arg->peer_reassoc ? "reassociate" : "new");
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->peer_assoc_cmdid);
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_10_2_op_gen_pdev_get_temperature(struct ath10k *ar)
+{
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, 0);
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi pdev get temperature\n");
+        return skb;
 }
 
 /* This function assumes the beacon is already DMA mapped */
-int ath10k_wmi_beacon_send_ref_nowait(struct ath10k_vif *arvif)
+static struct sk_buff *
+ath10k_wmi_op_gen_beacon_dma(struct ath10k *ar, u32 vdev_id, const void *bcn,
+                             size_t bcn_len, u32 bcn_paddr, bool dtim_zero,
+                             bool deliver_cab)
 {
         struct wmi_bcn_tx_ref_cmd *cmd;
         struct sk_buff *skb;
-        struct sk_buff *beacon = arvif->beacon;
-        struct ath10k *ar = arvif->ar;
         struct ieee80211_hdr *hdr;
-        int ret;
         u16 fc;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
-        hdr = (struct ieee80211_hdr *)beacon->data;
+        hdr = (struct ieee80211_hdr *)bcn;
         fc = le16_to_cpu(hdr->frame_control);
 
         cmd = (struct wmi_bcn_tx_ref_cmd *)skb->data;
-        cmd->vdev_id = __cpu_to_le32(arvif->vdev_id);
-        cmd->data_len = __cpu_to_le32(beacon->len);
-        cmd->data_ptr = __cpu_to_le32(ATH10K_SKB_CB(beacon)->paddr);
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        cmd->data_len = __cpu_to_le32(bcn_len);
+        cmd->data_ptr = __cpu_to_le32(bcn_paddr);
         cmd->msdu_id = 0;
         cmd->frame_control = __cpu_to_le32(fc);
         cmd->flags = 0;
         cmd->antenna_mask = __cpu_to_le32(WMI_BCN_TX_REF_DEF_ANTENNA);
 
-        if (ATH10K_SKB_CB(beacon)->bcn.dtim_zero)
+        if (dtim_zero)
                 cmd->flags |= __cpu_to_le32(WMI_BCN_TX_REF_FLAG_DTIM_ZERO);
 
-        if (ATH10K_SKB_CB(beacon)->bcn.deliver_cab)
+        if (deliver_cab)
                 cmd->flags |= __cpu_to_le32(WMI_BCN_TX_REF_FLAG_DELIVER_CAB);
 
-        ret = ath10k_wmi_cmd_send_nowait(ar, skb,
-                                         ar->wmi.cmd->pdev_send_bcn_cmdid);
-
-        if (ret)
-                dev_kfree_skb(skb);
-
-        return ret;
+        return skb;
 }
 
-static void ath10k_wmi_pdev_set_wmm_param(struct wmi_wmm_params *params,
-                                          const struct wmi_wmm_params_arg *arg)
+void ath10k_wmi_set_wmm_param(struct wmi_wmm_params *params,
+                              const struct wmi_wmm_params_arg *arg)
 {
         params->cwmin  = __cpu_to_le32(arg->cwmin);
         params->cwmax  = __cpu_to_le32(arg->cwmax);
@@ -4304,52 +4932,54 @@ static void ath10k_wmi_pdev_set_wmm_param(struct wmi_wmm_params *params,
         params->no_ack = __cpu_to_le32(arg->no_ack);
 }
 
-int ath10k_wmi_pdev_set_wmm_params(struct ath10k *ar,
-                                   const struct wmi_pdev_set_wmm_params_arg *arg)
+static struct sk_buff *
+ath10k_wmi_op_gen_pdev_set_wmm(struct ath10k *ar,
+                               const struct wmi_wmm_params_all_arg *arg)
 {
         struct wmi_pdev_set_wmm_params *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_pdev_set_wmm_params *)skb->data;
-        ath10k_wmi_pdev_set_wmm_param(&cmd->ac_be, &arg->ac_be);
-        ath10k_wmi_pdev_set_wmm_param(&cmd->ac_bk, &arg->ac_bk);
-        ath10k_wmi_pdev_set_wmm_param(&cmd->ac_vi, &arg->ac_vi);
-        ath10k_wmi_pdev_set_wmm_param(&cmd->ac_vo, &arg->ac_vo);
+        ath10k_wmi_set_wmm_param(&cmd->ac_be, &arg->ac_be);
+        ath10k_wmi_set_wmm_param(&cmd->ac_bk, &arg->ac_bk);
+        ath10k_wmi_set_wmm_param(&cmd->ac_vi, &arg->ac_vi);
+        ath10k_wmi_set_wmm_param(&cmd->ac_vo, &arg->ac_vo);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi pdev set wmm params\n");
-        return ath10k_wmi_cmd_send(ar, skb,
-                                   ar->wmi.cmd->pdev_set_wmm_params_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_request_stats(struct ath10k *ar, enum wmi_stats_id stats_id)
+static struct sk_buff *
+ath10k_wmi_op_gen_request_stats(struct ath10k *ar, enum wmi_stats_id stats_id)
 {
         struct wmi_request_stats_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_request_stats_cmd *)skb->data;
         cmd->stats_id = __cpu_to_le32(stats_id);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi request stats %d\n", (int)stats_id);
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->request_stats_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_force_fw_hang(struct ath10k *ar,
-                             enum wmi_force_fw_hang_type type, u32 delay_ms)
+static struct sk_buff *
+ath10k_wmi_op_gen_force_fw_hang(struct ath10k *ar,
+                                enum wmi_force_fw_hang_type type, u32 delay_ms)
 {
         struct wmi_force_fw_hang_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_force_fw_hang_cmd *)skb->data;
         cmd->type = __cpu_to_le32(type);
@@ -4357,10 +4987,12 @@ int ath10k_wmi_force_fw_hang(struct ath10k *ar,
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi force fw hang %d delay %d\n",
                    type, delay_ms);
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->force_fw_hang_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_dbglog_cfg(struct ath10k *ar, u32 module_enable)
+static struct sk_buff *
+ath10k_wmi_op_gen_dbglog_cfg(struct ath10k *ar, u32 module_enable,
+                             u32 log_level)
 {
         struct wmi_dbglog_cfg_cmd *cmd;
         struct sk_buff *skb;
@@ -4368,12 +5000,12 @@ int ath10k_wmi_dbglog_cfg(struct ath10k *ar, u32 module_enable)
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         cmd = (struct wmi_dbglog_cfg_cmd *)skb->data;
 
         if (module_enable) {
-                cfg = SM(ATH10K_DBGLOG_LEVEL_VERBOSE,
+                cfg = SM(log_level,
                          ATH10K_DBGLOG_CFG_LOG_LVL);
         } else {
                 /* set back defaults, all modules with WARN level */
@@ -4393,57 +5025,449 @@ int ath10k_wmi_dbglog_cfg(struct ath10k *ar, u32 module_enable)
                    __le32_to_cpu(cmd->module_valid),
                    __le32_to_cpu(cmd->config_enable),
                    __le32_to_cpu(cmd->config_valid));
-
-        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->dbglog_cfg_cmdid);
+        return skb;
 }
 
-int ath10k_wmi_pdev_pktlog_enable(struct ath10k *ar, u32 ev_bitmap)
+static struct sk_buff *
+ath10k_wmi_op_gen_pktlog_enable(struct ath10k *ar, u32 ev_bitmap)
 {
         struct wmi_pdev_pktlog_enable_cmd *cmd;
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         ev_bitmap &= ATH10K_PKTLOG_ANY;
-        ath10k_dbg(ar, ATH10K_DBG_WMI,
-                   "wmi enable pktlog filter:%x\n", ev_bitmap);
 
         cmd = (struct wmi_pdev_pktlog_enable_cmd *)skb->data;
         cmd->ev_bitmap = __cpu_to_le32(ev_bitmap);
-        return ath10k_wmi_cmd_send(ar, skb,
-                                   ar->wmi.cmd->pdev_pktlog_enable_cmdid);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi enable pktlog filter 0x%08x\n",
+                   ev_bitmap);
+        return skb;
 }
 
-int ath10k_wmi_pdev_pktlog_disable(struct ath10k *ar)
+static struct sk_buff *
+ath10k_wmi_op_gen_pktlog_disable(struct ath10k *ar)
 {
         struct sk_buff *skb;
 
         skb = ath10k_wmi_alloc_skb(ar, 0);
         if (!skb)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         ath10k_dbg(ar, ATH10K_DBG_WMI, "wmi disable pktlog\n");
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_op_gen_pdev_set_quiet_mode(struct ath10k *ar, u32 period,
+                                      u32 duration, u32 next_offset,
+                                      u32 enabled)
+{
+        struct wmi_pdev_set_quiet_cmd *cmd;
+        struct sk_buff *skb;
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        cmd = (struct wmi_pdev_set_quiet_cmd *)skb->data;
+        cmd->period = __cpu_to_le32(period);
+        cmd->duration = __cpu_to_le32(duration);
+        cmd->next_start = __cpu_to_le32(next_offset);
+        cmd->enabled = __cpu_to_le32(enabled);
 
-        return ath10k_wmi_cmd_send(ar, skb,
-                                   ar->wmi.cmd->pdev_pktlog_disable_cmdid);
+        ath10k_dbg(ar, ATH10K_DBG_WMI,
+                   "wmi quiet param: period %u duration %u enabled %d\n",
+                   period, duration, enabled);
+        return skb;
 }
 
-int ath10k_wmi_attach(struct ath10k *ar)
+static struct sk_buff *
+ath10k_wmi_op_gen_addba_clear_resp(struct ath10k *ar, u32 vdev_id,
+                                   const u8 *mac)
 {
-        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
-                if (test_bit(ATH10K_FW_FEATURE_WMI_10_2, ar->fw_features))
-                        ar->wmi.cmd = &wmi_10_2_cmd_map;
-                else
-                        ar->wmi.cmd = &wmi_10x_cmd_map;
+        struct wmi_addba_clear_resp_cmd *cmd;
+        struct sk_buff *skb;
+
+        if (!mac)
+                return ERR_PTR(-EINVAL);
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        cmd = (struct wmi_addba_clear_resp_cmd *)skb->data;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        ether_addr_copy(cmd->peer_macaddr.addr, mac);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI,
+                   "wmi addba clear resp vdev_id 0x%X mac_addr %pM\n",
+                   vdev_id, mac);
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_op_gen_addba_send(struct ath10k *ar, u32 vdev_id, const u8 *mac,
+                             u32 tid, u32 buf_size)
+{
+        struct wmi_addba_send_cmd *cmd;
+        struct sk_buff *skb;
+
+        if (!mac)
+                return ERR_PTR(-EINVAL);
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        cmd = (struct wmi_addba_send_cmd *)skb->data;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        ether_addr_copy(cmd->peer_macaddr.addr, mac);
+        cmd->tid = __cpu_to_le32(tid);
+        cmd->buffersize = __cpu_to_le32(buf_size);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI,
+                   "wmi addba send vdev_id 0x%X mac_addr %pM tid %u bufsize %u\n",
+                   vdev_id, mac, tid, buf_size);
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_op_gen_addba_set_resp(struct ath10k *ar, u32 vdev_id, const u8 *mac,
+                                 u32 tid, u32 status)
+{
+        struct wmi_addba_setresponse_cmd *cmd;
+        struct sk_buff *skb;
+
+        if (!mac)
+                return ERR_PTR(-EINVAL);
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        cmd = (struct wmi_addba_setresponse_cmd *)skb->data;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        ether_addr_copy(cmd->peer_macaddr.addr, mac);
+        cmd->tid = __cpu_to_le32(tid);
+        cmd->statuscode = __cpu_to_le32(status);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI,
+                   "wmi addba set resp vdev_id 0x%X mac_addr %pM tid %u status %u\n",
+                   vdev_id, mac, tid, status);
+        return skb;
+}
+
+static struct sk_buff *
+ath10k_wmi_op_gen_delba_send(struct ath10k *ar, u32 vdev_id, const u8 *mac,
+                             u32 tid, u32 initiator, u32 reason)
+{
+        struct wmi_delba_send_cmd *cmd;
+        struct sk_buff *skb;
+
+        if (!mac)
+                return ERR_PTR(-EINVAL);
+
+        skb = ath10k_wmi_alloc_skb(ar, sizeof(*cmd));
+        if (!skb)
+                return ERR_PTR(-ENOMEM);
+
+        cmd = (struct wmi_delba_send_cmd *)skb->data;
+        cmd->vdev_id = __cpu_to_le32(vdev_id);
+        ether_addr_copy(cmd->peer_macaddr.addr, mac);
+        cmd->tid = __cpu_to_le32(tid);
+        cmd->initiator = __cpu_to_le32(initiator);
+        cmd->reasoncode = __cpu_to_le32(reason);
+
+        ath10k_dbg(ar, ATH10K_DBG_WMI,
+                   "wmi delba send vdev_id 0x%X mac_addr %pM tid %u initiator %u reason %u\n",
+                   vdev_id, mac, tid, initiator, reason);
+        return skb;
+}
+
+static const struct wmi_ops wmi_ops = {
+        .rx = ath10k_wmi_op_rx,
+        .map_svc = wmi_main_svc_map,
+
+        .pull_scan = ath10k_wmi_op_pull_scan_ev,
+        .pull_mgmt_rx = ath10k_wmi_op_pull_mgmt_rx_ev,
+        .pull_ch_info = ath10k_wmi_op_pull_ch_info_ev,
+        .pull_vdev_start = ath10k_wmi_op_pull_vdev_start_ev,
+        .pull_peer_kick = ath10k_wmi_op_pull_peer_kick_ev,
+        .pull_swba = ath10k_wmi_op_pull_swba_ev,
+        .pull_phyerr = ath10k_wmi_op_pull_phyerr_ev,
+        .pull_svc_rdy = ath10k_wmi_main_op_pull_svc_rdy_ev,
+        .pull_rdy = ath10k_wmi_op_pull_rdy_ev,
+        .pull_fw_stats = ath10k_wmi_main_op_pull_fw_stats,
+
+        .gen_pdev_suspend = ath10k_wmi_op_gen_pdev_suspend,
+        .gen_pdev_resume = ath10k_wmi_op_gen_pdev_resume,
+        .gen_pdev_set_rd = ath10k_wmi_op_gen_pdev_set_rd,
+        .gen_pdev_set_param = ath10k_wmi_op_gen_pdev_set_param,
+        .gen_init = ath10k_wmi_op_gen_init,
+        .gen_start_scan = ath10k_wmi_op_gen_start_scan,
+        .gen_stop_scan = ath10k_wmi_op_gen_stop_scan,
+        .gen_vdev_create = ath10k_wmi_op_gen_vdev_create,
+        .gen_vdev_delete = ath10k_wmi_op_gen_vdev_delete,
+        .gen_vdev_start = ath10k_wmi_op_gen_vdev_start,
+        .gen_vdev_stop = ath10k_wmi_op_gen_vdev_stop,
+        .gen_vdev_up = ath10k_wmi_op_gen_vdev_up,
+        .gen_vdev_down = ath10k_wmi_op_gen_vdev_down,
+        .gen_vdev_set_param = ath10k_wmi_op_gen_vdev_set_param,
+        .gen_vdev_install_key = ath10k_wmi_op_gen_vdev_install_key,
+        .gen_vdev_spectral_conf = ath10k_wmi_op_gen_vdev_spectral_conf,
+        .gen_vdev_spectral_enable = ath10k_wmi_op_gen_vdev_spectral_enable,
+        /* .gen_vdev_wmm_conf not implemented */
+        .gen_peer_create = ath10k_wmi_op_gen_peer_create,
+        .gen_peer_delete = ath10k_wmi_op_gen_peer_delete,
+        .gen_peer_flush = ath10k_wmi_op_gen_peer_flush,
+        .gen_peer_set_param = ath10k_wmi_op_gen_peer_set_param,
+        .gen_peer_assoc = ath10k_wmi_op_gen_peer_assoc,
+        .gen_set_psmode = ath10k_wmi_op_gen_set_psmode,
+        .gen_set_sta_ps = ath10k_wmi_op_gen_set_sta_ps,
+        .gen_set_ap_ps = ath10k_wmi_op_gen_set_ap_ps,
+        .gen_scan_chan_list = ath10k_wmi_op_gen_scan_chan_list,
+        .gen_beacon_dma = ath10k_wmi_op_gen_beacon_dma,
+        .gen_pdev_set_wmm = ath10k_wmi_op_gen_pdev_set_wmm,
+        .gen_request_stats = ath10k_wmi_op_gen_request_stats,
+        .gen_force_fw_hang = ath10k_wmi_op_gen_force_fw_hang,
+        .gen_mgmt_tx = ath10k_wmi_op_gen_mgmt_tx,
+        .gen_dbglog_cfg = ath10k_wmi_op_gen_dbglog_cfg,
+        .gen_pktlog_enable = ath10k_wmi_op_gen_pktlog_enable,
+        .gen_pktlog_disable = ath10k_wmi_op_gen_pktlog_disable,
+        .gen_pdev_set_quiet_mode = ath10k_wmi_op_gen_pdev_set_quiet_mode,
+        /* .gen_pdev_get_temperature not implemented */
+        .gen_addba_clear_resp = ath10k_wmi_op_gen_addba_clear_resp,
+        .gen_addba_send = ath10k_wmi_op_gen_addba_send,
+        .gen_addba_set_resp = ath10k_wmi_op_gen_addba_set_resp,
+        .gen_delba_send = ath10k_wmi_op_gen_delba_send,
+        /* .gen_bcn_tmpl not implemented */
+        /* .gen_prb_tmpl not implemented */
+        /* .gen_p2p_go_bcn_ie not implemented */
+};
+
+static const struct wmi_ops wmi_10_1_ops = {
+        .rx = ath10k_wmi_10_1_op_rx,
+        .map_svc = wmi_10x_svc_map,
+        .pull_svc_rdy = ath10k_wmi_10x_op_pull_svc_rdy_ev,
+        .pull_fw_stats = ath10k_wmi_10x_op_pull_fw_stats,
+        .gen_init = ath10k_wmi_10_1_op_gen_init,
+        .gen_pdev_set_rd = ath10k_wmi_10x_op_gen_pdev_set_rd,
+        .gen_start_scan = ath10k_wmi_10x_op_gen_start_scan,
+        .gen_peer_assoc = ath10k_wmi_10_1_op_gen_peer_assoc,
+        /* .gen_pdev_get_temperature not implemented */
+
+        /* shared with main branch */
+        .pull_scan = ath10k_wmi_op_pull_scan_ev,
+        .pull_mgmt_rx = ath10k_wmi_op_pull_mgmt_rx_ev,
+        .pull_ch_info = ath10k_wmi_op_pull_ch_info_ev,
+        .pull_vdev_start = ath10k_wmi_op_pull_vdev_start_ev,
+        .pull_peer_kick = ath10k_wmi_op_pull_peer_kick_ev,
+        .pull_swba = ath10k_wmi_op_pull_swba_ev,
+        .pull_phyerr = ath10k_wmi_op_pull_phyerr_ev,
+        .pull_rdy = ath10k_wmi_op_pull_rdy_ev,
+
+        .gen_pdev_suspend = ath10k_wmi_op_gen_pdev_suspend,
+        .gen_pdev_resume = ath10k_wmi_op_gen_pdev_resume,
+        .gen_pdev_set_param = ath10k_wmi_op_gen_pdev_set_param,
+        .gen_stop_scan = ath10k_wmi_op_gen_stop_scan,
+        .gen_vdev_create = ath10k_wmi_op_gen_vdev_create,
+        .gen_vdev_delete = ath10k_wmi_op_gen_vdev_delete,
+        .gen_vdev_start = ath10k_wmi_op_gen_vdev_start,
+        .gen_vdev_stop = ath10k_wmi_op_gen_vdev_stop,
+        .gen_vdev_up = ath10k_wmi_op_gen_vdev_up,
+        .gen_vdev_down = ath10k_wmi_op_gen_vdev_down,
+        .gen_vdev_set_param = ath10k_wmi_op_gen_vdev_set_param,
+        .gen_vdev_install_key = ath10k_wmi_op_gen_vdev_install_key,
+        .gen_vdev_spectral_conf = ath10k_wmi_op_gen_vdev_spectral_conf,
+        .gen_vdev_spectral_enable = ath10k_wmi_op_gen_vdev_spectral_enable,
+        /* .gen_vdev_wmm_conf not implemented */
+        .gen_peer_create = ath10k_wmi_op_gen_peer_create,
+        .gen_peer_delete = ath10k_wmi_op_gen_peer_delete,
+        .gen_peer_flush = ath10k_wmi_op_gen_peer_flush,
+        .gen_peer_set_param = ath10k_wmi_op_gen_peer_set_param,
+        .gen_set_psmode = ath10k_wmi_op_gen_set_psmode,
+        .gen_set_sta_ps = ath10k_wmi_op_gen_set_sta_ps,
+        .gen_set_ap_ps = ath10k_wmi_op_gen_set_ap_ps,
+        .gen_scan_chan_list = ath10k_wmi_op_gen_scan_chan_list,
+        .gen_beacon_dma = ath10k_wmi_op_gen_beacon_dma,
+        .gen_pdev_set_wmm = ath10k_wmi_op_gen_pdev_set_wmm,
+        .gen_request_stats = ath10k_wmi_op_gen_request_stats,
+        .gen_force_fw_hang = ath10k_wmi_op_gen_force_fw_hang,
+        .gen_mgmt_tx = ath10k_wmi_op_gen_mgmt_tx,
+        .gen_dbglog_cfg = ath10k_wmi_op_gen_dbglog_cfg,
+        .gen_pktlog_enable = ath10k_wmi_op_gen_pktlog_enable,
+        .gen_pktlog_disable = ath10k_wmi_op_gen_pktlog_disable,
+        .gen_pdev_set_quiet_mode = ath10k_wmi_op_gen_pdev_set_quiet_mode,
+        .gen_addba_clear_resp = ath10k_wmi_op_gen_addba_clear_resp,
+        .gen_addba_send = ath10k_wmi_op_gen_addba_send,
+        .gen_addba_set_resp = ath10k_wmi_op_gen_addba_set_resp,
+        .gen_delba_send = ath10k_wmi_op_gen_delba_send,
+        /* .gen_bcn_tmpl not implemented */
+        /* .gen_prb_tmpl not implemented */
+        /* .gen_p2p_go_bcn_ie not implemented */
+};
+
+static const struct wmi_ops wmi_10_2_ops = {
+        .rx = ath10k_wmi_10_2_op_rx,
+        .pull_fw_stats = ath10k_wmi_10_2_op_pull_fw_stats,
+        .gen_init = ath10k_wmi_10_2_op_gen_init,
+        .gen_peer_assoc = ath10k_wmi_10_2_op_gen_peer_assoc,
+        /* .gen_pdev_get_temperature not implemented */
+
+        /* shared with 10.1 */
+        .map_svc = wmi_10x_svc_map,
+        .pull_svc_rdy = ath10k_wmi_10x_op_pull_svc_rdy_ev,
+        .gen_pdev_set_rd = ath10k_wmi_10x_op_gen_pdev_set_rd,
+        .gen_start_scan = ath10k_wmi_10x_op_gen_start_scan,
+
+        .pull_scan = ath10k_wmi_op_pull_scan_ev,
+        .pull_mgmt_rx = ath10k_wmi_op_pull_mgmt_rx_ev,
+        .pull_ch_info = ath10k_wmi_op_pull_ch_info_ev,
+        .pull_vdev_start = ath10k_wmi_op_pull_vdev_start_ev,
+        .pull_peer_kick = ath10k_wmi_op_pull_peer_kick_ev,
+        .pull_swba = ath10k_wmi_op_pull_swba_ev,
+        .pull_phyerr = ath10k_wmi_op_pull_phyerr_ev,
+        .pull_rdy = ath10k_wmi_op_pull_rdy_ev,
+
+        .gen_pdev_suspend = ath10k_wmi_op_gen_pdev_suspend,
+        .gen_pdev_resume = ath10k_wmi_op_gen_pdev_resume,
+        .gen_pdev_set_param = ath10k_wmi_op_gen_pdev_set_param,
+        .gen_stop_scan = ath10k_wmi_op_gen_stop_scan,
+        .gen_vdev_create = ath10k_wmi_op_gen_vdev_create,
+        .gen_vdev_delete = ath10k_wmi_op_gen_vdev_delete,
+        .gen_vdev_start = ath10k_wmi_op_gen_vdev_start,
+        .gen_vdev_stop = ath10k_wmi_op_gen_vdev_stop,
+        .gen_vdev_up = ath10k_wmi_op_gen_vdev_up,
+        .gen_vdev_down = ath10k_wmi_op_gen_vdev_down,
+        .gen_vdev_set_param = ath10k_wmi_op_gen_vdev_set_param,
+        .gen_vdev_install_key = ath10k_wmi_op_gen_vdev_install_key,
+        .gen_vdev_spectral_conf = ath10k_wmi_op_gen_vdev_spectral_conf,
+        .gen_vdev_spectral_enable = ath10k_wmi_op_gen_vdev_spectral_enable,
+        /* .gen_vdev_wmm_conf not implemented */
+        .gen_peer_create = ath10k_wmi_op_gen_peer_create,
+        .gen_peer_delete = ath10k_wmi_op_gen_peer_delete,
+        .gen_peer_flush = ath10k_wmi_op_gen_peer_flush,
+        .gen_peer_set_param = ath10k_wmi_op_gen_peer_set_param,
+        .gen_set_psmode = ath10k_wmi_op_gen_set_psmode,
+        .gen_set_sta_ps = ath10k_wmi_op_gen_set_sta_ps,
+        .gen_set_ap_ps = ath10k_wmi_op_gen_set_ap_ps,
+        .gen_scan_chan_list = ath10k_wmi_op_gen_scan_chan_list,
+        .gen_beacon_dma = ath10k_wmi_op_gen_beacon_dma,
+        .gen_pdev_set_wmm = ath10k_wmi_op_gen_pdev_set_wmm,
+        .gen_request_stats = ath10k_wmi_op_gen_request_stats,
+        .gen_force_fw_hang = ath10k_wmi_op_gen_force_fw_hang,
+        .gen_mgmt_tx = ath10k_wmi_op_gen_mgmt_tx,
+        .gen_dbglog_cfg = ath10k_wmi_op_gen_dbglog_cfg,
+        .gen_pktlog_enable = ath10k_wmi_op_gen_pktlog_enable,
+        .gen_pktlog_disable = ath10k_wmi_op_gen_pktlog_disable,
+        .gen_pdev_set_quiet_mode = ath10k_wmi_op_gen_pdev_set_quiet_mode,
+        .gen_addba_clear_resp = ath10k_wmi_op_gen_addba_clear_resp,
+        .gen_addba_send = ath10k_wmi_op_gen_addba_send,
+        .gen_addba_set_resp = ath10k_wmi_op_gen_addba_set_resp,
+        .gen_delba_send = ath10k_wmi_op_gen_delba_send,
+};
 
+static const struct wmi_ops wmi_10_2_4_ops = {
+        .rx = ath10k_wmi_10_2_op_rx,
+        .pull_fw_stats = ath10k_wmi_10_2_4_op_pull_fw_stats,
+        .gen_init = ath10k_wmi_10_2_op_gen_init,
+        .gen_peer_assoc = ath10k_wmi_10_2_op_gen_peer_assoc,
+        .gen_pdev_get_temperature = ath10k_wmi_10_2_op_gen_pdev_get_temperature,
+
+        /* shared with 10.1 */
+        .map_svc = wmi_10x_svc_map,
+        .pull_svc_rdy = ath10k_wmi_10x_op_pull_svc_rdy_ev,
+        .gen_pdev_set_rd = ath10k_wmi_10x_op_gen_pdev_set_rd,
+        .gen_start_scan = ath10k_wmi_10x_op_gen_start_scan,
+
+        .pull_scan = ath10k_wmi_op_pull_scan_ev,
+        .pull_mgmt_rx = ath10k_wmi_op_pull_mgmt_rx_ev,
+        .pull_ch_info = ath10k_wmi_op_pull_ch_info_ev,
+        .pull_vdev_start = ath10k_wmi_op_pull_vdev_start_ev,
+        .pull_peer_kick = ath10k_wmi_op_pull_peer_kick_ev,
+        .pull_swba = ath10k_wmi_op_pull_swba_ev,
+        .pull_phyerr = ath10k_wmi_op_pull_phyerr_ev,
+        .pull_rdy = ath10k_wmi_op_pull_rdy_ev,
+
+        .gen_pdev_suspend = ath10k_wmi_op_gen_pdev_suspend,
+        .gen_pdev_resume = ath10k_wmi_op_gen_pdev_resume,
+        .gen_pdev_set_param = ath10k_wmi_op_gen_pdev_set_param,
+        .gen_stop_scan = ath10k_wmi_op_gen_stop_scan,
+        .gen_vdev_create = ath10k_wmi_op_gen_vdev_create,
+        .gen_vdev_delete = ath10k_wmi_op_gen_vdev_delete,
+        .gen_vdev_start = ath10k_wmi_op_gen_vdev_start,
+        .gen_vdev_stop = ath10k_wmi_op_gen_vdev_stop,
+        .gen_vdev_up = ath10k_wmi_op_gen_vdev_up,
+        .gen_vdev_down = ath10k_wmi_op_gen_vdev_down,
+        .gen_vdev_set_param = ath10k_wmi_op_gen_vdev_set_param,
+        .gen_vdev_install_key = ath10k_wmi_op_gen_vdev_install_key,
+        .gen_vdev_spectral_conf = ath10k_wmi_op_gen_vdev_spectral_conf,
+        .gen_vdev_spectral_enable = ath10k_wmi_op_gen_vdev_spectral_enable,
+        .gen_peer_create = ath10k_wmi_op_gen_peer_create,
+        .gen_peer_delete = ath10k_wmi_op_gen_peer_delete,
+        .gen_peer_flush = ath10k_wmi_op_gen_peer_flush,
+        .gen_peer_set_param = ath10k_wmi_op_gen_peer_set_param,
+        .gen_set_psmode = ath10k_wmi_op_gen_set_psmode,
+        .gen_set_sta_ps = ath10k_wmi_op_gen_set_sta_ps,
+        .gen_set_ap_ps = ath10k_wmi_op_gen_set_ap_ps,
+        .gen_scan_chan_list = ath10k_wmi_op_gen_scan_chan_list,
+        .gen_beacon_dma = ath10k_wmi_op_gen_beacon_dma,
+        .gen_pdev_set_wmm = ath10k_wmi_op_gen_pdev_set_wmm,
+        .gen_request_stats = ath10k_wmi_op_gen_request_stats,
+        .gen_force_fw_hang = ath10k_wmi_op_gen_force_fw_hang,
+        .gen_mgmt_tx = ath10k_wmi_op_gen_mgmt_tx,
+        .gen_dbglog_cfg = ath10k_wmi_op_gen_dbglog_cfg,
+        .gen_pktlog_enable = ath10k_wmi_op_gen_pktlog_enable,
+        .gen_pktlog_disable = ath10k_wmi_op_gen_pktlog_disable,
+        .gen_pdev_set_quiet_mode = ath10k_wmi_op_gen_pdev_set_quiet_mode,
+        .gen_addba_clear_resp = ath10k_wmi_op_gen_addba_clear_resp,
+        .gen_addba_send = ath10k_wmi_op_gen_addba_send,
+        .gen_addba_set_resp = ath10k_wmi_op_gen_addba_set_resp,
+        .gen_delba_send = ath10k_wmi_op_gen_delba_send,
+        /* .gen_bcn_tmpl not implemented */
+        /* .gen_prb_tmpl not implemented */
+        /* .gen_p2p_go_bcn_ie not implemented */
+};
+
+int ath10k_wmi_attach(struct ath10k *ar)
+{
+        switch (ar->wmi.op_version) {
+        case ATH10K_FW_WMI_OP_VERSION_10_2_4:
+                ar->wmi.cmd = &wmi_10_2_4_cmd_map;
+                ar->wmi.ops = &wmi_10_2_4_ops;
+                ar->wmi.vdev_param = &wmi_10_2_4_vdev_param_map;
+                ar->wmi.pdev_param = &wmi_10_2_4_pdev_param_map;
+                break;
+        case ATH10K_FW_WMI_OP_VERSION_10_2:
+                ar->wmi.cmd = &wmi_10_2_cmd_map;
+                ar->wmi.ops = &wmi_10_2_ops;
                 ar->wmi.vdev_param = &wmi_10x_vdev_param_map;
                 ar->wmi.pdev_param = &wmi_10x_pdev_param_map;
-        } else {
+                break;
+        case ATH10K_FW_WMI_OP_VERSION_10_1:
+                ar->wmi.cmd = &wmi_10x_cmd_map;
+                ar->wmi.ops = &wmi_10_1_ops;
+                ar->wmi.vdev_param = &wmi_10x_vdev_param_map;
+                ar->wmi.pdev_param = &wmi_10x_pdev_param_map;
+                break;
+        case ATH10K_FW_WMI_OP_VERSION_MAIN:
                 ar->wmi.cmd = &wmi_cmd_map;
+                ar->wmi.ops = &wmi_ops;
                 ar->wmi.vdev_param = &wmi_vdev_param_map;
                 ar->wmi.pdev_param = &wmi_pdev_param_map;
+                break;
+        case ATH10K_FW_WMI_OP_VERSION_TLV:
+                ath10k_wmi_tlv_attach(ar);
+                break;
+        case ATH10K_FW_WMI_OP_VERSION_UNSET:
+        case ATH10K_FW_WMI_OP_VERSION_MAX:
+                ath10k_err(ar, "unsupported WMI op version: %d\n",
+                           ar->wmi.op_version);
+                return -EINVAL;
         }
 
         init_completion(&ar->wmi.service_ready);
diff --git a/drivers/net/wireless/ath/ath10k/wmi.h b/drivers/net/wireless/ath/ath10k/wmi.h
index 21391929d318..20ce3603e64b 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.h
+++ b/drivers/net/wireless/ath/ath10k/wmi.h
@@ -109,6 +109,45 @@ enum wmi_service {
         WMI_SERVICE_BURST,
         WMI_SERVICE_SMART_ANTENNA_SW_SUPPORT,
         WMI_SERVICE_SMART_ANTENNA_HW_SUPPORT,
+        WMI_SERVICE_ROAM_SCAN_OFFLOAD,
+        WMI_SERVICE_AP_PS_DETECT_OUT_OF_SYNC,
+        WMI_SERVICE_EARLY_RX,
+        WMI_SERVICE_STA_SMPS,
+        WMI_SERVICE_FWTEST,
+        WMI_SERVICE_STA_WMMAC,
+        WMI_SERVICE_TDLS,
+        WMI_SERVICE_MCC_BCN_INTERVAL_CHANGE,
+        WMI_SERVICE_ADAPTIVE_OCS,
+        WMI_SERVICE_BA_SSN_SUPPORT,
+        WMI_SERVICE_FILTER_IPSEC_NATKEEPALIVE,
+        WMI_SERVICE_WLAN_HB,
+        WMI_SERVICE_LTE_ANT_SHARE_SUPPORT,
+        WMI_SERVICE_BATCH_SCAN,
+        WMI_SERVICE_QPOWER,
+        WMI_SERVICE_PLMREQ,
+        WMI_SERVICE_THERMAL_MGMT,
+        WMI_SERVICE_RMC,
+        WMI_SERVICE_MHF_OFFLOAD,
+        WMI_SERVICE_COEX_SAR,
+        WMI_SERVICE_BCN_TXRATE_OVERRIDE,
+        WMI_SERVICE_NAN,
+        WMI_SERVICE_L1SS_STAT,
+        WMI_SERVICE_ESTIMATE_LINKSPEED,
+        WMI_SERVICE_OBSS_SCAN,
+        WMI_SERVICE_TDLS_OFFCHAN,
+        WMI_SERVICE_TDLS_UAPSD_BUFFER_STA,
+        WMI_SERVICE_TDLS_UAPSD_SLEEP_STA,
+        WMI_SERVICE_IBSS_PWRSAVE,
+        WMI_SERVICE_LPASS,
+        WMI_SERVICE_EXTSCAN,
+        WMI_SERVICE_D0WOW,
+        WMI_SERVICE_HSOFFLOAD,
+        WMI_SERVICE_ROAM_HO_OFFLOAD,
+        WMI_SERVICE_RX_FULL_REORDER,
+        WMI_SERVICE_DHCP_OFFLOAD,
+        WMI_SERVICE_STA_RX_IPA_OFFLOAD_SUPPORT,
+        WMI_SERVICE_MDNS_OFFLOAD,
+        WMI_SERVICE_SAP_AUTH_OFFLOAD,
 
         /* keep last */
         WMI_SERVICE_MAX,
@@ -215,6 +254,45 @@ static inline char *wmi_service_name(int service_id)
         SVCSTR(WMI_SERVICE_BURST);
         SVCSTR(WMI_SERVICE_SMART_ANTENNA_SW_SUPPORT);
         SVCSTR(WMI_SERVICE_SMART_ANTENNA_HW_SUPPORT);
+        SVCSTR(WMI_SERVICE_ROAM_SCAN_OFFLOAD);
+        SVCSTR(WMI_SERVICE_AP_PS_DETECT_OUT_OF_SYNC);
+        SVCSTR(WMI_SERVICE_EARLY_RX);
+        SVCSTR(WMI_SERVICE_STA_SMPS);
+        SVCSTR(WMI_SERVICE_FWTEST);
+        SVCSTR(WMI_SERVICE_STA_WMMAC);
+        SVCSTR(WMI_SERVICE_TDLS);
+        SVCSTR(WMI_SERVICE_MCC_BCN_INTERVAL_CHANGE);
+        SVCSTR(WMI_SERVICE_ADAPTIVE_OCS);
+        SVCSTR(WMI_SERVICE_BA_SSN_SUPPORT);
+        SVCSTR(WMI_SERVICE_FILTER_IPSEC_NATKEEPALIVE);
+        SVCSTR(WMI_SERVICE_WLAN_HB);
+        SVCSTR(WMI_SERVICE_LTE_ANT_SHARE_SUPPORT);
+        SVCSTR(WMI_SERVICE_BATCH_SCAN);
+        SVCSTR(WMI_SERVICE_QPOWER);
+        SVCSTR(WMI_SERVICE_PLMREQ);
+        SVCSTR(WMI_SERVICE_THERMAL_MGMT);
+        SVCSTR(WMI_SERVICE_RMC);
+        SVCSTR(WMI_SERVICE_MHF_OFFLOAD);
+        SVCSTR(WMI_SERVICE_COEX_SAR);
+        SVCSTR(WMI_SERVICE_BCN_TXRATE_OVERRIDE);
+        SVCSTR(WMI_SERVICE_NAN);
+        SVCSTR(WMI_SERVICE_L1SS_STAT);
+        SVCSTR(WMI_SERVICE_ESTIMATE_LINKSPEED);
+        SVCSTR(WMI_SERVICE_OBSS_SCAN);
+        SVCSTR(WMI_SERVICE_TDLS_OFFCHAN);
+        SVCSTR(WMI_SERVICE_TDLS_UAPSD_BUFFER_STA);
+        SVCSTR(WMI_SERVICE_TDLS_UAPSD_SLEEP_STA);
+        SVCSTR(WMI_SERVICE_IBSS_PWRSAVE);
+        SVCSTR(WMI_SERVICE_LPASS);
+        SVCSTR(WMI_SERVICE_EXTSCAN);
+        SVCSTR(WMI_SERVICE_D0WOW);
+        SVCSTR(WMI_SERVICE_HSOFFLOAD);
+        SVCSTR(WMI_SERVICE_ROAM_HO_OFFLOAD);
+        SVCSTR(WMI_SERVICE_RX_FULL_REORDER);
+        SVCSTR(WMI_SERVICE_DHCP_OFFLOAD);
+        SVCSTR(WMI_SERVICE_STA_RX_IPA_OFFLOAD_SUPPORT);
+        SVCSTR(WMI_SERVICE_MDNS_OFFLOAD);
+        SVCSTR(WMI_SERVICE_SAP_AUTH_OFFLOAD);
         default:
                 return NULL;
         }
@@ -472,6 +550,8 @@ struct wmi_cmd_map {
         u32 force_fw_hang_cmdid;
         u32 gpio_config_cmdid;
         u32 gpio_output_cmdid;
+        u32 pdev_get_temperature_cmdid;
+        u32 vdev_set_wmm_params_cmdid;
 };
 
 /*
@@ -1076,6 +1156,11 @@ enum wmi_10_2_cmd_id {
         WMI_10_2_PDEV_SET_MIMOGAIN_TABLE_CMDID,
         WMI_10_2_PDEV_RATEPWR_TABLE_CMDID,
         WMI_10_2_PDEV_RATEPWR_CHAINMSK_TABLE_CMDID,
+        WMI_10_2_PDEV_GET_INFO,
+        WMI_10_2_VDEV_GET_INFO,
+        WMI_10_2_VDEV_ATF_REQUEST_CMDID,
+        WMI_10_2_PEER_ATF_REQUEST_CMDID,
+        WMI_10_2_PDEV_GET_TEMPERATURE_CMDID,
         WMI_10_2_PDEV_UTF_CMDID = WMI_10_2_END_CMDID - 1,
 };
 
@@ -1117,6 +1202,8 @@ enum wmi_10_2_event_id {
         WMI_10_2_MCAST_BUF_RELEASE_EVENTID,
         WMI_10_2_MCAST_LIST_AGEOUT_EVENTID,
         WMI_10_2_WDS_PEER_EVENTID,
+        WMI_10_2_PEER_STA_PS_STATECHG_EVENTID,
+        WMI_10_2_PDEV_TEMPERATURE_EVENTID,
         WMI_10_2_PDEV_UTF_EVENTID = WMI_10_2_END_EVENTID - 1,
 };
 
@@ -1862,6 +1949,11 @@ struct wmi_resource_config_10x {
         __le32 max_frag_entries;
 } __packed;
 
+enum wmi_10_2_feature_mask {
+        WMI_10_2_RX_BATCH_MODE = BIT(0),
+        WMI_10_2_ATF_CONFIG    = BIT(1),
+};
+
 struct wmi_resource_config_10_2 {
         struct wmi_resource_config_10x common;
         __le32 max_peer_ext_stats;
@@ -1870,7 +1962,7 @@ struct wmi_resource_config_10_2 {
         __le32 be_min_free;
         __le32 vi_min_free;
         __le32 vo_min_free;
-        __le32 rx_batchmode; /* 0-disable, 1-enable */
+        __le32 feature_mask;
 } __packed;
 
 #define NUM_UNITS_IS_NUM_VDEVS   0x1
@@ -2505,6 +2597,7 @@ struct wmi_pdev_param_map {
         u32 fast_channel_reset;
         u32 burst_dur;
         u32 burst_enable;
+        u32 cal_period;
 };
 
 #define WMI_PDEV_PARAM_UNSUPPORTED 0
@@ -2715,6 +2808,9 @@ enum wmi_10x_pdev_param {
         WMI_10X_PDEV_PARAM_SET_MCAST2UCAST_MODE,
         WMI_10X_PDEV_PARAM_SET_MCAST2UCAST_BUFFER,
         WMI_10X_PDEV_PARAM_REMOVE_MCAST2UCAST_BUFFER,
+        WMI_10X_PDEV_PARAM_PEER_STA_PS_STATECHG_ENABLE,
+        WMI_10X_PDEV_PARAM_RTS_FIXED_RATE,
+        WMI_10X_PDEV_PARAM_CAL_PERIOD
 };
 
 struct wmi_pdev_set_param_cmd {
@@ -2722,6 +2818,9 @@ struct wmi_pdev_set_param_cmd {
         __le32 param_value;
 } __packed;
 
+/* valid period is 1 ~ 60000ms, unit in millisecond */
+#define WMI_PDEV_PARAM_CAL_PERIOD_MAX 60000
+
 struct wmi_pdev_get_tpc_config_cmd {
         /* parameter   */
         __le32 param;
@@ -2841,14 +2940,14 @@ struct wmi_wmm_params_arg {
         u32 no_ack;
 };
 
-struct wmi_pdev_set_wmm_params_arg {
+struct wmi_wmm_params_all_arg {
         struct wmi_wmm_params_arg ac_be;
         struct wmi_wmm_params_arg ac_bk;
         struct wmi_wmm_params_arg ac_vi;
         struct wmi_wmm_params_arg ac_vo;
 };
 
-struct wal_dbg_tx_stats {
+struct wmi_pdev_stats_tx {
         /* Num HTT cookies queued to dispatch list */
         __le32 comp_queued;
 
@@ -2918,7 +3017,7 @@ struct wal_dbg_tx_stats {
         __le32 txop_ovf;
 } __packed;
 
-struct wal_dbg_rx_stats {
+struct wmi_pdev_stats_rx {
         /* Cnts any change in ring routing mid-ppdu */
         __le32 mid_ppdu_route_change;
 
@@ -2952,17 +3051,11 @@ struct wal_dbg_rx_stats {
         __le32 mpdu_errs;
 } __packed;
 
-struct wal_dbg_peer_stats {
+struct wmi_pdev_stats_peer {
         /* REMOVE THIS ONCE REAL PEER STAT COUNTERS ARE ADDED */
         __le32 dummy;
 } __packed;
 
-struct wal_dbg_stats {
-        struct wal_dbg_tx_stats tx;
-        struct wal_dbg_rx_stats rx;
-        struct wal_dbg_peer_stats peer;
-} __packed;
-
 enum wmi_stats_id {
         WMI_REQUEST_PEER_STAT   = 0x01,
         WMI_REQUEST_AP_STAT     = 0x02
@@ -3029,23 +3122,38 @@ struct wmi_stats_event {
         u8 data[0];
 } __packed;
 
+struct wmi_10_2_stats_event {
+        __le32 stats_id; /* %WMI_REQUEST_ */
+        __le32 num_pdev_stats;
+        __le32 num_pdev_ext_stats;
+        __le32 num_vdev_stats;
+        __le32 num_peer_stats;
+        __le32 num_bcnflt_stats;
+        u8 data[0];
+} __packed;
+
 /*
  * PDEV statistics
  * TODO: add all PDEV stats here
  */
+struct wmi_pdev_stats_base {
+        __le32 chan_nf;
+        __le32 tx_frame_count;
+        __le32 rx_frame_count;
+        __le32 rx_clear_count;
+        __le32 cycle_count;
+        __le32 phy_err_count;
+        __le32 chan_tx_pwr;
+} __packed;
+
 struct wmi_pdev_stats {
-        __le32 chan_nf;        /* Channel noise floor */
-        __le32 tx_frame_count; /* TX frame count */
-        __le32 rx_frame_count; /* RX frame count */
-        __le32 rx_clear_count; /* rx clear count */
-        __le32 cycle_count;    /* cycle count */
-        __le32 phy_err_count;  /* Phy error count */
-        __le32 chan_tx_pwr;    /* channel tx power */
-        struct wal_dbg_stats wal; /* WAL dbg stats */
+        struct wmi_pdev_stats_base base;
+        struct wmi_pdev_stats_tx tx;
+        struct wmi_pdev_stats_rx rx;
+        struct wmi_pdev_stats_peer peer;
 } __packed;
 
-struct wmi_10x_pdev_stats {
-        struct wmi_pdev_stats old;
+struct wmi_pdev_stats_extra {
         __le32 ack_rx_bad;
         __le32 rts_bad;
         __le32 rts_good;
@@ -3054,6 +3162,30 @@ struct wmi_10x_pdev_stats {
         __le32 mib_int_count;
 } __packed;
 
+struct wmi_10x_pdev_stats {
+        struct wmi_pdev_stats_base base;
+        struct wmi_pdev_stats_tx tx;
+        struct wmi_pdev_stats_rx rx;
+        struct wmi_pdev_stats_peer peer;
+        struct wmi_pdev_stats_extra extra;
+} __packed;
+
+struct wmi_pdev_stats_mem {
+        __le32 dram_free;
+        __le32 iram_free;
+} __packed;
+
+struct wmi_10_2_pdev_stats {
+        struct wmi_pdev_stats_base base;
+        struct wmi_pdev_stats_tx tx;
+        __le32 mc_drop;
+        struct wmi_pdev_stats_rx rx;
+        __le32 pdev_rx_timeout;
+        struct wmi_pdev_stats_mem mem;
+        struct wmi_pdev_stats_peer peer;
+        struct wmi_pdev_stats_extra extra;
+} __packed;
+
 /*
  * VDEV statistics
  * TODO: add all VDEV stats here
@@ -3077,6 +3209,32 @@ struct wmi_10x_peer_stats {
         __le32 peer_rx_rate;
 } __packed;
 
+struct wmi_10_2_peer_stats {
+        struct wmi_peer_stats old;
+        __le32 peer_rx_rate;
+        __le32 current_per;
+        __le32 retries;
+        __le32 tx_rate_count;
+        __le32 max_4ms_frame_len;
+        __le32 total_sub_frames;
+        __le32 tx_bytes;
+        __le32 num_pkt_loss_overflow[4];
+        __le32 num_pkt_loss_excess_retry[4];
+} __packed;
+
+struct wmi_10_2_4_peer_stats {
+        struct wmi_10_2_peer_stats common;
+        __le32 unknown_value; /* FIXME: what is this word? */
+} __packed;
+
+struct wmi_10_2_pdev_ext_stats {
+        __le32 rx_rssi_comb;
+        __le32 rx_rssi[4];
+        __le32 rx_mcs[10];
+        __le32 tx_mcs[10];
+        __le32 ack_rssi;
+} __packed;
+
 struct wmi_vdev_create_cmd {
         __le32 vdev_id;
         __le32 vdev_type;
@@ -3930,6 +4088,13 @@ enum wmi_sta_ps_param_pspoll_count {
          * Values greater than 0 indicate the maximum numer of PS-Poll frames
          * FW will send before waking up.
          */
+
+        /* When u-APSD is enabled the firmware will be very reluctant to exit
+         * STA PS. This could result in very poor Rx performance with STA doing
+         * PS-Poll for each and every buffered frame. This value is a bit
+         * arbitrary.
+         */
+        WMI_STA_PS_PSPOLL_COUNT_UAPSD = 3,
 };
 
 /*
@@ -3955,6 +4120,30 @@ enum wmi_sta_ps_param_uapsd {
         WMI_STA_PS_UAPSD_AC3_TRIGGER_EN  = (1 << 7),
 };
 
+#define WMI_STA_UAPSD_MAX_INTERVAL_MSEC UINT_MAX
+
+struct wmi_sta_uapsd_auto_trig_param {
+        __le32 wmm_ac;
+        __le32 user_priority;
+        __le32 service_interval;
+        __le32 suspend_interval;
+        __le32 delay_interval;
+};
+
+struct wmi_sta_uapsd_auto_trig_cmd_fixed_param {
+        __le32 vdev_id;
+        struct wmi_mac_addr peer_macaddr;
+        __le32 num_ac;
+};
+
+struct wmi_sta_uapsd_auto_trig_arg {
+        u32 wmm_ac;
+        u32 user_priority;
+        u32 service_interval;
+        u32 suspend_interval;
+        u32 delay_interval;
+};
+
 enum wmi_sta_powersave_param {
         /*
          * Controls how frames are retrievd from AP while STA is sleeping
@@ -4120,7 +4309,7 @@ struct wmi_bcn_info {
 
 struct wmi_host_swba_event {
         __le32 vdev_map;
-        struct wmi_bcn_info bcn_info[1];
+        struct wmi_bcn_info bcn_info[0];
 } __packed;
 
 #define WMI_MAX_AP_VDEV 16
@@ -4325,7 +4514,7 @@ struct wmi_peer_set_q_empty_callback_cmd {
 #define WMI_PEER_SPATIAL_MUX    0x00200000
 #define WMI_PEER_VHT            0x02000000
 #define WMI_PEER_80MHZ          0x04000000
-#define WMI_PEER_PMF            0x08000000
+#define WMI_PEER_VHT_2G         0x08000000
 
 /*
  * Peer rate capabilities.
@@ -4476,6 +4665,11 @@ enum wmi_sta_keepalive_method {
         WMI_STA_KEEPALIVE_METHOD_UNSOLICITATED_ARP_RESPONSE = 2,
 };
 
+#define WMI_STA_KEEPALIVE_INTERVAL_DISABLE 0
+
+/* Firmware crashes if keepalive interval exceeds this limit */
+#define WMI_STA_KEEPALIVE_INTERVAL_MAX_SECONDS 0xffff
+
 /* note: ip4 addresses are in network byte order, i.e. big endian */
 struct wmi_sta_keepalive_arp_resp {
         __be32 src_ip4_addr;
@@ -4491,6 +4685,16 @@ struct wmi_sta_keepalive_cmd {
         struct wmi_sta_keepalive_arp_resp arp_resp;
 } __packed;
 
+struct wmi_sta_keepalive_arg {
+        u32 vdev_id;
+        u32 enabled;
+        u32 method;
+        u32 interval;
+        __be32 src_ip4_addr;
+        __be32 dest_ip4_addr;
+        const u8 dest_mac_addr[ETH_ALEN];
+};
+
 enum wmi_force_fw_hang_type {
         WMI_FORCE_FW_HANG_ASSERT = 1,
         WMI_FORCE_FW_HANG_NO_DETECT,
@@ -4567,6 +4771,58 @@ struct wmi_dbglog_cfg_cmd {
 
 #define WMI_MAX_MEM_REQS 16
 
+struct wmi_scan_ev_arg {
+        __le32 event_type; /* %WMI_SCAN_EVENT_ */
+        __le32 reason; /* %WMI_SCAN_REASON_ */
+        __le32 channel_freq; /* only valid for WMI_SCAN_EVENT_FOREIGN_CHANNEL */
+        __le32 scan_req_id;
+        __le32 scan_id;
+        __le32 vdev_id;
+};
+
+struct wmi_mgmt_rx_ev_arg {
+        __le32 channel;
+        __le32 snr;
+        __le32 rate;
+        __le32 phy_mode;
+        __le32 buf_len;
+        __le32 status; /* %WMI_RX_STATUS_ */
+};
+
+struct wmi_ch_info_ev_arg {
+        __le32 err_code;
+        __le32 freq;
+        __le32 cmd_flags;
+        __le32 noise_floor;
+        __le32 rx_clear_count;
+        __le32 cycle_count;
+};
+
+struct wmi_vdev_start_ev_arg {
+        __le32 vdev_id;
+        __le32 req_id;
+        __le32 resp_type; /* %WMI_VDEV_RESP_ */
+        __le32 status;
+};
+
+struct wmi_peer_kick_ev_arg {
+        const u8 *mac_addr;
+};
+
+struct wmi_swba_ev_arg {
+        __le32 vdev_map;
+        const struct wmi_tim_info *tim_info[WMI_MAX_AP_VDEV];
+        const struct wmi_p2p_noa_info *noa_info[WMI_MAX_AP_VDEV];
+};
+
+struct wmi_phyerr_ev_arg {
+        __le32 num_phyerrs;
+        __le32 tsf_l32;
+        __le32 tsf_u32;
+        __le32 buf_len;
+        const struct wmi_phyerr *phyerrs;
+};
+
 struct wmi_svc_rdy_ev_arg {
         __le32 min_tx_power;
         __le32 max_tx_power;
@@ -4574,6 +4830,7 @@ struct wmi_svc_rdy_ev_arg {
         __le32 vht_cap;
         __le32 sw_ver0;
         __le32 sw_ver1;
+        __le32 fw_build;
         __le32 phy_capab;
         __le32 num_rf_chains;
         __le32 eeprom_rd;
@@ -4583,83 +4840,99 @@ struct wmi_svc_rdy_ev_arg {
         const struct wlan_host_mem_req *mem_reqs[WMI_MAX_MEM_REQS];
 };
 
+struct wmi_rdy_ev_arg {
+        __le32 sw_version;
+        __le32 abi_version;
+        __le32 status;
+        const u8 *mac_addr;
+};
+
+struct wmi_pdev_temperature_event {
+        /* temperature value in Celcius degree */
+        __le32 temperature;
+} __packed;
+
 struct ath10k;
 struct ath10k_vif;
-struct ath10k_fw_stats;
+struct ath10k_fw_stats_pdev;
+struct ath10k_fw_stats_peer;
 
 int ath10k_wmi_attach(struct ath10k *ar);
 void ath10k_wmi_detach(struct ath10k *ar);
 int ath10k_wmi_wait_for_service_ready(struct ath10k *ar);
 int ath10k_wmi_wait_for_unified_ready(struct ath10k *ar);
 
+struct sk_buff *ath10k_wmi_alloc_skb(struct ath10k *ar, u32 len);
 int ath10k_wmi_connect(struct ath10k *ar);
 
 struct sk_buff *ath10k_wmi_alloc_skb(struct ath10k *ar, u32 len);
 int ath10k_wmi_cmd_send(struct ath10k *ar, struct sk_buff *skb, u32 cmd_id);
-
-int ath10k_wmi_pdev_suspend_target(struct ath10k *ar, u32 suspend_opt);
-int ath10k_wmi_pdev_resume_target(struct ath10k *ar);
-int ath10k_wmi_pdev_set_regdomain(struct ath10k *ar, u16 rd, u16 rd2g,
-                                  u16 rd5g, u16 ctl2g, u16 ctl5g,
-                                  enum wmi_dfs_region dfs_reg);
-int ath10k_wmi_pdev_set_param(struct ath10k *ar, u32 id, u32 value);
-int ath10k_wmi_cmd_init(struct ath10k *ar);
-int ath10k_wmi_start_scan(struct ath10k *ar, const struct wmi_start_scan_arg *);
+int ath10k_wmi_cmd_send_nowait(struct ath10k *ar, struct sk_buff *skb,
+                               u32 cmd_id);
 void ath10k_wmi_start_scan_init(struct ath10k *ar, struct wmi_start_scan_arg *);
-int ath10k_wmi_stop_scan(struct ath10k *ar,
-                         const struct wmi_stop_scan_arg *arg);
-int ath10k_wmi_vdev_create(struct ath10k *ar, u32 vdev_id,
-                           enum wmi_vdev_type type,
-                           enum wmi_vdev_subtype subtype,
-                           const u8 macaddr[ETH_ALEN]);
-int ath10k_wmi_vdev_delete(struct ath10k *ar, u32 vdev_id);
-int ath10k_wmi_vdev_start(struct ath10k *ar,
-                          const struct wmi_vdev_start_request_arg *);
-int ath10k_wmi_vdev_restart(struct ath10k *ar,
-                            const struct wmi_vdev_start_request_arg *);
-int ath10k_wmi_vdev_stop(struct ath10k *ar, u32 vdev_id);
-int ath10k_wmi_vdev_up(struct ath10k *ar, u32 vdev_id, u32 aid,
-                       const u8 *bssid);
-int ath10k_wmi_vdev_down(struct ath10k *ar, u32 vdev_id);
-int ath10k_wmi_vdev_set_param(struct ath10k *ar, u32 vdev_id,
-                              u32 param_id, u32 param_value);
-int ath10k_wmi_vdev_install_key(struct ath10k *ar,
-                                const struct wmi_vdev_install_key_arg *arg);
-int ath10k_wmi_vdev_spectral_conf(struct ath10k *ar,
-                                  const struct wmi_vdev_spectral_conf_arg *arg);
-int ath10k_wmi_vdev_spectral_enable(struct ath10k *ar, u32 vdev_id, u32 trigger,
-                                    u32 enable);
-int ath10k_wmi_peer_create(struct ath10k *ar, u32 vdev_id,
-                           const u8 peer_addr[ETH_ALEN]);
-int ath10k_wmi_peer_delete(struct ath10k *ar, u32 vdev_id,
-                           const u8 peer_addr[ETH_ALEN]);
-int ath10k_wmi_peer_flush(struct ath10k *ar, u32 vdev_id,
-                          const u8 peer_addr[ETH_ALEN], u32 tid_bitmap);
-int ath10k_wmi_peer_set_param(struct ath10k *ar, u32 vdev_id,
-                              const u8 *peer_addr,
-                              enum wmi_peer_param param_id, u32 param_value);
-int ath10k_wmi_peer_assoc(struct ath10k *ar,
-                          const struct wmi_peer_assoc_complete_arg *arg);
-int ath10k_wmi_set_psmode(struct ath10k *ar, u32 vdev_id,
-                          enum wmi_sta_ps_mode psmode);
-int ath10k_wmi_set_sta_ps_param(struct ath10k *ar, u32 vdev_id,
-                                enum wmi_sta_powersave_param param_id,
-                                u32 value);
-int ath10k_wmi_set_ap_ps_param(struct ath10k *ar, u32 vdev_id, const u8 *mac,
-                               enum wmi_ap_ps_peer_param param_id, u32 value);
-int ath10k_wmi_scan_chan_list(struct ath10k *ar,
-                              const struct wmi_scan_chan_list_arg *arg);
-int ath10k_wmi_beacon_send_ref_nowait(struct ath10k_vif *arvif);
-int ath10k_wmi_pdev_set_wmm_params(struct ath10k *ar,
-                                   const struct wmi_pdev_set_wmm_params_arg *arg);
-int ath10k_wmi_request_stats(struct ath10k *ar, enum wmi_stats_id stats_id);
-int ath10k_wmi_force_fw_hang(struct ath10k *ar,
-                             enum wmi_force_fw_hang_type type, u32 delay_ms);
-int ath10k_wmi_mgmt_tx(struct ath10k *ar, struct sk_buff *skb);
-int ath10k_wmi_dbglog_cfg(struct ath10k *ar, u32 module_enable);
-int ath10k_wmi_pull_fw_stats(struct ath10k *ar, struct sk_buff *skb,
-                             struct ath10k_fw_stats *stats);
-int ath10k_wmi_pdev_pktlog_enable(struct ath10k *ar, u32 ev_list);
-int ath10k_wmi_pdev_pktlog_disable(struct ath10k *ar);
+
+void ath10k_wmi_pull_pdev_stats_base(const struct wmi_pdev_stats_base *src,
+                                     struct ath10k_fw_stats_pdev *dst);
+void ath10k_wmi_pull_pdev_stats_tx(const struct wmi_pdev_stats_tx *src,
+                                   struct ath10k_fw_stats_pdev *dst);
+void ath10k_wmi_pull_pdev_stats_rx(const struct wmi_pdev_stats_rx *src,
+                                   struct ath10k_fw_stats_pdev *dst);
+void ath10k_wmi_pull_pdev_stats_extra(const struct wmi_pdev_stats_extra *src,
+                                      struct ath10k_fw_stats_pdev *dst);
+void ath10k_wmi_pull_peer_stats(const struct wmi_peer_stats *src,
+                                struct ath10k_fw_stats_peer *dst);
+void ath10k_wmi_put_host_mem_chunks(struct ath10k *ar,
+                                    struct wmi_host_mem_chunks *chunks);
+void ath10k_wmi_put_start_scan_common(struct wmi_start_scan_common *cmn,
+                                      const struct wmi_start_scan_arg *arg);
+void ath10k_wmi_set_wmm_param(struct wmi_wmm_params *params,
+                              const struct wmi_wmm_params_arg *arg);
+void ath10k_wmi_put_wmi_channel(struct wmi_channel *ch,
+                                const struct wmi_channel_arg *arg);
+int ath10k_wmi_start_scan_verify(const struct wmi_start_scan_arg *arg);
+
+int ath10k_wmi_event_scan(struct ath10k *ar, struct sk_buff *skb);
+int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_chan_info(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_echo(struct ath10k *ar, struct sk_buff *skb);
+int ath10k_wmi_event_debug_mesg(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_update_stats(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_vdev_start_resp(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_vdev_stopped(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_peer_sta_kickout(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_host_swba(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_tbttoffset_update(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_dfs(struct ath10k *ar,
+                          const struct wmi_phyerr *phyerr, u64 tsf);
+void ath10k_wmi_event_spectral_scan(struct ath10k *ar,
+                                    const struct wmi_phyerr *phyerr,
+                                    u64 tsf);
+void ath10k_wmi_event_phyerr(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_roam(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_profile_match(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_debug_print(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_pdev_qvit(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_wlan_profile_data(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_rtt_measurement_report(struct ath10k *ar,
+                                             struct sk_buff *skb);
+void ath10k_wmi_event_tsf_measurement_report(struct ath10k *ar,
+                                             struct sk_buff *skb);
+void ath10k_wmi_event_rtt_error_report(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_wow_wakeup_host(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_dcs_interference(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_pdev_tpc_config(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_pdev_ftm_intg(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_gtk_offload_status(struct ath10k *ar,
+                                         struct sk_buff *skb);
+void ath10k_wmi_event_gtk_rekey_fail(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_delba_complete(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_addba_complete(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_vdev_install_key_complete(struct ath10k *ar,
+                                                struct sk_buff *skb);
+void ath10k_wmi_event_inst_rssi_stats(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_vdev_standby_req(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_vdev_resume_req(struct ath10k *ar, struct sk_buff *skb);
+void ath10k_wmi_event_service_ready(struct ath10k *ar, struct sk_buff *skb);
+int ath10k_wmi_event_ready(struct ath10k *ar, struct sk_buff *skb);
 
 #endif /* _WMI_H_ */
diff --git a/drivers/net/wireless/ath/ath5k/ahb.c b/drivers/net/wireless/ath/ath5k/ahb.c
index 8f387cf67340..2ca88b593e4c 100644
--- a/drivers/net/wireless/ath/ath5k/ahb.c
+++ b/drivers/net/wireless/ath/ath5k/ahb.c
@@ -227,7 +227,6 @@ static struct platform_driver ath_ahb_driver = {
         .remove     = ath_ahb_remove,
         .driver         = {
                 .name   = "ar231x-wmac",
-                .owner  = THIS_MODULE,
         },
 };
 
diff --git a/drivers/net/wireless/ath/ath5k/mac80211-ops.c b/drivers/net/wireless/ath/ath5k/mac80211-ops.c
index 19eab2a69ad5..3b4a6463d87a 100644
--- a/drivers/net/wireless/ath/ath5k/mac80211-ops.c
+++ b/drivers/net/wireless/ath/ath5k/mac80211-ops.c
@@ -672,10 +672,10 @@ ath5k_get_survey(struct ieee80211_hw *hw, int idx, struct survey_info *survey)
         spin_lock_bh(&common->cc_lock);
         ath_hw_cycle_counters_update(common);
         if (cc->cycles > 0) {
-                ah->survey.channel_time += cc->cycles / div;
-                ah->survey.channel_time_busy += cc->rx_busy / div;
-                ah->survey.channel_time_rx += cc->rx_frame / div;
-                ah->survey.channel_time_tx += cc->tx_frame / div;
+                ah->survey.time += cc->cycles / div;
+                ah->survey.time_busy += cc->rx_busy / div;
+                ah->survey.time_rx += cc->rx_frame / div;
+                ah->survey.time_tx += cc->tx_frame / div;
         }
         memset(cc, 0, sizeof(*cc));
         spin_unlock_bh(&common->cc_lock);
@@ -686,10 +686,10 @@ ath5k_get_survey(struct ieee80211_hw *hw, int idx, struct survey_info *survey)
         survey->noise = ah->ah_noise_floor;
         survey->filled = SURVEY_INFO_NOISE_DBM |
                         SURVEY_INFO_IN_USE |
-                        SURVEY_INFO_CHANNEL_TIME |
-                        SURVEY_INFO_CHANNEL_TIME_BUSY |
-                        SURVEY_INFO_CHANNEL_TIME_RX |
-                        SURVEY_INFO_CHANNEL_TIME_TX;
+                        SURVEY_INFO_TIME |
+                        SURVEY_INFO_TIME_BUSY |
+                        SURVEY_INFO_TIME_RX |
+                        SURVEY_INFO_TIME_TX;
 
         return 0;
 }
diff --git a/drivers/net/wireless/ath/ath5k/pcu.c b/drivers/net/wireless/ath/ath5k/pcu.c
index c60d36aa13e2..bf29da5e90da 100644
--- a/drivers/net/wireless/ath/ath5k/pcu.c
+++ b/drivers/net/wireless/ath/ath5k/pcu.c
@@ -912,6 +912,7 @@ ath5k_hw_set_opmode(struct ath5k_hw *ah, enum nl80211_iftype op_mode)
                 pcu_reg |= AR5K_STA_ID1_KEYSRCH_MODE
                         | (ah->ah_version == AR5K_AR5210 ?
                                 AR5K_STA_ID1_PWR_SV : 0);
+                /* fall through */
         case NL80211_IFTYPE_MONITOR:
                 pcu_reg |= AR5K_STA_ID1_KEYSRCH_MODE
                         | (ah->ah_version == AR5K_AR5210 ?
diff --git a/drivers/net/wireless/ath/ath5k/reset.c b/drivers/net/wireless/ath/ath5k/reset.c
index a3399c4f13a9..b9b651ea9851 100644
--- a/drivers/net/wireless/ath/ath5k/reset.c
+++ b/drivers/net/wireless/ath/ath5k/reset.c
@@ -478,7 +478,7 @@ ath5k_hw_wisoc_reset(struct ath5k_hw *ah, u32 flags)
         regval = ioread32(reg);
         iowrite32(regval | val, reg);
         regval = ioread32(reg);
-        usleep_range(100, 150);
+        udelay(100);    /* NB: should be atomic */
 
         /* Bring BB/MAC out of reset */
         iowrite32(regval & ~val, reg);
diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c
index 7a5337877a0c..85da63a67faf 100644
--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
+++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
@@ -1799,20 +1799,20 @@ static int ath6kl_get_station(struct wiphy *wiphy, struct net_device *dev,
 
         if (vif->target_stats.rx_byte) {
                 sinfo->rx_bytes = vif->target_stats.rx_byte;
-                sinfo->filled |= STATION_INFO_RX_BYTES64;
+                sinfo->filled |= BIT(NL80211_STA_INFO_RX_BYTES64);
                 sinfo->rx_packets = vif->target_stats.rx_pkt;
-                sinfo->filled |= STATION_INFO_RX_PACKETS;
+                sinfo->filled |= BIT(NL80211_STA_INFO_RX_PACKETS);
         }
 
         if (vif->target_stats.tx_byte) {
                 sinfo->tx_bytes = vif->target_stats.tx_byte;
-                sinfo->filled |= STATION_INFO_TX_BYTES64;
+                sinfo->filled |= BIT(NL80211_STA_INFO_TX_BYTES64);
                 sinfo->tx_packets = vif->target_stats.tx_pkt;
-                sinfo->filled |= STATION_INFO_TX_PACKETS;
+                sinfo->filled |= BIT(NL80211_STA_INFO_TX_PACKETS);
         }
 
         sinfo->signal = vif->target_stats.cs_rssi;
-        sinfo->filled |= STATION_INFO_SIGNAL;
+        sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
 
         rate = vif->target_stats.tx_ucast_rate;
 
@@ -1827,6 +1827,7 @@ static int ath6kl_get_station(struct wiphy *wiphy, struct net_device *dev,
                 }
 
                 sinfo->txrate.flags |= RATE_INFO_FLAGS_MCS;
+                sinfo->txrate.bw = RATE_INFO_BW_20;
         } else if (is_rate_ht40(rate, &mcs, &sgi)) {
                 if (sgi) {
                         sinfo->txrate.flags |= RATE_INFO_FLAGS_SHORT_GI;
@@ -1835,7 +1836,7 @@ static int ath6kl_get_station(struct wiphy *wiphy, struct net_device *dev,
                         sinfo->txrate.mcs = mcs;
                 }
 
-                sinfo->txrate.flags |= RATE_INFO_FLAGS_40_MHZ_WIDTH;
+                sinfo->txrate.bw = RATE_INFO_BW_40;
                 sinfo->txrate.flags |= RATE_INFO_FLAGS_MCS;
         } else {
                 ath6kl_dbg(ATH6KL_DBG_WLAN_CFG,
@@ -1844,12 +1845,12 @@ static int ath6kl_get_station(struct wiphy *wiphy, struct net_device *dev,
                 return 0;
         }
 
-        sinfo->filled |= STATION_INFO_TX_BITRATE;
+        sinfo->filled |= BIT(NL80211_STA_INFO_TX_BITRATE);
 
         if (test_bit(CONNECTED, &vif->flags) &&
             test_bit(DTIM_PERIOD_AVAIL, &vif->flags) &&
             vif->nw_type == INFRA_NETWORK) {
-                sinfo->filled |= STATION_INFO_BSS_PARAM;
+                sinfo->filled |= BIT(NL80211_STA_INFO_BSS_PARAM);
                 sinfo->bss_param.flags = 0;
                 sinfo->bss_param.dtim_period = vif->assoc_bss_dtim_period;
                 sinfo->bss_param.beacon_interval = vif->assoc_bss_beacon_int;
diff --git a/drivers/net/wireless/ath/ath6kl/main.c b/drivers/net/wireless/ath/ath6kl/main.c
index 933aef025698..b42ba46b5030 100644
--- a/drivers/net/wireless/ath/ath6kl/main.c
+++ b/drivers/net/wireless/ath/ath6kl/main.c
@@ -488,7 +488,6 @@ void ath6kl_connect_ap_mode_sta(struct ath6kl_vif *vif, u16 aid, u8 *mac_addr,
 
         sinfo.assoc_req_ies = ies;
         sinfo.assoc_req_ies_len = ies_len;
-        sinfo.filled |= STATION_INFO_ASSOC_REQ_IES;
 
         cfg80211_new_sta(vif->ndev, mac_addr, &sinfo, GFP_KERNEL);
 
diff --git a/drivers/net/wireless/ath/ath9k/ahb.c b/drivers/net/wireless/ath/ath9k/ahb.c
index e000c4c27881..bd4a1a655f42 100644
--- a/drivers/net/wireless/ath/ath9k/ahb.c
+++ b/drivers/net/wireless/ath/ath9k/ahb.c
@@ -43,6 +43,10 @@ static const struct platform_device_id ath9k_platform_id_table[] = {
                 .name = "qca953x_wmac",
                 .driver_data = AR9300_DEVID_AR953X,
         },
+        {
+                .name = "qca956x_wmac",
+                .driver_data = AR9300_DEVID_QCA956X,
+        },
         {},
 };
 
diff --git a/drivers/net/wireless/ath/ath9k/ani.c b/drivers/net/wireless/ath/ath9k/ani.c
index ba502a2d199b..ca01d17d130f 100644
--- a/drivers/net/wireless/ath/ath9k/ani.c
+++ b/drivers/net/wireless/ath/ath9k/ani.c
@@ -259,7 +259,8 @@ static void ath9k_hw_set_cck_nil(struct ath_hw *ah, u_int8_t immunityLevel,
                                      entry_cck->fir_step_level);
 
         /* Skip MRC CCK for pre AR9003 families */
-        if (!AR_SREV_9300_20_OR_LATER(ah) || AR_SREV_9485(ah) || AR_SREV_9565(ah))
+        if (!AR_SREV_9300_20_OR_LATER(ah) || AR_SREV_9485(ah) ||
+            AR_SREV_9565(ah) || AR_SREV_9561(ah))
                 return;
 
         if (aniState->mrcCCK != entry_cck->mrc_cck_on)
diff --git a/drivers/net/wireless/ath/ath9k/ar5008_phy.c b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
index 5829074208fa..f273427fdd29 100644
--- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
@@ -22,6 +22,21 @@
 
 /* All code below is for AR5008, AR9001, AR9002 */
 
+#define AR5008_OFDM_RATES               8
+#define AR5008_HT_SS_RATES              8
+#define AR5008_HT_DS_RATES              8
+
+#define AR5008_HT20_SHIFT               16
+#define AR5008_HT40_SHIFT               24
+
+#define AR5008_11NA_OFDM_SHIFT          0
+#define AR5008_11NA_HT_SS_SHIFT         8
+#define AR5008_11NA_HT_DS_SHIFT         16
+
+#define AR5008_11NG_OFDM_SHIFT          4
+#define AR5008_11NG_HT_SS_SHIFT         12
+#define AR5008_11NG_HT_DS_SHIFT         20
+
 static const int firstep_table[] =
 /* level:  0   1   2   3   4   5   6   7   8  */
         { -4, -2,  0,  2,  4,  6,  8, 10, 12 }; /* lvl 0-8, default 2 */
@@ -1235,6 +1250,71 @@ static void ar5008_hw_set_radar_conf(struct ath_hw *ah)
         conf->radar_inband = 8;
 }
 
+static void ar5008_hw_init_txpower_cck(struct ath_hw *ah, int16_t *rate_array)
+{
+#define CCK_DELTA(x) ((OLC_FOR_AR9280_20_LATER) ? max((x) - 2, 0) : (x))
+        ah->tx_power[0] = CCK_DELTA(rate_array[rate1l]);
+        ah->tx_power[1] = CCK_DELTA(min(rate_array[rate2l],
+                                        rate_array[rate2s]));
+        ah->tx_power[2] = CCK_DELTA(min(rate_array[rate5_5l],
+                                        rate_array[rate5_5s]));
+        ah->tx_power[3] = CCK_DELTA(min(rate_array[rate11l],
+                                        rate_array[rate11s]));
+#undef CCK_DELTA
+}
+
+static void ar5008_hw_init_txpower_ofdm(struct ath_hw *ah, int16_t *rate_array,
+                                        int offset)
+{
+        int i, idx = 0;
+
+        for (i = offset; i < offset + AR5008_OFDM_RATES; i++) {
+                ah->tx_power[i] = rate_array[idx];
+                idx++;
+        }
+}
+
+static void ar5008_hw_init_txpower_ht(struct ath_hw *ah, int16_t *rate_array,
+                                      int ss_offset, int ds_offset,
+                                      bool is_40, int ht40_delta)
+{
+        int i, mcs_idx = (is_40) ? AR5008_HT40_SHIFT : AR5008_HT20_SHIFT;
+
+        for (i = ss_offset; i < ss_offset + AR5008_HT_SS_RATES; i++) {
+                ah->tx_power[i] = rate_array[mcs_idx] + ht40_delta;
+                mcs_idx++;
+        }
+        memcpy(&ah->tx_power[ds_offset], &ah->tx_power[ss_offset],
+               AR5008_HT_SS_RATES);
+}
+
+void ar5008_hw_init_rate_txpower(struct ath_hw *ah, int16_t *rate_array,
+                                 struct ath9k_channel *chan, int ht40_delta)
+{
+        if (IS_CHAN_5GHZ(chan)) {
+                ar5008_hw_init_txpower_ofdm(ah, rate_array,
+                                            AR5008_11NA_OFDM_SHIFT);
+                if (IS_CHAN_HT20(chan) || IS_CHAN_HT40(chan)) {
+                        ar5008_hw_init_txpower_ht(ah, rate_array,
+                                                  AR5008_11NA_HT_SS_SHIFT,
+                                                  AR5008_11NA_HT_DS_SHIFT,
+                                                  IS_CHAN_HT40(chan),
+                                                  ht40_delta);
+                }
+        } else {
+                ar5008_hw_init_txpower_cck(ah, rate_array);
+                ar5008_hw_init_txpower_ofdm(ah, rate_array,
+                                            AR5008_11NG_OFDM_SHIFT);
+                if (IS_CHAN_HT20(chan) || IS_CHAN_HT40(chan)) {
+                        ar5008_hw_init_txpower_ht(ah, rate_array,
+                                                  AR5008_11NG_HT_SS_SHIFT,
+                                                  AR5008_11NG_HT_DS_SHIFT,
+                                                  IS_CHAN_HT40(chan),
+                                                  ht40_delta);
+                }
+        }
+}
+
 int ar5008_hw_attach_phy_ops(struct ath_hw *ah)
 {
         struct ath_hw_private_ops *priv_ops = ath9k_hw_private_ops(ah);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_calib.c b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
index 06ab71db6e80..174442beb952 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
@@ -1203,24 +1203,41 @@ static void ar9003_hw_tx_iq_cal_reload(struct ath_hw *ah)
 static void ar9003_hw_manual_peak_cal(struct ath_hw *ah, u8 chain, bool is_2g)
 {
         int offset[8] = {0}, total = 0, test;
-        int agc_out, i;
+        int agc_out, i, peak_detect_threshold;
 
+        if (AR_SREV_9550(ah) || AR_SREV_9531(ah))
+                peak_detect_threshold = 8;
+        else
+                peak_detect_threshold = 0;
+
+        /*
+         * Turn off LNA/SW.
+         */
         REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_GAINSTAGES(chain),
                       AR_PHY_65NM_RXRF_GAINSTAGES_RX_OVERRIDE, 0x1);
         REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_GAINSTAGES(chain),
                       AR_PHY_65NM_RXRF_GAINSTAGES_LNAON_CALDC, 0x0);
-        if (is_2g)
-                REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_GAINSTAGES(chain),
-                              AR_PHY_65NM_RXRF_GAINSTAGES_LNA2G_GAIN_OVR, 0x0);
-        else
-                REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_GAINSTAGES(chain),
-                              AR_PHY_65NM_RXRF_GAINSTAGES_LNA5G_GAIN_OVR, 0x0);
 
+        if (AR_SREV_9003_PCOEM(ah) || AR_SREV_9330_11(ah)) {
+                if (is_2g)
+                        REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_GAINSTAGES(chain),
+                                      AR_PHY_65NM_RXRF_GAINSTAGES_LNA2G_GAIN_OVR, 0x0);
+                else
+                        REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_GAINSTAGES(chain),
+                                      AR_PHY_65NM_RXRF_GAINSTAGES_LNA5G_GAIN_OVR, 0x0);
+        }
+
+        /*
+         * Turn off RXON.
+         */
         REG_RMW_FIELD(ah, AR_PHY_65NM_RXTX2(chain),
                       AR_PHY_65NM_RXTX2_RXON_OVR, 0x1);
         REG_RMW_FIELD(ah, AR_PHY_65NM_RXTX2(chain),
                       AR_PHY_65NM_RXTX2_RXON, 0x0);
 
+        /*
+         * Turn on AGC for cal.
+         */
         REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_AGC(chain),
                       AR_PHY_65NM_RXRF_AGC_AGC_OVERRIDE, 0x1);
         REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_AGC(chain),
@@ -1228,16 +1245,19 @@ static void ar9003_hw_manual_peak_cal(struct ath_hw *ah, u8 chain, bool is_2g)
         REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_AGC(chain),
                       AR_PHY_65NM_RXRF_AGC_AGC_CAL_OVR, 0x1);
 
-        if (AR_SREV_9330_11(ah)) {
+        if (AR_SREV_9330_11(ah))
                 REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_AGC(chain),
                               AR_PHY_65NM_RXRF_AGC_AGC2G_CALDAC_OVR, 0x0);
-        } else {
+
+        if (AR_SREV_9003_PCOEM(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah)) {
                 if (is_2g)
                         REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_AGC(chain),
-                                      AR_PHY_65NM_RXRF_AGC_AGC2G_DBDAC_OVR, 0x0);
+                                      AR_PHY_65NM_RXRF_AGC_AGC2G_DBDAC_OVR,
+                                      peak_detect_threshold);
                 else
                         REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_AGC(chain),
-                                      AR_PHY_65NM_RXRF_AGC_AGC5G_DBDAC_OVR, 0x0);
+                                      AR_PHY_65NM_RXRF_AGC_AGC5G_DBDAC_OVR,
+                                      peak_detect_threshold);
         }
 
         for (i = 6; i > 0; i--) {
@@ -1266,10 +1286,19 @@ static void ar9003_hw_manual_peak_cal(struct ath_hw *ah, u8 chain, bool is_2g)
                 REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_AGC(chain),
                               AR_PHY_65NM_RXRF_AGC_AGC5G_CALDAC_OVR, total);
 
+        /*
+         * Turn on LNA.
+         */
         REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_GAINSTAGES(chain),
                       AR_PHY_65NM_RXRF_GAINSTAGES_RX_OVERRIDE, 0);
+        /*
+         * Turn off RXON.
+         */
         REG_RMW_FIELD(ah, AR_PHY_65NM_RXTX2(chain),
                       AR_PHY_65NM_RXTX2_RXON_OVR, 0);
+        /*
+         * Turn off peak detect calibration.
+         */
         REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_AGC(chain),
                       AR_PHY_65NM_RXRF_AGC_AGC_CAL_OVR, 0);
 }
@@ -1611,8 +1640,14 @@ static bool ar9003_hw_init_cal_soc(struct ath_hw *ah,
 
 skip_tx_iqcal:
         if (run_agc_cal || !(ah->ah_flags & AH_FASTCC)) {
-                if (AR_SREV_9330_11(ah))
-                        ar9003_hw_manual_peak_cal(ah, 0, IS_CHAN_2GHZ(chan));
+                if (AR_SREV_9330_11(ah) || AR_SREV_9531(ah) || AR_SREV_9550(ah)) {
+                        for (i = 0; i < AR9300_MAX_CHAINS; i++) {
+                                if (!(ah->rxchainmask & (1 << i)))
+                                        continue;
+                                ar9003_hw_manual_peak_cal(ah, i,
+                                                          IS_CHAN_2GHZ(chan));
+                        }
+                }
 
                 /*
                  * For non-AR9550 chips, we just trigger AGC calibration
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index 08225a0067c2..8b4561e8ce1a 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -3536,7 +3536,7 @@ static void ar9003_hw_xpa_bias_level_apply(struct ath_hw *ah, bool is2ghz)
         int bias = ar9003_modal_header(ah, is2ghz)->xpaBiasLvl;
 
         if (AR_SREV_9485(ah) || AR_SREV_9330(ah) || AR_SREV_9340(ah) ||
-            AR_SREV_9531(ah))
+            AR_SREV_9531(ah) || AR_SREV_9561(ah))
                 REG_RMW_FIELD(ah, AR_CH0_TOP2, AR_CH0_TOP2_XPABIASLVL, bias);
         else if (AR_SREV_9462(ah) || AR_SREV_9550(ah) || AR_SREV_9565(ah))
                 REG_RMW_FIELD(ah, AR_CH0_TOP, AR_CH0_TOP_XPABIASLVL, bias);
@@ -3599,7 +3599,7 @@ static void ar9003_hw_ant_ctrl_apply(struct ath_hw *ah, bool is2ghz)
         if (AR_SREV_9462(ah) || AR_SREV_9565(ah)) {
                 REG_RMW_FIELD(ah, AR_PHY_SWITCH_COM,
                                 AR_SWITCH_TABLE_COM_AR9462_ALL, value);
-        } else if (AR_SREV_9550(ah) || AR_SREV_9531(ah)) {
+        } else if (AR_SREV_9550(ah) || AR_SREV_9531(ah) || AR_SREV_9561(ah)) {
                 REG_RMW_FIELD(ah, AR_PHY_SWITCH_COM,
                                 AR_SWITCH_TABLE_COM_AR9550_ALL, value);
         } else
@@ -3929,9 +3929,13 @@ void ar9003_hw_internal_regulator_apply(struct ath_hw *ah)
                         REG_WRITE(ah, AR_PHY_PMU2, reg_pmu_set);
                         if (!is_pmu_set(ah, AR_PHY_PMU2, reg_pmu_set))
                                 return;
-                } else if (AR_SREV_9462(ah) || AR_SREV_9565(ah)) {
+                } else if (AR_SREV_9462(ah) || AR_SREV_9565(ah) ||
+                           AR_SREV_9561(ah)) {
                         reg_val = le32_to_cpu(pBase->swreg);
                         REG_WRITE(ah, AR_PHY_PMU1, reg_val);
+
+                        if (AR_SREV_9561(ah))
+                                REG_WRITE(ah, AR_PHY_PMU2, 0x10200000);
                 } else {
                         /* Internal regulator is ON. Write swreg register. */
                         reg_val = le32_to_cpu(pBase->swreg);
@@ -4034,7 +4038,8 @@ static void ar9003_hw_xpa_timing_control_apply(struct ath_hw *ah, bool is2ghz)
         if (!AR_SREV_9300(ah) &&
             !AR_SREV_9340(ah) &&
             !AR_SREV_9580(ah) &&
-            !AR_SREV_9531(ah))
+            !AR_SREV_9531(ah) &&
+            !AR_SREV_9561(ah))
                 return;
 
         xpa_ctl = ar9003_modal_header(ah, is2ghz)->txFrameToXpaOn;
@@ -4812,7 +4817,7 @@ static void ar9003_hw_power_control_override(struct ath_hw *ah,
         }
 
 tempslope:
-        if (AR_SREV_9550(ah) || AR_SREV_9531(ah)) {
+        if (AR_SREV_9550(ah) || AR_SREV_9531(ah) || AR_SREV_9561(ah)) {
                 u8 txmask = (eep->baseEepHeader.txrxMask & 0xf0) >> 4;
 
                 /*
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_hw.c b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
index 06ad2172030e..4335ccbe7d7e 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
@@ -29,6 +29,7 @@
 #include "ar9565_1p0_initvals.h"
 #include "ar9565_1p1_initvals.h"
 #include "ar953x_initvals.h"
+#include "ar956x_initvals.h"
 
 /* General hardware code for the AR9003 hadware family */
 
@@ -358,6 +359,40 @@ static void ar9003_hw_init_mode_regs(struct ath_hw *ah)
 
                 INIT_INI_ARRAY(&ah->iniModesFastClock,
                                qca953x_1p0_modes_fast_clock);
+        } else if (AR_SREV_9561(ah)) {
+                INIT_INI_ARRAY(&ah->iniMac[ATH_INI_CORE],
+                               qca956x_1p0_mac_core);
+                INIT_INI_ARRAY(&ah->iniMac[ATH_INI_POST],
+                               qca956x_1p0_mac_postamble);
+
+                INIT_INI_ARRAY(&ah->iniBB[ATH_INI_CORE],
+                               qca956x_1p0_baseband_core);
+                INIT_INI_ARRAY(&ah->iniBB[ATH_INI_POST],
+                               qca956x_1p0_baseband_postamble);
+
+                INIT_INI_ARRAY(&ah->iniRadio[ATH_INI_CORE],
+                               qca956x_1p0_radio_core);
+                INIT_INI_ARRAY(&ah->iniRadio[ATH_INI_POST],
+                               qca956x_1p0_radio_postamble);
+
+                INIT_INI_ARRAY(&ah->iniSOC[ATH_INI_PRE],
+                               qca956x_1p0_soc_preamble);
+                INIT_INI_ARRAY(&ah->iniSOC[ATH_INI_POST],
+                               qca956x_1p0_soc_postamble);
+
+                INIT_INI_ARRAY(&ah->iniModesRxGain,
+                               qca956x_1p0_common_wo_xlna_rx_gain_table);
+                INIT_INI_ARRAY(&ah->ini_modes_rx_gain_bounds,
+                               qca956x_1p0_common_wo_xlna_rx_gain_bounds);
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                               qca956x_1p0_modes_no_xpa_tx_gain_table);
+
+                INIT_INI_ARRAY(&ah->ini_dfs,
+                               qca956x_1p0_baseband_postamble_dfs_channel);
+                INIT_INI_ARRAY(&ah->iniCckfirJapan2484,
+                               qca956x_1p0_baseband_core_txfir_coeff_japan_2484);
+                INIT_INI_ARRAY(&ah->iniModesFastClock,
+                               qca956x_1p0_modes_fast_clock);
         } else if (AR_SREV_9580(ah)) {
                 /* mac */
                 INIT_INI_ARRAY(&ah->iniMac[ATH_INI_CORE],
@@ -544,6 +579,9 @@ static void ar9003_tx_gain_table_mode0(struct ath_hw *ah)
         else if (AR_SREV_9531_20(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                                qca953x_2p0_modes_xpa_tx_gain_table);
+        else if (AR_SREV_9561(ah))
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                               qca956x_1p0_modes_xpa_tx_gain_table);
         else if (AR_SREV_9580(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9580_1p0_lowest_ob_db_tx_gain_table);
@@ -594,7 +632,10 @@ static void ar9003_tx_gain_table_mode1(struct ath_hw *ah)
                 else
                         INIT_INI_ARRAY(&ah->iniModesTxGain,
                                        qca953x_1p0_modes_no_xpa_tx_gain_table);
-        } else if (AR_SREV_9462_21(ah))
+        } else if (AR_SREV_9561(ah))
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                               qca956x_1p0_modes_no_xpa_tx_gain_table);
+        else if (AR_SREV_9462_21(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9462_2p1_modes_high_ob_db_tx_gain);
         else if (AR_SREV_9462_20(ah))
@@ -628,6 +669,9 @@ static void ar9003_tx_gain_table_mode2(struct ath_hw *ah)
         else if (AR_SREV_9580(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9580_1p0_low_ob_db_tx_gain_table);
+        else if (AR_SREV_9561(ah))
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                               qca956x_1p0_modes_no_xpa_low_ob_db_tx_gain_table);
         else if (AR_SREV_9565_11(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                                ar9565_1p1_modes_low_ob_db_tx_gain_table);
@@ -699,6 +743,9 @@ static void ar9003_tx_gain_table_mode5(struct ath_hw *ah)
         else if (AR_SREV_9580(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9580_1p0_type5_tx_gain_table);
+        else if (AR_SREV_9561(ah))
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                               qca956x_1p0_modes_no_xpa_green_tx_gain_table);
         else if (AR_SREV_9300_22(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9300Modes_type5_tx_gain_table_2p2);
@@ -770,6 +817,13 @@ static void ar9003_rx_gain_table_mode0(struct ath_hw *ah)
                                qca953x_1p0_common_rx_gain_table);
                 INIT_INI_ARRAY(&ah->ini_modes_rx_gain_bounds,
                                qca953x_1p0_common_rx_gain_bounds);
+        } else if (AR_SREV_9561(ah)) {
+                INIT_INI_ARRAY(&ah->iniModesRxGain,
+                               qca956x_1p0_common_rx_gain_table);
+                INIT_INI_ARRAY(&ah->ini_modes_rx_gain_bounds,
+                               qca956x_1p0_common_rx_gain_bounds);
+                INIT_INI_ARRAY(&ah->ini_modes_rxgain_5g_xlna,
+                               qca956x_1p0_xlna_only);
         } else if (AR_SREV_9580(ah))
                 INIT_INI_ARRAY(&ah->iniModesRxGain,
                                 ar9580_1p0_rx_gain_table);
@@ -825,6 +879,11 @@ static void ar9003_rx_gain_table_mode1(struct ath_hw *ah)
                                qca953x_2p0_common_wo_xlna_rx_gain_table);
                 INIT_INI_ARRAY(&ah->ini_modes_rx_gain_bounds,
                                qca953x_2p0_common_wo_xlna_rx_gain_bounds);
+        } else if (AR_SREV_9561(ah)) {
+                INIT_INI_ARRAY(&ah->iniModesRxGain,
+                               qca956x_1p0_common_wo_xlna_rx_gain_table);
+                INIT_INI_ARRAY(&ah->ini_modes_rx_gain_bounds,
+                               qca956x_1p0_common_wo_xlna_rx_gain_bounds);
         } else if (AR_SREV_9580(ah))
                 INIT_INI_ARRAY(&ah->iniModesRxGain,
                         ar9580_1p0_wo_xlna_rx_gain_table);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index ae6cde273414..1ad66b76749b 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -183,7 +183,8 @@ static int ar9003_hw_set_channel(struct ath_hw *ah, struct ath9k_channel *chan)
                         } else {
                                 channelSel = CHANSEL_2G(freq) >> 1;
                         }
-                } else if (AR_SREV_9550(ah) || AR_SREV_9531(ah)) {
+                } else if (AR_SREV_9550(ah) || AR_SREV_9531(ah) ||
+                           AR_SREV_9561(ah)) {
                         if (ah->is_clk_25mhz)
                                 div = 75;
                         else
@@ -198,7 +199,8 @@ static int ar9003_hw_set_channel(struct ath_hw *ah, struct ath9k_channel *chan)
                 /* Set to 2G mode */
                 bMode = 1;
         } else {
-                if ((AR_SREV_9340(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah)) &&
+                if ((AR_SREV_9340(ah) || AR_SREV_9550(ah) ||
+                     AR_SREV_9531(ah) || AR_SREV_9561(ah)) &&
                     ah->is_clk_25mhz) {
                         channelSel = freq / 75;
                         chan_frac = ((freq % 75) * 0x20000) / 75;
@@ -265,7 +267,7 @@ static void ar9003_hw_spur_mitigate_mrc_cck(struct ath_hw *ah,
          */
 
         if (AR_SREV_9485(ah) || AR_SREV_9340(ah) || AR_SREV_9330(ah) ||
-            AR_SREV_9550(ah)) {
+            AR_SREV_9550(ah) || AR_SREV_9561(ah)) {
                 if (spur_fbin_ptr[0] == 0) /* No spur */
                         return;
                 max_spur_cnts = 5;
@@ -292,7 +294,7 @@ static void ar9003_hw_spur_mitigate_mrc_cck(struct ath_hw *ah,
 
                 negative = 0;
                 if (AR_SREV_9485(ah) || AR_SREV_9340(ah) || AR_SREV_9330(ah) ||
-                    AR_SREV_9550(ah))
+                    AR_SREV_9550(ah) || AR_SREV_9561(ah))
                         cur_bb_spur = ath9k_hw_fbin2freq(spur_fbin_ptr[i],
                                                          IS_CHAN_2GHZ(chan));
                 else
@@ -641,8 +643,10 @@ static void ar9003_hw_set_channel_regs(struct ath_hw *ah,
                 (REG_READ(ah, AR_PHY_GEN_CTRL) & AR_PHY_GC_ENABLE_DAC_FIFO);
 
         /* Enable 11n HT, 20 MHz */
-        phymode = AR_PHY_GC_HT_EN | AR_PHY_GC_SINGLE_HT_LTF1 |
-                  AR_PHY_GC_SHORT_GI_40 | enableDacFifo;
+        phymode = AR_PHY_GC_HT_EN | AR_PHY_GC_SHORT_GI_40 | enableDacFifo;
+
+        if (!AR_SREV_9561(ah))
+                phymode |= AR_PHY_GC_SINGLE_HT_LTF1;
 
         /* Configure baseband for dynamic 20/40 operation */
         if (IS_CHAN_HT40(chan)) {
@@ -745,7 +749,8 @@ static void ar9003_hw_override_ini(struct ath_hw *ah)
         else
                 ah->enabled_cals &= ~TX_CL_CAL;
 
-        if (AR_SREV_9340(ah) || AR_SREV_9531(ah) || AR_SREV_9550(ah)) {
+        if (AR_SREV_9340(ah) || AR_SREV_9531(ah) || AR_SREV_9550(ah) ||
+            AR_SREV_9561(ah)) {
                 if (ah->is_clk_25mhz) {
                         REG_WRITE(ah, AR_RTC_DERIVED_CLK, 0x17c << 1);
                         REG_WRITE(ah, AR_SLP32_MODE, 0x0010f3d7);
@@ -812,6 +817,19 @@ static int ar9550_hw_get_modes_txgain_index(struct ath_hw *ah,
         return ret;
 }
 
+static int ar9561_hw_get_modes_txgain_index(struct ath_hw *ah,
+                                            struct ath9k_channel *chan)
+{
+        if (IS_CHAN_2GHZ(chan)) {
+                if (IS_CHAN_HT40(chan))
+                        return 1;
+                else
+                        return 2;
+        }
+
+        return 0;
+}
+
 static void ar9003_doubler_fix(struct ath_hw *ah)
 {
         if (AR_SREV_9300(ah) || AR_SREV_9580(ah) || AR_SREV_9550(ah)) {
@@ -911,21 +929,29 @@ static int ar9003_hw_process_ini(struct ath_hw *ah,
                         REG_WRITE_ARRAY(&ah->ini_modes_rxgain_5g_xlna,
                                         modesIndex, regWrites);
                 }
+
+                if (AR_SREV_9561(ah) && (ar9003_hw_get_rx_gain_idx(ah) == 0))
+                        REG_WRITE_ARRAY(&ah->ini_modes_rxgain_5g_xlna,
+                                        modesIndex, regWrites);
         }
 
-        if (AR_SREV_9550(ah))
+        if (AR_SREV_9550(ah) || AR_SREV_9561(ah))
                 REG_WRITE_ARRAY(&ah->ini_modes_rx_gain_bounds, modesIndex,
                                 regWrites);
 
         /*
          * TXGAIN initvals.
          */
-        if (AR_SREV_9550(ah) || AR_SREV_9531(ah)) {
+        if (AR_SREV_9550(ah) || AR_SREV_9531(ah) || AR_SREV_9561(ah)) {
                 int modes_txgain_index = 1;
 
                 if (AR_SREV_9550(ah))
                         modes_txgain_index = ar9550_hw_get_modes_txgain_index(ah, chan);
 
+                if (AR_SREV_9561(ah))
+                        modes_txgain_index =
+                                ar9561_hw_get_modes_txgain_index(ah, chan);
+
                 if (modes_txgain_index < 0)
                         return -EINVAL;
 
@@ -1989,7 +2015,8 @@ void ar9003_hw_attach_phy_ops(struct ath_hw *ah)
         priv_ops->rf_set_freq = ar9003_hw_set_channel;
         priv_ops->spur_mitigate_freq = ar9003_hw_spur_mitigate;
 
-        if (AR_SREV_9340(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah))
+        if (AR_SREV_9340(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah) ||
+            AR_SREV_9561(ah))
                 priv_ops->compute_pll_control = ar9003_hw_compute_pll_control_soc;
         else
                 priv_ops->compute_pll_control = ar9003_hw_compute_pll_control;
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.h b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
index fd090b1f2d0f..c311b2bfdb00 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
@@ -454,7 +454,7 @@
 #define AR_PHY_GEN_CTRL          (AR_SM_BASE + 0x4)
 #define AR_PHY_MODE              (AR_SM_BASE + 0x8)
 #define AR_PHY_ACTIVE            (AR_SM_BASE + 0xc)
-#define AR_PHY_SPUR_MASK_A       (AR_SM_BASE + 0x20)
+#define AR_PHY_SPUR_MASK_A       (AR_SM_BASE + (AR_SREV_9561(ah) ? 0x18 : 0x20))
 #define AR_PHY_SPUR_MASK_B       (AR_SM_BASE + 0x24)
 #define AR_PHY_SPECTRAL_SCAN     (AR_SM_BASE + 0x28)
 #define AR_PHY_RADAR_BW_FILTER   (AR_SM_BASE + 0x2c)
@@ -506,7 +506,7 @@
 #define AR_PHY_TEST_CHAIN_SEL      0xC0000000
 #define AR_PHY_TEST_CHAIN_SEL_S    30
 
-#define AR_PHY_TEST_CTL_STATUS   (AR_SM_BASE + 0x164)
+#define AR_PHY_TEST_CTL_STATUS   (AR_SM_BASE + (AR_SREV_9561(ah) ? 0x160 : 0x164))
 #define AR_PHY_TEST_CTL_TSTDAC_EN         0x1
 #define AR_PHY_TEST_CTL_TSTDAC_EN_S       0
 #define AR_PHY_TEST_CTL_TX_OBS_SEL        0x1C
@@ -525,7 +525,7 @@
 
 #define AR_PHY_CHAN_STATUS       (AR_SM_BASE + 0x16c)
 
-#define AR_PHY_CHAN_INFO_MEMORY                         (AR_SM_BASE + 0x170)
+#define AR_PHY_CHAN_INFO_MEMORY (AR_SM_BASE + (AR_SREV_9561(ah) ? 0x16c : 0x170))
 #define AR_PHY_CHAN_INFO_MEMORY_CHANINFOMEM_S2_READ     0x00000008
 #define AR_PHY_CHAN_INFO_MEMORY_CHANINFOMEM_S2_READ_S   3
 
@@ -536,7 +536,7 @@
 #define AR_PHY_SCRAMBLER_SEED    (AR_SM_BASE + 0x190)
 #define AR_PHY_CCK_TX_CTRL       (AR_SM_BASE + 0x194)
 
-#define AR_PHY_HEAVYCLIP_CTL     (AR_SM_BASE + 0x1a4)
+#define AR_PHY_HEAVYCLIP_CTL     (AR_SM_BASE + (AR_SREV_9561(ah) ? 0x198 : 0x1a4))
 #define AR_PHY_HEAVYCLIP_20      (AR_SM_BASE + 0x1a8)
 #define AR_PHY_HEAVYCLIP_40      (AR_SM_BASE + 0x1ac)
 #define AR_PHY_ILLEGAL_TXRATE    (AR_SM_BASE + 0x1b0)
@@ -726,21 +726,24 @@
 
 #define AR_CH0_TOP2             (AR_SREV_9300(ah) ? 0x1628c : \
                                         (AR_SREV_9462(ah) ? 0x16290 : 0x16284))
-#define AR_CH0_TOP2_XPABIASLVL          0xf000
+#define AR_CH0_TOP2_XPABIASLVL          (AR_SREV_9561(ah) ? 0x1e00 : 0xf000)
 #define AR_CH0_TOP2_XPABIASLVL_S        12
 
 #define AR_CH0_XTAL             (AR_SREV_9300(ah) ? 0x16294 : \
-                                 ((AR_SREV_9462(ah) || AR_SREV_9565(ah)) ? 0x16298 : 0x16290))
+                                 ((AR_SREV_9462(ah) || AR_SREV_9565(ah)) ? 0x16298 : \
+                                  (AR_SREV_9561(ah) ? 0x162c0 : 0x16290)))
 #define AR_CH0_XTAL_CAPINDAC    0x7f000000
 #define AR_CH0_XTAL_CAPINDAC_S  24
 #define AR_CH0_XTAL_CAPOUTDAC   0x00fe0000
 #define AR_CH0_XTAL_CAPOUTDAC_S 17
 
-#define AR_PHY_PMU1             ((AR_SREV_9462(ah) || AR_SREV_9565(ah)) ? 0x16340 : 0x16c40)
+#define AR_PHY_PMU1             ((AR_SREV_9462(ah) || AR_SREV_9565(ah)) ? 0x16340 : \
+                                 (AR_SREV_9561(ah) ? 0x16cc0 : 0x16c40))
 #define AR_PHY_PMU1_PWD         0x1
 #define AR_PHY_PMU1_PWD_S       0
 
-#define AR_PHY_PMU2             ((AR_SREV_9462(ah) || AR_SREV_9565(ah)) ? 0x16344 : 0x16c44)
+#define AR_PHY_PMU2             ((AR_SREV_9462(ah) || AR_SREV_9565(ah)) ? 0x16344 : \
+                                 (AR_SREV_9561(ah) ? 0x16cc4 : 0x16c44))
 #define AR_PHY_PMU2_PGM         0x00200000
 #define AR_PHY_PMU2_PGM_S       21
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_wow.c b/drivers/net/wireless/ath/ath9k/ar9003_wow.c
index 81c88dd606dc..86bfc9604dca 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_wow.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_wow.c
@@ -17,23 +17,9 @@
 #include <linux/export.h>
 #include "ath9k.h"
 #include "reg.h"
+#include "reg_wow.h"
 #include "hw-ops.h"
 
-const char *ath9k_hw_wow_event_to_string(u32 wow_event)
-{
-        if (wow_event & AH_WOW_MAGIC_PATTERN_EN)
-                return "Magic pattern";
-        if (wow_event & AH_WOW_USER_PATTERN_EN)
-                return "User pattern";
-        if (wow_event & AH_WOW_LINK_CHANGE)
-                return "Link change";
-        if (wow_event & AH_WOW_BEACON_MISS)
-                return "Beacon miss";
-
-        return  "unknown reason";
-}
-EXPORT_SYMBOL(ath9k_hw_wow_event_to_string);
-
 static void ath9k_hw_set_powermode_wow_sleep(struct ath_hw *ah)
 {
         struct ath_common *common = ath9k_hw_common(ah);
@@ -49,6 +35,15 @@ static void ath9k_hw_set_powermode_wow_sleep(struct ath_hw *ah)
                 return;
         }
 
+        if (AR_SREV_9462(ah) || AR_SREV_9565(ah)) {
+                if (!REG_READ(ah, AR_MAC_PCU_GEN_TIMER_TSF_SEL))
+                        REG_CLR_BIT(ah, AR_DIRECT_CONNECT, AR_DC_TSF2_ENABLE);
+        } else if (AR_SREV_9485(ah)){
+                if (!(REG_READ(ah, AR_NDP2_TIMER_MODE) &
+                      AR_GEN_TIMERS2_MODE_ENABLE_MASK))
+                        REG_CLR_BIT(ah, AR_DIRECT_CONNECT, AR_DC_TSF2_ENABLE);
+        }
+
         REG_WRITE(ah, AR_RTC_FORCE_WAKE, AR_RTC_FORCE_WAKE_ON_INT);
 }
 
@@ -67,11 +62,15 @@ static void ath9k_wow_create_keep_alive_pattern(struct ath_hw *ah)
         /* set the transmit buffer */
         ctl[0] = (KAL_FRAME_LEN | (MAX_RATE_POWER << 16));
         ctl[1] = 0;
-        ctl[3] = 0xb;   /* OFDM_6M hardware value for this rate */
         ctl[4] = 0;
         ctl[7] = (ah->txchainmask) << 2;
         ctl[2] = 0xf << 16; /* tx_tries 0 */
 
+        if (IS_CHAN_2GHZ(ah->curchan))
+                ctl[3] = 0x1b;  /* CCK_1M */
+        else
+                ctl[3] = 0xb;   /* OFDM_6M */
+
         for (i = 0; i < KAL_NUM_DESC_WORDS; i++)
                 REG_WRITE(ah, (AR_WOW_KA_DESC_WORD2 + i * 4), ctl[i]);
 
@@ -103,21 +102,22 @@ static void ath9k_wow_create_keep_alive_pattern(struct ath_hw *ah)
 
 }
 
-void ath9k_hw_wow_apply_pattern(struct ath_hw *ah, u8 *user_pattern,
-                                u8 *user_mask, int pattern_count,
-                                int pattern_len)
+int ath9k_hw_wow_apply_pattern(struct ath_hw *ah, u8 *user_pattern,
+                               u8 *user_mask, int pattern_count,
+                               int pattern_len)
 {
         int i;
         u32 pattern_val, mask_val;
         u32 set, clr;
 
-        /* FIXME: should check count by querying the hardware capability */
-        if (pattern_count >= MAX_NUM_PATTERN)
-                return;
+        if (pattern_count >= ah->wow.max_patterns)
+                return -ENOSPC;
 
-        REG_SET_BIT(ah, AR_WOW_PATTERN, BIT(pattern_count));
+        if (pattern_count < MAX_NUM_PATTERN_LEGACY)
+                REG_SET_BIT(ah, AR_WOW_PATTERN, BIT(pattern_count));
+        else
+                REG_SET_BIT(ah, AR_MAC_PCU_WOW4, BIT(pattern_count - 8));
 
-        /* set the registers for pattern */
         for (i = 0; i < MAX_PATTERN_SIZE; i += 4) {
                 memcpy(&pattern_val, user_pattern, 4);
                 REG_WRITE(ah, (AR_WOW_TB_PATTERN(pattern_count) + i),
@@ -125,49 +125,42 @@ void ath9k_hw_wow_apply_pattern(struct ath_hw *ah, u8 *user_pattern,
                 user_pattern += 4;
         }
 
-        /* set the registers for mask */
         for (i = 0; i < MAX_PATTERN_MASK_SIZE; i += 4) {
                 memcpy(&mask_val, user_mask, 4);
                 REG_WRITE(ah, (AR_WOW_TB_MASK(pattern_count) + i), mask_val);
                 user_mask += 4;
         }
 
-        /* set the pattern length to be matched
-         *
-         * AR_WOW_LENGTH1_REG1
-         * bit 31:24 pattern 0 length
-         * bit 23:16 pattern 1 length
-         * bit 15:8 pattern 2 length
-         * bit 7:0 pattern 3 length
-         *
-         * AR_WOW_LENGTH1_REG2
-         * bit 31:24 pattern 4 length
-         * bit 23:16 pattern 5 length
-         * bit 15:8 pattern 6 length
-         * bit 7:0 pattern 7 length
-         *
-         * the below logic writes out the new
-         * pattern length for the corresponding
-         * pattern_count, while masking out the
-         * other fields
-         */
-
-        ah->wow_event_mask |= BIT(pattern_count + AR_WOW_PAT_FOUND_SHIFT);
+        if (pattern_count < MAX_NUM_PATTERN_LEGACY)
+                ah->wow.wow_event_mask |=
+                        BIT(pattern_count + AR_WOW_PAT_FOUND_SHIFT);
+        else
+                ah->wow.wow_event_mask2 |=
+                        BIT((pattern_count - 8) + AR_WOW_PAT_FOUND_SHIFT);
 
         if (pattern_count < 4) {
-                /* Pattern 0-3 uses AR_WOW_LENGTH1 register */
                 set = (pattern_len & AR_WOW_LENGTH_MAX) <<
                        AR_WOW_LEN1_SHIFT(pattern_count);
                 clr = AR_WOW_LENGTH1_MASK(pattern_count);
                 REG_RMW(ah, AR_WOW_LENGTH1, set, clr);
-        } else {
-                /* Pattern 4-7 uses AR_WOW_LENGTH2 register */
+        } else if (pattern_count < 8) {
                 set = (pattern_len & AR_WOW_LENGTH_MAX) <<
                        AR_WOW_LEN2_SHIFT(pattern_count);
                 clr = AR_WOW_LENGTH2_MASK(pattern_count);
                 REG_RMW(ah, AR_WOW_LENGTH2, set, clr);
+        } else if (pattern_count < 12) {
+                set = (pattern_len & AR_WOW_LENGTH_MAX) <<
+                       AR_WOW_LEN3_SHIFT(pattern_count);
+                clr = AR_WOW_LENGTH3_MASK(pattern_count);
+                REG_RMW(ah, AR_WOW_LENGTH3, set, clr);
+        } else if (pattern_count < MAX_NUM_PATTERN) {
+                set = (pattern_len & AR_WOW_LENGTH_MAX) <<
+                       AR_WOW_LEN4_SHIFT(pattern_count);
+                clr = AR_WOW_LENGTH4_MASK(pattern_count);
+                REG_RMW(ah, AR_WOW_LENGTH4, set, clr);
         }
 
+        return 0;
 }
 EXPORT_SYMBOL(ath9k_hw_wow_apply_pattern);
 
@@ -189,7 +182,7 @@ u32 ath9k_hw_wow_wakeup(struct ath_hw *ah)
          * register. This mask will clean it up.
          */
 
-        val &= ah->wow_event_mask;
+        val &= ah->wow.wow_event_mask;
 
         if (val) {
                 if (val & AR_WOW_MAGIC_PAT_FOUND)
@@ -233,190 +226,192 @@ u32 ath9k_hw_wow_wakeup(struct ath_hw *ah)
         if (ah->is_pciexpress)
                 ath9k_hw_configpcipowersave(ah, false);
 
-        ah->wow_event_mask = 0;
+        ah->wow.wow_event_mask = 0;
 
         return wow_status;
 }
 EXPORT_SYMBOL(ath9k_hw_wow_wakeup);
 
-void ath9k_hw_wow_enable(struct ath_hw *ah, u32 pattern_enable)
+static void ath9k_hw_wow_set_arwr_reg(struct ath_hw *ah)
 {
-        u32 wow_event_mask;
-        u32 set, clr;
+        u32 wa_reg;
 
-        /*
-         * wow_event_mask is a mask to the AR_WOW_PATTERN register to
-         * indicate which WoW events we have enabled. The WoW events
-         * are from the 'pattern_enable' in this function and
-         * 'pattern_count' of ath9k_hw_wow_apply_pattern()
-         */
-        wow_event_mask = ah->wow_event_mask;
+        if (!ah->is_pciexpress)
+                return;
 
         /*
-         * Untie Power-on-Reset from the PCI-E-Reset. When we are in
-         * WOW sleep, we do want the Reset from the PCI-E to disturb
-         * our hw state
+         * We need to untie the internal POR (power-on-reset)
+         * to the external PCI-E reset. We also need to tie
+         * the PCI-E Phy reset to the PCI-E reset.
          */
-        if (ah->is_pciexpress) {
-                /*
-                 * we need to untie the internal POR (power-on-reset)
-                 * to the external PCI-E reset. We also need to tie
-                 * the PCI-E Phy reset to the PCI-E reset.
-                 */
-                set = AR_WA_RESET_EN | AR_WA_POR_SHORT;
-                clr = AR_WA_UNTIE_RESET_EN | AR_WA_D3_L1_DISABLE;
-                REG_RMW(ah, AR_WA, set, clr);
-        }
+        wa_reg = REG_READ(ah, AR_WA);
+        wa_reg &= ~AR_WA_UNTIE_RESET_EN;
+        wa_reg |= AR_WA_RESET_EN;
+        wa_reg |= AR_WA_POR_SHORT;
 
-        /*
-         * set the power states appropriately and enable PME
-         */
-        set = AR_PMCTRL_HOST_PME_EN | AR_PMCTRL_PWR_PM_CTRL_ENA |
-              AR_PMCTRL_AUX_PWR_DET | AR_PMCTRL_WOW_PME_CLR;
+        REG_WRITE(ah, AR_WA, wa_reg);
+}
+
+void ath9k_hw_wow_enable(struct ath_hw *ah, u32 pattern_enable)
+{
+        u32 wow_event_mask;
+        u32 keep_alive, magic_pattern, host_pm_ctrl;
+
+        wow_event_mask = ah->wow.wow_event_mask;
 
         /*
-         * set and clear WOW_PME_CLEAR registers for the chip
+         * AR_PMCTRL_HOST_PME_EN - Override PME enable in configuration
+         *                         space and allow MAC to generate WoW anyway.
+         *
+         * AR_PMCTRL_PWR_PM_CTRL_ENA - ???
+         *
+         * AR_PMCTRL_AUX_PWR_DET - PCI core SYS_AUX_PWR_DET signal,
+         *                         needs to be set for WoW in PCI mode.
+         *
+         * AR_PMCTRL_WOW_PME_CLR - WoW Clear Signal going to the MAC.
+         *
+         * Set the power states appropriately and enable PME.
+         *
+         * Set and clear WOW_PME_CLEAR for the chip
          * to generate next wow signal.
          */
-        REG_SET_BIT(ah, AR_PCIE_PM_CTRL, set);
-        clr = AR_PMCTRL_WOW_PME_CLR;
-        REG_CLR_BIT(ah, AR_PCIE_PM_CTRL, clr);
+        REG_SET_BIT(ah, AR_PCIE_PM_CTRL, AR_PMCTRL_HOST_PME_EN |
+                                         AR_PMCTRL_PWR_PM_CTRL_ENA |
+                                         AR_PMCTRL_AUX_PWR_DET |
+                                         AR_PMCTRL_WOW_PME_CLR);
+        REG_CLR_BIT(ah, AR_PCIE_PM_CTRL, AR_PMCTRL_WOW_PME_CLR);
 
         /*
-         * Setup for:
-         *      - beacon misses
-         *      - magic pattern
-         *      - keep alive timeout
-         *      - pattern matching
+         * Random Backoff.
+         *
+         * 31:28 in AR_WOW_PATTERN : Indicates the number of bits used in the
+         *                           contention window. For value N,
+         *                           the random backoff will be selected between
+         *                           0 and (2 ^ N) - 1.
          */
+        REG_SET_BIT(ah, AR_WOW_PATTERN,
+                    AR_WOW_BACK_OFF_SHIFT(AR_WOW_PAT_BACKOFF));
 
         /*
-         * Program default values for pattern backoff, aifs/slot/KAL count,
-         * beacon miss timeout, KAL timeout, etc.
+         * AIFS time, Slot time, Keep Alive count.
+         */
+        REG_SET_BIT(ah, AR_WOW_COUNT, AR_WOW_AIFS_CNT(AR_WOW_CNT_AIFS_CNT) |
+                                      AR_WOW_SLOT_CNT(AR_WOW_CNT_SLOT_CNT) |
+                                      AR_WOW_KEEP_ALIVE_CNT(AR_WOW_CNT_KA_CNT));
+        /*
+         * Beacon timeout.
          */
-        set = AR_WOW_BACK_OFF_SHIFT(AR_WOW_PAT_BACKOFF);
-        REG_SET_BIT(ah, AR_WOW_PATTERN, set);
-
-        set = AR_WOW_AIFS_CNT(AR_WOW_CNT_AIFS_CNT) |
-              AR_WOW_SLOT_CNT(AR_WOW_CNT_SLOT_CNT) |
-              AR_WOW_KEEP_ALIVE_CNT(AR_WOW_CNT_KA_CNT);
-        REG_SET_BIT(ah, AR_WOW_COUNT, set);
-
         if (pattern_enable & AH_WOW_BEACON_MISS)
-                set = AR_WOW_BEACON_TIMO;
-        /* We are not using beacon miss, program a large value */
+                REG_WRITE(ah, AR_WOW_BCN_TIMO, AR_WOW_BEACON_TIMO);
         else
-                set = AR_WOW_BEACON_TIMO_MAX;
-
-        REG_WRITE(ah, AR_WOW_BCN_TIMO, set);
+                REG_WRITE(ah, AR_WOW_BCN_TIMO, AR_WOW_BEACON_TIMO_MAX);
 
         /*
-         * Keep alive timo in ms except AR9280
+         * Keep alive timeout in ms.
          */
         if (!pattern_enable)
-                set = AR_WOW_KEEP_ALIVE_NEVER;
+                REG_WRITE(ah, AR_WOW_KEEP_ALIVE_TIMO, AR_WOW_KEEP_ALIVE_NEVER);
         else
-                set = KAL_TIMEOUT * 32;
-
-        REG_WRITE(ah, AR_WOW_KEEP_ALIVE_TIMO, set);
+                REG_WRITE(ah, AR_WOW_KEEP_ALIVE_TIMO, KAL_TIMEOUT * 32);
 
         /*
-         * Keep alive delay in us. based on 'power on clock',
-         * therefore in usec
+         * Keep alive delay in us.
          */
-        set = KAL_DELAY * 1000;
-        REG_WRITE(ah, AR_WOW_KEEP_ALIVE_DELAY, set);
+        REG_WRITE(ah, AR_WOW_KEEP_ALIVE_DELAY, KAL_DELAY * 1000);
 
         /*
-         * Create keep alive pattern to respond to beacons
+         * Create keep alive pattern to respond to beacons.
          */
         ath9k_wow_create_keep_alive_pattern(ah);
 
         /*
-         * Configure MAC WoW Registers
+         * Configure keep alive register.
          */
-        set = 0;
+        keep_alive = REG_READ(ah, AR_WOW_KEEP_ALIVE);
+
         /* Send keep alive timeouts anyway */
-        clr = AR_WOW_KEEP_ALIVE_AUTO_DIS;
+        keep_alive &= ~AR_WOW_KEEP_ALIVE_AUTO_DIS;
 
-        if (pattern_enable & AH_WOW_LINK_CHANGE)
+        if (pattern_enable & AH_WOW_LINK_CHANGE) {
+                keep_alive &= ~AR_WOW_KEEP_ALIVE_FAIL_DIS;
                 wow_event_mask |= AR_WOW_KEEP_ALIVE_FAIL;
-        else
-                set = AR_WOW_KEEP_ALIVE_FAIL_DIS;
+        } else {
+                keep_alive |= AR_WOW_KEEP_ALIVE_FAIL_DIS;
+        }
 
-        set = AR_WOW_KEEP_ALIVE_FAIL_DIS;
-        REG_RMW(ah, AR_WOW_KEEP_ALIVE, set, clr);
+        REG_WRITE(ah, AR_WOW_KEEP_ALIVE, keep_alive);
 
         /*
-         * we are relying on a bmiss failure. ensure we have
-         * enough threshold to prevent false positives
+         * We are relying on a bmiss failure, ensure we have
+         * enough threshold to prevent false positives.
          */
         REG_RMW_FIELD(ah, AR_RSSI_THR, AR_RSSI_THR_BM_THR,
                       AR_WOW_BMISSTHRESHOLD);
 
-        set = 0;
-        clr = 0;
-
         if (pattern_enable & AH_WOW_BEACON_MISS) {
-                set = AR_WOW_BEACON_FAIL_EN;
                 wow_event_mask |= AR_WOW_BEACON_FAIL;
+                REG_SET_BIT(ah, AR_WOW_BCN_EN, AR_WOW_BEACON_FAIL_EN);
         } else {
-                clr = AR_WOW_BEACON_FAIL_EN;
+                REG_CLR_BIT(ah, AR_WOW_BCN_EN, AR_WOW_BEACON_FAIL_EN);
         }
 
-        REG_RMW(ah, AR_WOW_BCN_EN, set, clr);
-
-        set = 0;
-        clr = 0;
         /*
-         * Enable the magic packet registers
+         * Enable the magic packet registers.
          */
+        magic_pattern = REG_READ(ah, AR_WOW_PATTERN);
+        magic_pattern |= AR_WOW_MAC_INTR_EN;
+
         if (pattern_enable & AH_WOW_MAGIC_PATTERN_EN) {
-                set = AR_WOW_MAGIC_EN;
+                magic_pattern |= AR_WOW_MAGIC_EN;
                 wow_event_mask |= AR_WOW_MAGIC_PAT_FOUND;
         } else {
-                clr = AR_WOW_MAGIC_EN;
+                magic_pattern &= ~AR_WOW_MAGIC_EN;
         }
-        set |= AR_WOW_MAC_INTR_EN;
-        REG_RMW(ah, AR_WOW_PATTERN, set, clr);
 
+        REG_WRITE(ah, AR_WOW_PATTERN, magic_pattern);
+
+        /*
+         * Enable pattern matching for packets which are less
+         * than 256 bytes.
+         */
         REG_WRITE(ah, AR_WOW_PATTERN_MATCH_LT_256B,
                   AR_WOW_PATTERN_SUPPORTED);
 
         /*
-         * Set the power states appropriately and enable PME
+         * Set the power states appropriately and enable PME.
          */
-        clr = 0;
-        set = AR_PMCTRL_PWR_STATE_D1D3 | AR_PMCTRL_HOST_PME_EN |
-              AR_PMCTRL_PWR_PM_CTRL_ENA;
+        host_pm_ctrl = REG_READ(ah, AR_PCIE_PM_CTRL);
+        host_pm_ctrl |= AR_PMCTRL_PWR_STATE_D1D3 |
+                        AR_PMCTRL_HOST_PME_EN |
+                        AR_PMCTRL_PWR_PM_CTRL_ENA;
+        host_pm_ctrl &= ~AR_PCIE_PM_CTRL_ENA;
 
-        clr = AR_PCIE_PM_CTRL_ENA;
-        REG_RMW(ah, AR_PCIE_PM_CTRL, set, clr);
+        if (AR_SREV_9462(ah)) {
+                /*
+                 * This is needed to prevent the chip waking up
+                 * the host within 3-4 seconds with certain
+                 * platform/BIOS.
+                 */
+                host_pm_ctrl &= ~AR_PMCTRL_PWR_STATE_D1D3;
+                host_pm_ctrl |= AR_PMCTRL_PWR_STATE_D1D3_REAL;
+        }
+
+        REG_WRITE(ah, AR_PCIE_PM_CTRL, host_pm_ctrl);
 
         /*
-         * this is needed to prevent the chip waking up
-         * the host within 3-4 seconds with certain
-         * platform/BIOS. The fix is to enable
-         * D1 & D3 to match original definition and
-         * also match the OTP value. Anyway this
-         * is more related to SW WOW.
+         * Enable sequence number generation when asleep.
          */
-        clr = AR_PMCTRL_PWR_STATE_D1D3;
-        REG_CLR_BIT(ah, AR_PCIE_PM_CTRL, clr);
+        REG_CLR_BIT(ah, AR_STA_ID1, AR_STA_ID1_PRESERVE_SEQNUM);
 
-        set = AR_PMCTRL_PWR_STATE_D1D3_REAL;
-        REG_SET_BIT(ah, AR_PCIE_PM_CTRL, set);
+        /* To bring down WOW power low margin */
+        REG_SET_BIT(ah, AR_PCIE_PHY_REG3, BIT(13));
 
-        REG_CLR_BIT(ah, AR_STA_ID1, AR_STA_ID1_PRESERVE_SEQNUM);
+        ath9k_hw_wow_set_arwr_reg(ah);
 
-        /* to bring down WOW power low margin */
-        set = BIT(13);
-        REG_SET_BIT(ah, AR_PCIE_PHY_REG3, set);
         /* HW WoW */
-        clr = BIT(5);
-        REG_CLR_BIT(ah, AR_PCU_MISC_MODE3, clr);
+        REG_CLR_BIT(ah, AR_PCU_MISC_MODE3, BIT(5));
 
         ath9k_hw_set_powermode_wow_sleep(ah);
-        ah->wow_event_mask = wow_event_mask;
+        ah->wow.wow_event_mask = wow_event_mask;
 }
 EXPORT_SYMBOL(ath9k_hw_wow_enable);
diff --git a/drivers/net/wireless/ath/ath9k/ar953x_initvals.h b/drivers/net/wireless/ath/ath9k/ar953x_initvals.h
index 159cc6fd2362..6fc0d07e5ec6 100644
--- a/drivers/net/wireless/ath/ath9k/ar953x_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar953x_initvals.h
@@ -358,7 +358,7 @@ static const u32 qca953x_1p0_baseband_postamble[][5] = {
         {0x00009e1c, 0x0001cf9c, 0x0001cf9c, 0x00021f9c, 0x00021f9c},
         {0x00009e20, 0x000003b5, 0x000003b5, 0x000003ce, 0x000003ce},
         {0x00009e2c, 0x0000001c, 0x0000001c, 0x00000021, 0x00000021},
-        {0x00009e3c, 0xcfa10820, 0xcfa10820, 0xcfa10822, 0xcfa10822},
+        {0x00009e3c, 0xcfa10820, 0xcfa10820, 0xcfa10820, 0xcfa10820},
         {0x00009e44, 0xfe321e27, 0xfe321e27, 0xfe291e27, 0xfe291e27},
         {0x00009e48, 0x5030201a, 0x5030201a, 0x50302012, 0x50302012},
         {0x00009fc8, 0x0003f000, 0x0003f000, 0x0001a000, 0x0001a000},
@@ -378,7 +378,7 @@ static const u32 qca953x_1p0_baseband_postamble[][5] = {
         {0x0000a284, 0x00000000, 0x00000000, 0x00000010, 0x00000010},
         {0x0000a288, 0x00000110, 0x00000110, 0x00000110, 0x00000110},
         {0x0000a28c, 0x00022222, 0x00022222, 0x00022222, 0x00022222},
-        {0x0000a2c4, 0x00158d18, 0x00158d18, 0x00158d18, 0x00158d18},
+        {0x0000a2c4, 0x00158d18, 0x00158d18, 0x00058d18, 0x00058d18},
         {0x0000a2cc, 0x18c50033, 0x18c43433, 0x18c41033, 0x18c44c33},
         {0x0000a2d0, 0x00041982, 0x00041982, 0x00041982, 0x00041982},
         {0x0000a2d8, 0x7999a83b, 0x7999a83b, 0x7999a83b, 0x7999a83b},
diff --git a/drivers/net/wireless/ath/ath9k/ar955x_1p0_initvals.h b/drivers/net/wireless/ath/ath9k/ar955x_1p0_initvals.h
index fd6a84ccd49e..148562addd38 100644
--- a/drivers/net/wireless/ath/ath9k/ar955x_1p0_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar955x_1p0_initvals.h
@@ -63,7 +63,7 @@ static const u32 ar955x_1p0_baseband_postamble[][5] = {
         {0x00009e1c, 0x0001cf9c, 0x0001cf9c, 0x00021f9c, 0x00021f9c},
         {0x00009e20, 0x000003b5, 0x000003b5, 0x000003ce, 0x000003ce},
         {0x00009e2c, 0x0000001c, 0x0000001c, 0x00000021, 0x00000021},
-        {0x00009e3c, 0xcfa10820, 0xcfa10820, 0xcfa10822, 0xcfa10822},
+        {0x00009e3c, 0xcfa10820, 0xcfa10820, 0xcfa10820, 0xcfa10820},
         {0x00009e44, 0xfe321e27, 0xfe321e27, 0xfe291e27, 0xfe291e27},
         {0x00009e48, 0x5030201a, 0x5030201a, 0x50302012, 0x50302012},
         {0x00009fc8, 0x0003f000, 0x0003f000, 0x0001a000, 0x0001a000},
@@ -83,7 +83,7 @@ static const u32 ar955x_1p0_baseband_postamble[][5] = {
         {0x0000a284, 0x00000000, 0x00000000, 0x00000010, 0x00000010},
         {0x0000a288, 0x00000110, 0x00000110, 0x00000110, 0x00000110},
         {0x0000a28c, 0x00022222, 0x00022222, 0x00022222, 0x00022222},
-        {0x0000a2c4, 0x00158d18, 0x00158d18, 0x00158d18, 0x00158d18},
+        {0x0000a2c4, 0x00158d18, 0x00158d18, 0x00058d18, 0x00058d18},
         {0x0000a2cc, 0x18c50033, 0x18c43433, 0x18c41033, 0x18c44c33},
         {0x0000a2d0, 0x00041982, 0x00041982, 0x00041982, 0x00041982},
         {0x0000a2d8, 0x7999a83b, 0x7999a83b, 0x7999a83b, 0x7999a83b},
diff --git a/drivers/net/wireless/ath/ath9k/ar956x_initvals.h b/drivers/net/wireless/ath/ath9k/ar956x_initvals.h
new file mode 100644
index 000000000000..c3a47eaaf0c0
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/ar956x_initvals.h
@@ -0,0 +1,1046 @@
+/*
+ * Copyright (c) 2010-2011 Atheros Communications Inc.
+ * Copyright (c) 2011-2012 Qualcomm Atheros Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef INITVALS_956X_H
+#define INITVALS_956X_H
+
+#define qca956x_1p0_mac_core ar955x_1p0_mac_core
+
+#define qca956x_1p0_mac_postamble ar9331_1p1_mac_postamble
+
+#define qca956x_1p0_soc_preamble ar955x_1p0_soc_preamble
+
+#define qca956x_1p0_soc_postamble ar9300_2p2_soc_postamble
+
+#define qca956x_1p0_common_wo_xlna_rx_gain_table ar9300Common_wo_xlna_rx_gain_table_2p2
+
+#define qca956x_1p0_baseband_postamble_dfs_channel ar9300_2p2_baseband_postamble_dfs_channel
+
+#define qca956x_1p0_common_wo_xlna_rx_gain_bounds ar955x_1p0_common_wo_xlna_rx_gain_bounds
+
+#define qca956x_1p0_common_rx_gain_bounds ar955x_1p0_common_rx_gain_bounds
+
+#define qca956x_1p0_modes_fast_clock ar9462_2p0_modes_fast_clock
+
+static const u32 qca956x_1p0_baseband_core[][2] = {
+        /* Addr      allmodes  */
+        {0x00009800, 0xafe68e30},
+        {0x00009804, 0xfd14e000},
+        {0x00009808, 0x9c0a9f6b},
+        {0x0000980c, 0x04900000},
+        {0x00009814, 0x0280c00a},
+        {0x00009818, 0x00000000},
+        {0x0000981c, 0x00020028},
+        {0x00009834, 0x6400a190},
+        {0x00009838, 0x0108ecff},
+        {0x0000983c, 0x14000600},
+        {0x00009880, 0x201fff00},
+        {0x00009884, 0x00001042},
+        {0x000098a4, 0x00200400},
+        {0x000098b0, 0x32840cbf},
+        {0x000098bc, 0x00000002},
+        {0x000098d0, 0x004b6a8e},
+        {0x000098d4, 0x00000820},
+        {0x000098dc, 0x00000000},
+        {0x000098f0, 0x00000000},
+        {0x000098f4, 0x00000000},
+        {0x00009c04, 0xff55ff55},
+        {0x00009c08, 0x0320ff55},
+        {0x00009c0c, 0x00000000},
+        {0x00009c10, 0x00000000},
+        {0x00009c14, 0x00046384},
+        {0x00009c18, 0x05b6b440},
+        {0x00009c1c, 0x00b6b440},
+        {0x00009d00, 0xc080a333},
+        {0x00009d04, 0x40206c10},
+        {0x00009d08, 0x009c4060},
+        {0x00009d0c, 0x9883800a},
+        {0x00009d10, 0x01834061},
+        {0x00009d14, 0x00c0040b},
+        {0x00009d18, 0x00000000},
+        {0x00009e08, 0x0038230c},
+        {0x00009e24, 0x990bb514},
+        {0x00009e28, 0x0c6f0000},
+        {0x00009e30, 0x06336f77},
+        {0x00009e34, 0x6af6532f},
+        {0x00009e38, 0x0cc80c00},
+        {0x00009e40, 0x0d261820},
+        {0x00009e4c, 0x00001004},
+        {0x00009e50, 0x00ff03f1},
+        {0x00009fc0, 0x813e4789},
+        {0x00009fc4, 0x0001efb5},
+        {0x00009fcc, 0x40000014},
+        {0x00009fd0, 0x02993b93},
+        {0x0000a20c, 0x00000000},
+        {0x0000a218, 0x00000000},
+        {0x0000a21c, 0x00000000},
+        {0x0000a228, 0x10002310},
+        {0x0000a23c, 0x00000000},
+        {0x0000a244, 0x0c000000},
+        {0x0000a248, 0x00000140},
+        {0x0000a2a0, 0x00000007},
+        {0x0000a2c0, 0x00000007},
+        {0x0000a2c8, 0x00000000},
+        {0x0000a2d4, 0x00000000},
+        {0x0000a2ec, 0x00000000},
+        {0x0000a2f0, 0x00000000},
+        {0x0000a2f4, 0x00000000},
+        {0x0000a2f8, 0x00000000},
+        {0x0000a344, 0x00000000},
+        {0x0000a34c, 0x00000000},
+        {0x0000a350, 0x0000a000},
+        {0x0000a360, 0x00000000},
+        {0x0000a36c, 0x00000000},
+        {0x0000a384, 0x00000001},
+        {0x0000a388, 0x00000444},
+        {0x0000a38c, 0x00000000},
+        {0x0000a390, 0x210d0401},
+        {0x0000a394, 0xab9a7144},
+        {0x0000a398, 0x00000201},
+        {0x0000a39c, 0x42424848},
+        {0x0000a3a0, 0x3c466478},
+        {0x0000a3a4, 0x3a363600},
+        {0x0000a3a8, 0x0000003a},
+        {0x0000a3ac, 0x00000000},
+        {0x0000a3b0, 0x009011fe},
+        {0x0000a3b4, 0x00000034},
+        {0x0000a3b8, 0x00b3ec0a},
+        {0x0000a3bc, 0x00000036},
+        {0x0000a3c0, 0x20202020},
+        {0x0000a3c4, 0x22222220},
+        {0x0000a3c8, 0x20200020},
+        {0x0000a3cc, 0x20202020},
+        {0x0000a3d0, 0x20202020},
+        {0x0000a3d4, 0x20202020},
+        {0x0000a3d8, 0x20202020},
+        {0x0000a3dc, 0x20202020},
+        {0x0000a3e0, 0x20202020},
+        {0x0000a3e4, 0x20202020},
+        {0x0000a3e8, 0x20202020},
+        {0x0000a3ec, 0x20202020},
+        {0x0000a3f0, 0x00000000},
+        {0x0000a3f4, 0x00000000},
+        {0x0000a3f8, 0x0c9bd380},
+        {0x0000a3fc, 0x000f0f01},
+        {0x0000a400, 0x8fa91f01},
+        {0x0000a404, 0x00000000},
+        {0x0000a408, 0x0e79e5c6},
+        {0x0000a40c, 0x00820820},
+        {0x0000a414, 0x1ce739ce},
+        {0x0000a418, 0x2d0019ce},
+        {0x0000a41c, 0x1ce739ce},
+        {0x0000a420, 0x000001ce},
+        {0x0000a424, 0x1ce739ce},
+        {0x0000a428, 0x000001ce},
+        {0x0000a42c, 0x1ce739ce},
+        {0x0000a430, 0x1ce739ce},
+        {0x0000a434, 0x00000000},
+        {0x0000a438, 0x00001801},
+        {0x0000a43c, 0x00100000},
+        {0x0000a444, 0x00000000},
+        {0x0000a448, 0x05000080},
+        {0x0000a44c, 0x00000001},
+        {0x0000a450, 0x00010000},
+        {0x0000a454, 0x05000000},
+        {0x0000a458, 0x00000000},
+        {0x0000a644, 0xbfad9fee},
+        {0x0000a648, 0x0048660d},
+        {0x0000a64c, 0x00003c37},
+        {0x0000a670, 0x03020100},
+        {0x0000a674, 0x21200504},
+        {0x0000a678, 0x61602322},
+        {0x0000a67c, 0x65646362},
+        {0x0000a680, 0x6b6a6968},
+        {0x0000a684, 0xe2706d6c},
+        {0x0000a688, 0x000000e3},
+        {0x0000a690, 0x00000838},
+        {0x0000a7cc, 0x00000000},
+        {0x0000a7d0, 0x00000000},
+        {0x0000a7d4, 0x00000004},
+        {0x0000a7dc, 0x00000000},
+        {0x0000a8d0, 0x004b6a8e},
+        {0x0000a8d4, 0x00000820},
+        {0x0000a8dc, 0x00000000},
+        {0x0000a8f0, 0x00000000},
+        {0x0000a8f4, 0x00000000},
+        {0x0000b2d0, 0x00000080},
+        {0x0000b2d4, 0x00000000},
+        {0x0000b2ec, 0x00000000},
+        {0x0000b2f0, 0x00000000},
+        {0x0000b2f4, 0x00000000},
+        {0x0000b2f8, 0x00000000},
+        {0x0000b408, 0x0e79e5c0},
+        {0x0000b40c, 0x00820820},
+        {0x0000b420, 0x00000000},
+        {0x0000b8d0, 0x004b6a8e},
+        {0x0000b8d4, 0x00000820},
+        {0x0000b8dc, 0x00000000},
+        {0x0000b8f0, 0x00000000},
+        {0x0000b8f4, 0x00000000},
+        {0x0000c2d0, 0x00000080},
+        {0x0000c2d4, 0x00000000},
+        {0x0000c2ec, 0x00000000},
+        {0x0000c2f0, 0x00000000},
+        {0x0000c2f4, 0x00000000},
+        {0x0000c2f8, 0x00000000},
+        {0x0000c408, 0x0e79e5c0},
+        {0x0000c40c, 0x00820820},
+        {0x0000c420, 0x00000000},
+};
+
+static const u32 qca956x_1p0_baseband_postamble[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x00009810, 0xd00a8005, 0xd00a8005, 0xd00a8011, 0xd00a8011},
+        {0x00009820, 0x206a022e, 0x206a022e, 0x206a01ae, 0x206a01ae},
+        {0x00009824, 0x5ac640d0, 0x5ac640d0, 0x5ac621f1, 0x5ac621f1},
+        {0x00009828, 0x06903081, 0x06903081, 0x07d43881, 0x07d43881},
+        {0x0000982c, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4},
+        {0x00009830, 0x0000059c, 0x0000059c, 0x0000119c, 0x0000119c},
+        {0x00009c00, 0x000000c4, 0x000000c4, 0x000000c4, 0x000000c4},
+        {0x00009e00, 0x0372111a, 0x0372111a, 0x037216a0, 0x037216a0},
+        {0x00009e04, 0x001c2020, 0x001c2020, 0x001c2020, 0x001c2020},
+        {0x00009e0c, 0x6c4000e2, 0x6d4000e2, 0x6d4000de, 0x6c4000de},
+        {0x00009e10, 0x7ec88d2e, 0x7ec88d2e, 0x7ec84d2e, 0x7ec86d2e},
+        {0x00009e14, 0x37b95d5e, 0x37b9605e, 0x337d605e, 0x337d5d5e},
+        {0x00009e18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x00009e1c, 0x0001cf9c, 0x0001cf9c, 0x00021f9c, 0x00021f9c},
+        {0x00009e20, 0x000003b5, 0x000003b5, 0x000003a6, 0x000003a6},
+        {0x00009e2c, 0x0000001c, 0x0000001c, 0x00000021, 0x00000021},
+        {0x00009e3c, 0xcfa10820, 0xcfa10820, 0xcf946222, 0xcf946222},
+        {0x00009e44, 0xfe321e27, 0xfe321e27, 0xfe291e27, 0xfe291e27},
+        {0x00009e48, 0x5030201a, 0x5030201a, 0x50302012, 0x50302012},
+        {0x00009fc8, 0x0003f000, 0x0003f000, 0x0001a000, 0x0001a000},
+        {0x0000a204, 0x005c0ec0, 0x005c0ec4, 0x045c0cc4, 0x045c0cc0},
+        {0x0000a208, 0x00000104, 0x00000104, 0x00000004, 0x00000004},
+        {0x0000a22c, 0x07e26a2f, 0x07e26a2f, 0x01026a2f, 0x01026a2f},
+        {0x0000a230, 0x0000400a, 0x00004014, 0x00004016, 0x0000400b},
+        {0x0000a234, 0x00000fff, 0x10000fff, 0x10000fff, 0x00000fff},
+        {0x0000a238, 0xffb01018, 0xffb01018, 0xffb01018, 0xffb01018},
+        {0x0000a250, 0x00000000, 0x00000000, 0x00000210, 0x00000108},
+        {0x0000a254, 0x000007d0, 0x00000fa0, 0x00001130, 0x00000898},
+        {0x0000a258, 0x02020002, 0x02020002, 0x02020002, 0x02020002},
+        {0x0000a25c, 0x01000e0e, 0x01000e0e, 0x01010e0e, 0x01010e0e},
+        {0x0000a260, 0x0a021501, 0x0a021501, 0x3a021501, 0x3a021501},
+        {0x0000a264, 0x00000e0e, 0x00000e0e, 0x01000e0e, 0x01000e0e},
+        {0x0000a280, 0x00000007, 0x00000007, 0x0000000b, 0x0000000b},
+        {0x0000a284, 0x00000000, 0x00000000, 0x00000010, 0x00000010},
+        {0x0000a288, 0x00000110, 0x00000110, 0x00000110, 0x00000110},
+        {0x0000a28c, 0x00022222, 0x00022222, 0x00022222, 0x00022222},
+        {0x0000a2c4, 0x00058d18, 0x00058d18, 0x00058d18, 0x00058d18},
+        {0x0000a2cc, 0x18c50033, 0x18c43433, 0x18c41033, 0x18c44c33},
+        {0x0000a2d0, 0x00041982, 0x00041982, 0x00041982, 0x00041982},
+        {0x0000a2d8, 0x7999a83b, 0x7999a83b, 0x7999a83b, 0x7999a83b},
+        {0x0000a358, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a830, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
+        {0x0000ae04, 0x001c0000, 0x001c0000, 0x001c0000, 0x001c0000},
+        {0x0000ae18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000ae1c, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
+        {0x0000ae20, 0x000001b5, 0x000001b5, 0x000001a6, 0x000001a6},
+        {0x0000b284, 0x00000000, 0x00000000, 0x00000010, 0x00000010},
+        {0x0000b830, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
+        {0x0000be04, 0x001c0000, 0x001c0000, 0x001c0000, 0x001c0000},
+        {0x0000be18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000be1c, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
+        {0x0000be20, 0x000001b5, 0x000001b5, 0x000001a6, 0x000001a6},
+        {0x0000c284, 0x00000000, 0x00000000, 0x00000010, 0x00000010},
+};
+
+static const u32 qca956x_1p0_radio_core[][2] = {
+        /* Addr      allmodes  */
+        {0x00016000, 0x36db6db6},
+        {0x00016004, 0x6db6db40},
+        {0x00016008, 0x73f00000},
+        {0x0001600c, 0x00000000},
+        {0x00016040, 0x3f80fff8},
+        {0x0001604c, 0x000f0278},
+        {0x00016050, 0x8036db6c},
+        {0x00016054, 0x6db60000},
+        {0x00016080, 0x00080000},
+        {0x00016084, 0x0e48048c},
+        {0x00016088, 0x14214514},
+        {0x0001608c, 0x119f080a},
+        {0x00016090, 0x24926490},
+        {0x00016094, 0x00000000},
+        {0x000160a0, 0xc2108ffe},
+        {0x000160a4, 0x812fc370},
+        {0x000160a8, 0x423c8000},
+        {0x000160b4, 0x92480000},
+        {0x000160c0, 0x006db6d8},
+        {0x000160c4, 0x24b6db6c},
+        {0x000160c8, 0x6db6db6c},
+        {0x000160cc, 0x6db6fb7c},
+        {0x000160d0, 0x6db6da44},
+        {0x00016100, 0x07ff8001},
+        {0x00016108, 0x00080010},
+        {0x00016144, 0x01884080},
+        {0x00016148, 0x00008058},
+        {0x00016288, 0x001c6000},
+        {0x0001628c, 0x50000000},
+        {0x000162c0, 0x4b962100},
+        {0x000162c4, 0x00000480},
+        {0x000162c8, 0x04000144},
+        {0x00016380, 0x00000000},
+        {0x00016384, 0x00000000},
+        {0x00016388, 0x00800700},
+        {0x0001638c, 0x00800700},
+        {0x00016390, 0x00800700},
+        {0x00016394, 0x00000000},
+        {0x00016398, 0x00000000},
+        {0x0001639c, 0x00000000},
+        {0x000163a0, 0x00000001},
+        {0x000163a4, 0x00000001},
+        {0x000163a8, 0x00000000},
+        {0x000163ac, 0x00000000},
+        {0x000163b0, 0x00000000},
+        {0x000163b4, 0x00000000},
+        {0x000163b8, 0x00000000},
+        {0x000163bc, 0x00000000},
+        {0x000163c0, 0x000000a0},
+        {0x000163c4, 0x000c0000},
+        {0x000163c8, 0x14021402},
+        {0x000163cc, 0x00001402},
+        {0x000163d0, 0x00000000},
+        {0x000163d4, 0x00000000},
+        {0x00016400, 0x36db6db6},
+        {0x00016404, 0x6db6db40},
+        {0x00016408, 0x73f00000},
+        {0x0001640c, 0x00000000},
+        {0x00016440, 0x3f80fff8},
+        {0x0001644c, 0x000f0278},
+        {0x00016450, 0x8036db6c},
+        {0x00016454, 0x6db60000},
+        {0x00016500, 0x07ff8001},
+        {0x00016508, 0x00080010},
+        {0x00016544, 0x01884080},
+        {0x00016548, 0x00008058},
+        {0x00016780, 0x00000000},
+        {0x00016784, 0x00000000},
+        {0x00016788, 0x00800700},
+        {0x0001678c, 0x00800700},
+        {0x00016790, 0x00800700},
+        {0x00016794, 0x00000000},
+        {0x00016798, 0x00000000},
+        {0x0001679c, 0x00000000},
+        {0x000167a0, 0x00000001},
+        {0x000167a4, 0x00000001},
+        {0x000167a8, 0x00000000},
+        {0x000167ac, 0x00000000},
+        {0x000167b0, 0x00000000},
+        {0x000167b4, 0x00000000},
+        {0x000167b8, 0x00000000},
+        {0x000167bc, 0x00000000},
+        {0x000167c0, 0x000000a0},
+        {0x000167c4, 0x000c0000},
+        {0x000167c8, 0x14021402},
+        {0x000167cc, 0x00001402},
+        {0x000167d0, 0x00000000},
+        {0x000167d4, 0x00000000},
+        {0x00016800, 0x36db6db6},
+        {0x00016804, 0x6db6db40},
+        {0x00016808, 0x73f00000},
+        {0x0001680c, 0x00000000},
+        {0x00016840, 0x3f80fff8},
+        {0x0001684c, 0x000f0278},
+        {0x00016850, 0x8036db6c},
+        {0x00016854, 0x6db60000},
+        {0x00016900, 0x07ff8001},
+        {0x00016908, 0x00080010},
+        {0x00016944, 0x01884080},
+        {0x00016948, 0x00008058},
+        {0x00016b80, 0x00000000},
+        {0x00016b84, 0x00000000},
+        {0x00016b88, 0x00800700},
+        {0x00016b8c, 0x00800700},
+        {0x00016b90, 0x00800700},
+        {0x00016b94, 0x00000000},
+        {0x00016b98, 0x00000000},
+        {0x00016b9c, 0x00000000},
+        {0x00016ba0, 0x00000001},
+        {0x00016ba4, 0x00000001},
+        {0x00016ba8, 0x00000000},
+        {0x00016bac, 0x00000000},
+        {0x00016bb0, 0x00000000},
+        {0x00016bb4, 0x00000000},
+        {0x00016bb8, 0x00000000},
+        {0x00016bbc, 0x00000000},
+        {0x00016bc0, 0x000000a0},
+        {0x00016bc4, 0x000c0000},
+        {0x00016bc8, 0x14021402},
+        {0x00016bcc, 0x00001402},
+        {0x00016bd0, 0x00000000},
+        {0x00016bd4, 0x00000000},
+};
+
+static const u32 qca956x_1p0_radio_postamble[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x00016098, 0xd2dd5554, 0xd2dd5554, 0xc4128f5c, 0xc4128f5c},
+        {0x0001609c, 0x0a566f3a, 0x0a566f3a, 0x0fd08f25, 0x0fd08f25},
+        {0x000160ac, 0xa4647c00, 0xa4647c00, 0x24646800, 0x24646800},
+        {0x000160b0, 0x01885f52, 0x01885f52, 0x00fe7f46, 0x00fe7f46},
+        {0x00016104, 0xb7a00000, 0xb7a00000, 0xfff80001, 0xfff80001},
+        {0x0001610c, 0xc0000000, 0xc0000000, 0x00000000, 0x00000000},
+        {0x00016140, 0x10804008, 0x10804008, 0x50804000, 0x50804000},
+        {0x00016504, 0xb7a00000, 0xb7a00000, 0xfff80001, 0xfff80001},
+        {0x0001650c, 0xc0000000, 0xc0000000, 0x00000000, 0x00000000},
+        {0x00016540, 0x10804008, 0x10804008, 0x50804000, 0x50804000},
+        {0x00016904, 0xb7a00000, 0xb7a00000, 0xfff80001, 0xfff80001},
+        {0x0001690c, 0xc0000000, 0xc0000000, 0x00000000, 0x00000000},
+        {0x00016940, 0x10804008, 0x10804008, 0x50804000, 0x50804000},
+};
+
+static const u32 qca956x_1p0_baseband_core_txfir_coeff_japan_2484[][2] = {
+        /* Addr      allmodes  */
+        {0x0000a38c, 0x00000000},
+        {0x0000a390, 0x6f7f0301},
+        {0x0000a394, 0xca9228ee},
+};
+
+static const u32 qca956x_1p0_modes_no_xpa_tx_gain_table[][3] = {
+        /* Addr      5G          2G        */
+        {0x0000a2dc, 0xffa9ac94, 0xffa9ac94},
+        {0x0000a2e0, 0xff323118, 0xff323118},
+        {0x0000a2e4, 0xff3ffe00, 0xff3ffe00},
+        {0x0000a2e8, 0xffc00000, 0xffc00000},
+        {0x0000a39c, 0x42424242, 0x42424242},
+        {0x0000a3a4, 0x3a3e3e00, 0x3a3e3e00},
+        {0x0000a3b0, 0x00a01404, 0x00a01404},
+        {0x0000a3b4, 0x00000034, 0x00000034},
+        {0x0000a3b8, 0x00800408, 0x00800408},
+        {0x0000a3bc, 0x00000036, 0x00000036},
+        {0x0000a410, 0x000050dc, 0x000050dc},
+        {0x0000a500, 0x09000040, 0x09000040},
+        {0x0000a504, 0x0b000041, 0x0b000041},
+        {0x0000a508, 0x0d000042, 0x0d000042},
+        {0x0000a50c, 0x11000044, 0x11000044},
+        {0x0000a510, 0x15000046, 0x15000046},
+        {0x0000a514, 0x1d000440, 0x1d000440},
+        {0x0000a518, 0x1f000441, 0x1f000441},
+        {0x0000a51c, 0x23000443, 0x23000443},
+        {0x0000a520, 0x25000444, 0x25000444},
+        {0x0000a524, 0x280004e0, 0x280004e0},
+        {0x0000a528, 0x2c0004e2, 0x2c0004e2},
+        {0x0000a52c, 0x2e0004e3, 0x2e0004e3},
+        {0x0000a530, 0x300004e4, 0x300004e4},
+        {0x0000a534, 0x340004e6, 0x340004e6},
+        {0x0000a538, 0x37000ce0, 0x37000ce0},
+        {0x0000a53c, 0x3b000ce2, 0x3b000ce2},
+        {0x0000a540, 0x3d000ce3, 0x3d000ce3},
+        {0x0000a544, 0x3f000ce4, 0x3f000ce4},
+        {0x0000a548, 0x45001ee0, 0x45001ee0},
+        {0x0000a54c, 0x49001ee2, 0x49001ee2},
+        {0x0000a550, 0x4d001ee4, 0x4d001ee4},
+        {0x0000a554, 0x51001ee6, 0x51001ee6},
+        {0x0000a558, 0x55001eea, 0x55001eea},
+        {0x0000a55c, 0x59001eec, 0x59001eec},
+        {0x0000a560, 0x5d001ef0, 0x5d001ef0},
+        {0x0000a564, 0x5f001ef1, 0x5f001ef1},
+        {0x0000a568, 0x60001ef2, 0x60001ef2},
+        {0x0000a56c, 0x61001ef3, 0x61001ef3},
+        {0x0000a570, 0x62001ef4, 0x62001ef4},
+        {0x0000a574, 0x63001ef5, 0x63001ef5},
+        {0x0000a578, 0x64001ffc, 0x64001ffc},
+        {0x0000a57c, 0x64001ffc, 0x64001ffc},
+        {0x0000a600, 0x00000000, 0x00000000},
+        {0x0000a604, 0x00000000, 0x00000000},
+        {0x0000a608, 0x00000000, 0x00000000},
+        {0x0000a60c, 0x00000000, 0x00000000},
+        {0x0000a610, 0x00804000, 0x00804000},
+        {0x0000a614, 0x00804201, 0x00804201},
+        {0x0000a618, 0x00804201, 0x00804201},
+        {0x0000a61c, 0x00804201, 0x00804201},
+        {0x0000a620, 0x00804201, 0x00804201},
+        {0x0000a624, 0x00804201, 0x00804201},
+        {0x0000a628, 0x00804201, 0x00804201},
+        {0x0000a62c, 0x02808a02, 0x02808a02},
+        {0x0000a630, 0x0340cd03, 0x0340cd03},
+        {0x0000a634, 0x0340cd03, 0x0340cd03},
+        {0x0000a638, 0x0340cd03, 0x0340cd03},
+        {0x0000a63c, 0x05011404, 0x05011404},
+        {0x0000b2dc, 0xffa9ac94, 0xffa9ac94},
+        {0x0000b2e0, 0xff323118, 0xff323118},
+        {0x0000b2e4, 0xff3ffe00, 0xff3ffe00},
+        {0x0000b2e8, 0xffc00000, 0xffc00000},
+        {0x0000c2dc, 0xffa9ac94, 0xffa9ac94},
+        {0x0000c2e0, 0xff323118, 0xff323118},
+        {0x0000c2e4, 0xff3ffe00, 0xff3ffe00},
+        {0x0000c2e8, 0xffc00000, 0xffc00000},
+        {0x00016044, 0x049242db, 0x049242db},
+        {0x00016048, 0x64925a70, 0x64925a70},
+        {0x00016148, 0x00008050, 0x00008050},
+        {0x00016280, 0x41110005, 0x41110005},
+        {0x00016284, 0x453a6000, 0x453a6000},
+        {0x00016444, 0x049242db, 0x049242db},
+        {0x00016448, 0x6c925a70, 0x6c925a70},
+        {0x00016548, 0x00008050, 0x00008050},
+        {0x00016844, 0x049242db, 0x049242db},
+        {0x00016848, 0x6c925a70, 0x6c925a70},
+        {0x00016948, 0x00008050, 0x00008050},
+};
+
+static const u32 qca956x_1p0_modes_xpa_tx_gain_table[][3] = {
+        /* Addr      5G          2G        */
+        {0x0000a2dc, 0xcc69ac94, 0xcc69ac94},
+        {0x0000a2e0, 0xf0b23118, 0xf0b23118},
+        {0x0000a2e4, 0xffffc000, 0xffffc000},
+        {0x0000a2e8, 0xc0000000, 0xc0000000},
+        {0x0000a410, 0x000050d2, 0x000050d2},
+        {0x0000a500, 0x0a000040, 0x0a000040},
+        {0x0000a504, 0x0c000041, 0x0c000041},
+        {0x0000a508, 0x0e000042, 0x0e000042},
+        {0x0000a50c, 0x12000044, 0x12000044},
+        {0x0000a510, 0x16000046, 0x16000046},
+        {0x0000a514, 0x1d000440, 0x1d000440},
+        {0x0000a518, 0x1f000441, 0x1f000441},
+        {0x0000a51c, 0x23000443, 0x23000443},
+        {0x0000a520, 0x25000444, 0x25000444},
+        {0x0000a524, 0x29000a40, 0x29000a40},
+        {0x0000a528, 0x2d000a42, 0x2d000a42},
+        {0x0000a52c, 0x2f000a43, 0x2f000a43},
+        {0x0000a530, 0x31000a44, 0x31000a44},
+        {0x0000a534, 0x35000a46, 0x35000a46},
+        {0x0000a538, 0x38000ce0, 0x38000ce0},
+        {0x0000a53c, 0x3c000ce2, 0x3c000ce2},
+        {0x0000a540, 0x3e000ce3, 0x3e000ce3},
+        {0x0000a544, 0x40000ce4, 0x40000ce4},
+        {0x0000a548, 0x46001ee0, 0x46001ee0},
+        {0x0000a54c, 0x4a001ee2, 0x4a001ee2},
+        {0x0000a550, 0x4e001ee4, 0x4e001ee4},
+        {0x0000a554, 0x52001ee6, 0x52001ee6},
+        {0x0000a558, 0x56001eea, 0x56001eea},
+        {0x0000a55c, 0x5a001eec, 0x5a001eec},
+        {0x0000a560, 0x5e001ef0, 0x5e001ef0},
+        {0x0000a564, 0x60001ef1, 0x60001ef1},
+        {0x0000a568, 0x61001ef2, 0x61001ef2},
+        {0x0000a56c, 0x62001ef3, 0x62001ef3},
+        {0x0000a570, 0x63001ef4, 0x63001ef4},
+        {0x0000a574, 0x64001ef5, 0x64001ef5},
+        {0x0000a578, 0x65001ffc, 0x65001ffc},
+        {0x0000a57c, 0x65001ffc, 0x65001ffc},
+        {0x0000a600, 0x00000000, 0x00000000},
+        {0x0000a604, 0x00000000, 0x00000000},
+        {0x0000a608, 0x00000000, 0x00000000},
+        {0x0000a60c, 0x00000000, 0x00000000},
+        {0x0000a610, 0x00000000, 0x00000000},
+        {0x0000a614, 0x00000000, 0x00000000},
+        {0x0000a618, 0x00000000, 0x00000000},
+        {0x0000a61c, 0x00804201, 0x00804201},
+        {0x0000a620, 0x00804201, 0x00804201},
+        {0x0000a624, 0x00804201, 0x00804201},
+        {0x0000a628, 0x00804201, 0x00804201},
+        {0x0000a62c, 0x02808a02, 0x02808a02},
+        {0x0000a630, 0x0340cd03, 0x0340cd03},
+        {0x0000a634, 0x0340cd03, 0x0340cd03},
+        {0x0000a638, 0x0340cd03, 0x0340cd03},
+        {0x0000a63c, 0x05011404, 0x05011404},
+        {0x0000b2dc, 0xcc69ac94, 0xcc69ac94},
+        {0x0000b2e0, 0xf0b23118, 0xf0b23118},
+        {0x0000b2e4, 0xffffc000, 0xffffc000},
+        {0x0000b2e8, 0xc0000000, 0xc0000000},
+        {0x0000c2dc, 0xcc69ac94, 0xcc69ac94},
+        {0x0000c2e0, 0xf0b23118, 0xf0b23118},
+        {0x0000c2e4, 0xffffc000, 0xffffc000},
+        {0x0000c2e8, 0xc0000000, 0xc0000000},
+        {0x00016044, 0x012492db, 0x012492db},
+        {0x00016048, 0x6c927a70, 0x6c927a70},
+        {0x00016050, 0x8036d36c, 0x8036d36c},
+        {0x00016280, 0x41110005, 0x41110005},
+        {0x00016284, 0x453a7e00, 0x453a7e00},
+        {0x00016444, 0x012492db, 0x012492db},
+        {0x00016448, 0x6c927a70, 0x6c927a70},
+        {0x00016450, 0x8036d36c, 0x8036d36c},
+        {0x00016844, 0x012492db, 0x012492db},
+        {0x00016848, 0x6c927a70, 0x6c927a70},
+        {0x00016850, 0x8036d36c, 0x8036d36c},
+};
+
+static const u32 qca956x_1p0_modes_no_xpa_low_ob_db_tx_gain_table[][3] = {
+        /* Addr      5G          2G        */
+        {0x0000a2dc, 0xffa9ac94, 0xffa9ac94},
+        {0x0000a2e0, 0xff323118, 0xff323118},
+        {0x0000a2e4, 0xff3ffe00, 0xff3ffe00},
+        {0x0000a2e8, 0xffc00000, 0xffc00000},
+        {0x0000a39c, 0x42424242, 0x42424242},
+        {0x0000a3a4, 0x3a3e3e00, 0x3a3e3e00},
+        {0x0000a3b0, 0x00a01404, 0x00a01404},
+        {0x0000a3b4, 0x00000034, 0x00000034},
+        {0x0000a3b8, 0x00800408, 0x00800408},
+        {0x0000a3bc, 0x00000036, 0x00000036},
+        {0x0000a410, 0x000050dc, 0x000050dc},
+        {0x0000a414, 0x16b739ce, 0x16b739ce},
+        {0x0000a418, 0x2d00198b, 0x2d00198b},
+        {0x0000a41c, 0x16b5adce, 0x16b5adce},
+        {0x0000a420, 0x0000014a, 0x0000014a},
+        {0x0000a424, 0x14a525cc, 0x14a525cc},
+        {0x0000a428, 0x0000012a, 0x0000012a},
+        {0x0000a42c, 0x14a5294a, 0x14a5294a},
+        {0x0000a430, 0x1294a929, 0x1294a929},
+        {0x0000a500, 0x09000040, 0x09000040},
+        {0x0000a504, 0x0b000041, 0x0b000041},
+        {0x0000a508, 0x0d000042, 0x0d000042},
+        {0x0000a50c, 0x11000044, 0x11000044},
+        {0x0000a510, 0x15000046, 0x15000046},
+        {0x0000a514, 0x1d000440, 0x1d000440},
+        {0x0000a518, 0x1f000441, 0x1f000441},
+        {0x0000a51c, 0x23000443, 0x23000443},
+        {0x0000a520, 0x25000444, 0x25000444},
+        {0x0000a524, 0x280004e0, 0x280004e0},
+        {0x0000a528, 0x2c0004e2, 0x2c0004e2},
+        {0x0000a52c, 0x2e0004e3, 0x2e0004e3},
+        {0x0000a530, 0x300004e4, 0x300004e4},
+        {0x0000a534, 0x340004e6, 0x340004e6},
+        {0x0000a538, 0x37000ce0, 0x37000ce0},
+        {0x0000a53c, 0x3b000ce2, 0x3b000ce2},
+        {0x0000a540, 0x3d000ce3, 0x3d000ce3},
+        {0x0000a544, 0x3f000ce4, 0x3f000ce4},
+        {0x0000a548, 0x45001ee0, 0x45001ee0},
+        {0x0000a54c, 0x49001ee2, 0x49001ee2},
+        {0x0000a550, 0x4d001ee4, 0x4d001ee4},
+        {0x0000a554, 0x51001ee6, 0x51001ee6},
+        {0x0000a558, 0x55001eea, 0x55001eea},
+        {0x0000a55c, 0x59001eec, 0x59001eec},
+        {0x0000a560, 0x5d001ef0, 0x5d001ef0},
+        {0x0000a564, 0x5f001ef1, 0x5f001ef1},
+        {0x0000a568, 0x60001ef2, 0x60001ef2},
+        {0x0000a56c, 0x61001ef3, 0x61001ef3},
+        {0x0000a570, 0x62001ef4, 0x62001ef4},
+        {0x0000a574, 0x63001ef5, 0x63001ef5},
+        {0x0000a578, 0x64001ffc, 0x64001ffc},
+        {0x0000a57c, 0x64001ffc, 0x64001ffc},
+        {0x0000a600, 0x00000000, 0x00000000},
+        {0x0000a604, 0x00000000, 0x00000000},
+        {0x0000a608, 0x00000000, 0x00000000},
+        {0x0000a60c, 0x00000000, 0x00000000},
+        {0x0000a610, 0x00804000, 0x00804000},
+        {0x0000a614, 0x00804201, 0x00804201},
+        {0x0000a618, 0x00804201, 0x00804201},
+        {0x0000a61c, 0x00804201, 0x00804201},
+        {0x0000a620, 0x00804201, 0x00804201},
+        {0x0000a624, 0x00804201, 0x00804201},
+        {0x0000a628, 0x00804201, 0x00804201},
+        {0x0000a62c, 0x02808a02, 0x02808a02},
+        {0x0000a630, 0x0340cd03, 0x0340cd03},
+        {0x0000a634, 0x0340cd03, 0x0340cd03},
+        {0x0000a638, 0x0340cd03, 0x0340cd03},
+        {0x0000a63c, 0x05011404, 0x05011404},
+        {0x0000b2dc, 0xffa9ac94, 0xffa9ac94},
+        {0x0000b2e0, 0xff323118, 0xff323118},
+        {0x0000b2e4, 0xff3ffe00, 0xff3ffe00},
+        {0x0000b2e8, 0xffc00000, 0xffc00000},
+        {0x0000c2dc, 0xffa9ac94, 0xffa9ac94},
+        {0x0000c2e0, 0xff323118, 0xff323118},
+        {0x0000c2e4, 0xff3ffe00, 0xff3ffe00},
+        {0x0000c2e8, 0xffc00000, 0xffc00000},
+        {0x00016044, 0x046e42db, 0x046e42db},
+        {0x00016048, 0x64925a70, 0x64925a70},
+        {0x00016148, 0x00008050, 0x00008050},
+        {0x00016280, 0x41110005, 0x41110005},
+        {0x00016284, 0x453a6000, 0x453a6000},
+        {0x00016444, 0x046e42db, 0x046e42db},
+        {0x00016448, 0x6c925a70, 0x6c925a70},
+        {0x00016548, 0x00008050, 0x00008050},
+        {0x00016844, 0x046e42db, 0x046e42db},
+        {0x00016848, 0x6c925a70, 0x6c925a70},
+        {0x00016948, 0x00008050, 0x00008050},
+};
+
+static const u32 qca956x_1p0_modes_no_xpa_green_tx_gain_table[][3] = {
+        /* Addr      5G          2G        */
+        {0x000098bc, 0x00000001, 0x00000001},
+        {0x0000a2dc, 0xd3555284, 0xd3555284},
+        {0x0000a2e0, 0x1c666318, 0x1c666318},
+        {0x0000a2e4, 0xe07bbc00, 0xe07bbc00},
+        {0x0000a2e8, 0xff800000, 0xff800000},
+        {0x0000a3a4, 0x3a3e3e00, 0x3a3e3e00},
+        {0x0000a410, 0x000050dc, 0x000050dc},
+        {0x0000a500, 0x02000040, 0x02000040},
+        {0x0000a504, 0x04000041, 0x04000041},
+        {0x0000a508, 0x06000042, 0x06000042},
+        {0x0000a50c, 0x0a000044, 0x0a000044},
+        {0x0000a510, 0x0c000045, 0x0c000045},
+        {0x0000a514, 0x13000440, 0x13000440},
+        {0x0000a518, 0x15000441, 0x15000441},
+        {0x0000a51c, 0x19000443, 0x19000443},
+        {0x0000a520, 0x1b000444, 0x1b000444},
+        {0x0000a524, 0x1e0004e0, 0x1e0004e0},
+        {0x0000a528, 0x220004e2, 0x220004e2},
+        {0x0000a52c, 0x240004e3, 0x240004e3},
+        {0x0000a530, 0x260004e4, 0x260004e4},
+        {0x0000a534, 0x2a0004e6, 0x2a0004e6},
+        {0x0000a538, 0x32000ce0, 0x32000ce0},
+        {0x0000a53c, 0x36000ce2, 0x36000ce2},
+        {0x0000a540, 0x3a000ce4, 0x3a000ce4},
+        {0x0000a544, 0x3e000ce6, 0x3e000ce6},
+        {0x0000a548, 0x45001ee0, 0x45001ee0},
+        {0x0000a54c, 0x49001ee2, 0x49001ee2},
+        {0x0000a550, 0x4d001ee4, 0x4d001ee4},
+        {0x0000a554, 0x51001ee6, 0x51001ee6},
+        {0x0000a558, 0x55001eea, 0x55001eea},
+        {0x0000a55c, 0x59001eec, 0x59001eec},
+        {0x0000a560, 0x5d001ef0, 0x5d001ef0},
+        {0x0000a564, 0x5f001ef1, 0x5f001ef1},
+        {0x0000a568, 0x60001ef2, 0x60001ef2},
+        {0x0000a56c, 0x61001ef3, 0x61001ef3},
+        {0x0000a570, 0x62001ef4, 0x62001ef4},
+        {0x0000a574, 0x63001ff5, 0x63001ff5},
+        {0x0000a578, 0x64001ffc, 0x64001ffc},
+        {0x0000a57c, 0x64001ffc, 0x64001ffc},
+        {0x0000a600, 0x00000000, 0x00000000},
+        {0x0000a604, 0x00000000, 0x00000000},
+        {0x0000a608, 0x00000000, 0x00000000},
+        {0x0000a60c, 0x00000000, 0x00000000},
+        {0x0000a610, 0x00804000, 0x00804000},
+        {0x0000a614, 0x00804201, 0x00804201},
+        {0x0000a618, 0x00804201, 0x00804201},
+        {0x0000a61c, 0x00804201, 0x00804201},
+        {0x0000a620, 0x00804201, 0x00804201},
+        {0x0000a624, 0x00804201, 0x00804201},
+        {0x0000a628, 0x00804201, 0x00804201},
+        {0x0000a62c, 0x02808a02, 0x02808a02},
+        {0x0000a630, 0x0340cd03, 0x0340cd03},
+        {0x0000a634, 0x0340cd03, 0x0340cd03},
+        {0x0000a638, 0x0340cd03, 0x0340cd03},
+        {0x0000a63c, 0x05011404, 0x05011404},
+        {0x0000b2dc, 0xd3555284, 0xd3555284},
+        {0x0000b2e0, 0x1c666318, 0x1c666318},
+        {0x0000b2e4, 0xe07bbc00, 0xe07bbc00},
+        {0x0000b2e8, 0xff800000, 0xff800000},
+        {0x0000c2dc, 0xd3555284, 0xd3555284},
+        {0x0000c2e0, 0x1c666318, 0x1c666318},
+        {0x0000c2e4, 0xe07bbc00, 0xe07bbc00},
+        {0x0000c2e8, 0xff800000, 0xff800000},
+        {0x00016044, 0x849242db, 0x849242db},
+        {0x00016048, 0x64925a70, 0x64925a70},
+        {0x00016280, 0x41110005, 0x41110005},
+        {0x00016284, 0x453a6000, 0x453a6000},
+        {0x00016444, 0x849242db, 0x849242db},
+        {0x00016448, 0x6c925a70, 0x6c925a70},
+        {0x00016844, 0x849242db, 0x849242db},
+        {0x00016848, 0x6c925a70, 0x6c925a70},
+        {0x0000a7f0, 0x800002cc, 0x800002cc},
+        {0x0000a7f4, 0x00000018, 0x00000018},
+        {0x0000a7f4, 0x00000018, 0x00000018},
+        {0x0000a7f4, 0x00000018, 0x00000018},
+        {0x0000a7f4, 0x00000018, 0x00000018},
+        {0x0000a7f4, 0x00000018, 0x00000018},
+        {0x0000a7f4, 0x00000018, 0x00000018},
+        {0x0000a7f4, 0x00000018, 0x00000018},
+        {0x0000a7f4, 0x00000018, 0x00000018},
+        {0x0000a7f4, 0x00000018, 0x00000018},
+        {0x0000a7f4, 0x00000018, 0x00000018},
+        {0x0000a7f4, 0x00000018, 0x00000018},
+        {0x0000a7f4, 0x00000018, 0x00000018},
+        {0x0000a7f4, 0x00000018, 0x00000018},
+        {0x0000a7f4, 0x00000018, 0x00000018},
+        {0x0000a7f4, 0x00000028, 0x00000028},
+        {0x0000a7f4, 0x00000028, 0x00000028},
+        {0x0000a7f4, 0x00000028, 0x00000028},
+        {0x0000a7f4, 0x00000028, 0x00000028},
+        {0x0000a7f4, 0x00000048, 0x00000048},
+        {0x0000a7f4, 0x00000048, 0x00000048},
+        {0x0000a7f4, 0x00000048, 0x00000048},
+        {0x0000a7f4, 0x00000048, 0x00000048},
+        {0x0000a7f4, 0x00000048, 0x00000048},
+        {0x0000a7f4, 0x00000048, 0x00000048},
+        {0x0000a7f4, 0x00000048, 0x00000048},
+        {0x0000a7f4, 0x00000048, 0x00000048},
+        {0x0000a7f4, 0x00000048, 0x00000048},
+        {0x0000a7f4, 0x00000048, 0x00000048},
+        {0x0000a7f4, 0x00000048, 0x00000048},
+        {0x0000a7f4, 0x00000048, 0x00000048},
+        {0x0000a7f4, 0x00000048, 0x00000048},
+        {0x0000a7f4, 0x00000048, 0x00000048},
+};
+
+static const u32 qca956x_1p0_common_rx_gain_table[][2] = {
+        /* Addr      allmodes  */
+        {0x0000a000, 0x00010000},
+        {0x0000a004, 0x00030002},
+        {0x0000a008, 0x00050004},
+        {0x0000a00c, 0x00810080},
+        {0x0000a010, 0x00830082},
+        {0x0000a014, 0x01810180},
+        {0x0000a018, 0x01830182},
+        {0x0000a01c, 0x01850184},
+        {0x0000a020, 0x01890188},
+        {0x0000a024, 0x018b018a},
+        {0x0000a028, 0x018d018c},
+        {0x0000a02c, 0x01910190},
+        {0x0000a030, 0x01930192},
+        {0x0000a034, 0x01950194},
+        {0x0000a038, 0x038a0196},
+        {0x0000a03c, 0x038c038b},
+        {0x0000a040, 0x0390038d},
+        {0x0000a044, 0x03920391},
+        {0x0000a048, 0x03940393},
+        {0x0000a04c, 0x03960395},
+        {0x0000a050, 0x00000000},
+        {0x0000a054, 0x00000000},
+        {0x0000a058, 0x00000000},
+        {0x0000a05c, 0x00000000},
+        {0x0000a060, 0x00000000},
+        {0x0000a064, 0x00000000},
+        {0x0000a068, 0x00000000},
+        {0x0000a06c, 0x00000000},
+        {0x0000a070, 0x00000000},
+        {0x0000a074, 0x00000000},
+        {0x0000a078, 0x00000000},
+        {0x0000a07c, 0x00000000},
+        {0x0000a080, 0x22222222},
+        {0x0000a084, 0x1d1d1d1d},
+        {0x0000a088, 0x1d1d1d1d},
+        {0x0000a08c, 0x1d1d1d1d},
+        {0x0000a090, 0x17171717},
+        {0x0000a094, 0x11111717},
+        {0x0000a098, 0x00030311},
+        {0x0000a09c, 0x00000000},
+        {0x0000a0a0, 0x00000000},
+        {0x0000a0a4, 0x00000000},
+        {0x0000a0a8, 0x00000000},
+        {0x0000a0ac, 0x00000000},
+        {0x0000a0b0, 0x00000000},
+        {0x0000a0b4, 0x00000000},
+        {0x0000a0b8, 0x00000000},
+        {0x0000a0bc, 0x00000000},
+        {0x0000a0c0, 0x001f0000},
+        {0x0000a0c4, 0x01000101},
+        {0x0000a0c8, 0x011e011f},
+        {0x0000a0cc, 0x011c011d},
+        {0x0000a0d0, 0x02030204},
+        {0x0000a0d4, 0x02010202},
+        {0x0000a0d8, 0x021f0200},
+        {0x0000a0dc, 0x0302021e},
+        {0x0000a0e0, 0x03000301},
+        {0x0000a0e4, 0x031e031f},
+        {0x0000a0e8, 0x0402031d},
+        {0x0000a0ec, 0x04000401},
+        {0x0000a0f0, 0x041e041f},
+        {0x0000a0f4, 0x0502041d},
+        {0x0000a0f8, 0x05000501},
+        {0x0000a0fc, 0x051e051f},
+        {0x0000a100, 0x06010602},
+        {0x0000a104, 0x061f0600},
+        {0x0000a108, 0x061d061e},
+        {0x0000a10c, 0x07020703},
+        {0x0000a110, 0x07000701},
+        {0x0000a114, 0x00000000},
+        {0x0000a118, 0x00000000},
+        {0x0000a11c, 0x00000000},
+        {0x0000a120, 0x00000000},
+        {0x0000a124, 0x00000000},
+        {0x0000a128, 0x00000000},
+        {0x0000a12c, 0x00000000},
+        {0x0000a130, 0x00000000},
+        {0x0000a134, 0x00000000},
+        {0x0000a138, 0x00000000},
+        {0x0000a13c, 0x00000000},
+        {0x0000a140, 0x001f0000},
+        {0x0000a144, 0x01000101},
+        {0x0000a148, 0x011e011f},
+        {0x0000a14c, 0x011c011d},
+        {0x0000a150, 0x02030204},
+        {0x0000a154, 0x02010202},
+        {0x0000a158, 0x021f0200},
+        {0x0000a15c, 0x0302021e},
+        {0x0000a160, 0x03000301},
+        {0x0000a164, 0x031e031f},
+        {0x0000a168, 0x0402031d},
+        {0x0000a16c, 0x04000401},
+        {0x0000a170, 0x041e041f},
+        {0x0000a174, 0x0502041d},
+        {0x0000a178, 0x05000501},
+        {0x0000a17c, 0x051e051f},
+        {0x0000a180, 0x06010602},
+        {0x0000a184, 0x061f0600},
+        {0x0000a188, 0x061d061e},
+        {0x0000a18c, 0x07020703},
+        {0x0000a190, 0x07000701},
+        {0x0000a194, 0x00000000},
+        {0x0000a198, 0x00000000},
+        {0x0000a19c, 0x00000000},
+        {0x0000a1a0, 0x00000000},
+        {0x0000a1a4, 0x00000000},
+        {0x0000a1a8, 0x00000000},
+        {0x0000a1ac, 0x00000000},
+        {0x0000a1b0, 0x00000000},
+        {0x0000a1b4, 0x00000000},
+        {0x0000a1b8, 0x00000000},
+        {0x0000a1bc, 0x00000000},
+        {0x0000a1c0, 0x00000000},
+        {0x0000a1c4, 0x00000000},
+        {0x0000a1c8, 0x00000000},
+        {0x0000a1cc, 0x00000000},
+        {0x0000a1d0, 0x00000000},
+        {0x0000a1d4, 0x00000000},
+        {0x0000a1d8, 0x00000000},
+        {0x0000a1dc, 0x00000000},
+        {0x0000a1e0, 0x00000000},
+        {0x0000a1e4, 0x00000000},
+        {0x0000a1e8, 0x00000000},
+        {0x0000a1ec, 0x00000000},
+        {0x0000a1f0, 0x00000396},
+        {0x0000a1f4, 0x00000396},
+        {0x0000a1f8, 0x00000396},
+        {0x0000a1fc, 0x00000196},
+        {0x0000b000, 0x00010000},
+        {0x0000b004, 0x00030002},
+        {0x0000b008, 0x00050004},
+        {0x0000b00c, 0x00810080},
+        {0x0000b010, 0x00830082},
+        {0x0000b014, 0x01810180},
+        {0x0000b018, 0x01830182},
+        {0x0000b01c, 0x01850184},
+        {0x0000b020, 0x02810280},
+        {0x0000b024, 0x02830282},
+        {0x0000b028, 0x02850284},
+        {0x0000b02c, 0x02890288},
+        {0x0000b030, 0x028b028a},
+        {0x0000b034, 0x0388028c},
+        {0x0000b038, 0x038a0389},
+        {0x0000b03c, 0x038c038b},
+        {0x0000b040, 0x0390038d},
+        {0x0000b044, 0x03920391},
+        {0x0000b048, 0x03940393},
+        {0x0000b04c, 0x03960395},
+        {0x0000b050, 0x00000000},
+        {0x0000b054, 0x00000000},
+        {0x0000b058, 0x00000000},
+        {0x0000b05c, 0x00000000},
+        {0x0000b060, 0x00000000},
+        {0x0000b064, 0x00000000},
+        {0x0000b068, 0x00000000},
+        {0x0000b06c, 0x00000000},
+        {0x0000b070, 0x00000000},
+        {0x0000b074, 0x00000000},
+        {0x0000b078, 0x00000000},
+        {0x0000b07c, 0x00000000},
+        {0x0000b080, 0x23232323},
+        {0x0000b084, 0x21232323},
+        {0x0000b088, 0x19191c1e},
+        {0x0000b08c, 0x12141417},
+        {0x0000b090, 0x07070e0e},
+        {0x0000b094, 0x03030305},
+        {0x0000b098, 0x00000003},
+        {0x0000b09c, 0x00000000},
+        {0x0000b0a0, 0x00000000},
+        {0x0000b0a4, 0x00000000},
+        {0x0000b0a8, 0x00000000},
+        {0x0000b0ac, 0x00000000},
+        {0x0000b0b0, 0x00000000},
+        {0x0000b0b4, 0x00000000},
+        {0x0000b0b8, 0x00000000},
+        {0x0000b0bc, 0x00000000},
+        {0x0000b0c0, 0x003f0020},
+        {0x0000b0c4, 0x00400041},
+        {0x0000b0c8, 0x0140005f},
+        {0x0000b0cc, 0x0160015f},
+        {0x0000b0d0, 0x017e017f},
+        {0x0000b0d4, 0x02410242},
+        {0x0000b0d8, 0x025f0240},
+        {0x0000b0dc, 0x027f0260},
+        {0x0000b0e0, 0x0341027e},
+        {0x0000b0e4, 0x035f0340},
+        {0x0000b0e8, 0x037f0360},
+        {0x0000b0ec, 0x04400441},
+        {0x0000b0f0, 0x0460045f},
+        {0x0000b0f4, 0x0541047f},
+        {0x0000b0f8, 0x055f0540},
+        {0x0000b0fc, 0x057f0560},
+        {0x0000b100, 0x06400641},
+        {0x0000b104, 0x0660065f},
+        {0x0000b108, 0x067e067f},
+        {0x0000b10c, 0x07410742},
+        {0x0000b110, 0x075f0740},
+        {0x0000b114, 0x077f0760},
+        {0x0000b118, 0x07800781},
+        {0x0000b11c, 0x07a0079f},
+        {0x0000b120, 0x07c107bf},
+        {0x0000b124, 0x000007c0},
+        {0x0000b128, 0x00000000},
+        {0x0000b12c, 0x00000000},
+        {0x0000b130, 0x00000000},
+        {0x0000b134, 0x00000000},
+        {0x0000b138, 0x00000000},
+        {0x0000b13c, 0x00000000},
+        {0x0000b140, 0x003f0020},
+        {0x0000b144, 0x00400041},
+        {0x0000b148, 0x0140005f},
+        {0x0000b14c, 0x0160015f},
+        {0x0000b150, 0x017e017f},
+        {0x0000b154, 0x02410242},
+        {0x0000b158, 0x025f0240},
+        {0x0000b15c, 0x027f0260},
+        {0x0000b160, 0x0341027e},
+        {0x0000b164, 0x035f0340},
+        {0x0000b168, 0x037f0360},
+        {0x0000b16c, 0x04400441},
+        {0x0000b170, 0x0460045f},
+        {0x0000b174, 0x0541047f},
+        {0x0000b178, 0x055f0540},
+        {0x0000b17c, 0x057f0560},
+        {0x0000b180, 0x06400641},
+        {0x0000b184, 0x0660065f},
+        {0x0000b188, 0x067e067f},
+        {0x0000b18c, 0x07410742},
+        {0x0000b190, 0x075f0740},
+        {0x0000b194, 0x077f0760},
+        {0x0000b198, 0x07800781},
+        {0x0000b19c, 0x07a0079f},
+        {0x0000b1a0, 0x07c107bf},
+        {0x0000b1a4, 0x000007c0},
+        {0x0000b1a8, 0x00000000},
+        {0x0000b1ac, 0x00000000},
+        {0x0000b1b0, 0x00000000},
+        {0x0000b1b4, 0x00000000},
+        {0x0000b1b8, 0x00000000},
+        {0x0000b1bc, 0x00000000},
+        {0x0000b1c0, 0x00000000},
+        {0x0000b1c4, 0x00000000},
+        {0x0000b1c8, 0x00000000},
+        {0x0000b1cc, 0x00000000},
+        {0x0000b1d0, 0x00000000},
+        {0x0000b1d4, 0x00000000},
+        {0x0000b1d8, 0x00000000},
+        {0x0000b1dc, 0x00000000},
+        {0x0000b1e0, 0x00000000},
+        {0x0000b1e4, 0x00000000},
+        {0x0000b1e8, 0x00000000},
+        {0x0000b1ec, 0x00000000},
+        {0x0000b1f0, 0x00000396},
+        {0x0000b1f4, 0x00000396},
+        {0x0000b1f8, 0x00000396},
+        {0x0000b1fc, 0x00000196},
+};
+
+static const u32 qca956x_1p0_xlna_only[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x00009820, 0x206a022e, 0x206a022e, 0x206a01ae, 0x206a01ae},
+        {0x00009824, 0x5ac640d0, 0x5ac640d0, 0x5ac621f1, 0x5ac621f1},
+        {0x00009828, 0x06903081, 0x06903081, 0x07d43881, 0x07d43881},
+        {0x00009e00, 0x0372111a, 0x0372111a, 0x037216a0, 0x03721720},
+        {0x00009e0c, 0x6c4000e2, 0x6d4000e2, 0x6d4000de, 0x6c4000da},
+        {0x00009e10, 0x7ec88d2e, 0x7ec88d2e, 0x7ec86d2e, 0x7ec8ad2e},
+        {0x00009e14, 0x37b95d5e, 0x37b9605e, 0x317a6062, 0x317a5ae2},
+        {0x00009e18, 0x00000000, 0x00000000, 0x03c00000, 0x03c00000},
+        {0x00009e20, 0x000003b5, 0x000003b5, 0x000003b2, 0x000003b2},
+        {0x00009fc0, 0x813e4788, 0x813e4788, 0x813e4789, 0x813e4789},
+        {0x0000ae18, 0x00000000, 0x00000000, 0x03c00000, 0x03c00000},
+        {0x0000ae20, 0x000001b5, 0x000001b5, 0x000001b2, 0x000001b2},
+        {0x0000be18, 0x00000000, 0x00000000, 0x03c00000, 0x03c00000},
+        {0x0000be20, 0x000001b5, 0x000001b5, 0x000001b2, 0x000001b2},
+};
+
+#endif /* INITVALS_956X_H */
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 1a9fe0983a6b..0f8e9464e4ab 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -34,7 +34,7 @@ struct ath_vif;
 
 extern struct ieee80211_ops ath9k_ops;
 extern int ath9k_modparam_nohwcrypt;
-extern int led_blink;
+extern int ath9k_led_blink;
 extern bool is_ath9k_unloaded;
 extern int ath9k_use_chanctx;
 
@@ -830,14 +830,9 @@ static inline void ath_fill_led_pin(struct ath_softc *sc)
 /* Wake on Wireless LAN */
 /************************/
 
-struct ath9k_wow_pattern {
-        u8 pattern_bytes[MAX_PATTERN_SIZE];
-        u8 mask_bytes[MAX_PATTERN_SIZE];
-        u32 pattern_len;
-};
-
 #ifdef CONFIG_ATH9K_WOW
 void ath9k_init_wow(struct ieee80211_hw *hw);
+void ath9k_deinit_wow(struct ieee80211_hw *hw);
 int ath9k_suspend(struct ieee80211_hw *hw,
                   struct cfg80211_wowlan *wowlan);
 int ath9k_resume(struct ieee80211_hw *hw);
@@ -846,6 +841,9 @@ void ath9k_set_wakeup(struct ieee80211_hw *hw, bool enabled);
 static inline void ath9k_init_wow(struct ieee80211_hw *hw)
 {
 }
+static inline void ath9k_deinit_wow(struct ieee80211_hw *hw)
+{
+}
 static inline int ath9k_suspend(struct ieee80211_hw *hw,
                                 struct cfg80211_wowlan *wowlan)
 {
@@ -1039,9 +1037,8 @@ struct ath_softc {
         s16 tx99_power;
 
 #ifdef CONFIG_ATH9K_WOW
-        atomic_t wow_got_bmiss_intr;
-        atomic_t wow_sleep_proc_intr; /* in the middle of WoW sleep ? */
         u32 wow_intr_before_sleep;
+        bool force_wow;
 #endif
 };
 
diff --git a/drivers/net/wireless/ath/ath9k/common-spectral.c b/drivers/net/wireless/ath/ath9k/common-spectral.c
index ec93ddf0863a..5cee231cca1f 100644
--- a/drivers/net/wireless/ath/ath9k/common-spectral.c
+++ b/drivers/net/wireless/ath/ath9k/common-spectral.c
@@ -582,7 +582,7 @@ static struct rchan_callbacks rfs_spec_scan_cb = {
 
 void ath9k_cmn_spectral_deinit_debug(struct ath_spec_scan_priv *spec_priv)
 {
-        if (config_enabled(CONFIG_ATH9K_DEBUGFS) && spec_priv->rfs_chan_spec_scan) {
+        if (config_enabled(CONFIG_ATH9K_DEBUGFS)) {
                 relay_close(spec_priv->rfs_chan_spec_scan);
                 spec_priv->rfs_chan_spec_scan = NULL;
         }
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index 871e969409bf..50a2e0ac3b8b 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -403,7 +403,8 @@ static const struct file_operations fops_antenna_diversity = {
 
 static int read_file_dma(struct seq_file *file, void *data)
 {
-        struct ath_softc *sc = file->private;
+        struct ieee80211_hw *hw = dev_get_drvdata(file->private);
+        struct ath_softc *sc = hw->priv;
         struct ath_hw *ah = sc->sc_ah;
         u32 val[ATH9K_NUM_DMA_DEBUG_REGS];
         int i, qcuOffset = 0, dcuOffset = 0;
@@ -470,20 +471,6 @@ static int read_file_dma(struct seq_file *file, void *data)
         return 0;
 }
 
-static int open_file_dma(struct inode *inode, struct file *f)
-{
-        return single_open(f, read_file_dma, inode->i_private);
-}
-
-static const struct file_operations fops_dma = {
-        .open = open_file_dma,
-        .read = seq_read,
-        .owner = THIS_MODULE,
-        .llseek = seq_lseek,
-        .release = single_release,
-};
-
-
 void ath_debug_stat_interrupt(struct ath_softc *sc, enum ath9k_int status)
 {
         if (status)
@@ -539,7 +526,8 @@ void ath_debug_stat_interrupt(struct ath_softc *sc, enum ath9k_int status)
 
 static int read_file_interrupt(struct seq_file *file, void *data)
 {
-        struct ath_softc *sc = file->private;
+        struct ieee80211_hw *hw = dev_get_drvdata(file->private);
+        struct ath_softc *sc = hw->priv;
 
 #define PR_IS(a, s)                                             \
         do {                                                    \
@@ -600,22 +588,10 @@ static int read_file_interrupt(struct seq_file *file, void *data)
         return 0;
 }
 
-static int open_file_interrupt(struct inode *inode, struct file *f)
-{
-        return single_open(f, read_file_interrupt, inode->i_private);
-}
-
-static const struct file_operations fops_interrupt = {
-        .read = seq_read,
-        .open = open_file_interrupt,
-        .owner = THIS_MODULE,
-        .llseek = seq_lseek,
-        .release = single_release,
-};
-
 static int read_file_xmit(struct seq_file *file, void *data)
 {
-        struct ath_softc *sc = file->private;
+        struct ieee80211_hw *hw = dev_get_drvdata(file->private);
+        struct ath_softc *sc = hw->priv;
 
         seq_printf(file, "%30s %10s%10s%10s\n\n", "BE", "BK", "VI", "VO");
 
@@ -661,7 +637,8 @@ static void print_queue(struct ath_softc *sc, struct ath_txq *txq,
 
 static int read_file_queues(struct seq_file *file, void *data)
 {
-        struct ath_softc *sc = file->private;
+        struct ieee80211_hw *hw = dev_get_drvdata(file->private);
+        struct ath_softc *sc = hw->priv;
         struct ath_txq *txq;
         int i;
         static const char *qname[4] = {
@@ -682,7 +659,8 @@ static int read_file_queues(struct seq_file *file, void *data)
 
 static int read_file_misc(struct seq_file *file, void *data)
 {
-        struct ath_softc *sc = file->private;
+        struct ieee80211_hw *hw = dev_get_drvdata(file->private);
+        struct ath_softc *sc = hw->priv;
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ath9k_vif_iter_data iter_data;
         struct ath_chanctx *ctx;
@@ -773,7 +751,8 @@ static int read_file_misc(struct seq_file *file, void *data)
 
 static int read_file_reset(struct seq_file *file, void *data)
 {
-        struct ath_softc *sc = file->private;
+        struct ieee80211_hw *hw = dev_get_drvdata(file->private);
+        struct ath_softc *sc = hw->priv;
         static const char * const reset_cause[__RESET_TYPE_MAX] = {
                 [RESET_TYPE_BB_HANG] = "Baseband Hang",
                 [RESET_TYPE_BB_WATCHDOG] = "Baseband Watchdog",
@@ -837,58 +816,6 @@ void ath_debug_stat_tx(struct ath_softc *sc, struct ath_buf *bf,
                 TX_STAT_INC(qnum, delim_underrun);
 }
 
-static int open_file_xmit(struct inode *inode, struct file *f)
-{
-        return single_open(f, read_file_xmit, inode->i_private);
-}
-
-static const struct file_operations fops_xmit = {
-        .read = seq_read,
-        .open = open_file_xmit,
-        .owner = THIS_MODULE,
-        .llseek = seq_lseek,
-        .release = single_release,
-};
-
-static int open_file_queues(struct inode *inode, struct file *f)
-{
-        return single_open(f, read_file_queues, inode->i_private);
-}
-
-static const struct file_operations fops_queues = {
-        .read = seq_read,
-        .open = open_file_queues,
-        .owner = THIS_MODULE,
-        .llseek = seq_lseek,
-        .release = single_release,
-};
-
-static int open_file_misc(struct inode *inode, struct file *f)
-{
-        return single_open(f, read_file_misc, inode->i_private);
-}
-
-static const struct file_operations fops_misc = {
-        .read = seq_read,
-        .open = open_file_misc,
-        .owner = THIS_MODULE,
-        .llseek = seq_lseek,
-        .release = single_release,
-};
-
-static int open_file_reset(struct inode *inode, struct file *f)
-{
-        return single_open(f, read_file_reset, inode->i_private);
-}
-
-static const struct file_operations fops_reset = {
-        .read = seq_read,
-        .open = open_file_reset,
-        .owner = THIS_MODULE,
-        .llseek = seq_lseek,
-        .release = single_release,
-};
-
 void ath_debug_stat_rx(struct ath_softc *sc, struct ath_rx_status *rs)
 {
         ath9k_cmn_debug_stat_rx(&sc->debug.stats.rxstats, rs);
@@ -1018,7 +945,8 @@ static const struct file_operations fops_regdump = {
 
 static int read_file_dump_nfcal(struct seq_file *file, void *data)
 {
-        struct ath_softc *sc = file->private;
+        struct ieee80211_hw *hw = dev_get_drvdata(file->private);
+        struct ath_softc *sc = hw->priv;
         struct ath_hw *ah = sc->sc_ah;
         struct ath9k_nfcal_hist *h = sc->cur_chan->caldata.nfCalHist;
         struct ath_common *common = ath9k_hw_common(ah);
@@ -1115,6 +1043,133 @@ static const struct file_operations fops_ackto = {
 };
 #endif
 
+#ifdef CONFIG_ATH9K_WOW
+
+static ssize_t read_file_wow(struct file *file, char __user *user_buf,
+                             size_t count, loff_t *ppos)
+{
+        struct ath_softc *sc = file->private_data;
+        unsigned int len = 0, size = 32;
+        ssize_t retval;
+        char *buf;
+
+        buf = kzalloc(size, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        len += scnprintf(buf + len, size - len, "WOW: %s\n",
+                         sc->force_wow ? "ENABLED" : "DISABLED");
+
+        if (len > size)
+                len = size;
+
+        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
+        kfree(buf);
+
+        return retval;
+}
+
+static ssize_t write_file_wow(struct file *file, const char __user *user_buf,
+                              size_t count, loff_t *ppos)
+{
+        struct ath_softc *sc = file->private_data;
+        unsigned long val;
+        char buf[32];
+        ssize_t len;
+
+        len = min(count, sizeof(buf) - 1);
+        if (copy_from_user(buf, user_buf, len))
+                return -EFAULT;
+
+        buf[len] = '\0';
+        if (kstrtoul(buf, 0, &val))
+                return -EINVAL;
+
+        if (val != 1)
+                return -EINVAL;
+
+        if (!sc->force_wow) {
+                sc->force_wow = true;
+                ath9k_init_wow(sc->hw);
+        }
+
+        return count;
+}
+
+static const struct file_operations fops_wow = {
+        .read = read_file_wow,
+        .write = write_file_wow,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+#endif
+
+static ssize_t read_file_tpc(struct file *file, char __user *user_buf,
+                             size_t count, loff_t *ppos)
+{
+        struct ath_softc *sc = file->private_data;
+        struct ath_hw *ah = sc->sc_ah;
+        unsigned int len = 0, size = 32;
+        ssize_t retval;
+        char *buf;
+
+        buf = kzalloc(size, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        len += scnprintf(buf + len, size - len, "%s\n",
+                         ah->tpc_enabled ? "ENABLED" : "DISABLED");
+
+        if (len > size)
+                len = size;
+
+        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
+        kfree(buf);
+
+        return retval;
+}
+
+static ssize_t write_file_tpc(struct file *file, const char __user *user_buf,
+                              size_t count, loff_t *ppos)
+{
+        struct ath_softc *sc = file->private_data;
+        struct ath_hw *ah = sc->sc_ah;
+        unsigned long val;
+        char buf[32];
+        ssize_t len;
+        bool tpc_enabled;
+
+        len = min(count, sizeof(buf) - 1);
+        if (copy_from_user(buf, user_buf, len))
+                return -EFAULT;
+
+        buf[len] = '\0';
+        if (kstrtoul(buf, 0, &val))
+                return -EINVAL;
+
+        if (val < 0 || val > 1)
+                return -EINVAL;
+
+        tpc_enabled = !!val;
+
+        if (tpc_enabled != ah->tpc_enabled) {
+                ah->tpc_enabled = tpc_enabled;
+                ath9k_hw_set_txpowerlimit(ah, sc->cur_chan->txpower, false);
+        }
+
+        return count;
+}
+
+static const struct file_operations fops_tpc = {
+        .read = read_file_tpc,
+        .write = write_file_tpc,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
 /* Ethtool support for get-stats */
 
 #define AMKSTR(nm) #nm "_BE", #nm "_BK", #nm "_VI", #nm "_VO"
@@ -1260,14 +1315,14 @@ int ath9k_init_debug(struct ath_hw *ah)
         ath9k_tx99_init_debug(sc);
         ath9k_cmn_spectral_init_debug(&sc->spec_priv, sc->debug.debugfs_phy);
 
-        debugfs_create_file("dma", S_IRUSR, sc->debug.debugfs_phy, sc,
-                            &fops_dma);
-        debugfs_create_file("interrupt", S_IRUSR, sc->debug.debugfs_phy, sc,
-                            &fops_interrupt);
-        debugfs_create_file("xmit", S_IRUSR, sc->debug.debugfs_phy, sc,
-                            &fops_xmit);
-        debugfs_create_file("queues", S_IRUSR, sc->debug.debugfs_phy, sc,
-                            &fops_queues);
+        debugfs_create_devm_seqfile(sc->dev, "dma", sc->debug.debugfs_phy,
+                                    read_file_dma);
+        debugfs_create_devm_seqfile(sc->dev, "interrupt", sc->debug.debugfs_phy,
+                                    read_file_interrupt);
+        debugfs_create_devm_seqfile(sc->dev, "xmit", sc->debug.debugfs_phy,
+                                    read_file_xmit);
+        debugfs_create_devm_seqfile(sc->dev, "queues", sc->debug.debugfs_phy,
+                                    read_file_queues);
         debugfs_create_u32("qlen_bk", S_IRUSR | S_IWUSR, sc->debug.debugfs_phy,
                            &sc->tx.txq_max_pending[IEEE80211_AC_BK]);
         debugfs_create_u32("qlen_be", S_IRUSR | S_IWUSR, sc->debug.debugfs_phy,
@@ -1276,10 +1331,10 @@ int ath9k_init_debug(struct ath_hw *ah)
                            &sc->tx.txq_max_pending[IEEE80211_AC_VI]);
         debugfs_create_u32("qlen_vo", S_IRUSR | S_IWUSR, sc->debug.debugfs_phy,
                            &sc->tx.txq_max_pending[IEEE80211_AC_VO]);
-        debugfs_create_file("misc", S_IRUSR, sc->debug.debugfs_phy, sc,
-                            &fops_misc);
-        debugfs_create_file("reset", S_IRUSR, sc->debug.debugfs_phy, sc,
-                            &fops_reset);
+        debugfs_create_devm_seqfile(sc->dev, "misc", sc->debug.debugfs_phy,
+                                    read_file_misc);
+        debugfs_create_devm_seqfile(sc->dev, "reset", sc->debug.debugfs_phy,
+                                    read_file_reset);
 
         ath9k_cmn_debug_recv(sc->debug.debugfs_phy, &sc->debug.stats.rxstats);
         ath9k_cmn_debug_phy_err(sc->debug.debugfs_phy, &sc->debug.stats.rxstats);
@@ -1301,8 +1356,9 @@ int ath9k_init_debug(struct ath_hw *ah)
                             &ah->config.cwm_ignore_extcca);
         debugfs_create_file("regdump", S_IRUSR, sc->debug.debugfs_phy, sc,
                             &fops_regdump);
-        debugfs_create_file("dump_nfcal", S_IRUSR, sc->debug.debugfs_phy, sc,
-                            &fops_dump_nfcal);
+        debugfs_create_devm_seqfile(sc->dev, "dump_nfcal",
+                                    sc->debug.debugfs_phy,
+                                    read_file_dump_nfcal);
 
         ath9k_cmn_debug_base_eeprom(sc->debug.debugfs_phy, sc->sc_ah);
         ath9k_cmn_debug_modal_eeprom(sc->debug.debugfs_phy, sc->sc_ah);
@@ -1320,10 +1376,17 @@ int ath9k_init_debug(struct ath_hw *ah)
                             &fops_btcoex);
 #endif
 
+#ifdef CONFIG_ATH9K_WOW
+        debugfs_create_file("wow", S_IRUSR | S_IWUSR,
+                            sc->debug.debugfs_phy, sc, &fops_wow);
+#endif
+
 #ifdef CONFIG_ATH9K_DYNACK
         debugfs_create_file("ack_to", S_IRUSR | S_IWUSR, sc->debug.debugfs_phy,
                             sc, &fops_ackto);
 #endif
+        debugfs_create_file("tpc", S_IRUSR | S_IWUSR,
+                            sc->debug.debugfs_phy, sc, &fops_tpc);
 
         return 0;
 }
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_4k.c b/drivers/net/wireless/ath/ath9k/eeprom_4k.c
index 07b806c56c56..e5a78d4fd66e 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_4k.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_4k.c
@@ -748,6 +748,20 @@ static void ath9k_hw_4k_set_txpower(struct ath_hw *ah,
                           | ATH9K_POW_SM(ratesArray[rateDupCck], 0));
         }
 
+        /* TPC initializations */
+        if (ah->tpc_enabled) {
+                int ht40_delta;
+
+                ht40_delta = (IS_CHAN_HT40(chan)) ? ht40PowerIncForPdadc : 0;
+                ar5008_hw_init_rate_txpower(ah, ratesArray, chan, ht40_delta);
+                /* Enable TPC */
+                REG_WRITE(ah, AR_PHY_POWER_TX_RATE_MAX,
+                        MAX_RATE_POWER | AR_PHY_POWER_TX_RATE_MAX_TPC_ENABLE);
+        } else {
+                /* Disable TPC */
+                REG_WRITE(ah, AR_PHY_POWER_TX_RATE_MAX, MAX_RATE_POWER);
+        }
+
         REGWRITE_BUFFER_FLUSH(ah);
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_9287.c b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
index 5ba1385c9838..6ca33dfde1fd 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_9287.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
@@ -886,6 +886,21 @@ static void ath9k_hw_ar9287_set_txpower(struct ath_hw *ah,
                           | ATH9K_POW_SM(ratesArray[rateDupOfdm], 8)
                           | ATH9K_POW_SM(ratesArray[rateDupCck], 0));
         }
+
+        /* TPC initializations */
+        if (ah->tpc_enabled) {
+                int ht40_delta;
+
+                ht40_delta = (IS_CHAN_HT40(chan)) ? ht40PowerIncForPdadc : 0;
+                ar5008_hw_init_rate_txpower(ah, ratesArray, chan, ht40_delta);
+                /* Enable TPC */
+                REG_WRITE(ah, AR_PHY_POWER_TX_RATE_MAX,
+                        MAX_RATE_POWER | AR_PHY_POWER_TX_RATE_MAX_TPC_ENABLE);
+        } else {
+                /* Disable TPC */
+                REG_WRITE(ah, AR_PHY_POWER_TX_RATE_MAX, MAX_RATE_POWER);
+        }
+
         REGWRITE_BUFFER_FLUSH(ah);
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_def.c b/drivers/net/wireless/ath/ath9k/eeprom_def.c
index 122b846b8ec0..098059039351 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_def.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_def.c
@@ -1332,6 +1332,20 @@ static void ath9k_hw_def_set_txpower(struct ath_hw *ah,
                   ATH9K_POW_SM(pModal->pwrDecreaseFor3Chain, 6)
                   | ATH9K_POW_SM(pModal->pwrDecreaseFor2Chain, 0));
 
+        /* TPC initializations */
+        if (ah->tpc_enabled) {
+                int ht40_delta;
+
+                ht40_delta = (IS_CHAN_HT40(chan)) ? ht40PowerIncForPdadc : 0;
+                ar5008_hw_init_rate_txpower(ah, ratesArray, chan, ht40_delta);
+                /* Enable TPC */
+                REG_WRITE(ah, AR_PHY_POWER_TX_RATE_MAX,
+                        MAX_RATE_POWER | AR_PHY_POWER_TX_RATE_MAX_TPC_ENABLE);
+        } else {
+                /* Disable TPC */
+                REG_WRITE(ah, AR_PHY_POWER_TX_RATE_MAX, MAX_RATE_POWER);
+        }
+
         REGWRITE_BUFFER_FLUSH(ah);
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/gpio.c b/drivers/net/wireless/ath/ath9k/gpio.c
index 2fef7a480fec..da344b27326c 100644
--- a/drivers/net/wireless/ath/ath9k/gpio.c
+++ b/drivers/net/wireless/ath/ath9k/gpio.c
@@ -49,7 +49,7 @@ void ath_init_leds(struct ath_softc *sc)
         if (AR_SREV_9100(sc->sc_ah))
                 return;
 
-        if (!led_blink)
+        if (!ath9k_led_blink)
                 sc->led_cdev.default_trigger =
                         ieee80211_get_radio_led_name(sc->hw);
 
diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
index 9dde265d3f84..300d3671d0ef 100644
--- a/drivers/net/wireless/ath/ath9k/htc.h
+++ b/drivers/net/wireless/ath/ath9k/htc.h
@@ -44,6 +44,9 @@
 
 extern struct ieee80211_ops ath9k_htc_ops;
 extern int htc_modparam_nohwcrypt;
+#ifdef CONFIG_MAC80211_LEDS
+extern int ath9k_htc_led_blink;
+#endif
 
 enum htc_phymode {
         HTC_MODE_11NA           = 0,
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_gpio.c b/drivers/net/wireless/ath/ath9k/htc_drv_gpio.c
index 50f74a2a4cf8..2aabcbdaba4e 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_gpio.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_gpio.c
@@ -279,6 +279,10 @@ void ath9k_init_leds(struct ath9k_htc_priv *priv)
         else
                 priv->ah->led_pin = ATH_LED_PIN_DEF;
 
+        if (!ath9k_htc_led_blink)
+                priv->led_cdev.default_trigger =
+                        ieee80211_get_radio_led_name(priv->hw);
+
         ath9k_configure_leds(priv);
 
         snprintf(priv->led_name, sizeof(priv->led_name),
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index e8fa9448da24..fd229409f676 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -39,6 +39,10 @@ module_param_named(ps_enable, ath9k_ps_enable, int, 0444);
 MODULE_PARM_DESC(ps_enable, "Enable WLAN PowerSave");
 
 #ifdef CONFIG_MAC80211_LEDS
+int ath9k_htc_led_blink = 1;
+module_param_named(blink, ath9k_htc_led_blink, int, 0444);
+MODULE_PARM_DESC(blink, "Enable LED blink on activity");
+
 static const struct ieee80211_tpt_blink ath9k_htc_tpt_blink[] = {
         { .throughput = 0 * 1024, .blink_time = 334 },
         { .throughput = 1 * 1024, .blink_time = 260 },
diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
index a0ff5b637054..d2408da38c1c 100644
--- a/drivers/net/wireless/ath/ath9k/htc_hst.c
+++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
@@ -351,11 +351,7 @@ void ath9k_htc_txcompletion_cb(struct htc_target *htc_handle,
 
         return;
 ret:
-        /* HTC-generated packets are freed here. */
-        if (htc_hdr && htc_hdr->endpoint_id != ENDPOINT0)
-                dev_kfree_skb_any(skb);
-        else
-                kfree_skb(skb);
+        kfree_skb(skb);
 }
 
 static void ath9k_htc_fw_panic_report(struct htc_target *htc_handle,
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 6d4b273469b1..60aa8d71e753 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -246,6 +246,8 @@ static void ath9k_hw_read_revisions(struct ath_hw *ah)
         case AR9300_DEVID_AR953X:
                 ah->hw_version.macVersion = AR_SREV_VERSION_9531;
                 return;
+        case AR9300_DEVID_QCA956X:
+                ah->hw_version.macVersion = AR_SREV_VERSION_9561;
         }
 
         val = REG_READ(ah, AR_SREV) & AR_SREV_ID;
@@ -422,6 +424,8 @@ static void ath9k_hw_init_defaults(struct ath_hw *ah)
         ah->power_mode = ATH9K_PM_UNDEFINED;
         ah->htc_reset_init = true;
 
+        ah->tpc_enabled = true;
+
         ah->ani_function = ATH9K_ANI_ALL;
         if (!AR_SREV_9300_20_OR_LATER(ah))
                 ah->ani_function &= ~ATH9K_ANI_MRC_CCK;
@@ -536,6 +540,7 @@ static int __ath9k_hw_init(struct ath_hw *ah)
         case AR_SREV_VERSION_9550:
         case AR_SREV_VERSION_9565:
         case AR_SREV_VERSION_9531:
+        case AR_SREV_VERSION_9561:
                 break;
         default:
                 ath_err(common,
@@ -636,6 +641,7 @@ int ath9k_hw_init(struct ath_hw *ah)
         case AR9485_DEVID_AR1111:
         case AR9300_DEVID_AR9565:
         case AR9300_DEVID_AR953X:
+        case AR9300_DEVID_QCA956X:
                 break;
         default:
                 if (common->bus_ops->ath_bus_type == ATH_USB)
@@ -776,7 +782,8 @@ static void ath9k_hw_init_pll(struct ath_hw *ah,
                 /* program BB PLL phase_shift */
                 REG_RMW_FIELD(ah, AR_CH0_BB_DPLL3,
                               AR_CH0_BB_DPLL3_PHASE_SHIFT, 0x1);
-        } else if (AR_SREV_9340(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah)) {
+        } else if (AR_SREV_9340(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah) ||
+                   AR_SREV_9561(ah)) {
                 u32 regval, pll2_divint, pll2_divfrac, refdiv;
 
                 REG_WRITE(ah, AR_RTC_PLL_CONTROL,
@@ -787,7 +794,7 @@ static void ath9k_hw_init_pll(struct ath_hw *ah,
                 udelay(100);
 
                 if (ah->is_clk_25mhz) {
-                        if (AR_SREV_9531(ah)) {
+                        if (AR_SREV_9531(ah) || AR_SREV_9561(ah)) {
                                 pll2_divint = 0x1c;
                                 pll2_divfrac = 0xa3d2;
                                 refdiv = 1;
@@ -803,14 +810,15 @@ static void ath9k_hw_init_pll(struct ath_hw *ah,
                                 refdiv = 5;
                         } else {
                                 pll2_divint = 0x11;
-                                pll2_divfrac =
-                                        AR_SREV_9531(ah) ? 0x26665 : 0x26666;
+                                pll2_divfrac = (AR_SREV_9531(ah) ||
+                                                AR_SREV_9561(ah)) ?
+                                                0x26665 : 0x26666;
                                 refdiv = 1;
                         }
                 }
 
                 regval = REG_READ(ah, AR_PHY_PLL_MODE);
-                if (AR_SREV_9531(ah))
+                if (AR_SREV_9531(ah) || AR_SREV_9561(ah))
                         regval |= (0x1 << 22);
                 else
                         regval |= (0x1 << 16);
@@ -828,14 +836,16 @@ static void ath9k_hw_init_pll(struct ath_hw *ah,
                                 (0x1 << 13) |
                                 (0x4 << 26) |
                                 (0x18 << 19);
-                else if (AR_SREV_9531(ah))
+                else if (AR_SREV_9531(ah) || AR_SREV_9561(ah)) {
                         regval = (regval & 0x01c00fff) |
                                 (0x1 << 31) |
                                 (0x2 << 29) |
                                 (0xa << 25) |
-                                (0x1 << 19) |
-                                (0x6 << 12);
-                else
+                                (0x1 << 19);
+
+                        if (AR_SREV_9531(ah))
+                                regval |= (0x6 << 12);
+                } else
                         regval = (regval & 0x80071fff) |
                                 (0x3 << 30) |
                                 (0x1 << 13) |
@@ -843,7 +853,7 @@ static void ath9k_hw_init_pll(struct ath_hw *ah,
                                 (0x60 << 19);
                 REG_WRITE(ah, AR_PHY_PLL_MODE, regval);
 
-                if (AR_SREV_9531(ah))
+                if (AR_SREV_9531(ah) || AR_SREV_9561(ah))
                         REG_WRITE(ah, AR_PHY_PLL_MODE,
                                   REG_READ(ah, AR_PHY_PLL_MODE) & 0xffbfffff);
                 else
@@ -882,7 +892,8 @@ static void ath9k_hw_init_interrupt_masks(struct ath_hw *ah,
                 AR_IMR_RXORN |
                 AR_IMR_BCNMISC;
 
-        if (AR_SREV_9340(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah))
+        if (AR_SREV_9340(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah) ||
+            AR_SREV_9561(ah))
                 sync_default &= ~AR_INTR_SYNC_HOST1_FATAL;
 
         if (AR_SREV_9300_20_OR_LATER(ah)) {
@@ -1671,7 +1682,8 @@ static void ath9k_hw_init_desc(struct ath_hw *ah)
                 }
 #ifdef __BIG_ENDIAN
                 else if (AR_SREV_9330(ah) || AR_SREV_9340(ah) ||
-                         AR_SREV_9550(ah) || AR_SREV_9531(ah))
+                         AR_SREV_9550(ah) || AR_SREV_9531(ah) ||
+                         AR_SREV_9561(ah))
                         REG_RMW(ah, AR_CFG, AR_CFG_SWRB | AR_CFG_SWTB, 0);
                 else
                         REG_WRITE(ah, AR_CFG, AR_CFG_SWTD | AR_CFG_SWRD);
@@ -2459,7 +2471,8 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
 
         if (AR_SREV_9300_20_OR_LATER(ah)) {
                 pCap->hw_caps |= ATH9K_HW_CAP_EDMA | ATH9K_HW_CAP_FASTCLOCK;
-                if (!AR_SREV_9330(ah) && !AR_SREV_9485(ah) && !AR_SREV_9565(ah))
+                if (!AR_SREV_9330(ah) && !AR_SREV_9485(ah) &&
+                    !AR_SREV_9561(ah) && !AR_SREV_9565(ah))
                         pCap->hw_caps |= ATH9K_HW_CAP_LDPC;
 
                 pCap->rx_hp_qdepth = ATH9K_HW_RX_HP_QDEPTH;
@@ -2476,7 +2489,9 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
         if (AR_SREV_9300_20_OR_LATER(ah))
                 pCap->hw_caps |= ATH9K_HW_CAP_RAC_SUPPORTED;
 
-        if (AR_SREV_9300_20_OR_LATER(ah))
+        if (AR_SREV_9561(ah))
+                ah->ent_mode = 0x3BDA000;
+        else if (AR_SREV_9300_20_OR_LATER(ah))
                 ah->ent_mode = REG_READ(ah, AR_ENT_OTP);
 
         if (AR_SREV_9287_11_OR_LATER(ah) || AR_SREV_9271(ah))
@@ -2529,13 +2544,17 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
                         pCap->hw_caps |= ATH9K_HW_CAP_RTT;
         }
 
-        if (AR_SREV_9462(ah))
-                pCap->hw_caps |= ATH9K_HW_WOW_DEVICE_CAPABLE;
-
         if (AR_SREV_9300_20_OR_LATER(ah) &&
             ah->eep_ops->get_eeprom(ah, EEP_PAPRD))
                         pCap->hw_caps |= ATH9K_HW_CAP_PAPRD;
 
+#ifdef CONFIG_ATH9K_WOW
+        if (AR_SREV_9462_20_OR_LATER(ah) || AR_SREV_9565_11_OR_LATER(ah))
+                ah->wow.max_patterns = MAX_NUM_PATTERN;
+        else
+                ah->wow.max_patterns = MAX_NUM_PATTERN_LEGACY;
+#endif
+
         return 0;
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index 1cbd33551513..e82e570de330 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -54,6 +54,7 @@
 #define AR9485_DEVID_AR1111     0x0037
 #define AR9300_DEVID_AR9565     0x0036
 #define AR9300_DEVID_AR953X     0x003d
+#define AR9300_DEVID_QCA956X    0x003f
 
 #define AR5416_AR9100_DEVID     0x000b
 
@@ -198,12 +199,13 @@
 #define KAL_NUM_DESC_WORDS      12
 #define KAL_ANTENNA_MODE        1
 #define KAL_TO_DS               1
-#define KAL_DELAY               4       /*delay of 4ms between 2 KAL frames */
+#define KAL_DELAY               4       /* delay of 4ms between 2 KAL frames */
 #define KAL_TIMEOUT             900
 
 #define MAX_PATTERN_SIZE                256
 #define MAX_PATTERN_MASK_SIZE           32
-#define MAX_NUM_PATTERN                 8
+#define MAX_NUM_PATTERN                 16
+#define MAX_NUM_PATTERN_LEGACY          8
 #define MAX_NUM_USER_PATTERN            6 /*  deducting the disassociate and
                                               deauthenticate packets */
 
@@ -247,12 +249,10 @@ enum ath9k_hw_caps {
 #ifdef CONFIG_ATH9K_PCOEM
         ATH9K_HW_CAP_RTT                        = BIT(14),
         ATH9K_HW_CAP_MCI                        = BIT(15),
-        ATH9K_HW_WOW_DEVICE_CAPABLE             = BIT(16),
         ATH9K_HW_CAP_BT_ANT_DIV                 = BIT(17),
 #else
         ATH9K_HW_CAP_RTT                        = 0,
         ATH9K_HW_CAP_MCI                        = 0,
-        ATH9K_HW_WOW_DEVICE_CAPABLE             = 0,
         ATH9K_HW_CAP_BT_ANT_DIV                 = 0,
 #endif
         ATH9K_HW_CAP_DFS                        = BIT(18),
@@ -271,6 +271,12 @@ enum ath9k_hw_caps {
  * of those types.
  */
 
+struct ath9k_hw_wow {
+        u32 wow_event_mask;
+        u32 wow_event_mask2;
+        u8 max_patterns;
+};
+
 struct ath9k_hw_capabilities {
         u32 hw_caps; /* ATH9K_HW_CAP_* from ath9k_hw_caps */
         u16 rts_aggr_limit;
@@ -929,7 +935,7 @@ struct ath_hw {
         u32 ent_mode;
 
 #ifdef CONFIG_ATH9K_WOW
-        u32 wow_event_mask;
+        struct ath9k_hw_wow wow;
 #endif
         bool is_clk_25mhz;
         int (*get_mac_revision)(void);
@@ -1086,6 +1092,8 @@ bool ar9003_is_paprd_enabled(struct ath_hw *ah);
 void ar9003_hw_set_chain_masks(struct ath_hw *ah, u8 rx, u8 tx);
 void ar9003_hw_init_rate_txpower(struct ath_hw *ah, u8 *rate_array,
                                  struct ath9k_channel *chan);
+void ar5008_hw_init_rate_txpower(struct ath_hw *ah, int16_t *rate_array,
+                                 struct ath9k_channel *chan, int ht40_delta);
 
 /* Hardware family op attach helpers */
 int ar5008_hw_attach_phy_ops(struct ath_hw *ah);
@@ -1145,23 +1153,19 @@ ath9k_hw_get_btcoex_scheme(struct ath_hw *ah)
 
 
 #ifdef CONFIG_ATH9K_WOW
-const char *ath9k_hw_wow_event_to_string(u32 wow_event);
-void ath9k_hw_wow_apply_pattern(struct ath_hw *ah, u8 *user_pattern,
-                                u8 *user_mask, int pattern_count,
-                                int pattern_len);
+int ath9k_hw_wow_apply_pattern(struct ath_hw *ah, u8 *user_pattern,
+                               u8 *user_mask, int pattern_count,
+                               int pattern_len);
 u32 ath9k_hw_wow_wakeup(struct ath_hw *ah);
 void ath9k_hw_wow_enable(struct ath_hw *ah, u32 pattern_enable);
 #else
-static inline const char *ath9k_hw_wow_event_to_string(u32 wow_event)
-{
-        return NULL;
-}
-static inline void ath9k_hw_wow_apply_pattern(struct ath_hw *ah,
-                                              u8 *user_pattern,
-                                              u8 *user_mask,
-                                              int pattern_count,
-                                              int pattern_len)
+static inline int ath9k_hw_wow_apply_pattern(struct ath_hw *ah,
+                                             u8 *user_pattern,
+                                             u8 *user_mask,
+                                             int pattern_count,
+                                             int pattern_len)
 {
+        return 0;
 }
 static inline u32 ath9k_hw_wow_wakeup(struct ath_hw *ah)
 {
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index d1c39346b264..6c6e88495394 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -45,8 +45,8 @@ int ath9k_modparam_nohwcrypt;
 module_param_named(nohwcrypt, ath9k_modparam_nohwcrypt, int, 0444);
 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption");
 
-int led_blink;
-module_param_named(blink, led_blink, int, 0444);
+int ath9k_led_blink;
+module_param_named(blink, ath9k_led_blink, int, 0444);
 MODULE_PARM_DESC(blink, "Enable LED blink on activity");
 
 static int ath9k_btcoex_enable;
@@ -996,6 +996,7 @@ void ath9k_deinit_device(struct ath_softc *sc)
         ath9k_ps_restore(sc);
 
         ath9k_deinit_debug(sc);
+        ath9k_deinit_wow(hw);
         ieee80211_unregister_hw(hw);
         ath_rx_cleanup(sc);
         ath9k_deinit_softc(sc);
diff --git a/drivers/net/wireless/ath/ath9k/link.c b/drivers/net/wireless/ath/ath9k/link.c
index b829263e3d0a..90631d768a60 100644
--- a/drivers/net/wireless/ath/ath9k/link.c
+++ b/drivers/net/wireless/ath/ath9k/link.c
@@ -516,14 +516,14 @@ int ath_update_survey_stats(struct ath_softc *sc)
                 ath_hw_cycle_counters_update(common);
 
         if (cc->cycles > 0) {
-                survey->filled |= SURVEY_INFO_CHANNEL_TIME |
-                        SURVEY_INFO_CHANNEL_TIME_BUSY |
-                        SURVEY_INFO_CHANNEL_TIME_RX |
-                        SURVEY_INFO_CHANNEL_TIME_TX;
-                survey->channel_time += cc->cycles / div;
-                survey->channel_time_busy += cc->rx_busy / div;
-                survey->channel_time_rx += cc->rx_frame / div;
-                survey->channel_time_tx += cc->tx_frame / div;
+                survey->filled |= SURVEY_INFO_TIME |
+                        SURVEY_INFO_TIME_BUSY |
+                        SURVEY_INFO_TIME_RX |
+                        SURVEY_INFO_TIME_TX;
+                survey->time += cc->cycles / div;
+                survey->time_busy += cc->rx_busy / div;
+                survey->time_rx += cc->rx_frame / div;
+                survey->time_tx += cc->tx_frame / div;
         }
 
         if (cc->cycles < div)
diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
index 3e58bfa0c1fd..bba85d1a6cd1 100644
--- a/drivers/net/wireless/ath/ath9k/mac.c
+++ b/drivers/net/wireless/ath/ath9k/mac.c
@@ -820,7 +820,8 @@ void ath9k_hw_enable_interrupts(struct ath_hw *ah)
                 return;
         }
 
-        if (AR_SREV_9340(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah))
+        if (AR_SREV_9340(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah) ||
+            AR_SREV_9561(ah))
                 sync_default &= ~AR_INTR_SYNC_HOST1_FATAL;
 
         async_mask = AR_INTR_MAC_IRQ;
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 62b0bf4fdf6b..9ede991b8d76 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -555,15 +555,6 @@ irqreturn_t ath_isr(int irq, void *dev)
             (status & ATH9K_INT_BB_WATCHDOG))
                 goto chip_reset;
 
-#ifdef CONFIG_ATH9K_WOW
-        if (status & ATH9K_INT_BMISS) {
-                if (atomic_read(&sc->wow_sleep_proc_intr) == 0) {
-                        atomic_inc(&sc->wow_got_bmiss_intr);
-                        atomic_dec(&sc->wow_sleep_proc_intr);
-                }
-        }
-#endif
-
         if (status & ATH9K_INT_SWBA)
                 tasklet_schedule(&sc->bcon_tasklet);
 
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index f009b5b57e5e..e6fef1be9977 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -427,6 +427,11 @@ static const struct pci_device_id ath_pci_id_table[] = {
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
                          0x11AD, /* LITEON */
+                         0x1842),
+          .driver_data = ATH9K_PCI_AR9565_1ANT },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x11AD, /* LITEON */
                          0x6671),
           .driver_data = ATH9K_PCI_AR9565_1ANT },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
@@ -446,9 +451,19 @@ static const struct pci_device_id ath_pci_id_table[] = {
           .driver_data = ATH9K_PCI_AR9565_1ANT },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
+                         0x1B9A, /* XAVI */
+                         0x28A3),
+          .driver_data = ATH9K_PCI_AR9565_1ANT },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
                          PCI_VENDOR_ID_AZWAVE,
                          0x218A),
           .driver_data = ATH9K_PCI_AR9565_1ANT },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x2F8A),
+          .driver_data = ATH9K_PCI_AR9565_1ANT },
 
         /* WB335 1-ANT / Antenna Diversity */
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
@@ -508,6 +523,11 @@ static const struct pci_device_id ath_pci_id_table[] = {
           .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x213C),
+          .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
                          PCI_VENDOR_ID_HP,
                          0x18E3),
           .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
@@ -555,6 +575,16 @@ static const struct pci_device_id ath_pci_id_table[] = {
           .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
+                         PCI_VENDOR_ID_SAMSUNG,
+                         0x4129),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_SAMSUNG,
+                         0x412A),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
                          PCI_VENDOR_ID_ATHEROS,
                          0x3027),
           .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
@@ -586,10 +616,25 @@ static const struct pci_device_id ath_pci_id_table[] = {
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
                          0x11AD, /* LITEON */
+                         0x1832),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x11AD, /* LITEON */
                          0x0692),
           .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
+                         0x11AD, /* LITEON */
+                         0x0803),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x11AD, /* LITEON */
+                         0x0813),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
                          PCI_VENDOR_ID_AZWAVE,
                          0x2130),
           .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
@@ -605,6 +650,21 @@ static const struct pci_device_id ath_pci_id_table[] = {
           .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x218B),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x218C),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x2F82),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
                          0x144F, /* ASKEY */
                          0x7202),
           .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
@@ -616,10 +676,20 @@ static const struct pci_device_id ath_pci_id_table[] = {
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
                          0x1B9A, /* XAVI */
+                         0x2813),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x1B9A, /* XAVI */
                          0x28A2),
           .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
+                         0x1B9A, /* XAVI */
+                         0x28A4),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
                          0x185F, /* WNC */
                          0x3027),
           .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
@@ -636,10 +706,25 @@ static const struct pci_device_id ath_pci_id_table[] = {
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
                          PCI_VENDOR_ID_FOXCONN,
+                         0xE08F),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_FOXCONN,
                          0xE081),
           .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
+                         PCI_VENDOR_ID_FOXCONN,
+                         0xE091),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_FOXCONN,
+                         0xE099),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
                          PCI_VENDOR_ID_LENOVO,
                          0x3026),
           .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
@@ -913,9 +998,12 @@ static int ath_pci_suspend(struct device *device)
         struct pci_dev *pdev = to_pci_dev(device);
         struct ieee80211_hw *hw = pci_get_drvdata(pdev);
         struct ath_softc *sc = hw->priv;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
 
-        if (sc->wow_enabled)
+        if (test_bit(ATH_OP_WOW_ENABLED, &common->op_flags)) {
+                dev_info(&pdev->dev, "WOW is enabled, bypassing PCI suspend\n");
                 return 0;
+        }
 
         /* The device has to be moved to FULLSLEEP forcibly.
          * Otherwise the chip never moved to full sleep,
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index 7395afbc5124..6fb40ef86fd6 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -425,7 +425,8 @@ u32 ath_calcrxfilter(struct ath_softc *sc)
                 rfilt |= ATH9K_RX_FILTER_MCAST_BCAST_ALL;
         }
 
-        if (AR_SREV_9550(sc->sc_ah) || AR_SREV_9531(sc->sc_ah))
+        if (AR_SREV_9550(sc->sc_ah) || AR_SREV_9531(sc->sc_ah) ||
+            AR_SREV_9561(sc->sc_ah))
                 rfilt |= ATH9K_RX_FILTER_4ADDRESS;
 
         if (ath9k_is_chanctx_enabled() &&
diff --git a/drivers/net/wireless/ath/ath9k/reg.h b/drivers/net/wireless/ath/ath9k/reg.h
index fb11a9172f38..9587ec655680 100644
--- a/drivers/net/wireless/ath/ath9k/reg.h
+++ b/drivers/net/wireless/ath/ath9k/reg.h
@@ -814,6 +814,7 @@
 #define AR_SREV_REVISION_9531_10        0
 #define AR_SREV_REVISION_9531_11        1
 #define AR_SREV_REVISION_9531_20        2
+#define AR_SREV_VERSION_9561            0x600
 
 #define AR_SREV_5416(_ah) \
         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_5416_PCI) || \
@@ -899,10 +900,13 @@
         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9485))
 #define AR_SREV_9565(_ah) \
         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9565))
+#define AR_SREV_9003_PCOEM(_ah) \
+        (AR_SREV_9462(_ah) || AR_SREV_9485(_ah) || AR_SREV_9565(_ah))
 #else
 #define AR_SREV_9462(_ah) 0
 #define AR_SREV_9485(_ah) 0
 #define AR_SREV_9565(_ah) 0
+#define AR_SREV_9003_PCOEM(_ah) 0
 #endif
 
 #define AR_SREV_9485_11_OR_LATER(_ah) \
@@ -974,6 +978,9 @@
         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9531) && \
          ((_ah)->hw_version.macRev == AR_SREV_REVISION_9531_20))
 
+#define AR_SREV_9561(_ah) \
+        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9561))
+
 /* NOTE: When adding chips newer than Peacock, add chip check here */
 #define AR_SREV_9580_10_OR_LATER(_ah) \
         (AR_SREV_9580(_ah))
@@ -1876,6 +1883,7 @@ enum {
 #define AR_FIRST_NDP_TIMER                  7
 #define AR_NDP2_PERIOD                      0x81a0
 #define AR_NDP2_TIMER_MODE                  0x81c0
+#define AR_GEN_TIMERS2_MODE_ENABLE_MASK     0x000000FF
 
 #define AR_GEN_TIMERS(_i)                   (0x8200 + ((_i) << 2))
 #define AR_NEXT_TBTT_TIMER                  AR_GEN_TIMERS(0)
@@ -1971,6 +1979,7 @@ enum {
 
 #define AR_DIRECT_CONNECT                              0x83a0
 #define AR_DC_AP_STA_EN                                0x00000001
+#define AR_DC_TSF2_ENABLE                              0x00000001
 
 #define AR_AES_MUTE_MASK0       0x805c
 #define AR_AES_MUTE_MASK0_FC    0x0000FFFF
@@ -2003,126 +2012,6 @@ enum {
 
 #define AR_WOW_BEACON_TIMO_MAX          0xffffffff
 
-/*
- * MAC WoW Registers
- */
-
-#define AR_WOW_PATTERN                  0x825C
-#define AR_WOW_COUNT                    0x8260
-#define AR_WOW_BCN_EN                   0x8270
-#define AR_WOW_BCN_TIMO                 0x8274
-#define AR_WOW_KEEP_ALIVE_TIMO          0x8278
-#define AR_WOW_KEEP_ALIVE               0x827c
-#define AR_WOW_US_SCALAR                0x8284
-#define AR_WOW_KEEP_ALIVE_DELAY         0x8288
-#define AR_WOW_PATTERN_MATCH            0x828c
-#define AR_WOW_PATTERN_OFF1             0x8290  /* pattern bytes 0 -> 3 */
-#define AR_WOW_PATTERN_OFF2             0x8294  /* pattern bytes 4 -> 7 */
-
-/* for AR9285 or later version of chips */
-#define AR_WOW_EXACT                    0x829c
-#define AR_WOW_LENGTH1                  0x8360
-#define AR_WOW_LENGTH2                  0X8364
-/* register to enable match for less than 256 bytes packets */
-#define AR_WOW_PATTERN_MATCH_LT_256B    0x8368
-
-#define AR_SW_WOW_CONTROL               0x20018
-#define AR_SW_WOW_ENABLE                0x1
-#define AR_SWITCH_TO_REFCLK             0x2
-#define AR_RESET_CONTROL                0x4
-#define AR_RESET_VALUE_MASK             0x8
-#define AR_HW_WOW_DISABLE               0x10
-#define AR_CLR_MAC_INTERRUPT            0x20
-#define AR_CLR_KA_INTERRUPT             0x40
-
-/* AR_WOW_PATTERN register values */
-#define AR_WOW_BACK_OFF_SHIFT(x)        ((x & 0xf) << 28) /* in usecs */
-#define AR_WOW_MAC_INTR_EN              0x00040000
-#define AR_WOW_MAGIC_EN                 0x00010000
-#define AR_WOW_PATTERN_EN(x)            (x & 0xff)
-#define AR_WOW_PAT_FOUND_SHIFT  8
-#define AR_WOW_PATTERN_FOUND(x)         (x & (0xff << AR_WOW_PAT_FOUND_SHIFT))
-#define AR_WOW_PATTERN_FOUND_MASK       ((0xff) << AR_WOW_PAT_FOUND_SHIFT)
-#define AR_WOW_MAGIC_PAT_FOUND          0x00020000
-#define AR_WOW_MAC_INTR                 0x00080000
-#define AR_WOW_KEEP_ALIVE_FAIL          0x00100000
-#define AR_WOW_BEACON_FAIL              0x00200000
-
-#define AR_WOW_STATUS(x)                (x & (AR_WOW_PATTERN_FOUND_MASK | \
-                                              AR_WOW_MAGIC_PAT_FOUND    | \
-                                              AR_WOW_KEEP_ALIVE_FAIL    | \
-                                              AR_WOW_BEACON_FAIL))
-#define AR_WOW_CLEAR_EVENTS(x)          (x & ~(AR_WOW_PATTERN_EN(0xff) | \
-                                               AR_WOW_MAGIC_EN | \
-                                               AR_WOW_MAC_INTR_EN | \
-                                               AR_WOW_BEACON_FAIL | \
-                                               AR_WOW_KEEP_ALIVE_FAIL))
-
-/* AR_WOW_COUNT register values */
-#define AR_WOW_AIFS_CNT(x)              (x & 0xff)
-#define AR_WOW_SLOT_CNT(x)              ((x & 0xff) << 8)
-#define AR_WOW_KEEP_ALIVE_CNT(x)        ((x & 0xff) << 16)
-
-/* AR_WOW_BCN_EN register */
-#define AR_WOW_BEACON_FAIL_EN           0x00000001
-
-/* AR_WOW_BCN_TIMO rgister */
-#define AR_WOW_BEACON_TIMO              0x40000000 /* valid if BCN_EN is set */
-
-/* AR_WOW_KEEP_ALIVE_TIMO register */
-#define AR_WOW_KEEP_ALIVE_TIMO_VALUE
-#define AR_WOW_KEEP_ALIVE_NEVER         0xffffffff
-
-/* AR_WOW_KEEP_ALIVE register  */
-#define AR_WOW_KEEP_ALIVE_AUTO_DIS      0x00000001
-#define AR_WOW_KEEP_ALIVE_FAIL_DIS      0x00000002
-
-/* AR_WOW_KEEP_ALIVE_DELAY register */
-#define AR_WOW_KEEP_ALIVE_DELAY_VALUE   0x000003e8 /* 1 msec */
-
-
-/*
- * keep it long for beacon workaround - ensure no false alarm
- */
-#define AR_WOW_BMISSTHRESHOLD           0x20
-
-/* AR_WOW_PATTERN_MATCH register */
-#define AR_WOW_PAT_END_OF_PKT(x)        (x & 0xf)
-#define AR_WOW_PAT_OFF_MATCH(x)         ((x & 0xf) << 8)
-
-/*
- * default values for Wow Configuration for backoff, aifs, slot, keep-alive
- * to be programmed into various registers.
- */
-#define AR_WOW_PAT_BACKOFF      0x00000004 /* AR_WOW_PATTERN_REG */
-#define AR_WOW_CNT_AIFS_CNT     0x00000022 /* AR_WOW_COUNT_REG */
-#define AR_WOW_CNT_SLOT_CNT     0x00000009 /* AR_WOW_COUNT_REG */
-/*
- * Keepalive count applicable for AR9280 2.0 and above.
- */
-#define AR_WOW_CNT_KA_CNT 0x00000008    /* AR_WOW_COUNT register */
-
-/* WoW - Transmit buffer for keep alive frames */
-#define AR_WOW_TRANSMIT_BUFFER  0xe000 /* E000 - EFFC */
-
-#define AR_WOW_TXBUF(i)         (AR_WOW_TRANSMIT_BUFFER + ((i) << 2))
-
-#define AR_WOW_KA_DESC_WORD2    0xe000
-
-#define AR_WOW_KA_DATA_WORD0    0xe030
-
-/* WoW Transmit Buffer for patterns */
-#define AR_WOW_TB_PATTERN(i)    (0xe100 + (i << 8))
-#define AR_WOW_TB_MASK(i)       (0xec00 + (i << 5))
-
-/* Currently Pattern 0-7 are supported - so bit 0-7 are set */
-#define AR_WOW_PATTERN_SUPPORTED        0xff
-#define AR_WOW_LENGTH_MAX               0xff
-#define AR_WOW_LEN1_SHIFT(_i)   ((0x3 - ((_i) & 0x3)) << 0x3)
-#define AR_WOW_LENGTH1_MASK(_i) (AR_WOW_LENGTH_MAX << AR_WOW_LEN1_SHIFT(_i))
-#define AR_WOW_LEN2_SHIFT(_i)   ((0x7 - ((_i) & 0x7)) << 0x3)
-#define AR_WOW_LENGTH2_MASK(_i) (AR_WOW_LENGTH_MAX << AR_WOW_LEN2_SHIFT(_i))
-
 #define AR9271_CORE_CLOCK       117   /* clock to 117Mhz */
 #define AR9271_TARGET_BAUD_RATE 19200 /* 115200 */
 
diff --git a/drivers/net/wireless/ath/ath9k/reg_wow.h b/drivers/net/wireless/ath/ath9k/reg_wow.h
new file mode 100644
index 000000000000..3abfca56ca58
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/reg_wow.h
@@ -0,0 +1,128 @@
+/*
+ * Copyright (c) 2015 Qualcomm Atheros Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef REG_WOW_H
+#define REG_WOW_H
+
+#define AR_WOW_PATTERN                  0x825C
+#define AR_WOW_COUNT                    0x8260
+#define AR_WOW_BCN_EN                   0x8270
+#define AR_WOW_BCN_TIMO                 0x8274
+#define AR_WOW_KEEP_ALIVE_TIMO          0x8278
+#define AR_WOW_KEEP_ALIVE               0x827c
+#define AR_WOW_KEEP_ALIVE_DELAY         0x8288
+#define AR_WOW_PATTERN_MATCH            0x828c
+
+/*
+ * AR_WOW_LENGTH1
+ * bit 31:24 pattern 0 length
+ * bit 23:16 pattern 1 length
+ * bit 15:8 pattern 2 length
+ * bit 7:0 pattern 3 length
+ *
+ * AR_WOW_LENGTH2
+ * bit 31:24 pattern 4 length
+ * bit 23:16 pattern 5 length
+ * bit 15:8 pattern 6 length
+ * bit 7:0 pattern 7 length
+ *
+ * AR_WOW_LENGTH3
+ * bit 31:24 pattern 8 length
+ * bit 23:16 pattern 9 length
+ * bit 15:8 pattern 10 length
+ * bit 7:0 pattern 11 length
+ *
+ * AR_WOW_LENGTH4
+ * bit 31:24 pattern 12 length
+ * bit 23:16 pattern 13 length
+ * bit 15:8 pattern 14 length
+ * bit 7:0 pattern 15 length
+ */
+#define AR_WOW_LENGTH1                  0x8360
+#define AR_WOW_LENGTH2                  0X8364
+#define AR_WOW_LENGTH3                  0X8380
+#define AR_WOW_LENGTH4                  0X8384
+
+#define AR_WOW_PATTERN_MATCH_LT_256B    0x8368
+#define AR_MAC_PCU_WOW4                 0x8370
+
+#define AR_SW_WOW_CONTROL               0x20018
+#define AR_SW_WOW_ENABLE                0x1
+#define AR_SWITCH_TO_REFCLK             0x2
+#define AR_RESET_CONTROL                0x4
+#define AR_RESET_VALUE_MASK             0x8
+#define AR_HW_WOW_DISABLE               0x10
+#define AR_CLR_MAC_INTERRUPT            0x20
+#define AR_CLR_KA_INTERRUPT             0x40
+
+#define AR_WOW_BACK_OFF_SHIFT(x)        ((x & 0xf) << 27) /* in usecs */
+#define AR_WOW_MAC_INTR_EN              0x00040000
+#define AR_WOW_MAGIC_EN                 0x00010000
+#define AR_WOW_PATTERN_EN(x)            (x & 0xff)
+#define AR_WOW_PAT_FOUND_SHIFT  8
+#define AR_WOW_PATTERN_FOUND(x)         (x & (0xff << AR_WOW_PAT_FOUND_SHIFT))
+#define AR_WOW_PATTERN_FOUND_MASK       ((0xff) << AR_WOW_PAT_FOUND_SHIFT)
+#define AR_WOW_MAGIC_PAT_FOUND          0x00020000
+#define AR_WOW_MAC_INTR                 0x00080000
+#define AR_WOW_KEEP_ALIVE_FAIL          0x00100000
+#define AR_WOW_BEACON_FAIL              0x00200000
+
+#define AR_WOW_STATUS(x)                (x & (AR_WOW_PATTERN_FOUND_MASK | \
+                                              AR_WOW_MAGIC_PAT_FOUND    | \
+                                              AR_WOW_KEEP_ALIVE_FAIL    | \
+                                              AR_WOW_BEACON_FAIL))
+#define AR_WOW_CLEAR_EVENTS(x)          (x & ~(AR_WOW_PATTERN_EN(0xff) | \
+                                               AR_WOW_MAGIC_EN |        \
+                                               AR_WOW_MAC_INTR_EN |     \
+                                               AR_WOW_BEACON_FAIL |     \
+                                               AR_WOW_KEEP_ALIVE_FAIL))
+
+#define AR_WOW_AIFS_CNT(x)              (x & 0xff)
+#define AR_WOW_SLOT_CNT(x)              ((x & 0xff) << 8)
+#define AR_WOW_KEEP_ALIVE_CNT(x)        ((x & 0xff) << 16)
+
+#define AR_WOW_BEACON_FAIL_EN           0x00000001
+#define AR_WOW_BEACON_TIMO              0x40000000
+#define AR_WOW_KEEP_ALIVE_NEVER         0xffffffff
+#define AR_WOW_KEEP_ALIVE_AUTO_DIS      0x00000001
+#define AR_WOW_KEEP_ALIVE_FAIL_DIS      0x00000002
+#define AR_WOW_KEEP_ALIVE_DELAY_VALUE   0x000003e8 /* 1 msec */
+#define AR_WOW_BMISSTHRESHOLD           0x20
+#define AR_WOW_PAT_END_OF_PKT(x)        (x & 0xf)
+#define AR_WOW_PAT_OFF_MATCH(x)         ((x & 0xf) << 8)
+#define AR_WOW_PAT_BACKOFF              0x00000004
+#define AR_WOW_CNT_AIFS_CNT             0x00000022
+#define AR_WOW_CNT_SLOT_CNT             0x00000009
+#define AR_WOW_CNT_KA_CNT               0x00000008
+
+#define AR_WOW_TRANSMIT_BUFFER          0xe000
+#define AR_WOW_TXBUF(i)                 (AR_WOW_TRANSMIT_BUFFER + ((i) << 2))
+#define AR_WOW_KA_DESC_WORD2            0xe000
+#define AR_WOW_TB_PATTERN(i)            (0xe100 + (i << 8))
+#define AR_WOW_TB_MASK(i)               (0xec00 + (i << 5))
+#define AR_WOW_PATTERN_SUPPORTED_LEGACY 0xff
+#define AR_WOW_PATTERN_SUPPORTED        0xffff
+#define AR_WOW_LENGTH_MAX               0xff
+#define AR_WOW_LEN1_SHIFT(_i)           ((0x3 - ((_i) & 0x3)) << 0x3)
+#define AR_WOW_LENGTH1_MASK(_i)         (AR_WOW_LENGTH_MAX << AR_WOW_LEN1_SHIFT(_i))
+#define AR_WOW_LEN2_SHIFT(_i)           ((0x7 - ((_i) & 0x7)) << 0x3)
+#define AR_WOW_LENGTH2_MASK(_i)         (AR_WOW_LENGTH_MAX << AR_WOW_LEN2_SHIFT(_i))
+#define AR_WOW_LEN3_SHIFT(_i)           ((0xb - ((_i) & 0xb)) << 0x3)
+#define AR_WOW_LENGTH3_MASK(_i)         (AR_WOW_LENGTH_MAX << AR_WOW_LEN3_SHIFT(_i))
+#define AR_WOW_LEN4_SHIFT(_i)           ((0xf - ((_i) & 0xf)) << 0x3)
+#define AR_WOW_LENGTH4_MASK(_i)         (AR_WOW_LENGTH_MAX << AR_WOW_LEN4_SHIFT(_i))
+
+#endif /* REG_WOW_H */
diff --git a/drivers/net/wireless/ath/ath9k/wow.c b/drivers/net/wireless/ath/ath9k/wow.c
index 5f30e580d942..8d0b1730a9d5 100644
--- a/drivers/net/wireless/ath/ath9k/wow.c
+++ b/drivers/net/wireless/ath/ath9k/wow.c
@@ -16,36 +16,43 @@
 
 #include "ath9k.h"
 
-static const struct wiphy_wowlan_support ath9k_wowlan_support = {
+static const struct wiphy_wowlan_support ath9k_wowlan_support_legacy = {
         .flags = WIPHY_WOWLAN_MAGIC_PKT | WIPHY_WOWLAN_DISCONNECT,
         .n_patterns = MAX_NUM_USER_PATTERN,
         .pattern_min_len = 1,
         .pattern_max_len = MAX_PATTERN_SIZE,
 };
 
-static void ath9k_wow_map_triggers(struct ath_softc *sc,
-                                   struct cfg80211_wowlan *wowlan,
-                                   u32 *wow_triggers)
+static const struct wiphy_wowlan_support ath9k_wowlan_support = {
+        .flags = WIPHY_WOWLAN_MAGIC_PKT | WIPHY_WOWLAN_DISCONNECT,
+        .n_patterns = MAX_NUM_PATTERN - 2,
+        .pattern_min_len = 1,
+        .pattern_max_len = MAX_PATTERN_SIZE,
+};
+
+static u8 ath9k_wow_map_triggers(struct ath_softc *sc,
+                                 struct cfg80211_wowlan *wowlan)
 {
+        u8 wow_triggers = 0;
+
         if (wowlan->disconnect)
-                *wow_triggers |= AH_WOW_LINK_CHANGE |
-                                 AH_WOW_BEACON_MISS;
+                wow_triggers |= AH_WOW_LINK_CHANGE |
+                                AH_WOW_BEACON_MISS;
         if (wowlan->magic_pkt)
-                *wow_triggers |= AH_WOW_MAGIC_PATTERN_EN;
+                wow_triggers |= AH_WOW_MAGIC_PATTERN_EN;
 
         if (wowlan->n_patterns)
-                *wow_triggers |= AH_WOW_USER_PATTERN_EN;
-
-        sc->wow_enabled = *wow_triggers;
+                wow_triggers |= AH_WOW_USER_PATTERN_EN;
 
+        return wow_triggers;
 }
 
-static void ath9k_wow_add_disassoc_deauth_pattern(struct ath_softc *sc)
+static int ath9k_wow_add_disassoc_deauth_pattern(struct ath_softc *sc)
 {
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
         int pattern_count = 0;
-        int i, byte_cnt;
+        int ret, i, byte_cnt = 0;
         u8 dis_deauth_pattern[MAX_PATTERN_SIZE];
         u8 dis_deauth_mask[MAX_PATTERN_SIZE];
 
@@ -80,12 +87,7 @@ static void ath9k_wow_add_disassoc_deauth_pattern(struct ath_softc *sc)
          *                          | x:x:x:x:x:x  -- 22 bytes
          */
 
-        /* Create Disassociate Pattern first */
-
-        byte_cnt = 0;
-
         /* Fill out the mask with all FF's */
-
         for (i = 0; i < MAX_PATTERN_MASK_SIZE; i++)
                 dis_deauth_mask[i] = 0xff;
 
@@ -108,19 +110,17 @@ static void ath9k_wow_add_disassoc_deauth_pattern(struct ath_softc *sc)
         byte_cnt += 6;
 
         /* copy the bssid, its same as the source mac address */
-
         memcpy((dis_deauth_pattern + byte_cnt), common->curbssid, ETH_ALEN);
 
         /* Create Disassociate pattern mask */
-
         dis_deauth_mask[0] = 0xfe;
         dis_deauth_mask[1] = 0x03;
         dis_deauth_mask[2] = 0xc0;
 
-        ath_dbg(common, WOW, "Adding disassoc/deauth patterns for WoW\n");
-
-        ath9k_hw_wow_apply_pattern(ah, dis_deauth_pattern, dis_deauth_mask,
-                                   pattern_count, byte_cnt);
+        ret = ath9k_hw_wow_apply_pattern(ah, dis_deauth_pattern, dis_deauth_mask,
+                                         pattern_count, byte_cnt);
+        if (ret)
+                goto exit;
 
         pattern_count++;
         /*
@@ -129,59 +129,39 @@ static void ath9k_wow_add_disassoc_deauth_pattern(struct ath_softc *sc)
          */
         dis_deauth_pattern[0] = 0xC0;
 
-        ath9k_hw_wow_apply_pattern(ah, dis_deauth_pattern, dis_deauth_mask,
-                                   pattern_count, byte_cnt);
-
+        ret = ath9k_hw_wow_apply_pattern(ah, dis_deauth_pattern, dis_deauth_mask,
+                                         pattern_count, byte_cnt);
+exit:
+        return ret;
 }
 
-static void ath9k_wow_add_pattern(struct ath_softc *sc,
-                                  struct cfg80211_wowlan *wowlan)
+static int ath9k_wow_add_pattern(struct ath_softc *sc,
+                                 struct cfg80211_wowlan *wowlan)
 {
         struct ath_hw *ah = sc->sc_ah;
-        struct ath9k_wow_pattern *wow_pattern = NULL;
         struct cfg80211_pkt_pattern *patterns = wowlan->patterns;
-        int mask_len;
+        u8 wow_pattern[MAX_PATTERN_SIZE];
+        u8 wow_mask[MAX_PATTERN_SIZE];
+        int mask_len, ret = 0;
         s8 i = 0;
 
-        if (!wowlan->n_patterns)
-                return;
-
-        /*
-         * Add the new user configured patterns
-         */
         for (i = 0; i < wowlan->n_patterns; i++) {
-
-                wow_pattern = kzalloc(sizeof(*wow_pattern), GFP_KERNEL);
-
-                if (!wow_pattern)
-                        return;
-
-                /*
-                 * TODO: convert the generic user space pattern to
-                 * appropriate chip specific/802.11 pattern.
-                 */
-
-                mask_len = DIV_ROUND_UP(wowlan->patterns[i].pattern_len, 8);
-                memset(wow_pattern->pattern_bytes, 0, MAX_PATTERN_SIZE);
-                memset(wow_pattern->mask_bytes, 0, MAX_PATTERN_SIZE);
-                memcpy(wow_pattern->pattern_bytes, patterns[i].pattern,
-                       patterns[i].pattern_len);
-                memcpy(wow_pattern->mask_bytes, patterns[i].mask, mask_len);
-                wow_pattern->pattern_len = patterns[i].pattern_len;
-
-                /*
-                 * just need to take care of deauth and disssoc pattern,
-                 * make sure we don't overwrite them.
-                 */
-
-                ath9k_hw_wow_apply_pattern(ah, wow_pattern->pattern_bytes,
-                                           wow_pattern->mask_bytes,
-                                           i + 2,
-                                           wow_pattern->pattern_len);
-                kfree(wow_pattern);
-
+                mask_len = DIV_ROUND_UP(patterns[i].pattern_len, 8);
+                memset(wow_pattern, 0, MAX_PATTERN_SIZE);
+                memset(wow_mask, 0, MAX_PATTERN_SIZE);
+                memcpy(wow_pattern, patterns[i].pattern, patterns[i].pattern_len);
+                memcpy(wow_mask, patterns[i].mask, mask_len);
+
+                ret = ath9k_hw_wow_apply_pattern(ah,
+                                                 wow_pattern,
+                                                 wow_mask,
+                                                 i + 2,
+                                                 patterns[i].pattern_len);
+                if (ret)
+                        break;
         }
 
+        return ret;
 }
 
 int ath9k_suspend(struct ieee80211_hw *hw,
@@ -190,41 +170,39 @@ int ath9k_suspend(struct ieee80211_hw *hw,
         struct ath_softc *sc = hw->priv;
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
-        u32 wow_triggers_enabled = 0;
+        u8 triggers;
         int ret = 0;
 
         ath9k_deinit_channel_context(sc);
 
         mutex_lock(&sc->mutex);
 
-        ath_cancel_work(sc);
-        ath_stop_ani(sc);
-
         if (test_bit(ATH_OP_INVALID, &common->op_flags)) {
-                ath_dbg(common, ANY, "Device not present\n");
-                ret = -EINVAL;
+                ath_err(common, "Device not present\n");
+                ret = -ENODEV;
                 goto fail_wow;
         }
 
         if (WARN_ON(!wowlan)) {
-                ath_dbg(common, WOW, "None of the WoW triggers enabled\n");
+                ath_err(common, "None of the WoW triggers enabled\n");
                 ret = -EINVAL;
                 goto fail_wow;
         }
 
-        if (!device_can_wakeup(sc->dev)) {
-                ath_dbg(common, WOW, "device_can_wakeup failed, WoW is not enabled\n");
+        if (sc->cur_chan->nvifs > 1) {
+                ath_dbg(common, WOW, "WoW for multivif is not yet supported\n");
                 ret = 1;
                 goto fail_wow;
         }
 
-        /*
-         * none of the sta vifs are associated
-         * and we are not currently handling multivif
-         * cases, for instance we have to seperately
-         * configure 'keep alive frame' for each
-         * STA.
-         */
+        if (ath9k_is_chanctx_enabled()) {
+                if (test_bit(ATH_OP_MULTI_CHANNEL, &common->op_flags)) {
+                        ath_dbg(common, WOW,
+                                "Multi-channel WOW is not supported\n");
+                        ret = 1;
+                        goto fail_wow;
+                }
+        }
 
         if (!test_bit(ATH_OP_PRIM_STA_VIF, &common->op_flags)) {
                 ath_dbg(common, WOW, "None of the STA vifs are associated\n");
@@ -232,16 +210,15 @@ int ath9k_suspend(struct ieee80211_hw *hw,
                 goto fail_wow;
         }
 
-        if (sc->cur_chan->nvifs > 1) {
-                ath_dbg(common, WOW, "WoW for multivif is not yet supported\n");
+        triggers = ath9k_wow_map_triggers(sc, wowlan);
+        if (!triggers) {
+                ath_dbg(common, WOW, "No valid WoW triggers\n");
                 ret = 1;
                 goto fail_wow;
         }
 
-        ath9k_wow_map_triggers(sc, wowlan, &wow_triggers_enabled);
-
-        ath_dbg(common, WOW, "WoW triggers enabled 0x%x\n",
-                wow_triggers_enabled);
+        ath_cancel_work(sc);
+        ath_stop_ani(sc);
 
         ath9k_ps_wakeup(sc);
 
@@ -251,10 +228,21 @@ int ath9k_suspend(struct ieee80211_hw *hw,
          * Enable wake up on recieving disassoc/deauth
          * frame by default.
          */
-        ath9k_wow_add_disassoc_deauth_pattern(sc);
+        ret = ath9k_wow_add_disassoc_deauth_pattern(sc);
+        if (ret) {
+                ath_err(common,
+                        "Unable to add disassoc/deauth pattern: %d\n", ret);
+                goto fail_wow;
+        }
 
-        if (wow_triggers_enabled & AH_WOW_USER_PATTERN_EN)
-                ath9k_wow_add_pattern(sc, wowlan);
+        if (triggers & AH_WOW_USER_PATTERN_EN) {
+                ret = ath9k_wow_add_pattern(sc, wowlan);
+                if (ret) {
+                        ath_err(common,
+                                "Unable to add user pattern: %d\n", ret);
+                        goto fail_wow;
+                }
+        }
 
         spin_lock_bh(&sc->sc_pcu_lock);
         /*
@@ -278,12 +266,12 @@ int ath9k_suspend(struct ieee80211_hw *hw,
         synchronize_irq(sc->irq);
         tasklet_kill(&sc->intr_tq);
 
-        ath9k_hw_wow_enable(ah, wow_triggers_enabled);
+        ath9k_hw_wow_enable(ah, triggers);
 
         ath9k_ps_restore(sc);
-        ath_dbg(common, ANY, "WoW enabled in ath9k\n");
-        atomic_inc(&sc->wow_sleep_proc_intr);
+        ath_dbg(common, WOW, "Suspend with WoW triggers: 0x%x\n", triggers);
 
+        set_bit(ATH_OP_WOW_ENABLED, &common->op_flags);
 fail_wow:
         mutex_unlock(&sc->mutex);
         return ret;
@@ -294,7 +282,7 @@ int ath9k_resume(struct ieee80211_hw *hw)
         struct ath_softc *sc = hw->priv;
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
-        u32 wow_status;
+        u8 status;
 
         mutex_lock(&sc->mutex);
 
@@ -309,29 +297,14 @@ int ath9k_resume(struct ieee80211_hw *hw)
 
         spin_unlock_bh(&sc->sc_pcu_lock);
 
-        wow_status = ath9k_hw_wow_wakeup(ah);
-
-        if (atomic_read(&sc->wow_got_bmiss_intr) == 0) {
-                /*
-                 * some devices may not pick beacon miss
-                 * as the reason they woke up so we add
-                 * that here for that shortcoming.
-                 */
-                wow_status |= AH_WOW_BEACON_MISS;
-                atomic_dec(&sc->wow_got_bmiss_intr);
-                ath_dbg(common, ANY, "Beacon miss interrupt picked up during WoW sleep\n");
-        }
-
-        atomic_dec(&sc->wow_sleep_proc_intr);
-
-        if (wow_status) {
-                ath_dbg(common, ANY, "Waking up due to WoW triggers %s with WoW status = %x\n",
-                        ath9k_hw_wow_event_to_string(wow_status), wow_status);
-        }
+        status = ath9k_hw_wow_wakeup(ah);
+        ath_dbg(common, WOW, "Resume with WoW status: 0x%x\n", status);
 
         ath_restart_work(sc);
         ath9k_start_btcoex(sc);
 
+        clear_bit(ATH_OP_WOW_ENABLED, &common->op_flags);
+
         ath9k_ps_restore(sc);
         mutex_unlock(&sc->mutex);
 
@@ -341,22 +314,35 @@ int ath9k_resume(struct ieee80211_hw *hw)
 void ath9k_set_wakeup(struct ieee80211_hw *hw, bool enabled)
 {
         struct ath_softc *sc = hw->priv;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
 
         mutex_lock(&sc->mutex);
-        device_init_wakeup(sc->dev, 1);
         device_set_wakeup_enable(sc->dev, enabled);
         mutex_unlock(&sc->mutex);
+
+        ath_dbg(common, WOW, "WoW wakeup source is %s\n",
+                (enabled) ? "enabled" : "disabled");
 }
 
 void ath9k_init_wow(struct ieee80211_hw *hw)
 {
         struct ath_softc *sc = hw->priv;
+        struct ath_hw *ah = sc->sc_ah;
+
+        if ((sc->driver_data & ATH9K_PCI_WOW) || sc->force_wow) {
+                if (AR_SREV_9462_20_OR_LATER(ah) || AR_SREV_9565_11_OR_LATER(ah))
+                        hw->wiphy->wowlan = &ath9k_wowlan_support;
+                else
+                        hw->wiphy->wowlan = &ath9k_wowlan_support_legacy;
 
-        if ((sc->sc_ah->caps.hw_caps & ATH9K_HW_WOW_DEVICE_CAPABLE) &&
-            (sc->driver_data & ATH9K_PCI_WOW) &&
-            device_can_wakeup(sc->dev))
-                hw->wiphy->wowlan = &ath9k_wowlan_support;
+                device_init_wakeup(sc->dev, 1);
+        }
+}
+
+void ath9k_deinit_wow(struct ieee80211_hw *hw)
+{
+        struct ath_softc *sc = hw->priv;
 
-        atomic_set(&sc->wow_sleep_proc_intr, -1);
-        atomic_set(&sc->wow_got_bmiss_intr, -1);
+        if ((sc->driver_data & ATH9K_PCI_WOW) || sc->force_wow)
+                device_init_wakeup(sc->dev, 0);
 }
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index e9bd02c2e844..1b8e75c4d2c2 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1097,24 +1097,65 @@ void ath_update_max_aggr_framelen(struct ath_softc *sc, int queue, int txop)
 }
 
 static u8 ath_get_rate_txpower(struct ath_softc *sc, struct ath_buf *bf,
-                               u8 rateidx)
+                               u8 rateidx, bool is_40, bool is_cck)
 {
         u8 max_power;
+        struct sk_buff *skb;
+        struct ath_frame_info *fi;
+        struct ieee80211_tx_info *info;
         struct ath_hw *ah = sc->sc_ah;
 
-        if (sc->tx99_state)
+        if (sc->tx99_state || !ah->tpc_enabled)
                 return MAX_RATE_POWER;
 
+        skb = bf->bf_mpdu;
+        fi = get_frame_info(skb);
+        info = IEEE80211_SKB_CB(skb);
+
         if (!AR_SREV_9300_20_OR_LATER(ah)) {
-                /* ar9002 is not sipported for the moment */
-                return MAX_RATE_POWER;
-        }
+                int txpower = fi->tx_power;
 
-        if (!bf->bf_state.bfs_paprd) {
-                struct sk_buff *skb = bf->bf_mpdu;
-                struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-                struct ath_frame_info *fi = get_frame_info(skb);
+                if (is_40) {
+                        u8 power_ht40delta;
+                        struct ar5416_eeprom_def *eep = &ah->eeprom.def;
+
+                        if (AR5416_VER_MASK >= AR5416_EEP_MINOR_VER_2) {
+                                bool is_2ghz;
+                                struct modal_eep_header *pmodal;
 
+                                is_2ghz = info->band == IEEE80211_BAND_2GHZ;
+                                pmodal = &eep->modalHeader[is_2ghz];
+                                power_ht40delta = pmodal->ht40PowerIncForPdadc;
+                        } else {
+                                power_ht40delta = 2;
+                        }
+                        txpower += power_ht40delta;
+                }
+
+                if (AR_SREV_9287(ah) || AR_SREV_9285(ah) ||
+                    AR_SREV_9271(ah)) {
+                        txpower -= 2 * AR9287_PWR_TABLE_OFFSET_DB;
+                } else if (AR_SREV_9280_20_OR_LATER(ah)) {
+                        s8 power_offset;
+
+                        power_offset = ah->eep_ops->get_eeprom(ah,
+                                                        EEP_PWR_TABLE_OFFSET);
+                        txpower -= 2 * power_offset;
+                }
+
+                if (OLC_FOR_AR9280_20_LATER && is_cck)
+                        txpower -= 2;
+
+                txpower = max(txpower, 0);
+                max_power = min_t(u8, ah->tx_power[rateidx], txpower);
+
+                /* XXX: clamp minimum TX power at 1 for AR9160 since if
+                 * max_power is set to 0, frames are transmitted at max
+                 * TX power
+                 */
+                if (!max_power && !AR_SREV_9280_20_OR_LATER(ah))
+                        max_power = 1;
+        } else if (!bf->bf_state.bfs_paprd) {
                 if (rateidx < 8 && (info->flags & IEEE80211_TX_CTL_STBC))
                         max_power = min(ah->tx_power_stbc[rateidx],
                                         fi->tx_power);
@@ -1152,7 +1193,7 @@ static void ath_buf_set_rate(struct ath_softc *sc, struct ath_buf *bf,
         info->rtscts_rate = fi->rtscts_rate;
 
         for (i = 0; i < ARRAY_SIZE(bf->rates); i++) {
-                bool is_40, is_sgi, is_sp;
+                bool is_40, is_sgi, is_sp, is_cck;
                 int phy;
 
                 if (!rates[i].count || (rates[i].idx < 0))
@@ -1198,7 +1239,8 @@ static void ath_buf_set_rate(struct ath_softc *sc, struct ath_buf *bf,
                         if (rix < 8 && (tx_info->flags & IEEE80211_TX_CTL_STBC))
                                 info->rates[i].RateFlags |= ATH9K_RATESERIES_STBC;
 
-                        info->txpower[i] = ath_get_rate_txpower(sc, bf, rix);
+                        info->txpower[i] = ath_get_rate_txpower(sc, bf, rix,
+                                                                is_40, false);
                         continue;
                 }
 
@@ -1227,7 +1269,9 @@ static void ath_buf_set_rate(struct ath_softc *sc, struct ath_buf *bf,
                 info->rates[i].PktDuration = ath9k_hw_computetxtime(sc->sc_ah,
                         phy, rate->bitrate * 100, len, rix, is_sp);
 
-                info->txpower[i] = ath_get_rate_txpower(sc, bf, rix);
+                is_cck = IS_CCK_RATE(info->rates[i].Rate);
+                info->txpower[i] = ath_get_rate_txpower(sc, bf, rix, false,
+                                                        is_cck);
         }
 
         /* For AR5416 - RTS cannot be followed by a frame larger than 8K */
@@ -2259,7 +2303,7 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
         struct ath_txq *txq = txctl->txq;
         struct ath_atx_tid *tid = NULL;
         struct ath_buf *bf;
-        bool queue, skip_uapsd = false;
+        bool queue, skip_uapsd = false, ps_resp;
         int q, ret;
 
         if (vif)
@@ -2268,6 +2312,8 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
         if (info->flags & IEEE80211_TX_CTL_TX_OFFCHAN)
                 txctl->force_channel = true;
 
+        ps_resp = !!(info->control.flags & IEEE80211_TX_CTRL_PS_RESPONSE);
+
         ret = ath_tx_prepare(hw, skb, txctl);
         if (ret)
             return ret;
@@ -2310,7 +2356,7 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
         if (txctl->an && queue)
                 tid = ath_get_skb_tid(sc, txctl->an, skb);
 
-        if (!skip_uapsd && (info->flags & IEEE80211_TX_CTL_PS_RESPONSE)) {
+        if (!skip_uapsd && ps_resp) {
                 ath_txq_unlock(sc, txq);
                 txq = sc->tx.uapsdq;
                 ath_txq_lock(sc, txq);
@@ -2443,9 +2489,12 @@ static void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
         if (sc->sc_ah->caldata)
                 set_bit(PAPRD_PACKET_SENT, &sc->sc_ah->caldata->cal_flags);
 
-        if (!(tx_flags & ATH_TX_ERROR))
-                /* Frame was ACKed */
-                tx_info->flags |= IEEE80211_TX_STAT_ACK;
+        if (!(tx_flags & ATH_TX_ERROR)) {
+                if (tx_info->flags & IEEE80211_TX_CTL_NO_ACK)
+                        tx_info->flags |= IEEE80211_TX_STAT_NOACK_TRANSMITTED;
+                else
+                        tx_info->flags |= IEEE80211_TX_STAT_ACK;
+        }
 
         padpos = ieee80211_hdrlen(hdr->frame_control);
         padsize = padpos & 3;
diff --git a/drivers/net/wireless/ath/carl9170/cmd.c b/drivers/net/wireless/ath/carl9170/cmd.c
index 39a63874b275..f2b4f537e4c1 100644
--- a/drivers/net/wireless/ath/carl9170/cmd.c
+++ b/drivers/net/wireless/ath/carl9170/cmd.c
@@ -188,12 +188,12 @@ int carl9170_collect_tally(struct ar9170 *ar)
 
                 if (ar->channel) {
                         info = &ar->survey[ar->channel->hw_value];
-                        info->channel_time = ar->tally.active;
-                        info->channel_time_busy = ar->tally.cca;
-                        info->channel_time_tx = ar->tally.tx_time;
-                        do_div(info->channel_time, 1000);
-                        do_div(info->channel_time_busy, 1000);
-                        do_div(info->channel_time_tx, 1000);
+                        info->time = ar->tally.active;
+                        info->time_busy = ar->tally.cca;
+                        info->time_tx = ar->tally.tx_time;
+                        do_div(info->time, 1000);
+                        do_div(info->time_busy, 1000);
+                        do_div(info->time_tx, 1000);
                 }
         }
         return 0;
diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c
index ef5b6dc7b7f1..f1455a04cb62 100644
--- a/drivers/net/wireless/ath/carl9170/main.c
+++ b/drivers/net/wireless/ath/carl9170/main.c
@@ -1690,9 +1690,9 @@ found:
                 survey->filled |= SURVEY_INFO_IN_USE;
 
         if (ar->fw.hw_counters) {
-                survey->filled |= SURVEY_INFO_CHANNEL_TIME |
-                                  SURVEY_INFO_CHANNEL_TIME_BUSY |
-                                  SURVEY_INFO_CHANNEL_TIME_TX;
+                survey->filled |= SURVEY_INFO_TIME |
+                                  SURVEY_INFO_TIME_BUSY |
+                                  SURVEY_INFO_TIME_TX;
         }
 
         return 0;
diff --git a/drivers/net/wireless/ath/dfs_pattern_detector.c b/drivers/net/wireless/ath/dfs_pattern_detector.c
index cfd0554cf140..3d57f8772389 100644
--- a/drivers/net/wireless/ath/dfs_pattern_detector.c
+++ b/drivers/net/wireless/ath/dfs_pattern_detector.c
@@ -86,7 +86,7 @@ static const struct radar_detector_specs fcc_radar_ref_types[] = {
         FCC_PATTERN(1, 0, 5, 150, 230, 1, 23),
         FCC_PATTERN(2, 6, 10, 200, 500, 1, 16),
         FCC_PATTERN(3, 11, 20, 200, 500, 1, 12),
-        FCC_PATTERN(4, 50, 100, 1000, 2000, 1, 20),
+        FCC_PATTERN(4, 50, 100, 1000, 2000, 1, 1),
         FCC_PATTERN(5, 0, 1, 333, 333, 1, 9),
 };
 
diff --git a/drivers/net/wireless/ath/wcn36xx/dxe.c b/drivers/net/wireless/ath/wcn36xx/dxe.c
index 73f12f196f14..086549b732b9 100644
--- a/drivers/net/wireless/ath/wcn36xx/dxe.c
+++ b/drivers/net/wireless/ath/wcn36xx/dxe.c
@@ -84,6 +84,7 @@ static int wcn36xx_dxe_allocate_ctl_block(struct wcn36xx_dxe_ch *ch)
                 if (!cur_ctl)
                         goto out_fail;
 
+                spin_lock_init(&cur_ctl->skb_lock);
                 cur_ctl->ctl_blk_order = i;
                 if (i == 0) {
                         ch->head_blk_ctl = cur_ctl;
@@ -354,6 +355,8 @@ static void reap_tx_dxes(struct wcn36xx *wcn, struct wcn36xx_dxe_ch *ch)
          * and while-do will not make any cycles.
          */
         do {
+                if (ctl->desc->ctrl & WCN36XX_DXE_CTRL_VALID_MASK)
+                        break;
                 if (ctl->skb) {
                         dma_unmap_single(NULL, ctl->desc->src_addr_l,
                                          ctl->skb->len, DMA_TO_DEVICE);
diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c
index 7dd8873f757e..0783d2ed8238 100644
--- a/drivers/net/wireless/ath/wcn36xx/main.c
+++ b/drivers/net/wireless/ath/wcn36xx/main.c
@@ -298,6 +298,8 @@ static int wcn36xx_start(struct ieee80211_hw *hw)
         wcn36xx_debugfs_init(wcn);
 
         INIT_LIST_HEAD(&wcn->vif_list);
+        spin_lock_init(&wcn->dxe_lock);
+
         return 0;
 
 out_smd_stop:
@@ -795,6 +797,7 @@ static int wcn36xx_sta_add(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
         wcn36xx_dbg(WCN36XX_DBG_MAC, "mac sta add vif %p sta %pM\n",
                     vif, sta->addr);
 
+        spin_lock_init(&sta_priv->ampdu_lock);
         vif_priv->sta = sta_priv;
         sta_priv->vif = vif_priv;
         /*
@@ -873,21 +876,32 @@ static int wcn36xx_ampdu_action(struct ieee80211_hw *hw,
                         get_sta_index(vif, sta_priv));
                 wcn36xx_smd_add_ba(wcn);
                 wcn36xx_smd_trigger_ba(wcn, get_sta_index(vif, sta_priv));
-                ieee80211_start_tx_ba_session(sta, tid, 0);
                 break;
         case IEEE80211_AMPDU_RX_STOP:
                 wcn36xx_smd_del_ba(wcn, tid, get_sta_index(vif, sta_priv));
                 break;
         case IEEE80211_AMPDU_TX_START:
+                spin_lock_bh(&sta_priv->ampdu_lock);
+                sta_priv->ampdu_state[tid] = WCN36XX_AMPDU_START;
+                spin_unlock_bh(&sta_priv->ampdu_lock);
+
                 ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
                 break;
         case IEEE80211_AMPDU_TX_OPERATIONAL:
+                spin_lock_bh(&sta_priv->ampdu_lock);
+                sta_priv->ampdu_state[tid] = WCN36XX_AMPDU_OPERATIONAL;
+                spin_unlock_bh(&sta_priv->ampdu_lock);
+
                 wcn36xx_smd_add_ba_session(wcn, sta, tid, ssn, 1,
                         get_sta_index(vif, sta_priv));
                 break;
         case IEEE80211_AMPDU_TX_STOP_FLUSH:
         case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
         case IEEE80211_AMPDU_TX_STOP_CONT:
+                spin_lock_bh(&sta_priv->ampdu_lock);
+                sta_priv->ampdu_state[tid] = WCN36XX_AMPDU_NONE;
+                spin_unlock_bh(&sta_priv->ampdu_lock);
+
                 ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
                 break;
         default:
diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/ath/wcn36xx/smd.c
index 63986931829e..69ed39731902 100644
--- a/drivers/net/wireless/ath/wcn36xx/smd.c
+++ b/drivers/net/wireless/ath/wcn36xx/smd.c
@@ -21,6 +21,61 @@
 #include <linux/bitops.h>
 #include "smd.h"
 
+struct wcn36xx_cfg_val {
+        u32 cfg_id;
+        u32 value;
+};
+
+#define WCN36XX_CFG_VAL(id, val) \
+{ \
+        .cfg_id = WCN36XX_HAL_CFG_ ## id, \
+        .value = val \
+}
+
+static struct wcn36xx_cfg_val wcn36xx_cfg_vals[] = {
+        WCN36XX_CFG_VAL(CURRENT_TX_ANTENNA, 1),
+        WCN36XX_CFG_VAL(CURRENT_RX_ANTENNA, 1),
+        WCN36XX_CFG_VAL(LOW_GAIN_OVERRIDE, 0),
+        WCN36XX_CFG_VAL(POWER_STATE_PER_CHAIN, 785),
+        WCN36XX_CFG_VAL(CAL_PERIOD, 5),
+        WCN36XX_CFG_VAL(CAL_CONTROL, 1),
+        WCN36XX_CFG_VAL(PROXIMITY, 0),
+        WCN36XX_CFG_VAL(NETWORK_DENSITY, 3),
+        WCN36XX_CFG_VAL(MAX_MEDIUM_TIME, 6000),
+        WCN36XX_CFG_VAL(MAX_MPDUS_IN_AMPDU, 64),
+        WCN36XX_CFG_VAL(RTS_THRESHOLD, 2347),
+        WCN36XX_CFG_VAL(SHORT_RETRY_LIMIT, 6),
+        WCN36XX_CFG_VAL(LONG_RETRY_LIMIT, 6),
+        WCN36XX_CFG_VAL(FRAGMENTATION_THRESHOLD, 8000),
+        WCN36XX_CFG_VAL(DYNAMIC_THRESHOLD_ZERO, 5),
+        WCN36XX_CFG_VAL(DYNAMIC_THRESHOLD_ONE, 10),
+        WCN36XX_CFG_VAL(DYNAMIC_THRESHOLD_TWO, 15),
+        WCN36XX_CFG_VAL(FIXED_RATE, 0),
+        WCN36XX_CFG_VAL(RETRYRATE_POLICY, 4),
+        WCN36XX_CFG_VAL(RETRYRATE_SECONDARY, 0),
+        WCN36XX_CFG_VAL(RETRYRATE_TERTIARY, 0),
+        WCN36XX_CFG_VAL(FORCE_POLICY_PROTECTION, 5),
+        WCN36XX_CFG_VAL(FIXED_RATE_MULTICAST_24GHZ, 1),
+        WCN36XX_CFG_VAL(FIXED_RATE_MULTICAST_5GHZ, 5),
+        WCN36XX_CFG_VAL(DEFAULT_RATE_INDEX_5GHZ, 5),
+        WCN36XX_CFG_VAL(MAX_BA_SESSIONS, 40),
+        WCN36XX_CFG_VAL(PS_DATA_INACTIVITY_TIMEOUT, 200),
+        WCN36XX_CFG_VAL(PS_ENABLE_BCN_FILTER, 1),
+        WCN36XX_CFG_VAL(PS_ENABLE_RSSI_MONITOR, 1),
+        WCN36XX_CFG_VAL(NUM_BEACON_PER_RSSI_AVERAGE, 20),
+        WCN36XX_CFG_VAL(STATS_PERIOD, 10),
+        WCN36XX_CFG_VAL(CFP_MAX_DURATION, 30000),
+        WCN36XX_CFG_VAL(FRAME_TRANS_ENABLED, 0),
+        WCN36XX_CFG_VAL(BA_THRESHOLD_HIGH, 128),
+        WCN36XX_CFG_VAL(MAX_BA_BUFFERS, 2560),
+        WCN36XX_CFG_VAL(DYNAMIC_PS_POLL_VALUE, 0),
+        WCN36XX_CFG_VAL(TX_PWR_CTRL_ENABLE, 1),
+        WCN36XX_CFG_VAL(ENABLE_CLOSE_LOOP, 1),
+        WCN36XX_CFG_VAL(ENABLE_LPWR_IMG_TRANSITION, 0),
+        WCN36XX_CFG_VAL(MAX_ASSOC_LIMIT, 10),
+        WCN36XX_CFG_VAL(ENABLE_MCC_ADAPTIVE_SCHEDULER, 0),
+};
+
 static int put_cfg_tlv_u32(struct wcn36xx *wcn, size_t *len, u32 id, u32 value)
 {
         struct wcn36xx_hal_cfg *entry;
@@ -357,8 +412,10 @@ static int wcn36xx_smd_start_rsp(struct wcn36xx *wcn, void *buf, size_t len)
 
 int wcn36xx_smd_start(struct wcn36xx *wcn)
 {
-        struct wcn36xx_hal_mac_start_req_msg msg_body;
+        struct wcn36xx_hal_mac_start_req_msg msg_body, *body;
         int ret = 0;
+        int i;
+        size_t len;
 
         mutex_lock(&wcn->hal_mutex);
         INIT_HAL_MSG(msg_body, WCN36XX_HAL_START_REQ);
@@ -368,10 +425,22 @@ int wcn36xx_smd_start(struct wcn36xx *wcn)
 
         PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
 
+        body = (struct wcn36xx_hal_mac_start_req_msg *)wcn->hal_buf;
+        len = body->header.len;
+
+        for (i = 0; i < ARRAY_SIZE(wcn36xx_cfg_vals); i++) {
+                ret = put_cfg_tlv_u32(wcn, &len, wcn36xx_cfg_vals[i].cfg_id,
+                                      wcn36xx_cfg_vals[i].value);
+                if (ret)
+                        goto out;
+        }
+        body->header.len = len;
+        body->params.len = len - sizeof(*body);
+
         wcn36xx_dbg(WCN36XX_DBG_HAL, "hal start type %d\n",
                     msg_body.params.type);
 
-        ret = wcn36xx_smd_send_and_wait(wcn, msg_body.header.len);
+        ret = wcn36xx_smd_send_and_wait(wcn, body->header.len);
         if (ret) {
                 wcn36xx_err("Sending hal_start failed\n");
                 goto out;
diff --git a/drivers/net/wireless/ath/wcn36xx/txrx.c b/drivers/net/wireless/ath/wcn36xx/txrx.c
index 32bb26a0db2a..9bec8237231d 100644
--- a/drivers/net/wireless/ath/wcn36xx/txrx.c
+++ b/drivers/net/wireless/ath/wcn36xx/txrx.c
@@ -93,6 +93,7 @@ static void wcn36xx_set_tx_pdu(struct wcn36xx_tx_bd *bd,
                 bd->pdu.mpdu_header_off;
         bd->pdu.mpdu_len = len;
         bd->pdu.tid = tid;
+        bd->pdu.bd_ssn = WCN36XX_TXBD_SSN_FILL_DPU_QOS;
 }
 
 static inline struct wcn36xx_vif *get_vif_by_addr(struct wcn36xx *wcn,
@@ -110,15 +111,54 @@ static inline struct wcn36xx_vif *get_vif_by_addr(struct wcn36xx *wcn,
         wcn36xx_warn("vif %pM not found\n", addr);
         return NULL;
 }
+
+static void wcn36xx_tx_start_ampdu(struct wcn36xx *wcn,
+                                   struct wcn36xx_sta *sta_priv,
+                                   struct sk_buff *skb)
+{
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        struct ieee80211_sta *sta;
+        u8 *qc, tid;
+
+        if (!conf_is_ht(&wcn->hw->conf))
+                return;
+
+        sta = wcn36xx_priv_to_sta(sta_priv);
+
+        if (WARN_ON(!ieee80211_is_data_qos(hdr->frame_control)))
+                return;
+
+        if (skb_get_queue_mapping(skb) == IEEE80211_AC_VO)
+                return;
+
+        qc = ieee80211_get_qos_ctl(hdr);
+        tid = qc[0] & IEEE80211_QOS_CTL_TID_MASK;
+
+        spin_lock(&sta_priv->ampdu_lock);
+        if (sta_priv->ampdu_state[tid] != WCN36XX_AMPDU_NONE)
+                goto out_unlock;
+
+        if (sta_priv->non_agg_frame_ct++ >= WCN36XX_AMPDU_START_THRESH) {
+                sta_priv->ampdu_state[tid] = WCN36XX_AMPDU_START;
+                sta_priv->non_agg_frame_ct = 0;
+                ieee80211_start_tx_ba_session(sta, tid, 0);
+        }
+out_unlock:
+        spin_unlock(&sta_priv->ampdu_lock);
+}
+
 static void wcn36xx_set_tx_data(struct wcn36xx_tx_bd *bd,
                                 struct wcn36xx *wcn,
                                 struct wcn36xx_vif **vif_priv,
                                 struct wcn36xx_sta *sta_priv,
-                                struct ieee80211_hdr *hdr,
+                                struct sk_buff *skb,
                                 bool bcast)
 {
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         struct ieee80211_vif *vif = NULL;
         struct wcn36xx_vif *__vif_priv = NULL;
+        bool is_data_qos;
+
         bd->bd_rate = WCN36XX_BD_RATE_DATA;
 
         /*
@@ -157,14 +197,26 @@ static void wcn36xx_set_tx_data(struct wcn36xx_tx_bd *bd,
                 bd->ack_policy = 1;
         }
         *vif_priv = __vif_priv;
+
+        is_data_qos = ieee80211_is_data_qos(hdr->frame_control);
+
+        wcn36xx_set_tx_pdu(bd,
+                           is_data_qos ?
+                           sizeof(struct ieee80211_qos_hdr) :
+                           sizeof(struct ieee80211_hdr_3addr),
+                           skb->len, sta_priv ? sta_priv->tid : 0);
+
+        if (sta_priv && is_data_qos)
+                wcn36xx_tx_start_ampdu(wcn, sta_priv, skb);
 }
 
 static void wcn36xx_set_tx_mgmt(struct wcn36xx_tx_bd *bd,
                                 struct wcn36xx *wcn,
                                 struct wcn36xx_vif **vif_priv,
-                                struct ieee80211_hdr *hdr,
+                                struct sk_buff *skb,
                                 bool bcast)
 {
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         struct wcn36xx_vif *__vif_priv =
                 get_vif_by_addr(wcn, hdr->addr2);
         bd->sta_index = __vif_priv->self_sta_index;
@@ -198,6 +250,12 @@ static void wcn36xx_set_tx_mgmt(struct wcn36xx_tx_bd *bd,
         } else
                 bd->queue_id = WCN36XX_TX_U_WQ_ID;
         *vif_priv = __vif_priv;
+
+        wcn36xx_set_tx_pdu(bd,
+                           ieee80211_is_data_qos(hdr->frame_control) ?
+                           sizeof(struct ieee80211_qos_hdr) :
+                           sizeof(struct ieee80211_hdr_3addr),
+                           skb->len, WCN36XX_TID);
 }
 
 int wcn36xx_start_tx(struct wcn36xx *wcn,
@@ -237,7 +295,7 @@ int wcn36xx_start_tx(struct wcn36xx *wcn,
 
         bd->dpu_rf = WCN36XX_BMU_WQ_TX;
 
-        bd->tx_comp = info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS;
+        bd->tx_comp = !!(info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS);
         if (bd->tx_comp) {
                 wcn36xx_dbg(WCN36XX_DBG_DXE, "TX_ACK status requested\n");
                 spin_lock_irqsave(&wcn->dxe_lock, flags);
@@ -259,22 +317,11 @@ int wcn36xx_start_tx(struct wcn36xx *wcn,
         }
 
         /* Data frames served first*/
-        if (is_low) {
-                wcn36xx_set_tx_data(bd, wcn, &vif_priv, sta_priv, hdr, bcast);
-                wcn36xx_set_tx_pdu(bd,
-                           ieee80211_is_data_qos(hdr->frame_control) ?
-                           sizeof(struct ieee80211_qos_hdr) :
-                           sizeof(struct ieee80211_hdr_3addr),
-                           skb->len, sta_priv ? sta_priv->tid : 0);
-        } else {
+        if (is_low)
+                wcn36xx_set_tx_data(bd, wcn, &vif_priv, sta_priv, skb, bcast);
+        else
                 /* MGMT and CTRL frames are handeld here*/
-                wcn36xx_set_tx_mgmt(bd, wcn, &vif_priv, hdr, bcast);
-                wcn36xx_set_tx_pdu(bd,
-                           ieee80211_is_data_qos(hdr->frame_control) ?
-                           sizeof(struct ieee80211_qos_hdr) :
-                           sizeof(struct ieee80211_hdr_3addr),
-                           skb->len, WCN36XX_TID);
-        }
+                wcn36xx_set_tx_mgmt(bd, wcn, &vif_priv, skb, bcast);
 
         buff_to_be((u32 *)bd, sizeof(*bd)/sizeof(u32));
         bd->tx_bd_sign = 0xbdbdbdbd;
diff --git a/drivers/net/wireless/ath/wcn36xx/txrx.h b/drivers/net/wireless/ath/wcn36xx/txrx.h
index bbfbcf808c77..032216e82b2b 100644
--- a/drivers/net/wireless/ath/wcn36xx/txrx.h
+++ b/drivers/net/wireless/ath/wcn36xx/txrx.h
@@ -32,6 +32,12 @@
 #define WCN36XX_BD_RATE_MGMT 2
 #define WCN36XX_BD_RATE_CTRL 3
 
+enum wcn36xx_txbd_ssn_type {
+        WCN36XX_TXBD_SSN_FILL_HOST = 0,
+        WCN36XX_TXBD_SSN_FILL_DPU_NON_QOS = 1,
+        WCN36XX_TXBD_SSN_FILL_DPU_QOS = 2,
+};
+
 struct wcn36xx_pdu {
         u32     dpu_fb:8;
         u32     adu_fb:8;
@@ -50,7 +56,8 @@ struct wcn36xx_pdu {
         /* 0x0c*/
         u32     reserved4:8;
         u32     tid:4;
-        u32     reserved3:4;
+        u32     bd_ssn:2;
+        u32     reserved3:2;
         u32     mpdu_len:16;
 };
 
diff --git a/drivers/net/wireless/ath/wcn36xx/wcn36xx.h b/drivers/net/wireless/ath/wcn36xx/wcn36xx.h
index f0fb81dfd17b..7b41e833e18c 100644
--- a/drivers/net/wireless/ath/wcn36xx/wcn36xx.h
+++ b/drivers/net/wireless/ath/wcn36xx/wcn36xx.h
@@ -32,6 +32,9 @@
 #define WLAN_NV_FILE               "wlan/prima/WCNSS_qcom_wlan_nv.bin"
 #define WCN36XX_AGGR_BUFFER_SIZE 64
 
+/* How many frames until we start a-mpdu TX session */
+#define WCN36XX_AMPDU_START_THRESH      20
+
 extern unsigned int wcn36xx_dbg_mask;
 
 enum wcn36xx_debug_mask {
@@ -74,6 +77,13 @@ enum wcn36xx_debug_mask {
                                buf, len, false);                \
 } while (0)
 
+enum wcn36xx_ampdu_state {
+        WCN36XX_AMPDU_NONE,
+        WCN36XX_AMPDU_INIT,
+        WCN36XX_AMPDU_START,
+        WCN36XX_AMPDU_OPERATIONAL,
+};
+
 #define WCN36XX_HW_CHANNEL(__wcn) (__wcn->hw->conf.chandef.chan->hw_value)
 #define WCN36XX_BAND(__wcn) (__wcn->hw->conf.chandef.chan->band)
 #define WCN36XX_CENTER_FREQ(__wcn) (__wcn->hw->conf.chandef.chan->center_freq)
@@ -165,6 +175,10 @@ struct wcn36xx_sta {
         bool is_data_encrypted;
         /* Rates */
         struct wcn36xx_hal_supported_rates supported_rates;
+
+        spinlock_t ampdu_lock;          /* protects next two fields */
+        enum wcn36xx_ampdu_state ampdu_state[16];
+        int non_agg_frame_ct;
 };
 struct wcn36xx_dxe_ch;
 struct wcn36xx {
@@ -243,4 +257,10 @@ static inline bool wcn36xx_is_fw_version(struct wcn36xx *wcn,
 }
 void wcn36xx_set_default_rates(struct wcn36xx_hal_supported_rates *rates);
 
+static inline
+struct ieee80211_sta *wcn36xx_priv_to_sta(struct wcn36xx_sta *sta_priv)
+{
+        return container_of((void *)sta_priv, struct ieee80211_sta, drv_priv);
+}
+
 #endif  /* _WCN36XX_H_ */
diff --git a/drivers/net/wireless/ath/wil6210/Kconfig b/drivers/net/wireless/ath/wil6210/Kconfig
index 481680a3aa55..ce8c0381825e 100644
--- a/drivers/net/wireless/ath/wil6210/Kconfig
+++ b/drivers/net/wireless/ath/wil6210/Kconfig
@@ -39,12 +39,3 @@ config WIL6210_TRACING
           option if you are interested in debugging the driver.
 
           If unsure, say Y to make it easier to debug problems.
-
-config WIL6210_PLATFORM_MSM
-        bool "wil6210 MSM platform specific support"
-        depends on WIL6210
-        depends on ARCH_MSM
-        default y
-        ---help---
-          Say Y here to enable wil6210 driver support for MSM
-          platform specific features
diff --git a/drivers/net/wireless/ath/wil6210/Makefile b/drivers/net/wireless/ath/wil6210/Makefile
index 8ad4b5f97e04..caa717bf52f3 100644
--- a/drivers/net/wireless/ath/wil6210/Makefile
+++ b/drivers/net/wireless/ath/wil6210/Makefile
@@ -14,7 +14,6 @@ wil6210-y += ioctl.o
 wil6210-y += fw.o
 wil6210-$(CONFIG_WIL6210_TRACING) += trace.o
 wil6210-y += wil_platform.o
-wil6210-$(CONFIG_WIL6210_PLATFORM_MSM) += wil_platform_msm.o
 wil6210-y += ethtool.o
 
 # for tracing framework to find trace.h
diff --git a/drivers/net/wireless/ath/wil6210/cfg80211.c b/drivers/net/wireless/ath/wil6210/cfg80211.c
index 38332a6dfb3a..2d5ea21be47e 100644
--- a/drivers/net/wireless/ath/wil6210/cfg80211.c
+++ b/drivers/net/wireless/ath/wil6210/cfg80211.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014 Qualcomm Atheros, Inc.
+ * Copyright (c) 2012-2015 Qualcomm Atheros, Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -142,14 +142,14 @@ int wil_cid_fill_sinfo(struct wil6210_priv *wil, int cid,
 
         sinfo->generation = wil->sinfo_gen;
 
-        sinfo->filled = STATION_INFO_RX_BYTES |
-                        STATION_INFO_TX_BYTES |
-                        STATION_INFO_RX_PACKETS |
-                        STATION_INFO_TX_PACKETS |
-                        STATION_INFO_RX_BITRATE |
-                        STATION_INFO_TX_BITRATE |
-                        STATION_INFO_RX_DROP_MISC |
-                        STATION_INFO_TX_FAILED;
+        sinfo->filled = BIT(NL80211_STA_INFO_RX_BYTES) |
+                        BIT(NL80211_STA_INFO_TX_BYTES) |
+                        BIT(NL80211_STA_INFO_RX_PACKETS) |
+                        BIT(NL80211_STA_INFO_TX_PACKETS) |
+                        BIT(NL80211_STA_INFO_RX_BITRATE) |
+                        BIT(NL80211_STA_INFO_TX_BITRATE) |
+                        BIT(NL80211_STA_INFO_RX_DROP_MISC) |
+                        BIT(NL80211_STA_INFO_TX_FAILED);
 
         sinfo->txrate.flags = RATE_INFO_FLAGS_MCS | RATE_INFO_FLAGS_60G;
         sinfo->txrate.mcs = le16_to_cpu(reply.evt.bf_mcs);
@@ -162,8 +162,8 @@ int wil_cid_fill_sinfo(struct wil6210_priv *wil, int cid,
         sinfo->tx_packets = stats->tx_packets;
         sinfo->tx_failed = stats->tx_errors;
 
-        if (test_bit(wil_status_fwconnected, &wil->status)) {
-                sinfo->filled |= STATION_INFO_SIGNAL;
+        if (test_bit(wil_status_fwconnected, wil->status)) {
+                sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
                 sinfo->signal = reply.evt.sqi;
         }
 
@@ -282,7 +282,7 @@ static int wil_cfg80211_scan(struct wiphy *wiphy,
         }
 
         /* FW don't support scan after connection attempt */
-        if (test_bit(wil_status_dontscan, &wil->status)) {
+        if (test_bit(wil_status_dontscan, wil->status)) {
                 wil_err(wil, "Can't scan now\n");
                 return -EBUSY;
         }
@@ -334,6 +334,30 @@ out:
         return rc;
 }
 
+static void wil_print_crypto(struct wil6210_priv *wil,
+                             struct cfg80211_crypto_settings *c)
+{
+        int i, n;
+
+        wil_dbg_misc(wil, "WPA versions: 0x%08x cipher group 0x%08x\n",
+                     c->wpa_versions, c->cipher_group);
+        wil_dbg_misc(wil, "Pairwise ciphers [%d] {\n", c->n_ciphers_pairwise);
+        n = min_t(int, c->n_ciphers_pairwise, ARRAY_SIZE(c->ciphers_pairwise));
+        for (i = 0; i < n; i++)
+                wil_dbg_misc(wil, "  [%d] = 0x%08x\n", i,
+                             c->ciphers_pairwise[i]);
+        wil_dbg_misc(wil, "}\n");
+        wil_dbg_misc(wil, "AKM suites [%d] {\n", c->n_akm_suites);
+        n = min_t(int, c->n_akm_suites, ARRAY_SIZE(c->akm_suites));
+        for (i = 0; i < n; i++)
+                wil_dbg_misc(wil, "  [%d] = 0x%08x\n", i,
+                             c->akm_suites[i]);
+        wil_dbg_misc(wil, "}\n");
+        wil_dbg_misc(wil, "Control port : %d, eth_type 0x%04x no_encrypt %d\n",
+                     c->control_port, be16_to_cpu(c->control_port_ethertype),
+                     c->control_port_no_encrypt);
+}
+
 static void wil_print_connect_params(struct wil6210_priv *wil,
                                      struct cfg80211_connect_params *sme)
 {
@@ -348,6 +372,7 @@ static void wil_print_connect_params(struct wil6210_priv *wil,
                 print_hex_dump(KERN_INFO, "  SSID: ", DUMP_PREFIX_OFFSET,
                                16, 1, sme->ssid, sme->ssid_len, true);
         wil_info(wil, "  Privacy: %s\n", sme->privacy ? "secure" : "open");
+        wil_print_crypto(wil, &sme->crypto);
 }
 
 static int wil_cfg80211_connect(struct wiphy *wiphy,
@@ -362,8 +387,8 @@ static int wil_cfg80211_connect(struct wiphy *wiphy,
         int ch;
         int rc = 0;
 
-        if (test_bit(wil_status_fwconnecting, &wil->status) ||
-            test_bit(wil_status_fwconnected, &wil->status))
+        if (test_bit(wil_status_fwconnecting, wil->status) ||
+            test_bit(wil_status_fwconnected, wil->status))
                 return -EALREADY;
 
         wil_print_connect_params(wil, sme);
@@ -450,15 +475,16 @@ static int wil_cfg80211_connect(struct wiphy *wiphy,
         memcpy(conn.bssid, bss->bssid, ETH_ALEN);
         memcpy(conn.dst_mac, bss->bssid, ETH_ALEN);
 
-        set_bit(wil_status_fwconnecting, &wil->status);
+        set_bit(wil_status_fwconnecting, wil->status);
 
         rc = wmi_send(wil, WMI_CONNECT_CMDID, &conn, sizeof(conn));
         if (rc == 0) {
+                netif_carrier_on(ndev);
                 /* Connect can take lots of time */
                 mod_timer(&wil->connect_timer,
                           jiffies + msecs_to_jiffies(2000));
         } else {
-                clear_bit(wil_status_fwconnecting, &wil->status);
+                clear_bit(wil_status_fwconnecting, wil->status);
         }
 
  out:
@@ -618,18 +644,6 @@ static void wil_print_bcon_data(struct cfg80211_beacon_data *b)
                              b->assocresp_ies, b->assocresp_ies_len);
 }
 
-static void wil_print_crypto(struct wil6210_priv *wil,
-                             struct cfg80211_crypto_settings *c)
-{
-        wil_dbg_misc(wil, "WPA versions: 0x%08x cipher group 0x%08x\n",
-                     c->wpa_versions, c->cipher_group);
-        wil_dbg_misc(wil, "Pairwise ciphers [%d]\n", c->n_ciphers_pairwise);
-        wil_dbg_misc(wil, "AKM suites [%d]\n", c->n_akm_suites);
-        wil_dbg_misc(wil, "Control port : %d, eth_type 0x%04x no_encrypt %d\n",
-                     c->control_port, be16_to_cpu(c->control_port_ethertype),
-                     c->control_port_no_encrypt);
-}
-
 static int wil_fix_bcon(struct wil6210_priv *wil,
                         struct cfg80211_beacon_data *bcon)
 {
@@ -757,12 +771,12 @@ static int wil_cfg80211_start_ap(struct wiphy *wiphy,
 
         wil->secure_pcp = info->privacy;
 
+        netif_carrier_on(ndev);
+
         rc = wmi_pcp_start(wil, info->beacon_interval, wmi_nettype,
                            channel->hw_value);
         if (rc)
-                goto out;
-
-        netif_carrier_on(ndev);
+                netif_carrier_off(ndev);
 
 out:
         mutex_unlock(&wil->mutex);
@@ -772,23 +786,26 @@ out:
 static int wil_cfg80211_stop_ap(struct wiphy *wiphy,
                                 struct net_device *ndev)
 {
-        int rc, rc1;
         struct wil6210_priv *wil = wiphy_to_wil(wiphy);
 
         wil_dbg_misc(wil, "%s()\n", __func__);
 
+        netif_carrier_off(ndev);
         wil_set_recovery_state(wil, fw_recovery_idle);
 
         mutex_lock(&wil->mutex);
 
-        rc = wmi_pcp_stop(wil);
+        wmi_pcp_stop(wil);
 
         __wil_down(wil);
-        rc1 = __wil_up(wil);
+        __wil_up(wil);
 
         mutex_unlock(&wil->mutex);
 
-        return min(rc, rc1);
+        /* some functions above might fail (e.g. __wil_up). Nevertheless, we
+         * return success because AP has stopped
+         */
+        return 0;
 }
 
 static int wil_cfg80211_del_station(struct wiphy *wiphy,
@@ -804,6 +821,96 @@ static int wil_cfg80211_del_station(struct wiphy *wiphy,
         return 0;
 }
 
+/* probe_client handling */
+static void wil_probe_client_handle(struct wil6210_priv *wil,
+                                    struct wil_probe_client_req *req)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+        struct wil_sta_info *sta = &wil->sta[req->cid];
+        /* assume STA is alive if it is still connected,
+         * else FW will disconnect it
+         */
+        bool alive = (sta->status == wil_sta_connected);
+
+        cfg80211_probe_status(ndev, sta->addr, req->cookie, alive, GFP_KERNEL);
+}
+
+static struct list_head *next_probe_client(struct wil6210_priv *wil)
+{
+        struct list_head *ret = NULL;
+
+        mutex_lock(&wil->probe_client_mutex);
+
+        if (!list_empty(&wil->probe_client_pending)) {
+                ret = wil->probe_client_pending.next;
+                list_del(ret);
+        }
+
+        mutex_unlock(&wil->probe_client_mutex);
+
+        return ret;
+}
+
+void wil_probe_client_worker(struct work_struct *work)
+{
+        struct wil6210_priv *wil = container_of(work, struct wil6210_priv,
+                                                probe_client_worker);
+        struct wil_probe_client_req *req;
+        struct list_head *lh;
+
+        while ((lh = next_probe_client(wil)) != NULL) {
+                req = list_entry(lh, struct wil_probe_client_req, list);
+
+                wil_probe_client_handle(wil, req);
+                kfree(req);
+        }
+}
+
+void wil_probe_client_flush(struct wil6210_priv *wil)
+{
+        struct wil_probe_client_req *req, *t;
+
+        wil_dbg_misc(wil, "%s()\n", __func__);
+
+        mutex_lock(&wil->probe_client_mutex);
+
+        list_for_each_entry_safe(req, t, &wil->probe_client_pending, list) {
+                list_del(&req->list);
+                kfree(req);
+        }
+
+        mutex_unlock(&wil->probe_client_mutex);
+}
+
+static int wil_cfg80211_probe_client(struct wiphy *wiphy,
+                                     struct net_device *dev,
+                                     const u8 *peer, u64 *cookie)
+{
+        struct wil6210_priv *wil = wiphy_to_wil(wiphy);
+        struct wil_probe_client_req *req;
+        int cid = wil_find_cid(wil, peer);
+
+        wil_dbg_misc(wil, "%s(%pM => CID %d)\n", __func__, peer, cid);
+
+        if (cid < 0)
+                return -ENOLINK;
+
+        req = kzalloc(sizeof(*req), GFP_KERNEL);
+        if (!req)
+                return -ENOMEM;
+
+        req->cid = cid;
+        req->cookie = cid;
+
+        mutex_lock(&wil->probe_client_mutex);
+        list_add_tail(&req->list, &wil->probe_client_pending);
+        mutex_unlock(&wil->probe_client_mutex);
+
+        *cookie = req->cookie;
+        queue_work(wil->wq_service, &wil->probe_client_worker);
+        return 0;
+}
+
 static struct cfg80211_ops wil_cfg80211_ops = {
         .scan = wil_cfg80211_scan,
         .connect = wil_cfg80211_connect,
@@ -823,6 +930,7 @@ static struct cfg80211_ops wil_cfg80211_ops = {
         .start_ap = wil_cfg80211_start_ap,
         .stop_ap = wil_cfg80211_stop_ap,
         .del_station = wil_cfg80211_del_station,
+        .probe_client = wil_cfg80211_probe_client,
 };
 
 static void wil_wiphy_init(struct wiphy *wiphy)
@@ -854,6 +962,7 @@ static void wil_wiphy_init(struct wiphy *wiphy)
         wiphy->cipher_suites = wil_cipher_suites;
         wiphy->n_cipher_suites = ARRAY_SIZE(wil_cipher_suites);
         wiphy->mgmt_stypes = wil_mgmt_stypes;
+        wiphy->features |= NL80211_FEATURE_SK_TX_STATUS;
 }
 
 struct wireless_dev *wil_cfg80211_init(struct device *dev)
diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c
index 4e6e14501c2f..45c3558ec804 100644
--- a/drivers/net/wireless/ath/wil6210/debugfs.c
+++ b/drivers/net/wireless/ath/wil6210/debugfs.c
@@ -50,6 +50,7 @@ static void wil_print_vring(struct seq_file *s, struct wil6210_priv *wil,
                             char _s, char _h)
 {
         void __iomem *x = wmi_addr(wil, vring->hwtail);
+        u32 v;
 
         seq_printf(s, "VRING %s = {\n", name);
         seq_printf(s, "  pa     = %pad\n", &vring->pa);
@@ -58,10 +59,12 @@ static void wil_print_vring(struct seq_file *s, struct wil6210_priv *wil,
         seq_printf(s, "  swtail = %d\n", vring->swtail);
         seq_printf(s, "  swhead = %d\n", vring->swhead);
         seq_printf(s, "  hwtail = [0x%08x] -> ", vring->hwtail);
-        if (x)
-                seq_printf(s, "0x%08x\n", ioread32(x));
-        else
+        if (x) {
+                v = ioread32(x);
+                seq_printf(s, "0x%08x = %d\n", v, v);
+        } else {
                 seq_puts(s, "???\n");
+        }
 
         if (vring->va && (vring->size < 1025)) {
                 uint i;
@@ -101,8 +104,8 @@ static int wil_vring_debugfs_show(struct seq_file *s, void *data)
                         char name[10];
                         /* performance monitoring */
                         cycles_t now = get_cycles();
-                        cycles_t idle = txdata->idle * 100;
-                        cycles_t total = now - txdata->begin;
+                        uint64_t idle = txdata->idle * 100;
+                        uint64_t total = now - txdata->begin;
 
                         do_div(idle, total);
                         txdata->begin = now;
@@ -110,9 +113,12 @@ static int wil_vring_debugfs_show(struct seq_file *s, void *data)
 
                         snprintf(name, sizeof(name), "tx_%2d", i);
 
-                        seq_printf(s, "\n%pM CID %d TID %d [%3d|%3d] idle %3d%%\n",
-                                   wil->sta[cid].addr, cid, tid, used, avail,
-                                   (int)idle);
+                        seq_printf(s,
+                                   "\n%pM CID %d TID %d BACK([%d] %d TU A%s) [%3d|%3d] idle %3d%%\n",
+                                   wil->sta[cid].addr, cid, tid,
+                                   txdata->agg_wsize, txdata->agg_timeout,
+                                   txdata->agg_amsdu ? "+" : "-",
+                                   used, avail, (int)idle);
 
                         wil_print_vring(s, wil, name, vring, '_', 'H');
                 }
@@ -384,24 +390,67 @@ static int wil6210_debugfs_create_pseudo_ISR(struct wil6210_priv *wil,
         return 0;
 }
 
-static const struct dbg_off itr_cnt_off[] = {
+static const struct dbg_off lgc_itr_cnt_off[] = {
         {"TRSH", S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_CNT_TRSH), doff_io32},
         {"DATA", S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_CNT_DATA), doff_io32},
         {"CTL",  S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_CNT_CRL), doff_io32},
         {},
 };
 
+static const struct dbg_off tx_itr_cnt_off[] = {
+        {"TRSH", S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_TX_CNT_TRSH),
+         doff_io32},
+        {"DATA", S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_TX_CNT_DATA),
+         doff_io32},
+        {"CTL",  S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_TX_CNT_CTL),
+         doff_io32},
+        {"IDL_TRSH", S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_TX_IDL_CNT_TRSH),
+         doff_io32},
+        {"IDL_DATA", S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_TX_IDL_CNT_DATA),
+         doff_io32},
+        {"IDL_CTL",  S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_TX_IDL_CNT_CTL),
+         doff_io32},
+        {},
+};
+
+static const struct dbg_off rx_itr_cnt_off[] = {
+        {"TRSH", S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_RX_CNT_TRSH),
+         doff_io32},
+        {"DATA", S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_RX_CNT_DATA),
+         doff_io32},
+        {"CTL",  S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_RX_CNT_CTL),
+         doff_io32},
+        {"IDL_TRSH", S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_RX_IDL_CNT_TRSH),
+         doff_io32},
+        {"IDL_DATA", S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_RX_IDL_CNT_DATA),
+         doff_io32},
+        {"IDL_CTL",  S_IRUGO | S_IWUSR, HOSTADDR(RGF_DMA_ITR_RX_IDL_CNT_CTL),
+         doff_io32},
+        {},
+};
+
 static int wil6210_debugfs_create_ITR_CNT(struct wil6210_priv *wil,
                                           struct dentry *parent)
 {
-        struct dentry *d = debugfs_create_dir("ITR_CNT", parent);
+        struct dentry *d, *dtx, *drx;
 
+        d = debugfs_create_dir("ITR_CNT", parent);
         if (IS_ERR_OR_NULL(d))
                 return -ENODEV;
 
+        dtx = debugfs_create_dir("TX", d);
+        drx = debugfs_create_dir("RX", d);
+        if (IS_ERR_OR_NULL(dtx) || IS_ERR_OR_NULL(drx))
+                return -ENODEV;
+
         wil6210_debugfs_init_offset(wil, d, (void * __force)wil->csr,
-                                    itr_cnt_off);
+                                    lgc_itr_cnt_off);
+
+        wil6210_debugfs_init_offset(wil, dtx, (void * __force)wil->csr,
+                                    tx_itr_cnt_off);
 
+        wil6210_debugfs_init_offset(wil, drx, (void * __force)wil->csr,
+                                    rx_itr_cnt_off);
         return 0;
 }
 
@@ -558,6 +607,87 @@ static const struct file_operations fops_rxon = {
         .open  = simple_open,
 };
 
+/* block ack control, write:
+ * - "add <ringid> <agg_size> <timeout>" to trigger ADDBA
+ * - "del_tx <ringid> <reason>" to trigger DELBA for Tx side
+ * - "del_rx <CID> <TID> <reason>" to trigger DELBA for Rx side
+ */
+static ssize_t wil_write_back(struct file *file, const char __user *buf,
+                              size_t len, loff_t *ppos)
+{
+        struct wil6210_priv *wil = file->private_data;
+        int rc;
+        char *kbuf = kmalloc(len + 1, GFP_KERNEL);
+        char cmd[8];
+        int p1, p2, p3;
+
+        if (!kbuf)
+                return -ENOMEM;
+
+        rc = simple_write_to_buffer(kbuf, len, ppos, buf, len);
+        if (rc != len) {
+                kfree(kbuf);
+                return rc >= 0 ? -EIO : rc;
+        }
+
+        kbuf[len] = '\0';
+        rc = sscanf(kbuf, "%8s %d %d %d", cmd, &p1, &p2, &p3);
+        kfree(kbuf);
+
+        if (rc < 0)
+                return rc;
+        if (rc < 2)
+                return -EINVAL;
+
+        if (0 == strcmp(cmd, "add")) {
+                if (rc < 3) {
+                        wil_err(wil, "BACK: add require at least 2 params\n");
+                        return -EINVAL;
+                }
+                if (rc < 4)
+                        p3 = 0;
+                wmi_addba(wil, p1, p2, p3);
+        } else if (0 == strcmp(cmd, "del_tx")) {
+                if (rc < 3)
+                        p2 = WLAN_REASON_QSTA_LEAVE_QBSS;
+                wmi_delba_tx(wil, p1, p2);
+        } else if (0 == strcmp(cmd, "del_rx")) {
+                if (rc < 3) {
+                        wil_err(wil,
+                                "BACK: del_rx require at least 2 params\n");
+                        return -EINVAL;
+                }
+                if (rc < 4)
+                        p3 = WLAN_REASON_QSTA_LEAVE_QBSS;
+                wmi_delba_rx(wil, mk_cidxtid(p1, p2), p3);
+        } else {
+                wil_err(wil, "BACK: Unrecognized command \"%s\"\n", cmd);
+                return -EINVAL;
+        }
+
+        return len;
+}
+
+static ssize_t wil_read_back(struct file *file, char __user *user_buf,
+                             size_t count, loff_t *ppos)
+{
+        static const char text[] = "block ack control, write:\n"
+        " - \"add <ringid> <agg_size> <timeout>\" to trigger ADDBA\n"
+        "If missing, <timeout> defaults to 0\n"
+        " - \"del_tx <ringid> <reason>\" to trigger DELBA for Tx side\n"
+        " - \"del_rx <CID> <TID> <reason>\" to trigger DELBA for Rx side\n"
+        "If missing, <reason> set to \"STA_LEAVING\" (36)\n";
+
+        return simple_read_from_buffer(user_buf, count, ppos, text,
+                                       sizeof(text));
+}
+
+static const struct file_operations fops_back = {
+        .read = wil_read_back,
+        .write = wil_write_back,
+        .open  = simple_open,
+};
+
 /*---tx_mgmt---*/
 /* Write mgmt frame to this file to send it */
 static ssize_t wil_write_file_txmgmt(struct file *file, const char __user *buf,
@@ -1116,7 +1246,8 @@ static void wil_print_rxtid(struct seq_file *s, struct wil_tid_ampdu_rx *r)
         int i;
         u16 index = ((r->head_seq_num - r->ssn) & 0xfff) % r->buf_size;
 
-        seq_printf(s, "0x%03x [", r->head_seq_num);
+        seq_printf(s, "([%2d] %3d TU) 0x%03x [", r->buf_size, r->timeout,
+                   r->head_seq_num);
         for (i = 0; i < r->buf_size; i++) {
                 if (i == index)
                         seq_printf(s, "%c", r->reorder_buf[i] ? 'O' : '|');
@@ -1127,10 +1258,10 @@ static void wil_print_rxtid(struct seq_file *s, struct wil_tid_ampdu_rx *r)
 }
 
 static int wil_sta_debugfs_show(struct seq_file *s, void *data)
+__acquires(&p->tid_rx_lock) __releases(&p->tid_rx_lock)
 {
         struct wil6210_priv *wil = s->private;
         int i, tid;
-        unsigned long flags;
 
         for (i = 0; i < ARRAY_SIZE(wil->sta); i++) {
                 struct wil_sta_info *p = &wil->sta[i];
@@ -1151,7 +1282,7 @@ static int wil_sta_debugfs_show(struct seq_file *s, void *data)
                            (p->data_port_open ? " data_port_open" : ""));
 
                 if (p->status == wil_sta_connected) {
-                        spin_lock_irqsave(&p->tid_rx_lock, flags);
+                        spin_lock_bh(&p->tid_rx_lock);
                         for (tid = 0; tid < WIL_STA_TID_NUM; tid++) {
                                 struct wil_tid_ampdu_rx *r = p->tid_rx[tid];
 
@@ -1160,7 +1291,7 @@ static int wil_sta_debugfs_show(struct seq_file *s, void *data)
                                         wil_print_rxtid(s, r);
                                 }
                         }
-                        spin_unlock_irqrestore(&p->tid_rx_lock, flags);
+                        spin_unlock_bh(&p->tid_rx_lock);
                 }
         }
 
@@ -1217,6 +1348,7 @@ static const struct {
         {"rxon",                  S_IWUSR,      &fops_rxon},
         {"tx_mgmt",               S_IWUSR,      &fops_txmgmt},
         {"wmi_send",              S_IWUSR,      &fops_wmi},
+        {"back",        S_IRUGO | S_IWUSR,      &fops_back},
         {"temp",        S_IRUGO,                &fops_temp},
         {"freq",        S_IRUGO,                &fops_freq},
         {"link",        S_IRUGO,                &fops_link},
@@ -1261,7 +1393,7 @@ static void wil6210_debugfs_init_isr(struct wil6210_priv *wil,
 /* fields in struct wil6210_priv */
 static const struct dbg_off dbg_wil_off[] = {
         WIL_FIELD(secure_pcp,   S_IRUGO | S_IWUSR,      doff_u32),
-        WIL_FIELD(status,       S_IRUGO | S_IWUSR,      doff_ulong),
+        WIL_FIELD(status[0],    S_IRUGO | S_IWUSR,      doff_ulong),
         WIL_FIELD(fw_version,   S_IRUGO,                doff_u32),
         WIL_FIELD(hw_version,   S_IRUGO,                doff_x32),
         WIL_FIELD(recovery_count, S_IRUGO,              doff_u32),
diff --git a/drivers/net/wireless/ath/wil6210/ethtool.c b/drivers/net/wireless/ath/wil6210/ethtool.c
index d686638972be..4c44a82c34d7 100644
--- a/drivers/net/wireless/ath/wil6210/ethtool.c
+++ b/drivers/net/wireless/ath/wil6210/ethtool.c
@@ -45,16 +45,35 @@ static int wil_ethtoolops_get_coalesce(struct net_device *ndev,
                                        struct ethtool_coalesce *cp)
 {
         struct wil6210_priv *wil = ndev_to_wil(ndev);
-        u32 itr_en, itr_val = 0;
+        u32 tx_itr_en, tx_itr_val = 0;
+        u32 rx_itr_en, rx_itr_val = 0;
 
         wil_dbg_misc(wil, "%s()\n", __func__);
 
-        itr_en = ioread32(wil->csr + HOSTADDR(RGF_DMA_ITR_CNT_CRL));
-        if (itr_en & BIT_DMA_ITR_CNT_CRL_EN)
-                itr_val = ioread32(wil->csr + HOSTADDR(RGF_DMA_ITR_CNT_TRSH));
-
-        cp->rx_coalesce_usecs = itr_val;
+        if (test_bit(hw_capability_advanced_itr_moderation,
+                     wil->hw_capabilities)) {
+                tx_itr_en = ioread32(wil->csr +
+                                     HOSTADDR(RGF_DMA_ITR_TX_CNT_CTL));
+                if (tx_itr_en & BIT_DMA_ITR_TX_CNT_CTL_EN)
+                        tx_itr_val =
+                                ioread32(wil->csr +
+                                         HOSTADDR(RGF_DMA_ITR_TX_CNT_TRSH));
+
+                rx_itr_en = ioread32(wil->csr +
+                                     HOSTADDR(RGF_DMA_ITR_RX_CNT_CTL));
+                if (rx_itr_en & BIT_DMA_ITR_RX_CNT_CTL_EN)
+                        rx_itr_val =
+                                ioread32(wil->csr +
+                                         HOSTADDR(RGF_DMA_ITR_RX_CNT_TRSH));
+        } else {
+                rx_itr_en = ioread32(wil->csr + HOSTADDR(RGF_DMA_ITR_CNT_CRL));
+                if (rx_itr_en & BIT_DMA_ITR_CNT_CRL_EN)
+                        rx_itr_val = ioread32(wil->csr +
+                                              HOSTADDR(RGF_DMA_ITR_CNT_TRSH));
+        }
 
+        cp->tx_coalesce_usecs = tx_itr_val;
+        cp->rx_coalesce_usecs = rx_itr_val;
         return 0;
 }
 
@@ -63,22 +82,25 @@ static int wil_ethtoolops_set_coalesce(struct net_device *ndev,
 {
         struct wil6210_priv *wil = ndev_to_wil(ndev);
 
-        wil_dbg_misc(wil, "%s(%d usec)\n", __func__, cp->rx_coalesce_usecs);
+        wil_dbg_misc(wil, "%s(rx %d usec, tx %d usec)\n", __func__,
+                     cp->rx_coalesce_usecs, cp->tx_coalesce_usecs);
 
         if (wil->wdev->iftype == NL80211_IFTYPE_MONITOR) {
                 wil_dbg_misc(wil, "No IRQ coalescing in monitor mode\n");
                 return -EINVAL;
         }
 
-        /* only @rx_coalesce_usecs supported, ignore
-         * other parameters
+        /* only @rx_coalesce_usecs and @tx_coalesce_usecs supported,
+         * ignore other parameters
          */
 
-        if (cp->rx_coalesce_usecs > WIL6210_ITR_TRSH_MAX)
+        if (cp->rx_coalesce_usecs > WIL6210_ITR_TRSH_MAX ||
+            cp->tx_coalesce_usecs > WIL6210_ITR_TRSH_MAX)
                 goto out_bad;
 
-        wil->itr_trsh = cp->rx_coalesce_usecs;
-        wil_set_itr_trsh(wil);
+        wil->tx_max_burst_duration = cp->tx_coalesce_usecs;
+        wil->rx_max_burst_duration = cp->rx_coalesce_usecs;
+        wil_configure_interrupt_moderation(wil);
 
         return 0;
 
diff --git a/drivers/net/wireless/ath/wil6210/interrupt.c b/drivers/net/wireless/ath/wil6210/interrupt.c
index 4bcbd6297b3e..a6f923086f31 100644
--- a/drivers/net/wireless/ath/wil6210/interrupt.c
+++ b/drivers/net/wireless/ath/wil6210/interrupt.c
@@ -102,7 +102,7 @@ static void wil6210_mask_irq_pseudo(struct wil6210_priv *wil)
         iowrite32(WIL6210_IRQ_DISABLE, wil->csr +
                   HOSTADDR(RGF_DMA_PSEUDO_CAUSE_MASK_SW));
 
-        clear_bit(wil_status_irqen, &wil->status);
+        clear_bit(wil_status_irqen, wil->status);
 }
 
 void wil6210_unmask_irq_tx(struct wil6210_priv *wil)
@@ -130,7 +130,7 @@ static void wil6210_unmask_irq_pseudo(struct wil6210_priv *wil)
 {
         wil_dbg_irq(wil, "%s()\n", __func__);
 
-        set_bit(wil_status_irqen, &wil->status);
+        set_bit(wil_status_irqen, wil->status);
 
         iowrite32(WIL6210_IRQ_PSEUDO_MASK, wil->csr +
                   HOSTADDR(RGF_DMA_PSEUDO_CAUSE_MASK_SW));
@@ -157,15 +157,91 @@ void wil_unmask_irq(struct wil6210_priv *wil)
         iowrite32(WIL_ICR_ICC_VALUE, wil->csr + HOSTADDR(RGF_DMA_EP_MISC_ICR) +
                   offsetof(struct RGF_ICR, ICC));
 
-        /* interrupt moderation parameters */
-        wil_set_itr_trsh(wil);
-
         wil6210_unmask_irq_pseudo(wil);
         wil6210_unmask_irq_tx(wil);
         wil6210_unmask_irq_rx(wil);
         wil6210_unmask_irq_misc(wil);
 }
 
+/* target write operation */
+#define W(a, v) do { iowrite32(v, wil->csr + HOSTADDR(a)); wmb(); } while (0)
+
+static
+void wil_configure_interrupt_moderation_new(struct wil6210_priv *wil)
+{
+        /* Disable and clear tx counter before (re)configuration */
+        W(RGF_DMA_ITR_TX_CNT_CTL, BIT_DMA_ITR_TX_CNT_CTL_CLR);
+        W(RGF_DMA_ITR_TX_CNT_TRSH, wil->tx_max_burst_duration);
+        wil_info(wil, "set ITR_TX_CNT_TRSH = %d usec\n",
+                 wil->tx_max_burst_duration);
+        /* Configure TX max burst duration timer to use usec units */
+        W(RGF_DMA_ITR_TX_CNT_CTL,
+          BIT_DMA_ITR_TX_CNT_CTL_EN | BIT_DMA_ITR_TX_CNT_CTL_EXT_TIC_SEL);
+
+        /* Disable and clear tx idle counter before (re)configuration */
+        W(RGF_DMA_ITR_TX_IDL_CNT_CTL, BIT_DMA_ITR_TX_IDL_CNT_CTL_CLR);
+        W(RGF_DMA_ITR_TX_IDL_CNT_TRSH, wil->tx_interframe_timeout);
+        wil_info(wil, "set ITR_TX_IDL_CNT_TRSH = %d usec\n",
+                 wil->tx_interframe_timeout);
+        /* Configure TX max burst duration timer to use usec units */
+        W(RGF_DMA_ITR_TX_IDL_CNT_CTL, BIT_DMA_ITR_TX_IDL_CNT_CTL_EN |
+                                      BIT_DMA_ITR_TX_IDL_CNT_CTL_EXT_TIC_SEL);
+
+        /* Disable and clear rx counter before (re)configuration */
+        W(RGF_DMA_ITR_RX_CNT_CTL, BIT_DMA_ITR_RX_CNT_CTL_CLR);
+        W(RGF_DMA_ITR_RX_CNT_TRSH, wil->rx_max_burst_duration);
+        wil_info(wil, "set ITR_RX_CNT_TRSH = %d usec\n",
+                 wil->rx_max_burst_duration);
+        /* Configure TX max burst duration timer to use usec units */
+        W(RGF_DMA_ITR_RX_CNT_CTL,
+          BIT_DMA_ITR_RX_CNT_CTL_EN | BIT_DMA_ITR_RX_CNT_CTL_EXT_TIC_SEL);
+
+        /* Disable and clear rx idle counter before (re)configuration */
+        W(RGF_DMA_ITR_RX_IDL_CNT_CTL, BIT_DMA_ITR_RX_IDL_CNT_CTL_CLR);
+        W(RGF_DMA_ITR_RX_IDL_CNT_TRSH, wil->rx_interframe_timeout);
+        wil_info(wil, "set ITR_RX_IDL_CNT_TRSH = %d usec\n",
+                 wil->rx_interframe_timeout);
+        /* Configure TX max burst duration timer to use usec units */
+        W(RGF_DMA_ITR_RX_IDL_CNT_CTL, BIT_DMA_ITR_RX_IDL_CNT_CTL_EN |
+                                      BIT_DMA_ITR_RX_IDL_CNT_CTL_EXT_TIC_SEL);
+}
+
+static
+void wil_configure_interrupt_moderation_lgc(struct wil6210_priv *wil)
+{
+        /* disable, use usec resolution */
+        W(RGF_DMA_ITR_CNT_CRL, BIT_DMA_ITR_CNT_CRL_CLR);
+
+        wil_info(wil, "set ITR_TRSH = %d usec\n", wil->rx_max_burst_duration);
+        W(RGF_DMA_ITR_CNT_TRSH, wil->rx_max_burst_duration);
+        /* start it */
+        W(RGF_DMA_ITR_CNT_CRL,
+          BIT_DMA_ITR_CNT_CRL_EN | BIT_DMA_ITR_CNT_CRL_EXT_TICK);
+}
+
+#undef W
+
+void wil_configure_interrupt_moderation(struct wil6210_priv *wil)
+{
+        wil_dbg_irq(wil, "%s()\n", __func__);
+
+        /* disable interrupt moderation for monitor
+         * to get better timestamp precision
+         */
+        if (wil->wdev->iftype == NL80211_IFTYPE_MONITOR)
+                return;
+
+        if (test_bit(hw_capability_advanced_itr_moderation,
+                     wil->hw_capabilities))
+                wil_configure_interrupt_moderation_new(wil);
+        else {
+                /* Advanced interrupt moderation is not available before
+                 * Sparrow v2. Will use legacy interrupt moderation
+                 */
+                wil_configure_interrupt_moderation_lgc(wil);
+        }
+}
+
 static irqreturn_t wil6210_irq_rx(int irq, void *cookie)
 {
         struct wil6210_priv *wil = cookie;
@@ -194,18 +270,19 @@ static irqreturn_t wil6210_irq_rx(int irq, void *cookie)
                 wil_dbg_irq(wil, "RX done\n");
 
                 if (isr & BIT_DMA_EP_RX_ICR_RX_HTRSH)
-                        wil_err_ratelimited(wil, "Received \"Rx buffer is in risk "
-                                "of overflow\" interrupt\n");
+                        wil_err_ratelimited(wil,
+                                            "Received \"Rx buffer is in risk of overflow\" interrupt\n");
 
-                isr &= ~(BIT_DMA_EP_RX_ICR_RX_DONE | BIT_DMA_EP_RX_ICR_RX_HTRSH);
-                if (test_bit(wil_status_reset_done, &wil->status)) {
-                        if (test_bit(wil_status_napi_en, &wil->status)) {
+                isr &= ~(BIT_DMA_EP_RX_ICR_RX_DONE |
+                         BIT_DMA_EP_RX_ICR_RX_HTRSH);
+                if (test_bit(wil_status_reset_done, wil->status)) {
+                        if (test_bit(wil_status_napi_en, wil->status)) {
                                 wil_dbg_txrx(wil, "NAPI(Rx) schedule\n");
                                 need_unmask = false;
                                 napi_schedule(&wil->napi_rx);
                         } else {
-                                wil_err(wil, "Got Rx interrupt while "
-                                        "stopping interface\n");
+                                wil_err(wil,
+                                        "Got Rx interrupt while stopping interface\n");
                         }
                 } else {
                         wil_err(wil, "Got Rx interrupt while in reset\n");
@@ -248,7 +325,7 @@ static irqreturn_t wil6210_irq_tx(int irq, void *cookie)
                 isr &= ~BIT_DMA_EP_TX_ICR_TX_DONE;
                 /* clear also all VRING interrupts */
                 isr &= ~(BIT(25) - 1UL);
-                if (test_bit(wil_status_reset_done, &wil->status)) {
+                if (test_bit(wil_status_reset_done, wil->status)) {
                         wil_dbg_txrx(wil, "NAPI(Tx) schedule\n");
                         need_unmask = false;
                         napi_schedule(&wil->napi_tx);
@@ -310,7 +387,7 @@ static irqreturn_t wil6210_irq_misc(int irq, void *cookie)
 
         if (isr & ISR_MISC_FW_ERROR) {
                 wil_err(wil, "Firmware error detected\n");
-                clear_bit(wil_status_fwready, &wil->status);
+                clear_bit(wil_status_fwready, wil->status);
                 /*
                  * do not clear @isr here - we do 2-nd part in thread
                  * there, user space get notified, and it should be done
@@ -321,7 +398,7 @@ static irqreturn_t wil6210_irq_misc(int irq, void *cookie)
         if (isr & ISR_MISC_FW_READY) {
                 wil_dbg_irq(wil, "IRQ: FW ready\n");
                 wil_cache_mbox_regs(wil);
-                set_bit(wil_status_reset_done, &wil->status);
+                set_bit(wil_status_reset_done, wil->status);
                 /**
                  * Actual FW ready indicated by the
                  * WMI_FW_READY_EVENTID
@@ -394,7 +471,7 @@ static irqreturn_t wil6210_thread_irq(int irq, void *cookie)
  */
 static int wil6210_debug_irq_mask(struct wil6210_priv *wil, u32 pseudo_cause)
 {
-        if (!test_bit(wil_status_irqen, &wil->status)) {
+        if (!test_bit(wil_status_irqen, wil->status)) {
                 u32 icm_rx = wil_ioread32_and_clear(wil->csr +
                                 HOSTADDR(RGF_DMA_EP_RX_ICR) +
                                 offsetof(struct RGF_ICR, ICM));
diff --git a/drivers/net/wireless/ath/wil6210/main.c b/drivers/net/wireless/ath/wil6210/main.c
index 8ff3fe34fe05..b04e0afdcb21 100644
--- a/drivers/net/wireless/ath/wil6210/main.c
+++ b/drivers/net/wireless/ath/wil6210/main.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014 Qualcomm Atheros, Inc.
+ * Copyright (c) 2012-2015 Qualcomm Atheros, Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -33,15 +33,18 @@ static bool no_fw_load = true;
 module_param(no_fw_load, bool, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(no_fw_load, " do not download FW, use one in on-card flash.");
 
-static unsigned int itr_trsh = WIL6210_ITR_TRSH_DEFAULT;
-
-module_param(itr_trsh, uint, S_IRUGO);
-MODULE_PARM_DESC(itr_trsh, " Interrupt moderation threshold, usecs.");
+/* if not set via modparam, will be set to default value of 1/8 of
+ * rx ring size during init flow
+ */
+unsigned short rx_ring_overflow_thrsh = WIL6210_RX_HIGH_TRSH_INIT;
+module_param(rx_ring_overflow_thrsh, ushort, S_IRUGO);
+MODULE_PARM_DESC(rx_ring_overflow_thrsh,
+                 " RX ring overflow threshold in descriptors.");
 
 /* We allow allocation of more than 1 page buffers to support large packets.
  * It is suboptimal behavior performance wise in case MTU above page size.
  */
-unsigned int mtu_max = TXRX_BUF_LEN_DEFAULT - ETH_HLEN;
+unsigned int mtu_max = TXRX_BUF_LEN_DEFAULT - WIL_MAX_MPDU_OVERHEAD;
 static int mtu_max_set(const char *val, const struct kernel_param *kp)
 {
         int ret;
@@ -53,7 +56,7 @@ static int mtu_max_set(const char *val, const struct kernel_param *kp)
         if (ret)
                 return ret;
 
-        if (mtu_max < 68 || mtu_max > IEEE80211_MAX_DATA_LEN_DMG)
+        if (mtu_max < 68 || mtu_max > WIL_MAX_ETH_MTU)
                 ret = -EINVAL;
 
         return ret;
@@ -135,12 +138,14 @@ void wil_memcpy_toio_32(volatile void __iomem *dst, const void *src,
 
 static void wil_disconnect_cid(struct wil6210_priv *wil, int cid,
                                u16 reason_code, bool from_event)
+__acquires(&sta->tid_rx_lock) __releases(&sta->tid_rx_lock)
 {
         uint i;
         struct net_device *ndev = wil_to_ndev(wil);
         struct wireless_dev *wdev = wil->wdev;
         struct wil_sta_info *sta = &wil->sta[cid];
 
+        might_sleep();
         wil_dbg_misc(wil, "%s(CID %d, status %d)\n", __func__, cid,
                      sta->status);
 
@@ -163,15 +168,14 @@ static void wil_disconnect_cid(struct wil6210_priv *wil, int cid,
 
         for (i = 0; i < WIL_STA_TID_NUM; i++) {
                 struct wil_tid_ampdu_rx *r;
-                unsigned long flags;
 
-                spin_lock_irqsave(&sta->tid_rx_lock, flags);
+                spin_lock_bh(&sta->tid_rx_lock);
 
                 r = sta->tid_rx[i];
                 sta->tid_rx[i] = NULL;
                 wil_tid_ampdu_rx_free(wil, r);
 
-                spin_unlock_irqrestore(&sta->tid_rx_lock, flags);
+                spin_unlock_bh(&sta->tid_rx_lock);
         }
         for (i = 0; i < ARRAY_SIZE(wil->vring_tx); i++) {
                 if (wil->vring2cid_tid[i][0] == cid)
@@ -188,34 +192,47 @@ static void _wil6210_disconnect(struct wil6210_priv *wil, const u8 *bssid,
         struct wireless_dev *wdev = wil->wdev;
 
         might_sleep();
-        if (bssid) {
+        wil_dbg_misc(wil, "%s(bssid=%pM, reason=%d, ev%s)\n", __func__, bssid,
+                     reason_code, from_event ? "+" : "-");
+
+        /* Cases are:
+         * - disconnect single STA, still connected
+         * - disconnect single STA, already disconnected
+         * - disconnect all
+         *
+         * For "disconnect all", there are 2 options:
+         * - bssid == NULL
+         * - bssid is our MAC address
+         */
+        if (bssid && memcmp(ndev->dev_addr, bssid, ETH_ALEN)) {
                 cid = wil_find_cid(wil, bssid);
-                wil_dbg_misc(wil, "%s(%pM, CID %d)\n", __func__, bssid, cid);
-        } else {
-                wil_dbg_misc(wil, "%s(all)\n", __func__);
-        }
-
-        if (cid >= 0) /* disconnect 1 peer */
-                wil_disconnect_cid(wil, cid, reason_code, from_event);
-        else /* disconnect all */
+                wil_dbg_misc(wil, "Disconnect %pM, CID=%d, reason=%d\n",
+                             bssid, cid, reason_code);
+                if (cid >= 0) /* disconnect 1 peer */
+                        wil_disconnect_cid(wil, cid, reason_code, from_event);
+        } else { /* all */
+                wil_dbg_misc(wil, "Disconnect all\n");
                 for (cid = 0; cid < WIL6210_MAX_CID; cid++)
                         wil_disconnect_cid(wil, cid, reason_code, from_event);
+        }
 
         /* link state */
         switch (wdev->iftype) {
         case NL80211_IFTYPE_STATION:
         case NL80211_IFTYPE_P2P_CLIENT:
-                wil_link_off(wil);
-                if (test_bit(wil_status_fwconnected, &wil->status)) {
-                        clear_bit(wil_status_fwconnected, &wil->status);
+                netif_tx_stop_all_queues(ndev);
+                netif_carrier_off(ndev);
+
+                if (test_bit(wil_status_fwconnected, wil->status)) {
+                        clear_bit(wil_status_fwconnected, wil->status);
                         cfg80211_disconnected(ndev, reason_code,
                                               NULL, 0, GFP_KERNEL);
-                } else if (test_bit(wil_status_fwconnecting, &wil->status)) {
+                } else if (test_bit(wil_status_fwconnecting, wil->status)) {
                         cfg80211_connect_result(ndev, bssid, NULL, 0, NULL, 0,
                                                 WLAN_STATUS_UNSPECIFIED_FAILURE,
                                                 GFP_KERNEL);
                 }
-                clear_bit(wil_status_fwconnecting, &wil->status);
+                clear_bit(wil_status_fwconnecting, wil->status);
                 break;
         default:
                 break;
@@ -248,7 +265,7 @@ static void wil_scan_timer_fn(ulong x)
 {
         struct wil6210_priv *wil = (void *)x;
 
-        clear_bit(wil_status_fwready, &wil->status);
+        clear_bit(wil_status_fwready, wil->status);
         wil_err(wil, "Scan timeout detected, start fw error recovery\n");
         wil->recovery_state = fw_recovery_pending;
         schedule_work(&wil->fw_error_worker);
@@ -352,6 +369,8 @@ static void wil_connect_worker(struct work_struct *work)
         int rc;
         struct wil6210_priv *wil = container_of(work, struct wil6210_priv,
                                                 connect_worker);
+        struct net_device *ndev = wil_to_ndev(wil);
+
         int cid = wil->pending_connect_cid;
         int ringid = wil_find_free_vring(wil);
 
@@ -366,7 +385,7 @@ static void wil_connect_worker(struct work_struct *work)
         wil->pending_connect_cid = -1;
         if (rc == 0) {
                 wil->sta[cid].status = wil_sta_connected;
-                wil_link_on(wil);
+                netif_tx_wake_all_queues(ndev);
         } else {
                 wil->sta[cid].status = wil_sta_unused;
         }
@@ -384,6 +403,9 @@ int wil_priv_init(struct wil6210_priv *wil)
 
         mutex_init(&wil->mutex);
         mutex_init(&wil->wmi_mutex);
+        mutex_init(&wil->back_rx_mutex);
+        mutex_init(&wil->back_tx_mutex);
+        mutex_init(&wil->probe_client_mutex);
 
         init_completion(&wil->wmi_ready);
         init_completion(&wil->wmi_call);
@@ -396,25 +418,39 @@ int wil_priv_init(struct wil6210_priv *wil)
         INIT_WORK(&wil->disconnect_worker, wil_disconnect_worker);
         INIT_WORK(&wil->wmi_event_worker, wmi_event_worker);
         INIT_WORK(&wil->fw_error_worker, wil_fw_error_worker);
+        INIT_WORK(&wil->back_rx_worker, wil_back_rx_worker);
+        INIT_WORK(&wil->back_tx_worker, wil_back_tx_worker);
+        INIT_WORK(&wil->probe_client_worker, wil_probe_client_worker);
 
         INIT_LIST_HEAD(&wil->pending_wmi_ev);
+        INIT_LIST_HEAD(&wil->back_rx_pending);
+        INIT_LIST_HEAD(&wil->back_tx_pending);
+        INIT_LIST_HEAD(&wil->probe_client_pending);
         spin_lock_init(&wil->wmi_ev_lock);
         init_waitqueue_head(&wil->wq);
 
-        wil->wmi_wq = create_singlethread_workqueue(WIL_NAME"_wmi");
+        wil->wmi_wq = create_singlethread_workqueue(WIL_NAME "_wmi");
         if (!wil->wmi_wq)
                 return -EAGAIN;
 
-        wil->wmi_wq_conn = create_singlethread_workqueue(WIL_NAME"_connect");
-        if (!wil->wmi_wq_conn) {
-                destroy_workqueue(wil->wmi_wq);
-                return -EAGAIN;
-        }
+        wil->wq_service = create_singlethread_workqueue(WIL_NAME "_service");
+        if (!wil->wq_service)
+                goto out_wmi_wq;
 
         wil->last_fw_recovery = jiffies;
-        wil->itr_trsh = itr_trsh;
+        wil->tx_interframe_timeout = WIL6210_ITR_TX_INTERFRAME_TIMEOUT_DEFAULT;
+        wil->rx_interframe_timeout = WIL6210_ITR_RX_INTERFRAME_TIMEOUT_DEFAULT;
+        wil->tx_max_burst_duration = WIL6210_ITR_TX_MAX_BURST_DURATION_DEFAULT;
+        wil->rx_max_burst_duration = WIL6210_ITR_RX_MAX_BURST_DURATION_DEFAULT;
 
+        if (rx_ring_overflow_thrsh == WIL6210_RX_HIGH_TRSH_INIT)
+                rx_ring_overflow_thrsh = WIL6210_RX_HIGH_TRSH_DEFAULT;
         return 0;
+
+out_wmi_wq:
+        destroy_workqueue(wil->wmi_wq);
+
+        return -EAGAIN;
 }
 
 /**
@@ -448,7 +484,13 @@ void wil_priv_deinit(struct wil6210_priv *wil)
         wil6210_disconnect(wil, NULL, WLAN_REASON_DEAUTH_LEAVING, false);
         mutex_unlock(&wil->mutex);
         wmi_event_flush(wil);
-        destroy_workqueue(wil->wmi_wq_conn);
+        wil_back_rx_flush(wil);
+        cancel_work_sync(&wil->back_rx_worker);
+        wil_back_tx_flush(wil);
+        cancel_work_sync(&wil->back_tx_worker);
+        wil_probe_client_flush(wil);
+        cancel_work_sync(&wil->probe_client_worker);
+        destroy_workqueue(wil->wq_service);
         destroy_workqueue(wil->wmi_wq);
 }
 
@@ -478,13 +520,10 @@ static int wil_target_reset(struct wil6210_priv *wil)
 {
         int delay = 0;
         u32 x;
-        u32 rev_id;
-        bool is_sparrow = (wil->board->board == WIL_BOARD_SPARROW);
+        bool is_reset_v2 = test_bit(hw_capability_reset_v2,
+                                    wil->hw_capabilities);
 
-        wil_dbg_misc(wil, "Resetting \"%s\"...\n", wil->board->name);
-
-        wil->hw_version = R(RGF_USER_FW_REV_ID);
-        rev_id = wil->hw_version & 0xff;
+        wil_dbg_misc(wil, "Resetting \"%s\"...\n", wil->hw_name);
 
         /* Clear MAC link up */
         S(RGF_HP_CTRL, BIT(15));
@@ -496,7 +535,7 @@ static int wil_target_reset(struct wil6210_priv *wil)
         /* Clear Fw Download notification */
         C(RGF_USER_USAGE_6, BIT(0));
 
-        if (is_sparrow) {
+        if (is_reset_v2) {
                 S(RGF_CAF_OSC_CONTROL, BIT_CAF_OSC_XTAL_EN);
                 /* XTAL stabilization should take about 3ms */
                 usleep_range(5000, 7000);
@@ -517,10 +556,11 @@ static int wil_target_reset(struct wil6210_priv *wil)
 
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0xFE000000);
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_1, 0x0000003F);
-        W(RGF_USER_CLKS_CTL_SW_RST_VEC_3, is_sparrow ? 0x000000f0 : 0x00000170);
+        W(RGF_USER_CLKS_CTL_SW_RST_VEC_3,
+          is_reset_v2 ? 0x000000f0 : 0x00000170);
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_0, 0xFFE7FE00);
 
-        if (is_sparrow) {
+        if (is_reset_v2) {
                 W(RGF_USER_CLKS_CTL_EXT_SW_RST_VEC_0, 0x0);
                 W(RGF_USER_CLKS_CTL_EXT_SW_RST_VEC_1, 0x0);
         }
@@ -530,19 +570,14 @@ static int wil_target_reset(struct wil6210_priv *wil)
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_1, 0);
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_0, 0);
 
-        if (is_sparrow) {
+        if (is_reset_v2) {
                 W(RGF_USER_CLKS_CTL_SW_RST_VEC_3, 0x00000003);
                 /* reset A2 PCIE AHB */
                 W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0x00008000);
         } else {
                 W(RGF_USER_CLKS_CTL_SW_RST_VEC_3, 0x00000001);
-                if (rev_id == 1) {
-                        /* reset A1 BOTH PCIE AHB & PCIE RGF */
-                        W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0x00000080);
-                } else {
-                        W(RGF_PCIE_LOS_COUNTER_CTL, BIT(6) | BIT(8));
-                        W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0x00008000);
-                }
+                W(RGF_PCIE_LOS_COUNTER_CTL, BIT(6) | BIT(8));
+                W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0x00008000);
         }
 
         /* TODO: check order here!!! Erez code is different */
@@ -559,8 +594,7 @@ static int wil_target_reset(struct wil6210_priv *wil)
                 }
         } while (x != HW_MACHINE_BOOT_DONE);
 
-        /* TODO: Erez check rev_id != 1 */
-        if (!is_sparrow && (rev_id != 1))
+        if (!is_reset_v2)
                 W(RGF_PCIE_LOS_COUNTER_CTL, BIT(8));
 
         C(RGF_USER_CLKS_CTL_0, BIT_USER_CLKS_RST_PWGD);
@@ -569,26 +603,6 @@ static int wil_target_reset(struct wil6210_priv *wil)
         return 0;
 }
 
-/**
- * wil_set_itr_trsh: - apply interrupt coalescing params
- */
-void wil_set_itr_trsh(struct wil6210_priv *wil)
-{
-        /* disable, use usec resolution */
-        W(RGF_DMA_ITR_CNT_CRL, BIT_DMA_ITR_CNT_CRL_EXT_TICK);
-
-        /* disable interrupt moderation for monitor
-         * to get better timestamp precision
-         */
-        if (wil->wdev->iftype == NL80211_IFTYPE_MONITOR)
-                return;
-
-        wil_info(wil, "set ITR_TRSH = %d usec\n", wil->itr_trsh);
-        W(RGF_DMA_ITR_CNT_TRSH, wil->itr_trsh);
-        W(RGF_DMA_ITR_CNT_CRL, BIT_DMA_ITR_CNT_CRL_EN |
-          BIT_DMA_ITR_CNT_CRL_EXT_TICK); /* start it */
-}
-
 #undef R
 #undef W
 #undef S
@@ -629,13 +643,17 @@ int wil_reset(struct wil6210_priv *wil)
 
         wil_dbg_misc(wil, "%s()\n", __func__);
 
+        if (wil->hw_version == HW_VER_UNKNOWN)
+                return -ENODEV;
+
         WARN_ON(!mutex_is_locked(&wil->mutex));
-        WARN_ON(test_bit(wil_status_napi_en, &wil->status));
+        WARN_ON(test_bit(wil_status_napi_en, wil->status));
 
         cancel_work_sync(&wil->disconnect_worker);
         wil6210_disconnect(wil, NULL, WLAN_REASON_DEAUTH_LEAVING, false);
 
-        wil->status = 0; /* prevent NAPI from being scheduled */
+        /* prevent NAPI from being scheduled */
+        bitmap_zero(wil->status, wil_status_last);
 
         if (wil->scan_request) {
                 wil_dbg_misc(wil, "Abort scan_request 0x%p\n",
@@ -649,7 +667,7 @@ int wil_reset(struct wil6210_priv *wil)
 
         wmi_event_flush(wil);
 
-        flush_workqueue(wil->wmi_wq_conn);
+        flush_workqueue(wil->wq_service);
         flush_workqueue(wil->wmi_wq);
 
         rc = wil_target_reset(wil);
@@ -688,6 +706,7 @@ int wil_reset(struct wil6210_priv *wil)
         reinit_completion(&wil->wmi_ready);
         reinit_completion(&wil->wmi_call);
 
+        wil_configure_interrupt_moderation(wil);
         wil_unmask_irq(wil);
 
         /* we just started MAC, wait for FW ready */
@@ -703,28 +722,6 @@ void wil_fw_error_recovery(struct wil6210_priv *wil)
         schedule_work(&wil->fw_error_worker);
 }
 
-void wil_link_on(struct wil6210_priv *wil)
-{
-        struct net_device *ndev = wil_to_ndev(wil);
-
-        wil_dbg_misc(wil, "%s()\n", __func__);
-
-        netif_carrier_on(ndev);
-        wil_dbg_misc(wil, "netif_tx_wake : link on\n");
-        netif_tx_wake_all_queues(ndev);
-}
-
-void wil_link_off(struct wil6210_priv *wil)
-{
-        struct net_device *ndev = wil_to_ndev(wil);
-
-        wil_dbg_misc(wil, "%s()\n", __func__);
-
-        netif_tx_stop_all_queues(ndev);
-        wil_dbg_misc(wil, "netif_tx_stop : link off\n");
-        netif_carrier_off(ndev);
-}
-
 int __wil_up(struct wil6210_priv *wil)
 {
         struct net_device *ndev = wil_to_ndev(wil);
@@ -774,7 +771,7 @@ int __wil_up(struct wil6210_priv *wil)
         wil_dbg_misc(wil, "NAPI enable\n");
         napi_enable(&wil->napi_rx);
         napi_enable(&wil->napi_tx);
-        set_bit(wil_status_napi_en, &wil->status);
+        set_bit(wil_status_napi_en, wil->status);
 
         if (wil->platform_ops.bus_request)
                 wil->platform_ops.bus_request(wil->platform_handle,
@@ -807,7 +804,7 @@ int __wil_down(struct wil6210_priv *wil)
                 wil->platform_ops.bus_request(wil->platform_handle, 0);
 
         wil_disable_irq(wil);
-        if (test_and_clear_bit(wil_status_napi_en, &wil->status)) {
+        if (test_and_clear_bit(wil_status_napi_en, wil->status)) {
                 napi_disable(&wil->napi_rx);
                 napi_disable(&wil->napi_tx);
                 wil_dbg_misc(wil, "NAPI disable\n");
@@ -822,15 +819,15 @@ int __wil_down(struct wil6210_priv *wil)
                 wil->scan_request = NULL;
         }
 
-        if (test_bit(wil_status_fwconnected, &wil->status) ||
-            test_bit(wil_status_fwconnecting, &wil->status))
+        if (test_bit(wil_status_fwconnected, wil->status) ||
+            test_bit(wil_status_fwconnecting, wil->status))
                 wmi_send(wil, WMI_DISCONNECT_CMDID, NULL, 0);
 
         /* make sure wil is idle (not connected) */
         mutex_unlock(&wil->mutex);
         while (iter--) {
-                int idle = !test_bit(wil_status_fwconnected, &wil->status) &&
-                           !test_bit(wil_status_fwconnecting, &wil->status);
+                int idle = !test_bit(wil_status_fwconnected, wil->status) &&
+                           !test_bit(wil_status_fwconnecting, wil->status);
                 if (idle)
                         break;
                 msleep(WAIT_FOR_DISCONNECT_INTERVAL_MS);
diff --git a/drivers/net/wireless/ath/wil6210/netdev.c b/drivers/net/wireless/ath/wil6210/netdev.c
index e81703ca7701..ace30c1b5c64 100644
--- a/drivers/net/wireless/ath/wil6210/netdev.c
+++ b/drivers/net/wireless/ath/wil6210/netdev.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014 Qualcomm Atheros, Inc.
+ * Copyright (c) 2012-2015 Qualcomm Atheros, Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,6 @@
  */
 
 #include <linux/etherdevice.h>
-
 #include "wil6210.h"
 #include "txrx.h"
 
@@ -122,6 +121,12 @@ static int wil6210_netdev_poll_tx(struct napi_struct *napi, int budget)
         return min(tx_done, budget);
 }
 
+static void wil_dev_setup(struct net_device *dev)
+{
+        ether_setup(dev);
+        dev->tx_queue_len = WIL_TX_Q_LEN_DEFAULT;
+}
+
 void *wil_if_alloc(struct device *dev, void __iomem *csr)
 {
         struct net_device *ndev;
@@ -153,7 +158,7 @@ void *wil_if_alloc(struct device *dev, void __iomem *csr)
         ch = wdev->wiphy->bands[IEEE80211_BAND_60GHZ]->channels;
         cfg80211_chandef_create(&wdev->preset_chandef, ch, NL80211_CHAN_NO_HT);
 
-        ndev = alloc_netdev(0, "wlan%d", NET_NAME_UNKNOWN, ether_setup);
+        ndev = alloc_netdev(0, "wlan%d", NET_NAME_UNKNOWN, wil_dev_setup);
         if (!ndev) {
                 dev_err(dev, "alloc_netdev_mqs failed\n");
                 rc = -ENOMEM;
@@ -174,7 +179,7 @@ void *wil_if_alloc(struct device *dev, void __iomem *csr)
         netif_napi_add(ndev, &wil->napi_tx, wil6210_netdev_poll_tx,
                        WIL6210_NAPI_BUDGET);
 
-        wil_link_off(wil);
+        netif_tx_stop_all_queues(ndev);
 
         return wil;
 
@@ -217,8 +222,6 @@ int wil_if_add(struct wil6210_priv *wil)
                 return rc;
         }
 
-        wil_link_off(wil);
-
         return 0;
 }
 
diff --git a/drivers/net/wireless/ath/wil6210/pcie_bus.c b/drivers/net/wireless/ath/wil6210/pcie_bus.c
index 66626a8ee728..3dd26709ccb2 100644
--- a/drivers/net/wireless/ath/wil6210/pcie_bus.c
+++ b/drivers/net/wireless/ath/wil6210/pcie_bus.c
@@ -31,6 +31,46 @@ static bool debug_fw; /* = false; */
 module_param(debug_fw, bool, S_IRUGO);
 MODULE_PARM_DESC(debug_fw, " load driver if FW not ready. For FW debug");
 
+static
+void wil_set_capabilities(struct wil6210_priv *wil)
+{
+        u32 rev_id = ioread32(wil->csr + HOSTADDR(RGF_USER_JTAG_DEV_ID));
+
+        bitmap_zero(wil->hw_capabilities, hw_capability_last);
+
+        switch (rev_id) {
+        case JTAG_DEV_ID_MARLON_B0:
+                wil->hw_name = "Marlon B0";
+                wil->hw_version = HW_VER_MARLON_B0;
+                break;
+        case JTAG_DEV_ID_SPARROW_A0:
+                wil->hw_name = "Sparrow A0";
+                wil->hw_version = HW_VER_SPARROW_A0;
+                break;
+        case JTAG_DEV_ID_SPARROW_A1:
+                wil->hw_name = "Sparrow A1";
+                wil->hw_version = HW_VER_SPARROW_A1;
+                break;
+        case JTAG_DEV_ID_SPARROW_B0:
+                wil->hw_name = "Sparrow B0";
+                wil->hw_version = HW_VER_SPARROW_B0;
+                break;
+        default:
+                wil_err(wil, "Unknown board hardware 0x%08x\n", rev_id);
+                wil->hw_name = "Unknown";
+                wil->hw_version = HW_VER_UNKNOWN;
+        }
+
+        wil_info(wil, "Board hardware is %s\n", wil->hw_name);
+
+        if (wil->hw_version >= HW_VER_SPARROW_A0)
+                set_bit(hw_capability_reset_v2, wil->hw_capabilities);
+
+        if (wil->hw_version >= HW_VER_SPARROW_B0)
+                set_bit(hw_capability_advanced_itr_moderation,
+                        wil->hw_capabilities);
+}
+
 void wil_disable_irq(struct wil6210_priv *wil)
 {
         int irq = wil->pdev->irq;
@@ -149,12 +189,11 @@ static int wil_pcie_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         struct wil6210_priv *wil;
         struct device *dev = &pdev->dev;
         void __iomem *csr;
-        struct wil_board *board = (struct wil_board *)id->driver_data;
         int rc;
 
         /* check HW */
         dev_info(&pdev->dev, WIL_NAME
-                 " \"%s\" device found [%04x:%04x] (rev %x)\n", board->name,
+                 " device found [%04x:%04x] (rev %x)\n",
                  (int)pdev->vendor, (int)pdev->device, (int)pdev->revision);
 
         if (pci_resource_len(pdev, 0) != WIL6210_MEM_SIZE) {
@@ -204,8 +243,7 @@ static int wil_pcie_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 
         pci_set_drvdata(pdev, wil);
         wil->pdev = pdev;
-        wil->board = board;
-
+        wil_set_capabilities(wil);
         wil6210_clear_irq(wil);
 
         wil->platform_handle =
@@ -266,23 +304,10 @@ static void wil_pcie_remove(struct pci_dev *pdev)
         pci_disable_device(pdev);
 }
 
-static const struct wil_board wil_board_marlon = {
-        .board = WIL_BOARD_MARLON,
-        .name = "marlon",
-};
-
-static const struct wil_board wil_board_sparrow = {
-        .board = WIL_BOARD_SPARROW,
-        .name = "sparrow",
-};
-
 static const struct pci_device_id wil6210_pcie_ids[] = {
-        { PCI_DEVICE(0x1ae9, 0x0301),
-          .driver_data = (kernel_ulong_t)&wil_board_marlon },
-        { PCI_DEVICE(0x1ae9, 0x0310),
-          .driver_data = (kernel_ulong_t)&wil_board_sparrow },
-        { PCI_DEVICE(0x1ae9, 0x0302), /* same as above, firmware broken */
-          .driver_data = (kernel_ulong_t)&wil_board_sparrow },
+        { PCI_DEVICE(0x1ae9, 0x0301) },
+        { PCI_DEVICE(0x1ae9, 0x0310) },
+        { PCI_DEVICE(0x1ae9, 0x0302) }, /* same as above, firmware broken */
         { /* end: all zeroes */ },
 };
 MODULE_DEVICE_TABLE(pci, wil6210_pcie_ids);
diff --git a/drivers/net/wireless/ath/wil6210/rx_reorder.c b/drivers/net/wireless/ath/wil6210/rx_reorder.c
index 489cb73d139b..ca10dcf0986e 100644
--- a/drivers/net/wireless/ath/wil6210/rx_reorder.c
+++ b/drivers/net/wireless/ath/wil6210/rx_reorder.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014 Qualcomm Atheros, Inc.
+ * Copyright (c) 2014-2015 Qualcomm Atheros, Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -89,7 +89,9 @@ static void wil_reorder_release(struct wil6210_priv *wil,
         }
 }
 
+/* called in NAPI context */
 void wil_rx_reorder(struct wil6210_priv *wil, struct sk_buff *skb)
+__acquires(&sta->tid_rx_lock) __releases(&sta->tid_rx_lock)
 {
         struct net_device *ndev = wil_to_ndev(wil);
         struct vring_rx_desc *d = wil_skb_rxdesc(skb);
@@ -97,22 +99,26 @@ void wil_rx_reorder(struct wil6210_priv *wil, struct sk_buff *skb)
         int cid = wil_rxdesc_cid(d);
         int mid = wil_rxdesc_mid(d);
         u16 seq = wil_rxdesc_seq(d);
+        int mcast = wil_rxdesc_mcast(d);
         struct wil_sta_info *sta = &wil->sta[cid];
         struct wil_tid_ampdu_rx *r;
         u16 hseq;
         int index;
-        unsigned long flags;
 
-        wil_dbg_txrx(wil, "MID %d CID %d TID %d Seq 0x%03x\n",
-                     mid, cid, tid, seq);
+        wil_dbg_txrx(wil, "MID %d CID %d TID %d Seq 0x%03x mcast %01x\n",
+                     mid, cid, tid, seq, mcast);
 
-        spin_lock_irqsave(&sta->tid_rx_lock, flags);
+        if (unlikely(mcast)) {
+                wil_netif_rx_any(skb, ndev);
+                return;
+        }
+
+        spin_lock(&sta->tid_rx_lock);
 
         r = sta->tid_rx[tid];
         if (!r) {
-                spin_unlock_irqrestore(&sta->tid_rx_lock, flags);
                 wil_netif_rx_any(skb, ndev);
-                return;
+                goto out;
         }
 
         hseq = r->head_seq_num;
@@ -121,13 +127,24 @@ void wil_rx_reorder(struct wil6210_priv *wil, struct sk_buff *skb)
          * reported, and data Rx, few packets may be pass up before reorder
          * buffer get allocated. Catch up by pretending SSN is what we
          * see in the 1-st Rx packet
+         *
+         * Another scenario, Rx get delayed and we got packet from before
+         * BACK. Pass it to the stack and wait.
          */
         if (r->first_time) {
                 r->first_time = false;
                 if (seq != r->head_seq_num) {
-                        wil_err(wil, "Error: 1-st frame with wrong sequence"
-                                " %d, should be %d. Fixing...\n", seq,
-                                r->head_seq_num);
+                        if (seq_less(seq, r->head_seq_num)) {
+                                wil_err(wil,
+                                        "Error: frame with early sequence 0x%03x, should be 0x%03x. Waiting...\n",
+                                        seq, r->head_seq_num);
+                                r->first_time = true;
+                                wil_netif_rx_any(skb, ndev);
+                                goto out;
+                        }
+                        wil_err(wil,
+                                "Error: 1-st frame with wrong sequence 0x%03x, should be 0x%03x. Fixing...\n",
+                                seq, r->head_seq_num);
                         r->head_seq_num = seq;
                         r->ssn = seq;
                 }
@@ -179,7 +196,7 @@ void wil_rx_reorder(struct wil6210_priv *wil, struct sk_buff *skb)
         wil_reorder_release(wil, r);
 
 out:
-        spin_unlock_irqrestore(&sta->tid_rx_lock, flags);
+        spin_unlock(&sta->tid_rx_lock);
 }
 
 struct wil_tid_ampdu_rx *wil_tid_ampdu_rx_alloc(struct wil6210_priv *wil,
@@ -219,3 +236,241 @@ void wil_tid_ampdu_rx_free(struct wil6210_priv *wil,
         kfree(r->reorder_time);
         kfree(r);
 }
+
+/* ADDBA processing */
+static u16 wil_agg_size(struct wil6210_priv *wil, u16 req_agg_wsize)
+{
+        u16 max_agg_size = min_t(u16, WIL_MAX_AGG_WSIZE, WIL_MAX_AMPDU_SIZE /
+                                 (mtu_max + WIL_MAX_MPDU_OVERHEAD));
+
+        if (!req_agg_wsize)
+                return max_agg_size;
+
+        return min(max_agg_size, req_agg_wsize);
+}
+
+/* Block Ack - Rx side (recipient */
+int wil_addba_rx_request(struct wil6210_priv *wil, u8 cidxtid,
+                         u8 dialog_token, __le16 ba_param_set,
+                         __le16 ba_timeout, __le16 ba_seq_ctrl)
+{
+        struct wil_back_rx *req = kzalloc(sizeof(*req), GFP_KERNEL);
+
+        if (!req)
+                return -ENOMEM;
+
+        req->cidxtid = cidxtid;
+        req->dialog_token = dialog_token;
+        req->ba_param_set = le16_to_cpu(ba_param_set);
+        req->ba_timeout = le16_to_cpu(ba_timeout);
+        req->ba_seq_ctrl = le16_to_cpu(ba_seq_ctrl);
+
+        mutex_lock(&wil->back_rx_mutex);
+        list_add_tail(&req->list, &wil->back_rx_pending);
+        mutex_unlock(&wil->back_rx_mutex);
+
+        queue_work(wil->wq_service, &wil->back_rx_worker);
+
+        return 0;
+}
+
+static void wil_back_rx_handle(struct wil6210_priv *wil,
+                               struct wil_back_rx *req)
+__acquires(&sta->tid_rx_lock) __releases(&sta->tid_rx_lock)
+{
+        struct wil_sta_info *sta;
+        u8 cid, tid;
+        u16 agg_wsize = 0;
+        /* bit 0: A-MSDU supported
+         * bit 1: policy (should be 0 for us)
+         * bits 2..5: TID
+         * bits 6..15: buffer size
+         */
+        u16 req_agg_wsize = WIL_GET_BITS(req->ba_param_set, 6, 15);
+        bool agg_amsdu = !!(req->ba_param_set & BIT(0));
+        int ba_policy = req->ba_param_set & BIT(1);
+        u16 agg_timeout = req->ba_timeout;
+        u16 status = WLAN_STATUS_SUCCESS;
+        u16 ssn = req->ba_seq_ctrl >> 4;
+        struct wil_tid_ampdu_rx *r;
+        int rc;
+
+        might_sleep();
+        parse_cidxtid(req->cidxtid, &cid, &tid);
+
+        /* sanity checks */
+        if (cid >= WIL6210_MAX_CID) {
+                wil_err(wil, "BACK: invalid CID %d\n", cid);
+                return;
+        }
+
+        sta = &wil->sta[cid];
+        if (sta->status != wil_sta_connected) {
+                wil_err(wil, "BACK: CID %d not connected\n", cid);
+                return;
+        }
+
+        wil_dbg_wmi(wil,
+                    "ADDBA request for CID %d %pM TID %d size %d timeout %d AMSDU%s policy %d token %d SSN 0x%03x\n",
+                    cid, sta->addr, tid, req_agg_wsize, req->ba_timeout,
+                    agg_amsdu ? "+" : "-", !!ba_policy, req->dialog_token, ssn);
+
+        /* apply policies */
+        if (ba_policy) {
+                wil_err(wil, "BACK requested unsupported ba_policy == 1\n");
+                status = WLAN_STATUS_INVALID_QOS_PARAM;
+        }
+        if (status == WLAN_STATUS_SUCCESS)
+                agg_wsize = wil_agg_size(wil, req_agg_wsize);
+
+        rc = wmi_addba_rx_resp(wil, cid, tid, req->dialog_token, status,
+                               agg_amsdu, agg_wsize, agg_timeout);
+        if (rc || (status != WLAN_STATUS_SUCCESS))
+                return;
+
+        /* apply */
+        r = wil_tid_ampdu_rx_alloc(wil, agg_wsize, ssn);
+        spin_lock_bh(&sta->tid_rx_lock);
+        wil_tid_ampdu_rx_free(wil, sta->tid_rx[tid]);
+        sta->tid_rx[tid] = r;
+        spin_unlock_bh(&sta->tid_rx_lock);
+}
+
+void wil_back_rx_flush(struct wil6210_priv *wil)
+{
+        struct wil_back_rx *evt, *t;
+
+        wil_dbg_misc(wil, "%s()\n", __func__);
+
+        mutex_lock(&wil->back_rx_mutex);
+
+        list_for_each_entry_safe(evt, t, &wil->back_rx_pending, list) {
+                list_del(&evt->list);
+                kfree(evt);
+        }
+
+        mutex_unlock(&wil->back_rx_mutex);
+}
+
+/* Retrieve next ADDBA request from the pending list */
+static struct list_head *next_back_rx(struct wil6210_priv *wil)
+{
+        struct list_head *ret = NULL;
+
+        mutex_lock(&wil->back_rx_mutex);
+
+        if (!list_empty(&wil->back_rx_pending)) {
+                ret = wil->back_rx_pending.next;
+                list_del(ret);
+        }
+
+        mutex_unlock(&wil->back_rx_mutex);
+
+        return ret;
+}
+
+void wil_back_rx_worker(struct work_struct *work)
+{
+        struct wil6210_priv *wil = container_of(work, struct wil6210_priv,
+                                                back_rx_worker);
+        struct wil_back_rx *evt;
+        struct list_head *lh;
+
+        while ((lh = next_back_rx(wil)) != NULL) {
+                evt = list_entry(lh, struct wil_back_rx, list);
+
+                wil_back_rx_handle(wil, evt);
+                kfree(evt);
+        }
+}
+
+/* BACK - Tx (originator) side */
+static void wil_back_tx_handle(struct wil6210_priv *wil,
+                               struct wil_back_tx *req)
+{
+        struct vring_tx_data *txdata = &wil->vring_tx_data[req->ringid];
+        int rc;
+
+        if (txdata->addba_in_progress) {
+                wil_dbg_misc(wil, "ADDBA for vring[%d] already in progress\n",
+                             req->ringid);
+                return;
+        }
+        if (txdata->agg_wsize) {
+                wil_dbg_misc(wil,
+                             "ADDBA for vring[%d] already established wsize %d\n",
+                             req->ringid, txdata->agg_wsize);
+                return;
+        }
+        txdata->addba_in_progress = true;
+        rc = wmi_addba(wil, req->ringid, req->agg_wsize, req->agg_timeout);
+        if (rc)
+                txdata->addba_in_progress = false;
+}
+
+static struct list_head *next_back_tx(struct wil6210_priv *wil)
+{
+        struct list_head *ret = NULL;
+
+        mutex_lock(&wil->back_tx_mutex);
+
+        if (!list_empty(&wil->back_tx_pending)) {
+                ret = wil->back_tx_pending.next;
+                list_del(ret);
+        }
+
+        mutex_unlock(&wil->back_tx_mutex);
+
+        return ret;
+}
+
+void wil_back_tx_worker(struct work_struct *work)
+{
+        struct wil6210_priv *wil = container_of(work, struct wil6210_priv,
+                                                 back_tx_worker);
+        struct wil_back_tx *evt;
+        struct list_head *lh;
+
+        while ((lh = next_back_tx(wil)) != NULL) {
+                evt = list_entry(lh, struct wil_back_tx, list);
+
+                wil_back_tx_handle(wil, evt);
+                kfree(evt);
+        }
+}
+
+void wil_back_tx_flush(struct wil6210_priv *wil)
+{
+        struct wil_back_tx *evt, *t;
+
+        wil_dbg_misc(wil, "%s()\n", __func__);
+
+        mutex_lock(&wil->back_tx_mutex);
+
+        list_for_each_entry_safe(evt, t, &wil->back_tx_pending, list) {
+                list_del(&evt->list);
+                kfree(evt);
+        }
+
+        mutex_unlock(&wil->back_tx_mutex);
+}
+
+int wil_addba_tx_request(struct wil6210_priv *wil, u8 ringid, u16 wsize)
+{
+        struct wil_back_tx *req = kzalloc(sizeof(*req), GFP_KERNEL);
+
+        if (!req)
+                return -ENOMEM;
+
+        req->ringid = ringid;
+        req->agg_wsize = wil_agg_size(wil, wsize);
+        req->agg_timeout = 0;
+
+        mutex_lock(&wil->back_tx_mutex);
+        list_add_tail(&req->list, &wil->back_tx_pending);
+        mutex_unlock(&wil->back_tx_mutex);
+
+        queue_work(wil->wq_service, &wil->back_tx_worker);
+
+        return 0;
+}
diff --git a/drivers/net/wireless/ath/wil6210/txrx.c b/drivers/net/wireless/ath/wil6210/txrx.c
index e3f8bdce5abc..8439f65db259 100644
--- a/drivers/net/wireless/ath/wil6210/txrx.c
+++ b/drivers/net/wireless/ath/wil6210/txrx.c
@@ -463,7 +463,7 @@ static struct sk_buff *wil_vring_reap_rx(struct wil6210_priv *wil,
          * and in case of error drop the packet
          * higher stack layers will handle retransmission (if required)
          */
-        if (d->dma.status & RX_DMA_STATUS_L4_IDENT) {
+        if (d->dma.status & RX_DMA_STATUS_L4I) {
                 /* L4 protocol identified, csum calculated */
                 if ((d->dma.error & RX_DMA_ERROR_L4_ERR) == 0)
                         skb->ip_summed = CHECKSUM_UNNECESSARY;
@@ -581,14 +581,8 @@ void wil_rx_handle(struct wil6210_priv *wil, int *quota)
                         skb->protocol = htons(ETH_P_802_2);
                         wil_netif_rx_any(skb, ndev);
                 } else {
-                        struct ethhdr *eth = (void *)skb->data;
-
                         skb->protocol = eth_type_trans(skb, ndev);
-
-                        if (is_unicast_ether_addr(eth->h_dest))
-                                wil_rx_reorder(wil, skb);
-                        else
-                                wil_netif_rx_any(skb, ndev);
+                        wil_rx_reorder(wil, skb);
                 }
         }
         wil_rx_refill(wil, v->size);
@@ -645,7 +639,7 @@ int wil_vring_init_tx(struct wil6210_priv *wil, int id, int size,
                 .vring_cfg = {
                         .tx_sw_ring = {
                                 .max_mpdu_size =
-                                        cpu_to_le16(mtu_max + ETH_HLEN),
+                                        cpu_to_le16(wil_mtu2macbuf(mtu_max)),
                                 .ring_size = cpu_to_le16(size),
                         },
                         .ringid = id,
@@ -653,7 +647,7 @@ int wil_vring_init_tx(struct wil6210_priv *wil, int id, int size,
                         .encap_trans_type = WMI_VRING_ENC_TYPE_802_3,
                         .mac_ctrl = 0,
                         .to_resolution = 0,
-                        .agg_max_wsize = 16,
+                        .agg_max_wsize = 0,
                         .schd_params = {
                                 .priority = cpu_to_le16(0),
                                 .timeslot_us = cpu_to_le16(0xfff),
@@ -677,6 +671,7 @@ int wil_vring_init_tx(struct wil6210_priv *wil, int id, int size,
         }
 
         memset(txdata, 0, sizeof(*txdata));
+        spin_lock_init(&txdata->lock);
         vring->size = size;
         rc = wil_vring_alloc(wil, vring);
         if (rc)
@@ -701,6 +696,8 @@ int wil_vring_init_tx(struct wil6210_priv *wil, int id, int size,
         vring->hwtail = le32_to_cpu(reply.cmd.tx_vring_tail_ptr);
 
         txdata->enabled = 1;
+        if (wil->sta[cid].data_port_open && (agg_wsize >= 0))
+                wil_addba_tx_request(wil, id, agg_wsize);
 
         return 0;
  out_free:
@@ -713,6 +710,7 @@ int wil_vring_init_tx(struct wil6210_priv *wil, int id, int size,
 void wil_vring_fini_tx(struct wil6210_priv *wil, int id)
 {
         struct vring *vring = &wil->vring_tx[id];
+        struct vring_tx_data *txdata = &wil->vring_tx_data[id];
 
         WARN_ON(!mutex_is_locked(&wil->mutex));
 
@@ -721,12 +719,15 @@ void wil_vring_fini_tx(struct wil6210_priv *wil, int id)
 
         wil_dbg_misc(wil, "%s() id=%d\n", __func__, id);
 
+        spin_lock_bh(&txdata->lock);
+        txdata->enabled = 0; /* no Tx can be in progress or start anew */
+        spin_unlock_bh(&txdata->lock);
         /* make sure NAPI won't touch this vring */
-        wil->vring_tx_data[id].enabled = 0;
-        if (test_bit(wil_status_napi_en, &wil->status))
+        if (test_bit(wil_status_napi_en, wil->status))
                 napi_synchronize(&wil->napi_tx);
 
         wil_vring_free(wil, vring, 1);
+        memset(txdata, 0, sizeof(*txdata));
 }
 
 static struct vring *wil_find_tx_vring(struct wil6210_priv *wil,
@@ -773,6 +774,38 @@ static void wil_set_da_for_vring(struct wil6210_priv *wil,
 
 static int wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
                         struct sk_buff *skb);
+
+static struct vring *wil_find_tx_vring_sta(struct wil6210_priv *wil,
+                                           struct sk_buff *skb)
+{
+        struct vring *v;
+        int i;
+        u8 cid;
+
+        /* In the STA mode, it is expected to have only 1 VRING
+         * for the AP we connected to.
+         * find 1-st vring and see whether it is eligible for data
+         */
+        for (i = 0; i < WIL6210_MAX_TX_RINGS; i++) {
+                v = &wil->vring_tx[i];
+                if (!v->va)
+                        continue;
+
+                cid = wil->vring2cid_tid[i][0];
+                if (!wil->sta[cid].data_port_open &&
+                    (skb->protocol != cpu_to_be16(ETH_P_PAE)))
+                        break;
+
+                wil_dbg_txrx(wil, "Tx -> ring %d\n", i);
+
+                return v;
+        }
+
+        wil_dbg_txrx(wil, "Tx while no vrings active?\n");
+
+        return NULL;
+}
+
 /*
  * Find 1-st vring and return it; set dest address for this vring in skb
  * duplicate skb and send it to other active vrings
@@ -843,9 +876,6 @@ static int wil_tx_desc_map(struct vring_tx_desc *d, dma_addr_t pa, u32 len,
         d->mac.d[1] = 0;
         d->mac.d[2] = 0;
         d->mac.ucode_cmd = 0;
-        /* use dst index 0 */
-        d->mac.d[1] |= BIT(MAC_CFG_DESC_TX_1_DST_INDEX_EN_POS) |
-                       (0 << MAC_CFG_DESC_TX_1_DST_INDEX_POS);
         /* translation type:  0 - bypass; 1 - 802.3; 2 - native wifi */
         d->mac.d[2] = BIT(MAC_CFG_DESC_TX_2_SNAP_HDR_INSERTION_EN_POS) |
                       (1 << MAC_CFG_DESC_TX_2_L2_TRANSLATION_TYPE_POS);
@@ -908,8 +938,8 @@ static int wil_tx_desc_offload_cksum_set(struct wil6210_priv *wil,
         return 0;
 }
 
-static int wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
-                        struct sk_buff *skb)
+static int __wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
+                          struct sk_buff *skb)
 {
         struct device *dev = wil_to_dev(wil);
         struct vring_tx_desc dd, *d = &dd;
@@ -925,18 +955,21 @@ static int wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
 
         wil_dbg_txrx(wil, "%s()\n", __func__);
 
+        if (unlikely(!txdata->enabled))
+                return -EINVAL;
+
         if (avail < 1 + nr_frags) {
                 wil_err_ratelimited(wil,
-                                    "Tx ring full. No space for %d fragments\n",
-                                    1 + nr_frags);
+                                    "Tx ring[%2d] full. No space for %d fragments\n",
+                                    vring_index, 1 + nr_frags);
                 return -ENOMEM;
         }
         _d = &vring->va[i].tx;
 
         pa = dma_map_single(dev, skb->data, skb_headlen(skb), DMA_TO_DEVICE);
 
-        wil_dbg_txrx(wil, "Tx skb %d bytes 0x%p -> %pad\n", skb_headlen(skb),
-                     skb->data, &pa);
+        wil_dbg_txrx(wil, "Tx[%2d] skb %d bytes 0x%p -> %pad\n", vring_index,
+                     skb_headlen(skb), skb->data, &pa);
         wil_hex_dump_txrx("Tx ", DUMP_PREFIX_OFFSET, 16, 1,
                           skb->data, skb_headlen(skb), false);
 
@@ -947,15 +980,13 @@ static int wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
         wil_tx_desc_map(d, pa, skb_headlen(skb), vring_index);
         /* Process TCP/UDP checksum offloading */
         if (wil_tx_desc_offload_cksum_set(wil, d, skb)) {
-                wil_err(wil, "VRING #%d Failed to set cksum, drop packet\n",
+                wil_err(wil, "Tx[%2d] Failed to set cksum, drop packet\n",
                         vring_index);
                 goto dma_error;
         }
 
         vring->ctx[i].nr_frags = nr_frags;
         wil_tx_desc_set_nr_frags(d, nr_frags);
-        if (nr_frags)
-                *_d = *d;
 
         /* middle segments */
         for (; f < nr_frags; f++) {
@@ -963,6 +994,10 @@ static int wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
                                 &skb_shinfo(skb)->frags[f];
                 int len = skb_frag_size(frag);
 
+                *_d = *d;
+                wil_dbg_txrx(wil, "Tx[%2d] desc[%4d]\n", vring_index, i);
+                wil_hex_dump_txrx("TxD ", DUMP_PREFIX_NONE, 32, 4,
+                                  (const void *)d, sizeof(*d), false);
                 i = (swhead + f + 1) % vring->size;
                 _d = &vring->va[i].tx;
                 pa = skb_frag_dma_map(dev, frag, 0, skb_frag_size(frag),
@@ -976,13 +1011,15 @@ static int wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
                  * it will succeed here too
                  */
                 wil_tx_desc_offload_cksum_set(wil, d, skb);
-                *_d = *d;
         }
         /* for the last seg only */
         d->dma.d0 |= BIT(DMA_CFG_DESC_TX_0_CMD_EOP_POS);
         d->dma.d0 |= BIT(DMA_CFG_DESC_TX_0_CMD_MARK_WB_POS);
         d->dma.d0 |= BIT(DMA_CFG_DESC_TX_0_CMD_DMA_IT_POS);
         *_d = *d;
+        wil_dbg_txrx(wil, "Tx[%2d] desc[%4d]\n", vring_index, i);
+        wil_hex_dump_txrx("TxD ", DUMP_PREFIX_NONE, 32, 4,
+                          (const void *)d, sizeof(*d), false);
 
         /* hold reference to skb
          * to prevent skb release before accounting
@@ -990,15 +1027,13 @@ static int wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
          */
         vring->ctx[i].skb = skb_get(skb);
 
-        wil_hex_dump_txrx("Tx ", DUMP_PREFIX_NONE, 32, 4,
-                          (const void *)d, sizeof(*d), false);
-
         if (wil_vring_is_empty(vring)) /* performance monitoring */
                 txdata->idle += get_cycles() - txdata->last_idle;
 
         /* advance swhead */
         wil_vring_advance_head(vring, nr_frags + 1);
-        wil_dbg_txrx(wil, "Tx swhead %d -> %d\n", swhead, vring->swhead);
+        wil_dbg_txrx(wil, "Tx[%2d] swhead %d -> %d\n", vring_index, swhead,
+                     vring->swhead);
         trace_wil6210_tx(vring_index, swhead, skb->len, nr_frags);
         iowrite32(vring->swhead, wil->csr + HOSTADDR(vring->hwtail));
 
@@ -1025,6 +1060,19 @@ static int wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
         return -EINVAL;
 }
 
+static int wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
+                        struct sk_buff *skb)
+{
+        int vring_index = vring - wil->vring_tx;
+        struct vring_tx_data *txdata = &wil->vring_tx_data[vring_index];
+        int rc;
+
+        spin_lock(&txdata->lock);
+        rc = __wil_tx_vring(wil, vring, skb);
+        spin_unlock(&txdata->lock);
+        return rc;
+}
+
 netdev_tx_t wil_start_xmit(struct sk_buff *skb, struct net_device *ndev)
 {
         struct wil6210_priv *wil = ndev_to_wil(ndev);
@@ -1034,14 +1082,14 @@ netdev_tx_t wil_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         int rc;
 
         wil_dbg_txrx(wil, "%s()\n", __func__);
-        if (!test_bit(wil_status_fwready, &wil->status)) {
+        if (!test_bit(wil_status_fwready, wil->status)) {
                 if (!pr_once_fw) {
                         wil_err(wil, "FW not ready\n");
                         pr_once_fw = true;
                 }
                 goto drop;
         }
-        if (!test_bit(wil_status_fwconnected, &wil->status)) {
+        if (!test_bit(wil_status_fwconnected, wil->status)) {
                 wil_err(wil, "FW not connected\n");
                 goto drop;
         }
@@ -1052,15 +1100,19 @@ netdev_tx_t wil_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         pr_once_fw = false;
 
         /* find vring */
-        if (is_unicast_ether_addr(eth->h_dest))
-                vring = wil_find_tx_vring(wil, skb);
-        else
-                vring = wil_tx_bcast(wil, skb);
+        if (wil->wdev->iftype == NL80211_IFTYPE_STATION) {
+                /* in STA mode (ESS), all to same VRING */
+                vring = wil_find_tx_vring_sta(wil, skb);
+        } else { /* direct communication, find matching VRING */
+                if (is_unicast_ether_addr(eth->h_dest))
+                        vring = wil_find_tx_vring(wil, skb);
+                else
+                        vring = wil_tx_bcast(wil, skb);
+        }
         if (!vring) {
                 wil_dbg_txrx(wil, "No Tx VRING found for %pM\n", eth->h_dest);
                 goto drop;
         }
-
         /* set up vring entry */
         rc = wil_tx_vring(wil, vring, skb);
 
@@ -1087,6 +1139,22 @@ netdev_tx_t wil_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         return NET_XMIT_DROP;
 }
 
+static inline bool wil_need_txstat(struct sk_buff *skb)
+{
+        struct ethhdr *eth = (void *)skb->data;
+
+        return is_unicast_ether_addr(eth->h_dest) && skb->sk &&
+               (skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS);
+}
+
+static inline void wil_consume_skb(struct sk_buff *skb, bool acked)
+{
+        if (unlikely(wil_need_txstat(skb)))
+                skb_complete_wifi_ack(skb, acked);
+        else
+                acked ? dev_consume_skb_any(skb) : dev_kfree_skb_any(skb);
+}
+
 /**
  * Clean up transmitted skb's from the Tx VRING
  *
@@ -1147,10 +1215,10 @@ int wil_tx_complete(struct wil6210_priv *wil, int ringid)
                         trace_wil6210_tx_done(ringid, vring->swtail, dmalen,
                                               d->dma.error);
                         wil_dbg_txrx(wil,
-                                     "Tx[%3d] : %d bytes, status 0x%02x err 0x%02x\n",
-                                     vring->swtail, dmalen, d->dma.status,
-                                     d->dma.error);
-                        wil_hex_dump_txrx("TxC ", DUMP_PREFIX_NONE, 32, 4,
+                                     "TxC[%2d][%3d] : %d bytes, status 0x%02x err 0x%02x\n",
+                                     ringid, vring->swtail, dmalen,
+                                     d->dma.status, d->dma.error);
+                        wil_hex_dump_txrx("TxCD ", DUMP_PREFIX_NONE, 32, 4,
                                           (const void *)d, sizeof(*d), false);
 
                         wil_txdesc_unmap(dev, d, ctx);
@@ -1165,8 +1233,7 @@ int wil_tx_complete(struct wil6210_priv *wil, int ringid)
                                         ndev->stats.tx_errors++;
                                         stats->tx_errors++;
                                 }
-
-                                dev_kfree_skb_any(skb);
+                                wil_consume_skb(skb, d->dma.error == 0);
                         }
                         memset(ctx, 0, sizeof(*ctx));
                         /* There is no need to touch HW descriptor:
diff --git a/drivers/net/wireless/ath/wil6210/txrx.h b/drivers/net/wireless/ath/wil6210/txrx.h
index 630aeb5fa7f4..d90c8aa20c15 100644
--- a/drivers/net/wireless/ath/wil6210/txrx.h
+++ b/drivers/net/wireless/ath/wil6210/txrx.h
@@ -20,17 +20,15 @@
 #define BUF_SW_OWNED    (1)
 #define BUF_HW_OWNED    (0)
 
-/* size of max. Tx/Rx buffers, as supported by FW */
-#define TXRX_BUF_LEN_DEFAULT (2242)
+/* default size of MAC Tx/Rx buffers */
+#define TXRX_BUF_LEN_DEFAULT (2048)
 
 /* how many bytes to reserve for rtap header? */
 #define WIL6210_RTAP_SIZE (128)
 
 /* Tx/Rx path */
 
-/*
- * Common representation of physical address in Vring
- */
+/* Common representation of physical address in Vring */
 struct vring_dma_addr {
         __le32 addr_low;
         __le16 addr_high;
@@ -49,11 +47,10 @@ static inline void wil_desc_addr_set(struct vring_dma_addr *addr,
         addr->addr_high = cpu_to_le16((u16)upper_32_bits(pa));
 }
 
-/*
- * Tx descriptor - MAC part
+/* Tx descriptor - MAC part
  * [dword 0]
  * bit  0.. 9 : lifetime_expiry_value:10
- * bit     10 : interrup_en:1
+ * bit     10 : interrupt_en:1
  * bit     11 : status_en:1
  * bit 12..13 : txss_override:2
  * bit     14 : timestamp_insertion:1
@@ -61,15 +58,12 @@ static inline void wil_desc_addr_set(struct vring_dma_addr *addr,
  * bit 16..21 : reserved0:6
  * bit 22..26 : mcs_index:5
  * bit     27 : mcs_en:1
- * bit 28..29 : reserved1:2
- * bit     30 : reserved2:1
+ * bit 28..30 : reserved1:3
  * bit     31 : sn_preserved:1
  * [dword 1]
  * bit  0.. 3 : pkt_mode:4
  * bit      4 : pkt_mode_en:1
- * bit  5.. 7 : reserved0:3
- * bit  8..13 : reserved1:6
- * bit     14 : reserved2:1
+ * bit  5..14 : reserved0:10
  * bit     15 : ack_policy_en:1
  * bit 16..19 : dst_index:4
  * bit     20 : dst_index_en:1
@@ -80,7 +74,7 @@ static inline void wil_desc_addr_set(struct vring_dma_addr *addr,
  * [dword 2]
  * bit  0.. 7 : num_of_descriptors:8
  * bit  8..17 : reserved:10
- * bit 18..19 : l2_translation_type:2
+ * bit 18..19 : l2_translation_type:2 00 - bypass, 01 - 802.3, 10 - 802.11
  * bit     20 : snap_hdr_insertion_en:1
  * bit     21 : vlan_removal_en:1
  * bit 22..31 : reserved0:10
@@ -247,6 +241,46 @@ struct vring_tx_mac {
 
 #define TX_DMA_STATUS_DU         BIT(0)
 
+/* Tx descriptor - DMA part
+ * [dword 0]
+ * bit  0.. 7 : l4_length:8 layer 4 length
+ * bit      8 : cmd_eop:1 This descriptor is the last one in the packet
+ * bit      9 : reserved
+ * bit     10 : cmd_dma_it:1 immediate interrupt
+ * bit 11..12 : SBD - Segment Buffer Details
+ *              00 - Header Segment
+ *              01 - First Data Segment
+ *              10 - Medium Data Segment
+ *              11 - Last Data Segment
+ * bit     13 : TSE - TCP Segmentation Enable
+ * bit     14 : IIC - Directs the HW to Insert IPv4 Checksum
+ * bit     15 : ITC - Directs the HW to Insert TCP/UDP Checksum
+ * bit 16..20 : QID - The target QID that the packet should be stored
+ *              in the MAC.
+ * bit     21 : PO - Pseudo header Offload:
+ *              0 - Use the pseudo header value from the TCP checksum field
+ *              1- Calculate Pseudo header Checksum
+ * bit     22 : NC - No UDP Checksum
+ * bit 23..29 : reserved
+ * bit 30..31 : L4T - Layer 4 Type: 00 - UDP , 10 - TCP , 10, 11 - Reserved
+ *              If L4Len equal 0, no L4 at all
+ * [dword 1]
+ * bit  0..31 : addr_low:32 The payload buffer low address
+ * [dword 2]
+ * bit  0..15 : addr_high:16 The payload buffer high address
+ * bit 16..23 : ip_length:8 The IP header length for the TX IP checksum
+ *              offload feature
+ * bit 24..30 : mac_length:7
+ * bit     31 : ip_version:1 1 - IPv4, 0 - IPv6
+ * [dword 3]
+ *  [byte 12] error
+ * bit  0   2 : mac_status:3
+ * bit  3   7 : reserved:5
+ *  [byte 13] status
+ * bit      0 : DU:1 Descriptor Used
+ * bit  1   7 : reserved:7
+ *  [word 7] length
+ */
 struct vring_tx_dma {
         u32 d0;
         struct vring_dma_addr addr;
@@ -257,45 +291,45 @@ struct vring_tx_dma {
         __le16 length;
 } __packed;
 
-/*
- * Rx descriptor - MAC part
+/* Rx descriptor - MAC part
  * [dword 0]
  * bit  0.. 3 : tid:4 The QoS (b3-0) TID Field
- * bit  4.. 6 : connection_id:3 :The Source index that  was found during
- *  Parsing the TA.  This field is used to  define the source of the packet
+ * bit  4.. 6 : cid:3 The Source index that  was found during parsing the TA.
+ *              This field is used to define the source of the packet
  * bit      7 : reserved:1
- * bit  8.. 9 : mac_id:2 : The MAC virtual  Ring number (always zero)
- * bit 10..11 : frame_type:2 : The FC Control  (b3-2) -  MPDU Type
- *              (management, data, control  and extension)
- * bit 12..15 : frame_subtype:4 : The FC Control  (b7-4) -  Frame Subtype
+ * bit  8.. 9 : mid:2 The MAC virtual number
+ * bit 10..11 : frame_type:2 : The FC (b3-2) - MPDU Type
+ *              (management, data, control and extension)
+ * bit 12..15 : frame_subtype:4 : The FC (b7-4) - Frame Subtype
  * bit 16..27 : seq_number:12 The received Sequence number field
  * bit 28..31 : extended:4 extended subtype
  * [dword 1]
  * bit  0.. 3 : reserved
  * bit  4.. 5 : key_id:2
  * bit      6 : decrypt_bypass:1
- * bit      7 : security:1
- * bit  8.. 9 : ds_bits:2
- * bit     10 : a_msdu_present:1  from qos header
- * bit     11 : a_msdu_type:1  from qos header
+ * bit      7 : security:1 FC (b14)
+ * bit  8.. 9 : ds_bits:2 FC (b9-8)
+ * bit     10 : a_msdu_present:1  QoS (b7)
+ * bit     11 : a_msdu_type:1  QoS (b8)
  * bit     12 : a_mpdu:1  part of AMPDU aggregation
  * bit     13 : broadcast:1
  * bit     14 : mutlicast:1
  * bit     15 : reserved:1
- * bit 16..20 : rx_mac_qid:5   The Queue Identifier that the packet
- *                             is received from
+ * bit 16..20 : rx_mac_qid:5 The Queue Identifier that the packet
+ *              is received from
  * bit 21..24 : mcs:4
- * bit 25..28 : mic_icr:4
+ * bit 25..28 : mic_icr:4 this signal tells the DMA to assert an interrupt
+ *              after it writes the packet
  * bit 29..31 : reserved:3
  * [dword 2]
  * bit  0.. 2 : time_slot:3 The timeslot that the MPDU is received
- * bit      3 : fc_protocol_ver:1 The FC Control  (b0) - Protocol  Version
- * bit      4 : fc_order:1 The FC Control (b15) -Order
- * bit  5.. 7 : qos_ack_policy:3  The QoS (b6-5) ack policy Field
+ * bit  3.. 4 : fc_protocol_ver:1 The FC (b1-0) - Protocol Version
+ * bit      5 : fc_order:1 The FC Control (b15) -Order
+ * bit  6.. 7 : qos_ack_policy:2 The QoS (b6-5) ack policy Field
  * bit      8 : esop:1 The QoS (b4) ESOP field
- * bit      9 : qos_rdg_more_ppdu:1 The QoS (b9) RDG  field
- * bit 10..14 : qos_reserved:5 The QoS (b14-10) Reserved  field
- * bit     15 : qos_ac_constraint:1
+ * bit      9 : qos_rdg_more_ppdu:1 The QoS (b9) RDG field
+ * bit 10..14 : qos_reserved:5 The QoS (b14-10) Reserved field
+ * bit     15 : qos_ac_constraint:1 QoS (b15)
  * bit 16..31 : pn_15_0:16 low 2 bytes of PN
  * [dword 3]
  * bit  0..31 : pn_47_16:32 high 4 bytes of PN
@@ -308,35 +342,46 @@ struct vring_rx_mac {
         u32 pn_47_16;
 } __packed;
 
-/*
- * Rx descriptor - DMA part
+/* Rx descriptor - DMA part
  * [dword 0]
- * bit  0.. 7 : l4_length:8 layer 4 length
- * bit  8.. 9 : reserved:2
- * bit     10 : cmd_dma_it:1
+ * bit  0.. 7 : l4_length:8 layer 4 length. The field is only valid if
+ *              L4I bit is set
+ * bit      8 : cmd_eop:1 set to 1
+ * bit      9 : cmd_rt:1 set to 1
+ * bit     10 : cmd_dma_it:1 immediate interrupt
  * bit 11..15 : reserved:5
- * bit 16..29 : phy_info_length:14
+ * bit 16..29 : phy_info_length:14 It is valid when the PII is set.
+ *              When the FFM bit is set bits 29-27 are used for for
+ *              Flex Filter Match. Matching Index to one of the L2
+ *              EtherType Flex Filter
  * bit 30..31 : l4_type:2 valid if the L4I bit is set in the status field
+ *              00 - UDP, 01 - TCP, 10, 11 - reserved
  * [dword 1]
  * bit  0..31 : addr_low:32 The payload buffer low address
  * [dword 2]
  * bit  0..15 : addr_high:16 The payload buffer high address
- * bit 16..23 : ip_length:8
+ * bit 16..23 : ip_length:8 The filed is valid only if the L3I bit is set
  * bit 24..30 : mac_length:7
- * bit     31 : ip_version:1
+ * bit     31 : ip_version:1 1 - IPv4, 0 - IPv6
  * [dword 3]
  *  [byte 12] error
+ * bit      0 : FCS:1
+ * bit      1 : MIC:1
+ * bit      2 : Key miss:1
+ * bit      3 : Replay:1
+ * bit      4 : L3:1 IPv4 checksum
+ * bit      5 : L4:1 TCP/UDP checksum
+ * bit  6   7 : reserved:2
  *  [byte 13] status
- * bit      0 : du:1
- * bit      1 : eop:1
+ * bit      0 : DU:1 Descriptor Used
+ * bit      1 : EOP:1 The descriptor indicates the End of Packet
  * bit      2 : error:1
- * bit      3 : mi:1
- * bit      4 : l3_identified:1
- * bit      5 : l4_identified:1
- * bit      6 : phy_info_included:1
- * bit      7 : reserved:1
+ * bit      3 : MI:1 MAC Interrupt is asserted (according to parser decision)
+ * bit      4 : L3I:1 L3 identified and checksum calculated
+ * bit      5 : L4I:1 L4 identified and checksum calculated
+ * bit      6 : PII:1 PHY Info Included in the packet
+ * bit      7 : FFM:1 EtherType Flex Filter Match
  *  [word 7] length
- *
  */
 
 #define RX_DMA_D0_CMD_DMA_IT     BIT(10)
@@ -349,9 +394,9 @@ struct vring_rx_mac {
 #define RX_DMA_STATUS_DU         BIT(0)
 #define RX_DMA_STATUS_ERROR      BIT(2)
 
-#define RX_DMA_STATUS_L3_IDENT   BIT(4)
-#define RX_DMA_STATUS_L4_IDENT   BIT(5)
-#define RX_DMA_STATUS_PHY_INFO   BIT(6)
+#define RX_DMA_STATUS_L3I       BIT(4)
+#define RX_DMA_STATUS_L4I       BIT(5)
+#define RX_DMA_STATUS_PHY_INFO  BIT(6)
 
 struct vring_rx_dma {
         u32 d0;
@@ -423,6 +468,11 @@ static inline int wil_rxdesc_mcs(struct vring_rx_desc *d)
         return WIL_GET_BITS(d->mac.d1, 21, 24);
 }
 
+static inline int wil_rxdesc_mcast(struct vring_rx_desc *d)
+{
+        return WIL_GET_BITS(d->mac.d1, 13, 14);
+}
+
 static inline int wil_rxdesc_phy_length(struct vring_rx_desc *d)
 {
         return WIL_GET_BITS(d->dma.d0, 16, 29);
diff --git a/drivers/net/wireless/ath/wil6210/wil6210.h b/drivers/net/wireless/ath/wil6210/wil6210.h
index c6ec5b99ac7d..94611568fc9a 100644
--- a/drivers/net/wireless/ath/wil6210/wil6210.h
+++ b/drivers/net/wireless/ath/wil6210/wil6210.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2014 Qualcomm Atheros, Inc.
+ * Copyright (c) 2012-2015 Qualcomm Atheros, Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -25,19 +25,14 @@
 
 extern bool no_fw_recovery;
 extern unsigned int mtu_max;
+extern unsigned short rx_ring_overflow_thrsh;
+extern int agg_wsize;
 
 #define WIL_NAME "wil6210"
 #define WIL_FW_NAME "wil6210.fw"
 
 #define WIL_MAX_BUS_REQUEST_KBPS 800000 /* ~6.1Gbps */
 
-struct wil_board {
-        int board;
-#define WIL_BOARD_MARLON        (1)
-#define WIL_BOARD_SPARROW       (2)
-        const char * const name;
-};
-
 /**
  * extract bits [@b0:@b1] (inclusive) from the value @x
  * it should be @b0 <= @b1, or result is incorrect
@@ -49,21 +44,50 @@ static inline u32 WIL_GET_BITS(u32 x, int b0, int b1)
 
 #define WIL6210_MEM_SIZE (2*1024*1024UL)
 
-#define WIL_RX_RING_SIZE_ORDER_DEFAULT  (9)
-#define WIL_TX_RING_SIZE_ORDER_DEFAULT  (9)
+#define WIL_TX_Q_LEN_DEFAULT            (4000)
+#define WIL_RX_RING_SIZE_ORDER_DEFAULT  (10)
+#define WIL_TX_RING_SIZE_ORDER_DEFAULT  (10)
 /* limit ring size in range [32..32k] */
 #define WIL_RING_SIZE_ORDER_MIN (5)
 #define WIL_RING_SIZE_ORDER_MAX (15)
 #define WIL6210_MAX_TX_RINGS    (24) /* HW limit */
 #define WIL6210_MAX_CID         (8) /* HW limit */
 #define WIL6210_NAPI_BUDGET     (16) /* arbitrary */
+#define WIL_MAX_AMPDU_SIZE      (64 * 1024) /* FW/HW limit */
+#define WIL_MAX_AGG_WSIZE       (32) /* FW/HW limit */
+/* Hardware offload block adds the following:
+ * 26 bytes - 3-address QoS data header
+ *  8 bytes - IV + EIV (for GCMP)
+ *  8 bytes - SNAP
+ * 16 bytes - MIC (for GCMP)
+ *  4 bytes - CRC
+ */
+#define WIL_MAX_MPDU_OVERHEAD   (62)
+
+/* Calculate MAC buffer size for the firmware. It includes all overhead,
+ * as it will go over the air, and need to be 8 byte aligned
+ */
+static inline u32 wil_mtu2macbuf(u32 mtu)
+{
+        return ALIGN(mtu + WIL_MAX_MPDU_OVERHEAD, 8);
+}
+
+/* MTU for Ethernet need to take into account 8-byte SNAP header
+ * to be added when encapsulating Ethernet frame into 802.11
+ */
+#define WIL_MAX_ETH_MTU         (IEEE80211_MAX_DATA_LEN_DMG - 8)
 /* Max supported by wil6210 value for interrupt threshold is 5sec. */
 #define WIL6210_ITR_TRSH_MAX (5000000)
-#define WIL6210_ITR_TRSH_DEFAULT        (300) /* usec */
+#define WIL6210_ITR_TX_INTERFRAME_TIMEOUT_DEFAULT (13) /* usec */
+#define WIL6210_ITR_RX_INTERFRAME_TIMEOUT_DEFAULT (13) /* usec */
+#define WIL6210_ITR_TX_MAX_BURST_DURATION_DEFAULT (500) /* usec */
+#define WIL6210_ITR_RX_MAX_BURST_DURATION_DEFAULT (500) /* usec */
 #define WIL6210_FW_RECOVERY_RETRIES     (5) /* try to recover this many times */
 #define WIL6210_FW_RECOVERY_TO  msecs_to_jiffies(5000)
 #define WIL6210_SCAN_TO         msecs_to_jiffies(10000)
-
+#define WIL6210_RX_HIGH_TRSH_INIT               (0)
+#define WIL6210_RX_HIGH_TRSH_DEFAULT \
+                                (1 << (WIL_RX_RING_SIZE_ORDER_DEFAULT - 3))
 /* Hardware definitions begin */
 
 /*
@@ -135,7 +159,7 @@ struct RGF_ICR {
         #define BIT_DMA_EP_MISC_ICR_TX_NO_ACT   BIT(1)
         #define BIT_DMA_EP_MISC_ICR_FW_INT(n)   BIT(28+n) /* n = [0..3] */
 
-/* Interrupt moderation control */
+/* Legacy interrupt moderation control (before Sparrow v2)*/
 #define RGF_DMA_ITR_CNT_TRSH            (0x881c5c)
 #define RGF_DMA_ITR_CNT_DATA            (0x881c60)
 #define RGF_DMA_ITR_CNT_CRL             (0x881c64)
@@ -145,6 +169,46 @@ struct RGF_ICR {
         #define BIT_DMA_ITR_CNT_CRL_CLR         BIT(3)
         #define BIT_DMA_ITR_CNT_CRL_REACH_TRSH  BIT(4)
 
+/* New (sparrow v2+) interrupt moderation control */
+#define RGF_DMA_ITR_TX_DESQ_NO_MOD              (0x881d40)
+#define RGF_DMA_ITR_TX_CNT_TRSH                 (0x881d34)
+#define RGF_DMA_ITR_TX_CNT_DATA                 (0x881d38)
+#define RGF_DMA_ITR_TX_CNT_CTL                  (0x881d3c)
+        #define BIT_DMA_ITR_TX_CNT_CTL_EN               BIT(0)
+        #define BIT_DMA_ITR_TX_CNT_CTL_EXT_TIC_SEL      BIT(1)
+        #define BIT_DMA_ITR_TX_CNT_CTL_FOREVER          BIT(2)
+        #define BIT_DMA_ITR_TX_CNT_CTL_CLR              BIT(3)
+        #define BIT_DMA_ITR_TX_CNT_CTL_REACHED_TRESH    BIT(4)
+        #define BIT_DMA_ITR_TX_CNT_CTL_CROSS_EN         BIT(5)
+        #define BIT_DMA_ITR_TX_CNT_CTL_FREE_RUNNIG      BIT(6)
+#define RGF_DMA_ITR_TX_IDL_CNT_TRSH                     (0x881d60)
+#define RGF_DMA_ITR_TX_IDL_CNT_DATA                     (0x881d64)
+#define RGF_DMA_ITR_TX_IDL_CNT_CTL                      (0x881d68)
+        #define BIT_DMA_ITR_TX_IDL_CNT_CTL_EN                   BIT(0)
+        #define BIT_DMA_ITR_TX_IDL_CNT_CTL_EXT_TIC_SEL          BIT(1)
+        #define BIT_DMA_ITR_TX_IDL_CNT_CTL_FOREVER              BIT(2)
+        #define BIT_DMA_ITR_TX_IDL_CNT_CTL_CLR                  BIT(3)
+        #define BIT_DMA_ITR_TX_IDL_CNT_CTL_REACHED_TRESH        BIT(4)
+#define RGF_DMA_ITR_RX_DESQ_NO_MOD              (0x881d50)
+#define RGF_DMA_ITR_RX_CNT_TRSH                 (0x881d44)
+#define RGF_DMA_ITR_RX_CNT_DATA                 (0x881d48)
+#define RGF_DMA_ITR_RX_CNT_CTL                  (0x881d4c)
+        #define BIT_DMA_ITR_RX_CNT_CTL_EN               BIT(0)
+        #define BIT_DMA_ITR_RX_CNT_CTL_EXT_TIC_SEL      BIT(1)
+        #define BIT_DMA_ITR_RX_CNT_CTL_FOREVER          BIT(2)
+        #define BIT_DMA_ITR_RX_CNT_CTL_CLR              BIT(3)
+        #define BIT_DMA_ITR_RX_CNT_CTL_REACHED_TRESH    BIT(4)
+        #define BIT_DMA_ITR_RX_CNT_CTL_CROSS_EN         BIT(5)
+        #define BIT_DMA_ITR_RX_CNT_CTL_FREE_RUNNIG      BIT(6)
+#define RGF_DMA_ITR_RX_IDL_CNT_TRSH                     (0x881d54)
+#define RGF_DMA_ITR_RX_IDL_CNT_DATA                     (0x881d58)
+#define RGF_DMA_ITR_RX_IDL_CNT_CTL                      (0x881d5c)
+        #define BIT_DMA_ITR_RX_IDL_CNT_CTL_EN                   BIT(0)
+        #define BIT_DMA_ITR_RX_IDL_CNT_CTL_EXT_TIC_SEL          BIT(1)
+        #define BIT_DMA_ITR_RX_IDL_CNT_CTL_FOREVER              BIT(2)
+        #define BIT_DMA_ITR_RX_IDL_CNT_CTL_CLR                  BIT(3)
+        #define BIT_DMA_ITR_RX_IDL_CNT_CTL_REACHED_TRESH        BIT(4)
+
 #define RGF_DMA_PSEUDO_CAUSE            (0x881c68)
 #define RGF_DMA_PSEUDO_CAUSE_MASK_SW    (0x881c6c)
 #define RGF_DMA_PSEUDO_CAUSE_MASK_FW    (0x881c70)
@@ -164,6 +228,20 @@ struct RGF_ICR {
 #define RGF_CAF_PLL_LOCK_STATUS         (0x88afec)
         #define BIT_CAF_OSC_DIG_XTAL_STABLE     BIT(0)
 
+#define RGF_USER_JTAG_DEV_ID    (0x880b34) /* device ID */
+        #define JTAG_DEV_ID_MARLON_B0   (0x0612072f)
+        #define JTAG_DEV_ID_SPARROW_A0  (0x0632072f)
+        #define JTAG_DEV_ID_SPARROW_A1  (0x1632072f)
+        #define JTAG_DEV_ID_SPARROW_B0  (0x2632072f)
+
+enum {
+        HW_VER_UNKNOWN,
+        HW_VER_MARLON_B0,  /* JTAG_DEV_ID_MARLON_B0  */
+        HW_VER_SPARROW_A0, /* JTAG_DEV_ID_SPARROW_A0 */
+        HW_VER_SPARROW_A1, /* JTAG_DEV_ID_SPARROW_A1 */
+        HW_VER_SPARROW_B0, /* JTAG_DEV_ID_SPARROW_B0 */
+};
+
 /* popular locations */
 #define HOST_MBOX   HOSTADDR(RGF_USER_USER_SCRATCH_PAD)
 #define HOST_SW_INT (HOSTADDR(RGF_USER_USER_ICR) + \
@@ -303,6 +381,11 @@ struct vring {
 struct vring_tx_data {
         int enabled;
         cycles_t idle, last_idle, begin;
+        u8 agg_wsize; /* agreed aggregation window, 0 - no agg */
+        u16 agg_timeout;
+        u8 agg_amsdu;
+        bool addba_in_progress; /* if set, agg_xxx is for request in progress */
+        spinlock_t lock;
 };
 
 enum { /* for wil6210_priv.status */
@@ -313,6 +396,7 @@ enum { /* for wil6210_priv.status */
         wil_status_reset_done,
         wil_status_irqen, /* FIXME: interrupts enabled - for debug */
         wil_status_napi_en, /* NAPI enabled protected by wil->mutex */
+        wil_status_last /* keep last */
 };
 
 struct pci_dev;
@@ -397,15 +481,46 @@ enum {
         fw_recovery_running = 2,
 };
 
+enum {
+        hw_capability_reset_v2 = 0,
+        hw_capability_advanced_itr_moderation = 1,
+        hw_capability_last
+};
+
+struct wil_back_rx {
+        struct list_head list;
+        /* request params, converted to CPU byte order - what we asked for */
+        u8 cidxtid;
+        u8 dialog_token;
+        u16 ba_param_set;
+        u16 ba_timeout;
+        u16 ba_seq_ctrl;
+};
+
+struct wil_back_tx {
+        struct list_head list;
+        /* request params, converted to CPU byte order - what we asked for */
+        u8 ringid;
+        u8 agg_wsize;
+        u16 agg_timeout;
+};
+
+struct wil_probe_client_req {
+        struct list_head list;
+        u64 cookie;
+        u8 cid;
+};
+
 struct wil6210_priv {
         struct pci_dev *pdev;
         int n_msi;
         struct wireless_dev *wdev;
         void __iomem *csr;
-        ulong status;
+        DECLARE_BITMAP(status, wil_status_last);
         u32 fw_version;
         u32 hw_version;
-        struct wil_board *board;
+        const char *hw_name;
+        DECLARE_BITMAP(hw_capabilities, hw_capability_last);
         u8 n_mids; /* number of additional MIDs as reported by FW */
         u32 recovery_count; /* num of FW recovery attempts in a short time */
         u32 recovery_state; /* FW recovery state machine */
@@ -415,7 +530,11 @@ struct wil6210_priv {
         u32 monitor_flags;
         u32 secure_pcp; /* create secure PCP? */
         int sinfo_gen;
-        u32 itr_trsh;
+        /* interrupt moderation */
+        u32 tx_max_burst_duration;
+        u32 tx_interframe_timeout;
+        u32 rx_max_burst_duration;
+        u32 rx_interframe_timeout;
         /* cached ISR registers */
         u32 isr_misc;
         /* mailbox related */
@@ -429,7 +548,7 @@ struct wil6210_priv {
         u16 reply_size;
         struct workqueue_struct *wmi_wq; /* for deferred calls */
         struct work_struct wmi_event_worker;
-        struct workqueue_struct *wmi_wq_conn; /* for connect worker */
+        struct workqueue_struct *wq_service;
         struct work_struct connect_worker;
         struct work_struct disconnect_worker;
         struct work_struct fw_error_worker;     /* for FW error recovery */
@@ -445,6 +564,17 @@ struct wil6210_priv {
         spinlock_t wmi_ev_lock;
         struct napi_struct napi_rx;
         struct napi_struct napi_tx;
+        /* BACK */
+        struct list_head back_rx_pending;
+        struct mutex back_rx_mutex; /* protect @back_rx_pending */
+        struct work_struct back_rx_worker;
+        struct list_head back_tx_pending;
+        struct mutex back_tx_mutex; /* protect @back_tx_pending */
+        struct work_struct back_tx_worker;
+        /* keep alive */
+        struct list_head probe_client_pending;
+        struct mutex probe_client_mutex; /* protect @probe_client_pending */
+        struct work_struct probe_client_worker;
         /* DMA related */
         struct vring vring_rx;
         struct vring vring_tx[WIL6210_MAX_TX_RINGS];
@@ -529,11 +659,8 @@ void wil_if_remove(struct wil6210_priv *wil);
 int wil_priv_init(struct wil6210_priv *wil);
 void wil_priv_deinit(struct wil6210_priv *wil);
 int wil_reset(struct wil6210_priv *wil);
-void wil_set_itr_trsh(struct wil6210_priv *wil);
 void wil_fw_error_recovery(struct wil6210_priv *wil);
 void wil_set_recovery_state(struct wil6210_priv *wil, int state);
-void wil_link_on(struct wil6210_priv *wil);
-void wil_link_off(struct wil6210_priv *wil);
 int wil_up(struct wil6210_priv *wil);
 int __wil_up(struct wil6210_priv *wil);
 int wil_down(struct wil6210_priv *wil);
@@ -567,12 +694,26 @@ int wmi_p2p_cfg(struct wil6210_priv *wil, int channel);
 int wmi_rxon(struct wil6210_priv *wil, bool on);
 int wmi_get_temperature(struct wil6210_priv *wil, u32 *t_m, u32 *t_r);
 int wmi_disconnect_sta(struct wil6210_priv *wil, const u8 *mac, u16 reason);
+int wmi_addba(struct wil6210_priv *wil, u8 ringid, u8 size, u16 timeout);
+int wmi_delba_tx(struct wil6210_priv *wil, u8 ringid, u16 reason);
+int wmi_delba_rx(struct wil6210_priv *wil, u8 cidxtid, u16 reason);
+int wmi_addba_rx_resp(struct wil6210_priv *wil, u8 cid, u8 tid, u8 token,
+                      u16 status, bool amsdu, u16 agg_wsize, u16 timeout);
+int wil_addba_rx_request(struct wil6210_priv *wil, u8 cidxtid,
+                         u8 dialog_token, __le16 ba_param_set,
+                         __le16 ba_timeout, __le16 ba_seq_ctrl);
+void wil_back_rx_worker(struct work_struct *work);
+void wil_back_rx_flush(struct wil6210_priv *wil);
+int wil_addba_tx_request(struct wil6210_priv *wil, u8 ringid, u16 wsize);
+void wil_back_tx_worker(struct work_struct *work);
+void wil_back_tx_flush(struct wil6210_priv *wil);
 
 void wil6210_clear_irq(struct wil6210_priv *wil);
 int wil6210_init_irq(struct wil6210_priv *wil, int irq);
 void wil6210_fini_irq(struct wil6210_priv *wil, int irq);
 void wil_mask_irq(struct wil6210_priv *wil);
 void wil_unmask_irq(struct wil6210_priv *wil);
+void wil_configure_interrupt_moderation(struct wil6210_priv *wil);
 void wil_disable_irq(struct wil6210_priv *wil);
 void wil_enable_irq(struct wil6210_priv *wil);
 int wil_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
@@ -592,6 +733,8 @@ int wmi_pcp_start(struct wil6210_priv *wil, int bi, u8 wmi_nettype, u8 chan);
 int wmi_pcp_stop(struct wil6210_priv *wil);
 void wil6210_disconnect(struct wil6210_priv *wil, const u8 *bssid,
                         u16 reason_code, bool from_event);
+void wil_probe_client_flush(struct wil6210_priv *wil);
+void wil_probe_client_worker(struct work_struct *work);
 
 int wil_rx_init(struct wil6210_priv *wil, u16 size);
 void wil_rx_fini(struct wil6210_priv *wil);
diff --git a/drivers/net/wireless/ath/wil6210/wil_platform.c b/drivers/net/wireless/ath/wil6210/wil_platform.c
index 8f1d78f8a74d..976a071ba74e 100644
--- a/drivers/net/wireless/ath/wil6210/wil_platform.c
+++ b/drivers/net/wireless/ath/wil6210/wil_platform.c
@@ -17,10 +17,6 @@
 #include "linux/device.h"
 #include "wil_platform.h"
 
-#ifdef CONFIG_WIL6210_PLATFORM_MSM
-#include "wil_platform_msm.h"
-#endif
-
 /**
  * wil_platform_init() - wil6210 platform module init
  *
@@ -37,13 +33,7 @@ void *wil_platform_init(struct device *dev, struct wil_platform_ops *ops)
                 return NULL;
         }
 
-#ifdef CONFIG_WIL6210_PLATFORM_MSM
-        handle = wil_platform_msm_init(dev, ops);
-        if (handle)
-                return handle;
-#endif
-
-        /* other platform specific init functions should be called here */
+        /* platform specific init functions should be called here */
 
         return handle;
 }
diff --git a/drivers/net/wireless/ath/wil6210/wil_platform_msm.c b/drivers/net/wireless/ath/wil6210/wil_platform_msm.c
deleted file mode 100644
index b354a743240d..000000000000
--- a/drivers/net/wireless/ath/wil6210/wil_platform_msm.c
+++ /dev/null
@@ -1,257 +0,0 @@
-/*
- * Copyright (c) 2014 Qualcomm Atheros, Inc.
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
- * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
- * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
- * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-#include <linux/of.h>
-#include <linux/slab.h>
-#include <linux/msm-bus.h>
-
-#include "wil_platform.h"
-#include "wil_platform_msm.h"
-
-/**
- * struct wil_platform_msm - wil6210 msm platform module info
- *
- * @dev: device object
- * @msm_bus_handle: handle for using msm_bus API
- * @pdata: bus scale info retrieved from DT
- */
-struct wil_platform_msm {
-        struct device *dev;
-        uint32_t msm_bus_handle;
-        struct msm_bus_scale_pdata *pdata;
-};
-
-#define KBTOB(a) (a * 1000ULL)
-
-/**
- * wil_platform_get_pdata() - Generate bus client data from device tree
- * provided by clients.
- *
- * dev: device object
- * of_node: Device tree node to extract information from
- *
- * The function returns a valid pointer to the allocated bus-scale-pdata
- * if the vectors were correctly read from the client's device node.
- * Any error in reading or parsing the device node will return NULL
- * to the caller.
- */
-static struct msm_bus_scale_pdata *wil_platform_get_pdata(
-                struct device *dev,
-                struct device_node *of_node)
-{
-        struct msm_bus_scale_pdata *pdata;
-        struct msm_bus_paths *usecase;
-        int i, j, ret, len;
-        unsigned int num_usecases, num_paths, mem_size;
-        const uint32_t *vec_arr;
-        struct msm_bus_vectors *vectors;
-
-        /* first read num_usecases and num_paths so we can calculate
-         * amount of memory to allocate
-         */
-        ret = of_property_read_u32(of_node, "qcom,msm-bus,num-cases",
-                                   &num_usecases);
-        if (ret) {
-                dev_err(dev, "Error: num-usecases not found\n");
-                return NULL;
-        }
-
-        ret = of_property_read_u32(of_node, "qcom,msm-bus,num-paths",
-                                   &num_paths);
-        if (ret) {
-                dev_err(dev, "Error: num_paths not found\n");
-                return NULL;
-        }
-
-        /* pdata memory layout:
-         *   msm_bus_scale_pdata
-         *   msm_bus_paths[num_usecases]
-         *   msm_bus_vectors[num_usecases][num_paths]
-         */
-        mem_size = sizeof(struct msm_bus_scale_pdata) +
-                   sizeof(struct msm_bus_paths) * num_usecases +
-                   sizeof(struct msm_bus_vectors) * num_usecases * num_paths;
-
-        pdata = kzalloc(mem_size, GFP_KERNEL);
-        if (!pdata)
-                return NULL;
-
-        ret = of_property_read_string(of_node, "qcom,msm-bus,name",
-                                      &pdata->name);
-        if (ret) {
-                dev_err(dev, "Error: Client name not found\n");
-                goto err;
-        }
-
-        if (of_property_read_bool(of_node, "qcom,msm-bus,active-only")) {
-                pdata->active_only = 1;
-        } else {
-                dev_info(dev, "active_only flag absent.\n");
-                dev_info(dev, "Using dual context by default\n");
-        }
-
-        pdata->num_usecases = num_usecases;
-        pdata->usecase = (struct msm_bus_paths *)(pdata + 1);
-
-        vec_arr = of_get_property(of_node, "qcom,msm-bus,vectors-KBps", &len);
-        if (vec_arr == NULL) {
-                dev_err(dev, "Error: Vector array not found\n");
-                goto err;
-        }
-
-        if (len != num_usecases * num_paths * sizeof(uint32_t) * 4) {
-                dev_err(dev, "Error: Length-error on getting vectors\n");
-                goto err;
-        }
-
-        vectors = (struct msm_bus_vectors *)(pdata->usecase + num_usecases);
-        for (i = 0; i < num_usecases; i++) {
-                usecase = &pdata->usecase[i];
-                usecase->num_paths = num_paths;
-                usecase->vectors = &vectors[i];
-
-                for (j = 0; j < num_paths; j++) {
-                        int index = ((i * num_paths) + j) * 4;
-
-                        usecase->vectors[j].src = be32_to_cpu(vec_arr[index]);
-                        usecase->vectors[j].dst =
-                                be32_to_cpu(vec_arr[index + 1]);
-                        usecase->vectors[j].ab = (uint64_t)
-                                KBTOB(be32_to_cpu(vec_arr[index + 2]));
-                        usecase->vectors[j].ib = (uint64_t)
-                                KBTOB(be32_to_cpu(vec_arr[index + 3]));
-                }
-        }
-
-        return pdata;
-
-err:
-        kfree(pdata);
-
-        return NULL;
-}
-
-/* wil_platform API (callbacks) */
-
-static int wil_platform_bus_request(void *handle,
-                                    uint32_t kbps /* KBytes/Sec */)
-{
-        int rc, i;
-        struct wil_platform_msm *msm = (struct wil_platform_msm *)handle;
-        int vote = 0; /* vote 0 in case requested kbps cannot be satisfied */
-        struct msm_bus_paths *usecase;
-        uint32_t usecase_kbps;
-        uint32_t min_kbps = ~0;
-
-        /* find the lowest usecase that is bigger than requested kbps */
-        for (i = 0; i < msm->pdata->num_usecases; i++) {
-                usecase = &msm->pdata->usecase[i];
-                /* assume we have single path (vectors[0]). If we ever
-                 * have multiple paths, need to define the behavior */
-                usecase_kbps = div64_u64(usecase->vectors[0].ib, 1000);
-                if (usecase_kbps >= kbps && usecase_kbps < min_kbps) {
-                        min_kbps = usecase_kbps;
-                        vote = i;
-                }
-        }
-
-        rc = msm_bus_scale_client_update_request(msm->msm_bus_handle, vote);
-        if (rc)
-                dev_err(msm->dev, "Failed msm_bus voting. kbps=%d vote=%d, rc=%d\n",
-                        kbps, vote, rc);
-        else
-                /* TOOD: remove */
-                dev_info(msm->dev, "msm_bus_scale_client_update_request succeeded. kbps=%d vote=%d\n",
-                         kbps, vote);
-
-        return rc;
-}
-
-static void wil_platform_uninit(void *handle)
-{
-        struct wil_platform_msm *msm = (struct wil_platform_msm *)handle;
-
-        dev_info(msm->dev, "wil_platform_uninit\n");
-
-        if (msm->msm_bus_handle)
-                msm_bus_scale_unregister_client(msm->msm_bus_handle);
-
-        kfree(msm->pdata);
-        kfree(msm);
-}
-
-static int wil_platform_msm_bus_register(struct wil_platform_msm *msm,
-                                         struct device_node *node)
-{
-        msm->pdata = wil_platform_get_pdata(msm->dev, node);
-        if (!msm->pdata) {
-                dev_err(msm->dev, "Failed getting DT info\n");
-                return -EINVAL;
-        }
-
-        msm->msm_bus_handle = msm_bus_scale_register_client(msm->pdata);
-        if (!msm->msm_bus_handle) {
-                dev_err(msm->dev, "Failed msm_bus registration\n");
-                return -EINVAL;
-        }
-
-        dev_info(msm->dev, "msm_bus registration succeeded! handle 0x%x\n",
-                 msm->msm_bus_handle);
-
-        return 0;
-}
-
-/**
- * wil_platform_msm_init() - wil6210 msm platform module init
- *
- * The function must be called before all other functions in this module.
- * It returns a handle which is used with the rest of the API
- *
- */
-void *wil_platform_msm_init(struct device *dev, struct wil_platform_ops *ops)
-{
-        struct device_node *of_node;
-        struct wil_platform_msm *msm;
-        int rc;
-
-        of_node = of_find_compatible_node(NULL, NULL, "qcom,wil6210");
-        if (!of_node) {
-                /* this could mean non-msm platform */
-                dev_err(dev, "DT node not found\n");
-                return NULL;
-        }
-
-        msm = kzalloc(sizeof(*msm), GFP_KERNEL);
-        if (!msm)
-                return NULL;
-
-        msm->dev = dev;
-
-        /* register with msm_bus module for scaling requests */
-        rc = wil_platform_msm_bus_register(msm, of_node);
-        if (rc)
-                goto cleanup;
-
-        memset(ops, 0, sizeof(*ops));
-        ops->bus_request = wil_platform_bus_request;
-        ops->uninit = wil_platform_uninit;
-
-        return (void *)msm;
-
-cleanup:
-        kfree(msm);
-        return NULL;
-}
diff --git a/drivers/net/wireless/ath/wil6210/wmi.c b/drivers/net/wireless/ath/wil6210/wmi.c
index 63476c86cd0e..0f3e4334c8e3 100644
--- a/drivers/net/wireless/ath/wil6210/wmi.c
+++ b/drivers/net/wireless/ath/wil6210/wmi.c
@@ -23,10 +23,15 @@
 #include "wmi.h"
 #include "trace.h"
 
-static uint max_assoc_sta = 1;
+static uint max_assoc_sta = WIL6210_MAX_CID;
 module_param(max_assoc_sta, uint, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(max_assoc_sta, " Max number of stations associated to the AP");
 
+int agg_wsize; /* = 0; */
+module_param(agg_wsize, int, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(agg_wsize, " Window size for Tx Block Ack after connect;"
+                 " 0 - use default; < 0 - don't auto-establish");
+
 /**
  * WMI event receiving - theory of operations
  *
@@ -197,7 +202,7 @@ static int __wmi_send(struct wil6210_priv *wil, u16 cmdid, void *buf, u16 len)
 
         might_sleep();
 
-        if (!test_bit(wil_status_fwready, &wil->status)) {
+        if (!test_bit(wil_status_fwready, wil->status)) {
                 wil_err(wil, "WMI: cannot send command while FW not ready\n");
                 return -EAGAIN;
         }
@@ -300,7 +305,7 @@ static void wmi_evt_fw_ready(struct wil6210_priv *wil, int id, void *d,
         wil_dbg_wmi(wil, "WMI: got FW ready event\n");
 
         wil_set_recovery_state(wil, fw_recovery_idle);
-        set_bit(wil_status_fwready, &wil->status);
+        set_bit(wil_status_fwready, wil->status);
         /* let the reset sequence continue */
         complete(&wil->wmi_ready);
 }
@@ -438,7 +443,7 @@ static void wmi_evt_connect(struct wil6210_priv *wil, int id, void *d, int len)
 
         if ((wdev->iftype == NL80211_IFTYPE_STATION) ||
             (wdev->iftype == NL80211_IFTYPE_P2P_CLIENT)) {
-                if (!test_bit(wil_status_fwconnecting, &wil->status)) {
+                if (!test_bit(wil_status_fwconnecting, wil->status)) {
                         wil_err(wil, "Not in connecting state\n");
                         return;
                 }
@@ -457,13 +462,12 @@ static void wmi_evt_connect(struct wil6210_priv *wil, int id, void *d, int len)
                 if (assoc_req_ie) {
                         sinfo.assoc_req_ies = assoc_req_ie;
                         sinfo.assoc_req_ies_len = assoc_req_ielen;
-                        sinfo.filled |= STATION_INFO_ASSOC_REQ_IES;
                 }
 
                 cfg80211_new_sta(ndev, evt->bssid, &sinfo, GFP_KERNEL);
         }
-        clear_bit(wil_status_fwconnecting, &wil->status);
-        set_bit(wil_status_fwconnected, &wil->status);
+        clear_bit(wil_status_fwconnecting, wil->status);
+        set_bit(wil_status_fwconnected, wil->status);
 
         /* FIXME FW can transmit only ucast frames to peer */
         /* FIXME real ring_id instead of hard coded 0 */
@@ -471,7 +475,7 @@ static void wmi_evt_connect(struct wil6210_priv *wil, int id, void *d, int len)
         wil->sta[evt->cid].status = wil_sta_conn_pending;
 
         wil->pending_connect_cid = evt->cid;
-        queue_work(wil->wmi_wq_conn, &wil->connect_worker);
+        queue_work(wil->wq_service, &wil->connect_worker);
 }
 
 static void wmi_evt_disconnect(struct wil6210_priv *wil, int id,
@@ -544,9 +548,24 @@ static void wmi_evt_eapol_rx(struct wil6210_priv *wil, int id,
         }
 }
 
+static void wil_addba_tx_cid(struct wil6210_priv *wil, u8 cid, u16 wsize)
+{
+        struct vring_tx_data *t;
+        int i;
+
+        for (i = 0; i < WIL6210_MAX_TX_RINGS; i++) {
+                if (cid != wil->vring2cid_tid[i][0])
+                        continue;
+                t = &wil->vring_tx_data[i];
+                if (!t->enabled)
+                        continue;
+
+                wil_addba_tx_request(wil, i, wsize);
+        }
+}
+
 static void wmi_evt_linkup(struct wil6210_priv *wil, int id, void *d, int len)
 {
-        struct net_device *ndev = wil_to_ndev(wil);
         struct wmi_data_port_open_event *evt = d;
         u8 cid = evt->cid;
 
@@ -558,7 +577,8 @@ static void wmi_evt_linkup(struct wil6210_priv *wil, int id, void *d, int len)
         }
 
         wil->sta[cid].data_port_open = true;
-        netif_carrier_on(ndev);
+        if (agg_wsize >= 0)
+                wil_addba_tx_cid(wil, cid, agg_wsize);
 }
 
 static void wmi_evt_linkdown(struct wil6210_priv *wil, int id, void *d, int len)
@@ -583,55 +603,89 @@ static void wmi_evt_ba_status(struct wil6210_priv *wil, int id, void *d,
                               int len)
 {
         struct wmi_vring_ba_status_event *evt = d;
-        struct wil_sta_info *sta;
-        uint i, cid;
+        struct vring_tx_data *txdata;
 
-        /* TODO: use Rx BA status, not Tx one */
-
-        wil_dbg_wmi(wil, "BACK[%d] %s {%d} timeout %d\n",
+        wil_dbg_wmi(wil, "BACK[%d] %s {%d} timeout %d AMSDU%s\n",
                     evt->ringid,
                     evt->status == WMI_BA_AGREED ? "OK" : "N/A",
-                    evt->agg_wsize, __le16_to_cpu(evt->ba_timeout));
+                    evt->agg_wsize, __le16_to_cpu(evt->ba_timeout),
+                    evt->amsdu ? "+" : "-");
 
         if (evt->ringid >= WIL6210_MAX_TX_RINGS) {
                 wil_err(wil, "invalid ring id %d\n", evt->ringid);
                 return;
         }
 
-        mutex_lock(&wil->mutex);
-
-        cid = wil->vring2cid_tid[evt->ringid][0];
-        if (cid >= WIL6210_MAX_CID) {
-                wil_err(wil, "invalid CID %d for vring %d\n", cid, evt->ringid);
-                goto out;
+        if (evt->status != WMI_BA_AGREED) {
+                evt->ba_timeout = 0;
+                evt->agg_wsize = 0;
+                evt->amsdu = 0;
         }
 
-        sta = &wil->sta[cid];
-        if (sta->status == wil_sta_unused) {
-                wil_err(wil, "CID %d unused\n", cid);
-                goto out;
-        }
+        txdata = &wil->vring_tx_data[evt->ringid];
 
-        wil_dbg_wmi(wil, "BACK for CID %d %pM\n", cid, sta->addr);
-        for (i = 0; i < WIL_STA_TID_NUM; i++) {
-                struct wil_tid_ampdu_rx *r;
-                unsigned long flags;
+        txdata->agg_timeout = le16_to_cpu(evt->ba_timeout);
+        txdata->agg_wsize = evt->agg_wsize;
+        txdata->agg_amsdu = evt->amsdu;
+        txdata->addba_in_progress = false;
+}
 
-                spin_lock_irqsave(&sta->tid_rx_lock, flags);
+static void wmi_evt_addba_rx_req(struct wil6210_priv *wil, int id, void *d,
+                                 int len)
+{
+        struct wmi_rcp_addba_req_event *evt = d;
 
-                r = sta->tid_rx[i];
-                sta->tid_rx[i] = NULL;
-                wil_tid_ampdu_rx_free(wil, r);
+        wil_addba_rx_request(wil, evt->cidxtid, evt->dialog_token,
+                             evt->ba_param_set, evt->ba_timeout,
+                             evt->ba_seq_ctrl);
+}
 
-                spin_unlock_irqrestore(&sta->tid_rx_lock, flags);
+static void wmi_evt_delba(struct wil6210_priv *wil, int id, void *d, int len)
+__acquires(&sta->tid_rx_lock) __releases(&sta->tid_rx_lock)
+{
+        struct wmi_delba_event *evt = d;
+        u8 cid, tid;
+        u16 reason = __le16_to_cpu(evt->reason);
+        struct wil_sta_info *sta;
+        struct wil_tid_ampdu_rx *r;
 
-                if ((evt->status == WMI_BA_AGREED) && evt->agg_wsize)
-                        sta->tid_rx[i] = wil_tid_ampdu_rx_alloc(wil,
-                                                evt->agg_wsize, 0);
+        might_sleep();
+        parse_cidxtid(evt->cidxtid, &cid, &tid);
+        wil_dbg_wmi(wil, "DELBA CID %d TID %d from %s reason %d\n",
+                    cid, tid,
+                    evt->from_initiator ? "originator" : "recipient",
+                    reason);
+        if (!evt->from_initiator) {
+                int i;
+                /* find Tx vring it belongs to */
+                for (i = 0; i < ARRAY_SIZE(wil->vring2cid_tid); i++) {
+                        if ((wil->vring2cid_tid[i][0] == cid) &&
+                            (wil->vring2cid_tid[i][1] == tid)) {
+                                struct vring_tx_data *txdata =
+                                        &wil->vring_tx_data[i];
+
+                                wil_dbg_wmi(wil, "DELBA Tx vring %d\n", i);
+                                txdata->agg_timeout = 0;
+                                txdata->agg_wsize = 0;
+                                txdata->addba_in_progress = false;
+
+                                break; /* max. 1 matching ring */
+                        }
+                }
+                if (i >= ARRAY_SIZE(wil->vring2cid_tid))
+                        wil_err(wil, "DELBA: unable to find Tx vring\n");
+                return;
         }
 
-out:
-        mutex_unlock(&wil->mutex);
+        sta = &wil->sta[cid];
+
+        spin_lock_bh(&sta->tid_rx_lock);
+
+        r = sta->tid_rx[tid];
+        sta->tid_rx[tid] = NULL;
+        wil_tid_ampdu_rx_free(wil, r);
+
+        spin_unlock_bh(&sta->tid_rx_lock);
 }
 
 static const struct {
@@ -649,6 +703,8 @@ static const struct {
         {WMI_DATA_PORT_OPEN_EVENTID,    wmi_evt_linkup},
         {WMI_WBE_LINKDOWN_EVENTID,      wmi_evt_linkdown},
         {WMI_BA_STATUS_EVENTID,         wmi_evt_ba_status},
+        {WMI_RCP_ADDBA_REQ_EVENTID,     wmi_evt_addba_rx_req},
+        {WMI_DELBA_EVENTID,             wmi_evt_delba},
 };
 
 /*
@@ -668,7 +724,7 @@ void wmi_recv_cmd(struct wil6210_priv *wil)
         ulong flags;
         unsigned n;
 
-        if (!test_bit(wil_status_reset_done, &wil->status)) {
+        if (!test_bit(wil_status_reset_done, wil->status)) {
                 wil_err(wil, "Reset in progress. Cannot handle WMI event\n");
                 return;
         }
@@ -1025,13 +1081,14 @@ int wmi_rx_chain_add(struct wil6210_priv *wil, struct vring *vring)
         struct wmi_cfg_rx_chain_cmd cmd = {
                 .action = WMI_RX_CHAIN_ADD,
                 .rx_sw_ring = {
-                        .max_mpdu_size = cpu_to_le16(mtu_max + ETH_HLEN),
+                        .max_mpdu_size = cpu_to_le16(wil_mtu2macbuf(mtu_max)),
                         .ring_mem_base = cpu_to_le64(vring->pa),
                         .ring_size = cpu_to_le16(vring->size),
                 },
                 .mid = 0, /* TODO - what is it? */
                 .decap_trans_type = WMI_DECAP_TYPE_802_3,
                 .reorder_type = WMI_RX_SW_REORDER,
+                .host_thrsh = cpu_to_le16(rx_ring_overflow_thrsh),
         };
         struct {
                 struct wil6210_mbox_hdr_wmi wmi;
@@ -1074,12 +1131,13 @@ int wmi_rx_chain_add(struct wil6210_priv *wil, struct vring *vring)
         return rc;
 }
 
-int wmi_get_temperature(struct wil6210_priv *wil, u32 *t_m, u32 *t_r)
+int wmi_get_temperature(struct wil6210_priv *wil, u32 *t_bb, u32 *t_rf)
 {
         int rc;
         struct wmi_temp_sense_cmd cmd = {
-                .measure_marlon_m_en = cpu_to_le32(!!t_m),
-                .measure_marlon_r_en = cpu_to_le32(!!t_r),
+                .measure_baseband_en = cpu_to_le32(!!t_bb),
+                .measure_rf_en = cpu_to_le32(!!t_rf),
+                .measure_mode = cpu_to_le32(TEMPERATURE_MEASURE_NOW),
         };
         struct {
                 struct wil6210_mbox_hdr_wmi wmi;
@@ -1091,10 +1149,10 @@ int wmi_get_temperature(struct wil6210_priv *wil, u32 *t_m, u32 *t_r)
         if (rc)
                 return rc;
 
-        if (t_m)
-                *t_m = le32_to_cpu(reply.evt.marlon_m_t1000);
-        if (t_r)
-                *t_r = le32_to_cpu(reply.evt.marlon_r_t1000);
+        if (t_bb)
+                *t_bb = le32_to_cpu(reply.evt.baseband_t1000);
+        if (t_rf)
+                *t_rf = le32_to_cpu(reply.evt.rf_t1000);
 
         return 0;
 }
@@ -1111,6 +1169,87 @@ int wmi_disconnect_sta(struct wil6210_priv *wil, const u8 *mac, u16 reason)
         return wmi_send(wil, WMI_DISCONNECT_STA_CMDID, &cmd, sizeof(cmd));
 }
 
+int wmi_addba(struct wil6210_priv *wil, u8 ringid, u8 size, u16 timeout)
+{
+        struct wmi_vring_ba_en_cmd cmd = {
+                .ringid = ringid,
+                .agg_max_wsize = size,
+                .ba_timeout = cpu_to_le16(timeout),
+                .amsdu = 0,
+        };
+
+        wil_dbg_wmi(wil, "%s(ring %d size %d timeout %d)\n", __func__,
+                    ringid, size, timeout);
+
+        return wmi_send(wil, WMI_VRING_BA_EN_CMDID, &cmd, sizeof(cmd));
+}
+
+int wmi_delba_tx(struct wil6210_priv *wil, u8 ringid, u16 reason)
+{
+        struct wmi_vring_ba_dis_cmd cmd = {
+                .ringid = ringid,
+                .reason = cpu_to_le16(reason),
+        };
+
+        wil_dbg_wmi(wil, "%s(ring %d reason %d)\n", __func__,
+                    ringid, reason);
+
+        return wmi_send(wil, WMI_VRING_BA_DIS_CMDID, &cmd, sizeof(cmd));
+}
+
+int wmi_delba_rx(struct wil6210_priv *wil, u8 cidxtid, u16 reason)
+{
+        struct wmi_rcp_delba_cmd cmd = {
+                .cidxtid = cidxtid,
+                .reason = cpu_to_le16(reason),
+        };
+
+        wil_dbg_wmi(wil, "%s(CID %d TID %d reason %d)\n", __func__,
+                    cidxtid & 0xf, (cidxtid >> 4) & 0xf, reason);
+
+        return wmi_send(wil, WMI_RCP_DELBA_CMDID, &cmd, sizeof(cmd));
+}
+
+int wmi_addba_rx_resp(struct wil6210_priv *wil, u8 cid, u8 tid, u8 token,
+                      u16 status, bool amsdu, u16 agg_wsize, u16 timeout)
+{
+        int rc;
+        struct wmi_rcp_addba_resp_cmd cmd = {
+                .cidxtid = mk_cidxtid(cid, tid),
+                .dialog_token = token,
+                .status_code = cpu_to_le16(status),
+                /* bit 0: A-MSDU supported
+                 * bit 1: policy (should be 0 for us)
+                 * bits 2..5: TID
+                 * bits 6..15: buffer size
+                 */
+                .ba_param_set = cpu_to_le16((amsdu ? 1 : 0) | (tid << 2) |
+                                            (agg_wsize << 6)),
+                .ba_timeout = cpu_to_le16(timeout),
+        };
+        struct {
+                struct wil6210_mbox_hdr_wmi wmi;
+                struct wmi_rcp_addba_resp_sent_event evt;
+        } __packed reply;
+
+        wil_dbg_wmi(wil,
+                    "ADDBA response for CID %d TID %d size %d timeout %d status %d AMSDU%s\n",
+                    cid, tid, agg_wsize, timeout, status, amsdu ? "+" : "-");
+
+        rc = wmi_call(wil, WMI_RCP_ADDBA_RESP_CMDID, &cmd, sizeof(cmd),
+                      WMI_ADDBA_RESP_SENT_EVENTID, &reply, sizeof(reply), 100);
+        if (rc)
+                return rc;
+
+        if (reply.evt.status) {
+                wil_err(wil, "ADDBA response failed with status %d\n",
+                        le16_to_cpu(reply.evt.status));
+                rc = -EINVAL;
+        }
+
+        return rc;
+}
+
 void wmi_event_flush(struct wil6210_priv *wil)
 {
         struct pending_wmi_event *evt, *t;
diff --git a/drivers/net/wireless/ath/wil6210/wmi.h b/drivers/net/wireless/ath/wil6210/wmi.h
index 27b97432d1c2..8a4af613e191 100644
--- a/drivers/net/wireless/ath/wil6210/wmi.h
+++ b/drivers/net/wireless/ath/wil6210/wmi.h
@@ -29,8 +29,10 @@
 
 /* General */
 #define WILOCITY_MAX_ASSOC_STA (8)
+#define WILOCITY_DEFAULT_ASSOC_STA (1)
 #define WMI_MAC_LEN             (6)
 #define WMI_PROX_RANGE_NUM      (3)
+#define WMI_MAX_LOSS_DMG_BEACONS        (32)
 
 /* List of Commands */
 enum wmi_command_id {
@@ -48,7 +50,7 @@ enum wmi_command_id {
         WMI_SET_WSC_STATUS_CMDID        = 0x0041,
         WMI_PXMT_RANGE_CFG_CMDID        = 0x0042,
         WMI_PXMT_SNR2_RANGE_CFG_CMDID   = 0x0043,
-        WMI_FAST_MEM_ACC_MODE_CMDID     = 0x0300,
+/*      WMI_FAST_MEM_ACC_MODE_CMDID     = 0x0300, */
         WMI_MEM_READ_CMDID              = 0x0800,
         WMI_MEM_WR_CMDID                = 0x0801,
         WMI_ECHO_CMDID                  = 0x0803,
@@ -102,6 +104,8 @@ enum wmi_command_id {
         WMI_MAINTAIN_RESUME_CMDID       = 0x0851,
         WMI_RS_MGMT_CMDID               = 0x0852,
         WMI_RF_MGMT_CMDID               = 0x0853,
+        WMI_THERMAL_THROTTLING_CTRL_CMDID       = 0x0854,
+        WMI_THERMAL_THROTTLING_GET_STATUS_CMDID = 0x0855,
         /* Performance monitoring commands */
         WMI_BF_CTRL_CMDID               = 0x0862,
         WMI_NOTIFY_REQ_CMDID            = 0x0863,
@@ -136,6 +140,7 @@ enum wmi_command_id {
         WMI_EAPOL_TX_CMDID              = 0xf04c,
         WMI_MAC_ADDR_REQ_CMDID          = 0xf04d,
         WMI_FW_VER_CMDID                = 0xf04e,
+        WMI_PMC_CMDID                   = 0xf04f,
 };
 
 /*
@@ -283,8 +288,8 @@ enum wmi_scan_type {
         WMI_LONG_SCAN           = 0,
         WMI_SHORT_SCAN          = 1,
         WMI_PBC_SCAN            = 2,
-        WMI_ACTIVE_SCAN         = 3,
-        WMI_DIRECT_SCAN         = 4,
+        WMI_DIRECT_SCAN         = 3,
+        WMI_ACTIVE_SCAN         = 4,
 };
 
 struct wmi_start_scan_cmd {
@@ -375,6 +380,17 @@ struct wmi_rf_mgmt_cmd {
 } __packed;
 
 /*
+ * WMI_THERMAL_THROTTLING_CTRL_CMDID
+ */
+#define THERMAL_THROTTLING_USE_DEFAULT_MAX_TXOP_LENGTH  (0xFFFFFFFF)
+
+struct wmi_thermal_throttling_ctrl_cmd {
+        __le32 time_on_usec;
+        __le32 time_off_usec;
+        __le32 max_txop_length_usec;
+} __packed;
+
+/*
  * WMI_RF_RX_TEST_CMDID
  */
 struct wmi_rf_rx_test_cmd {
@@ -586,6 +602,7 @@ struct wmi_vring_ba_en_cmd {
         u8 ringid;
         u8 agg_max_wsize;
         __le16 ba_timeout;
+        u8 amsdu;
 } __packed;
 
 /*
@@ -647,6 +664,7 @@ enum wmi_cfg_rx_chain_cmd_action {
 enum wmi_cfg_rx_chain_cmd_decap_trans_type {
         WMI_DECAP_TYPE_802_3                    = 0,
         WMI_DECAP_TYPE_NATIVE_WIFI              = 1,
+        WMI_DECAP_TYPE_NONE                     = 2,
 };
 
 enum wmi_cfg_rx_chain_cmd_nwifi_ds_trans_type {
@@ -784,9 +802,17 @@ struct wmi_echo_cmd {
  *
  * Measure MAC and radio temperatures
  */
+
+/* Possible modes for temperature measurement */
+enum wmi_temperature_measure_mode {
+        TEMPERATURE_USE_OLD_VALUE       = 0x1,
+        TEMPERATURE_MEASURE_NOW         = 0x2,
+};
+
 struct wmi_temp_sense_cmd {
-        __le32 measure_marlon_m_en;
-        __le32 measure_marlon_r_en;
+        __le32 measure_baseband_en;
+        __le32 measure_rf_en;
+        __le32 measure_mode;
 } __packed;
 
 /*
@@ -842,6 +868,7 @@ enum wmi_event_id {
         WMI_BF_RXSS_MGMT_DONE_EVENTID           = 0x1839,
         WMI_RS_MGMT_DONE_EVENTID                = 0x1852,
         WMI_RF_MGMT_STATUS_EVENTID              = 0x1853,
+        WMI_THERMAL_THROTTLING_STATUS_EVENTID   = 0x1855,
         WMI_BF_SM_MGMT_DONE_EVENTID             = 0x1838,
         WMI_RX_MGMT_PACKET_EVENTID              = 0x1840,
         WMI_TX_MGMT_PACKET_EVENTID              = 0x1841,
@@ -858,6 +885,7 @@ enum wmi_event_id {
         WMI_FLASH_READ_DONE_EVENTID             = 0x1902,
         WMI_FLASH_WRITE_DONE_EVENTID            = 0x1903,
         /*P2P*/
+        WMI_P2P_CFG_DONE_EVENTID                = 0x1910,
         WMI_PORT_ALLOCATED_EVENTID              = 0x1911,
         WMI_PORT_DELETED_EVENTID                = 0x1912,
         WMI_LISTEN_STARTED_EVENTID              = 0x1914,
@@ -898,6 +926,15 @@ struct wmi_rf_mgmt_status_event {
 } __packed;
 
 /*
+ * WMI_THERMAL_THROTTLING_STATUS_EVENTID
+ */
+struct wmi_thermal_throttling_status_event {
+        __le32 time_on_usec;
+        __le32 time_off_usec;
+        __le32 max_txop_length_usec;
+} __packed;
+
+/*
  * WMI_GET_STATUS_DONE_EVENTID
  */
 struct wmi_get_status_done_event {
@@ -1052,14 +1089,23 @@ struct wmi_scan_complete_event {
 enum wmi_vring_ba_status {
         WMI_BA_AGREED                   = 0,
         WMI_BA_NON_AGREED               = 1,
+        /* BA_EN in middle of teardown flow */
+        WMI_BA_TD_WIP                   = 2,
+        /* BA_DIS or BA_EN in middle of BA SETUP flow */
+        WMI_BA_SETUP_WIP                = 3,
+        /* BA_EN when the BA session is already active */
+        WMI_BA_SESSION_ACTIVE           = 4,
+        /* BA_DIS when the BA session is not active */
+        WMI_BA_SESSION_NOT_ACTIVE       = 5,
 };
 
 struct wmi_vring_ba_status_event {
-        __le16 status;
+        __le16 status; /* enum wmi_vring_ba_status */
         u8 reserved[2];
         u8 ringid;
         u8 agg_wsize;
         __le16 ba_timeout;
+        u8 amsdu;
 } __packed;
 
 /*
@@ -1145,6 +1191,14 @@ struct wmi_get_pcp_channel_event {
 } __packed;
 
 /*
+ * WMI_P2P_CFG_DONE_EVENTID
+ */
+struct wmi_p2p_cfg_done_event {
+        u8 status;      /* wmi_fw_status */
+        u8 reserved[3];
+} __packed;
+
+/*
 * WMI_PORT_ALLOCATED_EVENTID
 */
 struct wmi_port_allocated_event {
@@ -1272,8 +1326,8 @@ struct wmi_echo_event {
  * Measure MAC and radio temperatures
  */
 struct wmi_temp_sense_done_event {
-        __le32 marlon_m_t1000;
-        __le32 marlon_r_t1000;
+        __le32 baseband_t1000;
+        __le32 rf_t1000;
 } __packed;
 
 #endif /* __WILOCITY_WMI_H__ */
diff --git a/drivers/net/wireless/atmel.c b/drivers/net/wireless/atmel.c
index 9183f1cf89a7..55db9f03eb2a 100644
--- a/drivers/net/wireless/atmel.c
+++ b/drivers/net/wireless/atmel.c
@@ -45,7 +45,6 @@
 #include <linux/ptrace.h>
 #include <linux/slab.h>
 #include <linux/string.h>
-#include <linux/ctype.h>
 #include <linux/timer.h>
 #include <asm/byteorder.h>
 #include <asm/io.h>
@@ -2699,16 +2698,7 @@ static int atmel_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
                 domain[REGDOMAINSZ] = 0;
                 rc = -EINVAL;
                 for (i = 0; i < ARRAY_SIZE(channel_table); i++) {
-                        /* strcasecmp doesn't exist in the library */
-                        char *a = channel_table[i].name;
-                        char *b = domain;
-                        while (*a) {
-                                char c1 = *a++;
-                                char c2 = *b++;
-                                if (tolower(c1) != tolower(c2))
-                                        break;
-                        }
-                        if (!*a && !*b) {
+                        if (!strcasecmp(channel_table[i].name, domain)) {
                                 priv->config_reg_domain = channel_table[i].reg_domain;
                                 rc = 0;
                         }
diff --git a/drivers/net/wireless/b43/Kconfig b/drivers/net/wireless/b43/Kconfig
index 64a5b672e30a..759fb8d41fc9 100644
--- a/drivers/net/wireless/b43/Kconfig
+++ b/drivers/net/wireless/b43/Kconfig
@@ -166,6 +166,15 @@ config B43_PHY_LCN
 
           Say N, this is BROKEN and crashes driver.
 
+config B43_PHY_AC
+        bool "Support for AC-PHY (802.11ac) devices (BROKEN)"
+        depends on B43 && B43_BCMA && BROKEN
+        ---help---
+          This PHY type can be found in the following chipsets:
+          PCI: BCM4352, BCM4360
+
+          Say N, this is BROKEN and crashes driver.
+
 # This config option automatically enables b43 LEDS support,
 # if it's possible.
 config B43_LEDS
diff --git a/drivers/net/wireless/b43/Makefile b/drivers/net/wireless/b43/Makefile
index 9f7965aae93d..c624d4d90e4f 100644
--- a/drivers/net/wireless/b43/Makefile
+++ b/drivers/net/wireless/b43/Makefile
@@ -13,6 +13,7 @@ b43-$(CONFIG_B43_PHY_HT)	+= phy_ht.o
 b43-$(CONFIG_B43_PHY_HT)        += tables_phy_ht.o
 b43-$(CONFIG_B43_PHY_HT)        += radio_2059.o
 b43-$(CONFIG_B43_PHY_LCN)       += phy_lcn.o tables_phy_lcn.o
+b43-$(CONFIG_B43_PHY_AC)        += phy_ac.o
 b43-y                           += sysfs.o
 b43-y                           += xmit.o
 b43-y                           += dma.o
diff --git a/drivers/net/wireless/b43/b43.h b/drivers/net/wireless/b43/b43.h
index bb12586cd7cd..036552439816 100644
--- a/drivers/net/wireless/b43/b43.h
+++ b/drivers/net/wireless/b43/b43.h
@@ -500,6 +500,8 @@ enum {
 #define  B43_BCMA_IOCTL_PHY_BW_10MHZ    0x00000000      /* 10 MHz bandwidth, 40 MHz PHY */
 #define  B43_BCMA_IOCTL_PHY_BW_20MHZ    0x00000040      /* 20 MHz bandwidth, 80 MHz PHY */
 #define  B43_BCMA_IOCTL_PHY_BW_40MHZ    0x00000080      /* 40 MHz bandwidth, 160 MHz PHY */
+#define  B43_BCMA_IOCTL_PHY_BW_80MHZ    0x000000C0      /* 80 MHz bandwidth */
+#define B43_BCMA_IOCTL_DAC              0x00000300      /* Highspeed DAC mode control field */
 #define B43_BCMA_IOCTL_GMODE            0x00002000      /* G Mode Enable */
 
 /* BCMA 802.11 core specific IO status (BCMA_IOST) flags */
@@ -941,6 +943,7 @@ struct b43_wl {
         bool beacon1_uploaded;
         bool beacon_templates_virgin; /* Never wrote the templates? */
         struct work_struct beacon_update_trigger;
+        spinlock_t beacon_lock;
 
         /* The current QOS parameters for the 4 queues. */
         struct b43_qos_params qos_params[B43_QOS_QUEUE_NUM];
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 47731cb0d815..2c9088633ec6 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -1262,6 +1262,23 @@ static void b43_bcma_wireless_core_reset(struct b43_wldev *dev, bool gmode)
                 flags |= B43_BCMA_IOCTL_GMODE;
         b43_device_enable(dev, flags);
 
+        if (dev->phy.type == B43_PHYTYPE_AC) {
+                u16 tmp;
+
+                tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
+                tmp &= ~B43_BCMA_IOCTL_DAC;
+                tmp |= 0x100;
+                bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
+
+                tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
+                tmp &= ~B43_BCMA_IOCTL_PHY_CLKEN;
+                bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
+
+                tmp = bcma_aread32(dev->dev->bdev, BCMA_IOCTL);
+                tmp |= B43_BCMA_IOCTL_PHY_CLKEN;
+                bcma_awrite32(dev->dev->bdev, BCMA_IOCTL, tmp);
+        }
+
         bcma_core_set_clockmode(dev->dev->bdev, BCMA_CLKMODE_FAST);
         b43_bcma_phy_reset(dev);
         bcma_core_pll_ctl(dev->dev->bdev, req, status, true);
@@ -1601,12 +1618,26 @@ static void b43_write_beacon_template(struct b43_wldev *dev,
         unsigned int rate;
         u16 ctl;
         int antenna;
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(dev->wl->current_beacon);
+        struct ieee80211_tx_info *info;
+        unsigned long flags;
+        struct sk_buff *beacon_skb;
 
-        bcn = (const struct ieee80211_mgmt *)(dev->wl->current_beacon->data);
-        len = min_t(size_t, dev->wl->current_beacon->len,
-                  0x200 - sizeof(struct b43_plcp_hdr6));
+        spin_lock_irqsave(&dev->wl->beacon_lock, flags);
+        info = IEEE80211_SKB_CB(dev->wl->current_beacon);
         rate = ieee80211_get_tx_rate(dev->wl->hw, info)->hw_value;
+        /* Clone the beacon, so it cannot go away, while we write it to hw. */
+        beacon_skb = skb_clone(dev->wl->current_beacon, GFP_ATOMIC);
+        spin_unlock_irqrestore(&dev->wl->beacon_lock, flags);
+
+        if (!beacon_skb) {
+                b43dbg(dev->wl, "Could not upload beacon. "
+                       "Failed to clone beacon skb.");
+                return;
+        }
+
+        bcn = (const struct ieee80211_mgmt *)(beacon_skb->data);
+        len = min_t(size_t, beacon_skb->len,
+                    0x200 - sizeof(struct b43_plcp_hdr6));
 
         b43_write_template_common(dev, (const u8 *)bcn,
                                   len, ram_offset, shm_size_offset, rate);
@@ -1674,6 +1705,8 @@ static void b43_write_beacon_template(struct b43_wldev *dev,
                                 B43_SHM_SH_DTIMPER, 0);
         }
         b43dbg(dev->wl, "Updated beacon template at 0x%x\n", ram_offset);
+
+        dev_kfree_skb_any(beacon_skb);
 }
 
 static void b43_upload_beacon0(struct b43_wldev *dev)
@@ -1790,13 +1823,13 @@ static void b43_beacon_update_trigger_work(struct work_struct *work)
         mutex_unlock(&wl->mutex);
 }
 
-/* Asynchronously update the packet templates in template RAM.
- * Locking: Requires wl->mutex to be locked. */
+/* Asynchronously update the packet templates in template RAM. */
 static void b43_update_templates(struct b43_wl *wl)
 {
-        struct sk_buff *beacon;
+        struct sk_buff *beacon, *old_beacon;
+        unsigned long flags;
 
-        /* This is the top half of the ansynchronous beacon update.
+        /* This is the top half of the asynchronous beacon update.
          * The bottom half is the beacon IRQ.
          * Beacon update must be asynchronous to avoid sending an
          * invalid beacon. This can happen for example, if the firmware
@@ -1810,12 +1843,17 @@ static void b43_update_templates(struct b43_wl *wl)
         if (unlikely(!beacon))
                 return;
 
-        if (wl->current_beacon)
-                dev_kfree_skb_any(wl->current_beacon);
+        spin_lock_irqsave(&wl->beacon_lock, flags);
+        old_beacon = wl->current_beacon;
         wl->current_beacon = beacon;
         wl->beacon0_uploaded = false;
         wl->beacon1_uploaded = false;
+        spin_unlock_irqrestore(&wl->beacon_lock, flags);
+
         ieee80211_queue_work(wl->hw, &wl->beacon_update_trigger);
+
+        if (old_beacon)
+                dev_kfree_skb_any(old_beacon);
 }
 
 static void b43_set_beacon_int(struct b43_wldev *dev, u16 beacon_int)
@@ -4318,6 +4356,7 @@ redo:
         mutex_unlock(&wl->mutex);
         cancel_delayed_work_sync(&dev->periodic_work);
         cancel_work_sync(&wl->tx_work);
+        b43_leds_stop(dev);
         mutex_lock(&wl->mutex);
         dev = wl->current_dev;
         if (!dev || b43_status(dev) < B43_STAT_STARTED) {
@@ -4505,6 +4544,12 @@ static int b43_phy_versioning(struct b43_wldev *dev)
                         unsupported = 1;
                 break;
 #endif
+#ifdef CONFIG_B43_PHY_AC
+        case B43_PHYTYPE_AC:
+                if (phy_rev > 1)
+                        unsupported = 1;
+                break;
+#endif
         default:
                 unsupported = 1;
         }
@@ -4601,6 +4646,10 @@ static int b43_phy_versioning(struct b43_wldev *dev)
                 if (radio_id != 0x2064)
                         unsupported = 1;
                 break;
+        case B43_PHYTYPE_AC:
+                if (radio_id != 0x2069)
+                        unsupported = 1;
+                break;
         default:
                 B43_WARN_ON(1);
         }
@@ -5094,7 +5143,6 @@ static int b43_op_beacon_set_tim(struct ieee80211_hw *hw,
 {
         struct b43_wl *wl = hw_to_b43_wl(hw);
 
-        /* FIXME: add locking */
         b43_update_templates(wl);
 
         return 0;
@@ -5584,6 +5632,7 @@ static struct b43_wl *b43_wireless_init(struct b43_bus_dev *dev)
         wl->hw = hw;
         mutex_init(&wl->mutex);
         spin_lock_init(&wl->hardirq_lock);
+        spin_lock_init(&wl->beacon_lock);
         INIT_WORK(&wl->beacon_update_trigger, b43_beacon_update_trigger_work);
         INIT_WORK(&wl->txpower_adjust_work, b43_phy_txpower_adjust_work);
         INIT_WORK(&wl->tx_work, b43_tx_work);
diff --git a/drivers/net/wireless/b43/phy_ac.c b/drivers/net/wireless/b43/phy_ac.c
new file mode 100644
index 000000000000..e75633d67938
--- /dev/null
+++ b/drivers/net/wireless/b43/phy_ac.c
@@ -0,0 +1,92 @@
+/*
+ * Broadcom B43 wireless driver
+ * IEEE 802.11ac AC-PHY support
+ *
+ * Copyright (c) 2015 Rafał Miłecki <zajec5@gmail.com>
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ */
+
+#include "b43.h"
+#include "phy_ac.h"
+
+/**************************************************
+ * Basic PHY ops
+ **************************************************/
+
+static int b43_phy_ac_op_allocate(struct b43_wldev *dev)
+{
+        struct b43_phy_ac *phy_ac;
+
+        phy_ac = kzalloc(sizeof(*phy_ac), GFP_KERNEL);
+        if (!phy_ac)
+                return -ENOMEM;
+        dev->phy.ac = phy_ac;
+
+        return 0;
+}
+
+static void b43_phy_ac_op_free(struct b43_wldev *dev)
+{
+        struct b43_phy *phy = &dev->phy;
+        struct b43_phy_ac *phy_ac = phy->ac;
+
+        kfree(phy_ac);
+        phy->ac = NULL;
+}
+
+static void b43_phy_ac_op_maskset(struct b43_wldev *dev, u16 reg, u16 mask,
+                                  u16 set)
+{
+        b43_write16f(dev, B43_MMIO_PHY_CONTROL, reg);
+        b43_write16(dev, B43_MMIO_PHY_DATA,
+                    (b43_read16(dev, B43_MMIO_PHY_DATA) & mask) | set);
+}
+
+static u16 b43_phy_ac_op_radio_read(struct b43_wldev *dev, u16 reg)
+{
+        b43_write16f(dev, B43_MMIO_RADIO24_CONTROL, reg);
+        return b43_read16(dev, B43_MMIO_RADIO24_DATA);
+}
+
+static void b43_phy_ac_op_radio_write(struct b43_wldev *dev, u16 reg,
+                                      u16 value)
+{
+        b43_write16f(dev, B43_MMIO_RADIO24_CONTROL, reg);
+        b43_write16(dev, B43_MMIO_RADIO24_DATA, value);
+}
+
+static unsigned int b43_phy_ac_op_get_default_chan(struct b43_wldev *dev)
+{
+        if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ)
+                return 11;
+        return 36;
+}
+
+static enum b43_txpwr_result
+b43_phy_ac_op_recalc_txpower(struct b43_wldev *dev, bool ignore_tssi)
+{
+        return B43_TXPWR_RES_DONE;
+}
+
+static void b43_phy_ac_op_adjust_txpower(struct b43_wldev *dev)
+{
+}
+
+/**************************************************
+ * PHY ops struct
+ **************************************************/
+
+const struct b43_phy_operations b43_phyops_ac = {
+        .allocate               = b43_phy_ac_op_allocate,
+        .free                   = b43_phy_ac_op_free,
+        .phy_maskset            = b43_phy_ac_op_maskset,
+        .radio_read             = b43_phy_ac_op_radio_read,
+        .radio_write            = b43_phy_ac_op_radio_write,
+        .get_default_chan       = b43_phy_ac_op_get_default_chan,
+        .recalc_txpower         = b43_phy_ac_op_recalc_txpower,
+        .adjust_txpower         = b43_phy_ac_op_adjust_txpower,
+};
diff --git a/drivers/net/wireless/b43/phy_ac.h b/drivers/net/wireless/b43/phy_ac.h
new file mode 100644
index 000000000000..d1ca79e0eb24
--- /dev/null
+++ b/drivers/net/wireless/b43/phy_ac.h
@@ -0,0 +1,38 @@
+#ifndef B43_PHY_AC_H_
+#define B43_PHY_AC_H_
+
+#include "phy_common.h"
+
+#define B43_PHY_AC_BBCFG                        0x001
+#define  B43_PHY_AC_BBCFG_RSTCCA                0x4000  /* Reset CCA */
+#define B43_PHY_AC_BANDCTL                      0x003   /* Band control */
+#define  B43_PHY_AC_BANDCTL_5GHZ                0x0001
+#define B43_PHY_AC_TABLE_ID                     0x00d
+#define B43_PHY_AC_TABLE_OFFSET                 0x00e
+#define B43_PHY_AC_TABLE_DATA1                  0x00f
+#define B43_PHY_AC_TABLE_DATA2                  0x010
+#define B43_PHY_AC_TABLE_DATA3                  0x011
+#define B43_PHY_AC_CLASSCTL                     0x140   /* Classifier control */
+#define  B43_PHY_AC_CLASSCTL_CCKEN              0x0001  /* CCK enable */
+#define  B43_PHY_AC_CLASSCTL_OFDMEN             0x0002  /* OFDM enable */
+#define  B43_PHY_AC_CLASSCTL_WAITEDEN           0x0004  /* Waited enable */
+#define B43_PHY_AC_BW1A                         0x371
+#define B43_PHY_AC_BW2                          0x372
+#define B43_PHY_AC_BW3                          0x373
+#define B43_PHY_AC_BW4                          0x374
+#define B43_PHY_AC_BW5                          0x375
+#define B43_PHY_AC_BW6                          0x376
+#define B43_PHY_AC_RFCTL_CMD                    0x408
+#define B43_PHY_AC_C1_CLIP                      0x6d4
+#define  B43_PHY_AC_C1_CLIP_DIS                 0x4000
+#define B43_PHY_AC_C2_CLIP                      0x8d4
+#define  B43_PHY_AC_C2_CLIP_DIS                 0x4000
+#define B43_PHY_AC_C3_CLIP                      0xad4
+#define  B43_PHY_AC_C3_CLIP_DIS                 0x4000
+
+struct b43_phy_ac {
+};
+
+extern const struct b43_phy_operations b43_phyops_ac;
+
+#endif /* B43_PHY_AC_H_ */
diff --git a/drivers/net/wireless/b43/phy_common.c b/drivers/net/wireless/b43/phy_common.c
index ee27b06074e1..ec2b9c577b90 100644
--- a/drivers/net/wireless/b43/phy_common.c
+++ b/drivers/net/wireless/b43/phy_common.c
@@ -33,6 +33,7 @@
 #include "phy_lp.h"
 #include "phy_ht.h"
 #include "phy_lcn.h"
+#include "phy_ac.h"
 #include "b43.h"
 #include "main.h"
 
@@ -70,6 +71,11 @@ int b43_phy_allocate(struct b43_wldev *dev)
                 phy->ops = &b43_phyops_lcn;
 #endif
                 break;
+        case B43_PHYTYPE_AC:
+#ifdef CONFIG_B43_PHY_AC
+                phy->ops = &b43_phyops_ac;
+#endif
+                break;
         }
         if (B43_WARN_ON(!phy->ops))
                 return -ENODEV;
@@ -572,7 +578,8 @@ void b43_phy_force_clock(struct b43_wldev *dev, bool force)
         u32 tmp;
 
         WARN_ON(dev->phy.type != B43_PHYTYPE_N &&
-                dev->phy.type != B43_PHYTYPE_HT);
+                dev->phy.type != B43_PHYTYPE_HT &&
+                dev->phy.type != B43_PHYTYPE_AC);
 
         switch (dev->dev->bus_type) {
 #ifdef CONFIG_B43_BCMA
diff --git a/drivers/net/wireless/b43/phy_common.h b/drivers/net/wireless/b43/phy_common.h
index 3912274f71e3..78d86526799e 100644
--- a/drivers/net/wireless/b43/phy_common.h
+++ b/drivers/net/wireless/b43/phy_common.h
@@ -222,6 +222,8 @@ struct b43_phy {
                 struct b43_phy_ht *ht;
                 /* LCN-PHY specific information */
                 struct b43_phy_lcn *lcn;
+                /* AC-PHY specific information */
+                struct b43_phy_ac *ac;
         };
 
         /* Band support flags. */
diff --git a/drivers/net/wireless/b43legacy/radio.c b/drivers/net/wireless/b43legacy/radio.c
index 896177690394..9501420340a9 100644
--- a/drivers/net/wireless/b43legacy/radio.c
+++ b/drivers/net/wireless/b43legacy/radio.c
@@ -1743,25 +1743,6 @@ u16 freq_r3A_value(u16 frequency)
         return value;
 }
 
-void b43legacy_radio_set_tx_iq(struct b43legacy_wldev *dev)
-{
-        static const u8 data_high[5] = { 0x00, 0x40, 0x80, 0x90, 0xD0 };
-        static const u8 data_low[5]  = { 0x00, 0x01, 0x05, 0x06, 0x0A };
-        u16 tmp = b43legacy_radio_read16(dev, 0x001E);
-        int i;
-        int j;
-
-        for (i = 0; i < 5; i++) {
-                for (j = 0; j < 5; j++) {
-                        if (tmp == (data_high[i] | data_low[j])) {
-                                b43legacy_phy_write(dev, 0x0069, (i - j) << 8 |
-                                                    0x00C0);
-                                return;
-                        }
-                }
-        }
-}
-
 int b43legacy_radio_selectchannel(struct b43legacy_wldev *dev,
                                   u8 channel,
                                   int synthetic_pu_workaround)
diff --git a/drivers/net/wireless/b43legacy/radio.h b/drivers/net/wireless/b43legacy/radio.h
index bccb3d7da682..dd2976d1d561 100644
--- a/drivers/net/wireless/b43legacy/radio.h
+++ b/drivers/net/wireless/b43legacy/radio.h
@@ -92,7 +92,6 @@ void b43legacy_nrssi_hw_write(struct b43legacy_wldev *dev, u16 offset, s16 val);
 void b43legacy_nrssi_hw_update(struct b43legacy_wldev *dev, u16 val);
 void b43legacy_nrssi_mem_update(struct b43legacy_wldev *dev);
 
-void b43legacy_radio_set_tx_iq(struct b43legacy_wldev *dev);
 u16 b43legacy_radio_calibrationvalue(struct b43legacy_wldev *dev);
 
 #endif /* B43legacy_RADIO_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
index 9880dae2a569..7944224e3fc9 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
@@ -97,25 +97,6 @@ static void brcmf_sdiod_dummy_irqhandler(struct sdio_func *func)
 {
 }
 
-static bool brcmf_sdiod_pm_resume_error(struct brcmf_sdio_dev *sdiodev)
-{
-        bool is_err = false;
-#ifdef CONFIG_PM_SLEEP
-        is_err = atomic_read(&sdiodev->suspend);
-#endif
-        return is_err;
-}
-
-static void brcmf_sdiod_pm_resume_wait(struct brcmf_sdio_dev *sdiodev,
-                                       wait_queue_head_t *wq)
-{
-#ifdef CONFIG_PM_SLEEP
-        int retry = 0;
-        while (atomic_read(&sdiodev->suspend) && retry++ != 30)
-                wait_event_timeout(*wq, false, HZ/100);
-#endif
-}
-
 int brcmf_sdiod_intr_register(struct brcmf_sdio_dev *sdiodev)
 {
         int ret = 0;
@@ -244,10 +225,6 @@ static int brcmf_sdiod_request_data(struct brcmf_sdio_dev *sdiodev, u8 fn,
         brcmf_dbg(SDIO, "rw=%d, func=%d, addr=0x%05x, nbytes=%d\n",
                   write, fn, addr, regsz);
 
-        brcmf_sdiod_pm_resume_wait(sdiodev, &sdiodev->request_word_wait);
-        if (brcmf_sdiod_pm_resume_error(sdiodev))
-                return -EIO;
-
         /* only allow byte access on F0 */
         if (WARN_ON(regsz > 1 && !fn))
                 return -EINVAL;
@@ -292,6 +269,12 @@ static int brcmf_sdiod_request_data(struct brcmf_sdio_dev *sdiodev, u8 fn,
         return ret;
 }
 
+static void brcmf_sdiod_nomedium_state(struct brcmf_sdio_dev *sdiodev)
+{
+        sdiodev->state = BRCMF_STATE_NOMEDIUM;
+        brcmf_bus_change_state(sdiodev->bus_if, BRCMF_BUS_DOWN);
+}
+
 static int brcmf_sdiod_regrw_helper(struct brcmf_sdio_dev *sdiodev, u32 addr,
                                    u8 regsz, void *data, bool write)
 {
@@ -299,7 +282,7 @@ static int brcmf_sdiod_regrw_helper(struct brcmf_sdio_dev *sdiodev, u32 addr,
         s32 retry = 0;
         int ret;
 
-        if (sdiodev->bus_if->state == BRCMF_BUS_NOMEDIUM)
+        if (sdiodev->state == BRCMF_STATE_NOMEDIUM)
                 return -ENOMEDIUM;
 
         /*
@@ -325,7 +308,7 @@ static int brcmf_sdiod_regrw_helper(struct brcmf_sdio_dev *sdiodev, u32 addr,
                  retry++ < SDIOH_API_ACCESS_RETRY_LIMIT);
 
         if (ret == -ENOMEDIUM)
-                brcmf_bus_change_state(sdiodev->bus_if, BRCMF_BUS_NOMEDIUM);
+                brcmf_sdiod_nomedium_state(sdiodev);
         else if (ret != 0) {
                 /*
                  * SleepCSR register access can fail when
@@ -348,7 +331,7 @@ brcmf_sdiod_set_sbaddr_window(struct brcmf_sdio_dev *sdiodev, u32 address)
         int err = 0, i;
         u8 addr[3];
 
-        if (sdiodev->bus_if->state == BRCMF_BUS_NOMEDIUM)
+        if (sdiodev->state == BRCMF_STATE_NOMEDIUM)
                 return -ENOMEDIUM;
 
         addr[0] = (address >> 8) & SBSDIO_SBADDRLOW_MASK;
@@ -462,10 +445,6 @@ static int brcmf_sdiod_buffrw(struct brcmf_sdio_dev *sdiodev, uint fn,
         unsigned int req_sz;
         int err;
 
-        brcmf_sdiod_pm_resume_wait(sdiodev, &sdiodev->request_buffer_wait);
-        if (brcmf_sdiod_pm_resume_error(sdiodev))
-                return -EIO;
-
         /* Single skb use the standard mmc interface */
         req_sz = pkt->len + 3;
         req_sz &= (uint)~3;
@@ -481,7 +460,7 @@ static int brcmf_sdiod_buffrw(struct brcmf_sdio_dev *sdiodev, uint fn,
                 err = sdio_readsb(sdiodev->func[fn], ((u8 *)(pkt->data)), addr,
                                   req_sz);
         if (err == -ENOMEDIUM)
-                brcmf_bus_change_state(sdiodev->bus_if, BRCMF_BUS_NOMEDIUM);
+                brcmf_sdiod_nomedium_state(sdiodev);
         return err;
 }
 
@@ -516,10 +495,6 @@ static int brcmf_sdiod_sglist_rw(struct brcmf_sdio_dev *sdiodev, uint fn,
         if (!pktlist->qlen)
                 return -EINVAL;
 
-        brcmf_sdiod_pm_resume_wait(sdiodev, &sdiodev->request_buffer_wait);
-        if (brcmf_sdiod_pm_resume_error(sdiodev))
-                return -EIO;
-
         target_list = pktlist;
         /* for host with broken sg support, prepare a page aligned list */
         __skb_queue_head_init(&local_list);
@@ -620,8 +595,7 @@ static int brcmf_sdiod_sglist_rw(struct brcmf_sdio_dev *sdiodev, uint fn,
 
                 ret = mmc_cmd.error ? mmc_cmd.error : mmc_dat.error;
                 if (ret == -ENOMEDIUM) {
-                        brcmf_bus_change_state(sdiodev->bus_if,
-                                               BRCMF_BUS_NOMEDIUM);
+                        brcmf_sdiod_nomedium_state(sdiodev);
                         break;
                 } else if (ret != 0) {
                         brcmf_err("CMD53 sg block %s failed %d\n",
@@ -996,18 +970,20 @@ out:
 }
 
 #define BRCMF_SDIO_DEVICE(dev_id)       \
-        {SDIO_DEVICE(BRCM_SDIO_VENDOR_ID_BROADCOM, dev_id)}
+        {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, dev_id)}
 
 /* devices we support, null terminated */
 static const struct sdio_device_id brcmf_sdmmc_ids[] = {
-        BRCMF_SDIO_DEVICE(BRCM_SDIO_43143_DEVICE_ID),
-        BRCMF_SDIO_DEVICE(BRCM_SDIO_43241_DEVICE_ID),
-        BRCMF_SDIO_DEVICE(BRCM_SDIO_4329_DEVICE_ID),
-        BRCMF_SDIO_DEVICE(BRCM_SDIO_4330_DEVICE_ID),
-        BRCMF_SDIO_DEVICE(BRCM_SDIO_4334_DEVICE_ID),
-        BRCMF_SDIO_DEVICE(BRCM_SDIO_43362_DEVICE_ID),
-        BRCMF_SDIO_DEVICE(BRCM_SDIO_4335_4339_DEVICE_ID),
-        BRCMF_SDIO_DEVICE(BRCM_SDIO_4354_DEVICE_ID),
+        BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43143),
+        BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43241),
+        BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4329),
+        BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4330),
+        BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4334),
+        BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43340),
+        BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43341),
+        BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43362),
+        BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4335_4339),
+        BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4354),
         { /* end: all zeroes */ }
 };
 MODULE_DEVICE_TABLE(sdio, brcmf_sdmmc_ids);
@@ -1074,9 +1050,9 @@ static int brcmf_ops_sdio_probe(struct sdio_func *func,
                 bus_if->wowl_supported = true;
 #endif
 
+        sdiodev->sleeping = false;
         atomic_set(&sdiodev->suspend, false);
-        init_waitqueue_head(&sdiodev->request_word_wait);
-        init_waitqueue_head(&sdiodev->request_buffer_wait);
+        init_waitqueue_head(&sdiodev->idle_wait);
 
         brcmf_dbg(SDIO, "F2 found, calling brcmf_sdiod_probe...\n");
         err = brcmf_sdiod_probe(sdiodev);
@@ -1138,12 +1114,23 @@ void brcmf_sdio_wowl_config(struct device *dev, bool enabled)
 #ifdef CONFIG_PM_SLEEP
 static int brcmf_ops_sdio_suspend(struct device *dev)
 {
-        struct brcmf_bus *bus_if = dev_get_drvdata(dev);
-        struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
+        struct brcmf_bus *bus_if;
+        struct brcmf_sdio_dev *sdiodev;
         mmc_pm_flag_t sdio_flags;
 
         brcmf_dbg(SDIO, "Enter\n");
 
+        bus_if = dev_get_drvdata(dev);
+        sdiodev = bus_if->bus_priv.sdio;
+
+        /* wait for watchdog to go idle */
+        if (wait_event_timeout(sdiodev->idle_wait, sdiodev->sleeping,
+                               msecs_to_jiffies(3 * BRCMF_WD_POLL_MS)) == 0) {
+                brcmf_err("bus still active\n");
+                return -EBUSY;
+        }
+        /* disable watchdog */
+        brcmf_sdio_wd_timer(sdiodev->bus, 0);
         atomic_set(&sdiodev->suspend, true);
 
         if (sdiodev->wowl_enabled) {
@@ -1155,9 +1142,6 @@ static int brcmf_ops_sdio_suspend(struct device *dev)
                 if (sdio_set_host_pm_flags(sdiodev->func[1], sdio_flags))
                         brcmf_err("Failed to set pm_flags %x\n", sdio_flags);
         }
-
-        brcmf_sdio_wd_timer(sdiodev->bus, 0);
-
         return 0;
 }
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bus.h b/drivers/net/wireless/brcm80211/brcmfmac/bus.h
index ef344e47218a..89e6a4dc105e 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bus.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bus.h
@@ -33,11 +33,8 @@
 
 /* The level of bus communication with the dongle */
 enum brcmf_bus_state {
-        BRCMF_BUS_UNKNOWN,      /* Not determined yet */
-        BRCMF_BUS_NOMEDIUM,     /* No medium access to dongle */
         BRCMF_BUS_DOWN,         /* Not ready for frame transfers */
-        BRCMF_BUS_LOAD,         /* Download access only (CPU reset) */
-        BRCMF_BUS_DATA          /* Ready for frame transfers */
+        BRCMF_BUS_UP            /* Ready for frame transfers */
 };
 
 /* The level of bus communication with the dongle */
@@ -188,22 +185,6 @@ void brcmf_bus_wowl_config(struct brcmf_bus *bus, bool enabled)
                 bus->ops->wowl_config(bus->dev, enabled);
 }
 
-static inline bool brcmf_bus_ready(struct brcmf_bus *bus)
-{
-        return bus->state == BRCMF_BUS_LOAD || bus->state == BRCMF_BUS_DATA;
-}
-
-static inline void brcmf_bus_change_state(struct brcmf_bus *bus,
-                                          enum brcmf_bus_state new_state)
-{
-        /* NOMEDIUM is permanent */
-        if (bus->state == BRCMF_BUS_NOMEDIUM)
-                return;
-
-        brcmf_dbg(TRACE, "%d -> %d\n", bus->state, new_state);
-        bus->state = new_state;
-}
-
 /*
  * interface functions from common layer
  */
@@ -226,6 +207,9 @@ void brcmf_txflowblock(struct device *dev, bool state);
 /* Notify the bus has transferred the tx packet to firmware */
 void brcmf_txcomplete(struct device *dev, struct sk_buff *txp, bool success);
 
+/* Configure the "global" bus state used by upper layers */
+void brcmf_bus_change_state(struct brcmf_bus *bus, enum brcmf_bus_state state);
+
 int brcmf_bus_start(struct device *dev);
 s32 brcmf_iovar_data_set(struct device *dev, char *name, void *data, u32 len);
 void brcmf_bus_add_txhdrlen(struct device *dev, uint len);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
index 3aecc5f48719..b59b8c6c42ab 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
@@ -38,6 +38,7 @@
 #include "proto.h"
 #include "vendor.h"
 #include "bus.h"
+#include "common.h"
 
 #define BRCMF_SCAN_IE_LEN_MAX           2048
 #define BRCMF_PNO_VERSION               2
@@ -452,16 +453,16 @@ static void convert_key_from_CPU(struct brcmf_wsec_key *key,
 }
 
 static int
-send_key_to_dongle(struct net_device *ndev, struct brcmf_wsec_key *key)
+send_key_to_dongle(struct brcmf_if *ifp, struct brcmf_wsec_key *key)
 {
         int err;
         struct brcmf_wsec_key_le key_le;
 
         convert_key_from_CPU(key, &key_le);
 
-        brcmf_netdev_wait_pend8021x(ndev);
+        brcmf_netdev_wait_pend8021x(ifp);
 
-        err = brcmf_fil_bsscfg_data_set(netdev_priv(ndev), "wsec_key", &key_le,
+        err = brcmf_fil_bsscfg_data_set(ifp, "wsec_key", &key_le,
                                         sizeof(key_le));
 
         if (err)
@@ -1228,7 +1229,25 @@ static void brcmf_init_prof(struct brcmf_cfg80211_profile *prof)
         memset(prof, 0, sizeof(*prof));
 }
 
-static void brcmf_link_down(struct brcmf_cfg80211_vif *vif)
+static u16 brcmf_map_fw_linkdown_reason(const struct brcmf_event_msg *e)
+{
+        u16 reason;
+
+        switch (e->event_code) {
+        case BRCMF_E_DEAUTH:
+        case BRCMF_E_DEAUTH_IND:
+        case BRCMF_E_DISASSOC_IND:
+                reason = e->reason;
+                break;
+        case BRCMF_E_LINK:
+        default:
+                reason = 0;
+                break;
+        }
+        return reason;
+}
+
+static void brcmf_link_down(struct brcmf_cfg80211_vif *vif, u16 reason)
 {
         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(vif->wdev.wiphy);
         s32 err = 0;
@@ -1243,7 +1262,8 @@ static void brcmf_link_down(struct brcmf_cfg80211_vif *vif)
                         brcmf_err("WLC_DISASSOC failed (%d)\n", err);
                 }
                 clear_bit(BRCMF_VIF_STATUS_CONNECTED, &vif->sme_state);
-                cfg80211_disconnected(vif->wdev.netdev, 0, NULL, 0, GFP_KERNEL);
+                cfg80211_disconnected(vif->wdev.netdev, reason, NULL, 0,
+                                      GFP_KERNEL);
 
         }
         clear_bit(BRCMF_VIF_STATUS_CONNECTING, &vif->sme_state);
@@ -1413,7 +1433,7 @@ brcmf_cfg80211_leave_ibss(struct wiphy *wiphy, struct net_device *ndev)
         if (!check_vif_up(ifp->vif))
                 return -EIO;
 
-        brcmf_link_down(ifp->vif);
+        brcmf_link_down(ifp->vif, WLAN_REASON_DEAUTH_LEAVING);
 
         brcmf_dbg(TRACE, "Exit\n");
 
@@ -1670,7 +1690,7 @@ brcmf_set_sharedkey(struct net_device *ndev,
         brcmf_dbg(CONN, "key length (%d) key index (%d) algo (%d)\n",
                   key.len, key.index, key.algo);
         brcmf_dbg(CONN, "key \"%s\"\n", key.data);
-        err = send_key_to_dongle(ndev, &key);
+        err = send_key_to_dongle(netdev_priv(ndev), &key);
         if (err)
                 return err;
 
@@ -2052,7 +2072,7 @@ brcmf_add_keyext(struct wiphy *wiphy, struct net_device *ndev,
         /* check for key index change */
         if (key.len == 0) {
                 /* key delete */
-                err = send_key_to_dongle(ndev, &key);
+                err = send_key_to_dongle(ifp, &key);
                 if (err)
                         brcmf_err("key delete error (%d)\n", err);
         } else {
@@ -2108,7 +2128,7 @@ brcmf_add_keyext(struct wiphy *wiphy, struct net_device *ndev,
                         brcmf_err("Invalid cipher (0x%x)\n", params->cipher);
                         return -EINVAL;
                 }
-                err = send_key_to_dongle(ndev, &key);
+                err = send_key_to_dongle(ifp, &key);
                 if (err)
                         brcmf_err("wsec_key error (%d)\n", err);
         }
@@ -2121,7 +2141,7 @@ brcmf_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
                     struct key_params *params)
 {
         struct brcmf_if *ifp = netdev_priv(ndev);
-        struct brcmf_wsec_key key;
+        struct brcmf_wsec_key *key;
         s32 val;
         s32 wsec;
         s32 err = 0;
@@ -2132,54 +2152,62 @@ brcmf_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
         if (!check_vif_up(ifp->vif))
                 return -EIO;
 
+        if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
+                /* we ignore this key index in this case */
+                brcmf_err("invalid key index (%d)\n", key_idx);
+                return -EINVAL;
+        }
+
         if (mac_addr &&
                 (params->cipher != WLAN_CIPHER_SUITE_WEP40) &&
                 (params->cipher != WLAN_CIPHER_SUITE_WEP104)) {
                 brcmf_dbg(TRACE, "Exit");
                 return brcmf_add_keyext(wiphy, ndev, key_idx, mac_addr, params);
         }
-        memset(&key, 0, sizeof(key));
 
-        key.len = (u32) params->key_len;
-        key.index = (u32) key_idx;
+        key = &ifp->vif->profile.key[key_idx];
+        memset(key, 0, sizeof(*key));
 
-        if (key.len > sizeof(key.data)) {
-                brcmf_err("Too long key length (%u)\n", key.len);
+        if (params->key_len > sizeof(key->data)) {
+                brcmf_err("Too long key length (%u)\n", params->key_len);
                 err = -EINVAL;
                 goto done;
         }
-        memcpy(key.data, params->key, key.len);
+        key->len = params->key_len;
+        key->index = key_idx;
 
-        key.flags = BRCMF_PRIMARY_KEY;
+        memcpy(key->data, params->key, key->len);
+
+        key->flags = BRCMF_PRIMARY_KEY;
         switch (params->cipher) {
         case WLAN_CIPHER_SUITE_WEP40:
-                key.algo = CRYPTO_ALGO_WEP1;
+                key->algo = CRYPTO_ALGO_WEP1;
                 val = WEP_ENABLED;
                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP40\n");
                 break;
         case WLAN_CIPHER_SUITE_WEP104:
-                key.algo = CRYPTO_ALGO_WEP128;
+                key->algo = CRYPTO_ALGO_WEP128;
                 val = WEP_ENABLED;
                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_WEP104\n");
                 break;
         case WLAN_CIPHER_SUITE_TKIP:
                 if (!brcmf_is_apmode(ifp->vif)) {
                         brcmf_dbg(CONN, "Swapping RX/TX MIC key\n");
-                        memcpy(keybuf, &key.data[24], sizeof(keybuf));
-                        memcpy(&key.data[24], &key.data[16], sizeof(keybuf));
-                        memcpy(&key.data[16], keybuf, sizeof(keybuf));
+                        memcpy(keybuf, &key->data[24], sizeof(keybuf));
+                        memcpy(&key->data[24], &key->data[16], sizeof(keybuf));
+                        memcpy(&key->data[16], keybuf, sizeof(keybuf));
                 }
-                key.algo = CRYPTO_ALGO_TKIP;
+                key->algo = CRYPTO_ALGO_TKIP;
                 val = TKIP_ENABLED;
                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_TKIP\n");
                 break;
         case WLAN_CIPHER_SUITE_AES_CMAC:
-                key.algo = CRYPTO_ALGO_AES_CCM;
+                key->algo = CRYPTO_ALGO_AES_CCM;
                 val = AES_ENABLED;
                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_AES_CMAC\n");
                 break;
         case WLAN_CIPHER_SUITE_CCMP:
-                key.algo = CRYPTO_ALGO_AES_CCM;
+                key->algo = CRYPTO_ALGO_AES_CCM;
                 val = AES_ENABLED;
                 brcmf_dbg(CONN, "WLAN_CIPHER_SUITE_CCMP\n");
                 break;
@@ -2189,7 +2217,7 @@ brcmf_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
                 goto done;
         }
 
-        err = send_key_to_dongle(ndev, &key);
+        err = send_key_to_dongle(ifp, key);
         if (err)
                 goto done;
 
@@ -2222,7 +2250,7 @@ brcmf_cfg80211_del_key(struct wiphy *wiphy, struct net_device *ndev,
         if (!check_vif_up(ifp->vif))
                 return -EIO;
 
-        if (key_idx >= DOT11_MAX_DEFAULT_KEYS) {
+        if (key_idx >= BRCMF_MAX_DEFAULT_KEYS) {
                 /* we ignore this key index in this case */
                 brcmf_err("invalid key index (%d)\n", key_idx);
                 return -EINVAL;
@@ -2237,7 +2265,7 @@ brcmf_cfg80211_del_key(struct wiphy *wiphy, struct net_device *ndev,
         brcmf_dbg(CONN, "key index (%d)\n", key_idx);
 
         /* Set the new key/index */
-        err = send_key_to_dongle(ndev, &key);
+        err = send_key_to_dongle(ifp, &key);
 
         brcmf_dbg(TRACE, "Exit\n");
         return err;
@@ -2305,6 +2333,39 @@ brcmf_cfg80211_config_default_mgmt_key(struct wiphy *wiphy,
         return -EOPNOTSUPP;
 }
 
+static void
+brcmf_cfg80211_reconfigure_wep(struct brcmf_if *ifp)
+{
+        s32 err;
+        u8 key_idx;
+        struct brcmf_wsec_key *key;
+        s32 wsec;
+
+        for (key_idx = 0; key_idx < BRCMF_MAX_DEFAULT_KEYS; key_idx++) {
+                key = &ifp->vif->profile.key[key_idx];
+                if ((key->algo == CRYPTO_ALGO_WEP1) ||
+                    (key->algo == CRYPTO_ALGO_WEP128))
+                        break;
+        }
+        if (key_idx == BRCMF_MAX_DEFAULT_KEYS)
+                return;
+
+        err = send_key_to_dongle(ifp, key);
+        if (err) {
+                brcmf_err("Setting WEP key failed (%d)\n", err);
+                return;
+        }
+        err = brcmf_fil_bsscfg_int_get(ifp, "wsec", &wsec);
+        if (err) {
+                brcmf_err("get wsec error (%d)\n", err);
+                return;
+        }
+        wsec |= WEP_ENABLED;
+        err = brcmf_fil_bsscfg_int_set(ifp, "wsec", wsec);
+        if (err)
+                brcmf_err("set wsec error (%d)\n", err);
+}
+
 static s32
 brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
                            const u8 *mac, struct station_info *sinfo)
@@ -2333,10 +2394,10 @@ brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
                         brcmf_err("GET STA INFO failed, %d\n", err);
                         goto done;
                 }
-                sinfo->filled = STATION_INFO_INACTIVE_TIME;
+                sinfo->filled = BIT(NL80211_STA_INFO_INACTIVE_TIME);
                 sinfo->inactive_time = le32_to_cpu(sta_info_le.idle) * 1000;
                 if (le32_to_cpu(sta_info_le.flags) & BRCMF_STA_ASSOC) {
-                        sinfo->filled |= STATION_INFO_CONNECTED_TIME;
+                        sinfo->filled |= BIT(NL80211_STA_INFO_CONNECTED_TIME);
                         sinfo->connected_time = le32_to_cpu(sta_info_le.in);
                 }
                 brcmf_dbg(TRACE, "STA idle time : %d ms, connected time :%d sec\n",
@@ -2354,7 +2415,7 @@ brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
                         brcmf_err("Could not get rate (%d)\n", err);
                         goto done;
                 } else {
-                        sinfo->filled |= STATION_INFO_TX_BITRATE;
+                        sinfo->filled |= BIT(NL80211_STA_INFO_TX_BITRATE);
                         sinfo->txrate.legacy = rate * 5;
                         brcmf_dbg(CONN, "Rate %d Mbps\n", rate / 2);
                 }
@@ -2369,7 +2430,7 @@ brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
                                 goto done;
                         } else {
                                 rssi = le32_to_cpu(scb_val.val);
-                                sinfo->filled |= STATION_INFO_SIGNAL;
+                                sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
                                 sinfo->signal = rssi;
                                 brcmf_dbg(CONN, "RSSI %d dBm\n", rssi);
                         }
@@ -2396,7 +2457,7 @@ brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
                                 brcmf_dbg(CONN, "DTIM peroid %d\n",
                                           dtim_period);
                         }
-                        sinfo->filled |= STATION_INFO_BSS_PARAM;
+                        sinfo->filled |= BIT(NL80211_STA_INFO_BSS_PARAM);
                 }
         } else
                 err = -EPERM;
@@ -2999,7 +3060,7 @@ static s32 brcmf_cfg80211_suspend(struct wiphy *wiphy,
                          * disassociate from AP to save power while system is
                          * in suspended state
                          */
-                        brcmf_link_down(vif);
+                        brcmf_link_down(vif, WLAN_REASON_UNSPECIFIED);
                         /* Make sure WPA_Supplicant receives all the event
                          * generated due to DISASSOC call to the fw to keep
                          * the state fw and WPA_Supplicant state consistent
@@ -3695,17 +3756,12 @@ static u32
 brcmf_vndr_ie(u8 *iebuf, s32 pktflag, u8 *ie_ptr, u32 ie_len, s8 *add_del_cmd)
 {
 
-        __le32 iecount_le;
-        __le32 pktflag_le;
-
         strncpy(iebuf, add_del_cmd, VNDR_IE_CMD_LEN - 1);
         iebuf[VNDR_IE_CMD_LEN - 1] = '\0';
 
-        iecount_le = cpu_to_le32(1);
-        memcpy(&iebuf[VNDR_IE_COUNT_OFFSET], &iecount_le, sizeof(iecount_le));
+        put_unaligned_le32(1, &iebuf[VNDR_IE_COUNT_OFFSET]);
 
-        pktflag_le = cpu_to_le32(pktflag);
-        memcpy(&iebuf[VNDR_IE_PKTFLAG_OFFSET], &pktflag_le, sizeof(pktflag_le));
+        put_unaligned_le32(pktflag, &iebuf[VNDR_IE_PKTFLAG_OFFSET]);
 
         memcpy(&iebuf[VNDR_IE_VSIE_OFFSET], ie_ptr, ie_len);
 
@@ -3924,6 +3980,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
         struct brcmf_if *ifp = netdev_priv(ndev);
         const struct brcmf_tlv *ssid_ie;
+        const struct brcmf_tlv *country_ie;
         struct brcmf_ssid_le ssid_le;
         s32 err = -EPERM;
         const struct brcmf_tlv *rsn_ie;
@@ -3933,6 +3990,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
         struct brcmf_fil_bss_enable_le bss_enable;
         u16 chanspec;
         bool mbss;
+        int is_11d;
 
         brcmf_dbg(TRACE, "ctrlchn=%d, center=%d, bw=%d, beacon_interval=%d, dtim_period=%d,\n",
                   settings->chandef.chan->hw_value,
@@ -3941,10 +3999,16 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
         brcmf_dbg(TRACE, "ssid=%s(%zu), auth_type=%d, inactivity_timeout=%d\n",
                   settings->ssid, settings->ssid_len, settings->auth_type,
                   settings->inactivity_timeout);
-
         dev_role = ifp->vif->wdev.iftype;
         mbss = ifp->vif->mbss;
 
+        /* store current 11d setting */
+        brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_REGULATORY, &ifp->vif->is_11d);
+        country_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
+                                      settings->beacon.tail_len,
+                                      WLAN_EID_COUNTRY);
+        is_11d = country_ie ? 1 : 0;
+
         memset(&ssid_le, 0, sizeof(ssid_le));
         if (settings->ssid == NULL || settings->ssid_len == 0) {
                 ie_offset = DOT11_MGMT_HDR_LEN + DOT11_BCN_PRB_FIXED_LEN;
@@ -4010,6 +4074,14 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
                         goto exit;
                 }
 
+                if (is_11d != ifp->vif->is_11d) {
+                        err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
+                                                    is_11d);
+                        if (err < 0) {
+                                brcmf_err("Regulatory Set Error, %d\n", err);
+                                goto exit;
+                        }
+                }
                 if (settings->beacon_interval) {
                         err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD,
                                                     settings->beacon_interval);
@@ -4042,6 +4114,10 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
                         brcmf_err("SET INFRA error %d\n", err);
                         goto exit;
                 }
+        } else if (WARN_ON(is_11d != ifp->vif->is_11d)) {
+                /* Multiple-BSS should use same 11d configuration */
+                err = -EINVAL;
+                goto exit;
         }
         if (dev_role == NL80211_IFTYPE_AP) {
                 if ((brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS)) && (!mbss))
@@ -4057,6 +4133,10 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
                         brcmf_err("BRCMF_C_UP error (%d)\n", err);
                         goto exit;
                 }
+                /* On DOWN the firmware removes the WEP keys, reconfigure
+                 * them if they were set.
+                 */
+                brcmf_cfg80211_reconfigure_wep(ifp);
 
                 memset(&join_params, 0, sizeof(join_params));
                 /* join parameters starts with ssid */
@@ -4133,6 +4213,11 @@ static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev)
                         brcmf_err("setting INFRA mode failed %d\n", err);
                 if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS))
                         brcmf_fil_iovar_int_set(ifp, "mbss", 0);
+                err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,
+                                            ifp->vif->is_11d);
+                if (err < 0)
+                        brcmf_err("restoring REGULATORY setting failed %d\n",
+                                  err);
                 /* Bring device back up so it can be used again */
                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
                 if (err < 0)
@@ -4197,6 +4282,34 @@ brcmf_cfg80211_del_station(struct wiphy *wiphy, struct net_device *ndev,
         return err;
 }
 
+static int
+brcmf_cfg80211_change_station(struct wiphy *wiphy, struct net_device *ndev,
+                              const u8 *mac, struct station_parameters *params)
+{
+        struct brcmf_if *ifp = netdev_priv(ndev);
+        s32 err;
+
+        brcmf_dbg(TRACE, "Enter, MAC %pM, mask 0x%04x set 0x%04x\n", mac,
+                  params->sta_flags_mask, params->sta_flags_set);
+
+        /* Ignore all 00 MAC */
+        if (is_zero_ether_addr(mac))
+                return 0;
+
+        if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
+                return 0;
+
+        if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED))
+                err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_AUTHORIZE,
+                                             (void *)mac, ETH_ALEN);
+        else
+                err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SCB_DEAUTHORIZE,
+                                             (void *)mac, ETH_ALEN);
+        if (err < 0)
+                brcmf_err("Setting SCB (de-)authorize failed, %d\n", err);
+
+        return err;
+}
 
 static void
 brcmf_cfg80211_mgmt_frame_register(struct wiphy *wiphy,
@@ -4471,6 +4584,7 @@ static struct cfg80211_ops wl_cfg80211_ops = {
         .stop_ap = brcmf_cfg80211_stop_ap,
         .change_beacon = brcmf_cfg80211_change_beacon,
         .del_station = brcmf_cfg80211_del_station,
+        .change_station = brcmf_cfg80211_change_station,
         .sched_scan_start = brcmf_cfg80211_sched_scan_start,
         .sched_scan_stop = brcmf_cfg80211_sched_scan_stop,
         .mgmt_frame_register = brcmf_cfg80211_mgmt_frame_register,
@@ -4778,7 +4892,6 @@ brcmf_notify_connect_status_ap(struct brcmf_cfg80211_info *cfg,
         if (((event == BRCMF_E_ASSOC_IND) || (event == BRCMF_E_REASSOC_IND)) &&
             (reason == BRCMF_E_STATUS_SUCCESS)) {
                 memset(&sinfo, 0, sizeof(sinfo));
-                sinfo.filled = STATION_INFO_ASSOC_REQ_IES;
                 if (!data) {
                         brcmf_err("No IEs present in ASSOC/REASSOC_IND");
                         return -EINVAL;
@@ -4833,7 +4946,7 @@ brcmf_notify_connect_status(struct brcmf_if *ifp,
                 if (!brcmf_is_ibssmode(ifp->vif)) {
                         brcmf_bss_connect_done(cfg, ndev, e, false);
                 }
-                brcmf_link_down(ifp->vif);
+                brcmf_link_down(ifp->vif, brcmf_map_fw_linkdown_reason(e));
                 brcmf_init_prof(ndev_to_prof(ndev));
                 if (ndev != cfg_to_ndev(cfg))
                         complete(&cfg->vif_disabled);
@@ -5774,7 +5887,7 @@ static s32 __brcmf_cfg80211_down(struct brcmf_if *ifp)
          * from AP to save power
          */
         if (check_vif_up(ifp->vif)) {
-                brcmf_link_down(ifp->vif);
+                brcmf_link_down(ifp->vif, WLAN_REASON_UNSPECIFIED);
 
                 /* Make sure WPA_Supplicant receives all the event
                    generated due to DISASSOC call to the fw to keep
@@ -5876,6 +5989,29 @@ int brcmf_cfg80211_wait_vif_event_timeout(struct brcmf_cfg80211_info *cfg,
                                   vif_event_equals(event, action), timeout);
 }
 
+static void brcmf_cfg80211_reg_notifier(struct wiphy *wiphy,
+                                        struct regulatory_request *req)
+{
+        struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
+        struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
+        struct brcmf_fil_country_le ccreq;
+        int i;
+
+        brcmf_dbg(TRACE, "enter: initiator=%d, alpha=%c%c\n", req->initiator,
+                  req->alpha2[0], req->alpha2[1]);
+
+        /* ignore non-ISO3166 country codes */
+        for (i = 0; i < sizeof(req->alpha2); i++)
+                if (req->alpha2[i] < 'A' || req->alpha2[i] > 'Z') {
+                        brcmf_err("not a ISO3166 code\n");
+                        return;
+                }
+        memset(&ccreq, 0, sizeof(ccreq));
+        ccreq.rev = cpu_to_le32(-1);
+        memcpy(ccreq.ccode, req->alpha2, sizeof(req->alpha2));
+        brcmf_fil_iovar_data_set(ifp, "country", &ccreq, sizeof(ccreq));
+}
+
 static void brcmf_free_wiphy(struct wiphy *wiphy)
 {
         kfree(wiphy->iface_combinations);
@@ -5952,6 +6088,7 @@ struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
                 goto priv_out;
 
         brcmf_dbg(INFO, "Registering custom regulatory\n");
+        wiphy->reg_notifier = brcmf_cfg80211_reg_notifier;
         wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
         wiphy_apply_custom_regulatory(wiphy, &brcmf_regdom);
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.h b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.h
index 9e98b8d52757..d9e6d01b2b69 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.h
@@ -75,6 +75,8 @@
 
 #define BRCMF_VNDR_IE_P2PAF_SHIFT       12
 
+#define BRCMF_MAX_DEFAULT_KEYS          4
+
 
 /**
  * enum brcmf_scan_status - scan engine status
@@ -125,11 +127,13 @@ struct brcmf_cfg80211_security {
  * @ssid: ssid of associated/associating ap.
  * @bssid: bssid of joined/joining ibss.
  * @sec: security information.
+ * @key: key information
  */
 struct brcmf_cfg80211_profile {
         struct brcmf_ssid ssid;
         u8 bssid[ETH_ALEN];
         struct brcmf_cfg80211_security sec;
+        struct brcmf_wsec_key key[BRCMF_MAX_DEFAULT_KEYS];
 };
 
 /**
@@ -196,6 +200,7 @@ struct brcmf_cfg80211_vif {
         struct list_head list;
         u16 mgmt_rx_reg;
         bool mbss;
+        int is_11d;
 };
 
 /* association inform */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/chip.c b/drivers/net/wireless/brcm80211/brcmfmac/chip.c
index ddae0b5e56ec..04d2ca0d87d6 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/chip.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/chip.c
@@ -101,14 +101,7 @@
 /* ARM Cortex M3 core, ID 0x82a */
 #define BCM4329_CORE_ARM_BASE           0x18002000
 #define BCM4329_RAMSIZE                 0x48000
-
 /* bcm43143 */
-/* SDIO device core */
-#define BCM43143_CORE_BUS_BASE          0x18002000
-/* internal memory core */
-#define BCM43143_CORE_SOCRAM_BASE       0x18004000
-/* ARM Cortex M3 core, ID 0x82a */
-#define BCM43143_CORE_ARM_BASE          0x18003000
 #define BCM43143_RAMSIZE                0x70000
 
 #define CORE_SB(base, field) \
@@ -164,13 +157,6 @@ struct brcmf_core_priv {
         struct brcmf_chip_priv *chip;
 };
 
-/* ARM CR4 core specific control flag bits */
-#define ARMCR4_BCMA_IOCTL_CPUHALT       0x0020
-
-/* D11 core specific control flag bits */
-#define D11_BCMA_IOCTL_PHYCLOCKEN       0x0004
-#define D11_BCMA_IOCTL_PHYRESET         0x0008
-
 struct brcmf_chip_priv {
         struct brcmf_chip pub;
         const struct brcmf_buscore_ops *ops;
@@ -495,6 +481,7 @@ static void brcmf_chip_get_raminfo(struct brcmf_chip_priv *ci)
                 ci->pub.ramsize = 0x48000;
                 break;
         case BRCM_CC_4334_CHIP_ID:
+        case BRCM_CC_43340_CHIP_ID:
                 ci->pub.ramsize = 0x80000;
                 break;
         case BRCM_CC_4335_CHIP_ID:
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/common.c b/drivers/net/wireless/brcm80211/brcmfmac/common.c
index 1861a13e8d03..fe54844c75e0 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/common.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/common.c
@@ -25,6 +25,9 @@
 #include "fwil.h"
 #include "fwil_types.h"
 #include "tracepoint.h"
+#include "common.h"
+
+const u8 ALLFFMAC[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
 
 #define BRCMF_DEFAULT_BCN_TIMEOUT       3
 #define BRCMF_DEFAULT_SCAN_CHANNEL_TIME 40
@@ -38,6 +41,8 @@ int brcmf_c_preinit_dcmds(struct brcmf_if *ifp)
         s8 eventmask[BRCMF_EVENTING_MASK_LEN];
         u8 buf[BRCMF_DCMD_SMLEN];
         struct brcmf_join_pref_params join_pref_params[2];
+        struct brcmf_rev_info_le revinfo;
+        struct brcmf_rev_info *ri;
         char *ptr;
         s32 err;
 
@@ -45,12 +50,37 @@ int brcmf_c_preinit_dcmds(struct brcmf_if *ifp)
         err = brcmf_fil_iovar_data_get(ifp, "cur_etheraddr", ifp->mac_addr,
                                        sizeof(ifp->mac_addr));
         if (err < 0) {
-                brcmf_err("Retreiving cur_etheraddr failed, %d\n",
-                          err);
+                brcmf_err("Retreiving cur_etheraddr failed, %d\n", err);
                 goto done;
         }
         memcpy(ifp->drvr->mac, ifp->mac_addr, sizeof(ifp->drvr->mac));
 
+        err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_REVINFO,
+                                     &revinfo, sizeof(revinfo));
+        ri = &ifp->drvr->revinfo;
+        if (err < 0) {
+                brcmf_err("retrieving revision info failed, %d\n", err);
+        } else {
+                ri->vendorid = le32_to_cpu(revinfo.vendorid);
+                ri->deviceid = le32_to_cpu(revinfo.deviceid);
+                ri->radiorev = le32_to_cpu(revinfo.radiorev);
+                ri->chiprev = le32_to_cpu(revinfo.chiprev);
+                ri->corerev = le32_to_cpu(revinfo.corerev);
+                ri->boardid = le32_to_cpu(revinfo.boardid);
+                ri->boardvendor = le32_to_cpu(revinfo.boardvendor);
+                ri->boardrev = le32_to_cpu(revinfo.boardrev);
+                ri->driverrev = le32_to_cpu(revinfo.driverrev);
+                ri->ucoderev = le32_to_cpu(revinfo.ucoderev);
+                ri->bus = le32_to_cpu(revinfo.bus);
+                ri->chipnum = le32_to_cpu(revinfo.chipnum);
+                ri->phytype = le32_to_cpu(revinfo.phytype);
+                ri->phyrev = le32_to_cpu(revinfo.phyrev);
+                ri->anarev = le32_to_cpu(revinfo.anarev);
+                ri->chippkg = le32_to_cpu(revinfo.chippkg);
+                ri->nvramrev = le32_to_cpu(revinfo.nvramrev);
+        }
+        ri->result = err;
+
         /* query for 'ver' to get version info from firmware */
         memset(buf, 0, sizeof(buf));
         strcpy(buf, "ver");
diff --git a/drivers/net/wireless/ath/wil6210/wil_platform_msm.h b/drivers/net/wireless/brcm80211/brcmfmac/common.h
index 2f2229edb498..0d39d80cee28 100644
--- a/drivers/net/wireless/ath/wil6210/wil_platform_msm.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/common.h
@@ -1,5 +1,4 @@
-/*
- * Copyright (c) 2014 Qualcomm Atheros, Inc.
+/* Copyright (c) 2014 Broadcom Corporation
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -7,18 +6,15 @@
  *
  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
- * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
- * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
- * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
+#ifndef BRCMFMAC_COMMON_H
+#define BRCMFMAC_COMMON_H
 
-#ifndef __WIL_PLATFORM__MSM_H__
-#define __WIL_PLATFORM_MSM_H__
+extern const u8 ALLFFMAC[ETH_ALEN];
 
-#include "wil_platform.h"
-
-void *wil_platform_msm_init(struct device *dev, struct wil_platform_ops *ops);
-
-#endif /* __WIL_PLATFORM__MSM_H__ */
+#endif /* BRCMFMAC_COMMON_H */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/commonring.h b/drivers/net/wireless/brcm80211/brcmfmac/commonring.h
index 002336e35764..3d404016a92e 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/commonring.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/commonring.h
@@ -37,6 +37,8 @@ struct brcmf_commonring {
         unsigned long flags;
         bool inited;
         bool was_full;
+
+        atomic_t outstanding_tx;
 };
 
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/core.c b/drivers/net/wireless/brcm80211/brcmfmac/core.c
index effe6d7831d9..2d6e2cc1b12c 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
@@ -197,7 +197,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,
         brcmf_dbg(DATA, "Enter, idx=%d\n", ifp->bssidx);
 
         /* Can the device send data? */
-        if (drvr->bus_if->state != BRCMF_BUS_DATA) {
+        if (drvr->bus_if->state != BRCMF_BUS_UP) {
                 brcmf_err("xmit rejected state=%d\n", drvr->bus_if->state);
                 netif_stop_queue(ndev);
                 dev_kfree_skb(skb);
@@ -601,9 +601,12 @@ static void brcmf_ethtool_get_drvinfo(struct net_device *ndev,
 {
         struct brcmf_if *ifp = netdev_priv(ndev);
         struct brcmf_pub *drvr = ifp->drvr;
+        char drev[BRCMU_DOTREV_LEN] = "n/a";
 
+        if (drvr->revinfo.result == 0)
+                brcmu_dotrev_str(drvr->revinfo.driverrev, drev);
         strlcpy(info->driver, KBUILD_MODNAME, sizeof(info->driver));
-        snprintf(info->version, sizeof(info->version), "n/a");
+        strlcpy(info->version, drev, sizeof(info->version));
         strlcpy(info->fw_version, drvr->fwver, sizeof(info->fw_version));
         strlcpy(info->bus_info, dev_name(drvr->bus_if->dev),
                 sizeof(info->bus_info));
@@ -637,7 +640,7 @@ static int brcmf_netdev_open(struct net_device *ndev)
         brcmf_dbg(TRACE, "Enter, idx=%d\n", ifp->bssidx);
 
         /* If bus is not ready, can't continue */
-        if (bus_if->state != BRCMF_BUS_DATA) {
+        if (bus_if->state != BRCMF_BUS_UP) {
                 brcmf_err("failed bus is not ready\n");
                 return -EAGAIN;
         }
@@ -964,13 +967,20 @@ int brcmf_bus_start(struct device *dev)
                 p2p_ifp = NULL;
 
         /* signal bus ready */
-        brcmf_bus_change_state(bus_if, BRCMF_BUS_DATA);
+        brcmf_bus_change_state(bus_if, BRCMF_BUS_UP);
 
         /* Bus is ready, do any initialization */
         ret = brcmf_c_preinit_dcmds(ifp);
         if (ret < 0)
                 goto fail;
 
+        /* assure we have chipid before feature attach */
+        if (!bus_if->chip) {
+                bus_if->chip = drvr->revinfo.chipnum;
+                bus_if->chiprev = drvr->revinfo.chiprev;
+                brcmf_dbg(INFO, "firmware revinfo: chip %x (%d) rev %d\n",
+                          bus_if->chip, bus_if->chip, bus_if->chiprev);
+        }
         brcmf_feat_attach(drvr);
 
         ret = brcmf_fws_init(drvr);
@@ -1093,9 +1103,8 @@ static int brcmf_get_pend_8021x_cnt(struct brcmf_if *ifp)
         return atomic_read(&ifp->pend_8021x_cnt);
 }
 
-int brcmf_netdev_wait_pend8021x(struct net_device *ndev)
+int brcmf_netdev_wait_pend8021x(struct brcmf_if *ifp)
 {
-        struct brcmf_if *ifp = netdev_priv(ndev);
         int err;
 
         err = wait_event_timeout(ifp->pend_8021x_wait,
@@ -1107,6 +1116,27 @@ int brcmf_netdev_wait_pend8021x(struct net_device *ndev)
         return !err;
 }
 
+void brcmf_bus_change_state(struct brcmf_bus *bus, enum brcmf_bus_state state)
+{
+        struct brcmf_pub *drvr = bus->drvr;
+        struct net_device *ndev;
+        int ifidx;
+
+        brcmf_dbg(TRACE, "%d -> %d\n", bus->state, state);
+        bus->state = state;
+
+        if (state == BRCMF_BUS_UP) {
+                for (ifidx = 0; ifidx < BRCMF_MAX_IFS; ifidx++) {
+                        if ((drvr->iflist[ifidx]) &&
+                            (drvr->iflist[ifidx]->ndev)) {
+                                ndev = drvr->iflist[ifidx]->ndev;
+                                if (netif_queue_stopped(ndev))
+                                        netif_wake_queue(ndev);
+                        }
+                }
+        }
+}
+
 static void brcmf_driver_register(struct work_struct *work)
 {
 #ifdef CONFIG_BRCMFMAC_SDIO
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/core.h b/drivers/net/wireless/brcm80211/brcmfmac/core.h
index 23f74b139cc8..fd74a9c6e9ac 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/core.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.h
@@ -29,8 +29,6 @@
 /* For supporting multiple interfaces */
 #define BRCMF_MAX_IFS   16
 
-#define DOT11_MAX_DEFAULT_KEYS  4
-
 /* Small, medium and maximum buffer size for dcmd
  */
 #define BRCMF_DCMD_SMLEN        256
@@ -73,6 +71,35 @@ struct brcmf_proto;	/* device communication protocol info */
 struct brcmf_cfg80211_dev; /* cfg80211 device info */
 struct brcmf_fws_info; /* firmware signalling info */
 
+/*
+ * struct brcmf_rev_info
+ *
+ * The result field stores the error code of the
+ * revision info request from firmware. For the
+ * other fields see struct brcmf_rev_info_le in
+ * fwil_types.h
+ */
+struct brcmf_rev_info {
+        int result;
+        u32 vendorid;
+        u32 deviceid;
+        u32 radiorev;
+        u32 chiprev;
+        u32 corerev;
+        u32 boardid;
+        u32 boardvendor;
+        u32 boardrev;
+        u32 driverrev;
+        u32 ucoderev;
+        u32 bus;
+        u32 chipnum;
+        u32 phytype;
+        u32 phyrev;
+        u32 anarev;
+        u32 chippkg;
+        u32 nvramrev;
+};
+
 /* Common structure for module and instance linkage */
 struct brcmf_pub {
         /* Linkage ponters */
@@ -106,6 +133,7 @@ struct brcmf_pub {
         u32 feat_flags;
         u32 chip_quirks;
 
+        struct brcmf_rev_info revinfo;
 #ifdef DEBUG
         struct dentry *dbgfs_dir;
 #endif
@@ -167,7 +195,7 @@ struct brcmf_skb_reorder_data {
         u8 *reorder;
 };
 
-int brcmf_netdev_wait_pend8021x(struct net_device *ndev);
+int brcmf_netdev_wait_pend8021x(struct brcmf_if *ifp);
 
 /* Return pointer to interface name */
 char *brcmf_ifname(struct brcmf_pub *drvr, int idx);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/firmware.c b/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
index 1ff787d1a36b..9cb99152ad17 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/firmware.c
@@ -103,7 +103,11 @@ static enum nvram_parser_state brcmf_nvram_handle_key(struct nvram_parser *nvp)
 
         c = nvp->fwnv->data[nvp->pos];
         if (c == '=') {
-                st = VALUE;
+                /* ignore RAW1 by treating as comment */
+                if (strncmp(&nvp->fwnv->data[nvp->entry], "RAW1", 4) == 0)
+                        st = COMMENT;
+                else
+                        st = VALUE;
         } else if (!is_nvram_char(c)) {
                 brcmf_dbg(INFO, "warning: ln=%d:col=%d: '=' expected, skip invalid key entry\n",
                           nvp->line, nvp->column);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/flowring.c b/drivers/net/wireless/brcm80211/brcmfmac/flowring.c
index 44f3a84d1999..910fbb561469 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/flowring.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/flowring.c
@@ -25,6 +25,7 @@
 #include "proto.h"
 #include "flowring.h"
 #include "msgbuf.h"
+#include "common.h"
 
 
 #define BRCMF_FLOWRING_HIGH             1024
@@ -34,9 +35,6 @@
 #define BRCMF_FLOWRING_HASH_AP(da, fifo, ifidx) (da[5] + fifo + ifidx * 16)
 #define BRCMF_FLOWRING_HASH_STA(fifo, ifidx) (fifo + ifidx * 16)
 
-static const u8 ALLZEROMAC[ETH_ALEN] = { 0, 0, 0, 0, 0, 0 };
-static const u8 ALLFFMAC[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
-
 static const u8 brcmf_flowring_prio2fifo[] = {
         1,
         0,
@@ -137,7 +135,7 @@ u32 brcmf_flowring_create(struct brcmf_flowring *flow, u8 da[ETH_ALEN],
         hash = flow->hash;
         for (i = 0; i < BRCMF_FLOWRING_HASHSIZE; i++) {
                 if ((hash[hash_idx].ifidx == BRCMF_FLOWRING_INVALID_IFIDX) &&
-                    (memcmp(hash[hash_idx].mac, ALLZEROMAC, ETH_ALEN) == 0)) {
+                    (is_zero_ether_addr(hash[hash_idx].mac))) {
                         found = true;
                         break;
                 }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwil.c b/drivers/net/wireless/brcm80211/brcmfmac/fwil.c
index 03f2c406a17b..dcfa0bb149ce 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fwil.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwil.c
@@ -109,7 +109,7 @@ brcmf_fil_cmd_data(struct brcmf_if *ifp, u32 cmd, void *data, u32 len, bool set)
         struct brcmf_pub *drvr = ifp->drvr;
         s32 err;
 
-        if (drvr->bus_if->state != BRCMF_BUS_DATA) {
+        if (drvr->bus_if->state != BRCMF_BUS_UP) {
                 brcmf_err("bus is down. we have nothing to do.\n");
                 return -EIO;
         }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwil.h b/drivers/net/wireless/brcm80211/brcmfmac/fwil.h
index a30be683f4a1..5434dcf64f7d 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fwil.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwil.h
@@ -43,6 +43,8 @@
 #define BRCMF_C_SET_RADIO                       38
 #define BRCMF_C_GET_PHYTYPE                     39
 #define BRCMF_C_SET_KEY                         45
+#define BRCMF_C_GET_REGULATORY                  46
+#define BRCMF_C_SET_REGULATORY                  47
 #define BRCMF_C_SET_PASSIVE_SCAN                49
 #define BRCMF_C_SCAN                            50
 #define BRCMF_C_SCAN_RESULTS                    51
@@ -57,9 +59,12 @@
 #define BRCMF_C_SET_COUNTRY                     84
 #define BRCMF_C_GET_PM                          85
 #define BRCMF_C_SET_PM                          86
+#define BRCMF_C_GET_REVINFO                     98
 #define BRCMF_C_GET_CURR_RATESET                114
 #define BRCMF_C_GET_AP                          117
 #define BRCMF_C_SET_AP                          118
+#define BRCMF_C_SET_SCB_AUTHORIZE               121
+#define BRCMF_C_SET_SCB_DEAUTHORIZE             122
 #define BRCMF_C_GET_RSSI                        127
 #define BRCMF_C_GET_WSEC                        133
 #define BRCMF_C_SET_WSEC                        134
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h b/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
index 50891c02c4c1..374920965108 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
@@ -112,6 +112,7 @@
 #define BRCMF_WOWL_MAXPATTERNS          8
 #define BRCMF_WOWL_MAXPATTERNSIZE       128
 
+#define BRCMF_COUNTRY_BUF_SZ            4
 
 /* join preference types for join_pref iovar */
 enum brcmf_join_pref_types {
@@ -525,4 +526,58 @@ struct brcmf_mbss_ssid_le {
         unsigned char SSID[32];
 };
 
+/**
+ * struct brcmf_fil_country_le - country configuration structure.
+ *
+ * @country_abbrev: null-terminated country code used in the country IE.
+ * @rev: revision specifier for ccode. on set, -1 indicates unspecified.
+ * @ccode: null-terminated built-in country code.
+ */
+struct brcmf_fil_country_le {
+        char country_abbrev[BRCMF_COUNTRY_BUF_SZ];
+        __le32 rev;
+        char ccode[BRCMF_COUNTRY_BUF_SZ];
+};
+
+/**
+ * struct brcmf_rev_info_le - device revision info.
+ *
+ * @vendorid: PCI vendor id.
+ * @deviceid: device id of chip.
+ * @radiorev: radio revision.
+ * @chiprev: chip revision.
+ * @corerev: core revision.
+ * @boardid: board identifier (usu. PCI sub-device id).
+ * @boardvendor: board vendor (usu. PCI sub-vendor id).
+ * @boardrev: board revision.
+ * @driverrev: driver version.
+ * @ucoderev: microcode version.
+ * @bus: bus type.
+ * @chipnum: chip number.
+ * @phytype: phy type.
+ * @phyrev: phy revision.
+ * @anarev: anacore rev.
+ * @chippkg: chip package info.
+ * @nvramrev: nvram revision number.
+ */
+struct brcmf_rev_info_le {
+        __le32 vendorid;
+        __le32 deviceid;
+        __le32 radiorev;
+        __le32 chiprev;
+        __le32 corerev;
+        __le32 boardid;
+        __le32 boardvendor;
+        __le32 boardrev;
+        __le32 driverrev;
+        __le32 ucoderev;
+        __le32 bus;
+        __le32 chipnum;
+        __le32 phytype;
+        __le32 phyrev;
+        __le32 anarev;
+        __le32 chippkg;
+        __le32 nvramrev;
+};
+
 #endif /* FWIL_TYPES_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
index 456944a6a2db..6262612dec45 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
@@ -73,6 +73,8 @@
 #define BRCMF_MSGBUF_TX_FLUSH_CNT1              32
 #define BRCMF_MSGBUF_TX_FLUSH_CNT2              96
 
+#define BRCMF_MSGBUF_DELAY_TXWORKER_THRS        64
+#define BRCMF_MSGBUF_TRICKLE_TXWORKER_THRS      32
 
 struct msgbuf_common_hdr {
         u8                              msgtype;
@@ -583,7 +585,7 @@ brcmf_msgbuf_flowring_create_worker(struct brcmf_msgbuf *msgbuf,
         u32 flowid;
         void *dma_buf;
         u32 dma_sz;
-        long long address;
+        u64 address;
         int err;
 
         flowid = work->flowid;
@@ -620,7 +622,7 @@ brcmf_msgbuf_flowring_create_worker(struct brcmf_msgbuf *msgbuf,
                                            BRCMF_NROF_H2D_COMMON_MSGRINGS);
         memcpy(create->sa, work->sa, ETH_ALEN);
         memcpy(create->da, work->da, ETH_ALEN);
-        address = (long long)(long)msgbuf->flowring_dma_handle[flowid];
+        address = (u64)msgbuf->flowring_dma_handle[flowid];
         create->flow_ring_addr.high_addr = cpu_to_le32(address >> 32);
         create->flow_ring_addr.low_addr = cpu_to_le32(address & 0xffffffff);
         create->max_items = cpu_to_le16(BRCMF_H2D_TXFLOWRING_MAX_ITEM);
@@ -698,7 +700,7 @@ static void brcmf_msgbuf_txflow(struct brcmf_msgbuf *msgbuf, u8 flowid)
         dma_addr_t physaddr;
         u32 pktid;
         struct msgbuf_tx_msghdr *tx_msghdr;
-        long long address;
+        u64 address;
 
         commonring = msgbuf->flowrings[flowid];
         if (!brcmf_commonring_write_available(commonring))
@@ -742,13 +744,14 @@ static void brcmf_msgbuf_txflow(struct brcmf_msgbuf *msgbuf, u8 flowid)
                 tx_msghdr->seg_cnt = 1;
                 memcpy(tx_msghdr->txhdr, skb->data, ETH_HLEN);
                 tx_msghdr->data_len = cpu_to_le16(skb->len - ETH_HLEN);
-                address = (long long)(long)physaddr;
+                address = (u64)physaddr;
                 tx_msghdr->data_buf_addr.high_addr = cpu_to_le32(address >> 32);
                 tx_msghdr->data_buf_addr.low_addr =
                         cpu_to_le32(address & 0xffffffff);
                 tx_msghdr->metadata_buf_len = 0;
                 tx_msghdr->metadata_buf_addr.high_addr = 0;
                 tx_msghdr->metadata_buf_addr.low_addr = 0;
+                atomic_inc(&commonring->outstanding_tx);
                 if (count >= BRCMF_MSGBUF_TX_FLUSH_CNT2) {
                         brcmf_commonring_write_complete(commonring);
                         count = 0;
@@ -773,10 +776,16 @@ static void brcmf_msgbuf_txflow_worker(struct work_struct *worker)
 }
 
 
-static int brcmf_msgbuf_schedule_txdata(struct brcmf_msgbuf *msgbuf, u32 flowid)
+static int brcmf_msgbuf_schedule_txdata(struct brcmf_msgbuf *msgbuf, u32 flowid,
+                                        bool force)
 {
+        struct brcmf_commonring *commonring;
+
         set_bit(flowid, msgbuf->flow_map);
-        queue_work(msgbuf->txflow_wq, &msgbuf->txflow_work);
+        commonring = msgbuf->flowrings[flowid];
+        if ((force) || (atomic_read(&commonring->outstanding_tx) <
+                        BRCMF_MSGBUF_DELAY_TXWORKER_THRS))
+                queue_work(msgbuf->txflow_wq, &msgbuf->txflow_work);
 
         return 0;
 }
@@ -797,7 +806,7 @@ static int brcmf_msgbuf_txdata(struct brcmf_pub *drvr, int ifidx,
                         return -ENOMEM;
         }
         brcmf_flowring_enqueue(flow, flowid, skb);
-        brcmf_msgbuf_schedule_txdata(msgbuf, flowid);
+        brcmf_msgbuf_schedule_txdata(msgbuf, flowid, false);
 
         return 0;
 }
@@ -854,6 +863,7 @@ brcmf_msgbuf_process_ioctl_complete(struct brcmf_msgbuf *msgbuf, void *buf)
 static void
 brcmf_msgbuf_process_txstatus(struct brcmf_msgbuf *msgbuf, void *buf)
 {
+        struct brcmf_commonring *commonring;
         struct msgbuf_tx_status *tx_status;
         u32 idx;
         struct sk_buff *skb;
@@ -871,6 +881,8 @@ brcmf_msgbuf_process_txstatus(struct brcmf_msgbuf *msgbuf, void *buf)
         }
 
         set_bit(flowid, msgbuf->txstatus_done_map);
+        commonring = msgbuf->flowrings[flowid];
+        atomic_dec(&commonring->outstanding_tx);
 
         brcmf_txfinalize(msgbuf->drvr, skb, tx_status->msg.ifidx, true);
 }
@@ -885,7 +897,7 @@ static u32 brcmf_msgbuf_rxbuf_data_post(struct brcmf_msgbuf *msgbuf, u32 count)
         u32 pktlen;
         dma_addr_t physaddr;
         struct msgbuf_rx_bufpost *rx_bufpost;
-        long long address;
+        u64 address;
         u32 pktid;
         u32 i;
 
@@ -894,7 +906,7 @@ static u32 brcmf_msgbuf_rxbuf_data_post(struct brcmf_msgbuf *msgbuf, u32 count)
                                                               count,
                                                               &alloced);
         if (!ret_ptr) {
-                brcmf_err("Failed to reserve space in commonring\n");
+                brcmf_dbg(MSGBUF, "Failed to reserve space in commonring\n");
                 return 0;
         }
 
@@ -921,7 +933,7 @@ static u32 brcmf_msgbuf_rxbuf_data_post(struct brcmf_msgbuf *msgbuf, u32 count)
                 }
 
                 if (msgbuf->rx_metadata_offset) {
-                        address = (long long)(long)physaddr;
+                        address = (u64)physaddr;
                         rx_bufpost->metadata_buf_len =
                                 cpu_to_le16(msgbuf->rx_metadata_offset);
                         rx_bufpost->metadata_buf_addr.high_addr =
@@ -936,7 +948,7 @@ static u32 brcmf_msgbuf_rxbuf_data_post(struct brcmf_msgbuf *msgbuf, u32 count)
                 rx_bufpost->msg.msgtype = MSGBUF_TYPE_RXBUF_POST;
                 rx_bufpost->msg.request_id = cpu_to_le32(pktid);
 
-                address = (long long)(long)physaddr;
+                address = (u64)physaddr;
                 rx_bufpost->data_buf_len = cpu_to_le16((u16)pktlen);
                 rx_bufpost->data_buf_addr.high_addr =
                         cpu_to_le32(address >> 32);
@@ -992,7 +1004,7 @@ brcmf_msgbuf_rxbuf_ctrl_post(struct brcmf_msgbuf *msgbuf, bool event_buf,
         u32 pktlen;
         dma_addr_t physaddr;
         struct msgbuf_rx_ioctl_resp_or_event *rx_bufpost;
-        long long address;
+        u64 address;
         u32 pktid;
         u32 i;
 
@@ -1035,7 +1047,7 @@ brcmf_msgbuf_rxbuf_ctrl_post(struct brcmf_msgbuf *msgbuf, bool event_buf,
                                 MSGBUF_TYPE_IOCTLRESP_BUF_POST;
                 rx_bufpost->msg.request_id = cpu_to_le32(pktid);
 
-                address = (long long)(long)physaddr;
+                address = (u64)physaddr;
                 rx_bufpost->host_buf_len = cpu_to_le16((u16)pktlen);
                 rx_bufpost->host_buf_addr.high_addr =
                         cpu_to_le32(address >> 32);
@@ -1181,7 +1193,7 @@ brcmf_msgbuf_process_flow_ring_create_response(struct brcmf_msgbuf *msgbuf,
 
         brcmf_flowring_open(msgbuf->flow, flowid);
 
-        brcmf_msgbuf_schedule_txdata(msgbuf, flowid);
+        brcmf_msgbuf_schedule_txdata(msgbuf, flowid, true);
 }
 
 
@@ -1280,8 +1292,10 @@ int brcmf_proto_msgbuf_rx_trigger(struct device *dev)
         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
         struct brcmf_pub *drvr = bus_if->drvr;
         struct brcmf_msgbuf *msgbuf = (struct brcmf_msgbuf *)drvr->proto->pd;
+        struct brcmf_commonring *commonring;
         void *buf;
         u32 flowid;
+        int qlen;
 
         buf = msgbuf->commonrings[BRCMF_D2H_MSGRING_RX_COMPLETE];
         brcmf_msgbuf_process_rx(msgbuf, buf);
@@ -1293,8 +1307,12 @@ int brcmf_proto_msgbuf_rx_trigger(struct device *dev)
         for_each_set_bit(flowid, msgbuf->txstatus_done_map,
                          msgbuf->nrof_flowrings) {
                 clear_bit(flowid, msgbuf->txstatus_done_map);
-                if (brcmf_flowring_qlen(msgbuf->flow, flowid))
-                        brcmf_msgbuf_schedule_txdata(msgbuf, flowid);
+                commonring = msgbuf->flowrings[flowid];
+                qlen = brcmf_flowring_qlen(msgbuf->flow, flowid);
+                if ((qlen > BRCMF_MSGBUF_TRICKLE_TXWORKER_THRS) ||
+                    ((qlen) && (atomic_read(&commonring->outstanding_tx) <
+                                BRCMF_MSGBUF_TRICKLE_TXWORKER_THRS)))
+                        brcmf_msgbuf_schedule_txdata(msgbuf, flowid, true);
         }
 
         return 0;
@@ -1348,7 +1366,7 @@ int brcmf_proto_msgbuf_attach(struct brcmf_pub *drvr)
 {
         struct brcmf_bus_msgbuf *if_msgbuf;
         struct brcmf_msgbuf *msgbuf;
-        long long address;
+        u64 address;
         u32 count;
 
         if_msgbuf = drvr->bus_if->msgbuf;
@@ -1379,7 +1397,7 @@ int brcmf_proto_msgbuf_attach(struct brcmf_pub *drvr)
                                              GFP_KERNEL);
         if (!msgbuf->ioctbuf)
                 goto fail;
-        address = (long long)(long)msgbuf->ioctbuf_handle;
+        address = (u64)msgbuf->ioctbuf_handle;
         msgbuf->ioctbuf_phys_hi = address >> 32;
         msgbuf->ioctbuf_phys_lo = address & 0xffffffff;
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
index 905991fdb7b1..61c053a729be 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
@@ -959,14 +959,14 @@ brcmf_pcie_init_dmabuffer_for_device(struct brcmf_pciedev_info *devinfo,
                                      dma_addr_t *dma_handle)
 {
         void *ring;
-        long long address;
+        u64 address;
 
         ring = dma_alloc_coherent(&devinfo->pdev->dev, size, dma_handle,
                                   GFP_KERNEL);
         if (!ring)
                 return NULL;
 
-        address = (long long)(long)*dma_handle;
+        address = (u64)*dma_handle;
         brcmf_pcie_write_tcm32(devinfo, tcm_dma_phys_addr,
                                address & 0xffffffff);
         brcmf_pcie_write_tcm32(devinfo, tcm_dma_phys_addr + 4, address >> 32);
@@ -1166,7 +1166,7 @@ brcmf_pcie_release_scratchbuffers(struct brcmf_pciedev_info *devinfo)
 
 static int brcmf_pcie_init_scratchbuffers(struct brcmf_pciedev_info *devinfo)
 {
-        long long address;
+        u64 address;
         u32 addr;
 
         devinfo->shared.scratch = dma_alloc_coherent(&devinfo->pdev->dev,
@@ -1180,7 +1180,7 @@ static int brcmf_pcie_init_scratchbuffers(struct brcmf_pciedev_info *devinfo)
 
         addr = devinfo->shared.tcm_base_address +
                BRCMF_SHARED_DMA_SCRATCH_ADDR_OFFSET;
-        address = (long long)(long)devinfo->shared.scratch_dmahandle;
+        address = (u64)devinfo->shared.scratch_dmahandle;
         brcmf_pcie_write_tcm32(devinfo, addr, address & 0xffffffff);
         brcmf_pcie_write_tcm32(devinfo, addr + 4, address >> 32);
         addr = devinfo->shared.tcm_base_address +
@@ -1198,7 +1198,7 @@ static int brcmf_pcie_init_scratchbuffers(struct brcmf_pciedev_info *devinfo)
 
         addr = devinfo->shared.tcm_base_address +
                BRCMF_SHARED_DMA_RINGUPD_ADDR_OFFSET;
-        address = (long long)(long)devinfo->shared.ringupd_dmahandle;
+        address = (u64)devinfo->shared.ringupd_dmahandle;
         brcmf_pcie_write_tcm32(devinfo, addr, address & 0xffffffff);
         brcmf_pcie_write_tcm32(devinfo, addr + 4, address >> 32);
         addr = devinfo->shared.tcm_base_address +
@@ -1828,7 +1828,7 @@ static int brcmf_pcie_resume(struct pci_dev *pdev)
                                 goto cleanup;
                         brcmf_dbg(PCIE, "Hot resume, continue....\n");
                         brcmf_pcie_select_core(devinfo, BCMA_CORE_PCIE2);
-                        brcmf_bus_change_state(bus, BRCMF_BUS_DATA);
+                        brcmf_bus_change_state(bus, BRCMF_BUS_UP);
                         brcmf_pcie_intr_enable(devinfo);
                         return 0;
                 }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
index 0b0d51a61060..faec35c899ec 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio.c
@@ -44,7 +44,8 @@
 #include "chip.h"
 #include "firmware.h"
 
-#define DCMD_RESP_TIMEOUT  2000 /* In milli second */
+#define DCMD_RESP_TIMEOUT       2000    /* In milli second */
+#define CTL_DONE_TIMEOUT        2000    /* In milli second */
 
 #ifdef DEBUG
 
@@ -495,9 +496,9 @@ struct brcmf_sdio {
         u8 *ctrl_frame_buf;
         u16 ctrl_frame_len;
         bool ctrl_frame_stat;
+        int ctrl_frame_err;
 
         spinlock_t txq_lock;            /* protect bus->txq */
-        struct semaphore tx_seq_lock;   /* protect bus->tx_seq */
         wait_queue_head_t ctrl_wait;
         wait_queue_head_t dcmd_resp_wait;
 
@@ -514,7 +515,6 @@ struct brcmf_sdio {
         bool txoff;             /* Transmit flow-controlled */
         struct brcmf_sdio_count sdcnt;
         bool sr_enabled; /* SaveRestore enabled */
-        bool sleeping; /* SDIO bus sleeping */
 
         u8 tx_hdrlen;           /* sdio bus header length for tx packet */
         bool txglom;            /* host tx glomming enable flag */
@@ -608,6 +608,8 @@ static const struct sdiod_drive_str sdiod_drvstr_tab2_3v3[] = {
 #define BCM4330_NVRAM_NAME              "brcm/brcmfmac4330-sdio.txt"
 #define BCM4334_FIRMWARE_NAME           "brcm/brcmfmac4334-sdio.bin"
 #define BCM4334_NVRAM_NAME              "brcm/brcmfmac4334-sdio.txt"
+#define BCM43340_FIRMWARE_NAME          "brcm/brcmfmac43340-sdio.bin"
+#define BCM43340_NVRAM_NAME             "brcm/brcmfmac43340-sdio.txt"
 #define BCM4335_FIRMWARE_NAME           "brcm/brcmfmac4335-sdio.bin"
 #define BCM4335_NVRAM_NAME              "brcm/brcmfmac4335-sdio.txt"
 #define BCM43362_FIRMWARE_NAME          "brcm/brcmfmac43362-sdio.bin"
@@ -629,6 +631,8 @@ MODULE_FIRMWARE(BCM4330_FIRMWARE_NAME);
 MODULE_FIRMWARE(BCM4330_NVRAM_NAME);
 MODULE_FIRMWARE(BCM4334_FIRMWARE_NAME);
 MODULE_FIRMWARE(BCM4334_NVRAM_NAME);
+MODULE_FIRMWARE(BCM43340_FIRMWARE_NAME);
+MODULE_FIRMWARE(BCM43340_NVRAM_NAME);
 MODULE_FIRMWARE(BCM4335_FIRMWARE_NAME);
 MODULE_FIRMWARE(BCM4335_NVRAM_NAME);
 MODULE_FIRMWARE(BCM43362_FIRMWARE_NAME);
@@ -660,6 +664,7 @@ static const struct brcmf_firmware_names brcmf_fwname_data[] = {
         { BRCM_CC_4329_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4329) },
         { BRCM_CC_4330_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4330) },
         { BRCM_CC_4334_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4334) },
+        { BRCM_CC_43340_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM43340) },
         { BRCM_CC_4335_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4335) },
         { BRCM_CC_43362_CHIP_ID, 0xFFFFFFFE, BRCMF_FIRMWARE_NVRAM(BCM43362) },
         { BRCM_CC_4339_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4339) },
@@ -1008,12 +1013,12 @@ brcmf_sdio_bus_sleep(struct brcmf_sdio *bus, bool sleep, bool pendok)
 
         brcmf_dbg(SDIO, "Enter: request %s currently %s\n",
                   (sleep ? "SLEEP" : "WAKE"),
-                  (bus->sleeping ? "SLEEP" : "WAKE"));
+                  (bus->sdiodev->sleeping ? "SLEEP" : "WAKE"));
 
         /* If SR is enabled control bus state with KSO */
         if (bus->sr_enabled) {
                 /* Done if we're already in the requested state */
-                if (sleep == bus->sleeping)
+                if (sleep == bus->sdiodev->sleeping)
                         goto end;
 
                 /* Going to sleep */
@@ -1045,12 +1050,7 @@ brcmf_sdio_bus_sleep(struct brcmf_sdio *bus, bool sleep, bool pendok)
                         bus->idlecount = 0;
                         err = brcmf_sdio_kso_control(bus, true);
                 }
-                if (!err) {
-                        /* Change state */
-                        bus->sleeping = sleep;
-                        brcmf_dbg(SDIO, "new state %s\n",
-                                  (sleep ? "SLEEP" : "WAKE"));
-                } else {
+                if (err) {
                         brcmf_err("error while changing bus sleep state %d\n",
                                   err);
                         goto done;
@@ -1065,6 +1065,11 @@ end:
         } else {
                 brcmf_sdio_clkctl(bus, CLK_AVAIL, pendok);
         }
+        bus->sdiodev->sleeping = sleep;
+        if (sleep)
+                wake_up(&bus->sdiodev->idle_wait);
+        brcmf_dbg(SDIO, "new state %s\n",
+                  (sleep ? "SLEEP" : "WAKE"));
 done:
         brcmf_dbg(SDIO, "Exit: err=%d\n", err);
         return err;
@@ -1904,7 +1909,7 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
         bus->rxpending = true;
 
         for (rd->seq_num = bus->rx_seq, rxleft = maxframes;
-             !bus->rxskip && rxleft && brcmf_bus_ready(bus->sdiodev->bus_if);
+             !bus->rxskip && rxleft && bus->sdiodev->state == BRCMF_STATE_DATA;
              rd->seq_num++, rxleft--) {
 
                 /* Handle glomming separately */
@@ -2371,8 +2376,6 @@ static uint brcmf_sdio_sendfromq(struct brcmf_sdio *bus, uint maxframes)
         /* Send frames until the limit or some other event */
         for (cnt = 0; (cnt < maxframes) && data_ok(bus);) {
                 pkt_num = 1;
-                if (down_interruptible(&bus->tx_seq_lock))
-                        return cnt;
                 if (bus->txglom)
                         pkt_num = min_t(u8, bus->tx_max - bus->tx_seq,
                                         bus->sdiodev->txglomsz);
@@ -2388,13 +2391,10 @@ static uint brcmf_sdio_sendfromq(struct brcmf_sdio *bus, uint maxframes)
                         __skb_queue_tail(&pktq, pkt);
                 }
                 spin_unlock_bh(&bus->txq_lock);
-                if (i == 0) {
-                        up(&bus->tx_seq_lock);
+                if (i == 0)
                         break;
-                }
 
                 ret = brcmf_sdio_txpkt(bus, &pktq, SDPCM_DATA_CHANNEL);
-                up(&bus->tx_seq_lock);
 
                 cnt += i;
 
@@ -2415,7 +2415,7 @@ static uint brcmf_sdio_sendfromq(struct brcmf_sdio *bus, uint maxframes)
         }
 
         /* Deflow-control stack if needed */
-        if ((bus->sdiodev->bus_if->state == BRCMF_BUS_DATA) &&
+        if ((bus->sdiodev->state == BRCMF_STATE_DATA) &&
             bus->txoff && (pktq_len(&bus->txq) < TXLOW)) {
                 bus->txoff = false;
                 brcmf_txflowblock(bus->sdiodev->dev, false);
@@ -2503,7 +2503,7 @@ static void brcmf_sdio_bus_stop(struct device *dev)
                 bus->watchdog_tsk = NULL;
         }
 
-        if (bus_if->state == BRCMF_BUS_DOWN) {
+        if (sdiodev->state != BRCMF_STATE_NOMEDIUM) {
                 sdio_claim_host(sdiodev->func[1]);
 
                 /* Enable clock for device interrupts */
@@ -2538,8 +2538,7 @@ static void brcmf_sdio_bus_stop(struct device *dev)
         brcmu_pktq_flush(&bus->txq, true, NULL, NULL);
 
         /* Clear any held glomming stuff */
-        if (bus->glomd)
-                brcmu_pkt_buf_free_skb(bus->glomd);
+        brcmu_pkt_buf_free_skb(bus->glomd);
         brcmf_sdio_free_glom(bus);
 
         /* Clear rx control and wake any waiters */
@@ -2604,6 +2603,21 @@ static int brcmf_sdio_intr_rstatus(struct brcmf_sdio *bus)
         return ret;
 }
 
+static int brcmf_sdio_pm_resume_wait(struct brcmf_sdio_dev *sdiodev)
+{
+#ifdef CONFIG_PM_SLEEP
+        int retry;
+
+        /* Wait for possible resume to complete */
+        retry = 0;
+        while ((atomic_read(&sdiodev->suspend)) && (retry++ != 50))
+                msleep(20);
+        if (atomic_read(&sdiodev->suspend))
+                return -EIO;
+#endif
+        return 0;
+}
+
 static void brcmf_sdio_dpc(struct brcmf_sdio *bus)
 {
         u32 newstatus = 0;
@@ -2614,6 +2628,9 @@ static void brcmf_sdio_dpc(struct brcmf_sdio *bus)
 
         brcmf_dbg(TRACE, "Enter\n");
 
+        if (brcmf_sdio_pm_resume_wait(bus->sdiodev))
+                return;
+
         sdio_claim_host(bus->sdiodev->func[1]);
 
         /* If waiting for HTAVAIL, check status */
@@ -2720,17 +2737,14 @@ static void brcmf_sdio_dpc(struct brcmf_sdio *bus)
         brcmf_sdio_clrintr(bus);
 
         if (bus->ctrl_frame_stat && (bus->clkstate == CLK_AVAIL) &&
-            (down_interruptible(&bus->tx_seq_lock) == 0)) {
-                if (data_ok(bus)) {
-                        sdio_claim_host(bus->sdiodev->func[1]);
-                        err = brcmf_sdio_tx_ctrlframe(bus,  bus->ctrl_frame_buf,
-                                                      bus->ctrl_frame_len);
-                        sdio_release_host(bus->sdiodev->func[1]);
-
-                        bus->ctrl_frame_stat = false;
-                        brcmf_sdio_wait_event_wakeup(bus);
-                }
-                up(&bus->tx_seq_lock);
+            data_ok(bus)) {
+                sdio_claim_host(bus->sdiodev->func[1]);
+                err = brcmf_sdio_tx_ctrlframe(bus,  bus->ctrl_frame_buf,
+                                              bus->ctrl_frame_len);
+                sdio_release_host(bus->sdiodev->func[1]);
+                bus->ctrl_frame_err = err;
+                bus->ctrl_frame_stat = false;
+                brcmf_sdio_wait_event_wakeup(bus);
         }
         /* Send queued frames (limit 1 if rx may still be pending) */
         if ((bus->clkstate == CLK_AVAIL) && !atomic_read(&bus->fcstate) &&
@@ -2741,7 +2755,7 @@ static void brcmf_sdio_dpc(struct brcmf_sdio *bus)
                 brcmf_sdio_sendfromq(bus, framecnt);
         }
 
-        if (!brcmf_bus_ready(bus->sdiodev->bus_if) || (err != 0)) {
+        if ((bus->sdiodev->state != BRCMF_STATE_DATA) || (err != 0)) {
                 brcmf_err("failed backplane access over SDIO, halting operation\n");
                 atomic_set(&bus->intstatus, 0);
         } else if (atomic_read(&bus->intstatus) ||
@@ -2942,43 +2956,30 @@ brcmf_sdio_bus_txctl(struct device *dev, unsigned char *msg, uint msglen)
         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
         struct brcmf_sdio *bus = sdiodev->bus;
-        int ret = -1;
+        int ret;
 
         brcmf_dbg(TRACE, "Enter\n");
 
-        if (down_interruptible(&bus->tx_seq_lock))
-                return -EINTR;
-
-        if (!data_ok(bus)) {
-                brcmf_dbg(INFO, "No bus credit bus->tx_max %d, bus->tx_seq %d\n",
-                          bus->tx_max, bus->tx_seq);
-                up(&bus->tx_seq_lock);
-                /* Send from dpc */
-                bus->ctrl_frame_buf = msg;
-                bus->ctrl_frame_len = msglen;
-                bus->ctrl_frame_stat = true;
-
-                wait_event_interruptible_timeout(bus->ctrl_wait,
-                                                 !bus->ctrl_frame_stat,
-                                                 msecs_to_jiffies(2000));
-
-                if (!bus->ctrl_frame_stat) {
-                        brcmf_dbg(SDIO, "ctrl_frame_stat == false\n");
-                        ret = 0;
-                } else {
-                        brcmf_dbg(SDIO, "ctrl_frame_stat == true\n");
-                        bus->ctrl_frame_stat = false;
-                        if (down_interruptible(&bus->tx_seq_lock))
-                                return -EINTR;
-                        ret = -1;
-                }
+        /* Send from dpc */
+        bus->ctrl_frame_buf = msg;
+        bus->ctrl_frame_len = msglen;
+        bus->ctrl_frame_stat = true;
+        if (atomic_read(&bus->dpc_tskcnt) == 0) {
+                atomic_inc(&bus->dpc_tskcnt);
+                queue_work(bus->brcmf_wq, &bus->datawork);
         }
-        if (ret == -1) {
-                sdio_claim_host(bus->sdiodev->func[1]);
-                brcmf_sdio_bus_sleep(bus, false, false);
-                ret = brcmf_sdio_tx_ctrlframe(bus, msg, msglen);
-                sdio_release_host(bus->sdiodev->func[1]);
-                up(&bus->tx_seq_lock);
+
+        wait_event_interruptible_timeout(bus->ctrl_wait, !bus->ctrl_frame_stat,
+                                         msecs_to_jiffies(CTL_DONE_TIMEOUT));
+
+        if (!bus->ctrl_frame_stat) {
+                brcmf_dbg(SDIO, "ctrl_frame complete, err=%d\n",
+                          bus->ctrl_frame_err);
+                ret = bus->ctrl_frame_err;
+        } else {
+                brcmf_dbg(SDIO, "ctrl_frame timeout\n");
+                bus->ctrl_frame_stat = false;
+                ret = -ETIMEDOUT;
         }
 
         if (ret)
@@ -2986,7 +2987,7 @@ brcmf_sdio_bus_txctl(struct device *dev, unsigned char *msg, uint msglen)
         else
                 bus->sdcnt.tx_ctlpkts++;
 
-        return ret ? -EIO : 0;
+        return ret;
 }
 
 #ifdef DEBUG
@@ -3409,8 +3410,8 @@ static int brcmf_sdio_download_firmware(struct brcmf_sdio *bus,
                 goto err;
         }
 
-        /* Allow HT Clock now that the ARM is running. */
-        brcmf_bus_change_state(bus->sdiodev->bus_if, BRCMF_BUS_LOAD);
+        /* Allow full data communication using DPC from now on. */
+        bus->sdiodev->state = BRCMF_STATE_DATA;
         bcmerror = 0;
 
 err:
@@ -3556,7 +3557,7 @@ void brcmf_sdio_isr(struct brcmf_sdio *bus)
                 return;
         }
 
-        if (!brcmf_bus_ready(bus->sdiodev->bus_if)) {
+        if (bus->sdiodev->state != BRCMF_STATE_DATA) {
                 brcmf_err("bus is down. we have nothing to do\n");
                 return;
         }
@@ -3579,10 +3580,6 @@ void brcmf_sdio_isr(struct brcmf_sdio *bus)
 
 static bool brcmf_sdio_bus_watchdog(struct brcmf_sdio *bus)
 {
-#ifdef DEBUG
-        struct brcmf_bus *bus_if = dev_get_drvdata(bus->sdiodev->dev);
-#endif  /* DEBUG */
-
         brcmf_dbg(TIMER, "Enter\n");
 
         /* Poll period: check device if appropriate. */
@@ -3626,7 +3623,7 @@ static bool brcmf_sdio_bus_watchdog(struct brcmf_sdio *bus)
         }
 #ifdef DEBUG
         /* Poll for console output periodically */
-        if (bus_if && bus_if->state == BRCMF_BUS_DATA &&
+        if (bus->sdiodev->state == BRCMF_STATE_DATA &&
             bus->console_interval != 0) {
                 bus->console.count += BRCMF_WD_POLL_MS;
                 if (bus->console.count >= bus->console_interval) {
@@ -3811,7 +3808,7 @@ static u32 brcmf_sdio_buscore_read32(void *ctx, u32 addr)
         u32 val, rev;
 
         val = brcmf_sdiod_regrl(sdiodev, addr, NULL);
-        if (sdiodev->func[0]->device == BRCM_SDIO_4335_4339_DEVICE_ID &&
+        if (sdiodev->func[0]->device == SDIO_DEVICE_ID_BROADCOM_4335_4339 &&
             addr == CORE_CC_REG(SI_ENUM_BASE, chipid)) {
                 rev = (val & CID_REV_MASK) >> CID_REV_SHIFT;
                 if (rev >= 2) {
@@ -3867,11 +3864,6 @@ brcmf_sdio_probe_attach(struct brcmf_sdio *bus)
                 goto fail;
         }
 
-        /* SDIO register access works so moving
-         * state from UNKNOWN to DOWN.
-         */
-        brcmf_bus_change_state(bus->sdiodev->bus_if, BRCMF_BUS_DOWN);
-
         bus->ci = brcmf_chip_attach(bus->sdiodev, &brcmf_sdio_buscore_ops);
         if (IS_ERR(bus->ci)) {
                 brcmf_err("brcmf_chip_attach failed!\n");
@@ -4005,18 +3997,16 @@ static void brcmf_sdio_firmware_callback(struct device *dev,
 
         brcmf_dbg(TRACE, "Enter: dev=%s\n", dev_name(dev));
 
-        /* try to download image and nvram to the dongle */
-        if (bus_if->state == BRCMF_BUS_DOWN) {
-                bus->alp_only = true;
-                err = brcmf_sdio_download_firmware(bus, code, nvram, nvram_len);
-                if (err)
-                        goto fail;
-                bus->alp_only = false;
-        }
-
         if (!bus_if->drvr)
                 return;
 
+        /* try to download image and nvram to the dongle */
+        bus->alp_only = true;
+        err = brcmf_sdio_download_firmware(bus, code, nvram, nvram_len);
+        if (err)
+                goto fail;
+        bus->alp_only = false;
+
         /* Start the watchdog timer */
         bus->sdcnt.tickcnt = 0;
         brcmf_sdio_wd_timer(bus, BRCMF_WD_POLL_MS);
@@ -4142,7 +4132,6 @@ struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
 
         spin_lock_init(&bus->rxctl_lock);
         spin_lock_init(&bus->txq_lock);
-        sema_init(&bus->tx_seq_lock, 1);
         init_waitqueue_head(&bus->ctrl_wait);
         init_waitqueue_head(&bus->dcmd_resp_wait);
 
@@ -4213,7 +4202,6 @@ struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
         bus->idleclock = BRCMF_IDLE_ACTIVE;
 
         /* SR state */
-        bus->sleeping = false;
         bus->sr_enabled = false;
 
         brcmf_sdio_debugfs_create(bus);
@@ -4254,7 +4242,7 @@ void brcmf_sdio_remove(struct brcmf_sdio *bus)
                         destroy_workqueue(bus->brcmf_wq);
 
                 if (bus->ci) {
-                        if (bus->sdiodev->bus_if->state == BRCMF_BUS_DOWN) {
+                        if (bus->sdiodev->state != BRCMF_STATE_NOMEDIUM) {
                                 sdio_claim_host(bus->sdiodev->func[1]);
                                 brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
                                 /* Leave the device in state where it is
@@ -4289,7 +4277,7 @@ void brcmf_sdio_wd_timer(struct brcmf_sdio *bus, uint wdtick)
         }
 
         /* don't start the wd until fw is loaded */
-        if (bus->sdiodev->bus_if->state != BRCMF_BUS_DATA)
+        if (bus->sdiodev->state != BRCMF_STATE_DATA)
                 return;
 
         if (wdtick) {
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/sdio.h b/drivers/net/wireless/brcm80211/brcmfmac/sdio.h
index 8eb42620129c..ec2586a8425c 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/sdio.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio.h
@@ -155,6 +155,13 @@
 /* watchdog polling interval in ms */
 #define BRCMF_WD_POLL_MS        10
 
+/* The state of the bus */
+enum brcmf_sdio_state {
+        BRCMF_STATE_DOWN,       /* Device available, still initialising */
+        BRCMF_STATE_DATA,       /* Ready for data transfers, DPC enabled */
+        BRCMF_STATE_NOMEDIUM    /* No medium access to dongle possible */
+};
+
 struct brcmf_sdreg {
         int func;
         int offset;
@@ -169,8 +176,8 @@ struct brcmf_sdio_dev {
         u32 sbwad;                      /* Save backplane window address */
         struct brcmf_sdio *bus;
         atomic_t suspend;               /* suspend flag */
-        wait_queue_head_t request_word_wait;
-        wait_queue_head_t request_buffer_wait;
+        bool sleeping;
+        wait_queue_head_t idle_wait;
         struct device *dev;
         struct brcmf_bus *bus_if;
         struct brcmfmac_sdio_platform_data *pdata;
@@ -187,6 +194,7 @@ struct brcmf_sdio_dev {
         char fw_name[BRCMF_FW_PATH_LEN + BRCMF_FW_NAME_LEN];
         char nvram_name[BRCMF_FW_PATH_LEN + BRCMF_FW_NAME_LEN];
         bool wowl_enabled;
+        enum brcmf_sdio_state state;
 };
 
 /* sdio core registers */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
index 4572defc280f..5df6aa72cc2d 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
@@ -421,7 +421,7 @@ fail:
         brcmf_err("fail!\n");
         while (!list_empty(q)) {
                 req = list_entry(q->next, struct brcmf_usbreq, list);
-                if (req && req->urb)
+                if (req)
                         usb_free_urb(req->urb);
                 list_del(q->next);
         }
@@ -576,7 +576,7 @@ brcmf_usb_state_change(struct brcmf_usbdev_info *devinfo, int state)
                 brcmf_bus_change_state(bcmf_bus, BRCMF_BUS_DOWN);
         } else if (state == BRCMFMAC_USB_STATE_UP) {
                 brcmf_dbg(USB, "DBUS is up\n");
-                brcmf_bus_change_state(bcmf_bus, BRCMF_BUS_DATA);
+                brcmf_bus_change_state(bcmf_bus, BRCMF_BUS_UP);
         } else {
                 brcmf_dbg(USB, "DBUS current state=%d\n", state);
         }
@@ -1263,6 +1263,8 @@ static int brcmf_usb_probe_cb(struct brcmf_usbdev_info *devinfo)
                 ret = brcmf_usb_bus_setup(devinfo);
                 if (ret)
                         goto fail;
+                /* we are done */
+                return 0;
         }
         bus->chip = bus_pub->devid;
         bus->chiprev = bus_pub->chiprev;
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/debug.c b/drivers/net/wireless/brcm80211/brcmsmac/debug.c
index c9a8b9360ab1..7a1fbb2e3a71 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/debug.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/debug.c
@@ -78,7 +78,7 @@ int brcms_debugfs_hardware_read(struct seq_file *s, void *data)
         struct brcms_hardware *hw = drvr->wlc->hw;
         struct bcma_device *core = hw->d11core;
         struct bcma_bus *bus = core->bus;
-        char boardrev[10];
+        char boardrev[BRCMU_BOARDREV_LEN];
 
         seq_printf(s, "chipnum 0x%x\n"
                    "chiprev 0x%x\n"
diff --git a/drivers/net/wireless/brcm80211/brcmutil/utils.c b/drivers/net/wireless/brcm80211/brcmutil/utils.c
index 906e89ddf319..0543607002fd 100644
--- a/drivers/net/wireless/brcm80211/brcmutil/utils.c
+++ b/drivers/net/wireless/brcm80211/brcmutil/utils.c
@@ -267,15 +267,43 @@ char *brcmu_boardrev_str(u32 brev, char *buf)
         char c;
 
         if (brev < 0x100) {
-                snprintf(buf, 8, "%d.%d", (brev & 0xf0) >> 4, brev & 0xf);
+                snprintf(buf, BRCMU_BOARDREV_LEN, "%d.%d",
+                         (brev & 0xf0) >> 4, brev & 0xf);
         } else {
                 c = (brev & 0xf000) == 0x1000 ? 'P' : 'A';
-                snprintf(buf, 8, "%c%03x", c, brev & 0xfff);
+                snprintf(buf, BRCMU_BOARDREV_LEN, "%c%03x", c, brev & 0xfff);
         }
         return buf;
 }
 EXPORT_SYMBOL(brcmu_boardrev_str);
 
+char *brcmu_dotrev_str(u32 dotrev, char *buf)
+{
+        u8 dotval[4];
+
+        if (!dotrev) {
+                snprintf(buf, BRCMU_DOTREV_LEN, "unknown");
+                return buf;
+        }
+        dotval[0] = (dotrev >> 24) & 0xFF;
+        dotval[1] = (dotrev >> 16) & 0xFF;
+        dotval[2] = (dotrev >> 8) & 0xFF;
+        dotval[3] = dotrev & 0xFF;
+
+        if (dotval[3])
+                snprintf(buf, BRCMU_DOTREV_LEN, "%d.%d.%d.%d", dotval[0],
+                        dotval[1], dotval[2], dotval[3]);
+        else if (dotval[2])
+                snprintf(buf, BRCMU_DOTREV_LEN, "%d.%d.%d", dotval[0],
+                        dotval[1], dotval[2]);
+        else
+                snprintf(buf, BRCMU_DOTREV_LEN, "%d.%d", dotval[0],
+                        dotval[1]);
+
+        return buf;
+}
+EXPORT_SYMBOL(brcmu_dotrev_str);
+
 #if defined(DEBUG)
 /* pretty hex print a pkt buffer chain */
 void brcmu_prpkt(const char *msg, struct sk_buff *p0)
diff --git a/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h b/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
index 6996fcc144cf..2124a17d0bfd 100644
--- a/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
+++ b/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
@@ -22,7 +22,6 @@
 
 #define BRCM_USB_VENDOR_ID_BROADCOM     0x0a5c
 #define BRCM_PCIE_VENDOR_ID_BROADCOM    PCI_VENDOR_ID_BROADCOM
-#define BRCM_SDIO_VENDOR_ID_BROADCOM    SDIO_VENDOR_ID_BROADCOM
 
 /* Chipcommon Core Chip IDs */
 #define BRCM_CC_43143_CHIP_ID           43143
@@ -34,6 +33,7 @@
 #define BRCM_CC_4329_CHIP_ID            0x4329
 #define BRCM_CC_4330_CHIP_ID            0x4330
 #define BRCM_CC_4334_CHIP_ID            0x4334
+#define BRCM_CC_43340_CHIP_ID           43340
 #define BRCM_CC_43362_CHIP_ID           43362
 #define BRCM_CC_4335_CHIP_ID            0x4335
 #define BRCM_CC_4339_CHIP_ID            0x4339
@@ -45,16 +45,6 @@
 #define BRCM_CC_43570_CHIP_ID           43570
 #define BRCM_CC_43602_CHIP_ID           43602
 
-/* SDIO Device IDs */
-#define BRCM_SDIO_43143_DEVICE_ID       BRCM_CC_43143_CHIP_ID
-#define BRCM_SDIO_43241_DEVICE_ID       BRCM_CC_43241_CHIP_ID
-#define BRCM_SDIO_4329_DEVICE_ID        BRCM_CC_4329_CHIP_ID
-#define BRCM_SDIO_4330_DEVICE_ID        BRCM_CC_4330_CHIP_ID
-#define BRCM_SDIO_4334_DEVICE_ID        BRCM_CC_4334_CHIP_ID
-#define BRCM_SDIO_43362_DEVICE_ID       BRCM_CC_43362_CHIP_ID
-#define BRCM_SDIO_4335_4339_DEVICE_ID   BRCM_CC_4335_CHIP_ID
-#define BRCM_SDIO_4354_DEVICE_ID        BRCM_CC_4354_CHIP_ID
-
 /* USB Device IDs */
 #define BRCM_USB_43143_DEVICE_ID        0xbd1e
 #define BRCM_USB_43236_DEVICE_ID        0xbd17
diff --git a/drivers/net/wireless/brcm80211/include/brcmu_utils.h b/drivers/net/wireless/brcm80211/include/brcmu_utils.h
index a043e29f07e2..41969527b459 100644
--- a/drivers/net/wireless/brcm80211/include/brcmu_utils.h
+++ b/drivers/net/wireless/brcm80211/include/brcmu_utils.h
@@ -218,6 +218,10 @@ void brcmu_dbg_hex_dump(const void *data, size_t size, const char *fmt, ...)
 }
 #endif
 
+#define BRCMU_BOARDREV_LEN      8
+#define BRCMU_DOTREV_LEN        16
+
 char *brcmu_boardrev_str(u32 brev, char *buf);
+char *brcmu_dotrev_str(u32 dotrev, char *buf);
 
 #endif                          /* _BRCMU_UTILS_H_ */
diff --git a/drivers/net/wireless/cw1200/fwio.c b/drivers/net/wireless/cw1200/fwio.c
index 6f1b9aace8b3..30e7646d04af 100644
--- a/drivers/net/wireless/cw1200/fwio.c
+++ b/drivers/net/wireless/cw1200/fwio.c
@@ -66,25 +66,31 @@ static int cw1200_load_firmware_cw1200(struct cw1200_common *priv)
         do { \
                 ret = cw1200_apb_write_32(priv, CW1200_APB(reg), (val)); \
                 if (ret < 0) \
-                        goto error; \
+                        goto exit; \
+        } while (0)
+#define APB_WRITE2(reg, val) \
+        do { \
+                ret = cw1200_apb_write_32(priv, CW1200_APB(reg), (val)); \
+                if (ret < 0) \
+                        goto free_buffer; \
         } while (0)
 #define APB_READ(reg, val) \
         do { \
                 ret = cw1200_apb_read_32(priv, CW1200_APB(reg), &(val)); \
                 if (ret < 0) \
-                        goto error; \
+                        goto free_buffer; \
         } while (0)
 #define REG_WRITE(reg, val) \
         do { \
                 ret = cw1200_reg_write_32(priv, (reg), (val)); \
                 if (ret < 0) \
-                        goto error; \
+                        goto exit; \
         } while (0)
 #define REG_READ(reg, val) \
         do { \
                 ret = cw1200_reg_read_32(priv, (reg), &(val)); \
                 if (ret < 0) \
-                        goto error; \
+                        goto exit; \
         } while (0)
 
         switch (priv->hw_revision) {
@@ -142,14 +148,14 @@ static int cw1200_load_firmware_cw1200(struct cw1200_common *priv)
         ret = request_firmware(&firmware, fw_path, priv->pdev);
         if (ret) {
                 pr_err("Can't load firmware file %s.\n", fw_path);
-                goto error;
+                goto exit;
         }
 
         buf = kmalloc(DOWNLOAD_BLOCK_SIZE, GFP_KERNEL | GFP_DMA);
         if (!buf) {
                 pr_err("Can't allocate firmware load buffer.\n");
                 ret = -ENOMEM;
-                goto error;
+                goto firmware_release;
         }
 
         /* Check if the bootloader is ready */
@@ -163,7 +169,7 @@ static int cw1200_load_firmware_cw1200(struct cw1200_common *priv)
         if (val32 != DOWNLOAD_I_AM_HERE) {
                 pr_err("Bootloader is not ready.\n");
                 ret = -ETIMEDOUT;
-                goto error;
+                goto free_buffer;
         }
 
         /* Calculcate number of download blocks */
@@ -171,7 +177,7 @@ static int cw1200_load_firmware_cw1200(struct cw1200_common *priv)
 
         /* Updating the length in Download Ctrl Area */
         val32 = firmware->size; /* Explicit cast from size_t to u32 */
-        APB_WRITE(DOWNLOAD_IMAGE_SIZE_REG, val32);
+        APB_WRITE2(DOWNLOAD_IMAGE_SIZE_REG, val32);
 
         /* Firmware downloading loop */
         for (block = 0; block < num_blocks; block++) {
@@ -183,7 +189,7 @@ static int cw1200_load_firmware_cw1200(struct cw1200_common *priv)
                 if (val32 != DOWNLOAD_PENDING) {
                         pr_err("Bootloader reported error %d.\n", val32);
                         ret = -EIO;
-                        goto error;
+                        goto free_buffer;
                 }
 
                 /* loop until put - get <= 24K */
@@ -198,7 +204,7 @@ static int cw1200_load_firmware_cw1200(struct cw1200_common *priv)
                 if ((put - get) > (DOWNLOAD_FIFO_SIZE - DOWNLOAD_BLOCK_SIZE)) {
                         pr_err("Timeout waiting for FIFO.\n");
                         ret = -ETIMEDOUT;
-                        goto error;
+                        goto free_buffer;
                 }
 
                 /* calculate the block size */
@@ -220,12 +226,12 @@ static int cw1200_load_firmware_cw1200(struct cw1200_common *priv)
                 if (ret < 0) {
                         pr_err("Can't write firmware block @ %d!\n",
                                put & (DOWNLOAD_FIFO_SIZE - 1));
-                        goto error;
+                        goto free_buffer;
                 }
 
                 /* update the put register */
                 put += block_size;
-                APB_WRITE(DOWNLOAD_PUT_REG, put);
+                APB_WRITE2(DOWNLOAD_PUT_REG, put);
         } /* End of firmware download loop */
 
         /* Wait for the download completion */
@@ -238,19 +244,21 @@ static int cw1200_load_firmware_cw1200(struct cw1200_common *priv)
         if (val32 != DOWNLOAD_SUCCESS) {
                 pr_err("Wait for download completion failed: 0x%.8X\n", val32);
                 ret = -ETIMEDOUT;
-                goto error;
+                goto free_buffer;
         } else {
                 pr_info("Firmware download completed.\n");
                 ret = 0;
         }
 
-error:
+free_buffer:
         kfree(buf);
-        if (firmware)
-                release_firmware(firmware);
+firmware_release:
+        release_firmware(firmware);
+exit:
         return ret;
 
 #undef APB_WRITE
+#undef APB_WRITE2
 #undef APB_READ
 #undef REG_WRITE
 #undef REG_READ
diff --git a/drivers/net/wireless/cw1200/main.c b/drivers/net/wireless/cw1200/main.c
index 3e78cc3ccb78..3689dbbd10bd 100644
--- a/drivers/net/wireless/cw1200/main.c
+++ b/drivers/net/wireless/cw1200/main.c
@@ -282,7 +282,6 @@ static struct ieee80211_hw *cw1200_init_common(const u8 *macaddr,
                     IEEE80211_HW_SUPPORTS_PS |
                     IEEE80211_HW_SUPPORTS_DYNAMIC_PS |
                     IEEE80211_HW_REPORTS_TX_ACK_STATUS |
-                    IEEE80211_HW_SUPPORTS_UAPSD |
                     IEEE80211_HW_CONNECTION_MONITOR |
                     IEEE80211_HW_AMPDU_AGGREGATION |
                     IEEE80211_HW_TX_AMPDU_SETUP_IN_HW |
@@ -374,9 +373,8 @@ static struct ieee80211_hw *cw1200_init_common(const u8 *macaddr,
         INIT_WORK(&priv->update_filtering_work, cw1200_update_filtering_work);
         INIT_WORK(&priv->set_beacon_wakeup_period_work,
                   cw1200_set_beacon_wakeup_period_work);
-        init_timer(&priv->mcast_timeout);
-        priv->mcast_timeout.data = (unsigned long)priv;
-        priv->mcast_timeout.function = cw1200_mcast_timeout;
+        setup_timer(&priv->mcast_timeout, cw1200_mcast_timeout,
+                    (unsigned long)priv);
 
         if (cw1200_queue_stats_init(&priv->tx_queue_stats,
                                     CW1200_LINK_ID_MAX,
diff --git a/drivers/net/wireless/cw1200/pm.c b/drivers/net/wireless/cw1200/pm.c
index 6907c8fd4578..d2202ae92bdd 100644
--- a/drivers/net/wireless/cw1200/pm.c
+++ b/drivers/net/wireless/cw1200/pm.c
@@ -101,9 +101,8 @@ int cw1200_pm_init(struct cw1200_pm_state *pm,
 {
         spin_lock_init(&pm->lock);
 
-        init_timer(&pm->stay_awake);
-        pm->stay_awake.data = (unsigned long)pm;
-        pm->stay_awake.function = cw1200_pm_stay_awake_tmo;
+        setup_timer(&pm->stay_awake, cw1200_pm_stay_awake_tmo,
+                    (unsigned long)pm);
 
         return 0;
 }
diff --git a/drivers/net/wireless/cw1200/queue.c b/drivers/net/wireless/cw1200/queue.c
index 9c3925f58d79..0ba5ef9b3e7b 100644
--- a/drivers/net/wireless/cw1200/queue.c
+++ b/drivers/net/wireless/cw1200/queue.c
@@ -179,9 +179,7 @@ int cw1200_queue_init(struct cw1200_queue *queue,
         INIT_LIST_HEAD(&queue->pending);
         INIT_LIST_HEAD(&queue->free_pool);
         spin_lock_init(&queue->lock);
-        init_timer(&queue->gc);
-        queue->gc.data = (unsigned long)queue;
-        queue->gc.function = cw1200_queue_gc;
+        setup_timer(&queue->gc, cw1200_queue_gc, (unsigned long)queue);
 
         queue->pool = kzalloc(sizeof(struct cw1200_queue_item) * capacity,
                         GFP_KERNEL);
diff --git a/drivers/net/wireless/cw1200/scan.c b/drivers/net/wireless/cw1200/scan.c
index f2e276faca70..bff81b8d4164 100644
--- a/drivers/net/wireless/cw1200/scan.c
+++ b/drivers/net/wireless/cw1200/scan.c
@@ -39,9 +39,9 @@ static int cw1200_scan_start(struct cw1200_common *priv, struct wsm_scan *scan)
         cancel_delayed_work_sync(&priv->clear_recent_scan_work);
         atomic_set(&priv->scan.in_progress, 1);
         atomic_set(&priv->recent_scan, 1);
-        cw1200_pm_stay_awake(&priv->pm_state, tmo * HZ / 1000);
+        cw1200_pm_stay_awake(&priv->pm_state, msecs_to_jiffies(tmo));
         queue_delayed_work(priv->workqueue, &priv->scan.timeout,
-                           tmo * HZ / 1000);
+                           msecs_to_jiffies(tmo));
         ret = wsm_scan(priv, scan);
         if (ret) {
                 atomic_set(&priv->scan.in_progress, 0);
@@ -386,8 +386,8 @@ void cw1200_probe_work(struct work_struct *work)
         if (down_trylock(&priv->scan.lock)) {
                 /* Scan is already in progress. Requeue self. */
                 schedule();
-                queue_delayed_work(priv->workqueue,
-                                   &priv->scan.probe_work, HZ / 10);
+                queue_delayed_work(priv->workqueue, &priv->scan.probe_work,
+                                   msecs_to_jiffies(100));
                 mutex_unlock(&priv->conf_mutex);
                 return;
         }
diff --git a/drivers/net/wireless/cw1200/sta.c b/drivers/net/wireless/cw1200/sta.c
index 5b84664db13b..4a47c7f8a246 100644
--- a/drivers/net/wireless/cw1200/sta.c
+++ b/drivers/net/wireless/cw1200/sta.c
@@ -213,6 +213,7 @@ int cw1200_add_interface(struct ieee80211_hw *dev,
         /* __le32 auto_calibration_mode = __cpu_to_le32(1); */
 
         vif->driver_flags |= IEEE80211_VIF_BEACON_FILTER |
+                             IEEE80211_VIF_SUPPORTS_UAPSD |
                              IEEE80211_VIF_SUPPORTS_CQM_RSSI;
 
         mutex_lock(&priv->conf_mutex);
@@ -708,7 +709,8 @@ int cw1200_set_key(struct ieee80211_hw *dev, enum set_key_cmd cmd,
                 if (sta)
                         peer_addr = sta->addr;
 
-                key->flags |= IEEE80211_KEY_FLAG_PUT_IV_SPACE;
+                key->flags |= IEEE80211_KEY_FLAG_PUT_IV_SPACE |
+                              IEEE80211_KEY_FLAG_RESERVE_TAILROOM;
 
                 switch (key->cipher) {
                 case WLAN_CIPHER_SUITE_WEP40:
diff --git a/drivers/net/wireless/hostap/hostap_ap.c b/drivers/net/wireless/hostap/hostap_ap.c
index 596525528f50..fd8d83dd4f62 100644
--- a/drivers/net/wireless/hostap/hostap_ap.c
+++ b/drivers/net/wireless/hostap/hostap_ap.c
@@ -145,7 +145,7 @@ static void ap_free_sta(struct ap_data *ap, struct sta_info *sta)
         if (sta->aid > 0)
                 ap->sta_aid[sta->aid - 1] = NULL;
 
-        if (!sta->ap && sta->u.sta.challenge)
+        if (!sta->ap)
                 kfree(sta->u.sta.challenge);
         del_timer_sync(&sta->timer);
 #endif /* PRISM2_NO_KERNEL_IEEE80211_MGMT */
diff --git a/drivers/net/wireless/iwlegacy/3945-mac.c b/drivers/net/wireless/iwlegacy/3945-mac.c
index dc1d20cf64ee..e5665804d986 100644
--- a/drivers/net/wireless/iwlegacy/3945-mac.c
+++ b/drivers/net/wireless/iwlegacy/3945-mac.c
@@ -3429,9 +3429,7 @@ il3945_setup_deferred_work(struct il_priv *il)
 
         il3945_hw_setup_deferred_work(il);
 
-        init_timer(&il->watchdog);
-        il->watchdog.data = (unsigned long)il;
-        il->watchdog.function = il_bg_watchdog;
+        setup_timer(&il->watchdog, il_bg_watchdog, (unsigned long)il);
 
         tasklet_init(&il->irq_tasklet,
                      (void (*)(unsigned long))il3945_irq_tasklet,
diff --git a/drivers/net/wireless/iwlegacy/4965-mac.c b/drivers/net/wireless/iwlegacy/4965-mac.c
index 2748fde4b90c..976f65fe9c38 100644
--- a/drivers/net/wireless/iwlegacy/4965-mac.c
+++ b/drivers/net/wireless/iwlegacy/4965-mac.c
@@ -6247,13 +6247,10 @@ il4965_setup_deferred_work(struct il_priv *il)
 
         INIT_WORK(&il->txpower_work, il4965_bg_txpower_work);
 
-        init_timer(&il->stats_periodic);
-        il->stats_periodic.data = (unsigned long)il;
-        il->stats_periodic.function = il4965_bg_stats_periodic;
+        setup_timer(&il->stats_periodic, il4965_bg_stats_periodic,
+                    (unsigned long)il);
 
-        init_timer(&il->watchdog);
-        il->watchdog.data = (unsigned long)il;
-        il->watchdog.function = il_bg_watchdog;
+        setup_timer(&il->watchdog, il_bg_watchdog, (unsigned long)il);
 
         tasklet_init(&il->irq_tasklet,
                      (void (*)(unsigned long))il4965_irq_tasklet,
diff --git a/drivers/net/wireless/iwlwifi/dvm/main.c b/drivers/net/wireless/iwlwifi/dvm/main.c
index 0b7f46f0b079..c4d6dd7402d9 100644
--- a/drivers/net/wireless/iwlwifi/dvm/main.c
+++ b/drivers/net/wireless/iwlwifi/dvm/main.c
@@ -64,22 +64,8 @@
  *
  ******************************************************************************/
 
-/*
- * module name, copyright, version, etc.
- */
 #define DRV_DESCRIPTION "Intel(R) Wireless WiFi Link AGN driver for Linux"
-
-#ifdef CONFIG_IWLWIFI_DEBUG
-#define VD "d"
-#else
-#define VD
-#endif
-
-#define DRV_VERSION     IWLWIFI_VERSION VD
-
-
 MODULE_DESCRIPTION(DRV_DESCRIPTION);
-MODULE_VERSION(DRV_VERSION);
 MODULE_AUTHOR(DRV_COPYRIGHT " " DRV_AUTHOR);
 MODULE_LICENSE("GPL");
 
@@ -1011,13 +997,11 @@ static void iwl_setup_deferred_work(struct iwl_priv *priv)
         if (priv->lib->bt_params)
                 iwlagn_bt_setup_deferred_work(priv);
 
-        init_timer(&priv->statistics_periodic);
-        priv->statistics_periodic.data = (unsigned long)priv;
-        priv->statistics_periodic.function = iwl_bg_statistics_periodic;
+        setup_timer(&priv->statistics_periodic, iwl_bg_statistics_periodic,
+                    (unsigned long)priv);
 
-        init_timer(&priv->ucode_trace);
-        priv->ucode_trace.data = (unsigned long)priv;
-        priv->ucode_trace.function = iwl_bg_ucode_trace;
+        setup_timer(&priv->ucode_trace, iwl_bg_ucode_trace,
+                    (unsigned long)priv);
 }
 
 void iwl_cancel_deferred_work(struct iwl_priv *priv)
@@ -1244,11 +1228,8 @@ static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans,
         trans_cfg.no_reclaim_cmds = no_reclaim_cmds;
         trans_cfg.n_no_reclaim_cmds = ARRAY_SIZE(no_reclaim_cmds);
         trans_cfg.rx_buf_size_8k = iwlwifi_mod_params.amsdu_size_8K;
-        if (!iwlwifi_mod_params.wd_disable)
-                trans_cfg.queue_watchdog_timeout =
-                        priv->cfg->base_params->wd_timeout;
-        else
-                trans_cfg.queue_watchdog_timeout = IWL_WATCHDOG_DISABLED;
+        trans_cfg.cmd_q_wdg_timeout = IWL_WATCHDOG_DISABLED;
+
         trans_cfg.command_names = iwl_dvm_cmd_strings;
         trans_cfg.cmd_fifo = IWLAGN_CMD_FIFO_NUM;
 
diff --git a/drivers/net/wireless/iwlwifi/dvm/tt.c b/drivers/net/wireless/iwlwifi/dvm/tt.c
index acb981a0a0aa..c4736c8834c5 100644
--- a/drivers/net/wireless/iwlwifi/dvm/tt.c
+++ b/drivers/net/wireless/iwlwifi/dvm/tt.c
@@ -612,15 +612,10 @@ void iwl_tt_initialize(struct iwl_priv *priv)
         memset(tt, 0, sizeof(struct iwl_tt_mgmt));
 
         tt->state = IWL_TI_0;
-        init_timer(&priv->thermal_throttle.ct_kill_exit_tm);
-        priv->thermal_throttle.ct_kill_exit_tm.data = (unsigned long)priv;
-        priv->thermal_throttle.ct_kill_exit_tm.function =
-                iwl_tt_check_exit_ct_kill;
-        init_timer(&priv->thermal_throttle.ct_kill_waiting_tm);
-        priv->thermal_throttle.ct_kill_waiting_tm.data =
-                (unsigned long)priv;
-        priv->thermal_throttle.ct_kill_waiting_tm.function =
-                iwl_tt_ready_for_ct_kill;
+        setup_timer(&priv->thermal_throttle.ct_kill_exit_tm,
+                    iwl_tt_check_exit_ct_kill, (unsigned long)priv);
+        setup_timer(&priv->thermal_throttle.ct_kill_waiting_tm,
+                    iwl_tt_ready_for_ct_kill, (unsigned long)priv);
         /* setup deferred ct kill work */
         INIT_WORK(&priv->tt_work, iwl_bg_tt_work);
         INIT_WORK(&priv->ct_enter, iwl_bg_ct_enter);
diff --git a/drivers/net/wireless/iwlwifi/dvm/tx.c b/drivers/net/wireless/iwlwifi/dvm/tx.c
index d1ce3ce13591..1e40a12de077 100644
--- a/drivers/net/wireless/iwlwifi/dvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/dvm/tx.c
@@ -715,7 +715,7 @@ int iwlagn_tx_agg_oper(struct iwl_priv *priv, struct ieee80211_vif *vif,
         fifo = ctx->ac_to_fifo[tid_to_ac[tid]];
 
         iwl_trans_txq_enable(priv->trans, q, fifo, sta_priv->sta_id, tid,
-                             buf_size, ssn);
+                             buf_size, ssn, 0);
 
         /*
          * If the limit is 0, then it wasn't initialised yet,
diff --git a/drivers/net/wireless/iwlwifi/dvm/ucode.c b/drivers/net/wireless/iwlwifi/dvm/ucode.c
index d5cee1530597..4dbef7e58c2e 100644
--- a/drivers/net/wireless/iwlwifi/dvm/ucode.c
+++ b/drivers/net/wireless/iwlwifi/dvm/ucode.c
@@ -267,7 +267,7 @@ static int iwl_alive_notify(struct iwl_priv *priv)
         for (i = 0; i < n_queues; i++)
                 if (queue_to_txf[i] != IWL_TX_FIFO_UNUSED)
                         iwl_trans_ac_txq_enable(priv->trans, i,
-                                                queue_to_txf[i]);
+                                                queue_to_txf[i], 0);
 
         priv->passive_no_rx = false;
         priv->transport_queue_stop = 0;
diff --git a/drivers/net/wireless/iwlwifi/iwl-7000.c b/drivers/net/wireless/iwlwifi/iwl-7000.c
index a5f9198d5747..97e38d2e2983 100644
--- a/drivers/net/wireless/iwlwifi/iwl-7000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-7000.c
@@ -92,6 +92,12 @@
 #define IWL7265D_NVM_VERSION            0x0c11
 #define IWL7265_TX_POWER_VERSION        0xffff /* meaningless */
 
+/* DCCM offsets and lengths */
+#define IWL7000_DCCM_OFFSET             0x800000
+#define IWL7260_DCCM_LEN                0x14000
+#define IWL3160_DCCM_LEN                0x10000
+#define IWL7265_DCCM_LEN                0x17A00
+
 #define IWL7260_FW_PRE "iwlwifi-7260-"
 #define IWL7260_MODULE_FIRMWARE(api) IWL7260_FW_PRE __stringify(api) ".ucode"
 
@@ -138,7 +144,8 @@ static const struct iwl_ht_params iwl7000_ht_params = {
         .led_mode = IWL_LED_RF_STATE,                           \
         .nvm_hw_section_num = NVM_HW_SECTION_NUM_FAMILY_7000,   \
         .non_shared_ant = ANT_A,                                \
-        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,    \
+        .dccm_offset = IWL7000_DCCM_OFFSET
 
 const struct iwl_cfg iwl7260_2ac_cfg = {
         .name = "Intel(R) Dual Band Wireless AC 7260",
@@ -149,6 +156,7 @@ const struct iwl_cfg iwl7260_2ac_cfg = {
         .nvm_calib_ver = IWL7260_TX_POWER_VERSION,
         .host_interrupt_operation_mode = true,
         .lp_xtal_workaround = true,
+        .dccm_len = IWL7260_DCCM_LEN,
 };
 
 const struct iwl_cfg iwl7260_2ac_cfg_high_temp = {
@@ -161,6 +169,7 @@ const struct iwl_cfg iwl7260_2ac_cfg_high_temp = {
         .high_temp = true,
         .host_interrupt_operation_mode = true,
         .lp_xtal_workaround = true,
+        .dccm_len = IWL7260_DCCM_LEN,
 };
 
 const struct iwl_cfg iwl7260_2n_cfg = {
@@ -172,6 +181,7 @@ const struct iwl_cfg iwl7260_2n_cfg = {
         .nvm_calib_ver = IWL7260_TX_POWER_VERSION,
         .host_interrupt_operation_mode = true,
         .lp_xtal_workaround = true,
+        .dccm_len = IWL7260_DCCM_LEN,
 };
 
 const struct iwl_cfg iwl7260_n_cfg = {
@@ -183,6 +193,7 @@ const struct iwl_cfg iwl7260_n_cfg = {
         .nvm_calib_ver = IWL7260_TX_POWER_VERSION,
         .host_interrupt_operation_mode = true,
         .lp_xtal_workaround = true,
+        .dccm_len = IWL7260_DCCM_LEN,
 };
 
 const struct iwl_cfg iwl3160_2ac_cfg = {
@@ -193,6 +204,7 @@ const struct iwl_cfg iwl3160_2ac_cfg = {
         .nvm_ver = IWL3160_NVM_VERSION,
         .nvm_calib_ver = IWL3160_TX_POWER_VERSION,
         .host_interrupt_operation_mode = true,
+        .dccm_len = IWL3160_DCCM_LEN,
 };
 
 const struct iwl_cfg iwl3160_2n_cfg = {
@@ -203,6 +215,7 @@ const struct iwl_cfg iwl3160_2n_cfg = {
         .nvm_ver = IWL3160_NVM_VERSION,
         .nvm_calib_ver = IWL3160_TX_POWER_VERSION,
         .host_interrupt_operation_mode = true,
+        .dccm_len = IWL3160_DCCM_LEN,
 };
 
 const struct iwl_cfg iwl3160_n_cfg = {
@@ -213,6 +226,7 @@ const struct iwl_cfg iwl3160_n_cfg = {
         .nvm_ver = IWL3160_NVM_VERSION,
         .nvm_calib_ver = IWL3160_TX_POWER_VERSION,
         .host_interrupt_operation_mode = true,
+        .dccm_len = IWL3160_DCCM_LEN,
 };
 
 static const struct iwl_pwr_tx_backoff iwl7265_pwr_tx_backoffs[] = {
@@ -240,6 +254,7 @@ const struct iwl_cfg iwl3165_2ac_cfg = {
         .nvm_ver = IWL3165_NVM_VERSION,
         .nvm_calib_ver = IWL3165_TX_POWER_VERSION,
         .pwr_tx_backoffs = iwl7265_pwr_tx_backoffs,
+        .dccm_len = IWL7265_DCCM_LEN,
 };
 
 const struct iwl_cfg iwl7265_2ac_cfg = {
@@ -250,6 +265,7 @@ const struct iwl_cfg iwl7265_2ac_cfg = {
         .nvm_ver = IWL7265_NVM_VERSION,
         .nvm_calib_ver = IWL7265_TX_POWER_VERSION,
         .pwr_tx_backoffs = iwl7265_pwr_tx_backoffs,
+        .dccm_len = IWL7265_DCCM_LEN,
 };
 
 const struct iwl_cfg iwl7265_2n_cfg = {
@@ -260,6 +276,7 @@ const struct iwl_cfg iwl7265_2n_cfg = {
         .nvm_ver = IWL7265_NVM_VERSION,
         .nvm_calib_ver = IWL7265_TX_POWER_VERSION,
         .pwr_tx_backoffs = iwl7265_pwr_tx_backoffs,
+        .dccm_len = IWL7265_DCCM_LEN,
 };
 
 const struct iwl_cfg iwl7265_n_cfg = {
@@ -270,6 +287,7 @@ const struct iwl_cfg iwl7265_n_cfg = {
         .nvm_ver = IWL7265_NVM_VERSION,
         .nvm_calib_ver = IWL7265_TX_POWER_VERSION,
         .pwr_tx_backoffs = iwl7265_pwr_tx_backoffs,
+        .dccm_len = IWL7265_DCCM_LEN,
 };
 
 const struct iwl_cfg iwl7265d_2ac_cfg = {
@@ -280,6 +298,7 @@ const struct iwl_cfg iwl7265d_2ac_cfg = {
         .nvm_ver = IWL7265D_NVM_VERSION,
         .nvm_calib_ver = IWL7265_TX_POWER_VERSION,
         .pwr_tx_backoffs = iwl7265_pwr_tx_backoffs,
+        .dccm_len = IWL7265_DCCM_LEN,
 };
 
 const struct iwl_cfg iwl7265d_2n_cfg = {
@@ -290,6 +309,7 @@ const struct iwl_cfg iwl7265d_2n_cfg = {
         .nvm_ver = IWL7265D_NVM_VERSION,
         .nvm_calib_ver = IWL7265_TX_POWER_VERSION,
         .pwr_tx_backoffs = iwl7265_pwr_tx_backoffs,
+        .dccm_len = IWL7265_DCCM_LEN,
 };
 
 const struct iwl_cfg iwl7265d_n_cfg = {
@@ -300,6 +320,7 @@ const struct iwl_cfg iwl7265d_n_cfg = {
         .nvm_ver = IWL7265D_NVM_VERSION,
         .nvm_calib_ver = IWL7265_TX_POWER_VERSION,
         .pwr_tx_backoffs = iwl7265_pwr_tx_backoffs,
+        .dccm_len = IWL7265_DCCM_LEN,
 };
 
 MODULE_FIRMWARE(IWL7260_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
diff --git a/drivers/net/wireless/iwlwifi/iwl-8000.c b/drivers/net/wireless/iwlwifi/iwl-8000.c
index 3668fc57e770..2f7fe8167dc9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-8000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-8000.c
@@ -81,12 +81,21 @@
 #define IWL8000_NVM_VERSION             0x0a1d
 #define IWL8000_TX_POWER_VERSION        0xffff /* meaningless */
 
+/* Memory offsets and lengths */
+#define IWL8260_DCCM_OFFSET             0x800000
+#define IWL8260_DCCM_LEN                0x18000
+#define IWL8260_DCCM2_OFFSET            0x880000
+#define IWL8260_DCCM2_LEN               0x8000
+#define IWL8260_SMEM_OFFSET             0x400000
+#define IWL8260_SMEM_LEN                0x68000
+
 #define IWL8000_FW_PRE "iwlwifi-8000"
 #define IWL8000_MODULE_FIRMWARE(api) \
         IWL8000_FW_PRE "-" __stringify(api) ".ucode"
 
 #define NVM_HW_SECTION_NUM_FAMILY_8000          10
-#define DEFAULT_NVM_FILE_FAMILY_8000            "iwl_nvm_8000.bin"
+#define DEFAULT_NVM_FILE_FAMILY_8000A           "iwl_nvm_8000.bin"
+#define DEFAULT_NVM_FILE_FAMILY_8000            "iwl_nvm_8000B.bin"
 
 /* Max SDIO RX aggregation size of the ADDBA request/response */
 #define MAX_RX_AGG_SIZE_8260_SDIO       28
@@ -124,7 +133,13 @@ static const struct iwl_ht_params iwl8000_ht_params = {
         .led_mode = IWL_LED_RF_STATE,                           \
         .nvm_hw_section_num = NVM_HW_SECTION_NUM_FAMILY_8000,   \
         .d0i3 = true,                                           \
-        .non_shared_ant = ANT_A
+        .non_shared_ant = ANT_A,                                \
+        .dccm_offset = IWL8260_DCCM_OFFSET,                     \
+        .dccm_len = IWL8260_DCCM_LEN,                           \
+        .dccm2_offset = IWL8260_DCCM2_OFFSET,                   \
+        .dccm2_len = IWL8260_DCCM2_LEN,                         \
+        .smem_offset = IWL8260_SMEM_OFFSET,                     \
+        .smem_len = IWL8260_SMEM_LEN
 
 const struct iwl_cfg iwl8260_2n_cfg = {
         .name = "Intel(R) Dual Band Wireless N 8260",
@@ -145,6 +160,16 @@ const struct iwl_cfg iwl8260_2ac_cfg = {
         .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
 };
 
+const struct iwl_cfg iwl4165_2ac_cfg = {
+        .name = "Intel(R) Dual Band Wireless AC 4165",
+        .fw_name_pre = IWL8000_FW_PRE,
+        IWL_DEVICE_8000,
+        .ht_params = &iwl8000_ht_params,
+        .nvm_ver = IWL8000_NVM_VERSION,
+        .nvm_calib_ver = IWL8000_TX_POWER_VERSION,
+        .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
+};
+
 const struct iwl_cfg iwl8260_2ac_sdio_cfg = {
         .name = "Intel(R) Dual Band Wireless-AC 8260",
         .fw_name_pre = IWL8000_FW_PRE,
@@ -153,6 +178,7 @@ const struct iwl_cfg iwl8260_2ac_sdio_cfg = {
         .nvm_ver = IWL8000_NVM_VERSION,
         .nvm_calib_ver = IWL8000_TX_POWER_VERSION,
         .default_nvm_file = DEFAULT_NVM_FILE_FAMILY_8000,
+        .default_nvm_file_8000A = DEFAULT_NVM_FILE_FAMILY_8000A,
         .max_rx_agg_size = MAX_RX_AGG_SIZE_8260_SDIO,
         .disable_dummy_notification = true,
         .max_ht_ampdu_exponent  = MAX_HT_AMPDU_EXPONENT_8260_SDIO,
@@ -167,6 +193,7 @@ const struct iwl_cfg iwl4165_2ac_sdio_cfg = {
         .nvm_ver = IWL8000_NVM_VERSION,
         .nvm_calib_ver = IWL8000_TX_POWER_VERSION,
         .default_nvm_file = DEFAULT_NVM_FILE_FAMILY_8000,
+        .default_nvm_file_8000A = DEFAULT_NVM_FILE_FAMILY_8000A,
         .max_rx_agg_size = MAX_RX_AGG_SIZE_8260_SDIO,
         .bt_shared_single_ant = true,
         .disable_dummy_notification = true,
diff --git a/drivers/net/wireless/iwlwifi/iwl-config.h b/drivers/net/wireless/iwlwifi/iwl-config.h
index 3a4b9c7fc083..4b190d98a1ec 100644
--- a/drivers/net/wireless/iwlwifi/iwl-config.h
+++ b/drivers/net/wireless/iwlwifi/iwl-config.h
@@ -126,7 +126,7 @@ enum iwl_led_mode {
 
 /* TX queue watchdog timeouts in mSecs */
 #define IWL_WATCHDOG_DISABLED   0
-#define IWL_DEF_WD_TIMEOUT      2000
+#define IWL_DEF_WD_TIMEOUT      2500
 #define IWL_LONG_WD_TIMEOUT     10000
 #define IWL_MAX_WD_TIMEOUT      120000
 
@@ -261,6 +261,12 @@ struct iwl_pwr_tx_backoff {
  *      station can receive in HT
  * @max_vht_ampdu_exponent: the exponent of the max length of A-MPDU that the
  *      station can receive in VHT
+ * @dccm_offset: offset from which DCCM begins
+ * @dccm_len: length of DCCM (including runtime stack CCM)
+ * @dccm2_offset: offset from which the second DCCM begins
+ * @dccm2_len: length of the second DCCM
+ * @smem_offset: offset from which the SMEM begins
+ * @smem_len: the length of SMEM
  *
  * We enable the driver to be backward compatible wrt. hardware features.
  * API differences in uCode shouldn't be handled here but through TLVs
@@ -298,11 +304,18 @@ struct iwl_cfg {
         const struct iwl_pwr_tx_backoff *pwr_tx_backoffs;
         bool no_power_up_nic_in_init;
         const char *default_nvm_file;
+        const char *default_nvm_file_8000A;
         unsigned int max_rx_agg_size;
         bool disable_dummy_notification;
         unsigned int max_tx_agg_size;
         unsigned int max_ht_ampdu_exponent;
         unsigned int max_vht_ampdu_exponent;
+        const u32 dccm_offset;
+        const u32 dccm_len;
+        const u32 dccm2_offset;
+        const u32 dccm2_len;
+        const u32 smem_offset;
+        const u32 smem_len;
 };
 
 /*
@@ -369,8 +382,8 @@ extern const struct iwl_cfg iwl7265d_2n_cfg;
 extern const struct iwl_cfg iwl7265d_n_cfg;
 extern const struct iwl_cfg iwl8260_2n_cfg;
 extern const struct iwl_cfg iwl8260_2ac_cfg;
+extern const struct iwl_cfg iwl4165_2ac_cfg;
 extern const struct iwl_cfg iwl8260_2ac_sdio_cfg;
-extern const struct iwl_cfg iwl4265_2ac_sdio_cfg;
 extern const struct iwl_cfg iwl4165_2ac_sdio_cfg;
 #endif /* CONFIG_IWLMVM */
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-csr.h b/drivers/net/wireless/iwlwifi/iwl-csr.h
index aff63c3f5bf8..faa17f2e352a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-csr.h
+++ b/drivers/net/wireless/iwlwifi/iwl-csr.h
@@ -184,6 +184,7 @@
 #define CSR_HW_IF_CONFIG_REG_BIT_NIC_READY      (0x00400000) /* PCI_OWN_SEM */
 #define CSR_HW_IF_CONFIG_REG_BIT_NIC_PREPARE_DONE (0x02000000) /* ME_OWN */
 #define CSR_HW_IF_CONFIG_REG_PREPARE              (0x08000000) /* WAKE_ME */
+#define CSR_HW_IF_CONFIG_REG_ENABLE_PME           (0x10000000)
 #define CSR_HW_IF_CONFIG_REG_PERSIST_MODE         (0x40000000) /* PERSISTENCE */
 
 #define CSR_MBOX_SET_REG_OS_ALIVE               BIT(5)
@@ -306,6 +307,7 @@
 enum {
         SILICON_A_STEP = 0,
         SILICON_B_STEP,
+        SILICON_C_STEP,
 };
 
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-drv.c b/drivers/net/wireless/iwlwifi/iwl-drv.c
index 850b85a47806..996e7f16adf9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/iwlwifi/iwl-drv.c
@@ -84,21 +84,8 @@
  *
  ******************************************************************************/
 
-/*
- * module name, copyright, version, etc.
- */
 #define DRV_DESCRIPTION "Intel(R) Wireless WiFi driver for Linux"
-
-#ifdef CONFIG_IWLWIFI_DEBUG
-#define VD "d"
-#else
-#define VD
-#endif
-
-#define DRV_VERSION     IWLWIFI_VERSION VD
-
 MODULE_DESCRIPTION(DRV_DESCRIPTION);
-MODULE_VERSION(DRV_VERSION);
 MODULE_AUTHOR(DRV_COPYRIGHT " " DRV_AUTHOR);
 MODULE_LICENSE("GPL");
 
@@ -250,9 +237,6 @@ static int iwl_request_firmware(struct iwl_drv *drv, bool first)
         /*
          * Starting 8000B - FW name format has changed. This overwrites the
          * previous name and uses the new format.
-         *
-         * TODO:
-         * Once there is only one supported step for 8000 family - delete this!
          */
         if (drv->trans->cfg->device_family == IWL_DEVICE_FAMILY_8000) {
                 char rev_step[2] = {
@@ -263,13 +247,6 @@ static int iwl_request_firmware(struct iwl_drv *drv, bool first)
                 if (CSR_HW_REV_STEP(drv->trans->hw_rev) == SILICON_A_STEP)
                         rev_step[0] = 0;
 
-                /*
-                 * If hw_rev wasn't set yet - default as B-step. If it IS A-step
-                 * we'll reload that FW later instead.
-                 */
-                if (drv->trans->hw_rev == 0)
-                        rev_step[0] = 'B';
-
                 snprintf(drv->firmware_name, sizeof(drv->firmware_name),
                          "%s%s-%s.ucode", name_pre, rev_step, tag);
         }
@@ -926,6 +903,12 @@ static int iwl_parse_tlv_firmware(struct iwl_drv *drv,
                                             IWL_UCODE_REGULAR_USNIFFER,
                                             tlv_len);
                         break;
+                case IWL_UCODE_TLV_SDIO_ADMA_ADDR:
+                        if (tlv_len != sizeof(u32))
+                                goto invalid_tlv_len;
+                        drv->fw.sdio_adma_addr =
+                                le32_to_cpup((__le32 *)tlv_data);
+                        break;
                 default:
                         IWL_DEBUG_INFO(drv, "unknown TLV: %d\n", tlv_type);
                         break;
@@ -1082,7 +1065,6 @@ static void iwl_req_fw_callback(const struct firmware *ucode_raw, void *context)
         u32 api_ver;
         int i;
         bool load_module = false;
-        u32 hw_rev = drv->trans->hw_rev;
 
         fw->ucode_capa.max_probe_length = IWL_DEFAULT_MAX_PROBE_LENGTH;
         fw->ucode_capa.standard_phy_calibration_size =
@@ -1275,50 +1257,6 @@ static void iwl_req_fw_callback(const struct firmware *ucode_raw, void *context)
                                 op->name, err);
 #endif
         }
-
-        /*
-         * We may have loaded the wrong FW file in 8000 HW family if it is an
-         * A-step card, and if drv->trans->hw_rev wasn't properly read when
-         * the FW file had been loaded. (This might happen in SDIO.) In such a
-         * case - unload and reload the correct file.
-         *
-         * TODO:
-         * Once there is only one supported step for 8000 family - delete this!
-         */
-        if (drv->trans->cfg->device_family == IWL_DEVICE_FAMILY_8000 &&
-            CSR_HW_REV_STEP(drv->trans->hw_rev) == SILICON_A_STEP &&
-            drv->trans->hw_rev != hw_rev) {
-                char firmware_name[32];
-
-                /* Free previous FW resources */
-                if (drv->op_mode)
-                        _iwl_op_mode_stop(drv);
-                iwl_dealloc_ucode(drv);
-
-                /* Build name of correct-step FW */
-                snprintf(firmware_name, sizeof(firmware_name),
-                         strrchr(drv->firmware_name, '-'));
-                snprintf(drv->firmware_name, sizeof(drv->firmware_name),
-                         "%s%s", drv->cfg->fw_name_pre, firmware_name);
-
-                /* Clear data before loading correct FW */
-                list_del(&drv->list);
-
-                /* Request correct FW file this time */
-                IWL_DEBUG_INFO(drv, "attempting to load A-step FW %s\n",
-                               drv->firmware_name);
-                err = request_firmware(&ucode_raw, drv->firmware_name,
-                                       drv->trans->dev);
-                if (err) {
-                        IWL_ERR(drv, "Failed swapping FW!\n");
-                        goto out_unbind;
-                }
-
-                /* Redo callback function - this time with right FW */
-                iwl_req_fw_callback(ucode_raw, context);
-        }
-
-        kfree(pieces);
         return;
 
  try_again:
@@ -1429,7 +1367,7 @@ struct iwl_mod_params iwlwifi_mod_params = {
         .restart_fw = true,
         .bt_coex_active = true,
         .power_level = IWL_POWER_INDEX_1,
-        .wd_disable = true,
+        .d0i3_disable = true,
 #ifndef CONFIG_IWLWIFI_UAPSD
         .uapsd_disable = true,
 #endif /* CONFIG_IWLWIFI_UAPSD */
@@ -1492,7 +1430,7 @@ static int __init iwl_drv_init(void)
         for (i = 0; i < ARRAY_SIZE(iwlwifi_opmode_table); i++)
                 INIT_LIST_HEAD(&iwlwifi_opmode_table[i].drv);
 
-        pr_info(DRV_DESCRIPTION ", " DRV_VERSION "\n");
+        pr_info(DRV_DESCRIPTION "\n");
         pr_info(DRV_COPYRIGHT "\n");
 
 #ifdef CONFIG_IWLWIFI_DEBUGFS
@@ -1539,15 +1477,15 @@ module_param_named(antenna_coupling, iwlwifi_mod_params.ant_coupling,
 MODULE_PARM_DESC(antenna_coupling,
                  "specify antenna coupling in dB (default: 0 dB)");
 
-module_param_named(wd_disable, iwlwifi_mod_params.wd_disable, int, S_IRUGO);
-MODULE_PARM_DESC(wd_disable,
-                "Disable stuck queue watchdog timer 0=system default, 1=disable (default: 1)");
-
 module_param_named(nvm_file, iwlwifi_mod_params.nvm_file, charp, S_IRUGO);
 MODULE_PARM_DESC(nvm_file, "NVM file name");
 
-module_param_named(uapsd_disable, iwlwifi_mod_params.uapsd_disable,
+module_param_named(d0i3_disable, iwlwifi_mod_params.d0i3_disable,
                    bool, S_IRUGO);
+MODULE_PARM_DESC(d0i3_disable, "disable d0i3 functionality (default: Y)");
+
+module_param_named(uapsd_disable, iwlwifi_mod_params.uapsd_disable,
+                   bool, S_IRUGO | S_IWUSR);
 #ifdef CONFIG_IWLWIFI_UAPSD
 MODULE_PARM_DESC(uapsd_disable, "disable U-APSD functionality (default: N)");
 #else
diff --git a/drivers/net/wireless/iwlwifi/iwl-drv.h b/drivers/net/wireless/iwlwifi/iwl-drv.h
index be4f8972241a..adf522c756e6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-drv.h
+++ b/drivers/net/wireless/iwlwifi/iwl-drv.h
@@ -68,7 +68,6 @@
 
 /* for all modules */
 #define DRV_NAME        "iwlwifi"
-#define IWLWIFI_VERSION "in-tree:"
 #define DRV_COPYRIGHT   "Copyright(c) 2003- 2014 Intel Corporation"
 #define DRV_AUTHOR     "<ilw@linux.intel.com>"
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-fw-error-dump.h b/drivers/net/wireless/iwlwifi/iwl-fw-error-dump.h
index 20a8a64c9fe3..919a2548a92c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fw-error-dump.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fw-error-dump.h
@@ -71,7 +71,6 @@
 
 /**
  * enum iwl_fw_error_dump_type - types of data in the dump file
- * @IWL_FW_ERROR_DUMP_SRAM:
  * @IWL_FW_ERROR_DUMP_CSR: Control Status Registers - from offset 0
  * @IWL_FW_ERROR_DUMP_RXF:
  * @IWL_FW_ERROR_DUMP_TXCMD: last TX command data, structured as
@@ -82,9 +81,10 @@
  * @IWL_FW_ERROR_DUMP_PRPH: range of periphery registers - there can be several
  *      sections like this in a single file.
  * @IWL_FW_ERROR_DUMP_FH_REGS: range of FH registers
+ * @IWL_FW_ERROR_DUMP_MEM: chunk of memory
  */
 enum iwl_fw_error_dump_type {
-        IWL_FW_ERROR_DUMP_SRAM = 0,
+        /* 0 is deprecated */
         IWL_FW_ERROR_DUMP_CSR = 1,
         IWL_FW_ERROR_DUMP_RXF = 2,
         IWL_FW_ERROR_DUMP_TXCMD = 3,
@@ -93,6 +93,7 @@ enum iwl_fw_error_dump_type {
         IWL_FW_ERROR_DUMP_PRPH = 6,
         IWL_FW_ERROR_DUMP_TXF = 7,
         IWL_FW_ERROR_DUMP_FH_REGS = 8,
+        IWL_FW_ERROR_DUMP_MEM = 9,
 
         IWL_FW_ERROR_DUMP_MAX,
 };
@@ -133,6 +134,27 @@ struct iwl_fw_error_dump_txcmd {
         u8 data[];
 } __packed;
 
+/**
+ * struct iwl_fw_error_dump_fifo - RX/TX FIFO data
+ * @fifo_num: number of FIFO (starting from 0)
+ * @available_bytes: num of bytes available in FIFO (may be less than FIFO size)
+ * @wr_ptr: position of write pointer
+ * @rd_ptr: position of read pointer
+ * @fence_ptr: position of fence pointer
+ * @fence_mode: the current mode of the fence (before locking) -
+ *      0=follow RD pointer ; 1 = freeze
+ * @data: all of the FIFO's data
+ */
+struct iwl_fw_error_dump_fifo {
+        __le32 fifo_num;
+        __le32 available_bytes;
+        __le32 wr_ptr;
+        __le32 rd_ptr;
+        __le32 fence_ptr;
+        __le32 fence_mode;
+        u8 data[];
+} __packed;
+
 enum iwl_fw_error_dump_family {
         IWL_FW_ERROR_DUMP_FAMILY_7 = 7,
         IWL_FW_ERROR_DUMP_FAMILY_8 = 8,
@@ -180,6 +202,23 @@ struct iwl_fw_error_dump_prph {
         __le32 data[];
 };
 
+enum iwl_fw_error_dump_mem_type {
+        IWL_FW_ERROR_DUMP_MEM_SRAM,
+        IWL_FW_ERROR_DUMP_MEM_SMEM,
+};
+
+/**
+ * struct iwl_fw_error_dump_mem - chunk of memory
+ * @type: %enum iwl_fw_error_dump_mem_type
+ * @offset: the offset from which the memory was read
+ * @data: the content of the memory
+ */
+struct iwl_fw_error_dump_mem {
+        __le32 type;
+        __le32 offset;
+        u8 data[];
+};
+
 /**
  * iwl_fw_error_next_data - advance fw error dump data pointer
  * @data: previous data block
diff --git a/drivers/net/wireless/iwlwifi/iwl-fw-file.h b/drivers/net/wireless/iwlwifi/iwl-fw-file.h
index 660ddb1b7d8a..016d91384681 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fw-file.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fw-file.h
@@ -132,6 +132,7 @@ enum iwl_ucode_tlv_type {
         IWL_UCODE_TLV_ENABLED_CAPABILITIES      = 30,
         IWL_UCODE_TLV_N_SCAN_CHANNELS           = 31,
         IWL_UCODE_TLV_SEC_RT_USNIFFER   = 34,
+        IWL_UCODE_TLV_SDIO_ADMA_ADDR    = 35,
         IWL_UCODE_TLV_FW_DBG_DEST       = 38,
         IWL_UCODE_TLV_FW_DBG_CONF       = 39,
 };
@@ -234,31 +235,34 @@ enum iwl_ucode_tlv_flag {
 
 /**
  * enum iwl_ucode_tlv_api - ucode api
- * @IWL_UCODE_TLV_API_WOWLAN_CONFIG_TID: wowlan config includes tid field.
- * @IWL_UCODE_TLV_CAPA_EXTENDED_BEACON: Support Extended beacon notification
  * @IWL_UCODE_TLV_API_BT_COEX_SPLIT: new API for BT Coex
- * @IWL_UCODE_TLV_API_CSA_FLOW: ucode can do unbind-bind flow for CSA.
  * @IWL_UCODE_TLV_API_DISABLE_STA_TX: ucode supports tx_disable bit.
  * @IWL_UCODE_TLV_API_LMAC_SCAN: This ucode uses LMAC unified scan API.
  * @IWL_UCODE_TLV_API_SF_NO_DUMMY_NOTIF: ucode supports disabling dummy notif.
  * @IWL_UCODE_TLV_API_FRAGMENTED_SCAN: This ucode supports active dwell time
  *      longer than the passive one, which is essential for fragmented scan.
+ * IWL_UCODE_TLV_API_HDC_PHASE_0: ucode supports finer configuration of LTR
  * @IWL_UCODE_TLV_API_BASIC_DWELL: use only basic dwell time in scan command,
  *      regardless of the band or the number of the probes. FW will calculate
  *      the actual dwell time.
+ * @IWL_UCODE_TLV_API_SCD_CFG: This firmware can configure the scheduler
+ *      through the dedicated host command.
  * @IWL_UCODE_TLV_API_SINGLE_SCAN_EBS: EBS is supported for single scans too.
+ * @IWL_UCODE_TLV_API_ASYNC_DTM: Async temperature notifications are supported.
+ * @IWL_UCODE_TLV_API_LQ_SS_PARAMS: Configure STBC/BFER via LQ CMD ss_params
  */
 enum iwl_ucode_tlv_api {
-        IWL_UCODE_TLV_API_WOWLAN_CONFIG_TID     = BIT(0),
-        IWL_UCODE_TLV_CAPA_EXTENDED_BEACON      = BIT(1),
         IWL_UCODE_TLV_API_BT_COEX_SPLIT         = BIT(3),
-        IWL_UCODE_TLV_API_CSA_FLOW              = BIT(4),
         IWL_UCODE_TLV_API_DISABLE_STA_TX        = BIT(5),
         IWL_UCODE_TLV_API_LMAC_SCAN             = BIT(6),
         IWL_UCODE_TLV_API_SF_NO_DUMMY_NOTIF     = BIT(7),
         IWL_UCODE_TLV_API_FRAGMENTED_SCAN       = BIT(8),
+        IWL_UCODE_TLV_API_HDC_PHASE_0           = BIT(10),
         IWL_UCODE_TLV_API_BASIC_DWELL           = BIT(13),
+        IWL_UCODE_TLV_API_SCD_CFG               = BIT(15),
         IWL_UCODE_TLV_API_SINGLE_SCAN_EBS       = BIT(16),
+        IWL_UCODE_TLV_API_ASYNC_DTM             = BIT(17),
+        IWL_UCODE_TLV_API_LQ_SS_PARAMS          = BIT(18),
 };
 
 /**
@@ -266,6 +270,7 @@ enum iwl_ucode_tlv_api {
  * @IWL_UCODE_TLV_CAPA_D0I3_SUPPORT: supports D0i3
  * @IWL_UCODE_TLV_CAPA_LAR_SUPPORT: supports Location Aware Regulatory
  * @IWL_UCODE_TLV_CAPA_UMAC_SCAN: supports UMAC scan.
+ * @IWL_UCODE_TLV_CAPA_BEAMFORMER: supports Beamformer
  * @IWL_UCODE_TLV_CAPA_TDLS_SUPPORT: support basic TDLS functionality
  * @IWL_UCODE_TLV_CAPA_TXPOWER_INSERTION_SUPPORT: supports insertion of current
  *      tx power value into TPC Report action frame and Link Measurement Report
@@ -284,6 +289,7 @@ enum iwl_ucode_tlv_capa {
         IWL_UCODE_TLV_CAPA_D0I3_SUPPORT                 = BIT(0),
         IWL_UCODE_TLV_CAPA_LAR_SUPPORT                  = BIT(1),
         IWL_UCODE_TLV_CAPA_UMAC_SCAN                    = BIT(2),
+        IWL_UCODE_TLV_CAPA_BEAMFORMER                   = BIT(3),
         IWL_UCODE_TLV_CAPA_TDLS_SUPPORT                 = BIT(6),
         IWL_UCODE_TLV_CAPA_TXPOWER_INSERTION_SUPPORT    = BIT(8),
         IWL_UCODE_TLV_CAPA_DS_PARAM_SET_IE_SUPPORT      = BIT(9),
diff --git a/drivers/net/wireless/iwlwifi/iwl-fw.h b/drivers/net/wireless/iwlwifi/iwl-fw.h
index e6dc3b870949..ffd785cc67d6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fw.h
@@ -152,6 +152,8 @@ struct iwl_fw_cscheme_list {
  * @mvm_fw: indicates this is MVM firmware
  * @cipher_scheme: optional external cipher scheme.
  * @human_readable: human readable version
+ * @sdio_adma_addr: the default address to set for the ADMA in SDIO mode until
+ *      we get the ALIVE from the uCode
  * @dbg_dest_tlv: points to the destination TLV for debug
  * @dbg_conf_tlv: array of pointers to configuration TLVs for debug
  * @dbg_conf_tlv_len: lengths of the @dbg_conf_tlv entries
@@ -181,6 +183,8 @@ struct iwl_fw {
         struct ieee80211_cipher_scheme cs[IWL_UCODE_MAX_CS];
         u8 human_readable[FW_VER_HUMAN_READABLE_SZ];
 
+        u32 sdio_adma_addr;
+
         struct iwl_fw_dbg_dest_tlv *dbg_dest_tlv;
         struct iwl_fw_dbg_conf_tlv *dbg_conf_tlv[FW_DBG_MAX];
         size_t dbg_conf_tlv_len[FW_DBG_MAX];
diff --git a/drivers/net/wireless/iwlwifi/iwl-io.c b/drivers/net/wireless/iwlwifi/iwl-io.c
index 7a2cbf6f90db..03250a45272e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-io.c
+++ b/drivers/net/wireless/iwlwifi/iwl-io.c
@@ -193,11 +193,15 @@ void iwl_force_nmi(struct iwl_trans *trans)
          * DEVICE_SET_NMI_8000B_REG - is used.
          */
         if ((trans->cfg->device_family != IWL_DEVICE_FAMILY_8000) ||
-            (CSR_HW_REV_STEP(trans->hw_rev) == SILICON_A_STEP))
-                iwl_write_prph(trans, DEVICE_SET_NMI_REG, DEVICE_SET_NMI_VAL);
-        else
+            (CSR_HW_REV_STEP(trans->hw_rev) == SILICON_A_STEP)) {
+                iwl_write_prph(trans, DEVICE_SET_NMI_REG,
+                               DEVICE_SET_NMI_VAL_DRV);
+                iwl_write_prph(trans, DEVICE_SET_NMI_REG,
+                               DEVICE_SET_NMI_VAL_HW);
+        } else {
                 iwl_write_prph(trans, DEVICE_SET_NMI_8000B_REG,
                                DEVICE_SET_NMI_8000B_VAL);
+        }
 }
 IWL_EXPORT_SYMBOL(iwl_force_nmi);
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-modparams.h b/drivers/net/wireless/iwlwifi/iwl-modparams.h
index 71507cf490e6..e8eabd21ccfe 100644
--- a/drivers/net/wireless/iwlwifi/iwl-modparams.h
+++ b/drivers/net/wireless/iwlwifi/iwl-modparams.h
@@ -96,13 +96,13 @@ enum iwl_disable_11n {
  *      use IWL_[DIS,EN]ABLE_HT_* constants
  * @amsdu_size_8K: enable 8K amsdu size, default = 0
  * @restart_fw: restart firmware, default = 1
- * @wd_disable: disable stuck queue check, default = 1
  * @bt_coex_active: enable bt coex, default = true
  * @led_mode: system default, default = 0
  * @power_save: enable power save, default = false
  * @power_level: power level, default = 1
  * @debug_level: levels are IWL_DL_*
  * @ant_coupling: antenna coupling in dB, default = 0
+ * @d0i3_disable: disable d0i3, default = 1,
  * @fw_monitor: allow to use firmware monitor
  */
 struct iwl_mod_params {
@@ -110,7 +110,6 @@ struct iwl_mod_params {
         unsigned int disable_11n;
         int amsdu_size_8K;
         bool restart_fw;
-        int  wd_disable;
         bool bt_coex_active;
         int led_mode;
         bool power_save;
@@ -121,6 +120,7 @@ struct iwl_mod_params {
         int ant_coupling;
         char *nvm_file;
         bool uapsd_disable;
+        bool d0i3_disable;
         bool fw_monitor;
 };
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
index 06e02fcd6f7b..c74f1a4edf23 100644
--- a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
+++ b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
@@ -468,6 +468,8 @@ static void iwl_set_radio_cfg(const struct iwl_cfg *cfg,
         data->radio_cfg_step = NVM_RF_CFG_STEP_MSK_FAMILY_8000(radio_cfg);
         data->radio_cfg_dash = NVM_RF_CFG_DASH_MSK_FAMILY_8000(radio_cfg);
         data->radio_cfg_pnum = NVM_RF_CFG_FLAVOR_MSK_FAMILY_8000(radio_cfg);
+        data->valid_tx_ant = NVM_RF_CFG_TX_ANT_MSK_FAMILY_8000(radio_cfg);
+        data->valid_rx_ant = NVM_RF_CFG_RX_ANT_MSK_FAMILY_8000(radio_cfg);
 }
 
 static void iwl_set_hw_address(const struct iwl_cfg *cfg,
@@ -592,6 +594,10 @@ iwl_parse_nvm_data(struct device *dev, const struct iwl_cfg *cfg,
 
         radio_cfg = iwl_get_radio_cfg(cfg, nvm_sw);
         iwl_set_radio_cfg(cfg, data, radio_cfg);
+        if (data->valid_tx_ant)
+                tx_chains &= data->valid_tx_ant;
+        if (data->valid_rx_ant)
+                rx_chains &= data->valid_rx_ant;
 
         sku = iwl_get_sku(cfg, nvm_sw);
         data->sku_cap_band_24GHz_enable = sku & NVM_SKU_CAP_BAND_24GHZ;
diff --git a/drivers/net/wireless/iwlwifi/iwl-prph.h b/drivers/net/wireless/iwlwifi/iwl-prph.h
index 2df51eab1348..6221e4dfc64f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-prph.h
+++ b/drivers/net/wireless/iwlwifi/iwl-prph.h
@@ -99,6 +99,7 @@
 
 #define APMG_PCIDEV_STT_VAL_PERSIST_DIS (0x00000200)
 #define APMG_PCIDEV_STT_VAL_L1_ACT_DIS  (0x00000800)
+#define APMG_PCIDEV_STT_VAL_WAKE_ME     (0x00004000)
 
 #define APMG_RTC_INT_STT_RFKILL         (0x10000000)
 
@@ -107,7 +108,8 @@
 
 /* Device NMI register */
 #define DEVICE_SET_NMI_REG 0x00a01c30
-#define DEVICE_SET_NMI_VAL 0x1
+#define DEVICE_SET_NMI_VAL_HW BIT(0)
+#define DEVICE_SET_NMI_VAL_DRV BIT(7)
 #define DEVICE_SET_NMI_8000B_REG 0x00a01c24
 #define DEVICE_SET_NMI_8000B_VAL 0x1000000
 
@@ -250,6 +252,7 @@
 #define SCD_QUEUE_CTX_REG2_WIN_SIZE_MSK         (0x0000007F)
 #define SCD_QUEUE_CTX_REG2_FRAME_LIMIT_POS      (16)
 #define SCD_QUEUE_CTX_REG2_FRAME_LIMIT_MSK      (0x007F0000)
+#define SCD_GP_CTRL_ENABLE_31_QUEUES            BIT(0)
 
 /* Context Data */
 #define SCD_CONTEXT_MEM_LOWER_BOUND     (SCD_MEM_LOWER_BOUND + 0x600)
@@ -283,32 +286,9 @@
 #define SCD_CHAINEXT_EN         (SCD_BASE + 0x244)
 #define SCD_AGGR_SEL            (SCD_BASE + 0x248)
 #define SCD_INTERRUPT_MASK      (SCD_BASE + 0x108)
+#define SCD_GP_CTRL             (SCD_BASE + 0x1a8)
 #define SCD_EN_CTRL             (SCD_BASE + 0x254)
 
-static inline unsigned int SCD_QUEUE_WRPTR(unsigned int chnl)
-{
-        if (chnl < 20)
-                return SCD_BASE + 0x18 + chnl * 4;
-        WARN_ON_ONCE(chnl >= 32);
-        return SCD_BASE + 0x284 + (chnl - 20) * 4;
-}
-
-static inline unsigned int SCD_QUEUE_RDPTR(unsigned int chnl)
-{
-        if (chnl < 20)
-                return SCD_BASE + 0x68 + chnl * 4;
-        WARN_ON_ONCE(chnl >= 32);
-        return SCD_BASE + 0x2B4 + (chnl - 20) * 4;
-}
-
-static inline unsigned int SCD_QUEUE_STATUS_BITS(unsigned int chnl)
-{
-        if (chnl < 20)
-                return SCD_BASE + 0x10c + chnl * 4;
-        WARN_ON_ONCE(chnl >= 32);
-        return SCD_BASE + 0x384 + (chnl - 20) * 4;
-}
-
 /*********************** END TX SCHEDULER *************************************/
 
 /* Oscillator clock */
@@ -358,18 +338,40 @@ enum secure_load_status_reg {
 
 /* Rx FIFO */
 #define RXF_SIZE_ADDR                   (0xa00c88)
+#define RXF_RD_D_SPACE                  (0xa00c40)
+#define RXF_RD_WR_PTR                   (0xa00c50)
+#define RXF_RD_RD_PTR                   (0xa00c54)
+#define RXF_RD_FENCE_PTR                (0xa00c4c)
+#define RXF_SET_FENCE_MODE              (0xa00c14)
+#define RXF_LD_WR2FENCE         (0xa00c1c)
+#define RXF_FIFO_RD_FENCE_INC           (0xa00c68)
 #define RXF_SIZE_BYTE_CND_POS           (7)
 #define RXF_SIZE_BYTE_CNT_MSK           (0x3ff << RXF_SIZE_BYTE_CND_POS)
+#define RXF_DIFF_FROM_PREV              (0x200)
 
 #define RXF_LD_FENCE_OFFSET_ADDR        (0xa00c10)
 #define RXF_FIFO_RD_FENCE_ADDR          (0xa00c0c)
 
+/* Tx FIFO */
+#define TXF_FIFO_ITEM_CNT               (0xa00438)
+#define TXF_WR_PTR                      (0xa00414)
+#define TXF_RD_PTR                      (0xa00410)
+#define TXF_FENCE_PTR                   (0xa00418)
+#define TXF_LOCK_FENCE                  (0xa00424)
+#define TXF_LARC_NUM                    (0xa0043c)
+#define TXF_READ_MODIFY_DATA            (0xa00448)
+#define TXF_READ_MODIFY_ADDR            (0xa0044c)
+
 /* FW monitor */
+#define MON_BUFF_SAMPLE_CTL             (0xa03c00)
 #define MON_BUFF_BASE_ADDR              (0xa03c3c)
 #define MON_BUFF_END_ADDR               (0xa03c40)
 #define MON_BUFF_WRPTR                  (0xa03c44)
 #define MON_BUFF_CYCLE_CNT              (0xa03c48)
 
+#define DBGC_IN_SAMPLE                  (0xa03c00)
+#define DBGC_OUT_CTRL                   (0xa03c0c)
+
 /* FW chicken bits */
 #define LMPM_CHICK                      0xA01FF8
 enum {
diff --git a/drivers/net/wireless/iwlwifi/iwl-scd.h b/drivers/net/wireless/iwlwifi/iwl-scd.h
index 6c622b21bba7..f2353ebf2666 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scd.h
+++ b/drivers/net/wireless/iwlwifi/iwl-scd.h
@@ -69,14 +69,6 @@
 #include "iwl-prph.h"
 
 
-static inline void iwl_scd_txq_set_inactive(struct iwl_trans *trans,
-                                            u16 txq_id)
-{
-        iwl_write_prph(trans, SCD_QUEUE_STATUS_BITS(txq_id),
-                       (0 << SCD_QUEUE_STTS_REG_POS_ACTIVE)|
-                       (1 << SCD_QUEUE_STTS_REG_POS_SCD_ACT_EN));
-}
-
 static inline void iwl_scd_txq_set_chain(struct iwl_trans *trans,
                                          u16 txq_id)
 {
@@ -115,4 +107,37 @@ static inline void iwl_scd_enable_set_active(struct iwl_trans *trans,
 {
         iwl_write_prph(trans, SCD_EN_CTRL, value);
 }
+
+static inline unsigned int SCD_QUEUE_WRPTR(unsigned int chnl)
+{
+        if (chnl < 20)
+                return SCD_BASE + 0x18 + chnl * 4;
+        WARN_ON_ONCE(chnl >= 32);
+        return SCD_BASE + 0x284 + (chnl - 20) * 4;
+}
+
+static inline unsigned int SCD_QUEUE_RDPTR(unsigned int chnl)
+{
+        if (chnl < 20)
+                return SCD_BASE + 0x68 + chnl * 4;
+        WARN_ON_ONCE(chnl >= 32);
+        return SCD_BASE + 0x2B4 + chnl * 4;
+}
+
+static inline unsigned int SCD_QUEUE_STATUS_BITS(unsigned int chnl)
+{
+        if (chnl < 20)
+                return SCD_BASE + 0x10c + chnl * 4;
+        WARN_ON_ONCE(chnl >= 32);
+        return SCD_BASE + 0x334 + chnl * 4;
+}
+
+static inline void iwl_scd_txq_set_inactive(struct iwl_trans *trans,
+                                            u16 txq_id)
+{
+        iwl_write_prph(trans, SCD_QUEUE_STATUS_BITS(txq_id),
+                       (0 << SCD_QUEUE_STTS_REG_POS_ACTIVE)|
+                       (1 << SCD_QUEUE_STTS_REG_POS_SCD_ACT_EN));
+}
+
 #endif
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans.h b/drivers/net/wireless/iwlwifi/iwl-trans.h
index 028408a6ecba..a96bd8db6ceb 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans.h
+++ b/drivers/net/wireless/iwlwifi/iwl-trans.h
@@ -368,6 +368,7 @@ enum iwl_trans_status {
  * @cmd_queue: the index of the command queue.
  *      Must be set before start_fw.
  * @cmd_fifo: the fifo for host commands
+ * @cmd_q_wdg_timeout: the timeout of the watchdog timer for the command queue.
  * @no_reclaim_cmds: Some devices erroneously don't set the
  *      SEQ_RX_FRAME bit on some notifications, this is the
  *      list of such notifications to filter. Max length is
@@ -378,24 +379,26 @@ enum iwl_trans_status {
  * @bc_table_dword: set to true if the BC table expects the byte count to be
  *      in DWORD (as opposed to bytes)
  * @scd_set_active: should the transport configure the SCD for HCMD queue
- * @queue_watchdog_timeout: time (in ms) after which queues
- *      are considered stuck and will trigger device restart
  * @command_names: array of command names, must be 256 entries
  *      (one for each command); for debugging only
+ * @sdio_adma_addr: the default address to set for the ADMA in SDIO mode until
+ *      we get the ALIVE from the uCode
  */
 struct iwl_trans_config {
         struct iwl_op_mode *op_mode;
 
         u8 cmd_queue;
         u8 cmd_fifo;
+        unsigned int cmd_q_wdg_timeout;
         const u8 *no_reclaim_cmds;
         unsigned int n_no_reclaim_cmds;
 
         bool rx_buf_size_8k;
         bool bc_table_dword;
         bool scd_set_active;
-        unsigned int queue_watchdog_timeout;
         const char *const *command_names;
+
+        u32 sdio_adma_addr;
 };
 
 struct iwl_trans_dump_data {
@@ -507,7 +510,8 @@ struct iwl_trans_ops {
                         struct sk_buff_head *skbs);
 
         void (*txq_enable)(struct iwl_trans *trans, int queue, u16 ssn,
-                           const struct iwl_trans_txq_scd_cfg *cfg);
+                           const struct iwl_trans_txq_scd_cfg *cfg,
+                           unsigned int queue_wdg_timeout);
         void (*txq_disable)(struct iwl_trans *trans, int queue,
                             bool configure_scd);
 
@@ -552,6 +556,21 @@ enum iwl_trans_state {
 };
 
 /**
+ * enum iwl_d0i3_mode - d0i3 mode
+ *
+ * @IWL_D0I3_MODE_OFF - d0i3 is disabled
+ * @IWL_D0I3_MODE_ON_IDLE - enter d0i3 when device is idle
+ *      (e.g. no active references)
+ * @IWL_D0I3_MODE_ON_SUSPEND - enter d0i3 only on suspend
+ *      (in case of 'any' trigger)
+ */
+enum iwl_d0i3_mode {
+        IWL_D0I3_MODE_OFF = 0,
+        IWL_D0I3_MODE_ON_IDLE,
+        IWL_D0I3_MODE_ON_SUSPEND,
+};
+
+/**
  * struct iwl_trans - transport common data
  *
  * @ops - pointer to iwl_trans_ops
@@ -612,6 +631,8 @@ struct iwl_trans {
         const struct iwl_fw_dbg_conf_tlv *dbg_conf_tlv[FW_DBG_MAX];
         u8 dbg_dest_reg_num;
 
+        enum iwl_d0i3_mode d0i3_mode;
+
         /* pointer to trans specific struct */
         /*Ensure that this pointer will always be aligned to sizeof pointer */
         char trans_specific[0] __aligned(sizeof(void *));
@@ -808,19 +829,21 @@ static inline void iwl_trans_txq_disable(struct iwl_trans *trans, int queue,
 
 static inline void
 iwl_trans_txq_enable_cfg(struct iwl_trans *trans, int queue, u16 ssn,
-                         const struct iwl_trans_txq_scd_cfg *cfg)
+                         const struct iwl_trans_txq_scd_cfg *cfg,
+                         unsigned int queue_wdg_timeout)
 {
         might_sleep();
 
         if (unlikely((trans->state != IWL_TRANS_FW_ALIVE)))
                 IWL_ERR(trans, "%s bad state = %d\n", __func__, trans->state);
 
-        trans->ops->txq_enable(trans, queue, ssn, cfg);
+        trans->ops->txq_enable(trans, queue, ssn, cfg, queue_wdg_timeout);
 }
 
 static inline void iwl_trans_txq_enable(struct iwl_trans *trans, int queue,
                                         int fifo, int sta_id, int tid,
-                                        int frame_limit, u16 ssn)
+                                        int frame_limit, u16 ssn,
+                                        unsigned int queue_wdg_timeout)
 {
         struct iwl_trans_txq_scd_cfg cfg = {
                 .fifo = fifo,
@@ -830,11 +853,12 @@ static inline void iwl_trans_txq_enable(struct iwl_trans *trans, int queue,
                 .aggregate = sta_id >= 0,
         };
 
-        iwl_trans_txq_enable_cfg(trans, queue, ssn, &cfg);
+        iwl_trans_txq_enable_cfg(trans, queue, ssn, &cfg, queue_wdg_timeout);
 }
 
-static inline void iwl_trans_ac_txq_enable(struct iwl_trans *trans, int queue,
-                                           int fifo)
+static inline
+void iwl_trans_ac_txq_enable(struct iwl_trans *trans, int queue, int fifo,
+                             unsigned int queue_wdg_timeout)
 {
         struct iwl_trans_txq_scd_cfg cfg = {
                 .fifo = fifo,
@@ -844,16 +868,16 @@ static inline void iwl_trans_ac_txq_enable(struct iwl_trans *trans, int queue,
                 .aggregate = false,
         };
 
-        iwl_trans_txq_enable_cfg(trans, queue, 0, &cfg);
+        iwl_trans_txq_enable_cfg(trans, queue, 0, &cfg, queue_wdg_timeout);
 }
 
 static inline int iwl_trans_wait_tx_queue_empty(struct iwl_trans *trans,
-                                                u32 txq_bm)
+                                                u32 txqs)
 {
         if (unlikely(trans->state != IWL_TRANS_FW_ALIVE))
                 IWL_ERR(trans, "%s bad state = %d\n", __func__, trans->state);
 
-        return trans->ops->wait_tx_queue_empty(trans, txq_bm);
+        return trans->ops->wait_tx_queue_empty(trans, txqs);
 }
 
 static inline int iwl_trans_dbgfs_register(struct iwl_trans *trans,
diff --git a/drivers/net/wireless/iwlwifi/mvm/coex.c b/drivers/net/wireless/iwlwifi/mvm/coex.c
index a3bfda45d9e6..1ec4d55155f7 100644
--- a/drivers/net/wireless/iwlwifi/mvm/coex.c
+++ b/drivers/net/wireless/iwlwifi/mvm/coex.c
@@ -342,7 +342,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 12,
                 .lut20 = {
-                        cpu_to_le32(0x00000001),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -363,7 +363,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 20,
                 .lut20 = {
-                        cpu_to_le32(0x00000002),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -384,7 +384,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 21,
                 .lut20 = {
-                        cpu_to_le32(0x00000003),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -405,7 +405,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 23,
                 .lut20 = {
-                        cpu_to_le32(0x00000004),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -426,7 +426,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 27,
                 .lut20 = {
-                        cpu_to_le32(0x00000005),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -447,7 +447,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 30,
                 .lut20 = {
-                        cpu_to_le32(0x00000006),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -468,7 +468,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 32,
                 .lut20 = {
-                        cpu_to_le32(0x00000007),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -489,7 +489,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 33,
                 .lut20 = {
-                        cpu_to_le32(0x00000008),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -989,7 +989,7 @@ int iwl_mvm_rx_bt_coex_notif(struct iwl_mvm *mvm,
 static void iwl_mvm_bt_rssi_iterator(void *_data, u8 *mac,
                                    struct ieee80211_vif *vif)
 {
-        struct iwl_mvm_vif *mvmvif = (void *)vif->drv_priv;
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         struct iwl_bt_iterator_data *data = _data;
         struct iwl_mvm *mvm = data->mvm;
 
@@ -1025,7 +1025,7 @@ static void iwl_mvm_bt_rssi_iterator(void *_data, u8 *mac,
 void iwl_mvm_bt_rssi_event(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                            enum ieee80211_rssi_event rssi_event)
 {
-        struct iwl_mvm_vif *mvmvif = (void *)vif->drv_priv;
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         struct iwl_bt_iterator_data data = {
                 .mvm = mvm,
         };
diff --git a/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c b/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
index b3210cfbecc8..d530ef3da107 100644
--- a/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
+++ b/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
@@ -330,7 +330,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 12,
                 .lut20 = {
-                        cpu_to_le32(0x00000001),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -351,7 +351,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 20,
                 .lut20 = {
-                        cpu_to_le32(0x00000002),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -372,7 +372,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 21,
                 .lut20 = {
-                        cpu_to_le32(0x00000003),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -393,7 +393,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 23,
                 .lut20 = {
-                        cpu_to_le32(0x00000004),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -414,7 +414,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 27,
                 .lut20 = {
-                        cpu_to_le32(0x00000005),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -435,7 +435,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 30,
                 .lut20 = {
-                        cpu_to_le32(0x00000006),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -456,7 +456,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 32,
                 .lut20 = {
-                        cpu_to_le32(0x00000007),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -477,7 +477,7 @@ static const struct corunning_block_luts antenna_coupling_ranges[] = {
         {
                 .range = 33,
                 .lut20 = {
-                        cpu_to_le32(0x00000008),  cpu_to_le32(0x00000000),
+                        cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
                         cpu_to_le32(0x00000000),  cpu_to_le32(0x00000000),
@@ -1034,7 +1034,7 @@ int iwl_mvm_rx_bt_coex_notif_old(struct iwl_mvm *mvm,
 static void iwl_mvm_bt_rssi_iterator(void *_data, u8 *mac,
                                      struct ieee80211_vif *vif)
 {
-        struct iwl_mvm_vif *mvmvif = (void *)vif->drv_priv;
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         struct iwl_bt_iterator_data *data = _data;
         struct iwl_mvm *mvm = data->mvm;
 
@@ -1070,7 +1070,7 @@ static void iwl_mvm_bt_rssi_iterator(void *_data, u8 *mac,
 void iwl_mvm_bt_rssi_event_old(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                                enum ieee80211_rssi_event rssi_event)
 {
-        struct iwl_mvm_vif *mvmvif = (void *)vif->drv_priv;
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         struct iwl_bt_iterator_data data = {
                 .mvm = mvm,
         };
diff --git a/drivers/net/wireless/iwlwifi/mvm/constants.h b/drivers/net/wireless/iwlwifi/mvm/constants.h
index 3bd93476ec1c..beba375489f1 100644
--- a/drivers/net/wireless/iwlwifi/mvm/constants.h
+++ b/drivers/net/wireless/iwlwifi/mvm/constants.h
@@ -94,13 +94,42 @@
 #define IWL_MVM_BT_COEX_MPLUT                   1
 #define IWL_MVM_BT_COEX_RRC                     1
 #define IWL_MVM_BT_COEX_TTC                     1
-#define IWL_MVM_BT_COEX_MPLUT_REG0              0x28412201
+#define IWL_MVM_BT_COEX_MPLUT_REG0              0x22002200
 #define IWL_MVM_BT_COEX_MPLUT_REG1              0x11118451
 #define IWL_MVM_BT_COEX_ANTENNA_COUPLING_THRS   30
 #define IWL_MVM_FW_MCAST_FILTER_PASS_ALL        0
 #define IWL_MVM_FW_BCAST_FILTER_PASS_ALL        0
-#define IWL_MVM_QUOTA_THRESHOLD                 8
+#define IWL_MVM_QUOTA_THRESHOLD                 4
 #define IWL_MVM_RS_RSSI_BASED_INIT_RATE         0
-#define IWL_MVM_RS_DISABLE_MIMO                 0
+#define IWL_MVM_RS_DISABLE_P2P_MIMO             0
+#define IWL_MVM_RS_NUM_TRY_BEFORE_ANT_TOGGLE    1
+#define IWL_MVM_RS_HT_VHT_RETRIES_PER_RATE      2
+#define IWL_MVM_RS_HT_VHT_RETRIES_PER_RATE_TW   1
+#define IWL_MVM_RS_INITIAL_MIMO_NUM_RATES       3
+#define IWL_MVM_RS_INITIAL_SISO_NUM_RATES       3
+#define IWL_MVM_RS_INITIAL_LEGACY_NUM_RATES     2
+#define IWL_MVM_RS_INITIAL_LEGACY_RETRIES       2
+#define IWL_MVM_RS_SECONDARY_LEGACY_RETRIES     1
+#define IWL_MVM_RS_SECONDARY_LEGACY_NUM_RATES   16
+#define IWL_MVM_RS_SECONDARY_SISO_NUM_RATES     3
+#define IWL_MVM_RS_SECONDARY_SISO_RETRIES       1
+#define IWL_MVM_RS_RATE_MIN_FAILURE_TH          3
+#define IWL_MVM_RS_RATE_MIN_SUCCESS_TH          8
+#define IWL_MVM_RS_STAY_IN_COLUMN_TIMEOUT       5       /* Seconds */
+#define IWL_MVM_RS_IDLE_TIMEOUT                 5       /* Seconds */
+#define IWL_MVM_RS_MISSED_RATE_MAX              15
+#define IWL_MVM_RS_LEGACY_FAILURE_LIMIT         160
+#define IWL_MVM_RS_LEGACY_SUCCESS_LIMIT         480
+#define IWL_MVM_RS_LEGACY_TABLE_COUNT           160
+#define IWL_MVM_RS_NON_LEGACY_FAILURE_LIMIT     400
+#define IWL_MVM_RS_NON_LEGACY_SUCCESS_LIMIT     4500
+#define IWL_MVM_RS_NON_LEGACY_TABLE_COUNT       1500
+#define IWL_MVM_RS_SR_FORCE_DECREASE            15      /* percent */
+#define IWL_MVM_RS_SR_NO_DECREASE               85      /* percent */
+#define IWL_MVM_RS_AGG_TIME_LIMIT               4000    /* 4 msecs. valid 100-8000 */
+#define IWL_MVM_RS_AGG_DISABLE_START            3
+#define IWL_MVM_RS_TPC_SR_FORCE_INCREASE        75      /* percent */
+#define IWL_MVM_RS_TPC_SR_NO_INCREASE           85      /* percent */
+#define IWL_MVM_RS_TPC_TX_POWER_STEP            3
 
 #endif /* __MVM_CONSTANTS_H */
diff --git a/drivers/net/wireless/iwlwifi/mvm/d3.c b/drivers/net/wireless/iwlwifi/mvm/d3.c
index 744de262373e..14e8fd661889 100644
--- a/drivers/net/wireless/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/iwlwifi/mvm/d3.c
@@ -793,7 +793,7 @@ iwl_mvm_get_wowlan_config(struct iwl_mvm *mvm,
                           struct ieee80211_sta *ap_sta)
 {
         int ret;
-        struct iwl_mvm_sta *mvm_ap_sta = (struct iwl_mvm_sta *)ap_sta->drv_priv;
+        struct iwl_mvm_sta *mvm_ap_sta = iwl_mvm_sta_from_mac80211(ap_sta);
 
         /* TODO: wowlan_config_cmd->wowlan_ba_teardown_tids */
 
@@ -1137,12 +1137,43 @@ static int __iwl_mvm_suspend(struct ieee80211_hw *hw,
         return ret;
 }
 
+static int iwl_mvm_enter_d0i3_sync(struct iwl_mvm *mvm)
+{
+        struct iwl_notification_wait wait_d3;
+        static const u8 d3_notif[] = { D3_CONFIG_CMD };
+        int ret;
+
+        iwl_init_notification_wait(&mvm->notif_wait, &wait_d3,
+                                   d3_notif, ARRAY_SIZE(d3_notif),
+                                   NULL, NULL);
+
+        ret = iwl_mvm_enter_d0i3(mvm->hw->priv);
+        if (ret)
+                goto remove_notif;
+
+        ret = iwl_wait_notification(&mvm->notif_wait, &wait_d3, HZ);
+        WARN_ON_ONCE(ret);
+        return ret;
+
+remove_notif:
+        iwl_remove_notification(&mvm->notif_wait, &wait_d3);
+        return ret;
+}
+
 int iwl_mvm_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
 {
         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
 
         iwl_trans_suspend(mvm->trans);
-        if (iwl_mvm_is_d0i3_supported(mvm)) {
+        if (wowlan->any) {
+                /* 'any' trigger means d0i3 usage */
+                if (mvm->trans->d0i3_mode == IWL_D0I3_MODE_ON_SUSPEND) {
+                        int ret = iwl_mvm_enter_d0i3_sync(mvm);
+
+                        if (ret)
+                                return ret;
+                }
+
                 mutex_lock(&mvm->d0i3_suspend_mutex);
                 __set_bit(D0I3_DEFER_WAKEUP, &mvm->d0i3_suspend_flags);
                 mutex_unlock(&mvm->d0i3_suspend_mutex);
@@ -1626,7 +1657,7 @@ static bool iwl_mvm_query_wakeup_reasons(struct iwl_mvm *mvm,
         if (IS_ERR_OR_NULL(ap_sta))
                 goto out_free;
 
-        mvm_ap_sta = (struct iwl_mvm_sta *)ap_sta->drv_priv;
+        mvm_ap_sta = iwl_mvm_sta_from_mac80211(ap_sta);
         for (i = 0; i < IWL_MAX_TID_COUNT; i++) {
                 u16 seq = status.qos_seq_ctr[i];
                 /* firmware stores last-used value, we store next value */
@@ -1876,8 +1907,20 @@ int iwl_mvm_resume(struct ieee80211_hw *hw)
 
         iwl_trans_resume(mvm->trans);
 
-        if (iwl_mvm_is_d0i3_supported(mvm))
+        if (mvm->hw->wiphy->wowlan_config->any) {
+                /* 'any' trigger means d0i3 usage */
+                if (mvm->trans->d0i3_mode == IWL_D0I3_MODE_ON_SUSPEND) {
+                        int ret = iwl_mvm_exit_d0i3(hw->priv);
+
+                        if (ret)
+                                return ret;
+                        /*
+                         * d0i3 exit will be deferred until reconfig_complete.
+                         * make sure there we are out of d0i3.
+                         */
+                }
                 return 0;
+        }
 
         return __iwl_mvm_resume(mvm, false);
 }
diff --git a/drivers/net/wireless/iwlwifi/mvm/debugfs-vif.c b/drivers/net/wireless/iwlwifi/mvm/debugfs-vif.c
index 9aa2311a776c..5fe14591e1c4 100644
--- a/drivers/net/wireless/iwlwifi/mvm/debugfs-vif.c
+++ b/drivers/net/wireless/iwlwifi/mvm/debugfs-vif.c
@@ -268,7 +268,7 @@ static ssize_t iwl_dbgfs_mac_params_read(struct file *file,
                 sta = rcu_dereference_protected(mvm->fw_id_to_mac_id[ap_sta_id],
                                                 lockdep_is_held(&mvm->mutex));
                 if (!IS_ERR_OR_NULL(sta)) {
-                        struct iwl_mvm_sta *mvm_sta = (void *)sta->drv_priv;
+                        struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
 
                         pos += scnprintf(buf+pos, bufsz-pos,
                                          "ap_sta_id %d - reduced Tx power %d\n",
@@ -517,6 +517,34 @@ static ssize_t iwl_dbgfs_low_latency_read(struct file *file,
         return simple_read_from_buffer(user_buf, count, ppos, buf, sizeof(buf));
 }
 
+static ssize_t iwl_dbgfs_uapsd_misbehaving_read(struct file *file,
+                                                char __user *user_buf,
+                                                size_t count, loff_t *ppos)
+{
+        struct ieee80211_vif *vif = file->private_data;
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        char buf[20];
+        int len;
+
+        len = sprintf(buf, "%pM\n", mvmvif->uapsd_misbehaving_bssid);
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static ssize_t iwl_dbgfs_uapsd_misbehaving_write(struct ieee80211_vif *vif,
+                                                 char *buf, size_t count,
+                                                 loff_t *ppos)
+{
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        struct iwl_mvm *mvm = mvmvif->mvm;
+        bool ret;
+
+        mutex_lock(&mvm->mutex);
+        ret = mac_pton(buf, mvmvif->uapsd_misbehaving_bssid);
+        mutex_unlock(&mvm->mutex);
+
+        return ret ? count : -EINVAL;
+}
+
 #define MVM_DEBUGFS_WRITE_FILE_OPS(name, bufsz) \
         _MVM_DEBUGFS_WRITE_FILE_OPS(name, bufsz, struct ieee80211_vif)
 #define MVM_DEBUGFS_READ_WRITE_FILE_OPS(name, bufsz) \
@@ -531,6 +559,7 @@ MVM_DEBUGFS_READ_FILE_OPS(mac_params);
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(pm_params, 32);
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(bf_params, 256);
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(low_latency, 10);
+MVM_DEBUGFS_READ_WRITE_FILE_OPS(uapsd_misbehaving, 20);
 
 void iwl_mvm_vif_dbgfs_register(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 {
@@ -564,6 +593,8 @@ void iwl_mvm_vif_dbgfs_register(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
         MVM_DEBUGFS_ADD_FILE_VIF(mac_params, mvmvif->dbgfs_dir, S_IRUSR);
         MVM_DEBUGFS_ADD_FILE_VIF(low_latency, mvmvif->dbgfs_dir,
                                  S_IRUSR | S_IWUSR);
+        MVM_DEBUGFS_ADD_FILE_VIF(uapsd_misbehaving, mvmvif->dbgfs_dir,
+                                 S_IRUSR | S_IWUSR);
 
         if (vif->type == NL80211_IFTYPE_STATION && !vif->p2p &&
             mvmvif == mvm->bf_allowed_vif)
diff --git a/drivers/net/wireless/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
index 33bf915cd7ea..82c09d86af8c 100644
--- a/drivers/net/wireless/iwlwifi/mvm/debugfs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
@@ -654,10 +654,10 @@ out:
         return ret ?: count;
 }
 
-#define PRINT_STATS_LE32(_str, _val)                                    \
+#define PRINT_STATS_LE32(_struct, _memb)                                \
                          pos += scnprintf(buf + pos, bufsz - pos,       \
-                                          fmt_table, _str,              \
-                                          le32_to_cpu(_val))
+                                          fmt_table, #_memb,            \
+                                          le32_to_cpu(_struct->_memb))
 
 static ssize_t iwl_dbgfs_fw_rx_stats_read(struct file *file,
                                           char __user *user_buf, size_t count,
@@ -692,97 +692,89 @@ static ssize_t iwl_dbgfs_fw_rx_stats_read(struct file *file,
 
         pos += scnprintf(buf + pos, bufsz - pos, fmt_header,
                          "Statistics_Rx - OFDM");
-        PRINT_STATS_LE32("ina_cnt", ofdm->ina_cnt);
-        PRINT_STATS_LE32("fina_cnt", ofdm->fina_cnt);
-        PRINT_STATS_LE32("plcp_err", ofdm->plcp_err);
-        PRINT_STATS_LE32("crc32_err", ofdm->crc32_err);
-        PRINT_STATS_LE32("overrun_err", ofdm->overrun_err);
-        PRINT_STATS_LE32("early_overrun_err", ofdm->early_overrun_err);
-        PRINT_STATS_LE32("crc32_good", ofdm->crc32_good);
-        PRINT_STATS_LE32("false_alarm_cnt", ofdm->false_alarm_cnt);
-        PRINT_STATS_LE32("fina_sync_err_cnt", ofdm->fina_sync_err_cnt);
-        PRINT_STATS_LE32("sfd_timeout", ofdm->sfd_timeout);
-        PRINT_STATS_LE32("fina_timeout", ofdm->fina_timeout);
-        PRINT_STATS_LE32("unresponded_rts", ofdm->unresponded_rts);
-        PRINT_STATS_LE32("rxe_frame_lmt_overrun",
-                         ofdm->rxe_frame_limit_overrun);
-        PRINT_STATS_LE32("sent_ack_cnt", ofdm->sent_ack_cnt);
-        PRINT_STATS_LE32("sent_cts_cnt", ofdm->sent_cts_cnt);
-        PRINT_STATS_LE32("sent_ba_rsp_cnt", ofdm->sent_ba_rsp_cnt);
-        PRINT_STATS_LE32("dsp_self_kill", ofdm->dsp_self_kill);
-        PRINT_STATS_LE32("mh_format_err", ofdm->mh_format_err);
-        PRINT_STATS_LE32("re_acq_main_rssi_sum", ofdm->re_acq_main_rssi_sum);
-        PRINT_STATS_LE32("reserved", ofdm->reserved);
+        PRINT_STATS_LE32(ofdm, ina_cnt);
+        PRINT_STATS_LE32(ofdm, fina_cnt);
+        PRINT_STATS_LE32(ofdm, plcp_err);
+        PRINT_STATS_LE32(ofdm, crc32_err);
+        PRINT_STATS_LE32(ofdm, overrun_err);
+        PRINT_STATS_LE32(ofdm, early_overrun_err);
+        PRINT_STATS_LE32(ofdm, crc32_good);
+        PRINT_STATS_LE32(ofdm, false_alarm_cnt);
+        PRINT_STATS_LE32(ofdm, fina_sync_err_cnt);
+        PRINT_STATS_LE32(ofdm, sfd_timeout);
+        PRINT_STATS_LE32(ofdm, fina_timeout);
+        PRINT_STATS_LE32(ofdm, unresponded_rts);
+        PRINT_STATS_LE32(ofdm, rxe_frame_lmt_overrun);
+        PRINT_STATS_LE32(ofdm, sent_ack_cnt);
+        PRINT_STATS_LE32(ofdm, sent_cts_cnt);
+        PRINT_STATS_LE32(ofdm, sent_ba_rsp_cnt);
+        PRINT_STATS_LE32(ofdm, dsp_self_kill);
+        PRINT_STATS_LE32(ofdm, mh_format_err);
+        PRINT_STATS_LE32(ofdm, re_acq_main_rssi_sum);
+        PRINT_STATS_LE32(ofdm, reserved);
 
         pos += scnprintf(buf + pos, bufsz - pos, fmt_header,
                          "Statistics_Rx - CCK");
-        PRINT_STATS_LE32("ina_cnt", cck->ina_cnt);
-        PRINT_STATS_LE32("fina_cnt", cck->fina_cnt);
-        PRINT_STATS_LE32("plcp_err", cck->plcp_err);
-        PRINT_STATS_LE32("crc32_err", cck->crc32_err);
-        PRINT_STATS_LE32("overrun_err", cck->overrun_err);
-        PRINT_STATS_LE32("early_overrun_err", cck->early_overrun_err);
-        PRINT_STATS_LE32("crc32_good", cck->crc32_good);
-        PRINT_STATS_LE32("false_alarm_cnt", cck->false_alarm_cnt);
-        PRINT_STATS_LE32("fina_sync_err_cnt", cck->fina_sync_err_cnt);
-        PRINT_STATS_LE32("sfd_timeout", cck->sfd_timeout);
-        PRINT_STATS_LE32("fina_timeout", cck->fina_timeout);
-        PRINT_STATS_LE32("unresponded_rts", cck->unresponded_rts);
-        PRINT_STATS_LE32("rxe_frame_lmt_overrun",
-                         cck->rxe_frame_limit_overrun);
-        PRINT_STATS_LE32("sent_ack_cnt", cck->sent_ack_cnt);
-        PRINT_STATS_LE32("sent_cts_cnt", cck->sent_cts_cnt);
-        PRINT_STATS_LE32("sent_ba_rsp_cnt", cck->sent_ba_rsp_cnt);
-        PRINT_STATS_LE32("dsp_self_kill", cck->dsp_self_kill);
-        PRINT_STATS_LE32("mh_format_err", cck->mh_format_err);
-        PRINT_STATS_LE32("re_acq_main_rssi_sum", cck->re_acq_main_rssi_sum);
-        PRINT_STATS_LE32("reserved", cck->reserved);
+        PRINT_STATS_LE32(cck, ina_cnt);
+        PRINT_STATS_LE32(cck, fina_cnt);
+        PRINT_STATS_LE32(cck, plcp_err);
+        PRINT_STATS_LE32(cck, crc32_err);
+        PRINT_STATS_LE32(cck, overrun_err);
+        PRINT_STATS_LE32(cck, early_overrun_err);
+        PRINT_STATS_LE32(cck, crc32_good);
+        PRINT_STATS_LE32(cck, false_alarm_cnt);
+        PRINT_STATS_LE32(cck, fina_sync_err_cnt);
+        PRINT_STATS_LE32(cck, sfd_timeout);
+        PRINT_STATS_LE32(cck, fina_timeout);
+        PRINT_STATS_LE32(cck, unresponded_rts);
+        PRINT_STATS_LE32(cck, rxe_frame_lmt_overrun);
+        PRINT_STATS_LE32(cck, sent_ack_cnt);
+        PRINT_STATS_LE32(cck, sent_cts_cnt);
+        PRINT_STATS_LE32(cck, sent_ba_rsp_cnt);
+        PRINT_STATS_LE32(cck, dsp_self_kill);
+        PRINT_STATS_LE32(cck, mh_format_err);
+        PRINT_STATS_LE32(cck, re_acq_main_rssi_sum);
+        PRINT_STATS_LE32(cck, reserved);
 
         pos += scnprintf(buf + pos, bufsz - pos, fmt_header,
                          "Statistics_Rx - GENERAL");
-        PRINT_STATS_LE32("bogus_cts", general->bogus_cts);
-        PRINT_STATS_LE32("bogus_ack", general->bogus_ack);
-        PRINT_STATS_LE32("non_bssid_frames", general->non_bssid_frames);
-        PRINT_STATS_LE32("filtered_frames", general->filtered_frames);
-        PRINT_STATS_LE32("non_channel_beacons", general->non_channel_beacons);
-        PRINT_STATS_LE32("channel_beacons", general->channel_beacons);
-        PRINT_STATS_LE32("num_missed_bcon", general->num_missed_bcon);
-        PRINT_STATS_LE32("adc_rx_saturation_time",
-                         general->adc_rx_saturation_time);
-        PRINT_STATS_LE32("ina_detection_search_time",
-                         general->ina_detection_search_time);
-        PRINT_STATS_LE32("beacon_silence_rssi_a",
-                         general->beacon_silence_rssi_a);
-        PRINT_STATS_LE32("beacon_silence_rssi_b",
-                         general->beacon_silence_rssi_b);
-        PRINT_STATS_LE32("beacon_silence_rssi_c",
-                         general->beacon_silence_rssi_c);
-        PRINT_STATS_LE32("interference_data_flag",
-                         general->interference_data_flag);
-        PRINT_STATS_LE32("channel_load", general->channel_load);
-        PRINT_STATS_LE32("dsp_false_alarms", general->dsp_false_alarms);
-        PRINT_STATS_LE32("beacon_rssi_a", general->beacon_rssi_a);
-        PRINT_STATS_LE32("beacon_rssi_b", general->beacon_rssi_b);
-        PRINT_STATS_LE32("beacon_rssi_c", general->beacon_rssi_c);
-        PRINT_STATS_LE32("beacon_energy_a", general->beacon_energy_a);
-        PRINT_STATS_LE32("beacon_energy_b", general->beacon_energy_b);
-        PRINT_STATS_LE32("beacon_energy_c", general->beacon_energy_c);
-        PRINT_STATS_LE32("num_bt_kills", general->num_bt_kills);
-        PRINT_STATS_LE32("mac_id", general->mac_id);
-        PRINT_STATS_LE32("directed_data_mpdu", general->directed_data_mpdu);
+        PRINT_STATS_LE32(general, bogus_cts);
+        PRINT_STATS_LE32(general, bogus_ack);
+        PRINT_STATS_LE32(general, non_bssid_frames);
+        PRINT_STATS_LE32(general, filtered_frames);
+        PRINT_STATS_LE32(general, non_channel_beacons);
+        PRINT_STATS_LE32(general, channel_beacons);
+        PRINT_STATS_LE32(general, num_missed_bcon);
+        PRINT_STATS_LE32(general, adc_rx_saturation_time);
+        PRINT_STATS_LE32(general, ina_detection_search_time);
+        PRINT_STATS_LE32(general, beacon_silence_rssi_a);
+        PRINT_STATS_LE32(general, beacon_silence_rssi_b);
+        PRINT_STATS_LE32(general, beacon_silence_rssi_c);
+        PRINT_STATS_LE32(general, interference_data_flag);
+        PRINT_STATS_LE32(general, channel_load);
+        PRINT_STATS_LE32(general, dsp_false_alarms);
+        PRINT_STATS_LE32(general, beacon_rssi_a);
+        PRINT_STATS_LE32(general, beacon_rssi_b);
+        PRINT_STATS_LE32(general, beacon_rssi_c);
+        PRINT_STATS_LE32(general, beacon_energy_a);
+        PRINT_STATS_LE32(general, beacon_energy_b);
+        PRINT_STATS_LE32(general, beacon_energy_c);
+        PRINT_STATS_LE32(general, num_bt_kills);
+        PRINT_STATS_LE32(general, mac_id);
+        PRINT_STATS_LE32(general, directed_data_mpdu);
 
         pos += scnprintf(buf + pos, bufsz - pos, fmt_header,
                          "Statistics_Rx - HT");
-        PRINT_STATS_LE32("plcp_err", ht->plcp_err);
-        PRINT_STATS_LE32("overrun_err", ht->overrun_err);
-        PRINT_STATS_LE32("early_overrun_err", ht->early_overrun_err);
-        PRINT_STATS_LE32("crc32_good", ht->crc32_good);
-        PRINT_STATS_LE32("crc32_err", ht->crc32_err);
-        PRINT_STATS_LE32("mh_format_err", ht->mh_format_err);
-        PRINT_STATS_LE32("agg_crc32_good", ht->agg_crc32_good);
-        PRINT_STATS_LE32("agg_mpdu_cnt", ht->agg_mpdu_cnt);
-        PRINT_STATS_LE32("agg_cnt", ht->agg_cnt);
-        PRINT_STATS_LE32("unsupport_mcs", ht->unsupport_mcs);
+        PRINT_STATS_LE32(ht, plcp_err);
+        PRINT_STATS_LE32(ht, overrun_err);
+        PRINT_STATS_LE32(ht, early_overrun_err);
+        PRINT_STATS_LE32(ht, crc32_good);
+        PRINT_STATS_LE32(ht, crc32_err);
+        PRINT_STATS_LE32(ht, mh_format_err);
+        PRINT_STATS_LE32(ht, agg_crc32_good);
+        PRINT_STATS_LE32(ht, agg_mpdu_cnt);
+        PRINT_STATS_LE32(ht, agg_cnt);
+        PRINT_STATS_LE32(ht, unsupport_mcs);
 
         mutex_unlock(&mvm->mutex);
 
@@ -933,7 +925,7 @@ iwl_dbgfs_scan_ant_rxchain_write(struct iwl_mvm *mvm, char *buf,
                 return -EINVAL;
         if (scan_rx_ant > ANT_ABC)
                 return -EINVAL;
-        if (scan_rx_ant & ~mvm->fw->valid_rx_ant)
+        if (scan_rx_ant & ~(iwl_mvm_get_valid_rx_ant(mvm)))
                 return -EINVAL;
 
         if (mvm->scan_rx_ant != scan_rx_ant) {
@@ -945,6 +937,61 @@ iwl_dbgfs_scan_ant_rxchain_write(struct iwl_mvm *mvm, char *buf,
         return count;
 }
 
+static ssize_t iwl_dbgfs_fw_dbg_conf_read(struct file *file,
+                                          char __user *user_buf,
+                                          size_t count, loff_t *ppos)
+{
+        struct iwl_mvm *mvm = file->private_data;
+        enum iwl_fw_dbg_conf conf;
+        char buf[8];
+        const size_t bufsz = sizeof(buf);
+        int pos = 0;
+
+        mutex_lock(&mvm->mutex);
+        conf = mvm->fw_dbg_conf;
+        mutex_unlock(&mvm->mutex);
+
+        pos += scnprintf(buf + pos, bufsz - pos, "%d\n", conf);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+}
+
+static ssize_t iwl_dbgfs_fw_dbg_conf_write(struct iwl_mvm *mvm,
+                                           char *buf, size_t count,
+                                           loff_t *ppos)
+{
+        int ret, conf_id;
+
+        ret = kstrtoint(buf, 0, &conf_id);
+        if (ret)
+                return ret;
+
+        if (WARN_ON(conf_id >= FW_DBG_MAX))
+                return -EINVAL;
+
+        mutex_lock(&mvm->mutex);
+        ret = iwl_mvm_start_fw_dbg_conf(mvm, conf_id);
+        mutex_unlock(&mvm->mutex);
+
+        return ret ?: count;
+}
+
+static ssize_t iwl_dbgfs_fw_dbg_collect_write(struct iwl_mvm *mvm,
+                                              char *buf, size_t count,
+                                              loff_t *ppos)
+{
+        int ret = iwl_mvm_ref_sync(mvm, IWL_MVM_REF_PRPH_WRITE);
+
+        if (ret)
+                return ret;
+
+        iwl_mvm_fw_dbg_collect(mvm);
+
+        iwl_mvm_unref(mvm, IWL_MVM_REF_PRPH_WRITE);
+
+        return count;
+}
+
 #define ADD_TEXT(...) pos += scnprintf(buf + pos, bufsz - pos, __VA_ARGS__)
 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
 static ssize_t iwl_dbgfs_bcast_filters_read(struct file *file,
@@ -1340,6 +1387,7 @@ static ssize_t iwl_dbgfs_d0i3_refs_read(struct file *file,
         PRINT_MVM_REF(IWL_MVM_REF_TM_CMD);
         PRINT_MVM_REF(IWL_MVM_REF_EXIT_WORK);
         PRINT_MVM_REF(IWL_MVM_REF_PROTECT_CSA);
+        PRINT_MVM_REF(IWL_MVM_REF_FW_DBG_COLLECT);
 
         return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
 }
@@ -1439,6 +1487,26 @@ out:
         return count;
 }
 
+static ssize_t iwl_dbgfs_enable_scan_iteration_notif_write(struct iwl_mvm *mvm,
+                                                           char *buf,
+                                                           size_t count,
+                                                           loff_t *ppos)
+{
+        int val;
+
+        mutex_lock(&mvm->mutex);
+
+        if (kstrtoint(buf, 10, &val)) {
+                mutex_unlock(&mvm->mutex);
+                return -EINVAL;
+        }
+
+        mvm->scan_iter_notif_enabled = val;
+        mutex_unlock(&mvm->mutex);
+
+        return count;
+}
+
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(prph_reg, 64);
 
 /* Device wide debugfs entries */
@@ -1459,6 +1527,9 @@ MVM_DEBUGFS_WRITE_FILE_OPS(bt_tx_prio, 10);
 MVM_DEBUGFS_WRITE_FILE_OPS(bt_force_ant, 10);
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(scan_ant_rxchain, 8);
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(d0i3_refs, 8);
+MVM_DEBUGFS_READ_WRITE_FILE_OPS(fw_dbg_conf, 8);
+MVM_DEBUGFS_WRITE_FILE_OPS(fw_dbg_collect, 8);
+MVM_DEBUGFS_WRITE_FILE_OPS(enable_scan_iteration_notif, 8);
 
 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
 MVM_DEBUGFS_READ_WRITE_FILE_OPS(bcast_filters, 256);
@@ -1500,6 +1571,10 @@ int iwl_mvm_dbgfs_register(struct iwl_mvm *mvm, struct dentry *dbgfs_dir)
                              S_IWUSR | S_IRUSR);
         MVM_DEBUGFS_ADD_FILE(prph_reg, mvm->debugfs_dir, S_IWUSR | S_IRUSR);
         MVM_DEBUGFS_ADD_FILE(d0i3_refs, mvm->debugfs_dir, S_IRUSR | S_IWUSR);
+        MVM_DEBUGFS_ADD_FILE(fw_dbg_conf, mvm->debugfs_dir, S_IRUSR | S_IWUSR);
+        MVM_DEBUGFS_ADD_FILE(fw_dbg_collect, mvm->debugfs_dir, S_IWUSR);
+        MVM_DEBUGFS_ADD_FILE(enable_scan_iteration_notif, mvm->debugfs_dir,
+                             S_IWUSR);
 
 #ifdef CONFIG_IWLWIFI_BCAST_FILTERING
         if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_BCAST_FILTERING) {
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h
index 430020047b77..4fc0938b3fb6 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h
@@ -92,14 +92,32 @@ enum iwl_ltr_config_flags {
 };
 
 /**
+ * struct iwl_ltr_config_cmd_v1 - configures the LTR
+ * @flags: See %enum iwl_ltr_config_flags
+ */
+struct iwl_ltr_config_cmd_v1 {
+        __le32 flags;
+        __le32 static_long;
+        __le32 static_short;
+} __packed; /* LTR_CAPABLE_API_S_VER_1 */
+
+#define LTR_VALID_STATES_NUM 4
+
+/**
  * struct iwl_ltr_config_cmd - configures the LTR
  * @flags: See %enum iwl_ltr_config_flags
+ * @static_long:
+ * @static_short:
+ * @ltr_cfg_values:
+ * @ltr_short_idle_timeout:
  */
 struct iwl_ltr_config_cmd {
         __le32 flags;
         __le32 static_long;
         __le32 static_short;
-} __packed;
+        __le32 ltr_cfg_values[LTR_VALID_STATES_NUM];
+        __le32 ltr_short_idle_timeout;
+} __packed; /* LTR_CAPABLE_API_S_VER_2 */
 
 /* Radio LP RX Energy Threshold measured in dBm */
 #define POWER_LPRX_RSSI_THRESHOLD       75
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-rs.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-rs.h
index 8bb5b94bf963..0f1ea80a55ef 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-rs.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-rs.h
@@ -308,6 +308,42 @@ enum {
 #define LQ_FLAG_DYNAMIC_BW_POS          6
 #define LQ_FLAG_DYNAMIC_BW_MSK          (1 << LQ_FLAG_DYNAMIC_BW_POS)
 
+/* Single Stream Tx Parameters (lq_cmd->ss_params)
+ * Flags to control a smart FW decision about whether BFER/STBC/SISO will be
+ * used for single stream Tx.
+ */
+
+/* Bit 0-1: Max STBC streams allowed. Can be 0-3.
+ * (0) - No STBC allowed
+ * (1) - 2x1 STBC allowed (HT/VHT)
+ * (2) - 4x2 STBC allowed (HT/VHT)
+ * (3) - 3x2 STBC allowed (HT only)
+ * All our chips are at most 2 antennas so only (1) is valid for now.
+ */
+#define LQ_SS_STBC_ALLOWED_POS          0
+#define LQ_SS_STBC_ALLOWED_MSK          (3 << LQ_SS_STBC_ALLOWED_MSK)
+
+/* 2x1 STBC is allowed */
+#define LQ_SS_STBC_1SS_ALLOWED          (1 << LQ_SS_STBC_ALLOWED_POS)
+
+/* Bit 2: Beamformer (VHT only) is allowed */
+#define LQ_SS_BFER_ALLOWED_POS          2
+#define LQ_SS_BFER_ALLOWED              (1 << LQ_SS_BFER_ALLOWED_POS)
+
+/* Bit 3: Force BFER or STBC for testing
+ * If this is set:
+ * If BFER is allowed then force the ucode to choose BFER else
+ * If STBC is allowed then force the ucode to choose STBC over SISO
+ */
+#define LQ_SS_FORCE_POS                 3
+#define LQ_SS_FORCE                     (1 << LQ_SS_FORCE_POS)
+
+/* Bit 31: ss_params field is valid. Used for FW backward compatibility
+ * with other drivers which don't support the ss_params API yet
+ */
+#define LQ_SS_PARAMS_VALID_POS          31
+#define LQ_SS_PARAMS_VALID              (1 << LQ_SS_PARAMS_VALID_POS)
+
 /**
  * struct iwl_lq_cmd - link quality command
  * @sta_id: station to update
@@ -330,7 +366,7 @@ enum {
  *      2 - 0x3f: maximal number of frames (up to 3f == 63)
  * @rs_table: array of rates for each TX try, each is rate_n_flags,
  *      meaning it is a combination of RATE_MCS_* and IWL_RATE_*_PLCP
- * @bf_params: beam forming params, currently not used
+ * @ss_params: single stream features. declare whether STBC or BFER are allowed.
  */
 struct iwl_lq_cmd {
         u8 sta_id;
@@ -348,6 +384,6 @@ struct iwl_lq_cmd {
         u8 agg_frame_cnt_limit;
         __le32 reserved2;
         __le32 rs_table[LQ_MAX_RETRY_NUM];
-        __le32 bf_params;
+        __le32 ss_params;
 }; /* LINK_QUALITY_CMD_API_S_VER_1 */
 #endif /* __fw_api_rs_h__ */
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-stats.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-stats.h
new file mode 100644
index 000000000000..928168b18346
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-stats.h
@@ -0,0 +1,277 @@
+/******************************************************************************
+ *
+ * This file is provided under a dual BSD/GPLv2 license.  When using or
+ * redistributing this file, you may do so under either license.
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called COPYING.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ * BSD LICENSE
+ *
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+
+#ifndef __fw_api_stats_h__
+#define __fw_api_stats_h__
+
+struct mvm_statistics_dbg {
+        __le32 burst_check;
+        __le32 burst_count;
+        __le32 wait_for_silence_timeout_cnt;
+        __le32 reserved[3];
+} __packed; /* STATISTICS_DEBUG_API_S_VER_2 */
+
+struct mvm_statistics_div {
+        __le32 tx_on_a;
+        __le32 tx_on_b;
+        __le32 exec_time;
+        __le32 probe_time;
+        __le32 rssi_ant;
+        __le32 reserved2;
+} __packed; /* STATISTICS_SLOW_DIV_API_S_VER_2 */
+
+struct mvm_statistics_rx_non_phy {
+        __le32 bogus_cts;       /* CTS received when not expecting CTS */
+        __le32 bogus_ack;       /* ACK received when not expecting ACK */
+        __le32 non_bssid_frames;        /* number of frames with BSSID that
+                                         * doesn't belong to the STA BSSID */
+        __le32 filtered_frames; /* count frames that were dumped in the
+                                 * filtering process */
+        __le32 non_channel_beacons;     /* beacons with our bss id but not on
+                                         * our serving channel */
+        __le32 channel_beacons; /* beacons with our bss id and in our
+                                 * serving channel */
+        __le32 num_missed_bcon; /* number of missed beacons */
+        __le32 adc_rx_saturation_time;  /* count in 0.8us units the time the
+                                         * ADC was in saturation */
+        __le32 ina_detection_search_time;/* total time (in 0.8us) searched
+                                          * for INA */
+        __le32 beacon_silence_rssi_a;   /* RSSI silence after beacon frame */
+        __le32 beacon_silence_rssi_b;   /* RSSI silence after beacon frame */
+        __le32 beacon_silence_rssi_c;   /* RSSI silence after beacon frame */
+        __le32 interference_data_flag;  /* flag for interference data
+                                         * availability. 1 when data is
+                                         * available. */
+        __le32 channel_load;            /* counts RX Enable time in uSec */
+        __le32 dsp_false_alarms;        /* DSP false alarm (both OFDM
+                                         * and CCK) counter */
+        __le32 beacon_rssi_a;
+        __le32 beacon_rssi_b;
+        __le32 beacon_rssi_c;
+        __le32 beacon_energy_a;
+        __le32 beacon_energy_b;
+        __le32 beacon_energy_c;
+        __le32 num_bt_kills;
+        __le32 mac_id;
+        __le32 directed_data_mpdu;
+} __packed; /* STATISTICS_RX_NON_PHY_API_S_VER_3 */
+
+struct mvm_statistics_rx_phy {
+        __le32 ina_cnt;
+        __le32 fina_cnt;
+        __le32 plcp_err;
+        __le32 crc32_err;
+        __le32 overrun_err;
+        __le32 early_overrun_err;
+        __le32 crc32_good;
+        __le32 false_alarm_cnt;
+        __le32 fina_sync_err_cnt;
+        __le32 sfd_timeout;
+        __le32 fina_timeout;
+        __le32 unresponded_rts;
+        __le32 rxe_frame_lmt_overrun;
+        __le32 sent_ack_cnt;
+        __le32 sent_cts_cnt;
+        __le32 sent_ba_rsp_cnt;
+        __le32 dsp_self_kill;
+        __le32 mh_format_err;
+        __le32 re_acq_main_rssi_sum;
+        __le32 reserved;
+} __packed; /* STATISTICS_RX_PHY_API_S_VER_2 */
+
+struct mvm_statistics_rx_ht_phy {
+        __le32 plcp_err;
+        __le32 overrun_err;
+        __le32 early_overrun_err;
+        __le32 crc32_good;
+        __le32 crc32_err;
+        __le32 mh_format_err;
+        __le32 agg_crc32_good;
+        __le32 agg_mpdu_cnt;
+        __le32 agg_cnt;
+        __le32 unsupport_mcs;
+} __packed;  /* STATISTICS_HT_RX_PHY_API_S_VER_1 */
+
+struct mvm_statistics_tx_non_phy {
+        __le32 preamble_cnt;
+        __le32 rx_detected_cnt;
+        __le32 bt_prio_defer_cnt;
+        __le32 bt_prio_kill_cnt;
+        __le32 few_bytes_cnt;
+        __le32 cts_timeout;
+        __le32 ack_timeout;
+        __le32 expected_ack_cnt;
+        __le32 actual_ack_cnt;
+        __le32 dump_msdu_cnt;
+        __le32 burst_abort_next_frame_mismatch_cnt;
+        __le32 burst_abort_missing_next_frame_cnt;
+        __le32 cts_timeout_collision;
+        __le32 ack_or_ba_timeout_collision;
+} __packed; /* STATISTICS_TX_NON_PHY_API_S_VER_3 */
+
+#define MAX_CHAINS 3
+
+struct mvm_statistics_tx_non_phy_agg {
+        __le32 ba_timeout;
+        __le32 ba_reschedule_frames;
+        __le32 scd_query_agg_frame_cnt;
+        __le32 scd_query_no_agg;
+        __le32 scd_query_agg;
+        __le32 scd_query_mismatch;
+        __le32 frame_not_ready;
+        __le32 underrun;
+        __le32 bt_prio_kill;
+        __le32 rx_ba_rsp_cnt;
+        __s8 txpower[MAX_CHAINS];
+        __s8 reserved;
+        __le32 reserved2;
+} __packed; /* STATISTICS_TX_NON_PHY_AGG_API_S_VER_1 */
+
+struct mvm_statistics_tx_channel_width {
+        __le32 ext_cca_narrow_ch20[1];
+        __le32 ext_cca_narrow_ch40[2];
+        __le32 ext_cca_narrow_ch80[3];
+        __le32 ext_cca_narrow_ch160[4];
+        __le32 last_tx_ch_width_indx;
+        __le32 rx_detected_per_ch_width[4];
+        __le32 success_per_ch_width[4];
+        __le32 fail_per_ch_width[4];
+}; /* STATISTICS_TX_CHANNEL_WIDTH_API_S_VER_1 */
+
+struct mvm_statistics_tx {
+        struct mvm_statistics_tx_non_phy general;
+        struct mvm_statistics_tx_non_phy_agg agg;
+        struct mvm_statistics_tx_channel_width channel_width;
+} __packed; /* STATISTICS_TX_API_S_VER_4 */
+
+
+struct mvm_statistics_bt_activity {
+        __le32 hi_priority_tx_req_cnt;
+        __le32 hi_priority_tx_denied_cnt;
+        __le32 lo_priority_tx_req_cnt;
+        __le32 lo_priority_tx_denied_cnt;
+        __le32 hi_priority_rx_req_cnt;
+        __le32 hi_priority_rx_denied_cnt;
+        __le32 lo_priority_rx_req_cnt;
+        __le32 lo_priority_rx_denied_cnt;
+} __packed;  /* STATISTICS_BT_ACTIVITY_API_S_VER_1 */
+
+struct mvm_statistics_general {
+        __le32 radio_temperature;
+        __le32 radio_voltage;
+        struct mvm_statistics_dbg dbg;
+        __le32 sleep_time;
+        __le32 slots_out;
+        __le32 slots_idle;
+        __le32 ttl_timestamp;
+        struct mvm_statistics_div slow_div;
+        __le32 rx_enable_counter;
+        /*
+         * num_of_sos_states:
+         *  count the number of times we have to re-tune
+         *  in order to get out of bad PHY status
+         */
+        __le32 num_of_sos_states;
+        __le32 beacon_filtered;
+        __le32 missed_beacons;
+        __s8 beacon_filter_average_energy;
+        __s8 beacon_filter_reason;
+        __s8 beacon_filter_current_energy;
+        __s8 beacon_filter_reserved;
+        __le32 beacon_filter_delta_time;
+        struct mvm_statistics_bt_activity bt_activity;
+} __packed; /* STATISTICS_GENERAL_API_S_VER_5 */
+
+struct mvm_statistics_rx {
+        struct mvm_statistics_rx_phy ofdm;
+        struct mvm_statistics_rx_phy cck;
+        struct mvm_statistics_rx_non_phy general;
+        struct mvm_statistics_rx_ht_phy ofdm_ht;
+} __packed; /* STATISTICS_RX_API_S_VER_3 */
+
+/*
+ * STATISTICS_NOTIFICATION = 0x9d (notification only, not a command)
+ *
+ * By default, uCode issues this notification after receiving a beacon
+ * while associated.  To disable this behavior, set DISABLE_NOTIF flag in the
+ * REPLY_STATISTICS_CMD 0x9c, above.
+ *
+ * Statistics counters continue to increment beacon after beacon, but are
+ * cleared when changing channels or when driver issues REPLY_STATISTICS_CMD
+ * 0x9c with CLEAR_STATS bit set (see above).
+ *
+ * uCode also issues this notification during scans.  uCode clears statistics
+ * appropriately so that each notification contains statistics for only the
+ * one channel that has just been scanned.
+ */
+
+struct iwl_notif_statistics {
+        __le32 flag;
+        struct mvm_statistics_rx rx;
+        struct mvm_statistics_tx tx;
+        struct mvm_statistics_general general;
+} __packed; /* STATISTICS_NTFY_API_S_VER_8 */
+
+#endif /* __fw_api_stats_h__ */
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-tx.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-tx.h
index 5bca1f8bfebf..81c4ea3c6958 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-tx.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-tx.h
@@ -592,4 +592,43 @@ static inline u32 iwl_mvm_get_scd_ssn(struct iwl_mvm_tx_resp *tx_resp)
                             tx_resp->frame_count) & 0xfff;
 }
 
+/**
+ * struct iwl_scd_txq_cfg_cmd - New txq hw scheduler config command
+ * @token:
+ * @sta_id: station id
+ * @tid:
+ * @scd_queue: scheduler queue to confiug
+ * @enable: 1 queue enable, 0 queue disable
+ * @aggregate: 1 aggregated queue, 0 otherwise
+ * @tx_fifo: %enum iwl_mvm_tx_fifo
+ * @window: BA window size
+ * @ssn: SSN for the BA agreement
+ */
+struct iwl_scd_txq_cfg_cmd {
+        u8 token;
+        u8 sta_id;
+        u8 tid;
+        u8 scd_queue;
+        u8 enable;
+        u8 aggregate;
+        u8 tx_fifo;
+        u8 window;
+        __le16 ssn;
+        __le16 reserved;
+} __packed; /* SCD_QUEUE_CFG_CMD_API_S_VER_1 */
+
+/**
+ * struct iwl_scd_txq_cfg_rsp
+ * @token: taken from the command
+ * @sta_id: station id from the command
+ * @tid: tid from the command
+ * @scd_queue: scd_queue from the command
+ */
+struct iwl_scd_txq_cfg_rsp {
+        u8 token;
+        u8 sta_id;
+        u8 tid;
+        u8 scd_queue;
+} __packed; /* SCD_QUEUE_CFG_RSP_API_S_VER_1 */
+
 #endif /* __fw_api_tx_h__ */
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api.h b/drivers/net/wireless/iwlwifi/mvm/fw-api.h
index 88af6dd2ceaa..b56154fe8ec5 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api.h
@@ -74,6 +74,7 @@
 #include "fw-api-d3.h"
 #include "fw-api-coex.h"
 #include "fw-api-scan.h"
+#include "fw-api-stats.h"
 
 /* Tx queue numbers */
 enum {
@@ -128,6 +129,9 @@ enum {
         /* global key */
         WEP_KEY = 0x20,
 
+        /* Memory */
+        SHARED_MEM_CFG = 0x25,
+
         /* TDLS */
         TDLS_CHANNEL_SWITCH_CMD = 0x27,
         TDLS_CHANNEL_SWITCH_NOTIFICATION = 0xaa,
@@ -1381,214 +1385,6 @@ struct iwl_mvm_marker {
         __le32 metadata[0];
 } __packed; /* MARKER_API_S_VER_1 */
 
-struct mvm_statistics_dbg {
-        __le32 burst_check;
-        __le32 burst_count;
-        __le32 wait_for_silence_timeout_cnt;
-        __le32 reserved[3];
-} __packed; /* STATISTICS_DEBUG_API_S_VER_2 */
-
-struct mvm_statistics_div {
-        __le32 tx_on_a;
-        __le32 tx_on_b;
-        __le32 exec_time;
-        __le32 probe_time;
-        __le32 rssi_ant;
-        __le32 reserved2;
-} __packed; /* STATISTICS_SLOW_DIV_API_S_VER_2 */
-
-struct mvm_statistics_general_common {
-        __le32 temperature;   /* radio temperature */
-        __le32 temperature_m; /* radio voltage */
-        struct mvm_statistics_dbg dbg;
-        __le32 sleep_time;
-        __le32 slots_out;
-        __le32 slots_idle;
-        __le32 ttl_timestamp;
-        struct mvm_statistics_div div;
-        __le32 rx_enable_counter;
-        /*
-         * num_of_sos_states:
-         *  count the number of times we have to re-tune
-         *  in order to get out of bad PHY status
-         */
-        __le32 num_of_sos_states;
-} __packed; /* STATISTICS_GENERAL_API_S_VER_5 */
-
-struct mvm_statistics_rx_non_phy {
-        __le32 bogus_cts;       /* CTS received when not expecting CTS */
-        __le32 bogus_ack;       /* ACK received when not expecting ACK */
-        __le32 non_bssid_frames;        /* number of frames with BSSID that
-                                         * doesn't belong to the STA BSSID */
-        __le32 filtered_frames; /* count frames that were dumped in the
-                                 * filtering process */
-        __le32 non_channel_beacons;     /* beacons with our bss id but not on
-                                         * our serving channel */
-        __le32 channel_beacons; /* beacons with our bss id and in our
-                                 * serving channel */
-        __le32 num_missed_bcon; /* number of missed beacons */
-        __le32 adc_rx_saturation_time;  /* count in 0.8us units the time the
-                                         * ADC was in saturation */
-        __le32 ina_detection_search_time;/* total time (in 0.8us) searched
-                                          * for INA */
-        __le32 beacon_silence_rssi_a;   /* RSSI silence after beacon frame */
-        __le32 beacon_silence_rssi_b;   /* RSSI silence after beacon frame */
-        __le32 beacon_silence_rssi_c;   /* RSSI silence after beacon frame */
-        __le32 interference_data_flag;  /* flag for interference data
-                                         * availability. 1 when data is
-                                         * available. */
-        __le32 channel_load;            /* counts RX Enable time in uSec */
-        __le32 dsp_false_alarms;        /* DSP false alarm (both OFDM
-                                         * and CCK) counter */
-        __le32 beacon_rssi_a;
-        __le32 beacon_rssi_b;
-        __le32 beacon_rssi_c;
-        __le32 beacon_energy_a;
-        __le32 beacon_energy_b;
-        __le32 beacon_energy_c;
-        __le32 num_bt_kills;
-        __le32 mac_id;
-        __le32 directed_data_mpdu;
-} __packed; /* STATISTICS_RX_NON_PHY_API_S_VER_3 */
-
-struct mvm_statistics_rx_phy {
-        __le32 ina_cnt;
-        __le32 fina_cnt;
-        __le32 plcp_err;
-        __le32 crc32_err;
-        __le32 overrun_err;
-        __le32 early_overrun_err;
-        __le32 crc32_good;
-        __le32 false_alarm_cnt;
-        __le32 fina_sync_err_cnt;
-        __le32 sfd_timeout;
-        __le32 fina_timeout;
-        __le32 unresponded_rts;
-        __le32 rxe_frame_limit_overrun;
-        __le32 sent_ack_cnt;
-        __le32 sent_cts_cnt;
-        __le32 sent_ba_rsp_cnt;
-        __le32 dsp_self_kill;
-        __le32 mh_format_err;
-        __le32 re_acq_main_rssi_sum;
-        __le32 reserved;
-} __packed; /* STATISTICS_RX_PHY_API_S_VER_2 */
-
-struct mvm_statistics_rx_ht_phy {
-        __le32 plcp_err;
-        __le32 overrun_err;
-        __le32 early_overrun_err;
-        __le32 crc32_good;
-        __le32 crc32_err;
-        __le32 mh_format_err;
-        __le32 agg_crc32_good;
-        __le32 agg_mpdu_cnt;
-        __le32 agg_cnt;
-        __le32 unsupport_mcs;
-} __packed;  /* STATISTICS_HT_RX_PHY_API_S_VER_1 */
-
-#define MAX_CHAINS 3
-
-struct mvm_statistics_tx_non_phy_agg {
-        __le32 ba_timeout;
-        __le32 ba_reschedule_frames;
-        __le32 scd_query_agg_frame_cnt;
-        __le32 scd_query_no_agg;
-        __le32 scd_query_agg;
-        __le32 scd_query_mismatch;
-        __le32 frame_not_ready;
-        __le32 underrun;
-        __le32 bt_prio_kill;
-        __le32 rx_ba_rsp_cnt;
-        __s8 txpower[MAX_CHAINS];
-        __s8 reserved;
-        __le32 reserved2;
-} __packed; /* STATISTICS_TX_NON_PHY_AGG_API_S_VER_1 */
-
-struct mvm_statistics_tx_channel_width {
-        __le32 ext_cca_narrow_ch20[1];
-        __le32 ext_cca_narrow_ch40[2];
-        __le32 ext_cca_narrow_ch80[3];
-        __le32 ext_cca_narrow_ch160[4];
-        __le32 last_tx_ch_width_indx;
-        __le32 rx_detected_per_ch_width[4];
-        __le32 success_per_ch_width[4];
-        __le32 fail_per_ch_width[4];
-}; /* STATISTICS_TX_CHANNEL_WIDTH_API_S_VER_1 */
-
-struct mvm_statistics_tx {
-        __le32 preamble_cnt;
-        __le32 rx_detected_cnt;
-        __le32 bt_prio_defer_cnt;
-        __le32 bt_prio_kill_cnt;
-        __le32 few_bytes_cnt;
-        __le32 cts_timeout;
-        __le32 ack_timeout;
-        __le32 expected_ack_cnt;
-        __le32 actual_ack_cnt;
-        __le32 dump_msdu_cnt;
-        __le32 burst_abort_next_frame_mismatch_cnt;
-        __le32 burst_abort_missing_next_frame_cnt;
-        __le32 cts_timeout_collision;
-        __le32 ack_or_ba_timeout_collision;
-        struct mvm_statistics_tx_non_phy_agg agg;
-        struct mvm_statistics_tx_channel_width channel_width;
-} __packed; /* STATISTICS_TX_API_S_VER_4 */
-
-
-struct mvm_statistics_bt_activity {
-        __le32 hi_priority_tx_req_cnt;
-        __le32 hi_priority_tx_denied_cnt;
-        __le32 lo_priority_tx_req_cnt;
-        __le32 lo_priority_tx_denied_cnt;
-        __le32 hi_priority_rx_req_cnt;
-        __le32 hi_priority_rx_denied_cnt;
-        __le32 lo_priority_rx_req_cnt;
-        __le32 lo_priority_rx_denied_cnt;
-} __packed;  /* STATISTICS_BT_ACTIVITY_API_S_VER_1 */
-
-struct mvm_statistics_general {
-        struct mvm_statistics_general_common common;
-        __le32 beacon_filtered;
-        __le32 missed_beacons;
-        __s8 beacon_filter_average_energy;
-        __s8 beacon_filter_reason;
-        __s8 beacon_filter_current_energy;
-        __s8 beacon_filter_reserved;
-        __le32 beacon_filter_delta_time;
-        struct mvm_statistics_bt_activity bt_activity;
-} __packed; /* STATISTICS_GENERAL_API_S_VER_5 */
-
-struct mvm_statistics_rx {
-        struct mvm_statistics_rx_phy ofdm;
-        struct mvm_statistics_rx_phy cck;
-        struct mvm_statistics_rx_non_phy general;
-        struct mvm_statistics_rx_ht_phy ofdm_ht;
-} __packed; /* STATISTICS_RX_API_S_VER_3 */
-
-/*
- * STATISTICS_NOTIFICATION = 0x9d (notification only, not a command)
- *
- * By default, uCode issues this notification after receiving a beacon
- * while associated.  To disable this behavior, set DISABLE_NOTIF flag in the
- * REPLY_STATISTICS_CMD 0x9c, above.
- *
- * Statistics counters continue to increment beacon after beacon, but are
- * cleared when changing channels or when driver issues REPLY_STATISTICS_CMD
- * 0x9c with CLEAR_STATS bit set (see above).
- *
- * uCode also issues this notification during scans.  uCode clears statistics
- * appropriately so that each notification contains statistics for only the
- * one channel that has just been scanned.
- */
-
-struct iwl_notif_statistics { /* STATISTICS_NTFY_API_S_VER_8 */
-        __le32 flag;
-        struct mvm_statistics_rx rx;
-        struct mvm_statistics_tx tx;
-        struct mvm_statistics_general general;
-} __packed;
-
 /***********************************
  * Smart Fifo API
  ***********************************/
@@ -1680,63 +1476,6 @@ struct iwl_dts_measurement_notif {
         __le32 voltage;
 } __packed; /* TEMPERATURE_MEASUREMENT_TRIGGER_NTFY_S */
 
-/**
- * enum iwl_scd_control - scheduler config command control flags
- * @IWL_SCD_CONTROL_RM_TID: remove TID from this queue
- * @IWL_SCD_CONTROL_SET_SSN: use the SSN and program it into HW
- */
-enum iwl_scd_control {
-        IWL_SCD_CONTROL_RM_TID  = BIT(4),
-        IWL_SCD_CONTROL_SET_SSN = BIT(5),
-};
-
-/**
- * enum iwl_scd_flags - scheduler config command flags
- * @IWL_SCD_FLAGS_SHARE_TID: multiple TIDs map to this queue
- * @IWL_SCD_FLAGS_SHARE_RA: multiple RAs map to this queue
- * @IWL_SCD_FLAGS_DQA_ENABLED: DQA is enabled
- */
-enum iwl_scd_flags {
-        IWL_SCD_FLAGS_SHARE_TID         = BIT(0),
-        IWL_SCD_FLAGS_SHARE_RA          = BIT(1),
-        IWL_SCD_FLAGS_DQA_ENABLED       = BIT(2),
-};
-
-#define IWL_SCDQ_INVALID_STA    0xff
-
-/**
- * struct iwl_scd_txq_cfg_cmd - New txq hw scheduler config command
- * @token:      dialog token addba - unused legacy
- * @sta_id:     station id 4-bit
- * @tid:        TID 0..7
- * @scd_queue:  TFD queue num 0 .. 31
- * @enable:     1 queue enable, 0 queue disable
- * @aggregate:  1 aggregated queue, 0 otherwise
- * @tx_fifo:    tx fifo num 0..7
- * @window:     up to 64
- * @ssn:        starting seq num 12-bit
- * @control:    command control flags
- * @flags:      flags - see &enum iwl_scd_flags
- *
- * Note that every time the command is sent, all parameters must
- * be filled with the exception of
- *  - the SSN, which is only used with @IWL_SCD_CONTROL_SET_SSN
- *  - the window, which is only relevant when starting aggregation
- */
-struct iwl_scd_txq_cfg_cmd {
-        u8 token;
-        u8 sta_id;
-        u8 tid;
-        u8 scd_queue;
-        u8 enable;
-        u8 aggregate;
-        u8 tx_fifo;
-        u8 window;
-        __le16 ssn;
-        u8 control;
-        u8 flags;
-} __packed;
-
 /***********************************
  * TDLS API
  ***********************************/
@@ -1878,4 +1617,36 @@ struct iwl_tdls_config_res {
         struct iwl_tdls_config_sta_info_res sta_info[IWL_MVM_TDLS_STA_COUNT];
 } __packed; /* TDLS_CONFIG_RSP_API_S_VER_1 */
 
+#define TX_FIFO_MAX_NUM         8
+#define RX_FIFO_MAX_NUM         2
+
+/**
+ * Shared memory configuration information from the FW
+ *
+ * @shared_mem_addr: shared memory addr (pre 8000 HW set to 0x0 as MARBH is not
+ *      accessible)
+ * @shared_mem_size: shared memory size
+ * @sample_buff_addr: internal sample (mon/adc) buff addr (pre 8000 HW set to
+ *      0x0 as accessible only via DBGM RDAT)
+ * @sample_buff_size: internal sample buff size
+ * @txfifo_addr: start addr of TXF0 (excluding the context table 0.5KB), (pre
+ *      8000 HW set to 0x0 as not accessible)
+ * @txfifo_size: size of TXF0 ... TXF7
+ * @rxfifo_size: RXF1, RXF2 sizes. If there is no RXF2, it'll have a value of 0
+ * @page_buff_addr: used by UMAC and performance debug (page miss analysis),
+ *      when paging is not supported this should be 0
+ * @page_buff_size: size of %page_buff_addr
+ */
+struct iwl_shared_mem_cfg {
+        __le32 shared_mem_addr;
+        __le32 shared_mem_size;
+        __le32 sample_buff_addr;
+        __le32 sample_buff_size;
+        __le32 txfifo_addr;
+        __le32 txfifo_size[TX_FIFO_MAX_NUM];
+        __le32 rxfifo_size[RX_FIFO_MAX_NUM];
+        __le32 page_buff_addr;
+        __le32 page_buff_size;
+} __packed; /* SHARED_MEM_ALLOC_API_S_VER_1 */
+
 #endif /* __fw_api_h__ */
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw.c b/drivers/net/wireless/iwlwifi/mvm/fw.c
index d0fa6e9ed590..ca38e9817374 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/iwlwifi/mvm/fw.c
@@ -70,6 +70,7 @@
 #include "iwl-debug.h"
 #include "iwl-csr.h" /* for iwl_mvm_rx_card_state_notif */
 #include "iwl-io.h" /* for iwl_mvm_rx_card_state_notif */
+#include "iwl-prph.h"
 #include "iwl-eeprom-parse.h"
 
 #include "mvm.h"
@@ -269,7 +270,7 @@ static int iwl_send_phy_cfg_cmd(struct iwl_mvm *mvm)
         enum iwl_ucode_type ucode_type = mvm->cur_ucode;
 
         /* Set parameters */
-        phy_cfg_cmd.phy_cfg = cpu_to_le32(mvm->fw->phy_config);
+        phy_cfg_cmd.phy_cfg = cpu_to_le32(iwl_mvm_get_phy_config(mvm));
         phy_cfg_cmd.calib_control.event_trigger =
                 mvm->fw->default_calib[ucode_type].event_trigger;
         phy_cfg_cmd.calib_control.flow_trigger =
@@ -346,7 +347,7 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
         mvm->calibrating = true;
 
         /* Send TX valid antennas before triggering calibrations */
-        ret = iwl_send_tx_ant_cfg(mvm, mvm->fw->valid_tx_ant);
+        ret = iwl_send_tx_ant_cfg(mvm, iwl_mvm_get_valid_tx_ant(mvm));
         if (ret)
                 goto error;
 
@@ -399,8 +400,71 @@ out:
         return ret;
 }
 
-static int iwl_mvm_start_fw_dbg_conf(struct iwl_mvm *mvm,
-                                     enum iwl_fw_dbg_conf conf_id)
+static void iwl_mvm_get_shared_mem_conf(struct iwl_mvm *mvm)
+{
+        struct iwl_host_cmd cmd = {
+                .id = SHARED_MEM_CFG,
+                .flags = CMD_WANT_SKB,
+                .data = { NULL, },
+                .len = { 0, },
+        };
+        struct iwl_rx_packet *pkt;
+        struct iwl_shared_mem_cfg *mem_cfg;
+        u32 i;
+
+        lockdep_assert_held(&mvm->mutex);
+
+        if (WARN_ON(iwl_mvm_send_cmd(mvm, &cmd)))
+                return;
+
+        pkt = cmd.resp_pkt;
+        if (pkt->hdr.flags & IWL_CMD_FAILED_MSK) {
+                IWL_ERR(mvm, "Bad return from SHARED_MEM_CFG (0x%08X)\n",
+                        pkt->hdr.flags);
+                goto exit;
+        }
+
+        mem_cfg = (void *)pkt->data;
+
+        mvm->shared_mem_cfg.shared_mem_addr =
+                le32_to_cpu(mem_cfg->shared_mem_addr);
+        mvm->shared_mem_cfg.shared_mem_size =
+                le32_to_cpu(mem_cfg->shared_mem_size);
+        mvm->shared_mem_cfg.sample_buff_addr =
+                le32_to_cpu(mem_cfg->sample_buff_addr);
+        mvm->shared_mem_cfg.sample_buff_size =
+                le32_to_cpu(mem_cfg->sample_buff_size);
+        mvm->shared_mem_cfg.txfifo_addr = le32_to_cpu(mem_cfg->txfifo_addr);
+        for (i = 0; i < ARRAY_SIZE(mvm->shared_mem_cfg.txfifo_size); i++)
+                mvm->shared_mem_cfg.txfifo_size[i] =
+                        le32_to_cpu(mem_cfg->txfifo_size[i]);
+        for (i = 0; i < ARRAY_SIZE(mvm->shared_mem_cfg.rxfifo_size); i++)
+                mvm->shared_mem_cfg.rxfifo_size[i] =
+                        le32_to_cpu(mem_cfg->rxfifo_size[i]);
+        mvm->shared_mem_cfg.page_buff_addr =
+                le32_to_cpu(mem_cfg->page_buff_addr);
+        mvm->shared_mem_cfg.page_buff_size =
+                le32_to_cpu(mem_cfg->page_buff_size);
+        IWL_DEBUG_INFO(mvm, "SHARED MEM CFG: got memory offsets/sizes\n");
+
+exit:
+        iwl_free_resp(&cmd);
+}
+
+void iwl_mvm_fw_dbg_collect(struct iwl_mvm *mvm)
+{
+        /* stop recording */
+        if (mvm->cfg->device_family == IWL_DEVICE_FAMILY_7000) {
+                iwl_set_bits_prph(mvm->trans, MON_BUFF_SAMPLE_CTL, 0x100);
+        } else {
+                iwl_write_prph(mvm->trans, DBGC_IN_SAMPLE, 0);
+                iwl_write_prph(mvm->trans, DBGC_OUT_CTRL, 0);
+        }
+
+        schedule_work(&mvm->fw_error_dump_wk);
+}
+
+int iwl_mvm_start_fw_dbg_conf(struct iwl_mvm *mvm, enum iwl_fw_dbg_conf conf_id)
 {
         u8 *ptr;
         int ret;
@@ -435,6 +499,35 @@ static int iwl_mvm_start_fw_dbg_conf(struct iwl_mvm *mvm,
         return ret;
 }
 
+static int iwl_mvm_config_ltr_v1(struct iwl_mvm *mvm)
+{
+        struct iwl_ltr_config_cmd_v1 cmd_v1 = {
+                .flags = cpu_to_le32(LTR_CFG_FLAG_FEATURE_ENABLE),
+        };
+
+        if (!mvm->trans->ltr_enabled)
+                return 0;
+
+        return iwl_mvm_send_cmd_pdu(mvm, LTR_CONFIG, 0,
+                                    sizeof(cmd_v1), &cmd_v1);
+}
+
+static int iwl_mvm_config_ltr(struct iwl_mvm *mvm)
+{
+        struct iwl_ltr_config_cmd cmd = {
+                .flags = cpu_to_le32(LTR_CFG_FLAG_FEATURE_ENABLE),
+        };
+
+        if (!mvm->trans->ltr_enabled)
+                return 0;
+
+        if (!(mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_HDC_PHASE_0))
+                return iwl_mvm_config_ltr_v1(mvm);
+
+        return iwl_mvm_send_cmd_pdu(mvm, LTR_CONFIG, 0,
+                                    sizeof(cmd), &cmd);
+}
+
 int iwl_mvm_up(struct iwl_mvm *mvm)
 {
         int ret, i;
@@ -482,6 +575,9 @@ int iwl_mvm_up(struct iwl_mvm *mvm)
                 goto error;
         }
 
+        if (IWL_UCODE_API(mvm->fw->ucode_ver) >= 10)
+                iwl_mvm_get_shared_mem_conf(mvm);
+
         ret = iwl_mvm_sf_update(mvm, NULL, false);
         if (ret)
                 IWL_ERR(mvm, "Failed to initialize Smart Fifo\n");
@@ -489,7 +585,7 @@ int iwl_mvm_up(struct iwl_mvm *mvm)
         mvm->fw_dbg_conf = FW_DBG_INVALID;
         iwl_mvm_start_fw_dbg_conf(mvm, FW_DBG_CUSTOM);
 
-        ret = iwl_send_tx_ant_cfg(mvm, mvm->fw->valid_tx_ant);
+        ret = iwl_send_tx_ant_cfg(mvm, iwl_mvm_get_valid_tx_ant(mvm));
         if (ret)
                 goto error;
 
@@ -538,14 +634,7 @@ int iwl_mvm_up(struct iwl_mvm *mvm)
         /* Initialize tx backoffs to the minimal possible */
         iwl_mvm_tt_tx_backoff(mvm, 0);
 
-        if (mvm->trans->ltr_enabled) {
-                struct iwl_ltr_config_cmd cmd = {
-                        .flags = cpu_to_le32(LTR_CFG_FLAG_FEATURE_ENABLE),
-                };
-
-                WARN_ON(iwl_mvm_send_cmd_pdu(mvm, LTR_CONFIG, 0,
-                                             sizeof(cmd), &cmd));
-        }
+        WARN_ON(iwl_mvm_config_ltr(mvm));
 
         ret = iwl_mvm_power_update_device(mvm);
         if (ret)
@@ -584,7 +673,7 @@ int iwl_mvm_load_d3_fw(struct iwl_mvm *mvm)
                 goto error;
         }
 
-        ret = iwl_send_tx_ant_cfg(mvm, mvm->fw->valid_tx_ant);
+        ret = iwl_send_tx_ant_cfg(mvm, iwl_mvm_get_valid_tx_ant(mvm));
         if (ret)
                 goto error;
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
index f6d86ccce6a8..7bdc6220743f 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
@@ -208,8 +208,10 @@ u32 iwl_mvm_mac_get_queues_mask(struct ieee80211_vif *vif)
         if (vif->type == NL80211_IFTYPE_P2P_DEVICE)
                 return BIT(IWL_MVM_OFFCHANNEL_QUEUE);
 
-        for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
-                qmask |= BIT(vif->hw_queue[ac]);
+        for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+                if (vif->hw_queue[ac] != IEEE80211_INVAL_HW_QUEUE)
+                        qmask |= BIT(vif->hw_queue[ac]);
+        }
 
         if (vif->type == NL80211_IFTYPE_AP)
                 qmask |= BIT(vif->cab_queue);
@@ -460,6 +462,9 @@ exit_fail:
 
 int iwl_mvm_mac_ctxt_init(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 {
+        unsigned int wdg_timeout = iwlmvm_mod_params.tfd_q_hang_detect ?
+                                        mvm->cfg->base_params->wd_timeout :
+                                        IWL_WATCHDOG_DISABLED;
         u32 ac;
         int ret;
 
@@ -472,16 +477,17 @@ int iwl_mvm_mac_ctxt_init(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
         switch (vif->type) {
         case NL80211_IFTYPE_P2P_DEVICE:
                 iwl_mvm_enable_ac_txq(mvm, IWL_MVM_OFFCHANNEL_QUEUE,
-                                      IWL_MVM_TX_FIFO_VO);
+                                      IWL_MVM_TX_FIFO_VO, wdg_timeout);
                 break;
         case NL80211_IFTYPE_AP:
                 iwl_mvm_enable_ac_txq(mvm, vif->cab_queue,
-                                      IWL_MVM_TX_FIFO_MCAST);
+                                      IWL_MVM_TX_FIFO_MCAST, wdg_timeout);
                 /* fall through */
         default:
                 for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
                         iwl_mvm_enable_ac_txq(mvm, vif->hw_queue[ac],
-                                              iwl_mvm_ac_to_tx_fifo[ac]);
+                                              iwl_mvm_ac_to_tx_fifo[ac],
+                                              wdg_timeout);
                 break;
         }
 
@@ -496,14 +502,14 @@ void iwl_mvm_mac_ctxt_release(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 
         switch (vif->type) {
         case NL80211_IFTYPE_P2P_DEVICE:
-                iwl_mvm_disable_txq(mvm, IWL_MVM_OFFCHANNEL_QUEUE);
+                iwl_mvm_disable_txq(mvm, IWL_MVM_OFFCHANNEL_QUEUE, 0);
                 break;
         case NL80211_IFTYPE_AP:
-                iwl_mvm_disable_txq(mvm, vif->cab_queue);
+                iwl_mvm_disable_txq(mvm, vif->cab_queue, 0);
                 /* fall through */
         default:
                 for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
-                        iwl_mvm_disable_txq(mvm, vif->hw_queue[ac]);
+                        iwl_mvm_disable_txq(mvm, vif->hw_queue[ac], 0);
         }
 }
 
@@ -975,7 +981,7 @@ static int iwl_mvm_mac_ctxt_send_beacon(struct iwl_mvm *mvm,
         beacon_cmd.tx.tx_flags = cpu_to_le32(tx_flags);
 
         mvm->mgmt_last_antenna_idx =
-                iwl_mvm_next_antenna(mvm, mvm->fw->valid_tx_ant,
+                iwl_mvm_next_antenna(mvm, iwl_mvm_get_valid_tx_ant(mvm),
                                      mvm->mgmt_last_antenna_idx);
 
         beacon_cmd.tx.rate_n_flags =
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index 20915587c820..1ff7ec08532d 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -85,6 +85,7 @@
 #include "testmode.h"
 #include "iwl-fw-error-dump.h"
 #include "iwl-prph.h"
+#include "iwl-csr.h"
 
 static const struct ieee80211_iface_limit iwl_mvm_limits[] = {
         {
@@ -105,7 +106,7 @@ static const struct ieee80211_iface_limit iwl_mvm_limits[] = {
 
 static const struct ieee80211_iface_combination iwl_mvm_iface_combinations[] = {
         {
-                .num_different_channels = 1,
+                .num_different_channels = 2,
                 .max_interfaces = 3,
                 .limits = iwl_mvm_limits,
                 .n_limits = ARRAY_SIZE(iwl_mvm_limits),
@@ -326,6 +327,8 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
         hw->radiotap_vht_details |= IEEE80211_RADIOTAP_VHT_KNOWN_STBC |
                 IEEE80211_RADIOTAP_VHT_KNOWN_BEAMFORMED;
         hw->rate_control_algorithm = "iwl-mvm-rs";
+        hw->uapsd_queues = IWL_MVM_UAPSD_QUEUES;
+        hw->uapsd_max_sp_len = IWL_UAPSD_MAX_SP;
 
         /*
          * Enable 11w if advertised by firmware and software crypto
@@ -336,13 +339,6 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
             !iwlwifi_mod_params.sw_crypto)
                 hw->flags |= IEEE80211_HW_MFP_CAPABLE;
 
-        if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_UAPSD_SUPPORT &&
-            !iwlwifi_mod_params.uapsd_disable) {
-                hw->flags |= IEEE80211_HW_SUPPORTS_UAPSD;
-                hw->uapsd_queues = IWL_MVM_UAPSD_QUEUES;
-                hw->uapsd_max_sp_len = IWL_UAPSD_MAX_SP;
-        }
-
         if (mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_LMAC_SCAN ||
             mvm->fw->ucode_capa.capa[0] & IWL_UCODE_TLV_CAPA_UMAC_SCAN) {
                 hw->flags |= IEEE80211_SINGLE_HW_SCAN_ON_ALL_BANDS;
@@ -377,6 +373,8 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
 
         hw->wiphy->max_remain_on_channel_duration = 10000;
         hw->max_listen_interval = IWL_CONN_MAX_LISTEN_INTERVAL;
+        /* we can compensate an offset of up to 3 channels = 15 MHz */
+        hw->wiphy->max_adj_channel_rssi_comp = 3 * 5;
 
         /* Extract MAC address */
         memcpy(mvm->addresses[0].addr, mvm->nvm_data->hw_addr, ETH_ALEN);
@@ -403,10 +401,15 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
         if (mvm->nvm_data->bands[IEEE80211_BAND_2GHZ].n_channels)
                 hw->wiphy->bands[IEEE80211_BAND_2GHZ] =
                         &mvm->nvm_data->bands[IEEE80211_BAND_2GHZ];
-        if (mvm->nvm_data->bands[IEEE80211_BAND_5GHZ].n_channels)
+        if (mvm->nvm_data->bands[IEEE80211_BAND_5GHZ].n_channels) {
                 hw->wiphy->bands[IEEE80211_BAND_5GHZ] =
                         &mvm->nvm_data->bands[IEEE80211_BAND_5GHZ];
 
+                if (mvm->fw->ucode_capa.capa[0] & IWL_UCODE_TLV_CAPA_BEAMFORMER)
+                        hw->wiphy->bands[IEEE80211_BAND_5GHZ]->vht_cap.cap |=
+                                IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE;
+        }
+
         hw->wiphy->hw_version = mvm->trans->hw_id;
 
         if (iwlmvm_mod_params.power_scheme != IWL_POWER_SCHEME_CAM)
@@ -459,15 +462,17 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
             device_can_wakeup(mvm->trans->dev)) {
                 mvm->wowlan.flags = WIPHY_WOWLAN_ANY;
                 hw->wiphy->wowlan = &mvm->wowlan;
-        } else if (mvm->fw->img[IWL_UCODE_WOWLAN].sec[0].len &&
+        }
+
+        if (mvm->fw->img[IWL_UCODE_WOWLAN].sec[0].len &&
             mvm->trans->ops->d3_suspend &&
             mvm->trans->ops->d3_resume &&
             device_can_wakeup(mvm->trans->dev)) {
-                mvm->wowlan.flags = WIPHY_WOWLAN_MAGIC_PKT |
-                                    WIPHY_WOWLAN_DISCONNECT |
-                                    WIPHY_WOWLAN_EAP_IDENTITY_REQ |
-                                    WIPHY_WOWLAN_RFKILL_RELEASE |
-                                    WIPHY_WOWLAN_NET_DETECT;
+                mvm->wowlan.flags |= WIPHY_WOWLAN_MAGIC_PKT |
+                                     WIPHY_WOWLAN_DISCONNECT |
+                                     WIPHY_WOWLAN_EAP_IDENTITY_REQ |
+                                     WIPHY_WOWLAN_RFKILL_RELEASE |
+                                     WIPHY_WOWLAN_NET_DETECT;
                 if (!iwlwifi_mod_params.sw_crypto)
                         mvm->wowlan.flags |= WIPHY_WOWLAN_SUPPORTS_GTK_REKEY |
                                              WIPHY_WOWLAN_GTK_REKEY_FAILURE |
@@ -707,9 +712,6 @@ static void iwl_mvm_cleanup_iterator(void *data, u8 *mac,
         mvmvif->uploaded = false;
         mvmvif->ap_sta_id = IWL_MVM_STATION_COUNT;
 
-        /* does this make sense at all? */
-        mvmvif->color++;
-
         spin_lock_bh(&mvm->time_event_lock);
         iwl_mvm_te_clear_data(mvm, &mvmvif->time_event_data);
         spin_unlock_bh(&mvm->time_event_lock);
@@ -761,41 +763,215 @@ static void iwl_mvm_free_coredump(const void *data)
         kfree(fw_error_dump);
 }
 
+static void iwl_mvm_dump_fifos(struct iwl_mvm *mvm,
+                               struct iwl_fw_error_dump_data **dump_data)
+{
+        struct iwl_fw_error_dump_fifo *fifo_hdr;
+        u32 *fifo_data;
+        u32 fifo_len;
+        unsigned long flags;
+        int i, j;
+
+        if (!iwl_trans_grab_nic_access(mvm->trans, false, &flags))
+                return;
+
+        /* Pull RXF data from all RXFs */
+        for (i = 0; i < ARRAY_SIZE(mvm->shared_mem_cfg.rxfifo_size); i++) {
+                /*
+                 * Keep aside the additional offset that might be needed for
+                 * next RXF
+                 */
+                u32 offset_diff = RXF_DIFF_FROM_PREV * i;
+
+                fifo_hdr = (void *)(*dump_data)->data;
+                fifo_data = (void *)fifo_hdr->data;
+                fifo_len = mvm->shared_mem_cfg.rxfifo_size[i];
+
+                /* No need to try to read the data if the length is 0 */
+                if (fifo_len == 0)
+                        continue;
+
+                /* Add a TLV for the RXF */
+                (*dump_data)->type = cpu_to_le32(IWL_FW_ERROR_DUMP_RXF);
+                (*dump_data)->len = cpu_to_le32(fifo_len + sizeof(*fifo_hdr));
+
+                fifo_hdr->fifo_num = cpu_to_le32(i);
+                fifo_hdr->available_bytes =
+                        cpu_to_le32(iwl_trans_read_prph(mvm->trans,
+                                                        RXF_RD_D_SPACE +
+                                                        offset_diff));
+                fifo_hdr->wr_ptr =
+                        cpu_to_le32(iwl_trans_read_prph(mvm->trans,
+                                                        RXF_RD_WR_PTR +
+                                                        offset_diff));
+                fifo_hdr->rd_ptr =
+                        cpu_to_le32(iwl_trans_read_prph(mvm->trans,
+                                                        RXF_RD_RD_PTR +
+                                                        offset_diff));
+                fifo_hdr->fence_ptr =
+                        cpu_to_le32(iwl_trans_read_prph(mvm->trans,
+                                                        RXF_RD_FENCE_PTR +
+                                                        offset_diff));
+                fifo_hdr->fence_mode =
+                        cpu_to_le32(iwl_trans_read_prph(mvm->trans,
+                                                        RXF_SET_FENCE_MODE +
+                                                        offset_diff));
+
+                /* Lock fence */
+                iwl_trans_write_prph(mvm->trans,
+                                     RXF_SET_FENCE_MODE + offset_diff, 0x1);
+                /* Set fence pointer to the same place like WR pointer */
+                iwl_trans_write_prph(mvm->trans,
+                                     RXF_LD_WR2FENCE + offset_diff, 0x1);
+                /* Set fence offset */
+                iwl_trans_write_prph(mvm->trans,
+                                     RXF_LD_FENCE_OFFSET_ADDR + offset_diff,
+                                     0x0);
+
+                /* Read FIFO */
+                fifo_len /= sizeof(u32); /* Size in DWORDS */
+                for (j = 0; j < fifo_len; j++)
+                        fifo_data[j] = iwl_trans_read_prph(mvm->trans,
+                                                         RXF_FIFO_RD_FENCE_INC +
+                                                         offset_diff);
+                *dump_data = iwl_fw_error_next_data(*dump_data);
+        }
+
+        /* Pull TXF data from all TXFs */
+        for (i = 0; i < ARRAY_SIZE(mvm->shared_mem_cfg.txfifo_size); i++) {
+                /* Mark the number of TXF we're pulling now */
+                iwl_trans_write_prph(mvm->trans, TXF_LARC_NUM, i);
+
+                fifo_hdr = (void *)(*dump_data)->data;
+                fifo_data = (void *)fifo_hdr->data;
+                fifo_len = mvm->shared_mem_cfg.txfifo_size[i];
+
+                /* No need to try to read the data if the length is 0 */
+                if (fifo_len == 0)
+                        continue;
+
+                /* Add a TLV for the FIFO */
+                (*dump_data)->type = cpu_to_le32(IWL_FW_ERROR_DUMP_TXF);
+                (*dump_data)->len = cpu_to_le32(fifo_len + sizeof(*fifo_hdr));
+
+                fifo_hdr->fifo_num = cpu_to_le32(i);
+                fifo_hdr->available_bytes =
+                        cpu_to_le32(iwl_trans_read_prph(mvm->trans,
+                                                        TXF_FIFO_ITEM_CNT));
+                fifo_hdr->wr_ptr =
+                        cpu_to_le32(iwl_trans_read_prph(mvm->trans,
+                                                        TXF_WR_PTR));
+                fifo_hdr->rd_ptr =
+                        cpu_to_le32(iwl_trans_read_prph(mvm->trans,
+                                                        TXF_RD_PTR));
+                fifo_hdr->fence_ptr =
+                        cpu_to_le32(iwl_trans_read_prph(mvm->trans,
+                                                        TXF_FENCE_PTR));
+                fifo_hdr->fence_mode =
+                        cpu_to_le32(iwl_trans_read_prph(mvm->trans,
+                                                        TXF_LOCK_FENCE));
+
+                /* Set the TXF_READ_MODIFY_ADDR to TXF_WR_PTR */
+                iwl_trans_write_prph(mvm->trans, TXF_READ_MODIFY_ADDR,
+                                     TXF_WR_PTR);
+
+                /* Dummy-read to advance the read pointer to the head */
+                iwl_trans_read_prph(mvm->trans, TXF_READ_MODIFY_DATA);
+
+                /* Read FIFO */
+                fifo_len /= sizeof(u32); /* Size in DWORDS */
+                for (j = 0; j < fifo_len; j++)
+                        fifo_data[j] = iwl_trans_read_prph(mvm->trans,
+                                                          TXF_READ_MODIFY_DATA);
+                *dump_data = iwl_fw_error_next_data(*dump_data);
+        }
+
+        iwl_trans_release_nic_access(mvm->trans, &flags);
+}
+
 void iwl_mvm_fw_error_dump(struct iwl_mvm *mvm)
 {
         struct iwl_fw_error_dump_file *dump_file;
         struct iwl_fw_error_dump_data *dump_data;
         struct iwl_fw_error_dump_info *dump_info;
+        struct iwl_fw_error_dump_mem *dump_mem;
         struct iwl_mvm_dump_ptrs *fw_error_dump;
-        const struct fw_img *img;
         u32 sram_len, sram_ofs;
-        u32 file_len, rxf_len;
-        unsigned long flags;
-        int reg_val;
+        u32 file_len, fifo_data_len = 0;
+        u32 smem_len = mvm->cfg->smem_len;
+        u32 sram2_len = mvm->cfg->dccm2_len;
 
         lockdep_assert_held(&mvm->mutex);
 
+        /* W/A for 8000 HW family A-step */
+        if (mvm->cfg->device_family == IWL_DEVICE_FAMILY_8000 &&
+            CSR_HW_REV_STEP(mvm->trans->hw_rev) == SILICON_A_STEP) {
+                if (smem_len)
+                        smem_len = 0x38000;
+
+                if (sram2_len)
+                        sram2_len = 0x10000;
+        }
+
         fw_error_dump = kzalloc(sizeof(*fw_error_dump), GFP_KERNEL);
         if (!fw_error_dump)
                 return;
 
-        img = &mvm->fw->img[mvm->cur_ucode];
-        sram_ofs = img->sec[IWL_UCODE_SECTION_DATA].offset;
-        sram_len = img->sec[IWL_UCODE_SECTION_DATA].len;
+        /* SRAM - include stack CCM if driver knows the values for it */
+        if (!mvm->cfg->dccm_offset || !mvm->cfg->dccm_len) {
+                const struct fw_img *img;
+
+                img = &mvm->fw->img[mvm->cur_ucode];
+                sram_ofs = img->sec[IWL_UCODE_SECTION_DATA].offset;
+                sram_len = img->sec[IWL_UCODE_SECTION_DATA].len;
+        } else {
+                sram_ofs = mvm->cfg->dccm_offset;
+                sram_len = mvm->cfg->dccm_len;
+        }
+
+        /* reading RXF/TXF sizes */
+        if (test_bit(STATUS_FW_ERROR, &mvm->trans->status)) {
+                struct iwl_mvm_shared_mem_cfg *mem_cfg = &mvm->shared_mem_cfg;
+                int i;
+
+                fifo_data_len = 0;
+
+                /* Count RXF size */
+                for (i = 0; i < ARRAY_SIZE(mem_cfg->rxfifo_size); i++) {
+                        if (!mem_cfg->rxfifo_size[i])
+                                continue;
+
+                        /* Add header info */
+                        fifo_data_len += mem_cfg->rxfifo_size[i] +
+                                         sizeof(*dump_data) +
+                                         sizeof(struct iwl_fw_error_dump_fifo);
+                }
 
-        /* reading buffer size */
-        reg_val = iwl_trans_read_prph(mvm->trans, RXF_SIZE_ADDR);
-        rxf_len = (reg_val & RXF_SIZE_BYTE_CNT_MSK) >> RXF_SIZE_BYTE_CND_POS;
+                for (i = 0; i < ARRAY_SIZE(mem_cfg->txfifo_size); i++) {
+                        if (!mem_cfg->txfifo_size[i])
+                                continue;
 
-        /* the register holds the value divided by 128 */
-        rxf_len = rxf_len << 7;
+                        /* Add header info */
+                        fifo_data_len += mem_cfg->txfifo_size[i] +
+                                         sizeof(*dump_data) +
+                                         sizeof(struct iwl_fw_error_dump_fifo);
+                }
+        }
 
         file_len = sizeof(*dump_file) +
-                   sizeof(*dump_data) * 3 +
-                   sram_len +
-                   rxf_len +
+                   sizeof(*dump_data) * 2 +
+                   sram_len + sizeof(*dump_mem) +
+                   fifo_data_len +
                    sizeof(*dump_info);
 
+        /* Make room for the SMEM, if it exists */
+        if (smem_len)
+                file_len += sizeof(*dump_data) + sizeof(*dump_mem) + smem_len;
+
+        /* Make room for the secondary SRAM, if it exists */
+        if (sram2_len)
+                file_len += sizeof(*dump_data) + sizeof(*dump_mem) + sram2_len;
+
         dump_file = vzalloc(file_len);
         if (!dump_file) {
                 kfree(fw_error_dump);
@@ -814,6 +990,7 @@ void iwl_mvm_fw_error_dump(struct iwl_mvm *mvm)
                 mvm->cfg->device_family == IWL_DEVICE_FAMILY_7000 ?
                         cpu_to_le32(IWL_FW_ERROR_DUMP_FAMILY_7) :
                         cpu_to_le32(IWL_FW_ERROR_DUMP_FAMILY_8);
+        dump_info->hw_step = cpu_to_le32(CSR_HW_REV_STEP(mvm->trans->hw_rev));
         memcpy(dump_info->fw_human_readable, mvm->fw->human_readable,
                sizeof(dump_info->fw_human_readable));
         strncpy(dump_info->dev_human_readable, mvm->cfg->name,
@@ -822,28 +999,39 @@ void iwl_mvm_fw_error_dump(struct iwl_mvm *mvm)
                 sizeof(dump_info->bus_human_readable));
 
         dump_data = iwl_fw_error_next_data(dump_data);
-        dump_data->type = cpu_to_le32(IWL_FW_ERROR_DUMP_RXF);
-        dump_data->len = cpu_to_le32(rxf_len);
-
-        if (iwl_trans_grab_nic_access(mvm->trans, false, &flags)) {
-                u32 *rxf = (void *)dump_data->data;
-                int i;
+        /* We only dump the FIFOs if the FW is in error state */
+        if (test_bit(STATUS_FW_ERROR, &mvm->trans->status))
+                iwl_mvm_dump_fifos(mvm, &dump_data);
+
+        dump_data->type = cpu_to_le32(IWL_FW_ERROR_DUMP_MEM);
+        dump_data->len = cpu_to_le32(sram_len + sizeof(*dump_mem));
+        dump_mem = (void *)dump_data->data;
+        dump_mem->type = cpu_to_le32(IWL_FW_ERROR_DUMP_MEM_SRAM);
+        dump_mem->offset = cpu_to_le32(sram_ofs);
+        iwl_trans_read_mem_bytes(mvm->trans, sram_ofs, dump_mem->data,
+                                 sram_len);
 
-                for (i = 0; i < (rxf_len / sizeof(u32)); i++) {
-                        iwl_trans_write_prph(mvm->trans,
-                                             RXF_LD_FENCE_OFFSET_ADDR,
-                                             i * sizeof(u32));
-                        rxf[i] = iwl_trans_read_prph(mvm->trans,
-                                                     RXF_FIFO_RD_FENCE_ADDR);
-                }
-                iwl_trans_release_nic_access(mvm->trans, &flags);
+        if (smem_len) {
+                dump_data = iwl_fw_error_next_data(dump_data);
+                dump_data->type = cpu_to_le32(IWL_FW_ERROR_DUMP_MEM);
+                dump_data->len = cpu_to_le32(smem_len + sizeof(*dump_mem));
+                dump_mem = (void *)dump_data->data;
+                dump_mem->type = cpu_to_le32(IWL_FW_ERROR_DUMP_MEM_SMEM);
+                dump_mem->offset = cpu_to_le32(mvm->cfg->smem_offset);
+                iwl_trans_read_mem_bytes(mvm->trans, mvm->cfg->smem_offset,
+                                         dump_mem->data, smem_len);
         }
 
-        dump_data = iwl_fw_error_next_data(dump_data);
-        dump_data->type = cpu_to_le32(IWL_FW_ERROR_DUMP_SRAM);
-        dump_data->len = cpu_to_le32(sram_len);
-        iwl_trans_read_mem_bytes(mvm->trans, sram_ofs, dump_data->data,
-                                 sram_len);
+        if (sram2_len) {
+                dump_data = iwl_fw_error_next_data(dump_data);
+                dump_data->type = cpu_to_le32(IWL_FW_ERROR_DUMP_MEM);
+                dump_data->len = cpu_to_le32(sram2_len + sizeof(*dump_mem));
+                dump_mem = (void *)dump_data->data;
+                dump_mem->type = cpu_to_le32(IWL_FW_ERROR_DUMP_MEM_SRAM);
+                dump_mem->offset = cpu_to_le32(mvm->cfg->dccm2_offset);
+                iwl_trans_read_mem_bytes(mvm->trans, mvm->cfg->dccm2_offset,
+                                         dump_mem->data, sram2_len);
+        }
 
         fw_error_dump->trans_ptr = iwl_trans_dump_data(mvm->trans);
         fw_error_dump->op_mode_len = file_len;
@@ -864,6 +1052,11 @@ static void iwl_mvm_restart_cleanup(struct iwl_mvm *mvm)
         if (!test_and_clear_bit(IWL_MVM_STATUS_D3_RECONFIG, &mvm->status))
                 iwl_mvm_fw_error_dump(mvm);
 
+        /* cleanup all stale references (scan, roc), but keep the
+         * ucode_down ref until reconfig is complete
+         */
+        iwl_mvm_unref_all_except(mvm, IWL_MVM_REF_UCODE_DOWN);
+
         iwl_trans_stop_device(mvm->trans);
 
         mvm->scan_status = IWL_MVM_SCAN_NONE;
@@ -893,10 +1086,6 @@ static void iwl_mvm_restart_cleanup(struct iwl_mvm *mvm)
 
         ieee80211_wake_queues(mvm->hw);
 
-        /* cleanup all stale references (scan, roc), but keep the
-         * ucode_down ref until reconfig is complete */
-        iwl_mvm_unref_all_except(mvm, IWL_MVM_REF_UCODE_DOWN);
-
         /* clear any stale d0i3 state */
         clear_bit(IWL_MVM_STATUS_IN_D0I3, &mvm->status);
 
@@ -933,6 +1122,19 @@ static int iwl_mvm_mac_start(struct ieee80211_hw *hw)
         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
         int ret;
 
+        /* Some hw restart cleanups must not hold the mutex */
+        if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) {
+                /*
+                 * Make sure we are out of d0i3. This is needed
+                 * to make sure the reference accounting is correct
+                 * (and there is no stale d0i3_exit_work).
+                 */
+                wait_event_timeout(mvm->d0i3_exit_waitq,
+                                   !test_bit(IWL_MVM_STATUS_IN_D0I3,
+                                             &mvm->status),
+                                   HZ);
+        }
+
         mutex_lock(&mvm->mutex);
         ret = __iwl_mvm_mac_start(mvm);
         mutex_unlock(&mvm->mutex);
@@ -982,6 +1184,13 @@ static void iwl_mvm_resume_complete(struct iwl_mvm *mvm)
                 IWL_DEBUG_RPM(mvm, "Run deferred d0i3 exit\n");
                 _iwl_mvm_exit_d0i3(mvm);
         }
+
+        if (mvm->trans->d0i3_mode == IWL_D0I3_MODE_ON_SUSPEND)
+                if (!wait_event_timeout(mvm->d0i3_exit_waitq,
+                                        !test_bit(IWL_MVM_STATUS_IN_D0I3,
+                                                  &mvm->status),
+                                        HZ))
+                        WARN_ONCE(1, "D0i3 exit on resume timed out\n");
 }
 
 static void
@@ -1146,7 +1355,7 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
 
         ret = iwl_mvm_power_update_mac(mvm);
         if (ret)
-                goto out_release;
+                goto out_remove_mac;
 
         /* beacon filtering */
         ret = iwl_mvm_disable_beacon_filter(mvm, vif, 0);
@@ -2088,7 +2297,7 @@ static void iwl_mvm_sta_pre_rcu_remove(struct ieee80211_hw *hw,
                                        struct ieee80211_sta *sta)
 {
         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
-        struct iwl_mvm_sta *mvm_sta = (void *)sta->drv_priv;
+        struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
 
         /*
          * This is called before mac80211 does RCU synchronisation,
@@ -2105,6 +2314,20 @@ static void iwl_mvm_sta_pre_rcu_remove(struct ieee80211_hw *hw,
         mutex_unlock(&mvm->mutex);
 }
 
+static void iwl_mvm_check_uapsd(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+                                const u8 *bssid)
+{
+        if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_UAPSD_SUPPORT))
+                return;
+
+        if (iwlwifi_mod_params.uapsd_disable) {
+                vif->driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
+                return;
+        }
+
+        vif->driver_flags |= IEEE80211_VIF_SUPPORTS_UAPSD;
+}
+
 static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
                                  struct ieee80211_vif *vif,
                                  struct ieee80211_sta *sta,
@@ -2164,6 +2387,7 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
                  * Reset EBS status here assuming environment has been changed.
                  */
                 mvm->last_ebs_successful = true;
+                iwl_mvm_check_uapsd(mvm, vif, sta->addr);
                 ret = 0;
         } else if (old_state == IEEE80211_STA_AUTH &&
                    new_state == IEEE80211_STA_ASSOC) {
@@ -3103,7 +3327,7 @@ static int iwl_mvm_set_tim(struct ieee80211_hw *hw,
                            bool set)
 {
         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
-        struct iwl_mvm_sta *mvm_sta = (void *)sta->drv_priv;
+        struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
 
         if (!mvm_sta || !mvm_sta->vif) {
                 IWL_ERR(mvm, "Station is not associated to a vif\n");
@@ -3343,16 +3567,18 @@ static void iwl_mvm_mac_flush(struct ieee80211_hw *hw,
                 msk |= mvmsta->tfd_queue_msk;
         }
 
-        msk &= ~BIT(vif->hw_queue[IEEE80211_AC_VO]);
-
-        if (iwl_mvm_flush_tx_path(mvm, msk, true))
-                IWL_ERR(mvm, "flush request fail\n");
-        mutex_unlock(&mvm->mutex);
+        if (drop) {
+                if (iwl_mvm_flush_tx_path(mvm, msk, true))
+                        IWL_ERR(mvm, "flush request fail\n");
+                mutex_unlock(&mvm->mutex);
+        } else {
+                mutex_unlock(&mvm->mutex);
 
-        /* this can take a while, and we may need/want other operations
-         * to succeed while doing this, so do it without the mutex held
-         */
-        iwl_trans_wait_tx_queue_empty(mvm->trans, msk);
+                /* this can take a while, and we may need/want other operations
+                 * to succeed while doing this, so do it without the mutex held
+                 */
+                iwl_trans_wait_tx_queue_empty(mvm->trans, msk);
+        }
 }
 
 const struct ieee80211_ops iwl_mvm_hw_ops = {
diff --git a/drivers/net/wireless/iwlwifi/mvm/mvm.h b/drivers/net/wireless/iwlwifi/mvm/mvm.h
index d24660fb4ef2..6c69d0584f6c 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/iwlwifi/mvm/mvm.h
@@ -119,11 +119,13 @@ extern const struct ieee80211_ops iwl_mvm_hw_ops;
  *      We will register to mac80211 to have testmode working. The NIC must not
  *      be up'ed after the INIT fw asserted. This is useful to be able to use
  *      proprietary tools over testmode to debug the INIT fw.
+ * @tfd_q_hang_detect: enabled the detection of hung transmit queues
  * @power_scheme: CAM(Continuous Active Mode)-1, BPS(Balanced Power
  *      Save)-2(default), LP(Low Power)-3
  */
 struct iwl_mvm_mod_params {
         bool init_dbg;
+        bool tfd_q_hang_detect;
         int power_scheme;
 };
 extern struct iwl_mvm_mod_params iwlmvm_mod_params;
@@ -276,6 +278,7 @@ enum iwl_mvm_ref_type {
         IWL_MVM_REF_TM_CMD,
         IWL_MVM_REF_EXIT_WORK,
         IWL_MVM_REF_PROTECT_CSA,
+        IWL_MVM_REF_FW_DBG_COLLECT,
 
         /* update debugfs.c when changing this */
 
@@ -531,10 +534,23 @@ enum {
 enum iwl_mvm_tdls_cs_state {
         IWL_MVM_TDLS_SW_IDLE = 0,
         IWL_MVM_TDLS_SW_REQ_SENT,
+        IWL_MVM_TDLS_SW_RESP_RCVD,
         IWL_MVM_TDLS_SW_REQ_RCVD,
         IWL_MVM_TDLS_SW_ACTIVE,
 };
 
+struct iwl_mvm_shared_mem_cfg {
+        u32 shared_mem_addr;
+        u32 shared_mem_size;
+        u32 sample_buff_addr;
+        u32 sample_buff_size;
+        u32 txfifo_addr;
+        u32 txfifo_size[TX_FIFO_MAX_NUM];
+        u32 rxfifo_size[RX_FIFO_MAX_NUM];
+        u32 page_buff_addr;
+        u32 page_buff_size;
+};
+
 struct iwl_mvm {
         /* for logger access */
         struct device *dev;
@@ -641,6 +657,8 @@ struct iwl_mvm {
         bool disable_power_off;
         bool disable_power_off_d3;
 
+        bool scan_iter_notif_enabled;
+
         struct debugfs_blob_wrapper nvm_hw_blob;
         struct debugfs_blob_wrapper nvm_sw_blob;
         struct debugfs_blob_wrapper nvm_calib_blob;
@@ -782,8 +800,13 @@ struct iwl_mvm {
                         struct cfg80211_chan_def chandef;
                         struct sk_buff *skb; /* ch sw template */
                         u32 ch_sw_tm_ie;
+
+                        /* timestamp of last ch-sw request sent (GP2 time) */
+                        u32 sent_timestamp;
                 } peer;
         } tdls_cs;
+
+        struct iwl_mvm_shared_mem_cfg shared_mem_cfg;
 };
 
 /* Extract MVM priv from op_mode and _hw */
@@ -850,12 +873,14 @@ iwl_mvm_sta_from_staid_protected(struct iwl_mvm *mvm, u8 sta_id)
 static inline bool iwl_mvm_is_d0i3_supported(struct iwl_mvm *mvm)
 {
         return mvm->trans->cfg->d0i3 &&
+               mvm->trans->d0i3_mode != IWL_D0I3_MODE_OFF &&
+               !iwlwifi_mod_params.d0i3_disable &&
                (mvm->fw->ucode_capa.capa[0] & IWL_UCODE_TLV_CAPA_D0I3_SUPPORT);
 }
 
-static inline bool iwl_mvm_is_dqa_supported(struct iwl_mvm *mvm)
+static inline bool iwl_mvm_is_scd_cfg_supported(struct iwl_mvm *mvm)
 {
-        return mvm->fw->ucode_capa.capa[0] & IWL_UCODE_TLV_CAPA_DQA_SUPPORT;
+        return mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_SCD_CFG;
 }
 
 extern const u8 iwl_mvm_ac_to_tx_fifo[];
@@ -937,6 +962,33 @@ int iwl_mvm_rx_statistics(struct iwl_mvm *mvm,
 int iwl_nvm_init(struct iwl_mvm *mvm, bool read_nvm_from_nic);
 int iwl_mvm_load_nvm_to_nic(struct iwl_mvm *mvm);
 
+static inline u8 iwl_mvm_get_valid_tx_ant(struct iwl_mvm *mvm)
+{
+        return mvm->nvm_data && mvm->nvm_data->valid_tx_ant ?
+               mvm->fw->valid_tx_ant & mvm->nvm_data->valid_tx_ant :
+               mvm->fw->valid_tx_ant;
+}
+
+static inline u8 iwl_mvm_get_valid_rx_ant(struct iwl_mvm *mvm)
+{
+        return mvm->nvm_data && mvm->nvm_data->valid_rx_ant ?
+               mvm->fw->valid_rx_ant & mvm->nvm_data->valid_rx_ant :
+               mvm->fw->valid_rx_ant;
+}
+
+static inline u32 iwl_mvm_get_phy_config(struct iwl_mvm *mvm)
+{
+        u32 phy_config = ~(FW_PHY_CFG_TX_CHAIN |
+                           FW_PHY_CFG_RX_CHAIN);
+        u32 valid_rx_ant = iwl_mvm_get_valid_rx_ant(mvm);
+        u32 valid_tx_ant = iwl_mvm_get_valid_tx_ant(mvm);
+
+        phy_config |= valid_tx_ant << FW_PHY_CFG_TX_CHAIN_POS |
+                      valid_rx_ant << FW_PHY_CFG_RX_CHAIN_POS;
+
+        return mvm->fw->phy_config & phy_config;
+}
+
 int iwl_mvm_up(struct iwl_mvm *mvm);
 int iwl_mvm_load_d3_fw(struct iwl_mvm *mvm);
 
@@ -970,6 +1022,9 @@ int iwl_mvm_rx_radio_ver(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
                          struct iwl_device_cmd *cmd);
 int iwl_mvm_rx_mfuart_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
                             struct iwl_device_cmd *cmd);
+int iwl_mvm_rx_shared_mem_cfg_notif(struct iwl_mvm *mvm,
+                                    struct iwl_rx_cmd_buffer *rxb,
+                                    struct iwl_device_cmd *cmd);
 
 /* MVM PHY */
 int iwl_mvm_phy_ctxt_add(struct iwl_mvm *mvm, struct iwl_mvm_phy_ctxt *ctxt,
@@ -1031,6 +1086,9 @@ int iwl_mvm_max_scan_ie_len(struct iwl_mvm *mvm, bool is_sched_scan);
 int iwl_mvm_rx_scan_offload_complete_notif(struct iwl_mvm *mvm,
                                            struct iwl_rx_cmd_buffer *rxb,
                                            struct iwl_device_cmd *cmd);
+int iwl_mvm_rx_scan_offload_iter_complete_notif(struct iwl_mvm *mvm,
+                                                struct iwl_rx_cmd_buffer *rxb,
+                                                struct iwl_device_cmd *cmd);
 int iwl_mvm_config_sched_scan(struct iwl_mvm *mvm,
                               struct ieee80211_vif *vif,
                               struct cfg80211_sched_scan_request *req,
@@ -1091,9 +1149,7 @@ iwl_mvm_vif_dbgfs_clean(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 
 /* rate scaling */
 int iwl_mvm_send_lq_cmd(struct iwl_mvm *mvm, struct iwl_lq_cmd *lq, bool init);
-void iwl_mvm_update_frame_stats(struct iwl_mvm *mvm,
-                                struct iwl_mvm_frame_stats *stats,
-                                u32 rate, bool agg);
+void iwl_mvm_update_frame_stats(struct iwl_mvm *mvm, u32 rate, bool agg);
 int rs_pretty_print_rate(char *buf, const u32 rate);
 void rs_update_last_rssi(struct iwl_mvm *mvm,
                          struct iwl_lq_sta *lq_sta,
@@ -1159,6 +1215,8 @@ void iwl_mvm_unref(struct iwl_mvm *mvm, enum iwl_mvm_ref_type ref_type);
 int iwl_mvm_ref_sync(struct iwl_mvm *mvm, enum iwl_mvm_ref_type ref_type);
 bool iwl_mvm_ref_taken(struct iwl_mvm *mvm);
 void iwl_mvm_d0i3_enable_tx(struct iwl_mvm *mvm, __le16 *qos_seq);
+int iwl_mvm_enter_d0i3(struct iwl_op_mode *op_mode);
+int iwl_mvm_exit_d0i3(struct iwl_op_mode *op_mode);
 int _iwl_mvm_exit_d0i3(struct iwl_mvm *mvm);
 
 /* BT Coex */
@@ -1260,11 +1318,13 @@ static inline bool iwl_mvm_vif_low_latency(struct iwl_mvm_vif *mvmvif)
 
 /* hw scheduler queue config */
 void iwl_mvm_enable_txq(struct iwl_mvm *mvm, int queue, u16 ssn,
-                        const struct iwl_trans_txq_scd_cfg *cfg);
-void iwl_mvm_disable_txq(struct iwl_mvm *mvm, int queue);
+                        const struct iwl_trans_txq_scd_cfg *cfg,
+                        unsigned int wdg_timeout);
+void iwl_mvm_disable_txq(struct iwl_mvm *mvm, int queue, u8 flags);
 
-static inline void iwl_mvm_enable_ac_txq(struct iwl_mvm *mvm, int queue,
-                                         u8 fifo)
+static inline
+void iwl_mvm_enable_ac_txq(struct iwl_mvm *mvm, int queue,
+                           u8 fifo, unsigned int wdg_timeout)
 {
         struct iwl_trans_txq_scd_cfg cfg = {
                 .fifo = fifo,
@@ -1273,12 +1333,13 @@ static inline void iwl_mvm_enable_ac_txq(struct iwl_mvm *mvm, int queue,
                 .frame_limit = IWL_FRAME_LIMIT,
         };
 
-        iwl_mvm_enable_txq(mvm, queue, 0, &cfg);
+        iwl_mvm_enable_txq(mvm, queue, 0, &cfg, wdg_timeout);
 }
 
 static inline void iwl_mvm_enable_agg_txq(struct iwl_mvm *mvm, int queue,
                                           int fifo, int sta_id, int tid,
-                                          int frame_limit, u16 ssn)
+                                          int frame_limit, u16 ssn,
+                                          unsigned int wdg_timeout)
 {
         struct iwl_trans_txq_scd_cfg cfg = {
                 .fifo = fifo,
@@ -1288,7 +1349,7 @@ static inline void iwl_mvm_enable_agg_txq(struct iwl_mvm *mvm, int queue,
                 .aggregate = true,
         };
 
-        iwl_mvm_enable_txq(mvm, queue, ssn, &cfg);
+        iwl_mvm_enable_txq(mvm, queue, ssn, &cfg, wdg_timeout);
 }
 
 /* Assoc status */
@@ -1344,4 +1405,7 @@ struct ieee80211_vif *iwl_mvm_get_bss_vif(struct iwl_mvm *mvm);
 void iwl_mvm_nic_restart(struct iwl_mvm *mvm, bool fw_error);
 void iwl_mvm_fw_error_dump(struct iwl_mvm *mvm);
 
+int iwl_mvm_start_fw_dbg_conf(struct iwl_mvm *mvm, enum iwl_fw_dbg_conf id);
+void iwl_mvm_fw_dbg_collect(struct iwl_mvm *mvm);
+
 #endif /* __IWL_MVM_H__ */
diff --git a/drivers/net/wireless/iwlwifi/mvm/nvm.c b/drivers/net/wireless/iwlwifi/mvm/nvm.c
index d55fd8e3654c..5383429d96c1 100644
--- a/drivers/net/wireless/iwlwifi/mvm/nvm.c
+++ b/drivers/net/wireless/iwlwifi/mvm/nvm.c
@@ -356,7 +356,7 @@ static int iwl_mvm_read_external_nvm(struct iwl_mvm *mvm)
                 max_section_size = IWL_MAX_NVM_SECTION_SIZE;
         else if (CSR_HW_REV_STEP(mvm->trans->hw_rev) == SILICON_A_STEP)
                 max_section_size = IWL_MAX_NVM_8000A_SECTION_SIZE;
-        else /* Family 8000 B-step */
+        else /* Family 8000 B-step or C-step */
                 max_section_size = IWL_MAX_NVM_8000B_SECTION_SIZE;
 
         /*
@@ -565,6 +565,8 @@ int iwl_nvm_init(struct iwl_mvm *mvm, bool read_nvm_from_nic)
         mvm->nvm_data = iwl_parse_nvm_sections(mvm);
         if (!mvm->nvm_data)
                 return -ENODATA;
+        IWL_DEBUG_EEPROM(mvm->trans->dev, "nvm version = %x\n",
+                         mvm->nvm_data->nvm_version);
 
         return 0;
 }
diff --git a/drivers/net/wireless/iwlwifi/mvm/ops.c b/drivers/net/wireless/iwlwifi/mvm/ops.c
index 97dfba50c682..2dffc3600ed3 100644
--- a/drivers/net/wireless/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/iwlwifi/mvm/ops.c
@@ -84,15 +84,8 @@
 #include "time-event.h"
 #include "iwl-fw-error-dump.h"
 
-/*
- * module name, copyright, version, etc.
- */
 #define DRV_DESCRIPTION "The new Intel(R) wireless AGN driver for Linux"
-
-#define DRV_VERSION     IWLWIFI_VERSION
-
 MODULE_DESCRIPTION(DRV_DESCRIPTION);
-MODULE_VERSION(DRV_VERSION);
 MODULE_AUTHOR(DRV_COPYRIGHT " " DRV_AUTHOR);
 MODULE_LICENSE("GPL");
 
@@ -100,6 +93,7 @@ static const struct iwl_op_mode_ops iwl_mvm_ops;
 
 struct iwl_mvm_mod_params iwlmvm_mod_params = {
         .power_scheme = IWL_POWER_SCHEME_BPS,
+        .tfd_q_hang_detect = true
         /* rest of fields are 0 by default */
 };
 
@@ -109,6 +103,10 @@ MODULE_PARM_DESC(init_dbg,
 module_param_named(power_scheme, iwlmvm_mod_params.power_scheme, int, S_IRUGO);
 MODULE_PARM_DESC(power_scheme,
                  "power management scheme: 1-active, 2-balanced, 3-low power, default: 2");
+module_param_named(tfd_q_hang_detect, iwlmvm_mod_params.tfd_q_hang_detect,
+                   bool, S_IRUGO);
+MODULE_PARM_DESC(tfd_q_hang_detect,
+                 "TFD queues hang detection (default: true");
 
 /*
  * module init and exit functions
@@ -146,13 +144,14 @@ static void iwl_mvm_nic_config(struct iwl_op_mode *op_mode)
         struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
         u8 radio_cfg_type, radio_cfg_step, radio_cfg_dash;
         u32 reg_val = 0;
+        u32 phy_config = iwl_mvm_get_phy_config(mvm);
 
-        radio_cfg_type = (mvm->fw->phy_config & FW_PHY_CFG_RADIO_TYPE) >>
-                          FW_PHY_CFG_RADIO_TYPE_POS;
-        radio_cfg_step = (mvm->fw->phy_config & FW_PHY_CFG_RADIO_STEP) >>
-                          FW_PHY_CFG_RADIO_STEP_POS;
-        radio_cfg_dash = (mvm->fw->phy_config & FW_PHY_CFG_RADIO_DASH) >>
-                          FW_PHY_CFG_RADIO_DASH_POS;
+        radio_cfg_type = (phy_config & FW_PHY_CFG_RADIO_TYPE) >>
+                         FW_PHY_CFG_RADIO_TYPE_POS;
+        radio_cfg_step = (phy_config & FW_PHY_CFG_RADIO_STEP) >>
+                         FW_PHY_CFG_RADIO_STEP_POS;
+        radio_cfg_dash = (phy_config & FW_PHY_CFG_RADIO_DASH) >>
+                         FW_PHY_CFG_RADIO_DASH_POS;
 
         /* SKU control */
         reg_val |= CSR_HW_REV_STEP(mvm->trans->hw_rev) <<
@@ -240,6 +239,8 @@ static const struct iwl_rx_handlers iwl_mvm_rx_handlers[] = {
 
         RX_HANDLER(SCAN_REQUEST_CMD, iwl_mvm_rx_scan_response, false),
         RX_HANDLER(SCAN_COMPLETE_NOTIFICATION, iwl_mvm_rx_scan_complete, true),
+        RX_HANDLER(SCAN_ITERATION_COMPLETE,
+                   iwl_mvm_rx_scan_offload_iter_complete_notif, false),
         RX_HANDLER(SCAN_OFFLOAD_COMPLETE,
                    iwl_mvm_rx_scan_offload_complete_notif, true),
         RX_HANDLER(MATCH_FOUND_NOTIFICATION, iwl_mvm_rx_scan_offload_results,
@@ -274,6 +275,7 @@ static const char *const iwl_mvm_cmd_strings[REPLY_MAX] = {
         CMD(MGMT_MCAST_KEY),
         CMD(TX_CMD),
         CMD(TXPATH_FLUSH),
+        CMD(SHARED_MEM_CFG),
         CMD(MAC_CONTEXT_CMD),
         CMD(TIME_EVENT_CMD),
         CMD(TIME_EVENT_NOTIFICATION),
@@ -476,17 +478,19 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
         if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_DW_BC_TABLE)
                 trans_cfg.bc_table_dword = true;
 
-        if (!iwlwifi_mod_params.wd_disable)
-                trans_cfg.queue_watchdog_timeout = cfg->base_params->wd_timeout;
-        else
-                trans_cfg.queue_watchdog_timeout = IWL_WATCHDOG_DISABLED;
-
         trans_cfg.command_names = iwl_mvm_cmd_strings;
 
         trans_cfg.cmd_queue = IWL_MVM_CMD_QUEUE;
         trans_cfg.cmd_fifo = IWL_MVM_TX_FIFO_CMD;
         trans_cfg.scd_set_active = true;
 
+        trans_cfg.sdio_adma_addr = fw->sdio_adma_addr;
+
+        /* Set a short watchdog for the command queue */
+        trans_cfg.cmd_q_wdg_timeout =
+                iwlmvm_mod_params.tfd_q_hang_detect ? IWL_DEF_WD_TIMEOUT :
+                                                      IWL_WATCHDOG_DISABLED;
+
         snprintf(mvm->hw->wiphy->fw_version,
                  sizeof(mvm->hw->wiphy->fw_version),
                  "%s", fw->fw_version);
@@ -517,10 +521,15 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
         min_backoff = calc_min_backoff(trans, cfg);
         iwl_mvm_tt_initialize(mvm, min_backoff);
         /* set the nvm_file_name according to priority */
-        if (iwlwifi_mod_params.nvm_file)
+        if (iwlwifi_mod_params.nvm_file) {
                 mvm->nvm_file_name = iwlwifi_mod_params.nvm_file;
-        else
-                mvm->nvm_file_name = mvm->cfg->default_nvm_file;
+        } else {
+                if ((trans->cfg->device_family == IWL_DEVICE_FAMILY_8000) &&
+                    (CSR_HW_REV_STEP(trans->hw_rev) == SILICON_A_STEP))
+                        mvm->nvm_file_name = mvm->cfg->default_nvm_file_8000A;
+                else
+                        mvm->nvm_file_name = mvm->cfg->default_nvm_file;
+        }
 
         if (WARN(cfg->no_power_up_nic_in_init && !mvm->nvm_file_name,
                  "not allowing power-up and not having nvm_file\n"))
@@ -559,6 +568,9 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
         if (!mvm->scan_cmd)
                 goto out_free;
 
+        /* Set EBS as successful as long as not stated otherwise by the FW. */
+        mvm->last_ebs_successful = true;
+
         err = iwl_mvm_mac_setup_register(mvm);
         if (err)
                 goto out_free;
@@ -817,9 +829,20 @@ static void iwl_mvm_fw_error_dump_wk(struct work_struct *work)
         struct iwl_mvm *mvm =
                 container_of(work, struct iwl_mvm, fw_error_dump_wk);
 
+        if (iwl_mvm_ref_sync(mvm, IWL_MVM_REF_FW_DBG_COLLECT))
+                return;
+
         mutex_lock(&mvm->mutex);
         iwl_mvm_fw_error_dump(mvm);
+
+        /* start recording again if the firmware is not crashed */
+        WARN_ON_ONCE((!test_bit(STATUS_FW_ERROR, &mvm->trans->status)) &&
+                      mvm->fw->dbg_dest_tlv &&
+                      iwl_mvm_start_fw_dbg_conf(mvm, mvm->fw_dbg_conf));
+
         mutex_unlock(&mvm->mutex);
+
+        iwl_mvm_unref(mvm, IWL_MVM_REF_FW_DBG_COLLECT);
 }
 
 void iwl_mvm_nic_restart(struct iwl_mvm *mvm, bool fw_error)
@@ -855,7 +878,10 @@ void iwl_mvm_nic_restart(struct iwl_mvm *mvm, bool fw_error)
          * If WoWLAN fw asserted, don't restart either, mac80211
          * can't recover this since we're already half suspended.
          */
-        if (test_and_set_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) {
+        if (!mvm->restart_fw && fw_error) {
+                schedule_work(&mvm->fw_error_dump_wk);
+        } else if (test_and_set_bit(IWL_MVM_STATUS_IN_HW_RESTART,
+                                    &mvm->status)) {
                 struct iwl_mvm_reprobe *reprobe;
 
                 IWL_ERR(mvm,
@@ -879,16 +905,13 @@ void iwl_mvm_nic_restart(struct iwl_mvm *mvm, bool fw_error)
                 reprobe->dev = mvm->trans->dev;
                 INIT_WORK(&reprobe->work, iwl_mvm_reprobe_wk);
                 schedule_work(&reprobe->work);
-        } else if (mvm->cur_ucode == IWL_UCODE_REGULAR &&
-                   (!fw_error || mvm->restart_fw)) {
+        } else if (mvm->cur_ucode == IWL_UCODE_REGULAR) {
                 /* don't let the transport/FW power down */
                 iwl_mvm_ref(mvm, IWL_MVM_REF_UCODE_DOWN);
 
                 if (fw_error && mvm->restart_fw > 0)
                         mvm->restart_fw--;
                 ieee80211_restart_hw(mvm->hw);
-        } else if (fw_error) {
-                schedule_work(&mvm->fw_error_dump_wk);
         }
 }
 
@@ -1031,7 +1054,8 @@ static void iwl_mvm_set_wowlan_data(struct iwl_mvm *mvm,
 out:
         rcu_read_unlock();
 }
-static int iwl_mvm_enter_d0i3(struct iwl_op_mode *op_mode)
+
+int iwl_mvm_enter_d0i3(struct iwl_op_mode *op_mode)
 {
         struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
         u32 flags = CMD_ASYNC | CMD_HIGH_PRIO | CMD_SEND_IN_IDLE;
@@ -1047,6 +1071,7 @@ static int iwl_mvm_enter_d0i3(struct iwl_op_mode *op_mode)
         };
         struct iwl_d3_manager_config d3_cfg_cmd = {
                 .min_sleep_time = cpu_to_le32(1000),
+                .wakeup_flags = cpu_to_le32(IWL_WAKEUP_D3_CONFIG_FW_ERROR),
         };
 
         IWL_DEBUG_RPM(mvm, "MVM entering D0i3\n");
@@ -1146,7 +1171,7 @@ void iwl_mvm_d0i3_enable_tx(struct iwl_mvm *mvm, __le16 *qos_seq)
 
         if (mvm->d0i3_offloading && qos_seq) {
                 /* update qos seq numbers if offloading was enabled */
-                mvm_ap_sta = (struct iwl_mvm_sta *)sta->drv_priv;
+                mvm_ap_sta = iwl_mvm_sta_from_mac80211(sta);
                 for (i = 0; i < IWL_MAX_TID_COUNT; i++) {
                         u16 seq = le16_to_cpu(qos_seq[i]);
                         /* firmware stores last-used one, we store next one */
@@ -1245,7 +1270,7 @@ out:
         return ret;
 }
 
-static int iwl_mvm_exit_d0i3(struct iwl_op_mode *op_mode)
+int iwl_mvm_exit_d0i3(struct iwl_op_mode *op_mode)
 {
         struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/phy-ctxt.c b/drivers/net/wireless/iwlwifi/mvm/phy-ctxt.c
index 1c0d4a45c1a8..5b43616eeb06 100644
--- a/drivers/net/wireless/iwlwifi/mvm/phy-ctxt.c
+++ b/drivers/net/wireless/iwlwifi/mvm/phy-ctxt.c
@@ -170,13 +170,13 @@ static void iwl_mvm_phy_ctxt_cmd_data(struct iwl_mvm *mvm,
                 active_cnt = 2;
         }
 
-        cmd->rxchain_info = cpu_to_le32(mvm->fw->valid_rx_ant <<
+        cmd->rxchain_info = cpu_to_le32(iwl_mvm_get_valid_rx_ant(mvm) <<
                                         PHY_RX_CHAIN_VALID_POS);
         cmd->rxchain_info |= cpu_to_le32(idle_cnt << PHY_RX_CHAIN_CNT_POS);
         cmd->rxchain_info |= cpu_to_le32(active_cnt <<
                                          PHY_RX_CHAIN_MIMO_CNT_POS);
 
-        cmd->txchain_info = cpu_to_le32(mvm->fw->valid_tx_ant);
+        cmd->txchain_info = cpu_to_le32(iwl_mvm_get_valid_tx_ant(mvm));
 }
 
 /*
diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.c b/drivers/net/wireless/iwlwifi/mvm/rs.c
index 30ceb67ed7a7..194bd1f939ca 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/rs.c
@@ -39,28 +39,16 @@
 #include "sta.h"
 #include "iwl-op-mode.h"
 #include "mvm.h"
+#include "debugfs.h"
 
 #define RS_NAME "iwl-mvm-rs"
 
-#define NUM_TRY_BEFORE_ANT_TOGGLE       1
-#define RS_LEGACY_RETRIES_PER_RATE      1
-#define RS_HT_VHT_RETRIES_PER_RATE      2
-#define RS_HT_VHT_RETRIES_PER_RATE_TW   1
-#define RS_INITIAL_MIMO_NUM_RATES       3
-#define RS_INITIAL_SISO_NUM_RATES       3
-#define RS_INITIAL_LEGACY_NUM_RATES     LINK_QUAL_MAX_RETRY_NUM
-#define RS_SECONDARY_LEGACY_NUM_RATES   LINK_QUAL_MAX_RETRY_NUM
-#define RS_SECONDARY_SISO_NUM_RATES     3
-#define RS_SECONDARY_SISO_RETRIES       1
-
 #define IWL_RATE_MAX_WINDOW             62      /* # tx in history window */
-#define IWL_RATE_MIN_FAILURE_TH         3       /* min failures to calc tpt */
-#define IWL_RATE_MIN_SUCCESS_TH         8       /* min successes to calc tpt */
 
-/* max allowed rate miss before sync LQ cmd */
-#define IWL_MISSED_RATE_MAX             15
-#define RS_STAY_IN_COLUMN_TIMEOUT       (5*HZ)
-#define RS_IDLE_TIMEOUT                 (5*HZ)
+/* Calculations of success ratio are done in fixed point where 12800 is 100%.
+ * Use this macro when dealing with thresholds consts set as a percentage
+ */
+#define RS_PERCENT(x) (128 * x)
 
 static u8 rs_ht_to_legacy[] = {
         [IWL_RATE_MCS_0_INDEX] = IWL_RATE_6M_INDEX,
@@ -173,7 +161,7 @@ static bool rs_mimo_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
         if (sta->smps_mode == IEEE80211_SMPS_STATIC)
                 return false;
 
-        if (num_of_ant(mvm->fw->valid_tx_ant) < 2)
+        if (num_of_ant(iwl_mvm_get_valid_tx_ant(mvm)) < 2)
                 return false;
 
         if (!iwl_mvm_bt_coex_is_mimo_allowed(mvm, sta))
@@ -613,7 +601,8 @@ static s32 get_expected_tpt(struct iwl_scale_tbl_info *tbl, int rs_index)
  * at this rate.  window->data contains the bitmask of successful
  * packets.
  */
-static int _rs_collect_tx_data(struct iwl_scale_tbl_info *tbl,
+static int _rs_collect_tx_data(struct iwl_mvm *mvm,
+                               struct iwl_scale_tbl_info *tbl,
                                int scale_index, int attempts, int successes,
                                struct iwl_rate_scale_data *window)
 {
@@ -668,8 +657,8 @@ static int _rs_collect_tx_data(struct iwl_scale_tbl_info *tbl,
         fail_count = window->counter - window->success_counter;
 
         /* Calculate average throughput, if we have enough history. */
-        if ((fail_count >= IWL_RATE_MIN_FAILURE_TH) ||
-            (window->success_counter >= IWL_RATE_MIN_SUCCESS_TH))
+        if ((fail_count >= IWL_MVM_RS_RATE_MIN_FAILURE_TH) ||
+            (window->success_counter >= IWL_MVM_RS_RATE_MIN_SUCCESS_TH))
                 window->average_tpt = (window->success_ratio * tpt + 64) / 128;
         else
                 window->average_tpt = IWL_INVALID_VALUE;
@@ -677,7 +666,8 @@ static int _rs_collect_tx_data(struct iwl_scale_tbl_info *tbl,
         return 0;
 }
 
-static int rs_collect_tx_data(struct iwl_lq_sta *lq_sta,
+static int rs_collect_tx_data(struct iwl_mvm *mvm,
+                              struct iwl_lq_sta *lq_sta,
                               struct iwl_scale_tbl_info *tbl,
                               int scale_index, int attempts, int successes,
                               u8 reduced_txp)
@@ -698,7 +688,7 @@ static int rs_collect_tx_data(struct iwl_lq_sta *lq_sta,
         /* Select window for current tx bit rate */
         window = &(tbl->win[scale_index]);
 
-        ret = _rs_collect_tx_data(tbl, scale_index, attempts, successes,
+        ret = _rs_collect_tx_data(mvm, tbl, scale_index, attempts, successes,
                                   window);
         if (ret)
                 return ret;
@@ -707,7 +697,7 @@ static int rs_collect_tx_data(struct iwl_lq_sta *lq_sta,
                 return -EINVAL;
 
         window = &tbl->tpc_win[reduced_txp];
-        return _rs_collect_tx_data(tbl, scale_index, attempts, successes,
+        return _rs_collect_tx_data(mvm, tbl, scale_index, attempts, successes,
                                    window);
 }
 
@@ -928,7 +918,6 @@ static u16 rs_get_adjacent_rate(struct iwl_mvm *mvm, u8 index, u16 rate_mask,
                         break;
                 if (rate_mask & (1 << low))
                         break;
-                IWL_DEBUG_RATE(mvm, "Skipping masked lower rate: %d\n", low);
         }
 
         high = index;
@@ -938,7 +927,6 @@ static u16 rs_get_adjacent_rate(struct iwl_mvm *mvm, u8 index, u16 rate_mask,
                         break;
                 if (rate_mask & (1 << high))
                         break;
-                IWL_DEBUG_RATE(mvm, "Skipping masked higher rate: %d\n", high);
         }
 
         return (high << 8) | low;
@@ -1004,7 +992,7 @@ static void rs_get_lower_rate_down_column(struct iwl_lq_sta *lq_sta,
         }
 
         if (num_of_ant(rate->ant) > 1)
-                rate->ant = first_antenna(mvm->fw->valid_tx_ant);
+                rate->ant = first_antenna(iwl_mvm_get_valid_tx_ant(mvm));
 
         /* Relevant in both switching to SISO or Legacy */
         rate->sgi = false;
@@ -1125,7 +1113,8 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
         }
 
         if (time_after(jiffies,
-                       (unsigned long)(lq_sta->last_tx + RS_IDLE_TIMEOUT))) {
+                       (unsigned long)(lq_sta->last_tx +
+                                       (IWL_MVM_RS_IDLE_TIMEOUT * HZ)))) {
                 int t;
 
                 IWL_DEBUG_RATE(mvm, "Tx idle for too long. reinit rs\n");
@@ -1158,7 +1147,7 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                  * ... driver.
                  */
                 lq_sta->missed_rate_counter++;
-                if (lq_sta->missed_rate_counter > IWL_MISSED_RATE_MAX) {
+                if (lq_sta->missed_rate_counter > IWL_MVM_RS_MISSED_RATE_MAX) {
                         lq_sta->missed_rate_counter = 0;
                         IWL_DEBUG_RATE(mvm,
                                        "Too many rates mismatch. Send sync LQ. rs_state %d\n",
@@ -1213,7 +1202,7 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
 
                 ucode_rate = le32_to_cpu(table->rs_table[0]);
                 rs_rate_from_ucode_rate(ucode_rate, info->band, &rate);
-                rs_collect_tx_data(lq_sta, curr_tbl, rate.index,
+                rs_collect_tx_data(mvm, lq_sta, curr_tbl, rate.index,
                                    info->status.ampdu_len,
                                    info->status.ampdu_ack_len,
                                    reduced_txp);
@@ -1249,7 +1238,7 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                         else
                                 continue;
 
-                        rs_collect_tx_data(lq_sta, tmp_tbl, rate.index, 1,
+                        rs_collect_tx_data(mvm, lq_sta, tmp_tbl, rate.index, 1,
                                            i < retries ? 0 : legacy_success,
                                            reduced_txp);
                 }
@@ -1303,13 +1292,13 @@ static void rs_set_stay_in_table(struct iwl_mvm *mvm, u8 is_legacy,
         IWL_DEBUG_RATE(mvm, "Moving to RS_STATE_STAY_IN_COLUMN\n");
         lq_sta->rs_state = RS_STATE_STAY_IN_COLUMN;
         if (is_legacy) {
-                lq_sta->table_count_limit = IWL_LEGACY_TABLE_COUNT;
-                lq_sta->max_failure_limit = IWL_LEGACY_FAILURE_LIMIT;
-                lq_sta->max_success_limit = IWL_LEGACY_SUCCESS_LIMIT;
+                lq_sta->table_count_limit = IWL_MVM_RS_LEGACY_TABLE_COUNT;
+                lq_sta->max_failure_limit = IWL_MVM_RS_LEGACY_FAILURE_LIMIT;
+                lq_sta->max_success_limit = IWL_MVM_RS_LEGACY_SUCCESS_LIMIT;
         } else {
-                lq_sta->table_count_limit = IWL_NONE_LEGACY_TABLE_COUNT;
-                lq_sta->max_failure_limit = IWL_NONE_LEGACY_FAILURE_LIMIT;
-                lq_sta->max_success_limit = IWL_NONE_LEGACY_SUCCESS_LIMIT;
+                lq_sta->table_count_limit = IWL_MVM_RS_NON_LEGACY_TABLE_COUNT;
+                lq_sta->max_failure_limit = IWL_MVM_RS_NON_LEGACY_FAILURE_LIMIT;
+                lq_sta->max_success_limit = IWL_MVM_RS_NON_LEGACY_SUCCESS_LIMIT;
         }
         lq_sta->table_count = 0;
         lq_sta->total_failed = 0;
@@ -1318,6 +1307,13 @@ static void rs_set_stay_in_table(struct iwl_mvm *mvm, u8 is_legacy,
         lq_sta->visited_columns = 0;
 }
 
+static inline int rs_get_max_rate_from_mask(unsigned long rate_mask)
+{
+        if (rate_mask)
+                return find_last_bit(&rate_mask, BITS_PER_LONG);
+        return IWL_RATE_INVALID;
+}
+
 static int rs_get_max_allowed_rate(struct iwl_lq_sta *lq_sta,
                                    const struct rs_tx_column *column)
 {
@@ -1420,7 +1416,7 @@ static s32 rs_get_best_rate(struct iwl_mvm *mvm,
         u32 target_tpt;
         int rate_idx;
 
-        if (success_ratio > RS_SR_NO_DECREASE) {
+        if (success_ratio > IWL_MVM_RS_SR_NO_DECREASE) {
                 target_tpt = 100 * expected_current_tpt;
                 IWL_DEBUG_RATE(mvm,
                                "SR %d high. Find rate exceeding EXPECTED_CURRENT %d\n",
@@ -1488,7 +1484,7 @@ static void rs_stay_in_table(struct iwl_lq_sta *lq_sta, bool force_search)
                         flush_interval_passed =
                                 time_after(jiffies,
                                            (unsigned long)(lq_sta->flush_timer +
-                                                RS_STAY_IN_COLUMN_TIMEOUT));
+                                                           (IWL_MVM_RS_STAY_IN_COLUMN_TIMEOUT * HZ)));
 
                 /*
                  * Check if we should allow search for new modulation mode.
@@ -1567,7 +1563,7 @@ static enum rs_column rs_get_next_column(struct iwl_mvm *mvm,
         const struct rs_tx_column *curr_col = &rs_tx_columns[tbl->column];
         const struct rs_tx_column *next_col;
         allow_column_func_t allow_func;
-        u8 valid_ants = mvm->fw->valid_tx_ant;
+        u8 valid_ants = iwl_mvm_get_valid_tx_ant(mvm);
         const u16 *expected_tpt_tbl;
         u16 tpt, max_expected_tpt;
 
@@ -1613,8 +1609,12 @@ static enum rs_column rs_get_next_column(struct iwl_mvm *mvm,
                         continue;
 
                 max_rate = rs_get_max_allowed_rate(lq_sta, next_col);
-                if (WARN_ON_ONCE(max_rate == IWL_RATE_INVALID))
+                if (max_rate == IWL_RATE_INVALID) {
+                        IWL_DEBUG_RATE(mvm,
+                                       "Skip column %d: no rate is allowed in this column\n",
+                                       next_col_id);
                         continue;
+                }
 
                 max_expected_tpt = expected_tpt_tbl[max_rate];
                 if (tpt >= max_expected_tpt) {
@@ -1724,7 +1724,8 @@ static enum rs_action rs_get_rate_action(struct iwl_mvm *mvm,
 {
         enum rs_action action = RS_ACTION_STAY;
 
-        if ((sr <= RS_SR_FORCE_DECREASE) || (current_tpt == 0)) {
+        if ((sr <= RS_PERCENT(IWL_MVM_RS_SR_FORCE_DECREASE)) ||
+            (current_tpt == 0)) {
                 IWL_DEBUG_RATE(mvm,
                                "Decrease rate because of low SR\n");
                 return RS_ACTION_DOWNSCALE;
@@ -1783,7 +1784,7 @@ static enum rs_action rs_get_rate_action(struct iwl_mvm *mvm,
 
 out:
         if ((action == RS_ACTION_DOWNSCALE) && (low != IWL_RATE_INVALID)) {
-                if (sr >= RS_SR_NO_DECREASE) {
+                if (sr >= RS_PERCENT(IWL_MVM_RS_SR_NO_DECREASE)) {
                         IWL_DEBUG_RATE(mvm,
                                        "SR is above NO DECREASE. Avoid downscale\n");
                         action = RS_ACTION_STAY;
@@ -1802,18 +1803,10 @@ out:
 static bool rs_stbc_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                           struct iwl_lq_sta *lq_sta)
 {
-        struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
-        struct ieee80211_vif *vif = mvmsta->vif;
-        bool sta_ps_disabled = (vif->type == NL80211_IFTYPE_STATION &&
-                                !vif->bss_conf.ps);
-
         /* Our chip supports Tx STBC and the peer is an HT/VHT STA which
          * supports STBC of at least 1*SS
          */
-        if (!lq_sta->stbc)
-                return false;
-
-        if (!mvm->ps_disabled && !sta_ps_disabled)
+        if (!lq_sta->stbc_capable)
                 return false;
 
         if (!iwl_mvm_bt_coex_is_mimo_allowed(mvm, sta))
@@ -1825,11 +1818,11 @@ static bool rs_stbc_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
 static void rs_get_adjacent_txp(struct iwl_mvm *mvm, int index,
                                 int *weaker, int *stronger)
 {
-        *weaker = index + TPC_TX_POWER_STEP;
+        *weaker = index + IWL_MVM_RS_TPC_TX_POWER_STEP;
         if (*weaker > TPC_MAX_REDUCTION)
                 *weaker = TPC_INVALID;
 
-        *stronger = index - TPC_TX_POWER_STEP;
+        *stronger = index - IWL_MVM_RS_TPC_TX_POWER_STEP;
         if (*stronger < 0)
                 *stronger = TPC_INVALID;
 }
@@ -1885,7 +1878,8 @@ static enum tpc_action rs_get_tpc_action(struct iwl_mvm *mvm,
         }
 
         /* Too many failures, increase txp */
-        if (sr <= TPC_SR_FORCE_INCREASE || current_tpt == 0) {
+        if (sr <= RS_PERCENT(IWL_MVM_RS_TPC_SR_FORCE_INCREASE) ||
+            current_tpt == 0) {
                 IWL_DEBUG_RATE(mvm, "increase txp because of weak SR\n");
                 return TPC_ACTION_NO_RESTIRCTION;
         }
@@ -1908,7 +1902,8 @@ static enum tpc_action rs_get_tpc_action(struct iwl_mvm *mvm,
         }
 
         /* next, increase if needed */
-        if (sr < TPC_SR_NO_INCREASE && strong != TPC_INVALID) {
+        if (sr < RS_PERCENT(IWL_MVM_RS_TPC_SR_NO_INCREASE) &&
+            strong != TPC_INVALID) {
                 if (weak_tpt == IWL_INVALID_VALUE &&
                     strong_tpt != IWL_INVALID_VALUE &&
                     current_tpt < strong_tpt) {
@@ -1935,7 +1930,7 @@ static bool rs_tpc_perform(struct iwl_mvm *mvm,
                            struct iwl_lq_sta *lq_sta,
                            struct iwl_scale_tbl_info *tbl)
 {
-        struct iwl_mvm_sta *mvm_sta = (void *)sta->drv_priv;
+        struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
         struct ieee80211_vif *vif = mvm_sta->vif;
         struct ieee80211_chanctx_conf *chanctx_conf;
         enum ieee80211_band band;
@@ -2044,7 +2039,7 @@ static void rs_rate_scale_perform(struct iwl_mvm *mvm,
         u16 high_low;
         s32 sr;
         u8 prev_agg = lq_sta->is_agg;
-        struct iwl_mvm_sta *sta_priv = (void *)sta->drv_priv;
+        struct iwl_mvm_sta *sta_priv = iwl_mvm_sta_from_mac80211(sta);
         struct iwl_mvm_tid_data *tid_data;
         struct rs_rate *rate;
 
@@ -2106,8 +2101,8 @@ static void rs_rate_scale_perform(struct iwl_mvm *mvm,
          * in current association (use new rate found above).
          */
         fail_count = window->counter - window->success_counter;
-        if ((fail_count < IWL_RATE_MIN_FAILURE_TH) &&
-            (window->success_counter < IWL_RATE_MIN_SUCCESS_TH)) {
+        if ((fail_count < IWL_MVM_RS_RATE_MIN_FAILURE_TH) &&
+            (window->success_counter < IWL_MVM_RS_RATE_MIN_SUCCESS_TH)) {
                 IWL_DEBUG_RATE(mvm,
                                "(%s: %d): Test Window: succ %d total %d\n",
                                rs_pretty_lq_type(rate->type),
@@ -2385,7 +2380,7 @@ static void rs_get_initial_rate(struct iwl_mvm *mvm,
         int i, nentries;
         s8 best_rssi = S8_MIN;
         u8 best_ant = ANT_NONE;
-        u8 valid_tx_ant = mvm->fw->valid_tx_ant;
+        u8 valid_tx_ant = iwl_mvm_get_valid_tx_ant(mvm);
         const struct rs_init_rate_info *initial_rates;
 
         for (i = 0; i < ARRAY_SIZE(lq_sta->pers.chain_signal); i++) {
@@ -2530,7 +2525,7 @@ static void rs_get_rate(void *mvm_r, struct ieee80211_sta *sta, void *mvm_sta,
 static void *rs_alloc_sta(void *mvm_rate, struct ieee80211_sta *sta,
                           gfp_t gfp)
 {
-        struct iwl_mvm_sta *sta_priv = (struct iwl_mvm_sta *)sta->drv_priv;
+        struct iwl_mvm_sta *sta_priv = iwl_mvm_sta_from_mac80211(sta);
         struct iwl_op_mode *op_mode = (struct iwl_op_mode *)mvm_rate;
         struct iwl_mvm *mvm  = IWL_OP_MODE_GET_MVM(op_mode);
         struct iwl_lq_sta *lq_sta = &sta_priv->lq_sta;
@@ -2606,68 +2601,121 @@ static void rs_vht_set_enabled_rates(struct ieee80211_sta *sta,
         }
 }
 
+static void rs_ht_init(struct iwl_mvm *mvm,
+                       struct ieee80211_sta *sta,
+                       struct iwl_lq_sta *lq_sta,
+                       struct ieee80211_sta_ht_cap *ht_cap)
+{
+        /* active_siso_rate mask includes 9 MBits (bit 5),
+         * and CCK (bits 0-3), supp_rates[] does not;
+         * shift to convert format, force 9 MBits off.
+         */
+        lq_sta->active_siso_rate = ht_cap->mcs.rx_mask[0] << 1;
+        lq_sta->active_siso_rate |= ht_cap->mcs.rx_mask[0] & 0x1;
+        lq_sta->active_siso_rate &= ~((u16)0x2);
+        lq_sta->active_siso_rate <<= IWL_FIRST_OFDM_RATE;
+
+        lq_sta->active_mimo2_rate = ht_cap->mcs.rx_mask[1] << 1;
+        lq_sta->active_mimo2_rate |= ht_cap->mcs.rx_mask[1] & 0x1;
+        lq_sta->active_mimo2_rate &= ~((u16)0x2);
+        lq_sta->active_mimo2_rate <<= IWL_FIRST_OFDM_RATE;
+
+        if (mvm->cfg->ht_params->ldpc &&
+            (ht_cap->cap & IEEE80211_HT_CAP_LDPC_CODING))
+                lq_sta->ldpc = true;
+
+        if (mvm->cfg->ht_params->stbc &&
+            (num_of_ant(iwl_mvm_get_valid_tx_ant(mvm)) > 1) &&
+            (ht_cap->cap & IEEE80211_HT_CAP_RX_STBC))
+                lq_sta->stbc_capable = true;
+
+        lq_sta->is_vht = false;
+}
+
+static void rs_vht_init(struct iwl_mvm *mvm,
+                        struct ieee80211_sta *sta,
+                        struct iwl_lq_sta *lq_sta,
+                        struct ieee80211_sta_vht_cap *vht_cap)
+{
+        rs_vht_set_enabled_rates(sta, vht_cap, lq_sta);
+
+        if (mvm->cfg->ht_params->ldpc &&
+            (vht_cap->cap & IEEE80211_VHT_CAP_RXLDPC))
+                lq_sta->ldpc = true;
+
+        if (mvm->cfg->ht_params->stbc &&
+            (num_of_ant(iwl_mvm_get_valid_tx_ant(mvm)) > 1) &&
+            (vht_cap->cap & IEEE80211_VHT_CAP_RXSTBC_MASK))
+                lq_sta->stbc_capable = true;
+
+        if ((mvm->fw->ucode_capa.capa[0] & IWL_UCODE_TLV_CAPA_BEAMFORMER) &&
+            (num_of_ant(iwl_mvm_get_valid_tx_ant(mvm)) > 1) &&
+            (vht_cap->cap & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE))
+                lq_sta->bfer_capable = true;
+
+        lq_sta->is_vht = true;
+}
+
 #ifdef CONFIG_IWLWIFI_DEBUGFS
-static void iwl_mvm_reset_frame_stats(struct iwl_mvm *mvm,
-                                      struct iwl_mvm_frame_stats *stats)
+static void iwl_mvm_reset_frame_stats(struct iwl_mvm *mvm)
 {
         spin_lock_bh(&mvm->drv_stats_lock);
-        memset(stats, 0, sizeof(*stats));
+        memset(&mvm->drv_rx_stats, 0, sizeof(mvm->drv_rx_stats));
         spin_unlock_bh(&mvm->drv_stats_lock);
 }
 
-void iwl_mvm_update_frame_stats(struct iwl_mvm *mvm,
-                                struct iwl_mvm_frame_stats *stats,
-                                u32 rate, bool agg)
+void iwl_mvm_update_frame_stats(struct iwl_mvm *mvm, u32 rate, bool agg)
 {
         u8 nss = 0, mcs = 0;
 
         spin_lock(&mvm->drv_stats_lock);
 
         if (agg)
-                stats->agg_frames++;
+                mvm->drv_rx_stats.agg_frames++;
 
-        stats->success_frames++;
+        mvm->drv_rx_stats.success_frames++;
 
         switch (rate & RATE_MCS_CHAN_WIDTH_MSK) {
         case RATE_MCS_CHAN_WIDTH_20:
-                stats->bw_20_frames++;
+                mvm->drv_rx_stats.bw_20_frames++;
                 break;
         case RATE_MCS_CHAN_WIDTH_40:
-                stats->bw_40_frames++;
+                mvm->drv_rx_stats.bw_40_frames++;
                 break;
         case RATE_MCS_CHAN_WIDTH_80:
-                stats->bw_80_frames++;
+                mvm->drv_rx_stats.bw_80_frames++;
                 break;
         default:
                 WARN_ONCE(1, "bad BW. rate 0x%x", rate);
         }
 
         if (rate & RATE_MCS_HT_MSK) {
-                stats->ht_frames++;
+                mvm->drv_rx_stats.ht_frames++;
                 mcs = rate & RATE_HT_MCS_RATE_CODE_MSK;
                 nss = ((rate & RATE_HT_MCS_NSS_MSK) >> RATE_HT_MCS_NSS_POS) + 1;
         } else if (rate & RATE_MCS_VHT_MSK) {
-                stats->vht_frames++;
+                mvm->drv_rx_stats.vht_frames++;
                 mcs = rate & RATE_VHT_MCS_RATE_CODE_MSK;
                 nss = ((rate & RATE_VHT_MCS_NSS_MSK) >>
                        RATE_VHT_MCS_NSS_POS) + 1;
         } else {
-                stats->legacy_frames++;
+                mvm->drv_rx_stats.legacy_frames++;
         }
 
         if (nss == 1)
-                stats->siso_frames++;
+                mvm->drv_rx_stats.siso_frames++;
         else if (nss == 2)
-                stats->mimo2_frames++;
+                mvm->drv_rx_stats.mimo2_frames++;
 
         if (rate & RATE_MCS_SGI_MSK)
-                stats->sgi_frames++;
+                mvm->drv_rx_stats.sgi_frames++;
         else
-                stats->ngi_frames++;
+                mvm->drv_rx_stats.ngi_frames++;
 
-        stats->last_rates[stats->last_frame_idx] = rate;
-        stats->last_frame_idx = (stats->last_frame_idx + 1) %
-                ARRAY_SIZE(stats->last_rates);
+        mvm->drv_rx_stats.last_rates[mvm->drv_rx_stats.last_frame_idx] = rate;
+        mvm->drv_rx_stats.last_frame_idx =
+                (mvm->drv_rx_stats.last_frame_idx + 1) %
+                        ARRAY_SIZE(mvm->drv_rx_stats.last_rates);
 
         spin_unlock(&mvm->drv_stats_lock);
 }
@@ -2683,14 +2731,11 @@ void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
         struct ieee80211_hw *hw = mvm->hw;
         struct ieee80211_sta_ht_cap *ht_cap = &sta->ht_cap;
         struct ieee80211_sta_vht_cap *vht_cap = &sta->vht_cap;
-        struct iwl_mvm_sta *sta_priv;
-        struct iwl_lq_sta *lq_sta;
+        struct iwl_mvm_sta *sta_priv = iwl_mvm_sta_from_mac80211(sta);
+        struct iwl_lq_sta *lq_sta = &sta_priv->lq_sta;
         struct ieee80211_supported_band *sband;
         unsigned long supp; /* must be unsigned long for for_each_set_bit */
 
-        sta_priv = (struct iwl_mvm_sta *)sta->drv_priv;
-        lq_sta = &sta_priv->lq_sta;
-
         /* clear all non-persistent lq data */
         memset(lq_sta, 0, offsetof(typeof(*lq_sta), pers));
 
@@ -2712,7 +2757,7 @@ void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
          * previous packets? Need to have IEEE 802.1X auth succeed immediately
          * after assoc.. */
 
-        lq_sta->missed_rate_counter = IWL_MISSED_RATE_MAX;
+        lq_sta->missed_rate_counter = IWL_MVM_RS_MISSED_RATE_MAX;
         lq_sta->band = sband->band;
         /*
          * active legacy rates as per supported rates bitmap
@@ -2723,61 +2768,28 @@ void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                 lq_sta->active_legacy_rate |= BIT(sband->bitrates[i].hw_value);
 
         /* TODO: should probably account for rx_highest for both HT/VHT */
-        if (!vht_cap || !vht_cap->vht_supported) {
-                /* active_siso_rate mask includes 9 MBits (bit 5),
-                 * and CCK (bits 0-3), supp_rates[] does not;
-                 * shift to convert format, force 9 MBits off.
-                 */
-                lq_sta->active_siso_rate = ht_cap->mcs.rx_mask[0] << 1;
-                lq_sta->active_siso_rate |= ht_cap->mcs.rx_mask[0] & 0x1;
-                lq_sta->active_siso_rate &= ~((u16)0x2);
-                lq_sta->active_siso_rate <<= IWL_FIRST_OFDM_RATE;
-
-                /* Same here */
-                lq_sta->active_mimo2_rate = ht_cap->mcs.rx_mask[1] << 1;
-                lq_sta->active_mimo2_rate |= ht_cap->mcs.rx_mask[1] & 0x1;
-                lq_sta->active_mimo2_rate &= ~((u16)0x2);
-                lq_sta->active_mimo2_rate <<= IWL_FIRST_OFDM_RATE;
-
-                lq_sta->is_vht = false;
-                if (mvm->cfg->ht_params->ldpc &&
-                    (ht_cap->cap & IEEE80211_HT_CAP_LDPC_CODING))
-                        lq_sta->ldpc = true;
-
-                if (mvm->cfg->ht_params->stbc &&
-                    (num_of_ant(mvm->fw->valid_tx_ant) > 1) &&
-                    (ht_cap->cap & IEEE80211_HT_CAP_RX_STBC))
-                        lq_sta->stbc = true;
-        } else {
-                rs_vht_set_enabled_rates(sta, vht_cap, lq_sta);
-                lq_sta->is_vht = true;
-
-                if (mvm->cfg->ht_params->ldpc &&
-                    (vht_cap->cap & IEEE80211_VHT_CAP_RXLDPC))
-                        lq_sta->ldpc = true;
-
-                if (mvm->cfg->ht_params->stbc &&
-                    (num_of_ant(mvm->fw->valid_tx_ant) > 1) &&
-                    (vht_cap->cap & IEEE80211_VHT_CAP_RXSTBC_MASK))
-                        lq_sta->stbc = true;
-        }
+        if (!vht_cap || !vht_cap->vht_supported)
+                rs_ht_init(mvm, sta, lq_sta, ht_cap);
+        else
+                rs_vht_init(mvm, sta, lq_sta, vht_cap);
 
-        if (IWL_MVM_RS_DISABLE_MIMO)
+        if (IWL_MVM_RS_DISABLE_P2P_MIMO && sta_priv->vif->p2p)
                 lq_sta->active_mimo2_rate = 0;
 
-        lq_sta->max_legacy_rate_idx = find_last_bit(&lq_sta->active_legacy_rate,
-                                                    BITS_PER_LONG);
-        lq_sta->max_siso_rate_idx = find_last_bit(&lq_sta->active_siso_rate,
-                                                  BITS_PER_LONG);
-        lq_sta->max_mimo2_rate_idx = find_last_bit(&lq_sta->active_mimo2_rate,
-                                                   BITS_PER_LONG);
+        lq_sta->max_legacy_rate_idx =
+                rs_get_max_rate_from_mask(lq_sta->active_legacy_rate);
+        lq_sta->max_siso_rate_idx =
+                rs_get_max_rate_from_mask(lq_sta->active_siso_rate);
+        lq_sta->max_mimo2_rate_idx =
+                rs_get_max_rate_from_mask(lq_sta->active_mimo2_rate);
 
         IWL_DEBUG_RATE(mvm,
-                       "RATE MASK: LEGACY=%lX SISO=%lX MIMO2=%lX VHT=%d LDPC=%d STBC%d\n",
+                       "LEGACY=%lX SISO=%lX MIMO2=%lX VHT=%d LDPC=%d STBC=%d BFER=%d\n",
                        lq_sta->active_legacy_rate,
                        lq_sta->active_siso_rate,
                        lq_sta->active_mimo2_rate,
-                       lq_sta->is_vht, lq_sta->ldpc, lq_sta->stbc);
+                       lq_sta->is_vht, lq_sta->ldpc, lq_sta->stbc_capable,
+                       lq_sta->bfer_capable);
         IWL_DEBUG_RATE(mvm, "MAX RATE: LEGACY=%d SISO=%d MIMO2=%d\n",
                        lq_sta->max_legacy_rate_idx,
                        lq_sta->max_siso_rate_idx,
@@ -2785,14 +2797,14 @@ void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
 
         /* These values will be overridden later */
         lq_sta->lq.single_stream_ant_msk =
-                first_antenna(mvm->fw->valid_tx_ant);
+                first_antenna(iwl_mvm_get_valid_tx_ant(mvm));
         lq_sta->lq.dual_stream_ant_msk = ANT_AB;
 
         /* as default allow aggregation for all tids */
         lq_sta->tx_agg_tid_en = IWL_AGG_ALL_TID;
         lq_sta->is_agg = 0;
 #ifdef CONFIG_IWLWIFI_DEBUGFS
-        iwl_mvm_reset_frame_stats(mvm, &mvm->drv_rx_stats);
+        iwl_mvm_reset_frame_stats(mvm);
 #endif
         rs_initialize_lq(mvm, sta, lq_sta, band, init);
 }
@@ -2861,12 +2873,13 @@ static void rs_fill_rates_for_column(struct iwl_mvm *mvm,
         int index = *rs_table_index;
 
         for (i = 0; i < num_rates && index < end; i++) {
-                ucode_rate = cpu_to_le32(ucode_rate_from_rs_rate(mvm, rate));
-                for (j = 0; j < num_retries && index < end; j++, index++)
+                for (j = 0; j < num_retries && index < end; j++, index++) {
+                        ucode_rate = cpu_to_le32(ucode_rate_from_rs_rate(mvm,
+                                                                         rate));
                         rs_table[index] = ucode_rate;
-
-                if (toggle_ant)
-                        rs_toggle_antenna(valid_tx_ant, rate);
+                        if (toggle_ant)
+                                rs_toggle_antenna(valid_tx_ant, rate);
+                }
 
                 prev_rate_idx = rate->index;
                 bottom_reached = rs_get_lower_rate_in_column(lq_sta, rate);
@@ -2874,7 +2887,7 @@ static void rs_fill_rates_for_column(struct iwl_mvm *mvm,
                         break;
         }
 
-        if (!bottom_reached)
+        if (!bottom_reached && !is_legacy(rate))
                 rate->index = prev_rate_idx;
 
         *rs_table_index = index;
@@ -2913,18 +2926,22 @@ static void rs_build_rates_table(struct iwl_mvm *mvm,
 
         memcpy(&rate, initial_rate, sizeof(rate));
 
-        valid_tx_ant = mvm->fw->valid_tx_ant;
-        rate.stbc = rs_stbc_allow(mvm, sta, lq_sta);
+        valid_tx_ant = iwl_mvm_get_valid_tx_ant(mvm);
+
+        /* TODO: remove old API when min FW API hits 14 */
+        if (!(mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_LQ_SS_PARAMS) &&
+            rs_stbc_allow(mvm, sta, lq_sta))
+                rate.stbc = true;
 
         if (is_siso(&rate)) {
-                num_rates = RS_INITIAL_SISO_NUM_RATES;
-                num_retries = RS_HT_VHT_RETRIES_PER_RATE;
+                num_rates = IWL_MVM_RS_INITIAL_SISO_NUM_RATES;
+                num_retries = IWL_MVM_RS_HT_VHT_RETRIES_PER_RATE;
         } else if (is_mimo(&rate)) {
-                num_rates = RS_INITIAL_MIMO_NUM_RATES;
-                num_retries = RS_HT_VHT_RETRIES_PER_RATE;
+                num_rates = IWL_MVM_RS_INITIAL_MIMO_NUM_RATES;
+                num_retries = IWL_MVM_RS_HT_VHT_RETRIES_PER_RATE;
         } else {
-                num_rates = RS_INITIAL_LEGACY_NUM_RATES;
-                num_retries = RS_LEGACY_RETRIES_PER_RATE;
+                num_rates = IWL_MVM_RS_INITIAL_LEGACY_NUM_RATES;
+                num_retries = IWL_MVM_RS_INITIAL_LEGACY_RETRIES;
                 toggle_ant = true;
         }
 
@@ -2935,12 +2952,12 @@ static void rs_build_rates_table(struct iwl_mvm *mvm,
         rs_get_lower_rate_down_column(lq_sta, &rate);
 
         if (is_siso(&rate)) {
-                num_rates = RS_SECONDARY_SISO_NUM_RATES;
-                num_retries = RS_SECONDARY_SISO_RETRIES;
+                num_rates = IWL_MVM_RS_SECONDARY_SISO_NUM_RATES;
+                num_retries = IWL_MVM_RS_SECONDARY_SISO_RETRIES;
                 lq_cmd->mimo_delim = index;
         } else if (is_legacy(&rate)) {
-                num_rates = RS_SECONDARY_LEGACY_NUM_RATES;
-                num_retries = RS_LEGACY_RETRIES_PER_RATE;
+                num_rates = IWL_MVM_RS_SECONDARY_LEGACY_NUM_RATES;
+                num_retries = IWL_MVM_RS_SECONDARY_LEGACY_RETRIES;
         } else {
                 WARN_ON_ONCE(1);
         }
@@ -2953,8 +2970,8 @@ static void rs_build_rates_table(struct iwl_mvm *mvm,
 
         rs_get_lower_rate_down_column(lq_sta, &rate);
 
-        num_rates = RS_SECONDARY_LEGACY_NUM_RATES;
-        num_retries = RS_LEGACY_RETRIES_PER_RATE;
+        num_rates = IWL_MVM_RS_SECONDARY_LEGACY_NUM_RATES;
+        num_retries = IWL_MVM_RS_SECONDARY_LEGACY_RETRIES;
 
         rs_fill_rates_for_column(mvm, lq_sta, &rate, lq_cmd->rs_table, &index,
                                  num_rates, num_retries, valid_tx_ant,
@@ -2962,6 +2979,142 @@ static void rs_build_rates_table(struct iwl_mvm *mvm,
 
 }
 
+struct rs_bfer_active_iter_data {
+        struct ieee80211_sta *exclude_sta;
+        struct iwl_mvm_sta *bfer_mvmsta;
+};
+
+static void rs_bfer_active_iter(void *_data,
+                                struct ieee80211_sta *sta)
+{
+        struct rs_bfer_active_iter_data *data = _data;
+        struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
+        struct iwl_lq_cmd *lq_cmd = &mvmsta->lq_sta.lq;
+        u32 ss_params = le32_to_cpu(lq_cmd->ss_params);
+
+        if (sta == data->exclude_sta)
+                return;
+
+        /* The current sta has BFER allowed */
+        if (ss_params & LQ_SS_BFER_ALLOWED) {
+                WARN_ON_ONCE(data->bfer_mvmsta != NULL);
+
+                data->bfer_mvmsta = mvmsta;
+        }
+}
+
+static int rs_bfer_priority(struct iwl_mvm_sta *sta)
+{
+        int prio = -1;
+        enum nl80211_iftype viftype = ieee80211_vif_type_p2p(sta->vif);
+
+        switch (viftype) {
+        case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_P2P_GO:
+                prio = 3;
+                break;
+        case NL80211_IFTYPE_P2P_CLIENT:
+                prio = 2;
+                break;
+        case NL80211_IFTYPE_STATION:
+                prio = 1;
+                break;
+        default:
+                WARN_ONCE(true, "viftype %d sta_id %d", viftype, sta->sta_id);
+                prio = -1;
+        }
+
+        return prio;
+}
+
+/* Returns >0 if sta1 has a higher BFER priority compared to sta2 */
+static int rs_bfer_priority_cmp(struct iwl_mvm_sta *sta1,
+                                struct iwl_mvm_sta *sta2)
+{
+        int prio1 = rs_bfer_priority(sta1);
+        int prio2 = rs_bfer_priority(sta2);
+
+        if (prio1 > prio2)
+                return 1;
+        if (prio1 < prio2)
+                return -1;
+        return 0;
+}
+
+static void rs_set_lq_ss_params(struct iwl_mvm *mvm,
+                                struct ieee80211_sta *sta,
+                                struct iwl_lq_sta *lq_sta,
+                                const struct rs_rate *initial_rate)
+{
+        struct iwl_lq_cmd *lq_cmd = &lq_sta->lq;
+        struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
+        struct rs_bfer_active_iter_data data = {
+                .exclude_sta = sta,
+                .bfer_mvmsta = NULL,
+        };
+        struct iwl_mvm_sta *bfer_mvmsta = NULL;
+        u32 ss_params = LQ_SS_PARAMS_VALID;
+
+        if (!iwl_mvm_bt_coex_is_mimo_allowed(mvm, sta))
+                goto out;
+
+        /* Check if forcing the decision is configured.
+         * Note that SISO is forced by not allowing STBC or BFER
+         */
+        if (lq_sta->ss_force == RS_SS_FORCE_STBC)
+                ss_params |= (LQ_SS_STBC_1SS_ALLOWED | LQ_SS_FORCE);
+        else if (lq_sta->ss_force == RS_SS_FORCE_BFER)
+                ss_params |= (LQ_SS_BFER_ALLOWED | LQ_SS_FORCE);
+
+        if (lq_sta->ss_force != RS_SS_FORCE_NONE) {
+                IWL_DEBUG_RATE(mvm, "Forcing single stream Tx decision %d\n",
+                               lq_sta->ss_force);
+                goto out;
+        }
+
+        if (lq_sta->stbc_capable)
+                ss_params |= LQ_SS_STBC_1SS_ALLOWED;
+
+        if (!lq_sta->bfer_capable)
+                goto out;
+
+        ieee80211_iterate_stations_atomic(mvm->hw,
+                                          rs_bfer_active_iter,
+                                          &data);
+        bfer_mvmsta = data.bfer_mvmsta;
+
+        /* This code is safe as it doesn't run concurrently for different
+         * stations. This is guaranteed by the fact that calls to
+         * ieee80211_tx_status wouldn't run concurrently for a single HW.
+         */
+        if (!bfer_mvmsta) {
+                IWL_DEBUG_RATE(mvm, "No sta with BFER allowed found. Allow\n");
+
+                ss_params |= LQ_SS_BFER_ALLOWED;
+                goto out;
+        }
+
+        IWL_DEBUG_RATE(mvm, "Found existing sta %d with BFER activated\n",
+                       bfer_mvmsta->sta_id);
+
+        /* Disallow BFER on another STA if active and we're a higher priority */
+        if (rs_bfer_priority_cmp(mvmsta, bfer_mvmsta) > 0) {
+                struct iwl_lq_cmd *bfersta_lq_cmd = &bfer_mvmsta->lq_sta.lq;
+                u32 bfersta_ss_params = le32_to_cpu(bfersta_lq_cmd->ss_params);
+
+                bfersta_ss_params &= ~LQ_SS_BFER_ALLOWED;
+                bfersta_lq_cmd->ss_params = cpu_to_le32(bfersta_ss_params);
+                iwl_mvm_send_lq_cmd(mvm, bfersta_lq_cmd, false);
+
+                ss_params |= LQ_SS_BFER_ALLOWED;
+                IWL_DEBUG_RATE(mvm,
+                               "Lower priority BFER sta found (%d). Switch BFER\n",
+                               bfer_mvmsta->sta_id);
+        }
+out:
+        lq_cmd->ss_params = cpu_to_le32(ss_params);
+}
+
 static void rs_fill_lq_cmd(struct iwl_mvm *mvm,
                            struct ieee80211_sta *sta,
                            struct iwl_lq_sta *lq_sta,
@@ -2971,9 +3124,9 @@ static void rs_fill_lq_cmd(struct iwl_mvm *mvm,
         struct iwl_mvm_sta *mvmsta;
         struct iwl_mvm_vif *mvmvif;
 
-        lq_cmd->agg_disable_start_th = LINK_QUAL_AGG_DISABLE_START_DEF;
+        lq_cmd->agg_disable_start_th = IWL_MVM_RS_AGG_DISABLE_START;
         lq_cmd->agg_time_limit =
-                cpu_to_le16(LINK_QUAL_AGG_TIME_LIMIT_DEF);
+                cpu_to_le16(IWL_MVM_RS_AGG_TIME_LIMIT);
 
 #ifdef CONFIG_MAC80211_DEBUGFS
         if (lq_sta->pers.dbg_fixed_rate) {
@@ -2988,6 +3141,9 @@ static void rs_fill_lq_cmd(struct iwl_mvm *mvm,
 
         rs_build_rates_table(mvm, sta, lq_sta, initial_rate);
 
+        if (mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_LQ_SS_PARAMS)
+                rs_set_lq_ss_params(mvm, sta, lq_sta, initial_rate);
+
         if (num_of_ant(initial_rate->ant) == 1)
                 lq_cmd->single_stream_ant_msk = initial_rate->ant;
 
@@ -3167,9 +3323,9 @@ static ssize_t rs_sta_dbgfs_scale_table_read(struct file *file,
         desc += sprintf(buff+desc, "fixed rate 0x%X\n",
                         lq_sta->pers.dbg_fixed_rate);
         desc += sprintf(buff+desc, "valid_tx_ant %s%s%s\n",
-            (mvm->fw->valid_tx_ant & ANT_A) ? "ANT_A," : "",
-            (mvm->fw->valid_tx_ant & ANT_B) ? "ANT_B," : "",
-            (mvm->fw->valid_tx_ant & ANT_C) ? "ANT_C" : "");
+            (iwl_mvm_get_valid_tx_ant(mvm) & ANT_A) ? "ANT_A," : "",
+            (iwl_mvm_get_valid_tx_ant(mvm) & ANT_B) ? "ANT_B," : "",
+            (iwl_mvm_get_valid_tx_ant(mvm) & ANT_C) ? "ANT_C" : "");
         desc += sprintf(buff+desc, "lq type %s\n",
                         (is_legacy(rate)) ? "legacy" :
                         is_vht(rate) ? "VHT" : "HT");
@@ -3361,9 +3517,73 @@ static const struct file_operations rs_sta_dbgfs_drv_tx_stats_ops = {
         .llseek = default_llseek,
 };
 
+static ssize_t iwl_dbgfs_ss_force_read(struct file *file,
+                                       char __user *user_buf,
+                                       size_t count, loff_t *ppos)
+{
+        struct iwl_lq_sta *lq_sta = file->private_data;
+        char buf[12];
+        int bufsz = sizeof(buf);
+        int pos = 0;
+        static const char * const ss_force_name[] = {
+                [RS_SS_FORCE_NONE] = "none",
+                [RS_SS_FORCE_STBC] = "stbc",
+                [RS_SS_FORCE_BFER] = "bfer",
+                [RS_SS_FORCE_SISO] = "siso",
+        };
+
+        pos += scnprintf(buf+pos, bufsz-pos, "%s\n",
+                         ss_force_name[lq_sta->ss_force]);
+        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+}
+
+static ssize_t iwl_dbgfs_ss_force_write(struct iwl_lq_sta *lq_sta, char *buf,
+                                        size_t count, loff_t *ppos)
+{
+        struct iwl_mvm *mvm = lq_sta->pers.drv;
+        int ret = 0;
+
+        if (!strncmp("none", buf, 4)) {
+                lq_sta->ss_force = RS_SS_FORCE_NONE;
+        } else if (!strncmp("siso", buf, 4)) {
+                lq_sta->ss_force = RS_SS_FORCE_SISO;
+        } else if (!strncmp("stbc", buf, 4)) {
+                if (lq_sta->stbc_capable) {
+                        lq_sta->ss_force = RS_SS_FORCE_STBC;
+                } else {
+                        IWL_ERR(mvm,
+                                "can't force STBC. peer doesn't support\n");
+                        ret = -EINVAL;
+                }
+        } else if (!strncmp("bfer", buf, 4)) {
+                if (lq_sta->bfer_capable) {
+                        lq_sta->ss_force = RS_SS_FORCE_BFER;
+                } else {
+                        IWL_ERR(mvm,
+                                "can't force BFER. peer doesn't support\n");
+                        ret = -EINVAL;
+                }
+        } else {
+                IWL_ERR(mvm, "valid values none|siso|stbc|bfer\n");
+                ret = -EINVAL;
+        }
+        return ret ?: count;
+}
+
+#define MVM_DEBUGFS_READ_WRITE_FILE_OPS(name, bufsz) \
+        _MVM_DEBUGFS_READ_WRITE_FILE_OPS(name, bufsz, struct iwl_lq_sta)
+#define MVM_DEBUGFS_ADD_FILE_RS(name, parent, mode) do {                \
+                if (!debugfs_create_file(#name, mode, parent, lq_sta,   \
+                                         &iwl_dbgfs_##name##_ops))      \
+                        goto err;                                       \
+        } while (0)
+
+MVM_DEBUGFS_READ_WRITE_FILE_OPS(ss_force, 32);
+
 static void rs_add_debugfs(void *mvm, void *mvm_sta, struct dentry *dir)
 {
         struct iwl_lq_sta *lq_sta = mvm_sta;
+
         debugfs_create_file("rate_scale_table", S_IRUSR | S_IWUSR, dir,
                             lq_sta, &rs_sta_dbgfs_scale_table_ops);
         debugfs_create_file("rate_stats_table", S_IRUSR, dir,
@@ -3374,6 +3594,11 @@ static void rs_add_debugfs(void *mvm, void *mvm_sta, struct dentry *dir)
                           &lq_sta->tx_agg_tid_en);
         debugfs_create_u8("reduced_tpc", S_IRUSR | S_IWUSR, dir,
                           &lq_sta->pers.dbg_fixed_txp_reduction);
+
+        MVM_DEBUGFS_ADD_FILE_RS(ss_force, dir, S_IRUSR | S_IWUSR);
+        return;
+err:
+        IWL_ERR((struct iwl_mvm *)mvm, "Can't create debugfs entity\n");
 }
 
 static void rs_remove_debugfs(void *mvm, void *mvm_sta)
diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.h b/drivers/net/wireless/iwlwifi/mvm/rs.h
index defd70a6d9e6..dc4ef3dfafe1 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rs.h
+++ b/drivers/net/wireless/iwlwifi/mvm/rs.h
@@ -137,42 +137,10 @@ enum {
 
 #define IWL_INVALID_VALUE    -1
 
-#define IWL_MIN_RSSI_VAL                 -100
-#define IWL_MAX_RSSI_VAL                    0
-
-/* These values specify how many Tx frame attempts before
- * searching for a new modulation mode */
-#define IWL_LEGACY_FAILURE_LIMIT        160
-#define IWL_LEGACY_SUCCESS_LIMIT        480
-#define IWL_LEGACY_TABLE_COUNT          160
-
-#define IWL_NONE_LEGACY_FAILURE_LIMIT   400
-#define IWL_NONE_LEGACY_SUCCESS_LIMIT   4500
-#define IWL_NONE_LEGACY_TABLE_COUNT     1500
-
-/* Success ratio (ACKed / attempted tx frames) values (perfect is 128 * 100) */
-#define IWL_RS_GOOD_RATIO               12800   /* 100% */
-#define IWL_RATE_SCALE_SWITCH           10880   /*  85% */
-#define IWL_RATE_HIGH_TH                10880   /*  85% */
-#define IWL_RATE_INCREASE_TH            6400    /*  50% */
-#define RS_SR_FORCE_DECREASE            1920    /*  15% */
-#define RS_SR_NO_DECREASE               10880   /*  85% */
-
-#define TPC_SR_FORCE_INCREASE           9600    /* 75% */
-#define TPC_SR_NO_INCREASE              10880   /* 85% */
-#define TPC_TX_POWER_STEP               3
 #define TPC_MAX_REDUCTION               15
 #define TPC_NO_REDUCTION                0
 #define TPC_INVALID                     0xff
 
-#define LINK_QUAL_AGG_TIME_LIMIT_DEF    (4000) /* 4 milliseconds */
-#define LINK_QUAL_AGG_TIME_LIMIT_MAX    (8000)
-#define LINK_QUAL_AGG_TIME_LIMIT_MIN    (100)
-
-#define LINK_QUAL_AGG_DISABLE_START_DEF (3)
-#define LINK_QUAL_AGG_DISABLE_START_MAX (255)
-#define LINK_QUAL_AGG_DISABLE_START_MIN (0)
-
 #define LINK_QUAL_AGG_FRAME_LIMIT_DEF   (63)
 #define LINK_QUAL_AGG_FRAME_LIMIT_MAX   (63)
 #define LINK_QUAL_AGG_FRAME_LIMIT_MIN   (0)
@@ -181,14 +149,7 @@ enum {
 
 /* load per tid defines for A-MPDU activation */
 #define IWL_AGG_TPT_THREHOLD    0
-#define IWL_AGG_LOAD_THRESHOLD  10
 #define IWL_AGG_ALL_TID         0xff
-#define TID_QUEUE_CELL_SPACING  50      /*mS */
-#define TID_QUEUE_MAX_SIZE      20
-#define TID_ROUND_VALUE         5       /* mS */
-
-#define TID_MAX_TIME_DIFF ((TID_QUEUE_MAX_SIZE - 1) * TID_QUEUE_CELL_SPACING)
-#define TIME_WRAP_AROUND(x, y) (((y) > (x)) ? (y) - (x) : (0-(x)) + (y))
 
 enum iwl_table_type {
         LQ_NONE,
@@ -279,6 +240,13 @@ enum rs_column {
         RS_COLUMN_INVALID,
 };
 
+enum rs_ss_force_opt {
+        RS_SS_FORCE_NONE = 0,
+        RS_SS_FORCE_STBC,
+        RS_SS_FORCE_BFER,
+        RS_SS_FORCE_SISO,
+};
+
 /* Packet stats per rate */
 struct rs_rate_stats {
         u64 success;
@@ -332,7 +300,9 @@ struct iwl_lq_sta {
         u64 last_tx;
         bool is_vht;
         bool ldpc;              /* LDPC Rx is supported by the STA */
-        bool stbc;              /* Tx STBC is supported by chip and Rx by STA */
+        bool stbc_capable;      /* Tx STBC is supported by chip and Rx by STA */
+        bool bfer_capable;      /* Remote supports beamformee and we BFer */
+
         enum ieee80211_band band;
 
         /* The following are bitmaps of rates; IWL_RATE_6M_MASK, etc. */
@@ -361,6 +331,9 @@ struct iwl_lq_sta {
         /* tx power reduce for this sta */
         int tpc_reduce;
 
+        /* force STBC/BFER/SISO for testing */
+        enum rs_ss_force_opt ss_force;
+
         /* persistent fields - initialized only once - keep last! */
         struct lq_sta_pers {
 #ifdef CONFIG_MAC80211_DEBUGFS
diff --git a/drivers/net/wireless/iwlwifi/mvm/rx.c b/drivers/net/wireless/iwlwifi/mvm/rx.c
index 94b6e7297a1e..f922131b4eab 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/rx.c
@@ -407,7 +407,7 @@ int iwl_mvm_rx_rx_mpdu(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
         }
 
 #ifdef CONFIG_IWLWIFI_DEBUGFS
-        iwl_mvm_update_frame_stats(mvm, &mvm->drv_rx_stats, rate_n_flags,
+        iwl_mvm_update_frame_stats(mvm, rate_n_flags,
                                    rx_status->flag & RX_FLAG_AMPDU_DETAILS);
 #endif
         iwl_mvm_pass_packet_to_mac80211(mvm, skb, hdr, len, ampdu_status,
@@ -511,13 +511,17 @@ int iwl_mvm_rx_statistics(struct iwl_mvm *mvm,
 {
         struct iwl_rx_packet *pkt = rxb_addr(rxb);
         struct iwl_notif_statistics *stats = (void *)&pkt->data;
-        struct mvm_statistics_general_common *common = &stats->general.common;
         struct iwl_mvm_stat_data data = {
                 .stats = stats,
                 .mvm = mvm,
         };
 
-        iwl_mvm_tt_temp_changed(mvm, le32_to_cpu(common->temperature));
+        /* Only handle rx statistics temperature changes if async temp
+         * notifications are not supported
+         */
+        if (!(mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_ASYNC_DTM))
+                iwl_mvm_tt_temp_changed(mvm,
+                                le32_to_cpu(stats->general.radio_temperature));
 
         iwl_mvm_update_rx_statistics(mvm, stats);
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index 844bf7c4c8de..7e9aa3cb3254 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -99,7 +99,7 @@ static u8 iwl_mvm_scan_rx_ant(struct iwl_mvm *mvm)
 {
         if (mvm->scan_rx_ant != ANT_NONE)
                 return mvm->scan_rx_ant;
-        return mvm->fw->valid_rx_ant;
+        return iwl_mvm_get_valid_rx_ant(mvm);
 }
 
 static inline __le16 iwl_mvm_scan_rx_chain(struct iwl_mvm *mvm)
@@ -130,7 +130,7 @@ iwl_mvm_scan_rate_n_flags(struct iwl_mvm *mvm, enum ieee80211_band band,
         u32 tx_ant;
 
         mvm->scan_last_antenna_idx =
-                iwl_mvm_next_antenna(mvm, mvm->fw->valid_tx_ant,
+                iwl_mvm_next_antenna(mvm, iwl_mvm_get_valid_tx_ant(mvm),
                                      mvm->scan_last_antenna_idx);
         tx_ant = BIT(mvm->scan_last_antenna_idx) << RATE_MCS_ANT_POS;
 
@@ -290,11 +290,11 @@ static void iwl_mvm_scan_condition_iterator(void *data, u8 *mac,
                                             struct ieee80211_vif *vif)
 {
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
-        bool *global_bound = data;
+        int *global_cnt = data;
 
         if (vif->type != NL80211_IFTYPE_P2P_DEVICE && mvmvif->phy_ctxt &&
             mvmvif->phy_ctxt->id < MAX_PHYS)
-                *global_bound = true;
+                *global_cnt += 1;
 }
 
 static void iwl_mvm_scan_calc_params(struct iwl_mvm *mvm,
@@ -302,27 +302,31 @@ static void iwl_mvm_scan_calc_params(struct iwl_mvm *mvm,
                                      int n_ssids, u32 flags,
                                      struct iwl_mvm_scan_params *params)
 {
-        bool global_bound = false;
+        int global_cnt = 0;
         enum ieee80211_band band;
         u8 frag_passive_dwell = 0;
 
         ieee80211_iterate_active_interfaces_atomic(mvm->hw,
                                             IEEE80211_IFACE_ITER_NORMAL,
                                             iwl_mvm_scan_condition_iterator,
-                                            &global_bound);
+                                            &global_cnt);
 
-        if (!global_bound)
+        if (!global_cnt)
                 goto not_bound;
 
         params->suspend_time = 30;
-        params->max_out_time = 170;
+        params->max_out_time = 120;
 
         if (iwl_mvm_low_latency(mvm)) {
                 if (mvm->fw->ucode_capa.api[0] &
                     IWL_UCODE_TLV_API_FRAGMENTED_SCAN) {
                         params->suspend_time = 105;
-                        params->max_out_time = 70;
-                        frag_passive_dwell = 20;
+                        /*
+                         * If there is more than one active interface make
+                         * passive scan more fragmented.
+                         */
+                        frag_passive_dwell = (global_cnt < 2) ? 40 : 20;
+                        params->max_out_time = frag_passive_dwell;
                 } else {
                         params->suspend_time = 120;
                         params->max_out_time = 120;
@@ -539,6 +543,19 @@ int iwl_mvm_rx_scan_response(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
         return 0;
 }
 
+int iwl_mvm_rx_scan_offload_iter_complete_notif(struct iwl_mvm *mvm,
+                                                struct iwl_rx_cmd_buffer *rxb,
+                                                struct iwl_device_cmd *cmd)
+{
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+        struct iwl_scan_complete_notif *notif = (void *)pkt->data;
+
+        IWL_DEBUG_SCAN(mvm,
+                       "Scan offload iteration complete: status=0x%x scanned channels=%d\n",
+                       notif->status, notif->scanned_channels);
+        return 0;
+}
+
 int iwl_mvm_rx_scan_complete(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
                           struct iwl_device_cmd *cmd)
 {
@@ -687,7 +704,8 @@ int iwl_mvm_rx_scan_offload_complete_notif(struct iwl_mvm *mvm,
                 iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
         }
 
-        mvm->last_ebs_successful = !ebs_status;
+        if (ebs_status)
+                mvm->last_ebs_successful = false;
 
         return 0;
 }
@@ -1480,6 +1498,11 @@ int iwl_mvm_unified_sched_scan_lmac(struct iwl_mvm *mvm,
         if (req->n_ssids == 0)
                 flags |= IWL_MVM_LMAC_SCAN_FLAG_PASSIVE;
 
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+        if (mvm->scan_iter_notif_enabled)
+                flags |= IWL_MVM_LMAC_SCAN_FLAG_ITER_COMPLETE;
+#endif
+
         cmd->scan_flags |= cpu_to_le32(flags);
 
         cmd->flags = iwl_mvm_scan_rxon_flags(req->channels[0]->band);
@@ -1641,7 +1664,7 @@ int iwl_mvm_config_scan(struct iwl_mvm *mvm)
                                          SCAN_CONFIG_FLAG_SET_MAC_ADDR |
                                          SCAN_CONFIG_FLAG_SET_CHANNEL_FLAGS|
                                          SCAN_CONFIG_N_CHANNELS(num_channels));
-        scan_config->tx_chains = cpu_to_le32(mvm->fw->valid_tx_ant);
+        scan_config->tx_chains = cpu_to_le32(iwl_mvm_get_valid_tx_ant(mvm));
         scan_config->rx_chains = cpu_to_le32(iwl_mvm_scan_rx_ant(mvm));
         scan_config->legacy_rates = iwl_mvm_scan_config_rates(mvm);
         scan_config->out_of_channel_time = cpu_to_le32(170);
@@ -1660,10 +1683,10 @@ int iwl_mvm_config_scan(struct iwl_mvm *mvm)
 
         band = &mvm->nvm_data->bands[IEEE80211_BAND_2GHZ];
         for (i = 0; i < band->n_channels; i++, j++)
-                scan_config->channel_array[j] = band->channels[i].center_freq;
+                scan_config->channel_array[j] = band->channels[i].hw_value;
         band = &mvm->nvm_data->bands[IEEE80211_BAND_5GHZ];
         for (i = 0; i < band->n_channels; i++, j++)
-                scan_config->channel_array[j] = band->channels[i].center_freq;
+                scan_config->channel_array[j] = band->channels[i].hw_value;
 
         cmd.data[0] = scan_config;
         cmd.len[0] = cmd_size;
@@ -1840,6 +1863,13 @@ int iwl_mvm_scan_umac(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
         flags |= IWL_UMAC_SCAN_GEN_FLAGS_PASS_ALL;
 
         cmd->general_flags = cpu_to_le32(flags);
+
+        if (mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_SINGLE_SCAN_EBS &&
+            mvm->last_ebs_successful)
+                cmd->channel_flags = IWL_SCAN_CHANNEL_FLAG_EBS |
+                                     IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE |
+                                     IWL_SCAN_CHANNEL_FLAG_CACHE_ADD;
+
         cmd->n_channels = req->req.n_channels;
 
         for (i = 0; i < req->req.n_ssids; i++)
@@ -2003,7 +2033,9 @@ int iwl_mvm_rx_umac_scan_complete_notif(struct iwl_mvm *mvm,
                        notif->ebs_status == IWL_SCAN_EBS_SUCCESS ?
                                 "success" : "failed");
 
-        mvm->last_ebs_successful = !notif->ebs_status;
+        if (notif->ebs_status)
+                mvm->last_ebs_successful = false;
+
         mvm->scan_uid[uid_idx] = 0;
 
         if (!sched) {
@@ -2036,10 +2068,14 @@ static bool iwl_scan_umac_done_check(struct iwl_notif_wait_data *notif_wait,
 
         /*
          * Clear scan uid of scans that was aborted from above and completed
-         * in FW so the RX handler does nothing.
+         * in FW so the RX handler does nothing. Set last_ebs_successful here if
+         * needed.
          */
         scan_done->mvm->scan_uid[uid_idx] = 0;
 
+        if (notif->ebs_status)
+                scan_done->mvm->last_ebs_successful = false;
+
         return !iwl_mvm_find_scan_type(scan_done->mvm, scan_done->type);
 }
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/sta.c b/drivers/net/wireless/iwlwifi/mvm/sta.c
index d86fe432e51f..5c23cddaaae3 100644
--- a/drivers/net/wireless/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/mvm/sta.c
@@ -99,7 +99,7 @@ static int iwl_mvm_find_free_sta_id(struct iwl_mvm *mvm,
 int iwl_mvm_sta_send_to_fw(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                            bool update)
 {
-        struct iwl_mvm_sta *mvm_sta = (void *)sta->drv_priv;
+        struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
         struct iwl_mvm_add_sta_cmd add_sta_cmd = {
                 .sta_id = mvm_sta->sta_id,
                 .mac_id_n_color = cpu_to_le32(mvm_sta->mac_id_n_color),
@@ -209,6 +209,9 @@ static int iwl_mvm_tdls_sta_init(struct iwl_mvm *mvm,
 {
         unsigned long used_hw_queues;
         struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
+        unsigned int wdg_timeout = iwlmvm_mod_params.tfd_q_hang_detect ?
+                                        mvm->cfg->base_params->wd_timeout :
+                                        IWL_WATCHDOG_DISABLED;
         u32 ac;
 
         lockdep_assert_held(&mvm->mutex);
@@ -232,7 +235,7 @@ static int iwl_mvm_tdls_sta_init(struct iwl_mvm *mvm,
         /* Found a place for all queues - enable them */
         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
                 iwl_mvm_enable_ac_txq(mvm, mvmsta->hw_queue[ac],
-                                      iwl_mvm_ac_to_tx_fifo[ac]);
+                                      iwl_mvm_ac_to_tx_fifo[ac], wdg_timeout);
                 mvmsta->tfd_queue_msk |= BIT(mvmsta->hw_queue[ac]);
         }
 
@@ -250,8 +253,8 @@ static void iwl_mvm_tdls_sta_deinit(struct iwl_mvm *mvm,
 
         /* disable the TDLS STA-specific queues */
         sta_msk = mvmsta->tfd_queue_msk;
-        for_each_set_bit(i, &sta_msk, sizeof(sta_msk))
-                iwl_mvm_disable_txq(mvm, i);
+        for_each_set_bit(i, &sta_msk, sizeof(sta_msk) * BITS_PER_BYTE)
+                iwl_mvm_disable_txq(mvm, i, 0);
 }
 
 int iwl_mvm_add_sta(struct iwl_mvm *mvm,
@@ -259,7 +262,7 @@ int iwl_mvm_add_sta(struct iwl_mvm *mvm,
                     struct ieee80211_sta *sta)
 {
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
-        struct iwl_mvm_sta *mvm_sta = (void *)sta->drv_priv;
+        struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
         int i, ret, sta_id;
 
         lockdep_assert_held(&mvm->mutex);
@@ -464,8 +467,8 @@ void iwl_mvm_sta_drained_wk(struct work_struct *wk)
                 if (mvm->tfd_drained[sta_id]) {
                         unsigned long i, msk = mvm->tfd_drained[sta_id];
 
-                        for_each_set_bit(i, &msk, sizeof(msk))
-                                iwl_mvm_disable_txq(mvm, i);
+                        for_each_set_bit(i, &msk, sizeof(msk) * BITS_PER_BYTE)
+                                iwl_mvm_disable_txq(mvm, i, 0);
 
                         mvm->tfd_drained[sta_id] = 0;
                         IWL_DEBUG_TDLS(mvm, "Drained sta %d, with queues %ld\n",
@@ -481,7 +484,7 @@ int iwl_mvm_rm_sta(struct iwl_mvm *mvm,
                    struct ieee80211_sta *sta)
 {
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
-        struct iwl_mvm_sta *mvm_sta = (void *)sta->drv_priv;
+        struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
         int ret;
 
         lockdep_assert_held(&mvm->mutex);
@@ -626,13 +629,16 @@ static int iwl_mvm_add_int_sta_common(struct iwl_mvm *mvm,
 
 int iwl_mvm_add_aux_sta(struct iwl_mvm *mvm)
 {
+        unsigned int wdg_timeout = iwlmvm_mod_params.tfd_q_hang_detect ?
+                                        mvm->cfg->base_params->wd_timeout :
+                                        IWL_WATCHDOG_DISABLED;
         int ret;
 
         lockdep_assert_held(&mvm->mutex);
 
         /* Map Aux queue to fifo - needs to happen before adding Aux station */
         iwl_mvm_enable_ac_txq(mvm, mvm->aux_queue,
-                              IWL_MVM_TX_FIFO_MCAST);
+                              IWL_MVM_TX_FIFO_MCAST, wdg_timeout);
 
         /* Allocate aux station and assign to it the aux queue */
         ret = iwl_mvm_allocate_int_sta(mvm, &mvm->aux_sta, BIT(mvm->aux_queue),
@@ -774,7 +780,7 @@ int iwl_mvm_rm_bcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 int iwl_mvm_sta_rx_agg(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                        int tid, u16 ssn, bool start)
 {
-        struct iwl_mvm_sta *mvm_sta = (void *)sta->drv_priv;
+        struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
         struct iwl_mvm_add_sta_cmd cmd = {};
         int ret;
         u32 status;
@@ -834,7 +840,7 @@ int iwl_mvm_sta_rx_agg(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
 static int iwl_mvm_sta_tx_agg(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                               int tid, u8 queue, bool start)
 {
-        struct iwl_mvm_sta *mvm_sta = (void *)sta->drv_priv;
+        struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
         struct iwl_mvm_add_sta_cmd cmd = {};
         int ret;
         u32 status;
@@ -965,6 +971,9 @@ int iwl_mvm_sta_tx_agg_oper(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 {
         struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
         struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
+        unsigned int wdg_timeout = iwlmvm_mod_params.tfd_q_hang_detect ?
+                                        mvm->cfg->base_params->wd_timeout :
+                                        IWL_WATCHDOG_DISABLED;
         int queue, fifo, ret;
         u16 ssn;
 
@@ -988,7 +997,7 @@ int iwl_mvm_sta_tx_agg_oper(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                 return -EIO;
 
         iwl_mvm_enable_agg_txq(mvm, queue, fifo, mvmsta->sta_id, tid,
-                               buf_size, ssn);
+                               buf_size, ssn, wdg_timeout);
 
         /*
          * Even though in theory the peer could have different
@@ -1058,7 +1067,7 @@ int iwl_mvm_sta_tx_agg_stop(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 
                 iwl_mvm_sta_tx_agg(mvm, sta, tid, txq_id, false);
 
-                iwl_mvm_disable_txq(mvm, txq_id);
+                iwl_mvm_disable_txq(mvm, txq_id, 0);
                 return 0;
         case IWL_AGG_STARTING:
         case IWL_EMPTYING_HW_QUEUE_ADDBA:
@@ -1116,7 +1125,7 @@ int iwl_mvm_sta_tx_agg_flush(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 
                 iwl_mvm_sta_tx_agg(mvm, sta, tid, txq_id, false);
 
-                iwl_mvm_disable_txq(mvm, tid_data->txq_id);
+                iwl_mvm_disable_txq(mvm, tid_data->txq_id, 0);
         }
 
         mvm->queue_to_mac80211[tid_data->txq_id] =
@@ -1144,10 +1153,10 @@ static int iwl_mvm_set_fw_key_idx(struct iwl_mvm *mvm)
 static u8 iwl_mvm_get_key_sta_id(struct ieee80211_vif *vif,
                                  struct ieee80211_sta *sta)
 {
-        struct iwl_mvm_vif *mvmvif = (void *)vif->drv_priv;
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
 
         if (sta) {
-                struct iwl_mvm_sta *mvm_sta = (void *)sta->drv_priv;
+                struct iwl_mvm_sta *mvm_sta = iwl_mvm_sta_from_mac80211(sta);
 
                 return mvm_sta->sta_id;
         }
@@ -1196,6 +1205,7 @@ static int iwl_mvm_send_sta_key(struct iwl_mvm *mvm,
                 break;
         case WLAN_CIPHER_SUITE_WEP104:
                 key_flags |= cpu_to_le16(STA_KEY_FLG_WEP_13BYTES);
+                /* fall through */
         case WLAN_CIPHER_SUITE_WEP40:
                 key_flags |= cpu_to_le16(STA_KEY_FLG_WEP);
                 memcpy(cmd.key + 3, keyconf->key, keyconf->keylen);
@@ -1280,7 +1290,7 @@ static inline u8 *iwl_mvm_get_mac_addr(struct iwl_mvm *mvm,
                                        struct ieee80211_vif *vif,
                                        struct ieee80211_sta *sta)
 {
-        struct iwl_mvm_vif *mvmvif = (void *)vif->drv_priv;
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
 
         if (sta)
                 return sta->addr;
diff --git a/drivers/net/wireless/iwlwifi/mvm/tdls.c b/drivers/net/wireless/iwlwifi/mvm/tdls.c
index c0e00bae5bd0..a87b506c8c72 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tdls.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tdls.c
@@ -64,6 +64,8 @@
 #include <linux/etherdevice.h>
 #include "mvm.h"
 #include "time-event.h"
+#include "iwl-io.h"
+#include "iwl-prph.h"
 
 #define TU_TO_US(x) (x * 1024)
 #define TU_TO_MS(x) (TU_TO_US(x) / 1000)
@@ -228,6 +230,8 @@ iwl_mvm_tdls_cs_state_str(enum iwl_mvm_tdls_cs_state state)
                 return "IDLE";
         case IWL_MVM_TDLS_SW_REQ_SENT:
                 return "REQ SENT";
+        case IWL_MVM_TDLS_SW_RESP_RCVD:
+                return "RESP RECEIVED";
         case IWL_MVM_TDLS_SW_REQ_RCVD:
                 return "REQ RECEIVED";
         case IWL_MVM_TDLS_SW_ACTIVE:
@@ -248,6 +252,11 @@ static void iwl_mvm_tdls_update_cs_state(struct iwl_mvm *mvm,
                        iwl_mvm_tdls_cs_state_str(state));
         mvm->tdls_cs.state = state;
 
+        /* we only send requests to our switching peer - update sent time */
+        if (state == IWL_MVM_TDLS_SW_REQ_SENT)
+                mvm->tdls_cs.peer.sent_timestamp =
+                        iwl_read_prph(mvm->trans, DEVICE_SYSTEM_TIME_REG);
+
         if (state == IWL_MVM_TDLS_SW_IDLE)
                 mvm->tdls_cs.cur_sta_id = IWL_MVM_STATION_COUNT;
 }
@@ -300,7 +309,7 @@ out:
 static int
 iwl_mvm_tdls_check_action(struct iwl_mvm *mvm,
                           enum iwl_tdls_channel_switch_type type,
-                          const u8 *peer, bool peer_initiator)
+                          const u8 *peer, bool peer_initiator, u32 timestamp)
 {
         bool same_peer = false;
         int ret = 0;
@@ -325,17 +334,30 @@ iwl_mvm_tdls_check_action(struct iwl_mvm *mvm,
                         ret = -EINVAL;
                 break;
         case IWL_MVM_TDLS_SW_REQ_SENT:
+                /* only allow requests from the same peer */
+                if (!same_peer)
+                        ret = -EBUSY;
+                else if (type == TDLS_SEND_CHAN_SW_RESP_AND_MOVE_CH &&
+                         !peer_initiator)
+                        /*
+                         * We received a ch-switch request while an outgoing
+                         * one is pending. Allow it if the peer is the link
+                         * initiator.
+                         */
+                        ret = -EBUSY;
+                else if (type == TDLS_SEND_CHAN_SW_REQ)
+                        /* wait for idle before sending another request */
+                        ret = -EBUSY;
+                else if (timestamp <= mvm->tdls_cs.peer.sent_timestamp)
+                        /* we got a stale response - ignore it */
+                        ret = -EINVAL;
+                break;
+        case IWL_MVM_TDLS_SW_RESP_RCVD:
                 /*
-                 * We received a ch-switch request while an outgoing one is
-                 * pending. Allow it to proceed if the other peer is the same
-                 * one we sent to, and we are not the link initiator.
+                 * we are waiting for the FW to give an "active" notification,
+                 * so ignore requests in the meantime
                  */
-                if (type == TDLS_SEND_CHAN_SW_RESP_AND_MOVE_CH) {
-                        if (!same_peer)
-                                ret = -EBUSY;
-                        else if (!peer_initiator) /* we are the initiator */
-                                ret = -EBUSY;
-                }
+                ret = -EBUSY;
                 break;
         case IWL_MVM_TDLS_SW_REQ_RCVD:
                 /* as above, allow the link initiator to proceed */
@@ -349,9 +371,12 @@ iwl_mvm_tdls_check_action(struct iwl_mvm *mvm,
                 }
                 break;
         case IWL_MVM_TDLS_SW_ACTIVE:
-                /* we don't allow initiations during active channel switch */
-                if (type == TDLS_SEND_CHAN_SW_REQ)
-                        ret = -EINVAL;
+                /*
+                 * the only valid request when active is a request to return
+                 * to the base channel by the current off-channel peer
+                 */
+                if (type != TDLS_MOVE_CH || !same_peer)
+                        ret = -EBUSY;
                 break;
         }
 
@@ -384,7 +409,8 @@ iwl_mvm_tdls_config_channel_switch(struct iwl_mvm *mvm,
 
         lockdep_assert_held(&mvm->mutex);
 
-        ret = iwl_mvm_tdls_check_action(mvm, type, peer, peer_initiator);
+        ret = iwl_mvm_tdls_check_action(mvm, type, peer, peer_initiator,
+                                        timestamp);
         if (ret)
                 return ret;
 
@@ -473,6 +499,8 @@ iwl_mvm_tdls_config_channel_switch(struct iwl_mvm *mvm,
                                              type == TDLS_SEND_CHAN_SW_REQ ?
                                              IWL_MVM_TDLS_SW_REQ_SENT :
                                              IWL_MVM_TDLS_SW_REQ_RCVD);
+        } else {
+                iwl_mvm_tdls_update_cs_state(mvm, IWL_MVM_TDLS_SW_RESP_RCVD);
         }
 
 out:
@@ -657,12 +685,15 @@ iwl_mvm_tdls_recv_channel_switch(struct ieee80211_hw *hw,
         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
         enum iwl_tdls_channel_switch_type type;
         unsigned int delay;
+        const char *action_str =
+                params->action_code == WLAN_TDLS_CHANNEL_SWITCH_REQUEST ?
+                "REQ" : "RESP";
 
         mutex_lock(&mvm->mutex);
 
         IWL_DEBUG_TDLS(mvm,
-                       "Received TDLS ch switch action %d from %pM status %d\n",
-                       params->action_code, params->sta->addr, params->status);
+                       "Received TDLS ch switch action %s from %pM status %d\n",
+                       action_str, params->sta->addr, params->status);
 
         /*
          * we got a non-zero status from a peer we were switching to - move to
diff --git a/drivers/net/wireless/iwlwifi/mvm/tt.c b/drivers/net/wireless/iwlwifi/mvm/tt.c
index 2b1e61fac34a..ba615ad2176c 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tt.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tt.c
@@ -69,6 +69,7 @@
 
 static void iwl_mvm_enter_ctkill(struct iwl_mvm *mvm)
 {
+        struct iwl_mvm_tt_mgmt *tt = &mvm->thermal_throttle;
         u32 duration = mvm->thermal_throttle.params->ct_kill_duration;
 
         if (test_bit(IWL_MVM_STATUS_HW_CTKILL, &mvm->status))
@@ -77,12 +78,15 @@ static void iwl_mvm_enter_ctkill(struct iwl_mvm *mvm)
         IWL_ERR(mvm, "Enter CT Kill\n");
         iwl_mvm_set_hw_ctkill_state(mvm, true);
 
+        tt->throttle = false;
+        tt->dynamic_smps = false;
+
         /* Don't schedule an exit work if we're in test mode, since
          * the temperature will not change unless we manually set it
          * again (or disable testing).
          */
         if (!mvm->temperature_test)
-                schedule_delayed_work(&mvm->thermal_throttle.ct_kill_exit,
+                schedule_delayed_work(&tt->ct_kill_exit,
                                       round_jiffies_relative(duration * HZ));
 }
 
@@ -452,6 +456,7 @@ void iwl_mvm_tt_initialize(struct iwl_mvm *mvm, u32 min_backoff)
                 tt->params = &iwl7000_tt_params;
 
         tt->throttle = false;
+        tt->dynamic_smps = false;
         tt->min_backoff = min_backoff;
         INIT_DELAYED_WORK(&tt->ct_kill_exit, check_exit_ctkill);
 }
diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c
index c59d07567d90..07304e1fd64a 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
@@ -220,7 +220,7 @@ void iwl_mvm_set_tx_cmd_rate(struct iwl_mvm *mvm, struct iwl_tx_cmd *tx_cmd,
         rate_plcp = iwl_mvm_mac80211_idx_to_hwrate(rate_idx);
 
         mvm->mgmt_last_antenna_idx =
-                iwl_mvm_next_antenna(mvm, mvm->fw->valid_tx_ant,
+                iwl_mvm_next_antenna(mvm, iwl_mvm_get_valid_tx_ant(mvm),
                                      mvm->mgmt_last_antenna_idx);
 
         if (info->band == IEEE80211_BAND_2GHZ &&
@@ -507,7 +507,7 @@ static void iwl_mvm_check_ratid_empty(struct iwl_mvm *mvm,
                 IWL_DEBUG_TX_QUEUES(mvm,
                                     "Can continue DELBA flow ssn = next_recl = %d\n",
                                     tid_data->next_reclaimed);
-                iwl_mvm_disable_txq(mvm, tid_data->txq_id);
+                iwl_mvm_disable_txq(mvm, tid_data->txq_id, CMD_ASYNC);
                 tid_data->state = IWL_AGG_OFF;
                 /*
                  * we can't hold the mutex - but since we are after a sequence
@@ -667,7 +667,8 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
 
                 /* Single frame failure in an AMPDU queue => send BAR */
                 if (txq_id >= mvm->first_agg_queue &&
-                    !(info->flags & IEEE80211_TX_STAT_ACK))
+                    !(info->flags & IEEE80211_TX_STAT_ACK) &&
+                    !(info->flags & IEEE80211_TX_STAT_TX_FILTERED))
                         info->flags |= IEEE80211_TX_STAT_AMPDU_NO_BACK;
 
                 /* W/A FW bug: seq_ctl is wrong when the status isn't success */
@@ -930,6 +931,11 @@ int iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
         sta_id = ba_notif->sta_id;
         tid = ba_notif->tid;
 
+        if (WARN_ONCE(sta_id >= IWL_MVM_STATION_COUNT ||
+                      tid >= IWL_MAX_TID_COUNT,
+                      "sta_id %d tid %d", sta_id, tid))
+                return 0;
+
         rcu_read_lock();
 
         sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_id]);
diff --git a/drivers/net/wireless/iwlwifi/mvm/utils.c b/drivers/net/wireless/iwlwifi/mvm/utils.c
index 917431e30f74..8decf9953229 100644
--- a/drivers/net/wireless/iwlwifi/mvm/utils.c
+++ b/drivers/net/wireless/iwlwifi/mvm/utils.c
@@ -432,7 +432,7 @@ static void iwl_mvm_dump_umac_error_log(struct iwl_mvm *mvm)
                         mvm->status, table.valid);
         }
 
-        IWL_ERR(mvm, "0x%08X | %-28s\n", table.error_id,
+        IWL_ERR(mvm, "0x%08X | %s\n", table.error_id,
                 desc_lookup(table.error_id));
         IWL_ERR(mvm, "0x%08X | umac branchlink1\n", table.blink1);
         IWL_ERR(mvm, "0x%08X | umac branchlink2\n", table.blink2);
@@ -531,49 +531,50 @@ void iwl_mvm_dump_nic_error_log(struct iwl_mvm *mvm)
 }
 
 void iwl_mvm_enable_txq(struct iwl_mvm *mvm, int queue, u16 ssn,
-                        const struct iwl_trans_txq_scd_cfg *cfg)
+                        const struct iwl_trans_txq_scd_cfg *cfg,
+                        unsigned int wdg_timeout)
 {
-        if (iwl_mvm_is_dqa_supported(mvm)) {
-                struct iwl_scd_txq_cfg_cmd cmd = {
-                        .scd_queue = queue,
-                        .enable = 1,
-                        .window = cfg->frame_limit,
-                        .sta_id = cfg->sta_id,
-                        .ssn = cpu_to_le16(ssn),
-                        .tx_fifo = cfg->fifo,
-                        .aggregate = cfg->aggregate,
-                        .flags = IWL_SCD_FLAGS_DQA_ENABLED,
-                        .tid = cfg->tid,
-                        .control = IWL_SCD_CONTROL_SET_SSN,
-                };
-                int ret = iwl_mvm_send_cmd_pdu(mvm, SCD_QUEUE_CFG, 0,
-                                               sizeof(cmd), &cmd);
-                if (ret)
-                        IWL_ERR(mvm,
-                                "Failed to configure queue %d on FIFO %d\n",
-                                queue, cfg->fifo);
+        struct iwl_scd_txq_cfg_cmd cmd = {
+                .scd_queue = queue,
+                .enable = 1,
+                .window = cfg->frame_limit,
+                .sta_id = cfg->sta_id,
+                .ssn = cpu_to_le16(ssn),
+                .tx_fifo = cfg->fifo,
+                .aggregate = cfg->aggregate,
+                .tid = cfg->tid,
+        };
+
+        if (!iwl_mvm_is_scd_cfg_supported(mvm)) {
+                iwl_trans_txq_enable_cfg(mvm->trans, queue, ssn, cfg,
+                                         wdg_timeout);
+                return;
         }
 
-        iwl_trans_txq_enable_cfg(mvm->trans, queue, ssn,
-                                 iwl_mvm_is_dqa_supported(mvm) ? NULL : cfg);
+        iwl_trans_txq_enable_cfg(mvm->trans, queue, ssn, NULL, wdg_timeout);
+        WARN(iwl_mvm_send_cmd_pdu(mvm, SCD_QUEUE_CFG, 0, sizeof(cmd), &cmd),
+             "Failed to configure queue %d on FIFO %d\n", queue, cfg->fifo);
 }
 
-void iwl_mvm_disable_txq(struct iwl_mvm *mvm, int queue)
+void iwl_mvm_disable_txq(struct iwl_mvm *mvm, int queue, u8 flags)
 {
-        iwl_trans_txq_disable(mvm->trans, queue,
-                              !iwl_mvm_is_dqa_supported(mvm));
-
-        if (iwl_mvm_is_dqa_supported(mvm)) {
-                struct iwl_scd_txq_cfg_cmd cmd = {
-                        .scd_queue = queue,
-                        .enable = 0,
-                };
-                int ret = iwl_mvm_send_cmd_pdu(mvm, SCD_QUEUE_CFG, CMD_ASYNC,
-                                               sizeof(cmd), &cmd);
-                if (ret)
-                        IWL_ERR(mvm, "Failed to disable queue %d (ret=%d)\n",
-                                queue, ret);
+        struct iwl_scd_txq_cfg_cmd cmd = {
+                .scd_queue = queue,
+                .enable = 0,
+        };
+        int ret;
+
+        if (!iwl_mvm_is_scd_cfg_supported(mvm)) {
+                iwl_trans_txq_disable(mvm->trans, queue, true);
+                return;
         }
+
+        iwl_trans_txq_disable(mvm->trans, queue, false);
+        ret = iwl_mvm_send_cmd_pdu(mvm, SCD_QUEUE_CFG, flags,
+                                   sizeof(cmd), &cmd);
+        if (ret)
+                IWL_ERR(mvm, "Failed to disable queue %d (ret=%d)\n",
+                        queue, ret);
 }
 
 /**
@@ -620,7 +621,7 @@ void iwl_mvm_update_smps(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
         lockdep_assert_held(&mvm->mutex);
 
         /* SMPS is irrelevant for NICs that don't have at least 2 RX antenna */
-        if (num_of_ant(mvm->fw->valid_rx_ant) == 1)
+        if (num_of_ant(iwl_mvm_get_valid_rx_ant(mvm)) == 1)
                 return;
 
         if (vif->type == NL80211_IFTYPE_AP)
@@ -662,7 +663,7 @@ bool iwl_mvm_rx_diversity_allowed(struct iwl_mvm *mvm)
 
         lockdep_assert_held(&mvm->mutex);
 
-        if (num_of_ant(mvm->fw->valid_rx_ant) == 1)
+        if (num_of_ant(iwl_mvm_get_valid_rx_ant(mvm)) == 1)
                 return false;
 
         if (mvm->cfg->rx_with_siso_diversity)
diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index d5aadb00dd9e..dbd6bcf52205 100644
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -415,6 +415,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x24F3, 0x0010, iwl8260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x24F3, 0x0004, iwl8260_2n_cfg)},
         {IWL_PCI_DEVICE(0x24F4, 0x0030, iwl8260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x24F5, 0x0010, iwl4165_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x24F6, 0x0030, iwl4165_2ac_cfg)},
 #endif /* CONFIG_IWLMVM */
 
         {0}
diff --git a/drivers/net/wireless/iwlwifi/pcie/internal.h b/drivers/net/wireless/iwlwifi/pcie/internal.h
index 1aea6b66c594..cae0eb8835ce 100644
--- a/drivers/net/wireless/iwlwifi/pcie/internal.h
+++ b/drivers/net/wireless/iwlwifi/pcie/internal.h
@@ -216,6 +216,7 @@ struct iwl_pcie_txq_scratch_buf {
  * @need_update: indicates need to update read/write index
  * @active: stores if queue is active
  * @ampdu: true if this queue is an ampdu queue for an specific RA/TID
+ * @wd_timeout: queue watchdog timeout (jiffies) - per queue
  *
  * A Tx queue consists of circular buffer of BDs (a.k.a. TFDs, transmit frame
  * descriptors) and required locking structures.
@@ -232,6 +233,7 @@ struct iwl_txq {
         bool need_update;
         u8 active;
         bool ampdu;
+        unsigned long wd_timeout;
 };
 
 static inline dma_addr_t
@@ -259,7 +261,6 @@ iwl_pcie_get_scratchbuf_dma(struct iwl_txq *txq, int idx)
  * @bc_table_dword: true if the BC table expects DWORD (as opposed to bytes)
  * @scd_set_active: should the transport configure the SCD for HCMD queue
  * @rx_page_order: page order for receive buffer size
- * @wd_timeout: queue watchdog timeout (jiffies)
  * @reg_lock: protect hw register access
  * @cmd_in_flight: true when we have a host command in flight
  * @fw_mon_phys: physical address of the buffer for the firmware monitor
@@ -302,6 +303,7 @@ struct iwl_trans_pcie {
 
         u8 cmd_queue;
         u8 cmd_fifo;
+        unsigned int cmd_q_wdg_timeout;
         u8 n_no_reclaim_cmds;
         u8 no_reclaim_cmds[MAX_NO_RECLAIM_CMDS];
 
@@ -312,12 +314,14 @@ struct iwl_trans_pcie {
 
         const char *const *command_names;
 
-        /* queue watchdog */
-        unsigned long wd_timeout;
-
         /*protect hw register */
         spinlock_t reg_lock;
         bool cmd_in_flight;
+        bool ref_cmd_in_flight;
+
+        /* protect ref counter */
+        spinlock_t ref_lock;
+        u32 ref_count;
 
         dma_addr_t fw_mon_phys;
         struct page *fw_mon_page;
@@ -368,7 +372,8 @@ void iwl_pcie_tx_start(struct iwl_trans *trans, u32 scd_base_addr);
 int iwl_pcie_tx_stop(struct iwl_trans *trans);
 void iwl_pcie_tx_free(struct iwl_trans *trans);
 void iwl_trans_pcie_txq_enable(struct iwl_trans *trans, int queue, u16 ssn,
-                               const struct iwl_trans_txq_scd_cfg *cfg);
+                               const struct iwl_trans_txq_scd_cfg *cfg,
+                               unsigned int wdg_timeout);
 void iwl_trans_pcie_txq_disable(struct iwl_trans *trans, int queue,
                                 bool configure_scd);
 int iwl_trans_pcie_tx(struct iwl_trans *trans, struct sk_buff *skb,
@@ -381,6 +386,9 @@ void iwl_trans_pcie_reclaim(struct iwl_trans *trans, int txq_id, int ssn,
                             struct sk_buff_head *skbs);
 void iwl_trans_pcie_tx_reset(struct iwl_trans *trans);
 
+void iwl_trans_pcie_ref(struct iwl_trans *trans);
+void iwl_trans_pcie_unref(struct iwl_trans *trans);
+
 static inline u16 iwl_pcie_tfd_tb_get_len(struct iwl_tfd *tfd, u8 idx)
 {
         struct iwl_tfd_tb *tb = &tfd->tbs[idx];
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index 523fe0c88dcb..69935aa5a1b3 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -75,6 +75,7 @@
 #include "iwl-trans.h"
 #include "iwl-csr.h"
 #include "iwl-prph.h"
+#include "iwl-scd.h"
 #include "iwl-agn-hw.h"
 #include "iwl-fw-error-dump.h"
 #include "internal.h"
@@ -443,10 +444,25 @@ static int iwl_pcie_apm_stop_master(struct iwl_trans *trans)
         return ret;
 }
 
-static void iwl_pcie_apm_stop(struct iwl_trans *trans)
+static void iwl_pcie_apm_stop(struct iwl_trans *trans, bool op_mode_leave)
 {
         IWL_DEBUG_INFO(trans, "Stop card, put in low power state\n");
 
+        if (op_mode_leave) {
+                if (!test_bit(STATUS_DEVICE_ENABLED, &trans->status))
+                        iwl_pcie_apm_init(trans);
+
+                /* inform ME that we are leaving */
+                if (trans->cfg->device_family == IWL_DEVICE_FAMILY_7000)
+                        iwl_set_bits_prph(trans, APMG_PCIDEV_STT_REG,
+                                          APMG_PCIDEV_STT_VAL_WAKE_ME);
+                else if (trans->cfg->device_family == IWL_DEVICE_FAMILY_8000)
+                        iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG,
+                                    CSR_HW_IF_CONFIG_REG_PREPARE |
+                                    CSR_HW_IF_CONFIG_REG_ENABLE_PME);
+                mdelay(5);
+        }
+
         clear_bit(STATUS_DEVICE_ENABLED, &trans->status);
 
         /* Stop device's DMA activity */
@@ -707,6 +723,11 @@ static int iwl_pcie_load_cpu_sections_8000b(struct iwl_trans *trans,
 
         *first_ucode_section = last_read_idx;
 
+        if (cpu == 1)
+                iwl_write_direct32(trans, FH_UCODE_LOAD_STATUS, 0xFFFF);
+        else
+                iwl_write_direct32(trans, FH_UCODE_LOAD_STATUS, 0xFFFFFFFF);
+
         return 0;
 }
 
@@ -893,8 +914,8 @@ static int iwl_pcie_load_given_ucode_8000b(struct iwl_trans *trans,
         if (ret)
                 return ret;
 
-        /* Notify FW loading is done */
-        iwl_write_direct32(trans, FH_UCODE_LOAD_STATUS, 0xFFFFFFFF);
+        if (trans->dbg_dest_tlv)
+                iwl_pcie_apply_destination(trans);
 
         /* wait for image verification to complete  */
         ret = iwl_poll_prph_bit(trans, LMPM_SECURE_BOOT_CPU1_STATUS_ADDR_B0,
@@ -916,6 +937,7 @@ static int iwl_pcie_load_given_ucode_8000b(struct iwl_trans *trans,
 static int iwl_trans_pcie_start_fw(struct iwl_trans *trans,
                                    const struct fw_img *fw, bool run_in_rfkill)
 {
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         int ret;
         bool hw_rfkill;
 
@@ -945,6 +967,9 @@ static int iwl_trans_pcie_start_fw(struct iwl_trans *trans,
                 return ret;
         }
 
+        /* init ref_count to 1 (should be cleared when ucode is loaded) */
+        trans_pcie->ref_count = 1;
+
         /* make sure rfkill handshake bits are cleared */
         iwl_write32(trans, CSR_UCODE_DRV_GP1_CLR, CSR_UCODE_SW_BIT_RFKILL);
         iwl_write32(trans, CSR_UCODE_DRV_GP1_CLR,
@@ -960,7 +985,7 @@ static int iwl_trans_pcie_start_fw(struct iwl_trans *trans,
 
         /* Load the given image to the HW */
         if ((trans->cfg->device_family == IWL_DEVICE_FAMILY_8000) &&
-            (CSR_HW_REV_STEP(trans->hw_rev) == SILICON_B_STEP))
+            (CSR_HW_REV_STEP(trans->hw_rev) != SILICON_A_STEP))
                 return iwl_pcie_load_given_ucode_8000b(trans, fw);
         else
                 return iwl_pcie_load_given_ucode(trans, fw);
@@ -1010,7 +1035,7 @@ static void iwl_trans_pcie_stop_device(struct iwl_trans *trans)
                       CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
 
         /* Stop the device, and put it in low power state */
-        iwl_pcie_apm_stop(trans);
+        iwl_pcie_apm_stop(trans, false);
 
         /* stop and reset the on-board processor */
         iwl_write32(trans, CSR_RESET, CSR_RESET_REG_FLAG_SW_RESET);
@@ -1192,7 +1217,7 @@ static void iwl_trans_pcie_op_mode_leave(struct iwl_trans *trans)
         iwl_disable_interrupts(trans);
         spin_unlock(&trans_pcie->irq_lock);
 
-        iwl_pcie_apm_stop(trans);
+        iwl_pcie_apm_stop(trans, true);
 
         spin_lock(&trans_pcie->irq_lock);
         iwl_disable_interrupts(trans);
@@ -1244,6 +1269,7 @@ static void iwl_trans_pcie_configure(struct iwl_trans *trans,
 
         trans_pcie->cmd_queue = trans_cfg->cmd_queue;
         trans_pcie->cmd_fifo = trans_cfg->cmd_fifo;
+        trans_pcie->cmd_q_wdg_timeout = trans_cfg->cmd_q_wdg_timeout;
         if (WARN_ON(trans_cfg->n_no_reclaim_cmds > MAX_NO_RECLAIM_CMDS))
                 trans_pcie->n_no_reclaim_cmds = 0;
         else
@@ -1258,9 +1284,6 @@ static void iwl_trans_pcie_configure(struct iwl_trans *trans,
         else
                 trans_pcie->rx_page_order = get_order(4 * 1024);
 
-        trans_pcie->wd_timeout =
-                msecs_to_jiffies(trans_cfg->queue_watchdog_timeout);
-
         trans_pcie->command_names = trans_cfg->command_names;
         trans_pcie->bc_table_dword = trans_cfg->bc_table_dword;
         trans_pcie->scd_set_active = trans_cfg->scd_set_active;
@@ -1540,6 +1563,38 @@ static void iwl_trans_pcie_set_bits_mask(struct iwl_trans *trans, u32 reg,
         spin_unlock_irqrestore(&trans_pcie->reg_lock, flags);
 }
 
+void iwl_trans_pcie_ref(struct iwl_trans *trans)
+{
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+        unsigned long flags;
+
+        if (iwlwifi_mod_params.d0i3_disable)
+                return;
+
+        spin_lock_irqsave(&trans_pcie->ref_lock, flags);
+        IWL_DEBUG_RPM(trans, "ref_counter: %d\n", trans_pcie->ref_count);
+        trans_pcie->ref_count++;
+        spin_unlock_irqrestore(&trans_pcie->ref_lock, flags);
+}
+
+void iwl_trans_pcie_unref(struct iwl_trans *trans)
+{
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+        unsigned long flags;
+
+        if (iwlwifi_mod_params.d0i3_disable)
+                return;
+
+        spin_lock_irqsave(&trans_pcie->ref_lock, flags);
+        IWL_DEBUG_RPM(trans, "ref_counter: %d\n", trans_pcie->ref_count);
+        if (WARN_ON_ONCE(trans_pcie->ref_count == 0)) {
+                spin_unlock_irqrestore(&trans_pcie->ref_lock, flags);
+                return;
+        }
+        trans_pcie->ref_count--;
+        spin_unlock_irqrestore(&trans_pcie->ref_lock, flags);
+}
+
 static const char *get_csr_string(int cmd)
 {
 #define IWL_CMD(x) case x: return #x
@@ -2264,6 +2319,9 @@ static const struct iwl_trans_ops trans_ops_pcie = {
         .release_nic_access = iwl_trans_pcie_release_nic_access,
         .set_bits_mask = iwl_trans_pcie_set_bits_mask,
 
+        .ref = iwl_trans_pcie_ref,
+        .unref = iwl_trans_pcie_unref,
+
         .dump_data = iwl_trans_pcie_dump_data,
 };
 
@@ -2291,6 +2349,7 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
         trans_pcie->trans = trans;
         spin_lock_init(&trans_pcie->irq_lock);
         spin_lock_init(&trans_pcie->reg_lock);
+        spin_lock_init(&trans_pcie->ref_lock);
         init_waitqueue_head(&trans_pcie->ucode_write_waitq);
 
         err = pci_enable_device(pdev);
@@ -2404,6 +2463,7 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
         }
 
         trans_pcie->inta_mask = CSR_INI_SET_MASK;
+        trans->d0i3_mode = IWL_D0I3_MODE_ON_SUSPEND;
 
         return trans;
 
diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c
index 8a6c7a084aa1..af0bce736358 100644
--- a/drivers/net/wireless/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
@@ -147,7 +147,6 @@ static void iwl_pcie_free_dma_ptr(struct iwl_trans *trans,
 static void iwl_pcie_txq_stuck_timer(unsigned long data)
 {
         struct iwl_txq *txq = (void *)data;
-        struct iwl_queue *q = &txq->q;
         struct iwl_trans_pcie *trans_pcie = txq->trans_pcie;
         struct iwl_trans *trans = iwl_trans_pcie_get_trans(trans_pcie);
         u32 scd_sram_addr = trans_pcie->scd_base_addr +
@@ -164,7 +163,7 @@ static void iwl_pcie_txq_stuck_timer(unsigned long data)
         spin_unlock(&txq->lock);
 
         IWL_ERR(trans, "Queue %d stuck for %u ms.\n", txq->q.id,
-                jiffies_to_msecs(trans_pcie->wd_timeout));
+                jiffies_to_msecs(txq->wd_timeout));
         IWL_ERR(trans, "Current SW read_ptr %d write_ptr %d\n",
                 txq->q.read_ptr, txq->q.write_ptr);
 
@@ -198,11 +197,6 @@ static void iwl_pcie_txq_stuck_timer(unsigned long data)
                         iwl_read_prph(trans, SCD_QUEUE_WRPTR(i)));
         }
 
-        for (i = q->read_ptr; i != q->write_ptr;
-             i = iwl_queue_inc_wrap(i))
-                IWL_ERR(trans, "scratch %d = 0x%08x\n", i,
-                        le32_to_cpu(txq->scratchbufs[i].scratch));
-
         iwl_force_nmi(trans);
 }
 
@@ -680,7 +674,8 @@ void iwl_pcie_tx_start(struct iwl_trans *trans, u32 scd_base_addr)
                 iwl_write_prph(trans, SCD_CHAINEXT_EN, 0);
 
         iwl_trans_ac_txq_enable(trans, trans_pcie->cmd_queue,
-                                trans_pcie->cmd_fifo);
+                                trans_pcie->cmd_fifo,
+                                trans_pcie->cmd_q_wdg_timeout);
 
         /* Activate all Tx DMA/FIFO channels */
         iwl_scd_activate_fifos(trans);
@@ -722,7 +717,12 @@ void iwl_trans_pcie_tx_reset(struct iwl_trans *trans)
         iwl_write_direct32(trans, FH_KW_MEM_ADDR_REG,
                            trans_pcie->kw.dma >> 4);
 
-        iwl_pcie_tx_start(trans, trans_pcie->scd_base_addr);
+        /*
+         * Send 0 as the scd_base_addr since the device may have be reset
+         * while we were in WoWLAN in which case SCD_SRAM_BASE_ADDR will
+         * contain garbage.
+         */
+        iwl_pcie_tx_start(trans, 0);
 }
 
 /*
@@ -898,6 +898,10 @@ int iwl_pcie_tx_init(struct iwl_trans *trans)
                 }
         }
 
+        if (trans->cfg->base_params->num_of_queues > 20)
+                iwl_set_bits_prph(trans, SCD_GP_CTRL,
+                                  SCD_GP_CTRL_ENABLE_31_QUEUES);
+
         return 0;
 error:
         /*Upon error, free only if we allocated something */
@@ -906,10 +910,9 @@ error:
         return ret;
 }
 
-static inline void iwl_pcie_txq_progress(struct iwl_trans_pcie *trans_pcie,
-                                           struct iwl_txq *txq)
+static inline void iwl_pcie_txq_progress(struct iwl_txq *txq)
 {
-        if (!trans_pcie->wd_timeout)
+        if (!txq->wd_timeout)
                 return;
 
         /*
@@ -919,7 +922,7 @@ static inline void iwl_pcie_txq_progress(struct iwl_trans_pcie *trans_pcie,
         if (txq->q.read_ptr == txq->q.write_ptr)
                 del_timer(&txq->stuck_timer);
         else
-                mod_timer(&txq->stuck_timer, jiffies + trans_pcie->wd_timeout);
+                mod_timer(&txq->stuck_timer, jiffies + txq->wd_timeout);
 }
 
 /* Frees buffers until index _not_ inclusive */
@@ -981,21 +984,35 @@ void iwl_trans_pcie_reclaim(struct iwl_trans *trans, int txq_id, int ssn,
                 iwl_pcie_txq_free_tfd(trans, txq);
         }
 
-        iwl_pcie_txq_progress(trans_pcie, txq);
+        iwl_pcie_txq_progress(txq);
 
         if (iwl_queue_space(&txq->q) > txq->q.low_mark)
                 iwl_wake_queue(trans, txq);
+
+        if (q->read_ptr == q->write_ptr) {
+                IWL_DEBUG_RPM(trans, "Q %d - last tx reclaimed\n", q->id);
+                iwl_trans_pcie_unref(trans);
+        }
+
 out:
         spin_unlock_bh(&txq->lock);
 }
 
-static int iwl_pcie_set_cmd_in_flight(struct iwl_trans *trans)
+static int iwl_pcie_set_cmd_in_flight(struct iwl_trans *trans,
+                                      const struct iwl_host_cmd *cmd)
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         int ret;
 
         lockdep_assert_held(&trans_pcie->reg_lock);
 
+        if (!(cmd->flags & CMD_SEND_IN_IDLE) &&
+            !trans_pcie->ref_cmd_in_flight) {
+                trans_pcie->ref_cmd_in_flight = true;
+                IWL_DEBUG_RPM(trans, "set ref_cmd_in_flight - ref\n");
+                iwl_trans_pcie_ref(trans);
+        }
+
         if (trans_pcie->cmd_in_flight)
                 return 0;
 
@@ -1036,6 +1053,12 @@ static int iwl_pcie_clear_cmd_in_flight(struct iwl_trans *trans)
 
         lockdep_assert_held(&trans_pcie->reg_lock);
 
+        if (trans_pcie->ref_cmd_in_flight) {
+                trans_pcie->ref_cmd_in_flight = false;
+                IWL_DEBUG_RPM(trans, "clear ref_cmd_in_flight - unref\n");
+                iwl_trans_pcie_unref(trans);
+        }
+
         if (WARN_ON(!trans_pcie->cmd_in_flight))
                 return 0;
 
@@ -1089,7 +1112,7 @@ static void iwl_pcie_cmdq_reclaim(struct iwl_trans *trans, int txq_id, int idx)
                 spin_unlock_irqrestore(&trans_pcie->reg_lock, flags);
         }
 
-        iwl_pcie_txq_progress(trans_pcie, txq);
+        iwl_pcie_txq_progress(txq);
 }
 
 static int iwl_pcie_txq_set_ratid_map(struct iwl_trans *trans, u16 ra_tid,
@@ -1122,14 +1145,18 @@ static int iwl_pcie_txq_set_ratid_map(struct iwl_trans *trans, u16 ra_tid,
 #define BUILD_RAxTID(sta_id, tid)       (((sta_id) << 4) + (tid))
 
 void iwl_trans_pcie_txq_enable(struct iwl_trans *trans, int txq_id, u16 ssn,
-                               const struct iwl_trans_txq_scd_cfg *cfg)
+                               const struct iwl_trans_txq_scd_cfg *cfg,
+                               unsigned int wdg_timeout)
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+        struct iwl_txq *txq = &trans_pcie->txq[txq_id];
         int fifo = -1;
 
         if (test_and_set_bit(txq_id, trans_pcie->queue_used))
                 WARN_ONCE(1, "queue %d already used - expect issues", txq_id);
 
+        txq->wd_timeout = msecs_to_jiffies(wdg_timeout);
+
         if (cfg) {
                 fifo = cfg->fifo;
 
@@ -1153,7 +1180,7 @@ void iwl_trans_pcie_txq_enable(struct iwl_trans *trans, int txq_id, u16 ssn,
 
                         /* enable aggregations for the queue */
                         iwl_scd_txq_enable_agg(trans, txq_id);
-                        trans_pcie->txq[txq_id].ampdu = true;
+                        txq->ampdu = true;
                 } else {
                         /*
                          * disable aggregations for the queue, this will also
@@ -1162,20 +1189,20 @@ void iwl_trans_pcie_txq_enable(struct iwl_trans *trans, int txq_id, u16 ssn,
                          */
                         iwl_scd_txq_disable_agg(trans, txq_id);
 
-                        ssn = trans_pcie->txq[txq_id].q.read_ptr;
+                        ssn = txq->q.read_ptr;
                 }
         }
 
         /* Place first TFD at index corresponding to start sequence number.
          * Assumes that ssn_idx is valid (!= 0xFFF) */
-        trans_pcie->txq[txq_id].q.read_ptr = (ssn & 0xff);
-        trans_pcie->txq[txq_id].q.write_ptr = (ssn & 0xff);
+        txq->q.read_ptr = (ssn & 0xff);
+        txq->q.write_ptr = (ssn & 0xff);
+        iwl_write_direct32(trans, HBUS_TARG_WRPTR,
+                           (ssn & 0xff) | (txq_id << 8));
 
         if (cfg) {
                 u8 frame_limit = cfg->frame_limit;
 
-                iwl_write_direct32(trans, HBUS_TARG_WRPTR,
-                                   (ssn & 0xff) | (txq_id << 8));
                 iwl_write_prph(trans, SCD_QUEUE_RDPTR(txq_id), ssn);
 
                 /* Set up Tx window size and frame limit for this queue */
@@ -1200,11 +1227,17 @@ void iwl_trans_pcie_txq_enable(struct iwl_trans *trans, int txq_id, u16 ssn,
                 if (txq_id == trans_pcie->cmd_queue &&
                     trans_pcie->scd_set_active)
                         iwl_scd_enable_set_active(trans, BIT(txq_id));
+
+                IWL_DEBUG_TX_QUEUES(trans,
+                                    "Activate queue %d on FIFO %d WrPtr: %d\n",
+                                    txq_id, fifo, ssn & 0xff);
+        } else {
+                IWL_DEBUG_TX_QUEUES(trans,
+                                    "Activate queue %d WrPtr: %d\n",
+                                    txq_id, ssn & 0xff);
         }
 
-        trans_pcie->txq[txq_id].active = true;
-        IWL_DEBUG_TX_QUEUES(trans, "Activate queue %d on FIFO %d WrPtr: %d\n",
-                            txq_id, fifo, ssn & 0xff);
+        txq->active = true;
 }
 
 void iwl_trans_pcie_txq_disable(struct iwl_trans *trans, int txq_id,
@@ -1469,11 +1502,11 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
         trace_iwlwifi_dev_hcmd(trans->dev, cmd, cmd_size, &out_cmd->hdr);
 
         /* start timer if queue currently empty */
-        if (q->read_ptr == q->write_ptr && trans_pcie->wd_timeout)
-                mod_timer(&txq->stuck_timer, jiffies + trans_pcie->wd_timeout);
+        if (q->read_ptr == q->write_ptr && txq->wd_timeout)
+                mod_timer(&txq->stuck_timer, jiffies + txq->wd_timeout);
 
         spin_lock_irqsave(&trans_pcie->reg_lock, flags);
-        ret = iwl_pcie_set_cmd_in_flight(trans);
+        ret = iwl_pcie_set_cmd_in_flight(trans, cmd);
         if (ret < 0) {
                 idx = ret;
                 spin_unlock_irqrestore(&trans_pcie->reg_lock, flags);
@@ -1819,9 +1852,12 @@ int iwl_trans_pcie_tx(struct iwl_trans *trans, struct sk_buff *skb,
         wait_write_ptr = ieee80211_has_morefrags(fc);
 
         /* start timer if queue currently empty */
-        if (txq->need_update && q->read_ptr == q->write_ptr &&
-            trans_pcie->wd_timeout)
-                mod_timer(&txq->stuck_timer, jiffies + trans_pcie->wd_timeout);
+        if (q->read_ptr == q->write_ptr) {
+                if (txq->wd_timeout)
+                        mod_timer(&txq->stuck_timer, jiffies + txq->wd_timeout);
+                IWL_DEBUG_RPM(trans, "Q: %d first tx - take ref\n", q->id);
+                iwl_trans_pcie_ref(trans);
+        }
 
         /* Tell device the write index *just past* this latest filled TFD */
         q->write_ptr = iwl_queue_inc_wrap(q->write_ptr);
diff --git a/drivers/net/wireless/libertas/cfg.c b/drivers/net/wireless/libertas/cfg.c
index 34f09ef90bb3..a92985a6ea21 100644
--- a/drivers/net/wireless/libertas/cfg.c
+++ b/drivers/net/wireless/libertas/cfg.c
@@ -1616,10 +1616,10 @@ static int lbs_cfg_get_station(struct wiphy *wiphy, struct net_device *dev,
 
         lbs_deb_enter(LBS_DEB_CFG80211);
 
-        sinfo->filled |= STATION_INFO_TX_BYTES |
-                         STATION_INFO_TX_PACKETS |
-                         STATION_INFO_RX_BYTES |
-                         STATION_INFO_RX_PACKETS;
+        sinfo->filled |= BIT(NL80211_STA_INFO_TX_BYTES) |
+                         BIT(NL80211_STA_INFO_TX_PACKETS) |
+                         BIT(NL80211_STA_INFO_RX_BYTES) |
+                         BIT(NL80211_STA_INFO_RX_PACKETS);
         sinfo->tx_bytes = priv->dev->stats.tx_bytes;
         sinfo->tx_packets = priv->dev->stats.tx_packets;
         sinfo->rx_bytes = priv->dev->stats.rx_bytes;
@@ -1629,14 +1629,14 @@ static int lbs_cfg_get_station(struct wiphy *wiphy, struct net_device *dev,
         ret = lbs_get_rssi(priv, &signal, &noise);
         if (ret == 0) {
                 sinfo->signal = signal;
-                sinfo->filled |= STATION_INFO_SIGNAL;
+                sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
         }
 
         /* Convert priv->cur_rate from hw_value to NL80211 value */
         for (i = 0; i < ARRAY_SIZE(lbs_rates); i++) {
                 if (priv->cur_rate == lbs_rates[i].hw_value) {
                         sinfo->txrate.legacy = lbs_rates[i].bitrate;
-                        sinfo->filled |= STATION_INFO_TX_BITRATE;
+                        sinfo->filled |= BIT(NL80211_STA_INFO_TX_BITRATE);
                         break;
                 }
         }
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index ef58a8862d91..4a4c6586a8d2 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -625,22 +625,22 @@ static int hwsim_fops_ps_write(void *dat, u64 val)
         old_ps = data->ps;
         data->ps = val;
 
+        local_bh_disable();
         if (val == PS_MANUAL_POLL) {
-                ieee80211_iterate_active_interfaces(data->hw,
-                                                    IEEE80211_IFACE_ITER_NORMAL,
-                                                    hwsim_send_ps_poll, data);
+                ieee80211_iterate_active_interfaces_atomic(
+                        data->hw, IEEE80211_IFACE_ITER_NORMAL,
+                        hwsim_send_ps_poll, data);
                 data->ps_poll_pending = true;
         } else if (old_ps == PS_DISABLED && val != PS_DISABLED) {
-                ieee80211_iterate_active_interfaces(data->hw,
-                                                    IEEE80211_IFACE_ITER_NORMAL,
-                                                    hwsim_send_nullfunc_ps,
-                                                    data);
+                ieee80211_iterate_active_interfaces_atomic(
+                        data->hw, IEEE80211_IFACE_ITER_NORMAL,
+                        hwsim_send_nullfunc_ps, data);
         } else if (old_ps != PS_DISABLED && val == PS_DISABLED) {
-                ieee80211_iterate_active_interfaces(data->hw,
-                                                    IEEE80211_IFACE_ITER_NORMAL,
-                                                    hwsim_send_nullfunc_no_ps,
-                                                    data);
+                ieee80211_iterate_active_interfaces_atomic(
+                        data->hw, IEEE80211_IFACE_ITER_NORMAL,
+                        hwsim_send_nullfunc_no_ps, data);
         }
+        local_bh_enable();
 
         return 0;
 }
@@ -2149,14 +2149,14 @@ static int append_radio_msg(struct sk_buff *skb, int id,
         if (param->regd) {
                 int i;
 
-                for (i = 0; hwsim_world_regdom_custom[i] != param->regd &&
-                     i < ARRAY_SIZE(hwsim_world_regdom_custom); i++)
-                        ;
+                for (i = 0; i < ARRAY_SIZE(hwsim_world_regdom_custom); i++) {
+                        if (hwsim_world_regdom_custom[i] != param->regd)
+                                continue;
 
-                if (i < ARRAY_SIZE(hwsim_world_regdom_custom)) {
                         ret = nla_put_u32(skb, HWSIM_ATTR_REG_CUSTOM_REG, i);
                         if (ret < 0)
                                 return ret;
+                        break;
                 }
         }
 
@@ -2557,7 +2557,8 @@ static int mac80211_hwsim_get_radio(struct sk_buff *skb,
         if (res < 0)
                 goto out_err;
 
-        return genlmsg_end(skb, hdr);
+        genlmsg_end(skb, hdr);
+        return 0;
 
 out_err:
         genlmsg_cancel(skb, hdr);
diff --git a/drivers/net/wireless/mwifiex/11h.c b/drivers/net/wireless/mwifiex/11h.c
index 2668e83afbb6..3ab87a855122 100644
--- a/drivers/net/wireless/mwifiex/11h.c
+++ b/drivers/net/wireless/mwifiex/11h.c
@@ -21,6 +21,16 @@
 #include "fw.h"
 
 
+void mwifiex_init_11h_params(struct mwifiex_private *priv)
+{
+        priv->state_11h.is_11h_enabled = true;
+        priv->state_11h.is_11h_active = false;
+}
+
+inline int mwifiex_is_11h_active(struct mwifiex_private *priv)
+{
+        return priv->state_11h.is_11h_active;
+}
 /* This function appends 11h info to a buffer while joining an
  * infrastructure BSS
  */
@@ -39,7 +49,7 @@ mwifiex_11h_process_infra_join(struct mwifiex_private *priv, u8 **buffer,
                 return;
 
         radio_type = mwifiex_band_to_radio_type((u8) bss_desc->bss_band);
-        sband = priv->wdev->wiphy->bands[radio_type];
+        sband = priv->wdev.wiphy->bands[radio_type];
 
         cap = (struct mwifiex_ie_types_pwr_capability *)*buffer;
         cap->header.type = cpu_to_le16(WLAN_EID_PWR_CAPABILITY);
@@ -69,10 +79,14 @@ mwifiex_11h_process_infra_join(struct mwifiex_private *priv, u8 **buffer,
 }
 
 /* Enable or disable the 11h extensions in the firmware */
-static int mwifiex_11h_activate(struct mwifiex_private *priv, bool flag)
+int mwifiex_11h_activate(struct mwifiex_private *priv, bool flag)
 {
         u32 enable = flag;
 
+        /* enable master mode radar detection on AP interface */
+        if ((GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_UAP) && enable)
+                enable |= MWIFIEX_MASTER_RADAR_DET_MASK;
+
         return mwifiex_send_cmd(priv, HostCmd_CMD_802_11_SNMP_MIB,
                                 HostCmd_ACT_GEN_SET, DOT11H_I, &enable, true);
 }
@@ -91,11 +105,191 @@ void mwifiex_11h_process_join(struct mwifiex_private *priv, u8 **buffer,
                  * bit
                  */
                 mwifiex_11h_activate(priv, true);
+                priv->state_11h.is_11h_active = true;
                 bss_desc->cap_info_bitmap |= WLAN_CAPABILITY_SPECTRUM_MGMT;
                 mwifiex_11h_process_infra_join(priv, buffer, bss_desc);
         } else {
                 /* Deactivate 11h functions in the firmware */
                 mwifiex_11h_activate(priv, false);
+                priv->state_11h.is_11h_active = false;
                 bss_desc->cap_info_bitmap &= ~WLAN_CAPABILITY_SPECTRUM_MGMT;
         }
 }
+
+/* This is DFS CAC work queue function.
+ * This delayed work emits CAC finished event for cfg80211 if
+ * CAC was started earlier.
+ */
+void mwifiex_dfs_cac_work_queue(struct work_struct *work)
+{
+        struct cfg80211_chan_def chandef;
+        struct delayed_work *delayed_work =
+                        container_of(work, struct delayed_work, work);
+        struct mwifiex_private *priv =
+                        container_of(delayed_work, struct mwifiex_private,
+                                     dfs_cac_work);
+
+        if (WARN_ON(!priv))
+                return;
+
+        chandef = priv->dfs_chandef;
+        if (priv->wdev.cac_started) {
+                dev_dbg(priv->adapter->dev,
+                        "CAC timer finished; No radar detected\n");
+                cfg80211_cac_event(priv->netdev, &chandef,
+                                   NL80211_RADAR_CAC_FINISHED,
+                                   GFP_KERNEL);
+        }
+}
+
+/* This function prepares channel report request command to FW for
+ * starting radar detection.
+ */
+int mwifiex_cmd_issue_chan_report_request(struct mwifiex_private *priv,
+                                          struct host_cmd_ds_command *cmd,
+                                          void *data_buf)
+{
+        struct host_cmd_ds_chan_rpt_req *cr_req = &cmd->params.chan_rpt_req;
+        struct mwifiex_radar_params *radar_params = (void *)data_buf;
+
+        cmd->command = cpu_to_le16(HostCmd_CMD_CHAN_REPORT_REQUEST);
+        cmd->size = cpu_to_le16(S_DS_GEN);
+        le16_add_cpu(&cmd->size, sizeof(struct host_cmd_ds_chan_rpt_req));
+
+        cr_req->chan_desc.start_freq = cpu_to_le16(MWIFIEX_A_BAND_START_FREQ);
+        cr_req->chan_desc.chan_num = radar_params->chandef->chan->hw_value;
+        cr_req->chan_desc.chan_width = radar_params->chandef->width;
+        cr_req->msec_dwell_time = cpu_to_le32(radar_params->cac_time_ms);
+
+        dev_dbg(priv->adapter->dev,
+                "11h: issuing DFS Radar check for channel=%d\n",
+                radar_params->chandef->chan->hw_value);
+
+        return 0;
+}
+
+/* This function is to abort ongoing CAC upon stopping AP operations
+ * or during unload.
+ */
+void mwifiex_abort_cac(struct mwifiex_private *priv)
+{
+        if (priv->wdev.cac_started) {
+                dev_dbg(priv->adapter->dev,
+                        "Aborting delayed work for CAC.\n");
+                cancel_delayed_work_sync(&priv->dfs_cac_work);
+                cfg80211_cac_event(priv->netdev, &priv->dfs_chandef,
+                                   NL80211_RADAR_CAC_ABORTED, GFP_KERNEL);
+        }
+}
+
+/* This function handles channel report event from FW during CAC period.
+ * If radar is detected during CAC, driver indicates the same to cfg80211
+ * and also cancels ongoing delayed work.
+ */
+int mwifiex_11h_handle_chanrpt_ready(struct mwifiex_private *priv,
+                                     struct sk_buff *skb)
+{
+        struct host_cmd_ds_chan_rpt_event *rpt_event;
+        struct mwifiex_ie_types_chan_rpt_data *rpt;
+        u8 *evt_buf;
+        u16 event_len, tlv_len;
+
+        rpt_event = (void *)(skb->data + sizeof(u32));
+        event_len = skb->len - (sizeof(struct host_cmd_ds_chan_rpt_event)+
+                                sizeof(u32));
+
+        if (le32_to_cpu(rpt_event->result) != HostCmd_RESULT_OK) {
+                dev_err(priv->adapter->dev, "Error in channel report event\n");
+                return -1;
+        }
+
+        evt_buf = (void *)&rpt_event->tlvbuf;
+
+        while (event_len >= sizeof(struct mwifiex_ie_types_header)) {
+                rpt = (void *)&rpt_event->tlvbuf;
+                tlv_len = le16_to_cpu(rpt->header.len);
+
+                switch (le16_to_cpu(rpt->header.type)) {
+                case TLV_TYPE_CHANRPT_11H_BASIC:
+                        if (rpt->map.radar) {
+                                dev_notice(priv->adapter->dev,
+                                           "RADAR Detected on channel %d!\n",
+                                            priv->dfs_chandef.chan->hw_value);
+                                cancel_delayed_work_sync(&priv->dfs_cac_work);
+                                cfg80211_cac_event(priv->netdev,
+                                                   &priv->dfs_chandef,
+                                                   NL80211_RADAR_DETECTED,
+                                                   GFP_KERNEL);
+                        }
+                        break;
+                default:
+                        break;
+                }
+
+                evt_buf += (tlv_len + sizeof(rpt->header));
+                event_len -= (tlv_len + sizeof(rpt->header));
+        }
+
+        return 0;
+}
+
+/* Handler for radar detected event from FW.*/
+int mwifiex_11h_handle_radar_detected(struct mwifiex_private *priv,
+                                      struct sk_buff *skb)
+{
+        struct mwifiex_radar_det_event *rdr_event;
+
+        rdr_event = (void *)(skb->data + sizeof(u32));
+
+        if (le32_to_cpu(rdr_event->passed)) {
+                dev_notice(priv->adapter->dev,
+                           "radar detected; indicating kernel\n");
+                cfg80211_radar_event(priv->adapter->wiphy, &priv->dfs_chandef,
+                                     GFP_KERNEL);
+                dev_dbg(priv->adapter->dev, "regdomain: %d\n",
+                        rdr_event->reg_domain);
+                dev_dbg(priv->adapter->dev, "radar detection type: %d\n",
+                        rdr_event->det_type);
+        } else {
+                dev_dbg(priv->adapter->dev, "false radar detection event!\n");
+        }
+
+        return 0;
+}
+
+/* This is work queue function for channel switch handling.
+ * This function takes care of updating new channel definitin to
+ * bss config structure, restart AP and indicate channel switch success
+ * to cfg80211.
+ */
+void mwifiex_dfs_chan_sw_work_queue(struct work_struct *work)
+{
+        struct mwifiex_uap_bss_param *bss_cfg;
+        struct delayed_work *delayed_work =
+                        container_of(work, struct delayed_work, work);
+        struct mwifiex_private *priv =
+                        container_of(delayed_work, struct mwifiex_private,
+                                     dfs_chan_sw_work);
+
+        if (WARN_ON(!priv))
+                return;
+
+        bss_cfg = &priv->bss_cfg;
+        if (!bss_cfg->beacon_period) {
+                dev_err(priv->adapter->dev,
+                        "channel switch: AP already stopped\n");
+                return;
+        }
+
+        mwifiex_uap_set_channel(bss_cfg, priv->dfs_chandef);
+
+        if (mwifiex_config_start_uap(priv, bss_cfg)) {
+                dev_dbg(priv->adapter->dev,
+                        "Failed to start AP after channel switch\n");
+                return;
+        }
+
+        dev_notice(priv->adapter->dev,
+                   "indicating channel switch completion to kernel\n");
+        cfg80211_ch_switch_notify(priv->netdev, &priv->dfs_chandef);
+}
diff --git a/drivers/net/wireless/mwifiex/11n.c b/drivers/net/wireless/mwifiex/11n.c
index 9d4786e7ddff..543148d27b01 100644
--- a/drivers/net/wireless/mwifiex/11n.c
+++ b/drivers/net/wireless/mwifiex/11n.c
@@ -39,7 +39,7 @@ int mwifiex_fill_cap_info(struct mwifiex_private *priv, u8 radio_type,
 {
         uint16_t ht_ext_cap = le16_to_cpu(ht_cap->extended_ht_cap_info);
         struct ieee80211_supported_band *sband =
-                                        priv->wdev->wiphy->bands[radio_type];
+                                        priv->wdev.wiphy->bands[radio_type];
 
         if (WARN_ON_ONCE(!sband)) {
                 dev_err(priv->adapter->dev, "Invalid radio type!\n");
@@ -314,7 +314,7 @@ mwifiex_cmd_append_11n_tlv(struct mwifiex_private *priv,
                 return ret_len;
 
         radio_type = mwifiex_band_to_radio_type((u8) bss_desc->bss_band);
-        sband = priv->wdev->wiphy->bands[radio_type];
+        sband = priv->wdev.wiphy->bands[radio_type];
 
         if (bss_desc->bcn_ht_cap) {
                 ht_cap = (struct mwifiex_ie_types_htcap *) *buffer;
@@ -558,10 +558,10 @@ int mwifiex_send_addba(struct mwifiex_private *priv, int tid, u8 *peer_mac)
                 spin_lock_irqsave(&priv->sta_list_spinlock, flags);
                 sta_ptr = mwifiex_get_sta_entry(priv, peer_mac);
                 if (!sta_ptr) {
+                        spin_unlock_irqrestore(&priv->sta_list_spinlock, flags);
                         dev_warn(priv->adapter->dev,
                                  "BA setup with unknown TDLS peer %pM!\n",
                                 peer_mac);
-                        spin_unlock_irqrestore(&priv->sta_list_spinlock, flags);
                         return -1;
                 }
                 if (sta_ptr->is_11ac_enabled)
diff --git a/drivers/net/wireless/mwifiex/11n.h b/drivers/net/wireless/mwifiex/11n.h
index f275675cdbd3..8e2e39422ad8 100644
--- a/drivers/net/wireless/mwifiex/11n.h
+++ b/drivers/net/wireless/mwifiex/11n.h
@@ -130,7 +130,9 @@ static inline u8 mwifiex_space_avail_for_new_ba_stream(
 {
         struct mwifiex_private *priv;
         u8 i;
-        u32 ba_stream_num = 0;
+        u32 ba_stream_num = 0, ba_stream_max;
+
+        ba_stream_max = MWIFIEX_MAX_TX_BASTREAM_SUPPORTED;
 
         for (i = 0; i < adapter->priv_num; i++) {
                 priv = adapter->priv[i];
@@ -139,8 +141,14 @@ static inline u8 mwifiex_space_avail_for_new_ba_stream(
                                 &priv->tx_ba_stream_tbl_ptr);
         }
 
-        return ((ba_stream_num <
-                 MWIFIEX_MAX_TX_BASTREAM_SUPPORTED) ? true : false);
+        if (adapter->fw_api_ver == MWIFIEX_FW_V15) {
+                ba_stream_max =
+                               GETSUPP_TXBASTREAMS(adapter->hw_dot_11n_dev_cap);
+                if (!ba_stream_max)
+                        ba_stream_max = MWIFIEX_MAX_TX_BASTREAM_SUPPORTED;
+        }
+
+        return ((ba_stream_num < ba_stream_max) ? true : false);
 }
 
 /*
diff --git a/drivers/net/wireless/mwifiex/11n_aggr.c b/drivers/net/wireless/mwifiex/11n_aggr.c
index 8720a3d3c755..9b983b5cebbd 100644
--- a/drivers/net/wireless/mwifiex/11n_aggr.c
+++ b/drivers/net/wireless/mwifiex/11n_aggr.c
@@ -101,6 +101,13 @@ mwifiex_11n_form_amsdu_txpd(struct mwifiex_private *priv,
 {
         struct txpd *local_tx_pd;
         struct mwifiex_txinfo *tx_info = MWIFIEX_SKB_TXCB(skb);
+        unsigned int pad;
+        int headroom = (priv->adapter->iface_type ==
+                        MWIFIEX_USB) ? 0 : INTF_HEADER_LEN;
+
+        pad = ((void *)skb->data - sizeof(*local_tx_pd) -
+                headroom - NULL) & (MWIFIEX_DMA_ALIGN_SZ - 1);
+        skb_push(skb, pad);
 
         skb_push(skb, sizeof(*local_tx_pd));
 
@@ -114,10 +121,12 @@ mwifiex_11n_form_amsdu_txpd(struct mwifiex_private *priv,
         local_tx_pd->bss_num = priv->bss_num;
         local_tx_pd->bss_type = priv->bss_type;
         /* Always zero as the data is followed by struct txpd */
-        local_tx_pd->tx_pkt_offset = cpu_to_le16(sizeof(struct txpd));
+        local_tx_pd->tx_pkt_offset = cpu_to_le16(sizeof(struct txpd) +
+                                                 pad);
         local_tx_pd->tx_pkt_type = cpu_to_le16(PKT_TYPE_AMSDU);
         local_tx_pd->tx_pkt_length = cpu_to_le16(skb->len -
-                                                 sizeof(*local_tx_pd));
+                                                 sizeof(*local_tx_pd) -
+                                                 pad);
 
         if (tx_info->flags & MWIFIEX_BUF_FLAG_TDLS_PKT)
                 local_tx_pd->flags |= MWIFIEX_TXPD_FLAGS_TDLS_PACKET;
@@ -182,7 +191,7 @@ mwifiex_11n_aggregate_pkt(struct mwifiex_private *priv,
                                        ra_list_flags);
                 return -1;
         }
-        skb_reserve(skb_aggr, headroom + sizeof(struct txpd));
+        skb_reserve(skb_aggr, MWIFIEX_MIN_DATA_HEADER_LEN);
         tx_info_aggr =  MWIFIEX_SKB_TXCB(skb_aggr);
 
         memset(tx_info_aggr, 0, sizeof(*tx_info_aggr));
diff --git a/drivers/net/wireless/mwifiex/11n_rxreorder.c b/drivers/net/wireless/mwifiex/11n_rxreorder.c
index d73fda312c87..a2e8817b56d8 100644
--- a/drivers/net/wireless/mwifiex/11n_rxreorder.c
+++ b/drivers/net/wireless/mwifiex/11n_rxreorder.c
@@ -45,7 +45,7 @@ static int mwifiex_11n_dispatch_amsdu_pkt(struct mwifiex_private *priv,
                 skb_trim(skb, le16_to_cpu(local_rx_pd->rx_pkt_length));
 
                 ieee80211_amsdu_to_8023s(skb, &list, priv->curr_addr,
-                                         priv->wdev->iftype, 0, false);
+                                         priv->wdev.iftype, 0, false);
 
                 while (!skb_queue_empty(&list)) {
                         rx_skb = __skb_dequeue(&list);
@@ -353,9 +353,6 @@ mwifiex_11n_create_rx_reorder_tbl(struct mwifiex_private *priv, u8 *ta,
 
         spin_lock_irqsave(&priv->sta_list_spinlock, flags);
         if (mwifiex_queuing_ra_based(priv)) {
-                dev_dbg(priv->adapter->dev,
-                        "info: AP/ADHOC:last_seq=%d start_win=%d\n",
-                        last_seq, new_node->start_win);
                 if (priv->bss_role == MWIFIEX_BSS_ROLE_UAP) {
                         node = mwifiex_get_sta_entry(priv, ta);
                         if (node)
@@ -370,6 +367,9 @@ mwifiex_11n_create_rx_reorder_tbl(struct mwifiex_private *priv, u8 *ta,
         }
         spin_unlock_irqrestore(&priv->sta_list_spinlock, flags);
 
+        dev_dbg(priv->adapter->dev, "info: last_seq=%d start_win=%d\n",
+                last_seq, new_node->start_win);
+
         if (last_seq != MWIFIEX_DEF_11N_RX_SEQ_NUM &&
             last_seq >= new_node->start_win) {
                 new_node->start_win = last_seq + 1;
@@ -391,10 +391,8 @@ mwifiex_11n_create_rx_reorder_tbl(struct mwifiex_private *priv, u8 *ta,
         new_node->timer_context.priv = priv;
         new_node->timer_context.timer_is_set = false;
 
-        init_timer(&new_node->timer_context.timer);
-        new_node->timer_context.timer.function = mwifiex_flush_data;
-        new_node->timer_context.timer.data =
-                        (unsigned long) &new_node->timer_context;
+        setup_timer(&new_node->timer_context.timer, mwifiex_flush_data,
+                    (unsigned long)&new_node->timer_context);
 
         for (i = 0; i < win_size; ++i)
                 new_node->rx_reorder_ptr[i] = NULL;
@@ -468,10 +466,10 @@ int mwifiex_cmd_11n_addba_rsp_gen(struct mwifiex_private *priv,
                 sta_ptr = mwifiex_get_sta_entry(priv,
                                                 cmd_addba_req->peer_mac_addr);
                 if (!sta_ptr) {
+                        spin_unlock_irqrestore(&priv->sta_list_spinlock, flags);
                         dev_warn(priv->adapter->dev,
                                  "BA setup with unknown TDLS peer %pM!\n",
                                  cmd_addba_req->peer_mac_addr);
-                        spin_unlock_irqrestore(&priv->sta_list_spinlock, flags);
                         return -1;
                 }
                 if (sta_ptr->is_11ac_enabled)
diff --git a/drivers/net/wireless/mwifiex/Makefile b/drivers/net/wireless/mwifiex/Makefile
index 9487d728ac20..fdfd9bf15ed4 100644
--- a/drivers/net/wireless/mwifiex/Makefile
+++ b/drivers/net/wireless/mwifiex/Makefile
@@ -53,3 +53,5 @@ obj-$(CONFIG_MWIFIEX_PCIE) += mwifiex_pcie.o
 
 mwifiex_usb-y += usb.o
 obj-$(CONFIG_MWIFIEX_USB) += mwifiex_usb.o
+
+ccflags-y += -D__CHECK_ENDIAN
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index 4a66a6555366..41c8e25df954 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -590,77 +590,62 @@ mwifiex_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
         struct mwifiex_adapter *adapter = mwifiex_cfg80211_get_adapter(wiphy);
         struct mwifiex_private *priv;
         struct mwifiex_uap_bss_param *bss_cfg;
-        int ret, bss_started, i;
-
-        for (i = 0; i < adapter->priv_num; i++) {
-                priv = adapter->priv[i];
-
-                switch (priv->bss_role) {
-                case MWIFIEX_BSS_ROLE_UAP:
-                        bss_cfg = kzalloc(sizeof(struct mwifiex_uap_bss_param),
-                                          GFP_KERNEL);
-                        if (!bss_cfg)
-                                return -ENOMEM;
-
-                        mwifiex_set_sys_config_invalid_data(bss_cfg);
-
-                        if (changed & WIPHY_PARAM_RTS_THRESHOLD)
-                                bss_cfg->rts_threshold = wiphy->rts_threshold;
-                        if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
-                                bss_cfg->frag_threshold = wiphy->frag_threshold;
-                        if (changed & WIPHY_PARAM_RETRY_LONG)
-                                bss_cfg->retry_limit = wiphy->retry_long;
-
-                        bss_started = priv->bss_started;
-
-                        ret = mwifiex_send_cmd(priv, HostCmd_CMD_UAP_BSS_STOP,
-                                               HostCmd_ACT_GEN_SET, 0,
-                                               NULL, true);
-                        if (ret) {
-                                wiphy_err(wiphy, "Failed to stop the BSS\n");
-                                kfree(bss_cfg);
-                                return ret;
-                        }
+        int ret;
 
-                        ret = mwifiex_send_cmd(priv, HostCmd_CMD_UAP_SYS_CONFIG,
-                                               HostCmd_ACT_GEN_SET,
-                                               UAP_BSS_PARAMS_I, bss_cfg,
-                                               false);
+        priv = mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_ANY);
 
-                        kfree(bss_cfg);
+        switch (priv->bss_role) {
+        case MWIFIEX_BSS_ROLE_UAP:
+                if (priv->bss_started) {
+                        dev_err(adapter->dev,
+                                "cannot change wiphy params when bss started");
+                        return -EINVAL;
+                }
 
-                        if (ret) {
-                                wiphy_err(wiphy, "Failed to set bss config\n");
-                                return ret;
-                        }
+                bss_cfg = kzalloc(sizeof(*bss_cfg), GFP_KERNEL);
+                if (!bss_cfg)
+                        return -ENOMEM;
 
-                        if (!bss_started)
-                                break;
+                mwifiex_set_sys_config_invalid_data(bss_cfg);
 
-                        ret = mwifiex_send_cmd(priv, HostCmd_CMD_UAP_BSS_START,
-                                               HostCmd_ACT_GEN_SET, 0,
-                                               NULL, false);
-                        if (ret) {
-                                wiphy_err(wiphy, "Failed to start BSS\n");
-                                return ret;
-                        }
+                if (changed & WIPHY_PARAM_RTS_THRESHOLD)
+                        bss_cfg->rts_threshold = wiphy->rts_threshold;
+                if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
+                        bss_cfg->frag_threshold = wiphy->frag_threshold;
+                if (changed & WIPHY_PARAM_RETRY_LONG)
+                        bss_cfg->retry_limit = wiphy->retry_long;
+
+                ret = mwifiex_send_cmd(priv, HostCmd_CMD_UAP_SYS_CONFIG,
+                                       HostCmd_ACT_GEN_SET,
+                                       UAP_BSS_PARAMS_I, bss_cfg,
+                                       false);
+
+                kfree(bss_cfg);
+                if (ret) {
+                        wiphy_err(wiphy, "Failed to set wiphy phy params\n");
+                        return ret;
+                }
+                break;
 
-                        break;
                 case MWIFIEX_BSS_ROLE_STA:
-                        if (changed & WIPHY_PARAM_RTS_THRESHOLD) {
-                                ret = mwifiex_set_rts(priv,
-                                                      wiphy->rts_threshold);
-                                if (ret)
-                                        return ret;
-                        }
-                        if (changed & WIPHY_PARAM_FRAG_THRESHOLD) {
-                                ret = mwifiex_set_frag(priv,
-                                                       wiphy->frag_threshold);
-                                if (ret)
-                                        return ret;
-                        }
-                        break;
+                if (priv->media_connected) {
+                        dev_err(adapter->dev,
+                                "cannot change wiphy params when connected");
+                        return -EINVAL;
                 }
+                if (changed & WIPHY_PARAM_RTS_THRESHOLD) {
+                        ret = mwifiex_set_rts(priv,
+                                              wiphy->rts_threshold);
+                        if (ret)
+                                return ret;
+                }
+                if (changed & WIPHY_PARAM_FRAG_THRESHOLD) {
+                        ret = mwifiex_set_frag(priv,
+                                               wiphy->frag_threshold);
+                        if (ret)
+                                return ret;
+                }
+                break;
         }
 
         return 0;
@@ -671,9 +656,6 @@ mwifiex_cfg80211_deinit_p2p(struct mwifiex_private *priv)
 {
         u16 mode = P2P_MODE_DISABLE;
 
-        if (GET_BSS_ROLE(priv) != MWIFIEX_BSS_ROLE_STA)
-                mwifiex_set_bss_role(priv, MWIFIEX_BSS_ROLE_STA);
-
         if (mwifiex_send_cmd(priv, HostCmd_CMD_P2P_MODE_CFG,
                              HostCmd_ACT_GEN_SET, 0, &mode, true))
                 return -1;
@@ -730,12 +712,249 @@ mwifiex_cfg80211_init_p2p_go(struct mwifiex_private *priv)
                              HostCmd_ACT_GEN_SET, 0, &mode, true))
                 return -1;
 
-        if (GET_BSS_ROLE(priv) != MWIFIEX_BSS_ROLE_UAP)
-                mwifiex_set_bss_role(priv, MWIFIEX_BSS_ROLE_UAP);
+        return 0;
+}
+
+static int mwifiex_deinit_priv_params(struct mwifiex_private *priv)
+{
+        priv->mgmt_frame_mask = 0;
+        if (mwifiex_send_cmd(priv, HostCmd_CMD_MGMT_FRAME_REG,
+                             HostCmd_ACT_GEN_SET, 0,
+                             &priv->mgmt_frame_mask, false)) {
+                dev_warn(priv->adapter->dev,
+                         "could not unregister mgmt frame rx\n");
+                return -1;
+        }
+
+        mwifiex_deauthenticate(priv, NULL);
+        mwifiex_free_priv(priv);
+        priv->wdev.iftype = NL80211_IFTYPE_UNSPECIFIED;
+        priv->bss_mode = NL80211_IFTYPE_UNSPECIFIED;
+        priv->sec_info.authentication_mode = NL80211_AUTHTYPE_OPEN_SYSTEM;
+
+        return 0;
+}
+
+static int
+mwifiex_init_new_priv_params(struct mwifiex_private *priv,
+                             struct net_device *dev,
+                             enum nl80211_iftype type)
+{
+        mwifiex_init_priv(priv);
+
+        priv->bss_mode = type;
+        priv->wdev.iftype = type;
+
+        mwifiex_init_priv_params(priv, priv->netdev);
+        priv->bss_started = 0;
+
+        switch (type) {
+        case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_ADHOC:
+                priv->bss_role =  MWIFIEX_BSS_ROLE_STA;
+                priv->bss_type = MWIFIEX_BSS_TYPE_STA;
+                break;
+        case NL80211_IFTYPE_P2P_CLIENT:
+        case NL80211_IFTYPE_P2P_GO:
+                priv->bss_role =  MWIFIEX_BSS_ROLE_STA;
+                priv->bss_type = MWIFIEX_BSS_TYPE_P2P;
+                break;
+        case NL80211_IFTYPE_AP:
+                priv->bss_type = MWIFIEX_BSS_TYPE_UAP;
+                priv->bss_role = MWIFIEX_BSS_ROLE_UAP;
+                break;
+        default:
+                dev_err(priv->adapter->dev,
+                        "%s: changing to %d not supported\n",
+                        dev->name, type);
+                return -EOPNOTSUPP;
+        }
 
         return 0;
 }
 
+static int
+mwifiex_change_vif_to_p2p(struct net_device *dev,
+                          enum nl80211_iftype curr_iftype,
+                          enum nl80211_iftype type, u32 *flags,
+                          struct vif_params *params)
+{
+        struct mwifiex_private *priv;
+        struct mwifiex_adapter *adapter;
+
+        priv = mwifiex_netdev_get_priv(dev);
+
+        if (!priv)
+                return -1;
+
+        adapter = priv->adapter;
+
+        if (adapter->curr_iface_comb.p2p_intf ==
+            adapter->iface_limit.p2p_intf) {
+                dev_err(adapter->dev,
+                        "cannot create multiple P2P ifaces\n");
+                return -1;
+        }
+
+        dev_dbg(priv->adapter->dev, "%s: changing role to p2p\n", dev->name);
+
+        if (mwifiex_deinit_priv_params(priv))
+                return -1;
+        if (mwifiex_init_new_priv_params(priv, dev, type))
+                return -1;
+
+        switch (type) {
+        case NL80211_IFTYPE_P2P_CLIENT:
+                if (mwifiex_cfg80211_init_p2p_client(priv))
+                        return -EFAULT;
+                break;
+        case NL80211_IFTYPE_P2P_GO:
+                if (mwifiex_cfg80211_init_p2p_go(priv))
+                        return -EFAULT;
+                break;
+        default:
+                dev_err(priv->adapter->dev,
+                        "%s: changing to %d not supported\n",
+                        dev->name, type);
+                return -EOPNOTSUPP;
+        }
+
+        if (mwifiex_send_cmd(priv, HostCmd_CMD_SET_BSS_MODE,
+                             HostCmd_ACT_GEN_SET, 0, NULL, true))
+                return -1;
+
+        if (mwifiex_sta_init_cmd(priv, false, false))
+                return -1;
+
+        switch (curr_iftype) {
+        case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_ADHOC:
+                adapter->curr_iface_comb.sta_intf--;
+                break;
+        case NL80211_IFTYPE_AP:
+                adapter->curr_iface_comb.uap_intf--;
+                break;
+        default:
+                break;
+        }
+
+        adapter->curr_iface_comb.p2p_intf++;
+        dev->ieee80211_ptr->iftype = type;
+
+        return 0;
+}
+
+static int
+mwifiex_change_vif_to_sta_adhoc(struct net_device *dev,
+                                enum nl80211_iftype curr_iftype,
+                                enum nl80211_iftype type, u32 *flags,
+                                struct vif_params *params)
+{
+        struct mwifiex_private *priv;
+        struct mwifiex_adapter *adapter;
+
+        priv = mwifiex_netdev_get_priv(dev);
+
+        if (!priv)
+                return -1;
+
+        adapter = priv->adapter;
+
+        if ((curr_iftype != NL80211_IFTYPE_P2P_CLIENT &&
+             curr_iftype != NL80211_IFTYPE_P2P_GO) &&
+            (adapter->curr_iface_comb.sta_intf ==
+             adapter->iface_limit.sta_intf)) {
+                dev_err(adapter->dev,
+                        "cannot create multiple station/adhoc ifaces\n");
+                return -1;
+        }
+
+        if (type == NL80211_IFTYPE_STATION)
+                dev_notice(adapter->dev,
+                           "%s: changing role to station\n", dev->name);
+        else
+                dev_notice(adapter->dev,
+                           "%s: changing role to adhoc\n", dev->name);
+
+        if (mwifiex_deinit_priv_params(priv))
+                return -1;
+        if (mwifiex_init_new_priv_params(priv, dev, type))
+                return -1;
+        if (mwifiex_send_cmd(priv, HostCmd_CMD_SET_BSS_MODE,
+                             HostCmd_ACT_GEN_SET, 0, NULL, true))
+                return -1;
+        if (mwifiex_sta_init_cmd(priv, false, false))
+                return -1;
+
+        switch (curr_iftype) {
+        case NL80211_IFTYPE_P2P_CLIENT:
+        case NL80211_IFTYPE_P2P_GO:
+                adapter->curr_iface_comb.p2p_intf--;
+                break;
+        case NL80211_IFTYPE_AP:
+                adapter->curr_iface_comb.uap_intf--;
+                break;
+        default:
+                break;
+        }
+
+        adapter->curr_iface_comb.sta_intf++;
+        dev->ieee80211_ptr->iftype = type;
+        return 0;
+}
+
+static int
+mwifiex_change_vif_to_ap(struct net_device *dev,
+                         enum nl80211_iftype curr_iftype,
+                         enum nl80211_iftype type, u32 *flags,
+                         struct vif_params *params)
+{
+        struct mwifiex_private *priv;
+        struct mwifiex_adapter *adapter;
+
+        priv = mwifiex_netdev_get_priv(dev);
+
+        if (!priv)
+                return -1;
+
+        adapter = priv->adapter;
+
+        if (adapter->curr_iface_comb.uap_intf ==
+            adapter->iface_limit.uap_intf) {
+                dev_err(adapter->dev,
+                        "cannot create multiple AP ifaces\n");
+                return -1;
+        }
+
+        dev_notice(adapter->dev, "%s: changing role to AP\n", dev->name);
+
+        if (mwifiex_deinit_priv_params(priv))
+                return -1;
+        if (mwifiex_init_new_priv_params(priv, dev, type))
+                return -1;
+        if (mwifiex_send_cmd(priv, HostCmd_CMD_SET_BSS_MODE,
+                             HostCmd_ACT_GEN_SET, 0, NULL, true))
+                return -1;
+        if (mwifiex_sta_init_cmd(priv, false, false))
+                return -1;
+
+        switch (curr_iftype) {
+        case NL80211_IFTYPE_P2P_CLIENT:
+        case NL80211_IFTYPE_P2P_GO:
+                adapter->curr_iface_comb.p2p_intf--;
+                break;
+        case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_ADHOC:
+                adapter->curr_iface_comb.sta_intf--;
+                break;
+        default:
+                break;
+        }
+
+        adapter->curr_iface_comb.uap_intf++;
+        dev->ieee80211_ptr->iftype = type;
+        return 0;
+}
 /*
  * CFG802.11 operation handler to change interface type.
  */
@@ -745,19 +964,32 @@ mwifiex_cfg80211_change_virtual_intf(struct wiphy *wiphy,
                                      enum nl80211_iftype type, u32 *flags,
                                      struct vif_params *params)
 {
-        int ret;
         struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
+        enum nl80211_iftype curr_iftype = dev->ieee80211_ptr->iftype;
 
-        switch (dev->ieee80211_ptr->iftype) {
+        switch (curr_iftype) {
         case NL80211_IFTYPE_ADHOC:
                 switch (type) {
                 case NL80211_IFTYPE_STATION:
-                        break;
+                        priv->bss_mode = type;
+                        priv->sec_info.authentication_mode =
+                                                   NL80211_AUTHTYPE_OPEN_SYSTEM;
+                        dev->ieee80211_ptr->iftype = type;
+                        mwifiex_deauthenticate(priv, NULL);
+                        return mwifiex_send_cmd(priv, HostCmd_CMD_SET_BSS_MODE,
+                                                HostCmd_ACT_GEN_SET, 0, NULL,
+                                                true);
+                case NL80211_IFTYPE_P2P_CLIENT:
+                case NL80211_IFTYPE_P2P_GO:
+                        return mwifiex_change_vif_to_p2p(dev, curr_iftype,
+                                                         type, flags, params);
+                case NL80211_IFTYPE_AP:
+                        return mwifiex_change_vif_to_ap(dev, curr_iftype, type,
+                                                        flags, params);
                 case NL80211_IFTYPE_UNSPECIFIED:
                         wiphy_warn(wiphy, "%s: kept type as IBSS\n", dev->name);
                 case NL80211_IFTYPE_ADHOC:      /* This shouldn't happen */
                         return 0;
-                case NL80211_IFTYPE_AP:
                 default:
                         wiphy_err(wiphy, "%s: changing to %d not supported\n",
                                   dev->name, type);
@@ -767,22 +999,25 @@ mwifiex_cfg80211_change_virtual_intf(struct wiphy *wiphy,
         case NL80211_IFTYPE_STATION:
                 switch (type) {
                 case NL80211_IFTYPE_ADHOC:
-                        break;
-                case NL80211_IFTYPE_P2P_CLIENT:
-                        if (mwifiex_cfg80211_init_p2p_client(priv))
-                                return -EFAULT;
+                        priv->bss_mode = type;
+                        priv->sec_info.authentication_mode =
+                                                   NL80211_AUTHTYPE_OPEN_SYSTEM;
                         dev->ieee80211_ptr->iftype = type;
-                        return 0;
+                        mwifiex_deauthenticate(priv, NULL);
+                        return mwifiex_send_cmd(priv, HostCmd_CMD_SET_BSS_MODE,
+                                                HostCmd_ACT_GEN_SET, 0, NULL,
+                                                true);
+                case NL80211_IFTYPE_P2P_CLIENT:
                 case NL80211_IFTYPE_P2P_GO:
-                        if (mwifiex_cfg80211_init_p2p_go(priv))
-                                return -EFAULT;
-                        dev->ieee80211_ptr->iftype = type;
-                        return 0;
+                        return mwifiex_change_vif_to_p2p(dev, curr_iftype,
+                                                         type, flags, params);
+                case NL80211_IFTYPE_AP:
+                        return mwifiex_change_vif_to_ap(dev, curr_iftype, type,
+                                                        flags, params);
                 case NL80211_IFTYPE_UNSPECIFIED:
                         wiphy_warn(wiphy, "%s: kept type as STA\n", dev->name);
                 case NL80211_IFTYPE_STATION:    /* This shouldn't happen */
                         return 0;
-                case NL80211_IFTYPE_AP:
                 default:
                         wiphy_err(wiphy, "%s: changing to %d not supported\n",
                                   dev->name, type);
@@ -791,12 +1026,20 @@ mwifiex_cfg80211_change_virtual_intf(struct wiphy *wiphy,
                 break;
         case NL80211_IFTYPE_AP:
                 switch (type) {
+                case NL80211_IFTYPE_ADHOC:
+                case NL80211_IFTYPE_STATION:
+                        return mwifiex_change_vif_to_sta_adhoc(dev, curr_iftype,
+                                                               type, flags,
+                                                               params);
+                        break;
+                case NL80211_IFTYPE_P2P_CLIENT:
+                case NL80211_IFTYPE_P2P_GO:
+                        return mwifiex_change_vif_to_p2p(dev, curr_iftype,
+                                                         type, flags, params);
                 case NL80211_IFTYPE_UNSPECIFIED:
                         wiphy_warn(wiphy, "%s: kept type as AP\n", dev->name);
                 case NL80211_IFTYPE_AP:         /* This shouldn't happen */
                         return 0;
-                case NL80211_IFTYPE_ADHOC:
-                case NL80211_IFTYPE_STATION:
                 default:
                         wiphy_err(wiphy, "%s: changing to %d not supported\n",
                                   dev->name, type);
@@ -807,11 +1050,30 @@ mwifiex_cfg80211_change_virtual_intf(struct wiphy *wiphy,
         case NL80211_IFTYPE_P2P_GO:
                 switch (type) {
                 case NL80211_IFTYPE_STATION:
-                        if (mwifiex_cfg80211_deinit_p2p(priv))
+                        if (mwifiex_cfg80211_init_p2p_client(priv))
                                 return -EFAULT;
                         dev->ieee80211_ptr->iftype = type;
+                        break;
+                case NL80211_IFTYPE_ADHOC:
+                        if (mwifiex_cfg80211_deinit_p2p(priv))
+                                return -EFAULT;
+                        return mwifiex_change_vif_to_sta_adhoc(dev, curr_iftype,
+                                                               type, flags,
+                                                               params);
+                        break;
+                case NL80211_IFTYPE_AP:
+                        if (mwifiex_cfg80211_deinit_p2p(priv))
+                                return -EFAULT;
+                        return mwifiex_change_vif_to_ap(dev, curr_iftype, type,
+                                                        flags, params);
+                case NL80211_IFTYPE_UNSPECIFIED:
+                        wiphy_warn(wiphy, "%s: kept type as P2P\n", dev->name);
+                case NL80211_IFTYPE_P2P_CLIENT:
+                case NL80211_IFTYPE_P2P_GO:
                         return 0;
                 default:
+                        wiphy_err(wiphy, "%s: changing to %d not supported\n",
+                                  dev->name, type);
                         return -EOPNOTSUPP;
                 }
                 break;
@@ -821,16 +1083,8 @@ mwifiex_cfg80211_change_virtual_intf(struct wiphy *wiphy,
                 return -EOPNOTSUPP;
         }
 
-        dev->ieee80211_ptr->iftype = type;
-        priv->bss_mode = type;
-        mwifiex_deauthenticate(priv, NULL);
-
-        priv->sec_info.authentication_mode = NL80211_AUTHTYPE_OPEN_SYSTEM;
-
-        ret = mwifiex_send_cmd(priv, HostCmd_CMD_SET_BSS_MODE,
-                               HostCmd_ACT_GEN_SET, 0, NULL, true);
 
-        return ret;
+        return 0;
 }
 
 static void
@@ -856,16 +1110,16 @@ mwifiex_parse_htinfo(struct mwifiex_private *priv, u8 tx_htinfo,
                         /* HT or VHT */
                         switch (tx_htinfo & (BIT(3) | BIT(2))) {
                         case 0:
-                                /* This will be 20MHz */
+                                rate->bw = RATE_INFO_BW_20;
                                 break;
                         case (BIT(2)):
-                                rate->flags |= RATE_INFO_FLAGS_40_MHZ_WIDTH;
+                                rate->bw = RATE_INFO_BW_40;
                                 break;
                         case (BIT(3)):
-                                rate->flags |= RATE_INFO_FLAGS_80_MHZ_WIDTH;
+                                rate->bw = RATE_INFO_BW_80;
                                 break;
                         case (BIT(3) | BIT(2)):
-                                rate->flags |= RATE_INFO_FLAGS_160_MHZ_WIDTH;
+                                rate->bw = RATE_INFO_BW_160;
                                 break;
                         }
 
@@ -885,8 +1139,9 @@ mwifiex_parse_htinfo(struct mwifiex_private *priv, u8 tx_htinfo,
                 if ((tx_htinfo & BIT(0)) && (priv->tx_rate < 16)) {
                         rate->mcs = priv->tx_rate;
                         rate->flags |= RATE_INFO_FLAGS_MCS;
+                        rate->bw = RATE_INFO_BW_20;
                         if (tx_htinfo & BIT(1))
-                                rate->flags |= RATE_INFO_FLAGS_40_MHZ_WIDTH;
+                                rate->bw = RATE_INFO_BW_40;
                         if (tx_htinfo & BIT(2))
                                 rate->flags |= RATE_INFO_FLAGS_SHORT_GI;
                 }
@@ -910,10 +1165,10 @@ mwifiex_dump_station_info(struct mwifiex_private *priv,
 {
         u32 rate;
 
-        sinfo->filled = STATION_INFO_RX_BYTES | STATION_INFO_TX_BYTES |
-                        STATION_INFO_RX_PACKETS | STATION_INFO_TX_PACKETS |
-                        STATION_INFO_TX_BITRATE |
-                        STATION_INFO_SIGNAL | STATION_INFO_SIGNAL_AVG;
+        sinfo->filled = BIT(NL80211_STA_INFO_RX_BYTES) | BIT(NL80211_STA_INFO_TX_BYTES) |
+                        BIT(NL80211_STA_INFO_RX_PACKETS) | BIT(NL80211_STA_INFO_TX_PACKETS) |
+                        BIT(NL80211_STA_INFO_TX_BITRATE) |
+                        BIT(NL80211_STA_INFO_SIGNAL) | BIT(NL80211_STA_INFO_SIGNAL_AVG);
 
         /* Get signal information from the firmware */
         if (mwifiex_send_cmd(priv, HostCmd_CMD_RSSI_INFO,
@@ -944,7 +1199,7 @@ mwifiex_dump_station_info(struct mwifiex_private *priv,
         sinfo->txrate.legacy = rate * 5;
 
         if (priv->bss_mode == NL80211_IFTYPE_STATION) {
-                sinfo->filled |= STATION_INFO_BSS_PARAM;
+                sinfo->filled |= BIT(NL80211_STA_INFO_BSS_PARAM);
                 sinfo->bss_param.flags = 0;
                 if (priv->curr_bss_params.bss_descriptor.cap_info_bitmap &
                                                 WLAN_CAPABILITY_SHORT_PREAMBLE)
@@ -1037,10 +1292,11 @@ mwifiex_cfg80211_dump_survey(struct wiphy *wiphy, struct net_device *dev,
         survey->channel = ieee80211_get_channel(wiphy,
             ieee80211_channel_to_frequency(pchan_stats[idx].chan_num, band));
         survey->filled = SURVEY_INFO_NOISE_DBM |
-                SURVEY_INFO_CHANNEL_TIME | SURVEY_INFO_CHANNEL_TIME_BUSY;
+                         SURVEY_INFO_TIME |
+                         SURVEY_INFO_TIME_BUSY;
         survey->noise = pchan_stats[idx].noise;
-        survey->channel_time = pchan_stats[idx].cca_scan_dur;
-        survey->channel_time_busy = pchan_stats[idx].cca_busy_dur;
+        survey->time = pchan_stats[idx].cca_scan_dur;
+        survey->time_busy = pchan_stats[idx].cca_busy_dur;
 
         return 0;
 }
@@ -1395,10 +1651,13 @@ static int mwifiex_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
 {
         struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
 
+        mwifiex_abort_cac(priv);
+
         if (mwifiex_del_mgmt_ies(priv))
                 wiphy_err(wiphy, "Failed to delete mgmt IEs!\n");
 
         priv->ap_11n_enabled = 0;
+        memset(&priv->bss_cfg, 0, sizeof(priv->bss_cfg));
 
         if (mwifiex_send_cmd(priv, HostCmd_CMD_UAP_BSS_STOP,
                              HostCmd_ACT_GEN_SET, 0, NULL, true)) {
@@ -1420,12 +1679,9 @@ static int mwifiex_cfg80211_start_ap(struct wiphy *wiphy,
 {
         struct mwifiex_uap_bss_param *bss_cfg;
         struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
-        u8 config_bands = 0;
 
         if (GET_BSS_ROLE(priv) != MWIFIEX_BSS_ROLE_UAP)
                 return -1;
-        if (mwifiex_set_mgmt_ies(priv, &params->beacon))
-                return -1;
 
         bss_cfg = kzalloc(sizeof(struct mwifiex_uap_bss_param), GFP_KERNEL);
         if (!bss_cfg)
@@ -1442,6 +1698,11 @@ static int mwifiex_cfg80211_start_ap(struct wiphy *wiphy,
                 memcpy(bss_cfg->ssid.ssid, params->ssid, params->ssid_len);
                 bss_cfg->ssid.ssid_len = params->ssid_len;
         }
+        if (params->inactivity_timeout > 0) {
+                /* sta_ao_timer/ps_sta_ao_timer is in unit of 100ms */
+                bss_cfg->sta_ao_timer = 10 * params->inactivity_timeout;
+                bss_cfg->ps_sta_ao_timer = 10 * params->inactivity_timeout;
+        }
 
         switch (params->hidden_ssid) {
         case NL80211_HIDDEN_SSID_NOT_IN_USE:
@@ -1457,33 +1718,8 @@ static int mwifiex_cfg80211_start_ap(struct wiphy *wiphy,
                 return -EINVAL;
         }
 
-        bss_cfg->channel = ieee80211_frequency_to_channel(
-                                params->chandef.chan->center_freq);
-
-        /* Set appropriate bands */
-        if (params->chandef.chan->band == IEEE80211_BAND_2GHZ) {
-                bss_cfg->band_cfg = BAND_CONFIG_BG;
-                config_bands = BAND_B | BAND_G;
-
-                if (params->chandef.width > NL80211_CHAN_WIDTH_20_NOHT)
-                        config_bands |= BAND_GN;
-        } else {
-                bss_cfg->band_cfg = BAND_CONFIG_A;
-                config_bands = BAND_A;
-
-                if (params->chandef.width > NL80211_CHAN_WIDTH_20_NOHT)
-                        config_bands |= BAND_AN;
-
-                if (params->chandef.width > NL80211_CHAN_WIDTH_40)
-                        config_bands |= BAND_AAC;
-        }
-
-        if (!((config_bands | priv->adapter->fw_bands) &
-              ~priv->adapter->fw_bands))
-                priv->adapter->config_bands = config_bands;
-
+        mwifiex_uap_set_channel(bss_cfg, params->chandef);
         mwifiex_set_uap_rates(bss_cfg, params);
-        mwifiex_send_domain_info_cmd_fw(wiphy);
 
         if (mwifiex_set_secure_params(priv, bss_cfg, params)) {
                 kfree(bss_cfg);
@@ -1506,45 +1742,29 @@ static int mwifiex_cfg80211_start_ap(struct wiphy *wiphy,
 
         mwifiex_set_wmm_params(priv, bss_cfg, params);
 
-        if (params->inactivity_timeout > 0) {
-                /* sta_ao_timer/ps_sta_ao_timer is in unit of 100ms */
-                bss_cfg->sta_ao_timer = 10 * params->inactivity_timeout;
-                bss_cfg->ps_sta_ao_timer = 10 * params->inactivity_timeout;
+        if (mwifiex_is_11h_active(priv) &&
+            !cfg80211_chandef_dfs_required(wiphy, &params->chandef,
+                                           priv->bss_mode)) {
+                dev_dbg(priv->adapter->dev, "Disable 11h extensions in FW\n");
+                if (mwifiex_11h_activate(priv, false)) {
+                        dev_err(priv->adapter->dev,
+                                "Failed to disable 11h extensions!!");
+                        return -1;
+                }
+                priv->state_11h.is_11h_active = true;
         }
 
-        if (mwifiex_send_cmd(priv, HostCmd_CMD_UAP_BSS_STOP,
-                             HostCmd_ACT_GEN_SET, 0, NULL, true)) {
-                wiphy_err(wiphy, "Failed to stop the BSS\n");
+        if (mwifiex_config_start_uap(priv, bss_cfg)) {
+                wiphy_err(wiphy, "Failed to start AP\n");
                 kfree(bss_cfg);
                 return -1;
         }
 
-        if (mwifiex_send_cmd(priv, HostCmd_CMD_UAP_SYS_CONFIG,
-                             HostCmd_ACT_GEN_SET,
-                             UAP_BSS_PARAMS_I, bss_cfg, false)) {
-                wiphy_err(wiphy, "Failed to set the SSID\n");
-                kfree(bss_cfg);
+        if (mwifiex_set_mgmt_ies(priv, &params->beacon))
                 return -1;
-        }
 
+        memcpy(&priv->bss_cfg, bss_cfg, sizeof(priv->bss_cfg));
         kfree(bss_cfg);
-
-        if (mwifiex_send_cmd(priv, HostCmd_CMD_UAP_BSS_START,
-                             HostCmd_ACT_GEN_SET, 0, NULL, false)) {
-                wiphy_err(wiphy, "Failed to start the BSS\n");
-                return -1;
-        }
-
-        if (priv->sec_info.wep_enabled)
-                priv->curr_pkt_filter |= HostCmd_ACT_MAC_WEP_ENABLE;
-        else
-                priv->curr_pkt_filter &= ~HostCmd_ACT_MAC_WEP_ENABLE;
-
-        if (mwifiex_send_cmd(priv, HostCmd_CMD_MAC_CONTROL,
-                             HostCmd_ACT_GEN_SET, 0,
-                             &priv->curr_pkt_filter, true))
-                return -1;
-
         return 0;
 }
 
@@ -1603,15 +1823,15 @@ static int mwifiex_cfg80211_inform_ibss_bss(struct mwifiex_private *priv)
         ie_len = ie_buf[1] + sizeof(struct ieee_types_header);
 
         band = mwifiex_band_to_radio_type(priv->curr_bss_params.band);
-        chan = __ieee80211_get_channel(priv->wdev->wiphy,
+        chan = __ieee80211_get_channel(priv->wdev.wiphy,
                         ieee80211_channel_to_frequency(bss_info.bss_chan,
                                                        band));
 
-        bss = cfg80211_inform_bss(priv->wdev->wiphy, chan,
+        bss = cfg80211_inform_bss(priv->wdev.wiphy, chan,
                                   CFG80211_BSS_FTYPE_UNKNOWN,
                                   bss_info.bssid, 0, WLAN_CAPABILITY_IBSS,
                                   0, ie_buf, ie_len, 0, GFP_KERNEL);
-        cfg80211_put_bss(priv->wdev->wiphy, bss);
+        cfg80211_put_bss(priv->wdev.wiphy, bss);
         memcpy(priv->cfg_bssid, bss_info.bssid, ETH_ALEN);
 
         return 0;
@@ -1732,12 +1952,12 @@ done:
 
                 /* Find the BSS we want using available scan results */
                 if (mode == NL80211_IFTYPE_ADHOC)
-                        bss = cfg80211_get_bss(priv->wdev->wiphy, channel,
+                        bss = cfg80211_get_bss(priv->wdev.wiphy, channel,
                                                bssid, ssid, ssid_len,
                                                WLAN_CAPABILITY_IBSS,
                                                WLAN_CAPABILITY_IBSS);
                 else
-                        bss = cfg80211_get_bss(priv->wdev->wiphy, channel,
+                        bss = cfg80211_get_bss(priv->wdev.wiphy, channel,
                                                bssid, ssid, ssid_len,
                                                WLAN_CAPABILITY_ESS,
                                                WLAN_CAPABILITY_ESS);
@@ -1784,6 +2004,7 @@ mwifiex_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
                          struct cfg80211_connect_params *sme)
 {
         struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
+        struct mwifiex_adapter *adapter = priv->adapter;
         int ret;
 
         if (GET_BSS_ROLE(priv) != MWIFIEX_BSS_ROLE_STA) {
@@ -1793,11 +2014,18 @@ mwifiex_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
                 return -EINVAL;
         }
 
-        if (priv->wdev && priv->wdev->current_bss) {
+        if (priv->wdev.current_bss) {
                 wiphy_warn(wiphy, "%s: already connected\n", dev->name);
                 return -EALREADY;
         }
 
+        if (adapter->surprise_removed || adapter->is_cmd_timedout) {
+                wiphy_err(wiphy,
+                          "%s: Ignore connection. Card removed or FW in bad state\n",
+                          dev->name);
+                return -EFAULT;
+        }
+
         wiphy_dbg(wiphy, "info: Trying to associate to %s and bssid %pM\n",
                   (char *) sme->ssid, sme->bssid);
 
@@ -1844,7 +2072,7 @@ mwifiex_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
 static int mwifiex_set_ibss_params(struct mwifiex_private *priv,
                                    struct cfg80211_ibss_params *params)
 {
-        struct wiphy *wiphy = priv->wdev->wiphy;
+        struct wiphy *wiphy = priv->wdev.wiphy;
         struct mwifiex_adapter *adapter = priv->adapter;
         int index = 0, i;
         u8 config_bands = 0;
@@ -2169,6 +2397,7 @@ mwifiex_setup_ht_caps(struct ieee80211_sta_ht_cap *ht_info,
         ht_info->mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
 }
 
+#define MWIFIEX_MAX_WQ_LEN  30
 /*
  *  create a new virtual interface with the given name
  */
@@ -2182,7 +2411,7 @@ struct wireless_dev *mwifiex_add_virtual_intf(struct wiphy *wiphy,
         struct mwifiex_private *priv;
         struct net_device *dev;
         void *mdev_priv;
-        struct wireless_dev *wdev;
+        char dfs_cac_str[MWIFIEX_MAX_WQ_LEN], dfs_chsw_str[MWIFIEX_MAX_WQ_LEN];
 
         if (!adapter)
                 return ERR_PTR(-EFAULT);
@@ -2191,20 +2420,22 @@ struct wireless_dev *mwifiex_add_virtual_intf(struct wiphy *wiphy,
         case NL80211_IFTYPE_UNSPECIFIED:
         case NL80211_IFTYPE_STATION:
         case NL80211_IFTYPE_ADHOC:
-                priv = adapter->priv[MWIFIEX_BSS_TYPE_STA];
-                if (priv->bss_mode) {
+                if (adapter->curr_iface_comb.sta_intf ==
+                    adapter->iface_limit.sta_intf) {
                         wiphy_err(wiphy,
                                   "cannot create multiple sta/adhoc ifaces\n");
                         return ERR_PTR(-EINVAL);
                 }
 
-                wdev = kzalloc(sizeof(struct wireless_dev), GFP_KERNEL);
-                if (!wdev)
-                        return ERR_PTR(-ENOMEM);
+                priv = mwifiex_get_unused_priv(adapter);
+                if (!priv) {
+                        wiphy_err(wiphy,
+                                  "could not get free private struct\n");
+                        return ERR_PTR(-EFAULT);
+                }
 
-                wdev->wiphy = wiphy;
-                priv->wdev = wdev;
-                wdev->iftype = NL80211_IFTYPE_STATION;
+                priv->wdev.wiphy = wiphy;
+                priv->wdev.iftype = NL80211_IFTYPE_STATION;
 
                 if (type == NL80211_IFTYPE_UNSPECIFIED)
                         priv->bss_mode = NL80211_IFTYPE_STATION;
@@ -2219,20 +2450,22 @@ struct wireless_dev *mwifiex_add_virtual_intf(struct wiphy *wiphy,
 
                 break;
         case NL80211_IFTYPE_AP:
-                priv = adapter->priv[MWIFIEX_BSS_TYPE_UAP];
-
-                if (priv->bss_mode) {
-                        wiphy_err(wiphy, "Can't create multiple AP interfaces");
+                if (adapter->curr_iface_comb.uap_intf ==
+                    adapter->iface_limit.uap_intf) {
+                        wiphy_err(wiphy,
+                                  "cannot create multiple AP ifaces\n");
                         return ERR_PTR(-EINVAL);
                 }
 
-                wdev = kzalloc(sizeof(struct wireless_dev), GFP_KERNEL);
-                if (!wdev)
-                        return ERR_PTR(-ENOMEM);
+                priv = mwifiex_get_unused_priv(adapter);
+                if (!priv) {
+                        wiphy_err(wiphy,
+                                  "could not get free private struct\n");
+                        return ERR_PTR(-EFAULT);
+                }
 
-                priv->wdev = wdev;
-                wdev->wiphy = wiphy;
-                wdev->iftype = NL80211_IFTYPE_AP;
+                priv->wdev.wiphy = wiphy;
+                priv->wdev.iftype = NL80211_IFTYPE_AP;
 
                 priv->bss_type = MWIFIEX_BSS_TYPE_UAP;
                 priv->frame_type = MWIFIEX_DATA_FRAME_TYPE_ETH_II;
@@ -2244,24 +2477,25 @@ struct wireless_dev *mwifiex_add_virtual_intf(struct wiphy *wiphy,
 
                 break;
         case NL80211_IFTYPE_P2P_CLIENT:
-                priv = adapter->priv[MWIFIEX_BSS_TYPE_P2P];
-
-                if (priv->bss_mode) {
-                        wiphy_err(wiphy, "Can't create multiple P2P ifaces");
+                if (adapter->curr_iface_comb.p2p_intf ==
+                    adapter->iface_limit.p2p_intf) {
+                        wiphy_err(wiphy,
+                                  "cannot create multiple P2P ifaces\n");
                         return ERR_PTR(-EINVAL);
                 }
 
-                wdev = kzalloc(sizeof(struct wireless_dev), GFP_KERNEL);
-                if (!wdev)
-                        return ERR_PTR(-ENOMEM);
-
-                priv->wdev = wdev;
-                wdev->wiphy = wiphy;
+                priv = mwifiex_get_unused_priv(adapter);
+                if (!priv) {
+                        wiphy_err(wiphy,
+                                  "could not get free private struct\n");
+                        return ERR_PTR(-EFAULT);
+                }
 
+                priv->wdev.wiphy = wiphy;
                 /* At start-up, wpa_supplicant tries to change the interface
                  * to NL80211_IFTYPE_STATION if it is not managed mode.
                  */
-                wdev->iftype = NL80211_IFTYPE_P2P_CLIENT;
+                priv->wdev.iftype = NL80211_IFTYPE_P2P_CLIENT;
                 priv->bss_mode = NL80211_IFTYPE_P2P_CLIENT;
 
                 /* Setting bss_type to P2P tells firmware that this interface
@@ -2277,8 +2511,9 @@ struct wireless_dev *mwifiex_add_virtual_intf(struct wiphy *wiphy,
                 priv->bss_num = 0;
 
                 if (mwifiex_cfg80211_init_p2p_client(priv)) {
-                        wdev = ERR_PTR(-EFAULT);
-                        goto done;
+                        memset(&priv->wdev, 0, sizeof(priv->wdev));
+                        priv->wdev.iftype = NL80211_IFTYPE_UNSPECIFIED;
+                        return ERR_PTR(-EFAULT);
                 }
 
                 break;
@@ -2292,9 +2527,10 @@ struct wireless_dev *mwifiex_add_virtual_intf(struct wiphy *wiphy,
                                IEEE80211_NUM_ACS, 1);
         if (!dev) {
                 wiphy_err(wiphy, "no memory available for netdevice\n");
+                memset(&priv->wdev, 0, sizeof(priv->wdev));
+                priv->wdev.iftype = NL80211_IFTYPE_UNSPECIFIED;
                 priv->bss_mode = NL80211_IFTYPE_UNSPECIFIED;
-                wdev = ERR_PTR(-ENOMEM);
-                goto done;
+                return ERR_PTR(-ENOMEM);
         }
 
         mwifiex_init_priv_params(priv, dev);
@@ -2314,7 +2550,7 @@ struct wireless_dev *mwifiex_add_virtual_intf(struct wiphy *wiphy,
                         &wiphy->bands[IEEE80211_BAND_5GHZ]->vht_cap, priv);
 
         dev_net_set(dev, wiphy_net(wiphy));
-        dev->ieee80211_ptr = priv->wdev;
+        dev->ieee80211_ptr = &priv->wdev;
         dev->ieee80211_ptr->iftype = priv->bss_mode;
         memcpy(dev->dev_addr, wiphy->perm_addr, ETH_ALEN);
         SET_NETDEV_DEV(dev, wiphy_dev(wiphy));
@@ -2335,10 +2571,47 @@ struct wireless_dev *mwifiex_add_virtual_intf(struct wiphy *wiphy,
                 free_netdev(dev);
                 priv->bss_mode = NL80211_IFTYPE_UNSPECIFIED;
                 priv->netdev = NULL;
-                wdev = ERR_PTR(-EFAULT);
-                goto done;
+                memset(&priv->wdev, 0, sizeof(priv->wdev));
+                priv->wdev.iftype = NL80211_IFTYPE_UNSPECIFIED;
+                return ERR_PTR(-EFAULT);
+        }
+
+        strcpy(dfs_cac_str, "MWIFIEX_DFS_CAC");
+        strcat(dfs_cac_str, name);
+        priv->dfs_cac_workqueue = alloc_workqueue(dfs_cac_str,
+                                                  WQ_HIGHPRI |
+                                                  WQ_MEM_RECLAIM |
+                                                  WQ_UNBOUND, 1);
+        if (!priv->dfs_cac_workqueue) {
+                wiphy_err(wiphy, "cannot register virtual network device\n");
+                free_netdev(dev);
+                priv->bss_mode = NL80211_IFTYPE_UNSPECIFIED;
+                priv->netdev = NULL;
+                memset(&priv->wdev, 0, sizeof(priv->wdev));
+                priv->wdev.iftype = NL80211_IFTYPE_UNSPECIFIED;
+                return ERR_PTR(-ENOMEM);
         }
 
+        INIT_DELAYED_WORK(&priv->dfs_cac_work, mwifiex_dfs_cac_work_queue);
+
+        strcpy(dfs_chsw_str, "MWIFIEX_DFS_CHSW");
+        strcat(dfs_chsw_str, name);
+        priv->dfs_chan_sw_workqueue = alloc_workqueue(dfs_chsw_str,
+                                                      WQ_HIGHPRI | WQ_UNBOUND |
+                                                      WQ_MEM_RECLAIM, 1);
+        if (!priv->dfs_chan_sw_workqueue) {
+                wiphy_err(wiphy, "cannot register virtual network device\n");
+                free_netdev(dev);
+                priv->bss_mode = NL80211_IFTYPE_UNSPECIFIED;
+                priv->netdev = NULL;
+                memset(&priv->wdev, 0, sizeof(priv->wdev));
+                priv->wdev.iftype = NL80211_IFTYPE_UNSPECIFIED;
+                return ERR_PTR(-ENOMEM);
+        }
+
+        INIT_DELAYED_WORK(&priv->dfs_chan_sw_work,
+                          mwifiex_dfs_chan_sw_work_queue);
+
         sema_init(&priv->async_sem, 1);
 
         dev_dbg(adapter->dev, "info: %s: Marvell 802.11 Adapter\n", dev->name);
@@ -2347,13 +2620,24 @@ struct wireless_dev *mwifiex_add_virtual_intf(struct wiphy *wiphy,
         mwifiex_dev_debugfs_init(priv);
 #endif
 
-done:
-        if (IS_ERR(wdev)) {
-                kfree(priv->wdev);
-                priv->wdev = NULL;
+        switch (type) {
+        case NL80211_IFTYPE_UNSPECIFIED:
+        case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_ADHOC:
+                adapter->curr_iface_comb.sta_intf++;
+                break;
+        case NL80211_IFTYPE_AP:
+                adapter->curr_iface_comb.uap_intf++;
+                break;
+        case NL80211_IFTYPE_P2P_CLIENT:
+                adapter->curr_iface_comb.p2p_intf++;
+                break;
+        default:
+                wiphy_err(wiphy, "type not supported\n");
+                return ERR_PTR(-EINVAL);
         }
 
-        return wdev;
+        return &priv->wdev;
 }
 EXPORT_SYMBOL_GPL(mwifiex_add_virtual_intf);
 
@@ -2363,12 +2647,13 @@ EXPORT_SYMBOL_GPL(mwifiex_add_virtual_intf);
 int mwifiex_del_virtual_intf(struct wiphy *wiphy, struct wireless_dev *wdev)
 {
         struct mwifiex_private *priv = mwifiex_netdev_get_priv(wdev->netdev);
+        struct mwifiex_adapter *adapter = priv->adapter;
 
 #ifdef CONFIG_DEBUG_FS
         mwifiex_dev_debugfs_remove(priv);
 #endif
 
-        mwifiex_stop_net_dev_queue(priv->netdev, priv->adapter);
+        mwifiex_stop_net_dev_queue(priv->netdev, adapter);
 
         if (netif_carrier_ok(priv->netdev))
                 netif_carrier_off(priv->netdev);
@@ -2376,16 +2661,48 @@ int mwifiex_del_virtual_intf(struct wiphy *wiphy, struct wireless_dev *wdev)
         if (wdev->netdev->reg_state == NETREG_REGISTERED)
                 unregister_netdevice(wdev->netdev);
 
+        if (priv->dfs_cac_workqueue) {
+                flush_workqueue(priv->dfs_cac_workqueue);
+                destroy_workqueue(priv->dfs_cac_workqueue);
+                priv->dfs_cac_workqueue = NULL;
+        }
+
+        if (priv->dfs_chan_sw_workqueue) {
+                flush_workqueue(priv->dfs_chan_sw_workqueue);
+                destroy_workqueue(priv->dfs_chan_sw_workqueue);
+                priv->dfs_chan_sw_workqueue = NULL;
+        }
         /* Clear the priv in adapter */
         priv->netdev->ieee80211_ptr = NULL;
         priv->netdev = NULL;
-        kfree(wdev);
-        priv->wdev = NULL;
+        priv->wdev.iftype = NL80211_IFTYPE_UNSPECIFIED;
 
         priv->media_connected = false;
 
+        switch (priv->bss_mode) {
+        case NL80211_IFTYPE_UNSPECIFIED:
+        case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_ADHOC:
+                adapter->curr_iface_comb.sta_intf++;
+                break;
+        case NL80211_IFTYPE_AP:
+                adapter->curr_iface_comb.uap_intf++;
+                break;
+        case NL80211_IFTYPE_P2P_CLIENT:
+        case NL80211_IFTYPE_P2P_GO:
+                adapter->curr_iface_comb.p2p_intf++;
+                break;
+        default:
+                dev_err(adapter->dev, "del_virtual_intf: type not supported\n");
+                break;
+        }
+
         priv->bss_mode = NL80211_IFTYPE_UNSPECIFIED;
 
+        if (GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_STA ||
+            GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_UAP)
+                kfree(priv->hist_data);
+
         return 0;
 }
 EXPORT_SYMBOL_GPL(mwifiex_del_virtual_intf);
@@ -2421,30 +2738,16 @@ mwifiex_is_pattern_supported(struct cfg80211_pkt_pattern *pat, s8 *byte_seq,
 }
 
 #ifdef CONFIG_PM
-static int mwifiex_cfg80211_suspend(struct wiphy *wiphy,
-                                    struct cfg80211_wowlan *wowlan)
+static int mwifiex_set_mef_filter(struct mwifiex_private *priv,
+                                  struct cfg80211_wowlan *wowlan)
 {
-        struct mwifiex_adapter *adapter = mwifiex_cfg80211_get_adapter(wiphy);
-        struct mwifiex_ds_mef_cfg mef_cfg;
-        struct mwifiex_mef_entry *mef_entry;
-        int i, filt_num = 0, ret;
+        int i, filt_num = 0, ret = 0;
         bool first_pat = true;
         u8 byte_seq[MWIFIEX_MEF_MAX_BYTESEQ + 1];
         const u8 ipv4_mc_mac[] = {0x33, 0x33};
         const u8 ipv6_mc_mac[] = {0x01, 0x00, 0x5e};
-        struct mwifiex_private *priv =
-                        mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_STA);
-
-        if (!wowlan) {
-                dev_warn(adapter->dev, "None of the WOWLAN triggers enabled\n");
-                return 0;
-        }
-
-        if (!priv->media_connected) {
-                dev_warn(adapter->dev,
-                         "Can not configure WOWLAN in disconnected state\n");
-                return 0;
-        }
+        struct mwifiex_ds_mef_cfg mef_cfg;
+        struct mwifiex_mef_entry *mef_entry;
 
         mef_entry = kzalloc(sizeof(*mef_entry), GFP_KERNEL);
         if (!mef_entry)
@@ -2459,9 +2762,9 @@ static int mwifiex_cfg80211_suspend(struct wiphy *wiphy,
         for (i = 0; i < wowlan->n_patterns; i++) {
                 memset(byte_seq, 0, sizeof(byte_seq));
                 if (!mwifiex_is_pattern_supported(&wowlan->patterns[i],
-                                                  byte_seq,
-                                                  MWIFIEX_MEF_MAX_BYTESEQ)) {
-                        wiphy_err(wiphy, "Pattern not supported\n");
+                                        byte_seq,
+                                        MWIFIEX_MEF_MAX_BYTESEQ)) {
+                        dev_err(priv->adapter->dev, "Pattern not supported\n");
                         kfree(mef_entry);
                         return -EOPNOTSUPP;
                 }
@@ -2485,9 +2788,9 @@ static int mwifiex_cfg80211_suspend(struct wiphy *wiphy,
 
                 mef_entry->filter[filt_num].repeat = 1;
                 mef_entry->filter[filt_num].offset =
-                                                wowlan->patterns[i].pkt_offset;
+                        wowlan->patterns[i].pkt_offset;
                 memcpy(mef_entry->filter[filt_num].byte_seq, byte_seq,
-                       sizeof(byte_seq));
+                                sizeof(byte_seq));
                 mef_entry->filter[filt_num].filt_type = TYPE_EQ;
 
                 if (first_pat)
@@ -2502,9 +2805,9 @@ static int mwifiex_cfg80211_suspend(struct wiphy *wiphy,
                 mef_cfg.criteria |= MWIFIEX_CRITERIA_UNICAST;
                 mef_entry->filter[filt_num].repeat = 16;
                 memcpy(mef_entry->filter[filt_num].byte_seq, priv->curr_addr,
-                       ETH_ALEN);
+                                ETH_ALEN);
                 mef_entry->filter[filt_num].byte_seq[MWIFIEX_MEF_MAX_BYTESEQ] =
-                                                                ETH_ALEN;
+                        ETH_ALEN;
                 mef_entry->filter[filt_num].offset = 28;
                 mef_entry->filter[filt_num].filt_type = TYPE_EQ;
                 if (filt_num)
@@ -2513,9 +2816,9 @@ static int mwifiex_cfg80211_suspend(struct wiphy *wiphy,
                 filt_num++;
                 mef_entry->filter[filt_num].repeat = 16;
                 memcpy(mef_entry->filter[filt_num].byte_seq, priv->curr_addr,
-                       ETH_ALEN);
+                                ETH_ALEN);
                 mef_entry->filter[filt_num].byte_seq[MWIFIEX_MEF_MAX_BYTESEQ] =
-                                                                ETH_ALEN;
+                        ETH_ALEN;
                 mef_entry->filter[filt_num].offset = 56;
                 mef_entry->filter[filt_num].filt_type = TYPE_EQ;
                 mef_entry->filter[filt_num].filt_action = TYPE_OR;
@@ -2523,16 +2826,61 @@ static int mwifiex_cfg80211_suspend(struct wiphy *wiphy,
 
         if (!mef_cfg.criteria)
                 mef_cfg.criteria = MWIFIEX_CRITERIA_BROADCAST |
-                                   MWIFIEX_CRITERIA_UNICAST |
-                                   MWIFIEX_CRITERIA_MULTICAST;
+                        MWIFIEX_CRITERIA_UNICAST |
+                        MWIFIEX_CRITERIA_MULTICAST;
 
         ret = mwifiex_send_cmd(priv, HostCmd_CMD_MEF_CFG,
-                               HostCmd_ACT_GEN_SET, 0, &mef_cfg, true);
+                        HostCmd_ACT_GEN_SET, 0, &mef_cfg, true);
 
         kfree(mef_entry);
         return ret;
 }
 
+static int mwifiex_cfg80211_suspend(struct wiphy *wiphy,
+                                    struct cfg80211_wowlan *wowlan)
+{
+        struct mwifiex_adapter *adapter = mwifiex_cfg80211_get_adapter(wiphy);
+        struct mwifiex_ds_hs_cfg hs_cfg;
+        int ret = 0;
+        struct mwifiex_private *priv =
+                        mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_STA);
+
+        if (!wowlan) {
+                dev_warn(adapter->dev, "None of the WOWLAN triggers enabled\n");
+                return 0;
+        }
+
+        if (!priv->media_connected) {
+                dev_warn(adapter->dev,
+                         "Can not configure WOWLAN in disconnected state\n");
+                return 0;
+        }
+
+        if (wowlan->n_patterns || wowlan->magic_pkt) {
+                ret = mwifiex_set_mef_filter(priv, wowlan);
+                if (ret) {
+                        dev_err(adapter->dev, "Failed to set MEF filter\n");
+                        return ret;
+                }
+        }
+
+        if (wowlan->disconnect) {
+                memset(&hs_cfg, 0, sizeof(hs_cfg));
+                hs_cfg.is_invoke_hostcmd = false;
+                hs_cfg.conditions = HS_CFG_COND_MAC_EVENT;
+                hs_cfg.gpio = HS_CFG_GPIO_DEF;
+                hs_cfg.gap = HS_CFG_GAP_DEF;
+                ret = mwifiex_set_hs_params(priv, HostCmd_ACT_GEN_SET,
+                                            MWIFIEX_SYNC_CMD, &hs_cfg);
+                if (ret) {
+                        dev_err(adapter->dev, "Failed to set HS params\n");
+                        return ret;
+                }
+        }
+
+        return ret;
+}
+
 static int mwifiex_cfg80211_resume(struct wiphy *wiphy)
 {
         return 0;
@@ -2803,6 +3151,102 @@ mwifiex_cfg80211_add_station(struct wiphy *wiphy, struct net_device *dev,
 }
 
 static int
+mwifiex_cfg80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
+                                struct cfg80211_csa_settings *params)
+{
+        struct ieee_types_header *chsw_ie;
+        struct ieee80211_channel_sw_ie *channel_sw;
+        int chsw_msec;
+        struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
+
+        if (priv->adapter->scan_processing) {
+                dev_err(priv->adapter->dev,
+                        "radar detection: scan in process...\n");
+                return -EBUSY;
+        }
+
+        if (priv->wdev.cac_started)
+                return -EBUSY;
+
+        if (cfg80211_chandef_identical(&params->chandef,
+                                       &priv->dfs_chandef))
+                return -EINVAL;
+
+        chsw_ie = (void *)cfg80211_find_ie(WLAN_EID_CHANNEL_SWITCH,
+                                           params->beacon_csa.tail,
+                                           params->beacon_csa.tail_len);
+        if (!chsw_ie) {
+                dev_err(priv->adapter->dev,
+                        "Could not parse channel switch announcement IE\n");
+                return -EINVAL;
+        }
+
+        channel_sw = (void *)(chsw_ie + 1);
+        if (channel_sw->mode) {
+                if (netif_carrier_ok(priv->netdev))
+                        netif_carrier_off(priv->netdev);
+                mwifiex_stop_net_dev_queue(priv->netdev, priv->adapter);
+        }
+
+        if (mwifiex_del_mgmt_ies(priv))
+                wiphy_err(wiphy, "Failed to delete mgmt IEs!\n");
+
+        if (mwifiex_set_mgmt_ies(priv, &params->beacon_csa)) {
+                wiphy_err(wiphy, "%s: setting mgmt ies failed\n", __func__);
+                return -EFAULT;
+        }
+
+        memcpy(&priv->dfs_chandef, &params->chandef, sizeof(priv->dfs_chandef));
+        memcpy(&priv->beacon_after, &params->beacon_after,
+               sizeof(priv->beacon_after));
+
+        chsw_msec = max(channel_sw->count * priv->bss_cfg.beacon_period, 100);
+        queue_delayed_work(priv->dfs_chan_sw_workqueue, &priv->dfs_chan_sw_work,
+                           msecs_to_jiffies(chsw_msec));
+        return 0;
+}
+
+static int
+mwifiex_cfg80211_start_radar_detection(struct wiphy *wiphy,
+                                       struct net_device *dev,
+                                       struct cfg80211_chan_def *chandef,
+                                       u32 cac_time_ms)
+{
+        struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
+        struct mwifiex_radar_params radar_params;
+
+        if (priv->adapter->scan_processing) {
+                dev_err(priv->adapter->dev,
+                        "radar detection: scan already in process...\n");
+                return -EBUSY;
+        }
+
+        if (!mwifiex_is_11h_active(priv)) {
+                dev_dbg(priv->adapter->dev, "Enable 11h extensions in FW\n");
+                if (mwifiex_11h_activate(priv, true)) {
+                        dev_err(priv->adapter->dev,
+                                "Failed to activate 11h extensions!!");
+                        return -1;
+                }
+                priv->state_11h.is_11h_active = true;
+        }
+
+        memset(&radar_params, 0, sizeof(struct mwifiex_radar_params));
+        radar_params.chandef = chandef;
+        radar_params.cac_time_ms = cac_time_ms;
+
+        memcpy(&priv->dfs_chandef, chandef, sizeof(priv->dfs_chandef));
+
+        if (mwifiex_send_cmd(priv, HostCmd_CMD_CHAN_REPORT_REQUEST,
+                             HostCmd_ACT_GEN_SET, 0, &radar_params, true))
+                return -1;
+
+        queue_delayed_work(priv->dfs_cac_workqueue, &priv->dfs_cac_work,
+                           msecs_to_jiffies(cac_time_ms));
+        return 0;
+}
+
+static int
 mwifiex_cfg80211_change_station(struct wiphy *wiphy, struct net_device *dev,
                                 const u8 *mac,
                                 struct station_parameters *params)
@@ -2866,11 +3310,13 @@ static struct cfg80211_ops mwifiex_cfg80211_ops = {
         .tdls_oper = mwifiex_cfg80211_tdls_oper,
         .add_station = mwifiex_cfg80211_add_station,
         .change_station = mwifiex_cfg80211_change_station,
+        .start_radar_detection = mwifiex_cfg80211_start_radar_detection,
+        .channel_switch = mwifiex_cfg80211_channel_switch,
 };
 
 #ifdef CONFIG_PM
 static const struct wiphy_wowlan_support mwifiex_wowlan_support = {
-        .flags = WIPHY_WOWLAN_MAGIC_PKT,
+        .flags = WIPHY_WOWLAN_MAGIC_PKT | WIPHY_WOWLAN_DISCONNECT,
         .n_patterns = MWIFIEX_MEF_MAX_FILTERS,
         .pattern_min_len = 1,
         .pattern_max_len = MWIFIEX_MAX_PATTERN_LEN,
@@ -2964,12 +3410,13 @@ int mwifiex_register_cfg80211(struct mwifiex_adapter *adapter)
         wiphy->cipher_suites = mwifiex_cipher_suites;
         wiphy->n_cipher_suites = ARRAY_SIZE(mwifiex_cipher_suites);
 
-        memcpy(wiphy->perm_addr, priv->curr_addr, ETH_ALEN);
+        ether_addr_copy(wiphy->perm_addr, adapter->perm_addr);
         wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
         wiphy->flags |= WIPHY_FLAG_HAVE_AP_SME |
                         WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD |
                         WIPHY_FLAG_AP_UAPSD |
-                        WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
+                        WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL |
+                        WIPHY_FLAG_HAS_CHANNEL_SWITCH;
 
         if (ISSUPP_TDLS_ENABLED(adapter->fw_cap_info))
                 wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS |
diff --git a/drivers/net/wireless/mwifiex/cfp.c b/drivers/net/wireless/mwifiex/cfp.c
index b8242eb2be6f..e9df8826f124 100644
--- a/drivers/net/wireless/mwifiex/cfp.c
+++ b/drivers/net/wireless/mwifiex/cfp.c
@@ -322,9 +322,9 @@ mwifiex_get_cfp(struct mwifiex_private *priv, u8 band, u16 channel, u32 freq)
                 return cfp;
 
         if (mwifiex_band_to_radio_type(band) == HostCmd_SCAN_RADIO_TYPE_BG)
-                sband = priv->wdev->wiphy->bands[IEEE80211_BAND_2GHZ];
+                sband = priv->wdev.wiphy->bands[IEEE80211_BAND_2GHZ];
         else
-                sband = priv->wdev->wiphy->bands[IEEE80211_BAND_5GHZ];
+                sband = priv->wdev.wiphy->bands[IEEE80211_BAND_5GHZ];
 
         if (!sband) {
                 dev_err(priv->adapter->dev, "%s: cannot find cfp by band %d\n",
@@ -509,3 +509,21 @@ u32 mwifiex_get_supported_rates(struct mwifiex_private *priv, u8 *rates)
 
         return k;
 }
+
+u8 mwifiex_adjust_data_rate(struct mwifiex_private *priv,
+                            u8 rx_rate, u8 rate_info)
+{
+        u8 rate_index = 0;
+
+        /* HT40 */
+        if ((rate_info & BIT(0)) && (rate_info & BIT(1)))
+                rate_index = MWIFIEX_RATE_INDEX_MCS0 +
+                             MWIFIEX_BW20_MCS_NUM + rx_rate;
+        else if (rate_info & BIT(0)) /* HT20 */
+                rate_index = MWIFIEX_RATE_INDEX_MCS0 + rx_rate;
+        else
+                rate_index = (rx_rate > MWIFIEX_RATE_INDEX_OFDM0) ?
+                              rx_rate - 1 : rx_rate;
+
+        return rate_index;
+}
diff --git a/drivers/net/wireless/mwifiex/cmdevt.c b/drivers/net/wireless/mwifiex/cmdevt.c
index 85597200badc..c5a14ff7eb82 100644
--- a/drivers/net/wireless/mwifiex/cmdevt.c
+++ b/drivers/net/wireless/mwifiex/cmdevt.c
@@ -315,22 +315,19 @@ static int mwifiex_dnld_sleep_confirm_cmd(struct mwifiex_adapter *adapter)
                 adapter->dbg.num_cmd_sleep_cfm_host_to_card_failure++;
                 return -1;
         }
-        if (GET_BSS_ROLE(mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_ANY))
-            == MWIFIEX_BSS_ROLE_STA) {
-                if (!le16_to_cpu(sleep_cfm_buf->resp_ctrl))
-                        /* Response is not needed for sleep
-                           confirm command */
-                        adapter->ps_state = PS_STATE_SLEEP;
-                else
-                        adapter->ps_state = PS_STATE_SLEEP_CFM;
-
-                if (!le16_to_cpu(sleep_cfm_buf->resp_ctrl) &&
-                    (adapter->is_hs_configured &&
-                     !adapter->sleep_period.period)) {
-                        adapter->pm_wakeup_card_req = true;
-                        mwifiex_hs_activated_event(mwifiex_get_priv
-                                        (adapter, MWIFIEX_BSS_ROLE_STA), true);
-                }
+
+        if (!le16_to_cpu(sleep_cfm_buf->resp_ctrl))
+                /* Response is not needed for sleep confirm command */
+                adapter->ps_state = PS_STATE_SLEEP;
+        else
+                adapter->ps_state = PS_STATE_SLEEP_CFM;
+
+        if (!le16_to_cpu(sleep_cfm_buf->resp_ctrl) &&
+            (adapter->is_hs_configured &&
+             !adapter->sleep_period.period)) {
+                adapter->pm_wakeup_card_req = true;
+                mwifiex_hs_activated_event(mwifiex_get_priv
+                                (adapter, MWIFIEX_BSS_ROLE_ANY), true);
         }
 
         return ret;
@@ -450,6 +447,7 @@ int mwifiex_process_event(struct mwifiex_adapter *adapter)
                                       EVENT_GET_BSS_TYPE(eventcause));
         if (!priv)
                 priv = mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_ANY);
+
         /* Clear BSS_NO_BITS from event */
         eventcause &= EVENT_ID_MASK;
         adapter->event_cause = eventcause;
@@ -462,12 +460,6 @@ int mwifiex_process_event(struct mwifiex_adapter *adapter)
         }
 
         dev_dbg(adapter->dev, "EVENT: cause: %#x\n", eventcause);
-        if (eventcause == EVENT_PS_SLEEP || eventcause == EVENT_PS_AWAKE) {
-                /* Handle PS_SLEEP/AWAKE events on STA */
-                priv = mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_STA);
-                if (!priv)
-                        priv = mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_ANY);
-        }
 
         if (priv->bss_role == MWIFIEX_BSS_ROLE_UAP)
                 ret = mwifiex_process_uap_event(priv);
@@ -1008,11 +1000,9 @@ mwifiex_cancel_all_pending_cmd(struct mwifiex_adapter *adapter)
         list_for_each_entry_safe(cmd_node, tmp_node,
                                  &adapter->scan_pending_q, list) {
                 list_del(&cmd_node->list);
-                spin_unlock_irqrestore(&adapter->scan_pending_q_lock, flags);
 
                 cmd_node->wait_q_enabled = false;
                 mwifiex_insert_cmd_to_free_q(adapter, cmd_node);
-                spin_lock_irqsave(&adapter->scan_pending_q_lock, flags);
         }
         spin_unlock_irqrestore(&adapter->scan_pending_q_lock, flags);
 
@@ -1070,12 +1060,8 @@ mwifiex_cancel_pending_ioctl(struct mwifiex_adapter *adapter)
         list_for_each_entry_safe(cmd_node, tmp_node,
                                  &adapter->scan_pending_q, list) {
                 list_del(&cmd_node->list);
-                spin_unlock_irqrestore(&adapter->scan_pending_q_lock,
-                                       scan_pending_q_flags);
                 cmd_node->wait_q_enabled = false;
                 mwifiex_insert_cmd_to_free_q(adapter, cmd_node);
-                spin_lock_irqsave(&adapter->scan_pending_q_lock,
-                                  scan_pending_q_flags);
         }
         spin_unlock_irqrestore(&adapter->scan_pending_q_lock,
                                scan_pending_q_flags);
@@ -1588,9 +1574,7 @@ int mwifiex_ret_get_hw_spec(struct mwifiex_private *priv,
                 le16_to_cpu(hw_spec->hw_if_version),
                 le16_to_cpu(hw_spec->version));
 
-        if (priv->curr_addr[0] == 0xff)
-                memmove(priv->curr_addr, hw_spec->permanent_addr, ETH_ALEN);
-
+        ether_addr_copy(priv->adapter->perm_addr, hw_spec->permanent_addr);
         adapter->region_code = le16_to_cpu(hw_spec->region_code);
 
         for (i = 0; i < MWIFIEX_MAX_REGION_CODE; i++)
diff --git a/drivers/net/wireless/mwifiex/debugfs.c b/drivers/net/wireless/mwifiex/debugfs.c
index 2713f7acd35e..1fb329dc6744 100644
--- a/drivers/net/wireless/mwifiex/debugfs.c
+++ b/drivers/net/wireless/mwifiex/debugfs.c
@@ -39,111 +39,6 @@ static char *bss_modes[] = {
         "P2P_DEVICE",
 };
 
-/* size/addr for mwifiex_debug_info */
-#define item_size(n)            (FIELD_SIZEOF(struct mwifiex_debug_info, n))
-#define item_addr(n)            (offsetof(struct mwifiex_debug_info, n))
-
-/* size/addr for struct mwifiex_adapter */
-#define adapter_item_size(n)    (FIELD_SIZEOF(struct mwifiex_adapter, n))
-#define adapter_item_addr(n)    (offsetof(struct mwifiex_adapter, n))
-
-struct mwifiex_debug_data {
-        char name[32];          /* variable/array name */
-        u32 size;               /* size of the variable/array */
-        size_t addr;            /* address of the variable/array */
-        int num;                /* number of variables in an array */
-};
-
-static struct mwifiex_debug_data items[] = {
-        {"int_counter", item_size(int_counter),
-         item_addr(int_counter), 1},
-        {"wmm_ac_vo", item_size(packets_out[WMM_AC_VO]),
-         item_addr(packets_out[WMM_AC_VO]), 1},
-        {"wmm_ac_vi", item_size(packets_out[WMM_AC_VI]),
-         item_addr(packets_out[WMM_AC_VI]), 1},
-        {"wmm_ac_be", item_size(packets_out[WMM_AC_BE]),
-         item_addr(packets_out[WMM_AC_BE]), 1},
-        {"wmm_ac_bk", item_size(packets_out[WMM_AC_BK]),
-         item_addr(packets_out[WMM_AC_BK]), 1},
-        {"tx_buf_size", item_size(tx_buf_size),
-         item_addr(tx_buf_size), 1},
-        {"curr_tx_buf_size", item_size(curr_tx_buf_size),
-         item_addr(curr_tx_buf_size), 1},
-        {"ps_mode", item_size(ps_mode),
-         item_addr(ps_mode), 1},
-        {"ps_state", item_size(ps_state),
-         item_addr(ps_state), 1},
-        {"is_deep_sleep", item_size(is_deep_sleep),
-         item_addr(is_deep_sleep), 1},
-        {"wakeup_dev_req", item_size(pm_wakeup_card_req),
-         item_addr(pm_wakeup_card_req), 1},
-        {"wakeup_tries", item_size(pm_wakeup_fw_try),
-         item_addr(pm_wakeup_fw_try), 1},
-        {"hs_configured", item_size(is_hs_configured),
-         item_addr(is_hs_configured), 1},
-        {"hs_activated", item_size(hs_activated),
-         item_addr(hs_activated), 1},
-        {"num_tx_timeout", item_size(num_tx_timeout),
-         item_addr(num_tx_timeout), 1},
-        {"is_cmd_timedout", item_size(is_cmd_timedout),
-         item_addr(is_cmd_timedout), 1},
-        {"timeout_cmd_id", item_size(timeout_cmd_id),
-         item_addr(timeout_cmd_id), 1},
-        {"timeout_cmd_act", item_size(timeout_cmd_act),
-         item_addr(timeout_cmd_act), 1},
-        {"last_cmd_id", item_size(last_cmd_id),
-         item_addr(last_cmd_id), DBG_CMD_NUM},
-        {"last_cmd_act", item_size(last_cmd_act),
-         item_addr(last_cmd_act), DBG_CMD_NUM},
-        {"last_cmd_index", item_size(last_cmd_index),
-         item_addr(last_cmd_index), 1},
-        {"last_cmd_resp_id", item_size(last_cmd_resp_id),
-         item_addr(last_cmd_resp_id), DBG_CMD_NUM},
-        {"last_cmd_resp_index", item_size(last_cmd_resp_index),
-         item_addr(last_cmd_resp_index), 1},
-        {"last_event", item_size(last_event),
-         item_addr(last_event), DBG_CMD_NUM},
-        {"last_event_index", item_size(last_event_index),
-         item_addr(last_event_index), 1},
-        {"num_cmd_h2c_fail", item_size(num_cmd_host_to_card_failure),
-         item_addr(num_cmd_host_to_card_failure), 1},
-        {"num_cmd_sleep_cfm_fail",
-         item_size(num_cmd_sleep_cfm_host_to_card_failure),
-         item_addr(num_cmd_sleep_cfm_host_to_card_failure), 1},
-        {"num_tx_h2c_fail", item_size(num_tx_host_to_card_failure),
-         item_addr(num_tx_host_to_card_failure), 1},
-        {"num_evt_deauth", item_size(num_event_deauth),
-         item_addr(num_event_deauth), 1},
-        {"num_evt_disassoc", item_size(num_event_disassoc),
-         item_addr(num_event_disassoc), 1},
-        {"num_evt_link_lost", item_size(num_event_link_lost),
-         item_addr(num_event_link_lost), 1},
-        {"num_cmd_deauth", item_size(num_cmd_deauth),
-         item_addr(num_cmd_deauth), 1},
-        {"num_cmd_assoc_ok", item_size(num_cmd_assoc_success),
-         item_addr(num_cmd_assoc_success), 1},
-        {"num_cmd_assoc_fail", item_size(num_cmd_assoc_failure),
-         item_addr(num_cmd_assoc_failure), 1},
-        {"cmd_sent", item_size(cmd_sent),
-         item_addr(cmd_sent), 1},
-        {"data_sent", item_size(data_sent),
-         item_addr(data_sent), 1},
-        {"cmd_resp_received", item_size(cmd_resp_received),
-         item_addr(cmd_resp_received), 1},
-        {"event_received", item_size(event_received),
-         item_addr(event_received), 1},
-
-        /* variables defined in struct mwifiex_adapter */
-        {"cmd_pending", adapter_item_size(cmd_pending),
-         adapter_item_addr(cmd_pending), 1},
-        {"tx_pending", adapter_item_size(tx_pending),
-         adapter_item_addr(tx_pending), 1},
-        {"rx_pending", adapter_item_size(rx_pending),
-         adapter_item_addr(rx_pending), 1},
-};
-
-static int num_of_items = ARRAY_SIZE(items);
-
 /*
  * Proc info file read handler.
  *
@@ -297,6 +192,8 @@ mwifiex_fw_dump_read(struct file *file, char __user *ubuf,
  *      - Number of FCS errors
  *      - Number of Tx frames
  *      - WEP ICV error counts
+ *      - Number of received beacons
+ *      - Number of missed beacons
  */
 static ssize_t
 mwifiex_getlog_read(struct file *file, char __user *ubuf,
@@ -333,7 +230,9 @@ mwifiex_getlog_read(struct file *file, char __user *ubuf,
                      "wepicverrcnt-1   %u\n"
                      "wepicverrcnt-2   %u\n"
                      "wepicverrcnt-3   %u\n"
-                     "wepicverrcnt-4   %u\n",
+                     "wepicverrcnt-4   %u\n"
+                     "bcn_rcv_cnt   %u\n"
+                     "bcn_miss_cnt   %u\n",
                      stats.mcast_tx_frame,
                      stats.failed,
                      stats.retry,
@@ -349,7 +248,9 @@ mwifiex_getlog_read(struct file *file, char __user *ubuf,
                      stats.wep_icv_error[0],
                      stats.wep_icv_error[1],
                      stats.wep_icv_error[2],
-                     stats.wep_icv_error[3]);
+                     stats.wep_icv_error[3],
+                     stats.bcn_rcv_cnt,
+                     stats.bcn_miss_cnt);
 
 
         ret = simple_read_from_buffer(ubuf, count, ppos, (char *) page,
@@ -360,6 +261,103 @@ free_and_exit:
         return ret;
 }
 
+/* Sysfs histogram file read handler.
+ *
+ * This function is called when the 'histogram' file is opened for reading
+ * It prints the following histogram information -
+ *      - Number of histogram samples
+ *      - Receive packet number of each rx_rate
+ *      - Receive packet number of each snr
+ *      - Receive packet number of each nosie_flr
+ *      - Receive packet number of each signal streath
+ */
+static ssize_t
+mwifiex_histogram_read(struct file *file, char __user *ubuf,
+                       size_t count, loff_t *ppos)
+{
+        struct mwifiex_private *priv =
+                (struct mwifiex_private *)file->private_data;
+        ssize_t ret;
+        struct mwifiex_histogram_data *phist_data;
+        int i, value;
+        unsigned long page = get_zeroed_page(GFP_KERNEL);
+        char *p = (char *)page;
+
+        if (!p)
+                return -ENOMEM;
+
+        if (!priv || !priv->hist_data)
+                return -EFAULT;
+        phist_data = priv->hist_data;
+
+        p += sprintf(p, "\n"
+                     "total samples = %d\n",
+                     atomic_read(&phist_data->num_samples));
+
+        p += sprintf(p, "rx rates (in Mbps): 0=1M   1=2M");
+        p += sprintf(p, "2=5.5M  3=11M   4=6M   5=9M  6=12M\n");
+        p += sprintf(p, "7=18M  8=24M  9=36M  10=48M  11=54M");
+        p += sprintf(p, "12-27=MCS0-15(BW20) 28-43=MCS0-15(BW40)\n");
+
+        if (ISSUPP_11ACENABLED(priv->adapter->fw_cap_info)) {
+                p += sprintf(p, "44-53=MCS0-9(VHT:BW20)");
+                p += sprintf(p, "54-63=MCS0-9(VHT:BW40)");
+                p += sprintf(p, "64-73=MCS0-9(VHT:BW80)\n\n");
+        } else {
+                p += sprintf(p, "\n");
+        }
+
+        for (i = 0; i < MWIFIEX_MAX_RX_RATES; i++) {
+                value = atomic_read(&phist_data->rx_rate[i]);
+                if (value)
+                        p += sprintf(p, "rx_rate[%02d] = %d\n", i, value);
+        }
+
+        if (ISSUPP_11ACENABLED(priv->adapter->fw_cap_info)) {
+                for (i = MWIFIEX_MAX_RX_RATES; i < MWIFIEX_MAX_AC_RX_RATES;
+                     i++) {
+                        value = atomic_read(&phist_data->rx_rate[i]);
+                        if (value)
+                                p += sprintf(p, "rx_rate[%02d] = %d\n",
+                                           i, value);
+                }
+        }
+
+        for (i = 0; i < MWIFIEX_MAX_SNR; i++) {
+                value =  atomic_read(&phist_data->snr[i]);
+                if (value)
+                        p += sprintf(p, "snr[%02ddB] = %d\n", i, value);
+        }
+        for (i = 0; i < MWIFIEX_MAX_NOISE_FLR; i++) {
+                value = atomic_read(&phist_data->noise_flr[i]);
+                if (value)
+                        p += sprintf(p, "noise_flr[-%02ddBm] = %d\n",
+                                (int)(i-128), value);
+        }
+        for (i = 0; i < MWIFIEX_MAX_SIG_STRENGTH; i++) {
+                value = atomic_read(&phist_data->sig_str[i]);
+                if (value)
+                        p += sprintf(p, "sig_strength[-%02ddBm] = %d\n",
+                                i, value);
+        }
+
+        ret = simple_read_from_buffer(ubuf, count, ppos, (char *)page,
+                                      (unsigned long)p - page);
+
+        return ret;
+}
+
+static ssize_t
+mwifiex_histogram_write(struct file *file, const char __user *ubuf,
+                        size_t count, loff_t *ppos)
+{
+        struct mwifiex_private *priv = (void *)file->private_data;
+
+        if (priv && priv->hist_data)
+                mwifiex_hist_data_reset(priv);
+        return 0;
+}
+
 static struct mwifiex_debug_info info;
 
 /*
@@ -415,13 +413,9 @@ mwifiex_debug_read(struct file *file, char __user *ubuf,
 {
         struct mwifiex_private *priv =
                 (struct mwifiex_private *) file->private_data;
-        struct mwifiex_debug_data *d = &items[0];
         unsigned long page = get_zeroed_page(GFP_KERNEL);
         char *p = (char *) page;
         ssize_t ret;
-        size_t size, addr;
-        long val;
-        int i, j;
 
         if (!p)
                 return -ENOMEM;
@@ -430,68 +424,7 @@ mwifiex_debug_read(struct file *file, char __user *ubuf,
         if (ret)
                 goto free_and_exit;
 
-        for (i = 0; i < num_of_items; i++) {
-                p += sprintf(p, "%s=", d[i].name);
-
-                size = d[i].size / d[i].num;
-
-                if (i < (num_of_items - 3))
-                        addr = d[i].addr + (size_t) &info;
-                else /* The last 3 items are struct mwifiex_adapter variables */
-                        addr = d[i].addr + (size_t) priv->adapter;
-
-                for (j = 0; j < d[i].num; j++) {
-                        switch (size) {
-                        case 1:
-                                val = *((u8 *) addr);
-                                break;
-                        case 2:
-                                val = *((u16 *) addr);
-                                break;
-                        case 4:
-                                val = *((u32 *) addr);
-                                break;
-                        case 8:
-                                val = *((long long *) addr);
-                                break;
-                        default:
-                                val = -1;
-                                break;
-                        }
-
-                        p += sprintf(p, "%#lx ", val);
-                        addr += size;
-                }
-
-                p += sprintf(p, "\n");
-        }
-
-        if (info.tx_tbl_num) {
-                p += sprintf(p, "Tx BA stream table:\n");
-                for (i = 0; i < info.tx_tbl_num; i++)
-                        p += sprintf(p, "tid = %d, ra = %pM\n",
-                                     info.tx_tbl[i].tid, info.tx_tbl[i].ra);
-        }
-
-        if (info.rx_tbl_num) {
-                p += sprintf(p, "Rx reorder table:\n");
-                for (i = 0; i < info.rx_tbl_num; i++) {
-                        p += sprintf(p, "tid = %d, ta = %pM, "
-                                     "start_win = %d, "
-                                     "win_size = %d, buffer: ",
-                                     info.rx_tbl[i].tid,
-                                     info.rx_tbl[i].ta,
-                                     info.rx_tbl[i].start_win,
-                                     info.rx_tbl[i].win_size);
-
-                        for (j = 0; j < info.rx_tbl[i].win_size; j++)
-                                p += sprintf(p, "%c ",
-                                             info.rx_tbl[i].buffer[j] ?
-                                             '1' : '0');
-
-                        p += sprintf(p, "\n");
-                }
-        }
+        p += mwifiex_debug_info_to_buffer(priv, p, &info);
 
         ret = simple_read_from_buffer(ubuf, count, ppos, (char *) page,
                                       (unsigned long) p - page);
@@ -817,6 +750,7 @@ MWIFIEX_DFS_FILE_READ_OPS(fw_dump);
 MWIFIEX_DFS_FILE_OPS(regrdwr);
 MWIFIEX_DFS_FILE_OPS(rdeeprom);
 MWIFIEX_DFS_FILE_OPS(hscfg);
+MWIFIEX_DFS_FILE_OPS(histogram);
 
 /*
  * This function creates the debug FS directory structure and the files.
@@ -840,6 +774,7 @@ mwifiex_dev_debugfs_init(struct mwifiex_private *priv)
         MWIFIEX_DFS_ADD_FILE(rdeeprom);
         MWIFIEX_DFS_ADD_FILE(fw_dump);
         MWIFIEX_DFS_ADD_FILE(hscfg);
+        MWIFIEX_DFS_ADD_FILE(histogram);
 }
 
 /*
diff --git a/drivers/net/wireless/mwifiex/decl.h b/drivers/net/wireless/mwifiex/decl.h
index 2269acf41ad8..88d0eade6bb1 100644
--- a/drivers/net/wireless/mwifiex/decl.h
+++ b/drivers/net/wireless/mwifiex/decl.h
@@ -32,15 +32,19 @@
 
 #define MWIFIEX_MAX_BSS_NUM         (3)
 
-#define MWIFIEX_MIN_DATA_HEADER_LEN 36  /* sizeof(mwifiex_txpd)
-                                         *   + 4 byte alignment
-                                         */
+#define MWIFIEX_DMA_ALIGN_SZ        64
+#define MAX_TXPD_SZ                 32
+#define INTF_HDR_ALIGN               4
+
+#define MWIFIEX_MIN_DATA_HEADER_LEN (MWIFIEX_DMA_ALIGN_SZ + INTF_HDR_ALIGN + \
+                                     MAX_TXPD_SZ)
 #define MWIFIEX_MGMT_FRAME_HEADER_SIZE  8       /* sizeof(pkt_type)
                                                  *   + sizeof(tx_control)
                                                  */
 
 #define MWIFIEX_MAX_TX_BASTREAM_SUPPORTED       2
 #define MWIFIEX_MAX_RX_BASTREAM_SUPPORTED       16
+#define MWIFIEX_MAX_TDLS_PEER_SUPPORTED 8
 
 #define MWIFIEX_STA_AMPDU_DEF_TXWINSIZE        64
 #define MWIFIEX_STA_AMPDU_DEF_RXWINSIZE        64
@@ -92,6 +96,20 @@
 #define MWIFIEX_TDLS_MAX_FAIL_COUNT      4
 #define MWIFIEX_AUTO_TDLS_IDLE_TIME     10
 
+/* 54M rates, index from 0 to 11 */
+#define MWIFIEX_RATE_INDEX_MCS0 12
+/* 12-27=MCS0-15(BW20) */
+#define MWIFIEX_BW20_MCS_NUM 15
+
+/* Rate index for OFDM 0 */
+#define MWIFIEX_RATE_INDEX_OFDM0   4
+
+#define MWIFIEX_MAX_STA_NUM             1
+#define MWIFIEX_MAX_UAP_NUM             1
+#define MWIFIEX_MAX_P2P_NUM             1
+
+#define MWIFIEX_A_BAND_START_FREQ       5000
+
 enum mwifiex_bss_type {
         MWIFIEX_BSS_TYPE_STA = 0,
         MWIFIEX_BSS_TYPE_UAP = 1,
@@ -204,4 +222,35 @@ struct mwifiex_chan_stats {
         u16 cca_scan_dur;
         u16 cca_busy_dur;
 } __packed;
+
+#define MWIFIEX_HIST_MAX_SAMPLES        1048576
+#define MWIFIEX_MAX_RX_RATES                 44
+#define MWIFIEX_MAX_AC_RX_RATES              74
+#define MWIFIEX_MAX_SNR                     256
+#define MWIFIEX_MAX_NOISE_FLR               256
+#define MWIFIEX_MAX_SIG_STRENGTH            256
+
+struct mwifiex_histogram_data {
+        atomic_t rx_rate[MWIFIEX_MAX_AC_RX_RATES];
+        atomic_t snr[MWIFIEX_MAX_SNR];
+        atomic_t noise_flr[MWIFIEX_MAX_NOISE_FLR];
+        atomic_t sig_str[MWIFIEX_MAX_SIG_STRENGTH];
+        atomic_t num_samples;
+};
+
+struct mwifiex_iface_comb {
+        u8 sta_intf;
+        u8 uap_intf;
+        u8 p2p_intf;
+};
+
+struct mwifiex_radar_params {
+        struct cfg80211_chan_def *chandef;
+        u32 cac_time_ms;
+} __packed;
+
+struct mwifiex_11h_intf_state {
+        bool is_11h_enabled;
+        bool is_11h_active;
+} __packed;
 #endif /* !_MWIFIEX_DECL_H_ */
diff --git a/drivers/net/wireless/mwifiex/ethtool.c b/drivers/net/wireless/mwifiex/ethtool.c
index 04e56b5fc535..65d8d6d4b6ba 100644
--- a/drivers/net/wireless/mwifiex/ethtool.c
+++ b/drivers/net/wireless/mwifiex/ethtool.c
@@ -76,7 +76,9 @@ mwifiex_get_dump_flag(struct net_device *dev, struct ethtool_dump *dump)
 
         dump->flag = adapter->curr_mem_idx;
         dump->version = 1;
-        if (adapter->curr_mem_idx != MWIFIEX_FW_DUMP_IDX) {
+        if (adapter->curr_mem_idx == MWIFIEX_DRV_INFO_IDX) {
+                dump->len = adapter->drv_info_size;
+        } else if (adapter->curr_mem_idx != MWIFIEX_FW_DUMP_IDX) {
                 entry = &adapter->mem_type_mapping_tbl[adapter->curr_mem_idx];
                 dump->len = entry->mem_size;
         } else {
@@ -98,6 +100,13 @@ mwifiex_get_dump_data(struct net_device *dev, struct ethtool_dump *dump,
         if (!adapter->if_ops.fw_dump)
                 return -ENOTSUPP;
 
+        if (adapter->curr_mem_idx == MWIFIEX_DRV_INFO_IDX) {
+                if (!adapter->drv_info_dump)
+                        return -EFAULT;
+                memcpy(p, adapter->drv_info_dump, adapter->drv_info_size);
+                return 0;
+        }
+
         if (adapter->curr_mem_idx == MWIFIEX_FW_DUMP_IDX) {
                 dev_err(adapter->dev, "firmware dump in progress!!\n");
                 return -EBUSY;
@@ -125,6 +134,11 @@ static int mwifiex_set_dump(struct net_device *dev, struct ethtool_dump *val)
         if (!adapter->if_ops.fw_dump)
                 return -ENOTSUPP;
 
+        if (val->flag == MWIFIEX_DRV_INFO_IDX) {
+                adapter->curr_mem_idx = MWIFIEX_DRV_INFO_IDX;
+                return 0;
+        }
+
         if (adapter->curr_mem_idx == MWIFIEX_FW_DUMP_IDX) {
                 dev_err(adapter->dev, "firmware dump in progress!!\n");
                 return -EBUSY;
diff --git a/drivers/net/wireless/mwifiex/fw.h b/drivers/net/wireless/mwifiex/fw.h
index fb5936eb82e3..df553e86a0ad 100644
--- a/drivers/net/wireless/mwifiex/fw.h
+++ b/drivers/net/wireless/mwifiex/fw.h
@@ -158,6 +158,7 @@ enum MWIFIEX_802_11_PRIVACY_FILTER {
 #define TLV_TYPE_POWER_GROUP        (PROPRIETARY_TLV_BASE_ID + 84)
 #define TLV_TYPE_BSS_SCAN_RSP       (PROPRIETARY_TLV_BASE_ID + 86)
 #define TLV_TYPE_BSS_SCAN_INFO      (PROPRIETARY_TLV_BASE_ID + 87)
+#define TLV_TYPE_CHANRPT_11H_BASIC  (PROPRIETARY_TLV_BASE_ID + 91)
 #define TLV_TYPE_UAP_RETRY_LIMIT    (PROPRIETARY_TLV_BASE_ID + 93)
 #define TLV_TYPE_WAPI_IE            (PROPRIETARY_TLV_BASE_ID + 94)
 #define TLV_TYPE_UAP_MGMT_FRAME     (PROPRIETARY_TLV_BASE_ID + 104)
@@ -233,6 +234,7 @@ enum MWIFIEX_802_11_PRIVACY_FILTER {
 #define ISSUPP_RXLDPC(Dot11nDevCap) (Dot11nDevCap & BIT(22))
 #define ISSUPP_BEAMFORMING(Dot11nDevCap) (Dot11nDevCap & BIT(30))
 #define ISALLOWED_CHANWIDTH40(ht_param) (ht_param & BIT(2))
+#define GETSUPP_TXBASTREAMS(Dot11nDevCap) ((Dot11nDevCap >> 18) & 0xF)
 
 /* httxcfg bitmap
  * 0            reserved
@@ -335,6 +337,7 @@ enum MWIFIEX_802_11_PRIVACY_FILTER {
 #define HostCmd_CMD_11N_ADDBA_RSP                     0x00cf
 #define HostCmd_CMD_11N_DELBA                         0x00d0
 #define HostCmd_CMD_RECONFIGURE_TX_BUFF               0x00d9
+#define HostCmd_CMD_CHAN_REPORT_REQUEST               0x00dd
 #define HostCmd_CMD_AMSDU_AGGR_CTRL                   0x00df
 #define HostCmd_CMD_TXPWR_CFG                         0x00d1
 #define HostCmd_CMD_TX_RATE_CFG                       0x00d6
@@ -492,6 +495,8 @@ enum P2P_MODES {
 #define EVENT_HOSTWAKE_STAIE            0x0000004d
 #define EVENT_CHANNEL_SWITCH_ANN        0x00000050
 #define EVENT_TDLS_GENERIC_EVENT        0x00000052
+#define EVENT_RADAR_DETECTED            0x00000053
+#define EVENT_CHANNEL_REPORT_RDY        0x00000054
 #define EVENT_EXT_SCAN_REPORT           0x00000058
 #define EVENT_REMAIN_ON_CHAN_EXPIRED    0x0000005f
 #define EVENT_TX_STATUS_REPORT          0x00000074
@@ -529,6 +534,8 @@ enum P2P_MODES {
 
 #define MWIFIEX_FW_V15             15
 
+#define MWIFIEX_MASTER_RADAR_DET_MASK BIT(1)
+
 struct mwifiex_ie_types_header {
         __le16 type;
         __le16 len;
@@ -1076,6 +1083,8 @@ struct host_cmd_ds_802_11_get_log {
         __le32 tx_frame;
         __le32 reserved;
         __le32 wep_icv_err_cnt[4];
+        __le32 bcn_rcv_cnt;
+        __le32 bcn_miss_cnt;
 };
 
 /* Enumeration for rate format */
@@ -1213,6 +1222,24 @@ struct host_cmd_ds_tdls_oper {
         u8 peer_mac[ETH_ALEN];
 } __packed;
 
+struct mwifiex_chan_desc {
+        __le16 start_freq;
+        u8 chan_width;
+        u8 chan_num;
+} __packed;
+
+struct host_cmd_ds_chan_rpt_req {
+        struct mwifiex_chan_desc chan_desc;
+        __le32 msec_dwell_time;
+} __packed;
+
+struct host_cmd_ds_chan_rpt_event {
+        __le32 result;
+        __le64 start_tsf;
+        __le32 duration;
+        u8 tlvbuf[0];
+} __packed;
+
 struct mwifiex_fixed_bcn_param {
         __le64 timestamp;
         __le16 beacon_period;
@@ -1789,6 +1816,39 @@ struct mwifiex_ie_types_rssi_threshold {
         u8 evt_freq;
 } __packed;
 
+#define MWIFIEX_DFS_REC_HDR_LEN         8
+#define MWIFIEX_DFS_REC_HDR_NUM         10
+#define MWIFIEX_BIN_COUNTER_LEN         7
+
+struct mwifiex_radar_det_event {
+        __le32 detect_count;
+        u8 reg_domain;  /*1=fcc, 2=etsi, 3=mic*/
+        u8 det_type;  /*0=none, 1=pw(chirp), 2=pri(radar)*/
+        __le16 pw_chirp_type;
+        u8 pw_chirp_idx;
+        u8 pw_value;
+        u8 pri_radar_type;
+        u8 pri_bincnt;
+        u8 bin_counter[MWIFIEX_BIN_COUNTER_LEN];
+        u8 num_dfs_records;
+        u8 dfs_record_hdr[MWIFIEX_DFS_REC_HDR_NUM][MWIFIEX_DFS_REC_HDR_LEN];
+        __le32 passed;
+} __packed;
+
+struct meas_rpt_map {
+        u8 rssi:3;
+        u8 unmeasured:1;
+        u8 radar:1;
+        u8 unidentified_sig:1;
+        u8 ofdm_preamble:1;
+        u8 bss:1;
+} __packed;
+
+struct mwifiex_ie_types_chan_rpt_data {
+        struct mwifiex_ie_types_header header;
+        struct meas_rpt_map map;
+} __packed;
+
 struct host_cmd_ds_802_11_subsc_evt {
         __le16 action;
         __le16 events;
@@ -1901,6 +1961,7 @@ struct host_cmd_ds_command {
                 struct host_cmd_11ac_vht_cfg vht_cfg;
                 struct host_cmd_ds_coalesce_cfg coalesce_cfg;
                 struct host_cmd_ds_tdls_oper tdls_oper;
+                struct host_cmd_ds_chan_rpt_req chan_rpt_req;
         } params;
 } __packed;
 
diff --git a/drivers/net/wireless/mwifiex/ie.c b/drivers/net/wireless/mwifiex/ie.c
index b933794758b7..f3b6ed249403 100644
--- a/drivers/net/wireless/mwifiex/ie.c
+++ b/drivers/net/wireless/mwifiex/ie.c
@@ -317,27 +317,27 @@ done:
         return ret;
 }
 
-/* This function parses different IEs-tail IEs, beacon IEs, probe response IEs,
- * association response IEs from cfg80211_ap_settings function and sets these IE
- * to FW.
+/* This function parses  head and tail IEs, from cfg80211_beacon_data and sets
+ * these IE to FW.
  */
-int mwifiex_set_mgmt_ies(struct mwifiex_private *priv,
-                         struct cfg80211_beacon_data *info)
+static int mwifiex_uap_set_head_tail_ies(struct mwifiex_private *priv,
+                                         struct cfg80211_beacon_data *info)
 {
         struct mwifiex_ie *gen_ie;
-        struct ieee_types_header *rsn_ie, *wpa_ie = NULL;
-        u16 rsn_idx = MWIFIEX_AUTO_IDX_MASK, ie_len = 0;
+        struct ieee_types_header *rsn_ie = NULL, *wpa_ie = NULL;
+        struct ieee_types_header *chsw_ie = NULL;
+        u16 gen_idx = MWIFIEX_AUTO_IDX_MASK, ie_len = 0;
         const u8 *vendor_ie;
 
-        if (info->tail && info->tail_len) {
-                gen_ie = kzalloc(sizeof(struct mwifiex_ie), GFP_KERNEL);
-                if (!gen_ie)
-                        return -ENOMEM;
-                gen_ie->ie_index = cpu_to_le16(rsn_idx);
-                gen_ie->mgmt_subtype_mask = cpu_to_le16(MGMT_MASK_BEACON |
-                                                        MGMT_MASK_PROBE_RESP |
-                                                        MGMT_MASK_ASSOC_RESP);
+        gen_ie = kzalloc(sizeof(*gen_ie), GFP_KERNEL);
+        if (!gen_ie)
+                return -ENOMEM;
+        gen_ie->ie_index = cpu_to_le16(gen_idx);
+        gen_ie->mgmt_subtype_mask = cpu_to_le16(MGMT_MASK_BEACON |
+                                                MGMT_MASK_PROBE_RESP |
+                                                MGMT_MASK_ASSOC_RESP);
 
+        if (info->tail && info->tail_len) {
                 rsn_ie = (void *)cfg80211_find_ie(WLAN_EID_RSN,
                                                   info->tail, info->tail_len);
                 if (rsn_ie) {
@@ -358,19 +358,41 @@ int mwifiex_set_mgmt_ies(struct mwifiex_private *priv,
                         gen_ie->ie_length = cpu_to_le16(ie_len);
                 }
 
-                if (rsn_ie || wpa_ie) {
-                        if (mwifiex_update_uap_custom_ie(priv, gen_ie, &rsn_idx,
-                                                         NULL, NULL,
-                                                         NULL, NULL)) {
-                                kfree(gen_ie);
-                                return -1;
-                        }
-                        priv->rsn_idx = rsn_idx;
+                chsw_ie = (void *)cfg80211_find_ie(WLAN_EID_CHANNEL_SWITCH,
+                                                   info->tail, info->tail_len);
+                if (chsw_ie) {
+                        memcpy(gen_ie->ie_buffer + ie_len,
+                               chsw_ie, chsw_ie->len + 2);
+                        ie_len += chsw_ie->len + 2;
+                        gen_ie->ie_length = cpu_to_le16(ie_len);
                 }
+        }
 
-                kfree(gen_ie);
+        if (rsn_ie || wpa_ie || chsw_ie) {
+                if (mwifiex_update_uap_custom_ie(priv, gen_ie, &gen_idx, NULL,
+                                                 NULL, NULL, NULL)) {
+                        kfree(gen_ie);
+                        return -1;
+                }
+                priv->gen_idx = gen_idx;
         }
 
+        kfree(gen_ie);
+        return 0;
+}
+
+/* This function parses different IEs-head & tail IEs, beacon IEs,
+ * probe response IEs, association response IEs from cfg80211_ap_settings
+ * function and sets these IE to FW.
+ */
+int mwifiex_set_mgmt_ies(struct mwifiex_private *priv,
+                         struct cfg80211_beacon_data *info)
+{
+        int ret;
+
+        ret = mwifiex_uap_set_head_tail_ies(priv, info);
+                return ret;
+
         return mwifiex_set_mgmt_beacon_data_ies(priv, info);
 }
 
@@ -378,25 +400,25 @@ int mwifiex_set_mgmt_ies(struct mwifiex_private *priv,
 int mwifiex_del_mgmt_ies(struct mwifiex_private *priv)
 {
         struct mwifiex_ie *beacon_ie = NULL, *pr_ie = NULL;
-        struct mwifiex_ie *ar_ie = NULL, *rsn_ie = NULL;
+        struct mwifiex_ie *ar_ie = NULL, *gen_ie = NULL;
         int ret = 0;
 
-        if (priv->rsn_idx != MWIFIEX_AUTO_IDX_MASK) {
-                rsn_ie = kmalloc(sizeof(struct mwifiex_ie), GFP_KERNEL);
-                if (!rsn_ie)
+        if (priv->gen_idx != MWIFIEX_AUTO_IDX_MASK) {
+                gen_ie = kmalloc(sizeof(*gen_ie), GFP_KERNEL);
+                if (!gen_ie)
                         return -ENOMEM;
 
-                rsn_ie->ie_index = cpu_to_le16(priv->rsn_idx);
-                rsn_ie->mgmt_subtype_mask = cpu_to_le16(MWIFIEX_DELETE_MASK);
-                rsn_ie->ie_length = 0;
-                if (mwifiex_update_uap_custom_ie(priv, rsn_ie, &priv->rsn_idx,
+                gen_ie->ie_index = cpu_to_le16(priv->gen_idx);
+                gen_ie->mgmt_subtype_mask = cpu_to_le16(MWIFIEX_DELETE_MASK);
+                gen_ie->ie_length = 0;
+                if (mwifiex_update_uap_custom_ie(priv, gen_ie, &priv->gen_idx,
                                                  NULL, &priv->proberesp_idx,
                                                  NULL, &priv->assocresp_idx)) {
                         ret = -1;
                         goto done;
                 }
 
-                priv->rsn_idx = MWIFIEX_AUTO_IDX_MASK;
+                priv->gen_idx = MWIFIEX_AUTO_IDX_MASK;
         }
 
         if (priv->beacon_idx != MWIFIEX_AUTO_IDX_MASK) {
@@ -440,7 +462,6 @@ done:
         kfree(beacon_ie);
         kfree(pr_ie);
         kfree(ar_ie);
-        kfree(rsn_ie);
 
         return ret;
 }
diff --git a/drivers/net/wireless/mwifiex/init.c b/drivers/net/wireless/mwifiex/init.c
index 520ad4a3018b..b77ba743e1c4 100644
--- a/drivers/net/wireless/mwifiex/init.c
+++ b/drivers/net/wireless/mwifiex/init.c
@@ -52,6 +52,18 @@ static int mwifiex_add_bss_prio_tbl(struct mwifiex_private *priv)
         return 0;
 }
 
+static void wakeup_timer_fn(unsigned long data)
+{
+        struct mwifiex_adapter *adapter = (struct mwifiex_adapter *)data;
+
+        dev_err(adapter->dev, "Firmware wakeup failed\n");
+        adapter->hw_status = MWIFIEX_HW_STATUS_RESET;
+        mwifiex_cancel_all_pending_cmd(adapter);
+
+        if (adapter->if_ops.card_reset)
+                adapter->if_ops.card_reset(adapter);
+}
+
 /*
  * This function initializes the private structure and sets default
  * values to the members.
@@ -140,6 +152,8 @@ int mwifiex_init_priv(struct mwifiex_private *priv)
         priv->check_tdls_tx = false;
         memcpy(priv->tos_to_tid_inv, tos_to_tid_inv, MAX_NUM_TID);
 
+        mwifiex_init_11h_params(priv);
+
         return mwifiex_add_bss_prio_tbl(priv);
 }
 
@@ -282,9 +296,16 @@ static void mwifiex_init_adapter(struct mwifiex_adapter *adapter)
         memset(&adapter->arp_filter, 0, sizeof(adapter->arp_filter));
         adapter->arp_filter_size = 0;
         adapter->max_mgmt_ie_index = MAX_MGMT_IE_INDEX;
-        adapter->ext_scan = true;
+        adapter->ext_scan = false;
         adapter->key_api_major_ver = 0;
         adapter->key_api_minor_ver = 0;
+        memset(adapter->perm_addr, 0xff, ETH_ALEN);
+        adapter->iface_limit.sta_intf = MWIFIEX_MAX_STA_NUM;
+        adapter->iface_limit.uap_intf = MWIFIEX_MAX_UAP_NUM;
+        adapter->iface_limit.p2p_intf = MWIFIEX_MAX_P2P_NUM;
+
+        setup_timer(&adapter->wakeup_timer, wakeup_timer_fn,
+                    (unsigned long)adapter);
 }
 
 /*
@@ -391,7 +412,10 @@ mwifiex_adapter_cleanup(struct mwifiex_adapter *adapter)
                 return;
         }
 
+        del_timer(&adapter->wakeup_timer);
         mwifiex_cancel_all_pending_cmd(adapter);
+        wake_up_interruptible(&adapter->cmd_wait_q.wait);
+        wake_up_interruptible(&adapter->hs_activate_wait_q);
 
         /* Free lock variables */
         mwifiex_free_lock_list(adapter);
@@ -411,6 +435,11 @@ mwifiex_adapter_cleanup(struct mwifiex_adapter *adapter)
                 entry->mem_size = 0;
         }
 
+        if (adapter->drv_info_dump) {
+                vfree(adapter->drv_info_dump);
+                adapter->drv_info_size = 0;
+        }
+
         if (adapter->sleep_cfm)
                 dev_kfree_skb_any(adapter->sleep_cfm);
 }
@@ -528,7 +557,8 @@ int mwifiex_init_fw(struct mwifiex_adapter *adapter)
 
         for (i = 0; i < adapter->priv_num; i++) {
                 if (adapter->priv[i]) {
-                        ret = mwifiex_sta_init_cmd(adapter->priv[i], first_sta);
+                        ret = mwifiex_sta_init_cmd(adapter->priv[i], first_sta,
+                                                   true);
                         if (ret == -1)
                                 return -1;
 
@@ -653,6 +683,7 @@ mwifiex_shutdown_drv(struct mwifiex_adapter *adapter)
                         priv = adapter->priv[i];
 
                         mwifiex_clean_auto_tdls(priv);
+                        mwifiex_abort_cac(priv);
                         mwifiex_clean_txrx(priv);
                         mwifiex_delete_bss_prio_tbl(priv);
                 }
diff --git a/drivers/net/wireless/mwifiex/ioctl.h b/drivers/net/wireless/mwifiex/ioctl.h
index 0847f3e07ab7..d2b05c3a96da 100644
--- a/drivers/net/wireless/mwifiex/ioctl.h
+++ b/drivers/net/wireless/mwifiex/ioctl.h
@@ -137,6 +137,8 @@ struct mwifiex_ds_get_stats {
         u32 fcs_error;
         u32 tx_frame;
         u32 wep_icv_error[4];
+        u32 bcn_rcv_cnt;
+        u32 bcn_miss_cnt;
 };
 
 #define MWIFIEX_MAX_VER_STR_LEN    128
@@ -180,7 +182,11 @@ struct mwifiex_ds_tx_ba_stream_tbl {
         u8 amsdu;
 };
 
-#define DBG_CMD_NUM     5
+#define DBG_CMD_NUM    5
+
+struct tdls_peer_info {
+        u8 peer_addr[ETH_ALEN];
+};
 
 struct mwifiex_debug_info {
         u32 int_counter;
@@ -193,6 +199,9 @@ struct mwifiex_debug_info {
         u32 rx_tbl_num;
         struct mwifiex_ds_rx_reorder_tbl rx_tbl
                 [MWIFIEX_MAX_RX_BASTREAM_SUPPORTED];
+        u32 tdls_peer_num;
+        struct tdls_peer_info tdls_list
+                [MWIFIEX_MAX_TDLS_PEER_SUPPORTED];
         u16 ps_mode;
         u32 ps_state;
         u8 is_deep_sleep;
diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
index d4d2223d1f31..7e74b4fccddd 100644
--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -83,9 +83,8 @@ static int mwifiex_register(void *card, struct mwifiex_if_ops *if_ops,
         }
         mwifiex_init_lock_list(adapter);
 
-        init_timer(&adapter->cmd_timer);
-        adapter->cmd_timer.function = mwifiex_cmd_timeout_func;
-        adapter->cmd_timer.data = (unsigned long) adapter;
+        setup_timer(&adapter->cmd_timer, mwifiex_cmd_timeout_func,
+                    (unsigned long)adapter);
 
         return 0;
 
@@ -237,6 +236,7 @@ process_start:
                     (is_command_pending(adapter) ||
                      !mwifiex_wmm_lists_empty(adapter))) {
                         adapter->pm_wakeup_fw_try = true;
+                        mod_timer(&adapter->wakeup_timer, jiffies + (HZ*3));
                         adapter->if_ops.wakeup(adapter);
                         continue;
                 }
@@ -244,6 +244,7 @@ process_start:
                 if (IS_CARD_RX_RCVD(adapter)) {
                         adapter->data_received = false;
                         adapter->pm_wakeup_fw_try = false;
+                        del_timer_sync(&adapter->wakeup_timer);
                         if (adapter->ps_state == PS_STATE_SLEEP)
                                 adapter->ps_state = PS_STATE_AWAKE;
                 } else {
@@ -511,8 +512,7 @@ err_dnld_fw:
         if (adapter->if_ops.unregister_dev)
                 adapter->if_ops.unregister_dev(adapter);
 
-        if ((adapter->hw_status == MWIFIEX_HW_STATUS_FW_READY) ||
-            (adapter->hw_status == MWIFIEX_HW_STATUS_READY)) {
+        if (adapter->hw_status == MWIFIEX_HW_STATUS_READY) {
                 pr_debug("info: %s: shutdown mwifiex\n", __func__);
                 adapter->init_wait_q_woken = false;
 
@@ -562,7 +562,8 @@ static int mwifiex_init_hw_fw(struct mwifiex_adapter *adapter)
 static int
 mwifiex_open(struct net_device *dev)
 {
-        netif_tx_start_all_queues(dev);
+        netif_carrier_off(dev);
+
         return 0;
 }
 
@@ -801,6 +802,114 @@ mwifiex_tx_timeout(struct net_device *dev)
         }
 }
 
+void mwifiex_dump_drv_info(struct mwifiex_adapter *adapter)
+{
+        void *p;
+        char drv_version[64];
+        struct usb_card_rec *cardp;
+        struct sdio_mmc_card *sdio_card;
+        struct mwifiex_private *priv;
+        int i, idx;
+        struct netdev_queue *txq;
+        struct mwifiex_debug_info *debug_info;
+
+        if (adapter->drv_info_dump) {
+                vfree(adapter->drv_info_dump);
+                adapter->drv_info_size = 0;
+        }
+
+        dev_info(adapter->dev, "=== DRIVER INFO DUMP START===\n");
+
+        adapter->drv_info_dump = vzalloc(MWIFIEX_DRV_INFO_SIZE_MAX);
+
+        if (!adapter->drv_info_dump)
+                return;
+
+        p = (char *)(adapter->drv_info_dump);
+        p += sprintf(p, "driver_name = " "\"mwifiex\"\n");
+
+        mwifiex_drv_get_driver_version(adapter, drv_version,
+                                       sizeof(drv_version) - 1);
+        p += sprintf(p, "driver_version = %s\n", drv_version);
+
+        if (adapter->iface_type == MWIFIEX_USB) {
+                cardp = (struct usb_card_rec *)adapter->card;
+                p += sprintf(p, "tx_cmd_urb_pending = %d\n",
+                             atomic_read(&cardp->tx_cmd_urb_pending));
+                p += sprintf(p, "tx_data_urb_pending = %d\n",
+                             atomic_read(&cardp->tx_data_urb_pending));
+                p += sprintf(p, "rx_cmd_urb_pending = %d\n",
+                             atomic_read(&cardp->rx_cmd_urb_pending));
+                p += sprintf(p, "rx_data_urb_pending = %d\n",
+                             atomic_read(&cardp->rx_data_urb_pending));
+        }
+
+        p += sprintf(p, "tx_pending = %d\n",
+                     atomic_read(&adapter->tx_pending));
+        p += sprintf(p, "rx_pending = %d\n",
+                     atomic_read(&adapter->rx_pending));
+
+        if (adapter->iface_type == MWIFIEX_SDIO) {
+                sdio_card = (struct sdio_mmc_card *)adapter->card;
+                p += sprintf(p, "\nmp_rd_bitmap=0x%x curr_rd_port=0x%x\n",
+                             sdio_card->mp_rd_bitmap, sdio_card->curr_rd_port);
+                p += sprintf(p, "mp_wr_bitmap=0x%x curr_wr_port=0x%x\n",
+                             sdio_card->mp_wr_bitmap, sdio_card->curr_wr_port);
+        }
+
+        for (i = 0; i < adapter->priv_num; i++) {
+                if (!adapter->priv[i] || !adapter->priv[i]->netdev)
+                        continue;
+                priv = adapter->priv[i];
+                p += sprintf(p, "\n[interface  : \"%s\"]\n",
+                             priv->netdev->name);
+                p += sprintf(p, "wmm_tx_pending[0] = %d\n",
+                             atomic_read(&priv->wmm_tx_pending[0]));
+                p += sprintf(p, "wmm_tx_pending[1] = %d\n",
+                             atomic_read(&priv->wmm_tx_pending[1]));
+                p += sprintf(p, "wmm_tx_pending[2] = %d\n",
+                             atomic_read(&priv->wmm_tx_pending[2]));
+                p += sprintf(p, "wmm_tx_pending[3] = %d\n",
+                             atomic_read(&priv->wmm_tx_pending[3]));
+                p += sprintf(p, "media_state=\"%s\"\n", !priv->media_connected ?
+                             "Disconnected" : "Connected");
+                p += sprintf(p, "carrier %s\n", (netif_carrier_ok(priv->netdev)
+                             ? "on" : "off"));
+                for (idx = 0; idx < priv->netdev->num_tx_queues; idx++) {
+                        txq = netdev_get_tx_queue(priv->netdev, idx);
+                        p += sprintf(p, "tx queue %d:%s  ", idx,
+                                     netif_tx_queue_stopped(txq) ?
+                                     "stopped" : "started");
+                }
+                p += sprintf(p, "\n%s: num_tx_timeout = %d\n",
+                             priv->netdev->name, priv->num_tx_timeout);
+        }
+
+        if (adapter->iface_type == MWIFIEX_SDIO) {
+                p += sprintf(p, "\n=== SDIO register DUMP===\n");
+                if (adapter->if_ops.reg_dump)
+                        p += adapter->if_ops.reg_dump(adapter, p);
+        }
+
+        p += sprintf(p, "\n=== MORE DEBUG INFORMATION\n");
+        debug_info = kzalloc(sizeof(*debug_info), GFP_KERNEL);
+        if (debug_info) {
+                for (i = 0; i < adapter->priv_num; i++) {
+                        if (!adapter->priv[i] || !adapter->priv[i]->netdev)
+                                continue;
+                        priv = adapter->priv[i];
+                        mwifiex_get_debug_info(priv, debug_info);
+                        p += mwifiex_debug_info_to_buffer(priv, p, debug_info);
+                        break;
+                }
+                kfree(debug_info);
+        }
+
+        adapter->drv_info_size = p - adapter->drv_info_dump;
+        dev_info(adapter->dev, "=== DRIVER INFO DUMP END===\n");
+}
+EXPORT_SYMBOL_GPL(mwifiex_dump_drv_info);
+
 /*
  * CFG802.11 network device handler for statistics retrieval.
  */
@@ -847,26 +956,34 @@ static const struct net_device_ops mwifiex_netdev_ops = {
  *      - Nick name             : Set to null
  *      - Number of Tx timeout  : Set to 0
  *      - Device address        : Set to current address
+ *      - Rx histogram statistc : Set to 0
  *
  * In addition, the CFG80211 work queue is also created.
  */
 void mwifiex_init_priv_params(struct mwifiex_private *priv,
-                                                struct net_device *dev)
+                              struct net_device *dev)
 {
         dev->netdev_ops = &mwifiex_netdev_ops;
         dev->destructor = free_netdev;
         /* Initialize private structure */
         priv->current_key_index = 0;
         priv->media_connected = false;
-        memset(&priv->nick_name, 0, sizeof(priv->nick_name));
         memset(priv->mgmt_ie, 0,
                sizeof(struct mwifiex_ie) * MAX_MGMT_IE_INDEX);
         priv->beacon_idx = MWIFIEX_AUTO_IDX_MASK;
         priv->proberesp_idx = MWIFIEX_AUTO_IDX_MASK;
         priv->assocresp_idx = MWIFIEX_AUTO_IDX_MASK;
-        priv->rsn_idx = MWIFIEX_AUTO_IDX_MASK;
+        priv->gen_idx = MWIFIEX_AUTO_IDX_MASK;
         priv->num_tx_timeout = 0;
+        ether_addr_copy(priv->curr_addr, priv->adapter->perm_addr);
         memcpy(dev->dev_addr, priv->curr_addr, ETH_ALEN);
+
+        if (GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_STA ||
+            GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_UAP) {
+                priv->hist_data = kmalloc(sizeof(*priv->hist_data), GFP_KERNEL);
+                if (priv->hist_data)
+                        mwifiex_hist_data_reset(priv);
+        }
 }
 
 /*
@@ -1000,8 +1117,7 @@ err_init_fw:
         pr_debug("info: %s: unregister device\n", __func__);
         if (adapter->if_ops.unregister_dev)
                 adapter->if_ops.unregister_dev(adapter);
-        if ((adapter->hw_status == MWIFIEX_HW_STATUS_FW_READY) ||
-            (adapter->hw_status == MWIFIEX_HW_STATUS_READY)) {
+        if (adapter->hw_status == MWIFIEX_HW_STATUS_READY) {
                 pr_debug("info: %s: shutdown mwifiex\n", __func__);
                 adapter->init_wait_q_woken = false;
 
@@ -1052,6 +1168,8 @@ int mwifiex_remove_card(struct mwifiex_adapter *adapter, struct semaphore *sem)
 
         adapter->surprise_removed = true;
 
+        mwifiex_terminate_workqueue(adapter);
+
         /* Stop data */
         for (i = 0; i < adapter->priv_num; i++) {
                 priv = adapter->priv[i];
@@ -1086,16 +1204,15 @@ int mwifiex_remove_card(struct mwifiex_adapter *adapter, struct semaphore *sem)
                         continue;
 
                 rtnl_lock();
-                if (priv->wdev && priv->netdev)
-                        mwifiex_del_virtual_intf(adapter->wiphy, priv->wdev);
+                if (priv->netdev &&
+                    priv->wdev.iftype != NL80211_IFTYPE_UNSPECIFIED)
+                        mwifiex_del_virtual_intf(adapter->wiphy, &priv->wdev);
                 rtnl_unlock();
         }
 
         wiphy_unregister(adapter->wiphy);
         wiphy_free(adapter->wiphy);
 
-        mwifiex_terminate_workqueue(adapter);
-
         /* Unregister device */
         dev_dbg(adapter->dev, "info: unregister device\n");
         if (adapter->if_ops.unregister_dev)
diff --git a/drivers/net/wireless/mwifiex/main.h b/drivers/net/wireless/mwifiex/main.h
index e66993cb5daf..f0a6af179af0 100644
--- a/drivers/net/wireless/mwifiex/main.h
+++ b/drivers/net/wireless/mwifiex/main.h
@@ -41,6 +41,8 @@
 #include "util.h"
 #include "fw.h"
 #include "pcie.h"
+#include "usb.h"
+#include "sdio.h"
 
 extern const char driver_version[];
 
@@ -136,6 +138,8 @@ enum {
 /* Threshold for tx_timeout_cnt before we trigger a card reset */
 #define TX_TIMEOUT_THRESHOLD    6
 
+#define MWIFIEX_DRV_INFO_SIZE_MAX 0x40000
+
 struct mwifiex_dbg {
         u32 num_cmd_host_to_card_failure;
         u32 num_cmd_sleep_cfm_host_to_card_failure;
@@ -161,7 +165,6 @@ struct mwifiex_dbg {
 enum MWIFIEX_HARDWARE_STATUS {
         MWIFIEX_HW_STATUS_READY,
         MWIFIEX_HW_STATUS_INITIALIZING,
-        MWIFIEX_HW_STATUS_FW_READY,
         MWIFIEX_HW_STATUS_INIT_DONE,
         MWIFIEX_HW_STATUS_RESET,
         MWIFIEX_HW_STATUS_CLOSING,
@@ -413,6 +416,7 @@ struct mwifiex_roc_cfg {
 };
 
 #define MWIFIEX_FW_DUMP_IDX             0xff
+#define MWIFIEX_DRV_INFO_IDX            20
 #define FW_DUMP_MAX_NAME_LEN            8
 #define FW_DUMP_HOST_READY              0xEE
 #define FW_DUMP_DONE                    0xFF
@@ -543,13 +547,12 @@ struct mwifiex_private {
         u32 curr_bcn_size;
         /* spin lock for beacon buffer */
         spinlock_t curr_bcn_buf_lock;
-        struct wireless_dev *wdev;
+        struct wireless_dev wdev;
         struct mwifiex_chan_freq_power cfp;
         char version_str[128];
 #ifdef CONFIG_DEBUG_FS
         struct dentry *dfs_dev_dir;
 #endif
-        u8 nick_name[16];
         u16 current_key_index;
         struct semaphore async_sem;
         struct cfg80211_scan_request *scan_request;
@@ -564,7 +567,7 @@ struct mwifiex_private {
         u16 beacon_idx;
         u16 proberesp_idx;
         u16 assocresp_idx;
-        u16 rsn_idx;
+        u16 gen_idx;
         u8 ap_11n_enabled;
         u8 ap_11ac_enabled;
         u32 mgmt_frame_mask;
@@ -574,6 +577,7 @@ struct mwifiex_private {
         unsigned long csa_expire_time;
         u8 del_list_idx;
         bool hs2_enabled;
+        struct mwifiex_uap_bss_param bss_cfg;
         struct station_parameters *sta_params;
         struct sk_buff_head tdls_txq;
         u8 check_tdls_tx;
@@ -582,6 +586,16 @@ struct mwifiex_private {
         struct idr ack_status_frames;
         /* spin lock for ack status */
         spinlock_t ack_status_lock;
+        /** rx histogram data */
+        struct mwifiex_histogram_data *hist_data;
+        struct cfg80211_chan_def dfs_chandef;
+        struct workqueue_struct *dfs_cac_workqueue;
+        struct delayed_work dfs_cac_work;
+        struct timer_list dfs_chan_switch_timer;
+        struct workqueue_struct *dfs_chan_sw_workqueue;
+        struct delayed_work dfs_chan_sw_work;
+        struct cfg80211_beacon_data beacon_after;
+        struct mwifiex_11h_intf_state state_11h;
 };
 
 enum mwifiex_ba_status {
@@ -717,6 +731,7 @@ struct mwifiex_if_ops {
         int (*dnld_fw) (struct mwifiex_adapter *, struct mwifiex_fw_image *);
         void (*card_reset) (struct mwifiex_adapter *);
         void (*fw_dump)(struct mwifiex_adapter *);
+        int (*reg_dump)(struct mwifiex_adapter *, char *);
         int (*clean_pcie_ring) (struct mwifiex_adapter *adapter);
         void (*iface_work)(struct work_struct *work);
         void (*submit_rem_rx_urbs)(struct mwifiex_adapter *adapter);
@@ -724,6 +739,8 @@ struct mwifiex_if_ops {
 
 struct mwifiex_adapter {
         u8 iface_type;
+        struct mwifiex_iface_comb iface_limit;
+        struct mwifiex_iface_comb curr_iface_comb;
         struct mwifiex_private *priv[MWIFIEX_MAX_BSS_NUM];
         u8 priv_num;
         const struct firmware *firmware;
@@ -731,6 +748,7 @@ struct mwifiex_adapter {
         int winner;
         struct device *dev;
         struct wiphy *wiphy;
+        u8 perm_addr[ETH_ALEN];
         bool surprise_removed;
         u32 fw_release_number;
         u16 init_wait_q_woken;
@@ -744,6 +762,8 @@ struct mwifiex_adapter {
         struct work_struct main_work;
         struct workqueue_struct *rx_workqueue;
         struct work_struct rx_work;
+        struct workqueue_struct *dfs_workqueue;
+        struct work_struct dfs_work;
         bool rx_work_enabled;
         bool rx_processing;
         bool delay_main_work;
@@ -823,6 +843,7 @@ struct mwifiex_adapter {
         u16 gen_null_pkt;
         u16 pps_uapsd_mode;
         u32 pm_wakeup_fw_try;
+        struct timer_list wakeup_timer;
         u8 is_hs_configured;
         struct mwifiex_hs_config_param hs_cfg;
         u8 hs_activated;
@@ -865,6 +886,8 @@ struct mwifiex_adapter {
         struct memory_type_mapping *mem_type_mapping_tbl;
         u8 num_mem_types;
         u8 curr_mem_idx;
+        void *drv_info_dump;
+        u32 drv_info_size;
         bool scan_chan_gap_enabled;
         struct sk_buff_head rx_data_q;
         struct mwifiex_chan_stats *chan_stats;
@@ -979,7 +1002,7 @@ void mwifiex_wmm_del_peer_ra_list(struct mwifiex_private *priv,
                                   const u8 *ra_addr);
 void *mwifiex_process_sta_txpd(struct mwifiex_private *, struct sk_buff *skb);
 void *mwifiex_process_uap_txpd(struct mwifiex_private *, struct sk_buff *skb);
-int mwifiex_sta_init_cmd(struct mwifiex_private *, u8 first_sta);
+int mwifiex_sta_init_cmd(struct mwifiex_private *, u8 first_sta, bool init);
 int mwifiex_cmd_802_11_scan(struct host_cmd_ds_command *cmd,
                             struct mwifiex_scan_cmd_config *scan_cfg);
 void mwifiex_queue_scan_cmd(struct mwifiex_private *priv,
@@ -1140,6 +1163,25 @@ mwifiex_get_priv(struct mwifiex_adapter *adapter,
 }
 
 /*
+ * This function returns the first available unused private structure pointer.
+ */
+static inline struct mwifiex_private *
+mwifiex_get_unused_priv(struct mwifiex_adapter *adapter)
+{
+        int i;
+
+        for (i = 0; i < adapter->priv_num; i++) {
+                if (adapter->priv[i]) {
+                        if (adapter->priv[i]->bss_mode ==
+                            NL80211_IFTYPE_UNSPECIFIED)
+                                break;
+                }
+        }
+
+        return ((i < adapter->priv_num) ? adapter->priv[i] : NULL);
+}
+
+/*
  * This function returns the driver private structure of a network device.
  */
 static inline struct mwifiex_private *
@@ -1230,8 +1272,6 @@ int mwifiex_remain_on_chan_cfg(struct mwifiex_private *priv, u16 action,
                                struct ieee80211_channel *chan,
                                unsigned int duration);
 
-int mwifiex_set_bss_role(struct mwifiex_private *priv, u8 bss_role);
-
 int mwifiex_get_stats_info(struct mwifiex_private *priv,
                            struct mwifiex_ds_get_stats *log);
 
@@ -1291,9 +1331,17 @@ int mwifiex_set_mgmt_ies(struct mwifiex_private *priv,
                          struct cfg80211_beacon_data *data);
 int mwifiex_del_mgmt_ies(struct mwifiex_private *priv);
 u8 *mwifiex_11d_code_2_region(u8 code);
+void mwifiex_uap_set_channel(struct mwifiex_uap_bss_param *bss_cfg,
+                             struct cfg80211_chan_def chandef);
+int mwifiex_config_start_uap(struct mwifiex_private *priv,
+                             struct mwifiex_uap_bss_param *bss_cfg);
 void mwifiex_uap_del_sta_data(struct mwifiex_private *priv,
                               struct mwifiex_sta_node *node);
 
+void mwifiex_init_11h_params(struct mwifiex_private *priv);
+int mwifiex_is_11h_active(struct mwifiex_private *priv);
+int mwifiex_11h_activate(struct mwifiex_private *priv, bool flag);
+
 void mwifiex_11h_process_join(struct mwifiex_private *priv, u8 **buffer,
                               struct mwifiex_bssdescriptor *bss_desc);
 int mwifiex_11h_handle_event_chanswann(struct mwifiex_private *priv);
@@ -1324,6 +1372,8 @@ void mwifiex_process_tdls_action_frame(struct mwifiex_private *priv,
                                        u8 *buf, int len);
 int mwifiex_tdls_oper(struct mwifiex_private *priv, const u8 *peer, u8 action);
 int mwifiex_get_tdls_link_status(struct mwifiex_private *priv, const u8 *mac);
+int mwifiex_get_tdls_list(struct mwifiex_private *priv,
+                          struct tdls_peer_info *buf);
 void mwifiex_disable_all_tdls_links(struct mwifiex_private *priv);
 bool mwifiex_is_bss_in_11ac_mode(struct mwifiex_private *priv);
 u8 mwifiex_get_center_freq_index(struct mwifiex_private *priv, u8 band,
@@ -1340,6 +1390,11 @@ void mwifiex_check_auto_tdls(unsigned long context);
 void mwifiex_add_auto_tdls_peer(struct mwifiex_private *priv, const u8 *mac);
 void mwifiex_setup_auto_tdls_timer(struct mwifiex_private *priv);
 void mwifiex_clean_auto_tdls(struct mwifiex_private *priv);
+int mwifiex_cmd_issue_chan_report_request(struct mwifiex_private *priv,
+                                          struct host_cmd_ds_command *cmd,
+                                          void *data_buf);
+int mwifiex_11h_handle_chanrpt_ready(struct mwifiex_private *priv,
+                                     struct sk_buff *skb);
 
 void mwifiex_parse_tx_status_event(struct mwifiex_private *priv,
                                    void *event_body);
@@ -1347,6 +1402,21 @@ void mwifiex_parse_tx_status_event(struct mwifiex_private *priv,
 struct sk_buff *
 mwifiex_clone_skb_for_tx_status(struct mwifiex_private *priv,
                                 struct sk_buff *skb, u8 flag, u64 *cookie);
+void mwifiex_dfs_cac_work_queue(struct work_struct *work);
+void mwifiex_dfs_chan_sw_work_queue(struct work_struct *work);
+void mwifiex_abort_cac(struct mwifiex_private *priv);
+int mwifiex_11h_handle_radar_detected(struct mwifiex_private *priv,
+                                      struct sk_buff *skb);
+
+void mwifiex_hist_data_set(struct mwifiex_private *priv, u8 rx_rate, s8 snr,
+                           s8 nflr);
+void mwifiex_hist_data_reset(struct mwifiex_private *priv);
+void mwifiex_hist_data_add(struct mwifiex_private *priv,
+                           u8 rx_rate, s8 snr, s8 nflr);
+u8 mwifiex_adjust_data_rate(struct mwifiex_private *priv,
+                            u8 rx_rate, u8 ht_info);
+
+void mwifiex_dump_drv_info(struct mwifiex_adapter *adapter);
 
 #ifdef CONFIG_DEBUG_FS
 void mwifiex_debugfs_init(void);
diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
index c3a20f94f3c9..a5828da59365 100644
--- a/drivers/net/wireless/mwifiex/pcie.c
+++ b/drivers/net/wireless/mwifiex/pcie.c
@@ -204,6 +204,7 @@ static int mwifiex_pcie_probe(struct pci_dev *pdev,
                 card->pcie.blksz_fw_dl = data->blksz_fw_dl;
                 card->pcie.tx_buf_size = data->tx_buf_size;
                 card->pcie.supports_fw_dump = data->supports_fw_dump;
+                card->pcie.can_ext_scan = data->can_ext_scan;
         }
 
         if (mwifiex_add_card(card, &add_remove_card_sem, &pcie_ops,
@@ -1952,8 +1953,8 @@ static int mwifiex_prog_fw_w_helper(struct mwifiex_adapter *adapter,
                 offset += txlen;
         } while (true);
 
-        dev_dbg(adapter->dev, "info:\nFW download over, size %d bytes\n",
-                offset);
+        dev_notice(adapter->dev,
+                   "info: FW download over, size %d bytes\n", offset);
 
         ret = 0;
 
@@ -2064,6 +2065,7 @@ static void mwifiex_interrupt_status(struct mwifiex_adapter *adapter)
                                  * state until cookie is set */
                                 adapter->ps_state = PS_STATE_AWAKE;
                                 adapter->pm_wakeup_fw_try = false;
+                                del_timer(&adapter->wakeup_timer);
                 }
         }
 }
@@ -2562,6 +2564,7 @@ static int mwifiex_register_dev(struct mwifiex_adapter *adapter)
         adapter->mem_type_mapping_tbl = mem_type_mapping_tbl;
         adapter->num_mem_types = ARRAY_SIZE(mem_type_mapping_tbl);
         strcpy(adapter->fw_name, card->pcie.firmware);
+        adapter->ext_scan = card->pcie.can_ext_scan;
 
         return 0;
 }
diff --git a/drivers/net/wireless/mwifiex/pcie.h b/drivers/net/wireless/mwifiex/pcie.h
index 200e8b0cb582..666d40e9dbc3 100644
--- a/drivers/net/wireless/mwifiex/pcie.h
+++ b/drivers/net/wireless/mwifiex/pcie.h
@@ -206,6 +206,7 @@ struct mwifiex_pcie_device {
         u16 blksz_fw_dl;
         u16 tx_buf_size;
         bool supports_fw_dump;
+        bool can_ext_scan;
 };
 
 static const struct mwifiex_pcie_device mwifiex_pcie8766 = {
@@ -214,6 +215,7 @@ static const struct mwifiex_pcie_device mwifiex_pcie8766 = {
         .blksz_fw_dl = MWIFIEX_PCIE_BLOCK_SIZE_FW_DNLD,
         .tx_buf_size = MWIFIEX_TX_DATA_BUF_SIZE_2K,
         .supports_fw_dump = false,
+        .can_ext_scan = true,
 };
 
 static const struct mwifiex_pcie_device mwifiex_pcie8897 = {
@@ -222,6 +224,7 @@ static const struct mwifiex_pcie_device mwifiex_pcie8897 = {
         .blksz_fw_dl = MWIFIEX_PCIE_BLOCK_SIZE_FW_DNLD,
         .tx_buf_size = MWIFIEX_TX_DATA_BUF_SIZE_4K,
         .supports_fw_dump = true,
+        .can_ext_scan = true,
 };
 
 struct mwifiex_evt_buf_desc {
diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
index 984a7a4fa93b..0ffdb7c5afd2 100644
--- a/drivers/net/wireless/mwifiex/scan.c
+++ b/drivers/net/wireless/mwifiex/scan.c
@@ -496,10 +496,10 @@ mwifiex_scan_create_channel_list(struct mwifiex_private *priv,
 
         for (band = 0; (band < IEEE80211_NUM_BANDS) ; band++) {
 
-                if (!priv->wdev->wiphy->bands[band])
+                if (!priv->wdev.wiphy->bands[band])
                         continue;
 
-                sband = priv->wdev->wiphy->bands[band];
+                sband = priv->wdev.wiphy->bands[band];
 
                 for (i = 0; (i < sband->n_channels) ; i++) {
                         ch = &sband->channels[i];
@@ -1429,6 +1429,12 @@ int mwifiex_scan_networks(struct mwifiex_private *priv,
                 return -EBUSY;
         }
 
+        if (adapter->surprise_removed || adapter->is_cmd_timedout) {
+                dev_err(adapter->dev,
+                        "Ignore scan. Card removed or firmware in bad state\n");
+                return -EFAULT;
+        }
+
         spin_lock_irqsave(&adapter->mwifiex_cmd_lock, flags);
         adapter->scan_processing = true;
         spin_unlock_irqrestore(&adapter->mwifiex_cmd_lock, flags);
@@ -1727,10 +1733,10 @@ mwifiex_parse_single_response_buf(struct mwifiex_private *priv, u8 **bss_info,
 
                 freq = cfp ? cfp->freq : 0;
 
-                chan = ieee80211_get_channel(priv->wdev->wiphy, freq);
+                chan = ieee80211_get_channel(priv->wdev.wiphy, freq);
 
                 if (chan && !(chan->flags & IEEE80211_CHAN_DISABLED)) {
-                        bss = cfg80211_inform_bss(priv->wdev->wiphy,
+                        bss = cfg80211_inform_bss(priv->wdev.wiphy,
                                             chan, CFG80211_BSS_FTYPE_UNKNOWN,
                                             bssid, timestamp,
                                             cap_info_bitmap, beacon_period,
@@ -1742,7 +1748,7 @@ mwifiex_parse_single_response_buf(struct mwifiex_private *priv, u8 **bss_info,
                             !memcmp(bssid, priv->curr_bss_params.bss_descriptor
                                     .mac_address, ETH_ALEN))
                                 mwifiex_update_curr_bss_params(priv, bss);
-                        cfg80211_put_bss(priv->wdev->wiphy, bss);
+                        cfg80211_put_bss(priv->wdev.wiphy, bss);
                 }
         } else {
                 dev_dbg(adapter->dev, "missing BSS channel IE\n");
diff --git a/drivers/net/wireless/mwifiex/sdio.c b/drivers/net/wireless/mwifiex/sdio.c
index 933dae137850..91e36cda9543 100644
--- a/drivers/net/wireless/mwifiex/sdio.c
+++ b/drivers/net/wireless/mwifiex/sdio.c
@@ -107,6 +107,7 @@ mwifiex_sdio_probe(struct sdio_func *func, const struct sdio_device_id *id)
                 card->mp_rx_agg_buf_size = data->mp_rx_agg_buf_size;
                 card->supports_fw_dump = data->supports_fw_dump;
                 card->auto_tdls = data->auto_tdls;
+                card->can_ext_scan = data->can_ext_scan;
         }
 
         sdio_claim_host(func);
@@ -282,6 +283,9 @@ static int mwifiex_sdio_suspend(struct device *dev)
 #define SDIO_DEVICE_ID_MARVELL_8897   (0x912d)
 /* Device ID for SD8887 */
 #define SDIO_DEVICE_ID_MARVELL_8887   (0x9135)
+/* Device ID for SD8801 */
+#define SDIO_DEVICE_ID_MARVELL_8801   (0x9139)
+
 
 /* WLAN IDs */
 static const struct sdio_device_id mwifiex_ids[] = {
@@ -295,6 +299,8 @@ static const struct sdio_device_id mwifiex_ids[] = {
                 .driver_data = (unsigned long) &mwifiex_sdio_sd8897},
         {SDIO_DEVICE(SDIO_VENDOR_ID_MARVELL, SDIO_DEVICE_ID_MARVELL_8887),
                 .driver_data = (unsigned long)&mwifiex_sdio_sd8887},
+        {SDIO_DEVICE(SDIO_VENDOR_ID_MARVELL, SDIO_DEVICE_ID_MARVELL_8801),
+                .driver_data = (unsigned long)&mwifiex_sdio_sd8801},
         {},
 };
 
@@ -986,8 +992,8 @@ static int mwifiex_prog_fw_w_helper(struct mwifiex_adapter *adapter,
                 offset += txlen;
         } while (true);
 
-        dev_dbg(adapter->dev, "info: FW download over, size %d bytes\n",
-                offset);
+        dev_notice(adapter->dev,
+                   "info: FW download over, size %d bytes\n", offset);
 
         ret = 0;
 done:
@@ -1882,6 +1888,7 @@ static int mwifiex_init_sdio(struct mwifiex_adapter *adapter)
         }
 
         adapter->auto_tdls = card->auto_tdls;
+        adapter->ext_scan = card->can_ext_scan;
         return ret;
 }
 
@@ -1958,8 +1965,8 @@ static void mwifiex_sdio_card_reset_work(struct mwifiex_adapter *adapter)
 
         pr_err("Resetting card...\n");
         mmc_remove_host(target);
-        /* 20ms delay is based on experiment with sdhci controller */
-        mdelay(20);
+        /* 200ms delay is based on experiment with sdhci controller */
+        mdelay(200);
         target->rescan_entered = 0; /* rescan non-removable cards */
         mmc_add_host(target);
 }
@@ -2023,6 +2030,8 @@ static void mwifiex_sdio_fw_dump_work(struct work_struct *work)
         u32 memory_size;
         static char *env[] = { "DRIVER=mwifiex_sdio", "EVENT=fw_dump", NULL };
 
+        mwifiex_dump_drv_info(adapter);
+
         if (!card->supports_fw_dump)
                 return;
 
@@ -2166,6 +2175,99 @@ static void mwifiex_sdio_fw_dump(struct mwifiex_adapter *adapter)
         schedule_work(&adapter->iface_work);
 }
 
+/* Function to dump SDIO function registers and SDIO scratch registers in case
+ * of FW crash
+ */
+static int
+mwifiex_sdio_reg_dump(struct mwifiex_adapter *adapter, char *drv_buf)
+{
+        char *p = drv_buf;
+        struct sdio_mmc_card *cardp = adapter->card;
+        int ret = 0;
+        u8 count, func, data, index = 0, size = 0;
+        u8 reg, reg_start, reg_end;
+        char buf[256], *ptr;
+
+        if (!p)
+                return 0;
+
+        dev_info(adapter->dev, "SDIO register DUMP START\n");
+
+        mwifiex_pm_wakeup_card(adapter);
+
+        sdio_claim_host(cardp->func);
+
+        for (count = 0; count < 5; count++) {
+                memset(buf, 0, sizeof(buf));
+                ptr = buf;
+
+                switch (count) {
+                case 0:
+                        /* Read the registers of SDIO function0 */
+                        func = count;
+                        reg_start = 0;
+                        reg_end = 9;
+                        break;
+                case 1:
+                        /* Read the registers of SDIO function1 */
+                        func = count;
+                        reg_start = cardp->reg->func1_dump_reg_start;
+                        reg_end = cardp->reg->func1_dump_reg_end;
+                        break;
+                case 2:
+                        index = 0;
+                        func = 1;
+                        reg_start = cardp->reg->func1_spec_reg_table[index++];
+                        size = cardp->reg->func1_spec_reg_num;
+                        reg_end = cardp->reg->func1_spec_reg_table[size-1];
+                        break;
+                default:
+                        /* Read the scratch registers of SDIO function1 */
+                        if (count == 4)
+                                mdelay(100);
+                        func = 1;
+                        reg_start = cardp->reg->func1_scratch_reg;
+                        reg_end = reg_start + MWIFIEX_SDIO_SCRATCH_SIZE;
+                }
+
+                if (count != 2)
+                        ptr += sprintf(ptr, "SDIO Func%d (%#x-%#x): ",
+                                       func, reg_start, reg_end);
+                else
+                        ptr += sprintf(ptr, "SDIO Func%d: ", func);
+
+                for (reg = reg_start; reg <= reg_end;) {
+                        if (func == 0)
+                                data = sdio_f0_readb(cardp->func, reg, &ret);
+                        else
+                                data = sdio_readb(cardp->func, reg, &ret);
+
+                        if (count == 2)
+                                ptr += sprintf(ptr, "(%#x) ", reg);
+                        if (!ret) {
+                                ptr += sprintf(ptr, "%02x ", data);
+                        } else {
+                                ptr += sprintf(ptr, "ERR");
+                                break;
+                        }
+
+                        if (count == 2 && reg < reg_end)
+                                reg = cardp->reg->func1_spec_reg_table[index++];
+                        else
+                                reg++;
+                }
+
+                dev_info(adapter->dev, "%s\n", buf);
+                p += sprintf(p, "%s\n", buf);
+        }
+
+        sdio_release_host(cardp->func);
+
+        dev_info(adapter->dev, "SDIO register DUMP END\n");
+
+        return p - drv_buf;
+}
+
 static struct mwifiex_if_ops sdio_ops = {
         .init_if = mwifiex_init_sdio,
         .cleanup_if = mwifiex_cleanup_sdio,
@@ -2188,6 +2290,7 @@ static struct mwifiex_if_ops sdio_ops = {
         .card_reset = mwifiex_sdio_card_reset,
         .iface_work = mwifiex_sdio_work,
         .fw_dump = mwifiex_sdio_fw_dump,
+        .reg_dump = mwifiex_sdio_reg_dump,
 };
 
 /*
diff --git a/drivers/net/wireless/mwifiex/sdio.h b/drivers/net/wireless/mwifiex/sdio.h
index 54c07156dd78..957cca246618 100644
--- a/drivers/net/wireless/mwifiex/sdio.h
+++ b/drivers/net/wireless/mwifiex/sdio.h
@@ -34,6 +34,7 @@
 #define SD8797_DEFAULT_FW_NAME "mrvl/sd8797_uapsta.bin"
 #define SD8897_DEFAULT_FW_NAME "mrvl/sd8897_uapsta.bin"
 #define SD8887_DEFAULT_FW_NAME "mrvl/sd8887_uapsta.bin"
+#define SD8801_DEFAULT_FW_NAME "mrvl/sd8801_uapsta.bin"
 
 #define BLOCK_MODE      1
 #define BYTE_MODE       0
@@ -44,6 +45,9 @@
 
 #define MWIFIEX_SDIO_BYTE_MODE_MASK     0x80000000
 
+#define MWIFIEX_MAX_FUNC2_REG_NUM       13
+#define MWIFIEX_SDIO_SCRATCH_SIZE       10
+
 #define SDIO_MPA_ADDR_BASE              0x1000
 #define CTRL_PORT                       0
 #define CTRL_PORT_MASK                  0x0001
@@ -219,6 +223,11 @@ struct mwifiex_sdio_card_reg {
         u8 fw_dump_ctrl;
         u8 fw_dump_start;
         u8 fw_dump_end;
+        u8 func1_dump_reg_start;
+        u8 func1_dump_reg_end;
+        u8 func1_scratch_reg;
+        u8 func1_spec_reg_num;
+        u8 func1_spec_reg_table[MWIFIEX_MAX_FUNC2_REG_NUM];
 };
 
 struct sdio_mmc_card {
@@ -247,6 +256,7 @@ struct sdio_mmc_card {
 
         u8 *mp_regs;
         u8 auto_tdls;
+        bool can_ext_scan;
 
         struct mwifiex_sdio_mpa_tx mpa_tx;
         struct mwifiex_sdio_mpa_rx mpa_rx;
@@ -264,6 +274,7 @@ struct mwifiex_sdio_device {
         u32 mp_tx_agg_buf_size;
         u32 mp_rx_agg_buf_size;
         u8 auto_tdls;
+        bool can_ext_scan;
 };
 
 static const struct mwifiex_sdio_card_reg mwifiex_reg_sd87xx = {
@@ -291,6 +302,11 @@ static const struct mwifiex_sdio_card_reg mwifiex_reg_sd87xx = {
         .rd_len_p0_l = 0x08,
         .rd_len_p0_u = 0x09,
         .card_misc_cfg_reg = 0x6c,
+        .func1_dump_reg_start = 0x0,
+        .func1_dump_reg_end = 0x9,
+        .func1_scratch_reg = 0x60,
+        .func1_spec_reg_num = 5,
+        .func1_spec_reg_table = {0x28, 0x30, 0x34, 0x38, 0x3c},
 };
 
 static const struct mwifiex_sdio_card_reg mwifiex_reg_sd8897 = {
@@ -335,6 +351,12 @@ static const struct mwifiex_sdio_card_reg mwifiex_reg_sd8897 = {
         .fw_dump_ctrl = 0xe2,
         .fw_dump_start = 0xe3,
         .fw_dump_end = 0xea,
+        .func1_dump_reg_start = 0x0,
+        .func1_dump_reg_end = 0xb,
+        .func1_scratch_reg = 0xc0,
+        .func1_spec_reg_num = 8,
+        .func1_spec_reg_table = {0x4C, 0x50, 0x54, 0x55, 0x58,
+                                 0x59, 0x5c, 0x5d},
 };
 
 static const struct mwifiex_sdio_card_reg mwifiex_reg_sd8887 = {
@@ -376,6 +398,13 @@ static const struct mwifiex_sdio_card_reg mwifiex_reg_sd8887 = {
         .cmd_cfg_1 = 0xc5,
         .cmd_cfg_2 = 0xc6,
         .cmd_cfg_3 = 0xc7,
+        .func1_dump_reg_start = 0x10,
+        .func1_dump_reg_end = 0x17,
+        .func1_scratch_reg = 0x90,
+        .func1_spec_reg_num = 13,
+        .func1_spec_reg_table = {0x08, 0x58, 0x5C, 0x5D, 0x60,
+                                 0x61, 0x62, 0x64, 0x65, 0x66,
+                                 0x68, 0x69, 0x6a},
 };
 
 static const struct mwifiex_sdio_device mwifiex_sdio_sd8786 = {
@@ -390,6 +419,7 @@ static const struct mwifiex_sdio_device mwifiex_sdio_sd8786 = {
         .mp_rx_agg_buf_size = MWIFIEX_MP_AGGR_BUF_SIZE_16K,
         .supports_fw_dump = false,
         .auto_tdls = false,
+        .can_ext_scan = false,
 };
 
 static const struct mwifiex_sdio_device mwifiex_sdio_sd8787 = {
@@ -404,6 +434,7 @@ static const struct mwifiex_sdio_device mwifiex_sdio_sd8787 = {
         .mp_rx_agg_buf_size = MWIFIEX_MP_AGGR_BUF_SIZE_16K,
         .supports_fw_dump = false,
         .auto_tdls = false,
+        .can_ext_scan = true,
 };
 
 static const struct mwifiex_sdio_device mwifiex_sdio_sd8797 = {
@@ -418,6 +449,7 @@ static const struct mwifiex_sdio_device mwifiex_sdio_sd8797 = {
         .mp_rx_agg_buf_size = MWIFIEX_MP_AGGR_BUF_SIZE_16K,
         .supports_fw_dump = false,
         .auto_tdls = false,
+        .can_ext_scan = true,
 };
 
 static const struct mwifiex_sdio_device mwifiex_sdio_sd8897 = {
@@ -432,6 +464,7 @@ static const struct mwifiex_sdio_device mwifiex_sdio_sd8897 = {
         .mp_rx_agg_buf_size = MWIFIEX_MP_AGGR_BUF_SIZE_32K,
         .supports_fw_dump = true,
         .auto_tdls = false,
+        .can_ext_scan = true,
 };
 
 static const struct mwifiex_sdio_device mwifiex_sdio_sd8887 = {
@@ -446,6 +479,22 @@ static const struct mwifiex_sdio_device mwifiex_sdio_sd8887 = {
         .mp_rx_agg_buf_size = MWIFIEX_MP_AGGR_BUF_SIZE_32K,
         .supports_fw_dump = false,
         .auto_tdls = true,
+        .can_ext_scan = true,
+};
+
+static const struct mwifiex_sdio_device mwifiex_sdio_sd8801 = {
+        .firmware = SD8801_DEFAULT_FW_NAME,
+        .reg = &mwifiex_reg_sd87xx,
+        .max_ports = 16,
+        .mp_agg_pkt_limit = 8,
+        .supports_sdio_new_mode = false,
+        .has_control_mask = true,
+        .tx_buf_size = MWIFIEX_TX_DATA_BUF_SIZE_2K,
+        .mp_tx_agg_buf_size = MWIFIEX_MP_AGGR_BUF_SIZE_16K,
+        .mp_rx_agg_buf_size = MWIFIEX_MP_AGGR_BUF_SIZE_16K,
+        .supports_fw_dump = false,
+        .auto_tdls = false,
+        .can_ext_scan = true,
 };
 
 /*
diff --git a/drivers/net/wireless/mwifiex/sta_cmd.c b/drivers/net/wireless/mwifiex/sta_cmd.c
index 1c2ca291d1f5..f7d204ffd6e9 100644
--- a/drivers/net/wireless/mwifiex/sta_cmd.c
+++ b/drivers/net/wireless/mwifiex/sta_cmd.c
@@ -26,6 +26,10 @@
 #include "11n.h"
 #include "11ac.h"
 
+static bool disable_auto_ds;
+module_param(disable_auto_ds, bool, 0);
+MODULE_PARM_DESC(disable_auto_ds,
+                 "deepsleep enabled=0(default), deepsleep disabled=1");
 /*
  * This function prepares command to set/get RSSI information.
  *
@@ -1893,6 +1897,10 @@ int mwifiex_sta_prepare_cmd(struct mwifiex_private *priv, uint16_t cmd_no,
         case HostCmd_CMD_TDLS_OPER:
                 ret = mwifiex_cmd_tdls_oper(priv, cmd_ptr, data_buf);
                 break;
+        case HostCmd_CMD_CHAN_REPORT_REQUEST:
+                ret = mwifiex_cmd_issue_chan_report_request(priv, cmd_ptr,
+                                                            data_buf);
+                break;
         default:
                 dev_err(priv->adapter->dev,
                         "PREP_CMD: unknown cmd- %#x\n", cmd_no);
@@ -1907,6 +1915,8 @@ int mwifiex_sta_prepare_cmd(struct mwifiex_private *priv, uint16_t cmd_no,
  *
  * This is called after firmware download to bring the card to
  * working state.
+ * Function is also called during reinitialization of virtual
+ * interfaces.
  *
  * The following commands are issued sequentially -
  *      - Set PCI-Express host buffer configuration (PCIE only)
@@ -1921,7 +1931,7 @@ int mwifiex_sta_prepare_cmd(struct mwifiex_private *priv, uint16_t cmd_no,
  *      - Set 11d control
  *      - Set MAC control (this must be the last command to initialize firmware)
  */
-int mwifiex_sta_init_cmd(struct mwifiex_private *priv, u8 first_sta)
+int mwifiex_sta_init_cmd(struct mwifiex_private *priv, u8 first_sta, bool init)
 {
         struct mwifiex_adapter *adapter = priv->adapter;
         int ret;
@@ -2031,7 +2041,8 @@ int mwifiex_sta_init_cmd(struct mwifiex_private *priv, u8 first_sta)
         if (ret)
                 return -1;
 
-        if (first_sta && priv->adapter->iface_type != MWIFIEX_USB &&
+        if (!disable_auto_ds &&
+            first_sta && priv->adapter->iface_type != MWIFIEX_USB &&
             priv->bss_type != MWIFIEX_BSS_TYPE_UAP) {
                 /* Enable auto deep sleep */
                 auto_ds.auto_ds = DEEP_SLEEP_ON;
@@ -2054,9 +2065,6 @@ int mwifiex_sta_init_cmd(struct mwifiex_private *priv, u8 first_sta)
                                 "11D: failed to enable 11D\n");
         }
 
-        /* set last_init_cmd before sending the command */
-        priv->adapter->last_init_cmd = HostCmd_CMD_11N_CFG;
-
         /* Send cmd to FW to configure 11n specific configuration
          * (Short GI, Channel BW, Green field support etc.) for transmit
          */
@@ -2064,7 +2072,11 @@ int mwifiex_sta_init_cmd(struct mwifiex_private *priv, u8 first_sta)
         ret = mwifiex_send_cmd(priv, HostCmd_CMD_11N_CFG,
                                HostCmd_ACT_GEN_SET, 0, &tx_cfg, true);
 
-        ret = -EINPROGRESS;
+        if (init) {
+                /* set last_init_cmd before sending the command */
+                priv->adapter->last_init_cmd = HostCmd_CMD_11N_CFG;
+                ret = -EINPROGRESS;
+        }
 
         return ret;
 }
diff --git a/drivers/net/wireless/mwifiex/sta_cmdresp.c b/drivers/net/wireless/mwifiex/sta_cmdresp.c
index b65e1014b0fc..5f8da5924666 100644
--- a/drivers/net/wireless/mwifiex/sta_cmdresp.c
+++ b/drivers/net/wireless/mwifiex/sta_cmdresp.c
@@ -248,6 +248,8 @@ static int mwifiex_ret_get_log(struct mwifiex_private *priv,
                         le32_to_cpu(get_log->wep_icv_err_cnt[2]);
                 stats->wep_icv_error[3] =
                         le32_to_cpu(get_log->wep_icv_err_cnt[3]);
+                stats->bcn_rcv_cnt = le32_to_cpu(get_log->bcn_rcv_cnt);
+                stats->bcn_miss_cnt = le32_to_cpu(get_log->bcn_miss_cnt);
         }
 
         return 0;
@@ -1103,6 +1105,9 @@ int mwifiex_process_sta_cmdresp(struct mwifiex_private *priv, u16 cmdresp_no,
         case HostCmd_CMD_UAP_SYS_CONFIG:
                 break;
         case HostCmd_CMD_UAP_BSS_START:
+                adapter->tx_lock_flag = false;
+                adapter->pps_uapsd_mode = false;
+                adapter->delay_null_pkt = false;
                 priv->bss_started = 1;
                 break;
         case HostCmd_CMD_UAP_BSS_STOP:
@@ -1117,6 +1122,8 @@ int mwifiex_process_sta_cmdresp(struct mwifiex_private *priv, u16 cmdresp_no,
         case HostCmd_CMD_TDLS_OPER:
                 ret = mwifiex_ret_tdls_oper(priv, resp);
                 break;
+        case HostCmd_CMD_CHAN_REPORT_REQUEST:
+                break;
         default:
                 dev_err(adapter->dev, "CMD_RESP: unknown cmd response %#x\n",
                         resp->command);
diff --git a/drivers/net/wireless/mwifiex/sta_event.c b/drivers/net/wireless/mwifiex/sta_event.c
index b8c171df6223..80ffe7412496 100644
--- a/drivers/net/wireless/mwifiex/sta_event.c
+++ b/drivers/net/wireless/mwifiex/sta_event.c
@@ -90,6 +90,10 @@ mwifiex_reset_connect_state(struct mwifiex_private *priv, u16 reason_code)
         priv->is_data_rate_auto = true;
         priv->data_rate = 0;
 
+        if ((GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_STA ||
+             GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_UAP) && priv->hist_data)
+                mwifiex_hist_data_reset(priv);
+
         if (priv->bss_mode == NL80211_IFTYPE_ADHOC) {
                 priv->adhoc_state = ADHOC_IDLE;
                 priv->adhoc_is_link_sensed = false;
@@ -308,6 +312,7 @@ int mwifiex_process_sta_event(struct mwifiex_private *priv)
                                         adapter->ps_state = PS_STATE_AWAKE;
                                         adapter->pm_wakeup_card_req = false;
                                         adapter->pm_wakeup_fw_try = false;
+                                        del_timer_sync(&adapter->wakeup_timer);
                                         break;
                                 }
                                 if (!mwifiex_send_null_packet
@@ -322,6 +327,7 @@ int mwifiex_process_sta_event(struct mwifiex_private *priv)
                 adapter->ps_state = PS_STATE_AWAKE;
                 adapter->pm_wakeup_card_req = false;
                 adapter->pm_wakeup_fw_try = false;
+                del_timer_sync(&adapter->wakeup_timer);
 
                 break;
 
@@ -480,7 +486,7 @@ int mwifiex_process_sta_event(struct mwifiex_private *priv)
 
         case EVENT_REMAIN_ON_CHAN_EXPIRED:
                 dev_dbg(adapter->dev, "event: Remain on channel expired\n");
-                cfg80211_remain_on_channel_expired(priv->wdev,
+                cfg80211_remain_on_channel_expired(&priv->wdev,
                                                    priv->roc_cfg.cookie,
                                                    &priv->roc_cfg.chan,
                                                    GFP_ATOMIC);
@@ -509,6 +515,16 @@ int mwifiex_process_sta_event(struct mwifiex_private *priv)
                 mwifiex_parse_tx_status_event(priv, adapter->event_body);
                 break;
 
+        case EVENT_CHANNEL_REPORT_RDY:
+                dev_dbg(adapter->dev, "event: Channel Report\n");
+                ret = mwifiex_11h_handle_chanrpt_ready(priv,
+                                                       adapter->event_skb);
+                break;
+        case EVENT_RADAR_DETECTED:
+                dev_dbg(adapter->dev, "event: Radar detected\n");
+                ret = mwifiex_11h_handle_radar_detected(priv,
+                                                        adapter->event_skb);
+                break;
         default:
                 dev_dbg(adapter->dev, "event: unknown event id: %#x\n",
                         eventcause);
diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c
index 1626868a4b5c..0599e41e253c 100644
--- a/drivers/net/wireless/mwifiex/sta_ioctl.c
+++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
@@ -219,7 +219,7 @@ static int mwifiex_process_country_ie(struct mwifiex_private *priv,
 
         if (!strncmp(priv->adapter->country_code, &country_ie[2], 2)) {
                 rcu_read_unlock();
-                wiphy_dbg(priv->wdev->wiphy,
+                wiphy_dbg(priv->wdev.wiphy,
                           "11D: skip setting domain info in FW\n");
                 return 0;
         }
@@ -902,9 +902,12 @@ static int mwifiex_sec_ioctl_set_wep_key(struct mwifiex_private *priv,
         if (wep_key->key_length) {
                 void *enc_key;
 
-                if (encrypt_key->key_disable)
+                if (encrypt_key->key_disable) {
                         memset(&priv->wep_key[index], 0,
                                sizeof(struct mwifiex_wep_key));
+                        if (wep_key->key_length)
+                                goto done;
+                        }
 
                 if (adapter->key_api_major_ver == KEY_API_VER_MAJOR_V2)
                         enc_key = encrypt_key;
@@ -918,6 +921,7 @@ static int mwifiex_sec_ioctl_set_wep_key(struct mwifiex_private *priv,
                         return ret;
         }
 
+done:
         if (priv->sec_info.wep_enabled)
                 priv->curr_pkt_filter |= HostCmd_ACT_MAC_WEP_ENABLE;
         else
@@ -1131,36 +1135,6 @@ mwifiex_remain_on_chan_cfg(struct mwifiex_private *priv, u16 action,
         return roc_cfg.status;
 }
 
-int
-mwifiex_set_bss_role(struct mwifiex_private *priv, u8 bss_role)
-{
-        if (GET_BSS_ROLE(priv) == bss_role) {
-                dev_dbg(priv->adapter->dev,
-                        "info: already in the desired role.\n");
-                return 0;
-        }
-
-        mwifiex_free_priv(priv);
-        mwifiex_init_priv(priv);
-
-        priv->bss_role = bss_role;
-        switch (bss_role) {
-        case MWIFIEX_BSS_ROLE_UAP:
-                priv->bss_mode = NL80211_IFTYPE_AP;
-                break;
-        case MWIFIEX_BSS_ROLE_STA:
-        case MWIFIEX_BSS_ROLE_ANY:
-        default:
-                priv->bss_mode = NL80211_IFTYPE_STATION;
-                break;
-        }
-
-        mwifiex_send_cmd(priv, HostCmd_CMD_SET_BSS_MODE,
-                         HostCmd_ACT_GEN_SET, 0, NULL, true);
-
-        return mwifiex_sta_init_cmd(priv, false);
-}
-
 /*
  * Sends IOCTL request to get statistics information.
  *
diff --git a/drivers/net/wireless/mwifiex/sta_rx.c b/drivers/net/wireless/mwifiex/sta_rx.c
index c2ad3b63ae70..b8729c9394e9 100644
--- a/drivers/net/wireless/mwifiex/sta_rx.c
+++ b/drivers/net/wireless/mwifiex/sta_rx.c
@@ -90,6 +90,7 @@ int mwifiex_process_rx_packet(struct mwifiex_private *priv,
         struct ethhdr *eth;
         u16 rx_pkt_off, rx_pkt_len;
         u8 *offset;
+        u8 adj_rx_rate = 0;
 
         local_rx_pd = (struct rxpd *) (skb->data);
 
@@ -155,6 +156,14 @@ int mwifiex_process_rx_packet(struct mwifiex_private *priv,
 
         priv->rxpd_htinfo = local_rx_pd->ht_info;
 
+        if (GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_STA ||
+            GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_UAP) {
+                adj_rx_rate = mwifiex_adjust_data_rate(priv, priv->rxpd_rate,
+                                                       priv->rxpd_htinfo);
+                mwifiex_hist_data_add(priv, adj_rx_rate, local_rx_pd->snr,
+                                      local_rx_pd->nf);
+        }
+
         ret = mwifiex_recv_packet(priv, skb);
         if (ret == -1)
                 dev_err(priv->adapter->dev, "recv packet failed\n");
diff --git a/drivers/net/wireless/mwifiex/sta_tx.c b/drivers/net/wireless/mwifiex/sta_tx.c
index b896d7375b52..5ce2d9a4f919 100644
--- a/drivers/net/wireless/mwifiex/sta_tx.c
+++ b/drivers/net/wireless/mwifiex/sta_tx.c
@@ -47,8 +47,10 @@ void *mwifiex_process_sta_txpd(struct mwifiex_private *priv,
         struct mwifiex_adapter *adapter = priv->adapter;
         struct txpd *local_tx_pd;
         struct mwifiex_txinfo *tx_info = MWIFIEX_SKB_TXCB(skb);
-        u8 pad;
+        unsigned int pad;
         u16 pkt_type, pkt_offset;
+        int hroom = (priv->adapter->iface_type == MWIFIEX_USB) ? 0 :
+                       INTF_HEADER_LEN;
 
         if (!skb->len) {
                 dev_err(adapter->dev, "Tx: bad packet length: %d\n", skb->len);
@@ -56,13 +58,12 @@ void *mwifiex_process_sta_txpd(struct mwifiex_private *priv,
                 return skb->data;
         }
 
-        pkt_type = mwifiex_is_skb_mgmt_frame(skb) ? PKT_TYPE_MGMT : 0;
+        BUG_ON(skb_headroom(skb) < MWIFIEX_MIN_DATA_HEADER_LEN);
 
-        /* If skb->data is not aligned; add padding */
-        pad = (4 - (((void *)skb->data - NULL) & 0x3)) % 4;
+        pkt_type = mwifiex_is_skb_mgmt_frame(skb) ? PKT_TYPE_MGMT : 0;
 
-        BUG_ON(skb_headroom(skb) < (sizeof(*local_tx_pd) + INTF_HEADER_LEN
-                                    + pad));
+        pad = ((void *)skb->data - (sizeof(*local_tx_pd) + hroom)-
+                         NULL) & (MWIFIEX_DMA_ALIGN_SZ - 1);
         skb_push(skb, sizeof(*local_tx_pd) + pad);
 
         local_tx_pd = (struct txpd *) skb->data;
@@ -70,8 +71,8 @@ void *mwifiex_process_sta_txpd(struct mwifiex_private *priv,
         local_tx_pd->bss_num = priv->bss_num;
         local_tx_pd->bss_type = priv->bss_type;
         local_tx_pd->tx_pkt_length = cpu_to_le16((u16)(skb->len -
-                                                       (sizeof(struct txpd)
-                                                        + pad)));
+                                                       (sizeof(struct txpd) +
+                                                        pad)));
 
         local_tx_pd->priority = (u8) skb->priority;
         local_tx_pd->pkt_delay_2ms =
@@ -115,7 +116,7 @@ void *mwifiex_process_sta_txpd(struct mwifiex_private *priv,
         local_tx_pd->tx_pkt_offset = cpu_to_le16(pkt_offset);
 
         /* make space for INTF_HEADER_LEN */
-        skb_push(skb, INTF_HEADER_LEN);
+        skb_push(skb, hroom);
 
         if (!local_tx_pd->tx_control)
                 /* TxCtrl set by user or default */
@@ -182,9 +183,13 @@ int mwifiex_send_null_packet(struct mwifiex_private *priv, u8 flags)
         }
         switch (ret) {
         case -EBUSY:
-                adapter->data_sent = true;
-                /* Fall through FAILURE handling */
+                dev_kfree_skb_any(skb);
+                dev_err(adapter->dev, "%s: host_to_card failed: ret=%d\n",
+                        __func__, ret);
+                adapter->dbg.num_tx_host_to_card_failure++;
+                break;
         case -1:
+                adapter->data_sent = false;
                 dev_kfree_skb_any(skb);
                 dev_err(adapter->dev, "%s: host_to_card failed: ret=%d\n",
                         __func__, ret);
@@ -197,6 +202,7 @@ int mwifiex_send_null_packet(struct mwifiex_private *priv, u8 flags)
                 adapter->tx_lock_flag = true;
                 break;
         case -EINPROGRESS:
+                adapter->tx_lock_flag = true;
                 break;
         default:
                 break;
diff --git a/drivers/net/wireless/mwifiex/tdls.c b/drivers/net/wireless/mwifiex/tdls.c
index 22884b429be7..087d84762cd3 100644
--- a/drivers/net/wireless/mwifiex/tdls.c
+++ b/drivers/net/wireless/mwifiex/tdls.c
@@ -1123,6 +1123,36 @@ int mwifiex_get_tdls_link_status(struct mwifiex_private *priv, const u8 *mac)
         return TDLS_NOT_SETUP;
 }
 
+int mwifiex_get_tdls_list(struct mwifiex_private *priv,
+                          struct tdls_peer_info *buf)
+{
+        struct mwifiex_sta_node *sta_ptr;
+        struct tdls_peer_info *peer = buf;
+        int count = 0;
+        unsigned long flags;
+
+        if (!ISSUPP_TDLS_ENABLED(priv->adapter->fw_cap_info))
+                return 0;
+
+        /* make sure we are in station mode and connected */
+        if (!(priv->bss_type == MWIFIEX_BSS_TYPE_STA && priv->media_connected))
+                return 0;
+
+        spin_lock_irqsave(&priv->sta_list_spinlock, flags);
+        list_for_each_entry(sta_ptr, &priv->sta_list, list) {
+                if (sta_ptr->tdls_status == TDLS_SETUP_COMPLETE) {
+                        ether_addr_copy(peer->peer_addr, sta_ptr->mac_addr);
+                        peer++;
+                        count++;
+                        if (count >= MWIFIEX_MAX_TDLS_PEER_SUPPORTED)
+                                break;
+                }
+        }
+        spin_unlock_irqrestore(&priv->sta_list_spinlock, flags);
+
+        return count;
+}
+
 void mwifiex_disable_all_tdls_links(struct mwifiex_private *priv)
 {
         struct mwifiex_sta_node *sta_ptr;
@@ -1367,9 +1397,8 @@ void mwifiex_check_auto_tdls(unsigned long context)
 
 void mwifiex_setup_auto_tdls_timer(struct mwifiex_private *priv)
 {
-        init_timer(&priv->auto_tdls_timer);
-        priv->auto_tdls_timer.function = mwifiex_check_auto_tdls;
-        priv->auto_tdls_timer.data = (unsigned long)priv;
+        setup_timer(&priv->auto_tdls_timer, mwifiex_check_auto_tdls,
+                    (unsigned long)priv);
         priv->auto_tdls_timer_active = true;
         mod_timer(&priv->auto_tdls_timer,
                   jiffies + msecs_to_jiffies(MWIFIEX_TIMER_10S));
diff --git a/drivers/net/wireless/mwifiex/txrx.c b/drivers/net/wireless/mwifiex/txrx.c
index 6ae133333363..ac93557cbdc9 100644
--- a/drivers/net/wireless/mwifiex/txrx.c
+++ b/drivers/net/wireless/mwifiex/txrx.c
@@ -227,7 +227,7 @@ void mwifiex_parse_tx_status_event(struct mwifiex_private *priv,
                         /* consumes ack_skb */
                         skb_complete_wifi_ack(ack_skb, !tx_status->status);
                 } else {
-                        cfg80211_mgmt_tx_status(priv->wdev, tx_info->cookie,
+                        cfg80211_mgmt_tx_status(&priv->wdev, tx_info->cookie,
                                                 ack_skb->data, ack_skb->len,
                                                 !tx_status->status, GFP_ATOMIC);
                         dev_kfree_skb_any(ack_skb);
diff --git a/drivers/net/wireless/mwifiex/uap_cmd.c b/drivers/net/wireless/mwifiex/uap_cmd.c
index 0f347fdefa0a..f5c2af01ba0a 100644
--- a/drivers/net/wireless/mwifiex/uap_cmd.c
+++ b/drivers/net/wireless/mwifiex/uap_cmd.c
@@ -761,6 +761,11 @@ int mwifiex_uap_prepare_cmd(struct mwifiex_private *priv, u16 cmd_no,
                 if (mwifiex_cmd_uap_sta_deauth(priv, cmd, data_buf))
                         return -1;
                 break;
+        case HostCmd_CMD_CHAN_REPORT_REQUEST:
+                if (mwifiex_cmd_issue_chan_report_request(priv, cmd_buf,
+                                                          data_buf))
+                        return -1;
+                break;
         default:
                 dev_err(priv->adapter->dev,
                         "PREP_CMD: unknown cmd %#x\n", cmd_no);
@@ -769,3 +774,68 @@ int mwifiex_uap_prepare_cmd(struct mwifiex_private *priv, u16 cmd_no,
 
         return 0;
 }
+
+void mwifiex_uap_set_channel(struct mwifiex_uap_bss_param *bss_cfg,
+                             struct cfg80211_chan_def chandef)
+{
+        u8 config_bands = 0;
+
+        bss_cfg->channel = ieee80211_frequency_to_channel(
+                                                     chandef.chan->center_freq);
+
+        /* Set appropriate bands */
+        if (chandef.chan->band == IEEE80211_BAND_2GHZ) {
+                bss_cfg->band_cfg = BAND_CONFIG_BG;
+                config_bands = BAND_B | BAND_G;
+
+                if (chandef.width > NL80211_CHAN_WIDTH_20_NOHT)
+                        config_bands |= BAND_GN;
+        } else {
+                bss_cfg->band_cfg = BAND_CONFIG_A;
+                config_bands = BAND_A;
+
+                if (chandef.width > NL80211_CHAN_WIDTH_20_NOHT)
+                        config_bands |= BAND_AN;
+
+                if (chandef.width > NL80211_CHAN_WIDTH_40)
+                        config_bands |= BAND_AAC;
+        }
+}
+
+int mwifiex_config_start_uap(struct mwifiex_private *priv,
+                             struct mwifiex_uap_bss_param *bss_cfg)
+{
+        if (mwifiex_del_mgmt_ies(priv))
+                dev_err(priv->adapter->dev, "Failed to delete mgmt IEs!\n");
+
+        if (mwifiex_send_cmd(priv, HostCmd_CMD_UAP_BSS_STOP,
+                             HostCmd_ACT_GEN_SET, 0, NULL, true)) {
+                dev_err(priv->adapter->dev, "Failed to stop the BSS\n");
+                return -1;
+        }
+
+        if (mwifiex_send_cmd(priv, HostCmd_CMD_UAP_SYS_CONFIG,
+                             HostCmd_ACT_GEN_SET,
+                             UAP_BSS_PARAMS_I, bss_cfg, false)) {
+                dev_err(priv->adapter->dev, "Failed to set the SSID\n");
+                return -1;
+        }
+
+        if (mwifiex_send_cmd(priv, HostCmd_CMD_UAP_BSS_START,
+                             HostCmd_ACT_GEN_SET, 0, NULL, false)) {
+                dev_err(priv->adapter->dev, "Failed to start the BSS\n");
+                return -1;
+        }
+
+        if (priv->sec_info.wep_enabled)
+                priv->curr_pkt_filter |= HostCmd_ACT_MAC_WEP_ENABLE;
+        else
+                priv->curr_pkt_filter &= ~HostCmd_ACT_MAC_WEP_ENABLE;
+
+        if (mwifiex_send_cmd(priv, HostCmd_CMD_MAC_CONTROL,
+                             HostCmd_ACT_GEN_SET, 0,
+                             &priv->curr_pkt_filter, true))
+                return -1;
+
+        return 0;
+}
diff --git a/drivers/net/wireless/mwifiex/uap_event.c b/drivers/net/wireless/mwifiex/uap_event.c
index c54a537e31fb..f4794cdc36d2 100644
--- a/drivers/net/wireless/mwifiex/uap_event.c
+++ b/drivers/net/wireless/mwifiex/uap_event.c
@@ -68,7 +68,6 @@ int mwifiex_process_uap_event(struct mwifiex_private *priv)
                                 len = ETH_ALEN;
 
                         if (len != -1) {
-                                sinfo.filled = STATION_INFO_ASSOC_REQ_IES;
                                 sinfo.assoc_req_ies = &event->data[len];
                                 len = (u8 *)sinfo.assoc_req_ies -
                                       (u8 *)&event->frame_control;
@@ -132,6 +131,8 @@ int mwifiex_process_uap_event(struct mwifiex_private *priv)
                 dev_dbg(adapter->dev, "AP EVENT: event id: %#x\n", eventcause);
                 memcpy(priv->netdev->dev_addr, adapter->event_body + 2,
                        ETH_ALEN);
+                if (priv->hist_data)
+                        mwifiex_hist_data_reset(priv);
                 break;
         case EVENT_UAP_MIC_COUNTERMEASURES:
                 /* For future development */
@@ -177,6 +178,53 @@ int mwifiex_process_uap_event(struct mwifiex_private *priv)
                 dev_dbg(adapter->dev, "event: TX_STATUS Report\n");
                 mwifiex_parse_tx_status_event(priv, adapter->event_body);
                 break;
+        case EVENT_PS_SLEEP:
+                dev_dbg(adapter->dev, "info: EVENT: SLEEP\n");
+
+                adapter->ps_state = PS_STATE_PRE_SLEEP;
+
+                mwifiex_check_ps_cond(adapter);
+                break;
+
+        case EVENT_PS_AWAKE:
+                dev_dbg(adapter->dev, "info: EVENT: AWAKE\n");
+                if (!adapter->pps_uapsd_mode &&
+                    priv->media_connected && adapter->sleep_period.period) {
+                                adapter->pps_uapsd_mode = true;
+                                dev_dbg(adapter->dev,
+                                        "event: PPS/UAPSD mode activated\n");
+                }
+                adapter->tx_lock_flag = false;
+                if (adapter->pps_uapsd_mode && adapter->gen_null_pkt) {
+                        if (mwifiex_check_last_packet_indication(priv)) {
+                                if (adapter->data_sent) {
+                                        adapter->ps_state = PS_STATE_AWAKE;
+                                        adapter->pm_wakeup_card_req = false;
+                                        adapter->pm_wakeup_fw_try = false;
+                                        break;
+                                }
+                                if (!mwifiex_send_null_packet
+                                        (priv,
+                                         MWIFIEX_TxPD_POWER_MGMT_NULL_PACKET |
+                                         MWIFIEX_TxPD_POWER_MGMT_LAST_PACKET))
+                                                adapter->ps_state =
+                                                        PS_STATE_SLEEP;
+                                        return 0;
+                        }
+                }
+                adapter->ps_state = PS_STATE_AWAKE;
+                adapter->pm_wakeup_card_req = false;
+                adapter->pm_wakeup_fw_try = false;
+                break;
+
+        case EVENT_CHANNEL_REPORT_RDY:
+                dev_dbg(adapter->dev, "event: Channel Report\n");
+                mwifiex_11h_handle_chanrpt_ready(priv, adapter->event_skb);
+                break;
+        case EVENT_RADAR_DETECTED:
+                dev_dbg(adapter->dev, "event: Radar detected\n");
+                mwifiex_11h_handle_radar_detected(priv, adapter->event_skb);
+                break;
         default:
                 dev_dbg(adapter->dev, "event: unknown event id: %#x\n",
                         eventcause);
diff --git a/drivers/net/wireless/mwifiex/uap_txrx.c b/drivers/net/wireless/mwifiex/uap_txrx.c
index be3a203a529b..38ac4d74c486 100644
--- a/drivers/net/wireless/mwifiex/uap_txrx.c
+++ b/drivers/net/wireless/mwifiex/uap_txrx.c
@@ -348,8 +348,10 @@ void *mwifiex_process_uap_txpd(struct mwifiex_private *priv,
         struct mwifiex_adapter *adapter = priv->adapter;
         struct uap_txpd *txpd;
         struct mwifiex_txinfo *tx_info = MWIFIEX_SKB_TXCB(skb);
-        int pad, len;
-        u16 pkt_type;
+        int pad;
+        u16 pkt_type, pkt_offset;
+        int hroom = (priv->adapter->iface_type == MWIFIEX_USB) ? 0 :
+                       INTF_HEADER_LEN;
 
         if (!skb->len) {
                 dev_err(adapter->dev, "Tx: bad packet length: %d\n", skb->len);
@@ -357,22 +359,21 @@ void *mwifiex_process_uap_txpd(struct mwifiex_private *priv,
                 return skb->data;
         }
 
-        pkt_type = mwifiex_is_skb_mgmt_frame(skb) ? PKT_TYPE_MGMT : 0;
-
-        /* If skb->data is not aligned, add padding */
-        pad = (4 - (((void *)skb->data - NULL) & 0x3)) % 4;
+        BUG_ON(skb_headroom(skb) < MWIFIEX_MIN_DATA_HEADER_LEN);
 
-        len = sizeof(*txpd) + pad;
+        pkt_type = mwifiex_is_skb_mgmt_frame(skb) ? PKT_TYPE_MGMT : 0;
 
-        BUG_ON(skb_headroom(skb) < len + INTF_HEADER_LEN);
+        pad = ((void *)skb->data - (sizeof(*txpd) + hroom) - NULL) &
+                        (MWIFIEX_DMA_ALIGN_SZ - 1);
 
-        skb_push(skb, len);
+        skb_push(skb, sizeof(*txpd) + pad);
 
         txpd = (struct uap_txpd *)skb->data;
         memset(txpd, 0, sizeof(*txpd));
         txpd->bss_num = priv->bss_num;
         txpd->bss_type = priv->bss_type;
-        txpd->tx_pkt_length = cpu_to_le16((u16)(skb->len - len));
+        txpd->tx_pkt_length = cpu_to_le16((u16)(skb->len - (sizeof(*txpd) +
+                                                pad)));
         txpd->priority = (u8)skb->priority;
 
         txpd->pkt_delay_2ms = mwifiex_wmm_compute_drv_pkt_delay(priv, skb);
@@ -392,16 +393,17 @@ void *mwifiex_process_uap_txpd(struct mwifiex_private *priv,
                     cpu_to_le32(priv->wmm.user_pri_pkt_tx_ctrl[txpd->priority]);
 
         /* Offset of actual data */
+        pkt_offset = sizeof(*txpd) + pad;
         if (pkt_type == PKT_TYPE_MGMT) {
                 /* Set the packet type and add header for management frame */
                 txpd->tx_pkt_type = cpu_to_le16(pkt_type);
-                len += MWIFIEX_MGMT_FRAME_HEADER_SIZE;
+                pkt_offset += MWIFIEX_MGMT_FRAME_HEADER_SIZE;
         }
 
-        txpd->tx_pkt_offset = cpu_to_le16(len);
+        txpd->tx_pkt_offset = cpu_to_le16(pkt_offset);
 
         /* make space for INTF_HEADER_LEN */
-        skb_push(skb, INTF_HEADER_LEN);
+        skb_push(skb, hroom);
 
         if (!txpd->tx_control)
                 /* TxCtrl set by user or default */
diff --git a/drivers/net/wireless/mwifiex/usb.c b/drivers/net/wireless/mwifiex/usb.c
index 1b56495ec872..223873022ffe 100644
--- a/drivers/net/wireless/mwifiex/usb.c
+++ b/drivers/net/wireless/mwifiex/usb.c
@@ -37,6 +37,11 @@ static struct usb_device_id mwifiex_usb_table[] = {
         {USB_DEVICE_AND_INTERFACE_INFO(USB8XXX_VID, USB8797_PID_2,
                                        USB_CLASS_VENDOR_SPEC,
                                        USB_SUBCLASS_VENDOR_SPEC, 0xff)},
+        /* 8801 */
+        {USB_DEVICE(USB8XXX_VID, USB8801_PID_1)},
+        {USB_DEVICE_AND_INTERFACE_INFO(USB8XXX_VID, USB8801_PID_2,
+                                       USB_CLASS_VENDOR_SPEC,
+                                       USB_SUBCLASS_VENDOR_SPEC, 0xff)},
         /* 8897 */
         {USB_DEVICE(USB8XXX_VID, USB8897_PID_1)},
         {USB_DEVICE_AND_INTERFACE_INFO(USB8XXX_VID, USB8897_PID_2,
@@ -361,11 +366,13 @@ static int mwifiex_usb_probe(struct usb_interface *intf,
         switch (id_product) {
         case USB8766_PID_1:
         case USB8797_PID_1:
+        case USB8801_PID_1:
         case USB8897_PID_1:
                 card->usb_boot_state = USB8XXX_FW_DNLD;
                 break;
         case USB8766_PID_2:
         case USB8797_PID_2:
+        case USB8801_PID_2:
         case USB8897_PID_2:
                 card->usb_boot_state = USB8XXX_FW_READY;
                 break;
@@ -792,11 +799,19 @@ static int mwifiex_register_dev(struct mwifiex_adapter *adapter)
         case USB8897_PID_2:
                 adapter->tx_buf_size = MWIFIEX_TX_DATA_BUF_SIZE_4K;
                 strcpy(adapter->fw_name, USB8897_DEFAULT_FW_NAME);
+                adapter->ext_scan = true;
                 break;
         case USB8766_PID_1:
         case USB8766_PID_2:
                 adapter->tx_buf_size = MWIFIEX_TX_DATA_BUF_SIZE_2K;
                 strcpy(adapter->fw_name, USB8766_DEFAULT_FW_NAME);
+                adapter->ext_scan = true;
+                break;
+        case USB8801_PID_1:
+        case USB8801_PID_2:
+                adapter->tx_buf_size = MWIFIEX_TX_DATA_BUF_SIZE_2K;
+                strcpy(adapter->fw_name, USB8801_DEFAULT_FW_NAME);
+                adapter->ext_scan = false;
                 break;
         case USB8797_PID_1:
         case USB8797_PID_2:
@@ -930,7 +945,8 @@ static int mwifiex_prog_fw_w_helper(struct mwifiex_adapter *adapter,
         } while ((dnld_cmd != FW_HAS_LAST_BLOCK) && retries);
 
 cleanup:
-        dev_dbg(adapter->dev, "%s: %d bytes downloaded\n", __func__, tlen);
+        dev_notice(adapter->dev,
+                   "info: FW download over, size %d bytes\n", tlen);
 
         kfree(recv_buff);
         kfree(fwdata);
@@ -990,6 +1006,7 @@ static int mwifiex_pm_wakeup_card(struct mwifiex_adapter *adapter)
 {
         /* Simulation of HS_AWAKE event */
         adapter->pm_wakeup_fw_try = false;
+        del_timer_sync(&adapter->wakeup_timer);
         adapter->pm_wakeup_card_req = false;
         adapter->ps_state = PS_STATE_AWAKE;
 
@@ -1010,6 +1027,13 @@ static void mwifiex_usb_submit_rem_rx_urbs(struct mwifiex_adapter *adapter)
         }
 }
 
+/* This function is called after the card has woken up. */
+static inline int
+mwifiex_pm_wakeup_card_complete(struct mwifiex_adapter *adapter)
+{
+        return 0;
+}
+
 static struct mwifiex_if_ops usb_ops = {
         .register_dev =         mwifiex_register_dev,
         .unregister_dev =       mwifiex_unregister_dev,
@@ -1074,4 +1098,5 @@ MODULE_VERSION(USB_VERSION);
 MODULE_LICENSE("GPL v2");
 MODULE_FIRMWARE(USB8766_DEFAULT_FW_NAME);
 MODULE_FIRMWARE(USB8797_DEFAULT_FW_NAME);
+MODULE_FIRMWARE(USB8801_DEFAULT_FW_NAME);
 MODULE_FIRMWARE(USB8897_DEFAULT_FW_NAME);
diff --git a/drivers/net/wireless/mwifiex/usb.h b/drivers/net/wireless/mwifiex/usb.h
index a7cbba1355af..57e1a5736318 100644
--- a/drivers/net/wireless/mwifiex/usb.h
+++ b/drivers/net/wireless/mwifiex/usb.h
@@ -30,6 +30,9 @@
 #define USB8797_PID_2           0x2044
 #define USB8897_PID_1           0x2045
 #define USB8897_PID_2           0x2046
+#define USB8801_PID_1           0x2049
+#define USB8801_PID_2           0x204a
+
 
 #define USB8XXX_FW_DNLD         1
 #define USB8XXX_FW_READY        2
@@ -41,6 +44,7 @@
 
 #define USB8766_DEFAULT_FW_NAME "mrvl/usb8766_uapsta.bin"
 #define USB8797_DEFAULT_FW_NAME "mrvl/usb8797_uapsta.bin"
+#define USB8801_DEFAULT_FW_NAME "mrvl/usb8801_uapsta.bin"
 #define USB8897_DEFAULT_FW_NAME "mrvl/usb8897_uapsta.bin"
 
 #define FW_DNLD_TX_BUF_SIZE     620
@@ -96,11 +100,4 @@ struct fw_data {
         u8 data[1];
 };
 
-/* This function is called after the card has woken up. */
-static inline int
-mwifiex_pm_wakeup_card_complete(struct mwifiex_adapter *adapter)
-{
-        return 0;
-}
-
 #endif /*_MWIFIEX_USB_H */
diff --git a/drivers/net/wireless/mwifiex/util.c b/drivers/net/wireless/mwifiex/util.c
index b1768fbf98f2..308550611f22 100644
--- a/drivers/net/wireless/mwifiex/util.c
+++ b/drivers/net/wireless/mwifiex/util.c
@@ -25,6 +25,96 @@
 #include "wmm.h"
 #include "11n.h"
 
+static struct mwifiex_debug_data items[] = {
+        {"int_counter", item_size(int_counter),
+         item_addr(int_counter), 1},
+        {"wmm_ac_vo", item_size(packets_out[WMM_AC_VO]),
+         item_addr(packets_out[WMM_AC_VO]), 1},
+        {"wmm_ac_vi", item_size(packets_out[WMM_AC_VI]),
+         item_addr(packets_out[WMM_AC_VI]), 1},
+        {"wmm_ac_be", item_size(packets_out[WMM_AC_BE]),
+         item_addr(packets_out[WMM_AC_BE]), 1},
+        {"wmm_ac_bk", item_size(packets_out[WMM_AC_BK]),
+         item_addr(packets_out[WMM_AC_BK]), 1},
+        {"tx_buf_size", item_size(tx_buf_size),
+         item_addr(tx_buf_size), 1},
+        {"curr_tx_buf_size", item_size(curr_tx_buf_size),
+         item_addr(curr_tx_buf_size), 1},
+        {"ps_mode", item_size(ps_mode),
+         item_addr(ps_mode), 1},
+        {"ps_state", item_size(ps_state),
+         item_addr(ps_state), 1},
+        {"is_deep_sleep", item_size(is_deep_sleep),
+         item_addr(is_deep_sleep), 1},
+        {"wakeup_dev_req", item_size(pm_wakeup_card_req),
+         item_addr(pm_wakeup_card_req), 1},
+        {"wakeup_tries", item_size(pm_wakeup_fw_try),
+         item_addr(pm_wakeup_fw_try), 1},
+        {"hs_configured", item_size(is_hs_configured),
+         item_addr(is_hs_configured), 1},
+        {"hs_activated", item_size(hs_activated),
+         item_addr(hs_activated), 1},
+        {"num_tx_timeout", item_size(num_tx_timeout),
+         item_addr(num_tx_timeout), 1},
+        {"is_cmd_timedout", item_size(is_cmd_timedout),
+         item_addr(is_cmd_timedout), 1},
+        {"timeout_cmd_id", item_size(timeout_cmd_id),
+         item_addr(timeout_cmd_id), 1},
+        {"timeout_cmd_act", item_size(timeout_cmd_act),
+         item_addr(timeout_cmd_act), 1},
+        {"last_cmd_id", item_size(last_cmd_id),
+         item_addr(last_cmd_id), DBG_CMD_NUM},
+        {"last_cmd_act", item_size(last_cmd_act),
+         item_addr(last_cmd_act), DBG_CMD_NUM},
+        {"last_cmd_index", item_size(last_cmd_index),
+         item_addr(last_cmd_index), 1},
+        {"last_cmd_resp_id", item_size(last_cmd_resp_id),
+         item_addr(last_cmd_resp_id), DBG_CMD_NUM},
+        {"last_cmd_resp_index", item_size(last_cmd_resp_index),
+         item_addr(last_cmd_resp_index), 1},
+        {"last_event", item_size(last_event),
+         item_addr(last_event), DBG_CMD_NUM},
+        {"last_event_index", item_size(last_event_index),
+         item_addr(last_event_index), 1},
+        {"num_cmd_h2c_fail", item_size(num_cmd_host_to_card_failure),
+         item_addr(num_cmd_host_to_card_failure), 1},
+        {"num_cmd_sleep_cfm_fail",
+         item_size(num_cmd_sleep_cfm_host_to_card_failure),
+         item_addr(num_cmd_sleep_cfm_host_to_card_failure), 1},
+        {"num_tx_h2c_fail", item_size(num_tx_host_to_card_failure),
+         item_addr(num_tx_host_to_card_failure), 1},
+        {"num_evt_deauth", item_size(num_event_deauth),
+         item_addr(num_event_deauth), 1},
+        {"num_evt_disassoc", item_size(num_event_disassoc),
+         item_addr(num_event_disassoc), 1},
+        {"num_evt_link_lost", item_size(num_event_link_lost),
+         item_addr(num_event_link_lost), 1},
+        {"num_cmd_deauth", item_size(num_cmd_deauth),
+         item_addr(num_cmd_deauth), 1},
+        {"num_cmd_assoc_ok", item_size(num_cmd_assoc_success),
+         item_addr(num_cmd_assoc_success), 1},
+        {"num_cmd_assoc_fail", item_size(num_cmd_assoc_failure),
+         item_addr(num_cmd_assoc_failure), 1},
+        {"cmd_sent", item_size(cmd_sent),
+         item_addr(cmd_sent), 1},
+        {"data_sent", item_size(data_sent),
+         item_addr(data_sent), 1},
+        {"cmd_resp_received", item_size(cmd_resp_received),
+         item_addr(cmd_resp_received), 1},
+        {"event_received", item_size(event_received),
+         item_addr(event_received), 1},
+
+        /* variables defined in struct mwifiex_adapter */
+        {"cmd_pending", adapter_item_size(cmd_pending),
+         adapter_item_addr(cmd_pending), 1},
+        {"tx_pending", adapter_item_size(tx_pending),
+         adapter_item_addr(tx_pending), 1},
+        {"rx_pending", adapter_item_size(rx_pending),
+         adapter_item_addr(rx_pending), 1},
+};
+
+static int num_of_items = ARRAY_SIZE(items);
+
 /*
  * Firmware initialization complete callback handler.
  *
@@ -97,6 +187,8 @@ int mwifiex_get_debug_info(struct mwifiex_private *priv,
                                                               info->rx_tbl);
                 info->tx_tbl_num = mwifiex_get_tx_ba_stream_tbl(priv,
                                                                 info->tx_tbl);
+                info->tdls_peer_num = mwifiex_get_tdls_list(priv,
+                                                            info->tdls_list);
                 info->ps_mode = adapter->ps_mode;
                 info->ps_state = adapter->ps_state;
                 info->is_deep_sleep = adapter->is_deep_sleep;
@@ -141,6 +233,93 @@ int mwifiex_get_debug_info(struct mwifiex_private *priv,
         return 0;
 }
 
+int mwifiex_debug_info_to_buffer(struct mwifiex_private *priv, char *buf,
+                                 struct mwifiex_debug_info *info)
+{
+        char *p = buf;
+        struct mwifiex_debug_data *d = &items[0];
+        size_t size, addr;
+        long val;
+        int i, j;
+
+        if (!info)
+                return 0;
+
+        for (i = 0; i < num_of_items; i++) {
+                p += sprintf(p, "%s=", d[i].name);
+
+                size = d[i].size / d[i].num;
+
+                if (i < (num_of_items - 3))
+                        addr = d[i].addr + (size_t)info;
+                else /* The last 3 items are struct mwifiex_adapter variables */
+                        addr = d[i].addr + (size_t)priv->adapter;
+
+                for (j = 0; j < d[i].num; j++) {
+                        switch (size) {
+                        case 1:
+                                val = *((u8 *)addr);
+                                break;
+                        case 2:
+                                val = *((u16 *)addr);
+                                break;
+                        case 4:
+                                val = *((u32 *)addr);
+                                break;
+                        case 8:
+                                val = *((long long *)addr);
+                                break;
+                        default:
+                                val = -1;
+                                break;
+                        }
+
+                        p += sprintf(p, "%#lx ", val);
+                        addr += size;
+                }
+
+                p += sprintf(p, "\n");
+        }
+
+        if (info->tx_tbl_num) {
+                p += sprintf(p, "Tx BA stream table:\n");
+                for (i = 0; i < info->tx_tbl_num; i++)
+                        p += sprintf(p, "tid = %d, ra = %pM\n",
+                                     info->tx_tbl[i].tid, info->tx_tbl[i].ra);
+        }
+
+        if (info->rx_tbl_num) {
+                p += sprintf(p, "Rx reorder table:\n");
+                for (i = 0; i < info->rx_tbl_num; i++) {
+                        p += sprintf(p, "tid = %d, ta = %pM, ",
+                                     info->rx_tbl[i].tid,
+                                     info->rx_tbl[i].ta);
+                        p += sprintf(p, "start_win = %d, ",
+                                     info->rx_tbl[i].start_win);
+                        p += sprintf(p, "win_size = %d, buffer: ",
+                                     info->rx_tbl[i].win_size);
+
+                        for (j = 0; j < info->rx_tbl[i].win_size; j++)
+                                p += sprintf(p, "%c ",
+                                             info->rx_tbl[i].buffer[j] ?
+                                             '1' : '0');
+
+                        p += sprintf(p, "\n");
+                }
+        }
+
+        if (info->tdls_peer_num) {
+                p += sprintf(p, "TDLS peer table:\n");
+                for (i = 0; i < info->tdls_peer_num; i++) {
+                        p += sprintf(p, "peer = %pM",
+                                     info->tdls_list[i].peer_addr);
+                        p += sprintf(p, "\n");
+                }
+        }
+
+        return p - buf;
+}
+
 static int
 mwifiex_parse_mgmt_packet(struct mwifiex_private *priv, u8 *payload, u16 len,
                           struct rxpd *rx_pd)
@@ -208,7 +387,7 @@ mwifiex_process_mgmt_packet(struct mwifiex_private *priv,
         pkt_len -= ETH_ALEN + sizeof(pkt_len);
         rx_pd->rx_pkt_length = cpu_to_le16(pkt_len);
 
-        cfg80211_rx_mgmt(priv->wdev, priv->roc_cfg.chan.center_freq,
+        cfg80211_rx_mgmt(&priv->wdev, priv->roc_cfg.chan.center_freq,
                          CAL_RSSI(rx_pd->snr, rx_pd->nf), skb->data, pkt_len,
                          0);
 
@@ -404,3 +583,44 @@ void mwifiex_del_all_sta_list(struct mwifiex_private *priv)
         spin_unlock_irqrestore(&priv->sta_list_spinlock, flags);
         return;
 }
+
+/* This function adds histogram data to histogram array*/
+void mwifiex_hist_data_add(struct mwifiex_private *priv,
+                           u8 rx_rate, s8 snr, s8 nflr)
+{
+        struct mwifiex_histogram_data *phist_data = priv->hist_data;
+
+        if (atomic_read(&phist_data->num_samples) > MWIFIEX_HIST_MAX_SAMPLES)
+                mwifiex_hist_data_reset(priv);
+        mwifiex_hist_data_set(priv, rx_rate, snr, nflr);
+}
+
+/* function to add histogram record */
+void mwifiex_hist_data_set(struct mwifiex_private *priv, u8 rx_rate, s8 snr,
+                           s8 nflr)
+{
+        struct mwifiex_histogram_data *phist_data = priv->hist_data;
+
+        atomic_inc(&phist_data->num_samples);
+        atomic_inc(&phist_data->rx_rate[rx_rate]);
+        atomic_inc(&phist_data->snr[snr]);
+        atomic_inc(&phist_data->noise_flr[128 + nflr]);
+        atomic_inc(&phist_data->sig_str[nflr - snr]);
+}
+
+/* function to reset histogram data during init/reset */
+void mwifiex_hist_data_reset(struct mwifiex_private *priv)
+{
+        int ix;
+        struct mwifiex_histogram_data *phist_data = priv->hist_data;
+
+        atomic_set(&phist_data->num_samples, 0);
+        for (ix = 0; ix < MWIFIEX_MAX_AC_RX_RATES; ix++)
+                atomic_set(&phist_data->rx_rate[ix], 0);
+        for (ix = 0; ix < MWIFIEX_MAX_SNR; ix++)
+                atomic_set(&phist_data->snr[ix], 0);
+        for (ix = 0; ix < MWIFIEX_MAX_NOISE_FLR; ix++)
+                atomic_set(&phist_data->noise_flr[ix], 0);
+        for (ix = 0; ix < MWIFIEX_MAX_SIG_STRENGTH; ix++)
+                atomic_set(&phist_data->sig_str[ix], 0);
+}
diff --git a/drivers/net/wireless/mwifiex/util.h b/drivers/net/wireless/mwifiex/util.h
index 40296cb4a3f1..b541d66c01eb 100644
--- a/drivers/net/wireless/mwifiex/util.h
+++ b/drivers/net/wireless/mwifiex/util.h
@@ -20,6 +20,8 @@
 #ifndef _MWIFIEX_UTIL_H_
 #define _MWIFIEX_UTIL_H_
 
+struct mwifiex_private;
+
 struct mwifiex_dma_mapping {
         dma_addr_t addr;
         size_t len;
@@ -33,6 +35,21 @@ struct mwifiex_cb {
         };
 };
 
+/* size/addr for mwifiex_debug_info */
+#define item_size(n)            (FIELD_SIZEOF(struct mwifiex_debug_info, n))
+#define item_addr(n)            (offsetof(struct mwifiex_debug_info, n))
+
+/* size/addr for struct mwifiex_adapter */
+#define adapter_item_size(n)    (FIELD_SIZEOF(struct mwifiex_adapter, n))
+#define adapter_item_addr(n)    (offsetof(struct mwifiex_adapter, n))
+
+struct mwifiex_debug_data {
+        char name[32];          /* variable/array name */
+        u32 size;               /* size of the variable/array */
+        size_t addr;            /* address of the variable/array */
+        int num;                /* number of variables in an array */
+};
+
 static inline struct mwifiex_rxinfo *MWIFIEX_SKB_RXCB(struct sk_buff *skb)
 {
         struct mwifiex_cb *cb = (struct mwifiex_cb *)skb->cb;
@@ -73,4 +90,7 @@ static inline dma_addr_t MWIFIEX_SKB_DMA_ADDR(struct sk_buff *skb)
         return mapping.addr;
 }
 
+int mwifiex_debug_info_to_buffer(struct mwifiex_private *priv, char *buf,
+                                 struct mwifiex_debug_info *info);
+
 #endif /* !_MWIFIEX_UTIL_H_ */
diff --git a/drivers/net/wireless/mwifiex/wmm.c b/drivers/net/wireless/mwifiex/wmm.c
index ffffd2c5a76e..ef717acec8b7 100644
--- a/drivers/net/wireless/mwifiex/wmm.c
+++ b/drivers/net/wireless/mwifiex/wmm.c
@@ -1228,6 +1228,9 @@ mwifiex_send_processed_packet(struct mwifiex_private *priv,
         case -EINPROGRESS:
                 if (adapter->iface_type != MWIFIEX_PCIE)
                         adapter->data_sent = false;
+                break;
+        case 0:
+                mwifiex_write_data_complete(adapter, skb, 0, ret);
         default:
                 break;
         }
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index b8d1e04aa9b9..f9b1218c761a 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -3098,14 +3098,14 @@ static void mwl8k_update_survey(struct mwl8k_priv *priv,
 
         cca_cnt = ioread32(priv->regs + NOK_CCA_CNT_REG);
         cca_cnt /= 1000; /* uSecs to mSecs */
-        survey->channel_time_busy = (u64) cca_cnt;
+        survey->time_busy = (u64) cca_cnt;
 
         rx_rdy = ioread32(priv->regs + BBU_RXRDY_CNT_REG);
         rx_rdy /= 1000; /* uSecs to mSecs */
-        survey->channel_time_rx = (u64) rx_rdy;
+        survey->time_rx = (u64) rx_rdy;
 
         priv->channel_time = jiffies - priv->channel_time;
-        survey->channel_time = jiffies_to_msecs(priv->channel_time);
+        survey->time = jiffies_to_msecs(priv->channel_time);
 
         survey->channel = channel;
 
@@ -3115,9 +3115,9 @@ static void mwl8k_update_survey(struct mwl8k_priv *priv,
         survey->noise = nf * -1;
 
         survey->filled = SURVEY_INFO_NOISE_DBM |
-                         SURVEY_INFO_CHANNEL_TIME |
-                         SURVEY_INFO_CHANNEL_TIME_BUSY |
-                         SURVEY_INFO_CHANNEL_TIME_RX;
+                         SURVEY_INFO_TIME |
+                         SURVEY_INFO_TIME_BUSY |
+                         SURVEY_INFO_TIME_RX;
 }
 
 /*
diff --git a/drivers/net/wireless/orinoco/Kconfig b/drivers/net/wireless/orinoco/Kconfig
index 60698b020851..6d831d4d1b5f 100644
--- a/drivers/net/wireless/orinoco/Kconfig
+++ b/drivers/net/wireless/orinoco/Kconfig
@@ -1,7 +1,8 @@
 config HERMES
         tristate "Hermes chipset 802.11b support (Orinoco/Prism2/Symbol)"
         depends on (PPC_PMAC || PCI || PCMCIA)
-        depends on CFG80211 && CFG80211_WEXT
+        depends on CFG80211
+        select CFG80211_WEXT
         select WIRELESS_EXT
         select WEXT_SPY
         select WEXT_PRIV
diff --git a/drivers/net/wireless/orinoco/main.c b/drivers/net/wireless/orinoco/main.c
index 38ec8d19ac29..c410180479e6 100644
--- a/drivers/net/wireless/orinoco/main.c
+++ b/drivers/net/wireless/orinoco/main.c
@@ -2342,7 +2342,7 @@ void free_orinocodev(struct orinoco_private *priv)
         list_for_each_entry_safe(sd, sdtemp, &priv->scan_list, list) {
                 list_del(&sd->list);
 
-                if ((sd->len > 0) && sd->buf)
+                if (sd->len > 0)
                         kfree(sd->buf);
                 kfree(sd);
         }
diff --git a/drivers/net/wireless/orinoco/orinoco_pci.c b/drivers/net/wireless/orinoco/orinoco_pci.c
index b6bdad632842..74219d59d7e1 100644
--- a/drivers/net/wireless/orinoco/orinoco_pci.c
+++ b/drivers/net/wireless/orinoco/orinoco_pci.c
@@ -94,7 +94,7 @@ static int orinoco_pci_cor_reset(struct orinoco_private *priv)
         mdelay(HERMES_PCI_COR_OFFT);
 
         /* The card is ready when it's no longer busy */
-        timeout = jiffies + (HERMES_PCI_COR_BUSYT * HZ / 1000);
+        timeout = jiffies + msecs_to_jiffies(HERMES_PCI_COR_BUSYT);
         reg = hermes_read_regn(hw, CMD);
         while (time_before(jiffies, timeout) && (reg & HERMES_CMD_BUSY)) {
                 mdelay(1);
diff --git a/drivers/net/wireless/orinoco/orinoco_plx.c b/drivers/net/wireless/orinoco/orinoco_plx.c
index b8f6e5c431ae..8b045236b6e0 100644
--- a/drivers/net/wireless/orinoco/orinoco_plx.c
+++ b/drivers/net/wireless/orinoco/orinoco_plx.c
@@ -121,7 +121,7 @@ static int orinoco_plx_cor_reset(struct orinoco_private *priv)
         mdelay(1);
 
         /* Just in case, wait more until the card is no longer busy */
-        timeout = jiffies + (PLX_RESET_TIME * HZ / 1000);
+        timeout = jiffies + msecs_to_jiffies(PLX_RESET_TIME);
         reg = hermes_read_regn(hw, CMD);
         while (time_before(jiffies, timeout) && (reg & HERMES_CMD_BUSY)) {
                 mdelay(1);
diff --git a/drivers/net/wireless/orinoco/orinoco_tmd.c b/drivers/net/wireless/orinoco/orinoco_tmd.c
index 79d0e33b625e..20ce569b8a43 100644
--- a/drivers/net/wireless/orinoco/orinoco_tmd.c
+++ b/drivers/net/wireless/orinoco/orinoco_tmd.c
@@ -71,7 +71,7 @@ static int orinoco_tmd_cor_reset(struct orinoco_private *priv)
         mdelay(1);
 
         /* Just in case, wait more until the card is no longer busy */
-        timeout = jiffies + (TMD_RESET_TIME * HZ / 1000);
+        timeout = jiffies + msecs_to_jiffies(TMD_RESET_TIME);
         reg = hermes_read_regn(hw, CMD);
         while (time_before(jiffies, timeout) && (reg & HERMES_CMD_BUSY)) {
                 mdelay(1);
diff --git a/drivers/net/wireless/orinoco/orinoco_usb.c b/drivers/net/wireless/orinoco/orinoco_usb.c
index 995846422dc0..91f05442de28 100644
--- a/drivers/net/wireless/orinoco/orinoco_usb.c
+++ b/drivers/net/wireless/orinoco/orinoco_usb.c
@@ -364,9 +364,7 @@ static struct request_context *ezusb_alloc_ctx(struct ezusb_priv *upriv,
         atomic_set(&ctx->refcount, 1);
         init_completion(&ctx->done);
 
-        init_timer(&ctx->timer);
-        ctx->timer.function = ezusb_request_timerfn;
-        ctx->timer.data = (u_long) ctx;
+        setup_timer(&ctx->timer, ezusb_request_timerfn, (u_long)ctx);
         return ctx;
 }
 
diff --git a/drivers/net/wireless/p54/eeprom.c b/drivers/net/wireless/p54/eeprom.c
index 0fe67d2da208..2fe713eda7ad 100644
--- a/drivers/net/wireless/p54/eeprom.c
+++ b/drivers/net/wireless/p54/eeprom.c
@@ -196,9 +196,9 @@ static int p54_generate_band(struct ieee80211_hw *dev,
                 dest->max_power = chan->max_power;
                 priv->survey[*chan_num].channel = &tmp->channels[j];
                 priv->survey[*chan_num].filled = SURVEY_INFO_NOISE_DBM |
-                        SURVEY_INFO_CHANNEL_TIME |
-                        SURVEY_INFO_CHANNEL_TIME_BUSY |
-                        SURVEY_INFO_CHANNEL_TIME_TX;
+                        SURVEY_INFO_TIME |
+                        SURVEY_INFO_TIME_BUSY |
+                        SURVEY_INFO_TIME_TX;
                 dest->hw_value = (*chan_num);
                 j++;
                 (*chan_num)++;
diff --git a/drivers/net/wireless/p54/fwio.c b/drivers/net/wireless/p54/fwio.c
index bc065e8e348b..5367d510b22d 100644
--- a/drivers/net/wireless/p54/fwio.c
+++ b/drivers/net/wireless/p54/fwio.c
@@ -220,6 +220,7 @@ int p54_download_eeprom(struct p54_common *priv, void *buf,
         struct sk_buff *skb;
         size_t eeprom_hdr_size;
         int ret = 0;
+        long timeout;
 
         if (priv->fw_var >= 0x509)
                 eeprom_hdr_size = sizeof(*eeprom_hdr);
@@ -249,9 +250,11 @@ int p54_download_eeprom(struct p54_common *priv, void *buf,
 
         p54_tx(priv, skb);
 
-        if (!wait_for_completion_interruptible_timeout(
-             &priv->eeprom_comp, HZ)) {
-                wiphy_err(priv->hw->wiphy, "device does not respond!\n");
+        timeout = wait_for_completion_interruptible_timeout(
+                        &priv->eeprom_comp, HZ);
+        if (timeout <= 0) {
+                wiphy_err(priv->hw->wiphy,
+                        "device does not respond or signal received!\n");
                 ret = -EBUSY;
         }
         priv->eeprom = NULL;
diff --git a/drivers/net/wireless/p54/main.c b/drivers/net/wireless/p54/main.c
index 97aeff0edb84..b9250d75d253 100644
--- a/drivers/net/wireless/p54/main.c
+++ b/drivers/net/wireless/p54/main.c
@@ -305,9 +305,9 @@ static void p54_reset_stats(struct p54_common *priv)
                 struct survey_info *info = &priv->survey[chan->hw_value];
 
                 /* only reset channel statistics, don't touch .filled, etc. */
-                info->channel_time = 0;
-                info->channel_time_busy = 0;
-                info->channel_time_tx = 0;
+                info->time = 0;
+                info->time_busy = 0;
+                info->time_tx = 0;
         }
 
         priv->update_stats = true;
@@ -575,6 +575,8 @@ static int p54_set_key(struct ieee80211_hw *dev, enum set_key_cmd cmd,
                         key->hw_key_idx = 0xff;
                         goto out_unlock;
                 }
+
+                key->flags |= IEEE80211_KEY_FLAG_RESERVE_TAILROOM;
         } else {
                 slot = key->hw_key_idx;
 
@@ -634,7 +636,7 @@ static int p54_get_survey(struct ieee80211_hw *dev, int idx,
 
                 if (in_use) {
                         /* test if the reported statistics are valid. */
-                        if  (survey->channel_time != 0) {
+                        if  (survey->time != 0) {
                                 survey->filled |= SURVEY_INFO_IN_USE;
                         } else {
                                 /*
diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
index d4aee64fb5ea..27a49068d32d 100644
--- a/drivers/net/wireless/p54/p54pci.c
+++ b/drivers/net/wireless/p54/p54pci.c
@@ -431,6 +431,7 @@ static int p54p_open(struct ieee80211_hw *dev)
 {
         struct p54p_priv *priv = dev->priv;
         int err;
+        long timeout;
 
         init_completion(&priv->boot_comp);
         err = request_irq(priv->pdev->irq, p54p_interrupt,
@@ -468,10 +469,12 @@ static int p54p_open(struct ieee80211_hw *dev)
         P54P_WRITE(dev_int, cpu_to_le32(ISL38XX_DEV_INT_RESET));
         P54P_READ(dev_int);
 
-        if (!wait_for_completion_interruptible_timeout(&priv->boot_comp, HZ)) {
+        timeout = wait_for_completion_interruptible_timeout(
+                        &priv->boot_comp, HZ);
+        if (timeout <= 0) {
                 wiphy_err(dev->wiphy, "Cannot boot firmware!\n");
                 p54p_stop(dev);
-                return -ETIMEDOUT;
+                return timeout ? -ERESTARTSYS : -ETIMEDOUT;
         }
 
         P54P_WRITE(int_enable, cpu_to_le32(ISL38XX_INT_IDENT_UPDATE));
diff --git a/drivers/net/wireless/p54/txrx.c b/drivers/net/wireless/p54/txrx.c
index 153c61539ec8..24e5ff9a9272 100644
--- a/drivers/net/wireless/p54/txrx.c
+++ b/drivers/net/wireless/p54/txrx.c
@@ -587,13 +587,13 @@ static void p54_rx_stats(struct p54_common *priv, struct sk_buff *skb)
         if (chan) {
                 struct survey_info *survey = &priv->survey[chan->hw_value];
                 survey->noise = clamp(priv->noise, -128, 127);
-                survey->channel_time = priv->survey_raw.active;
-                survey->channel_time_tx = priv->survey_raw.tx;
-                survey->channel_time_busy = priv->survey_raw.tx +
+                survey->time = priv->survey_raw.active;
+                survey->time_tx = priv->survey_raw.tx;
+                survey->time_busy = priv->survey_raw.tx +
                         priv->survey_raw.cca;
-                do_div(survey->channel_time, 1024);
-                do_div(survey->channel_time_tx, 1024);
-                do_div(survey->channel_time_busy, 1024);
+                do_div(survey->time, 1024);
+                do_div(survey->time_tx, 1024);
+                do_div(survey->time_busy, 1024);
         }
 
         tmp = p54_find_and_unlink_skb(priv, hdr->req_id);
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index 1a4facd1fbf3..60d44ce9c017 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -2478,7 +2478,7 @@ static void rndis_fill_station_info(struct usbnet *usbdev,
         ret = rndis_query_oid(usbdev, RNDIS_OID_GEN_LINK_SPEED, &linkspeed, &len);
         if (ret == 0) {
                 sinfo->txrate.legacy = le32_to_cpu(linkspeed) / 1000;
-                sinfo->filled |= STATION_INFO_TX_BITRATE;
+                sinfo->filled |= BIT(NL80211_STA_INFO_TX_BITRATE);
         }
 
         len = sizeof(rssi);
@@ -2486,7 +2486,7 @@ static void rndis_fill_station_info(struct usbnet *usbdev,
                               &rssi, &len);
         if (ret == 0) {
                 sinfo->signal = level_to_qual(le32_to_cpu(rssi));
-                sinfo->filled |= STATION_INFO_SIGNAL;
+                sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
         }
 }
 
diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c b/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c
index 4834a9abc171..b6cc9ff47fc2 100644
--- a/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c
+++ b/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c
@@ -172,7 +172,6 @@ static int rsi_load_ta_instructions(struct rsi_common *common)
                 (struct rsi_91x_sdiodev *)adapter->rsi_dev;
         u32 len;
         u32 num_blocks;
-        const u8 *fw;
         const struct firmware *fw_entry = NULL;
         u32 block_size = dev->tx_blk_size;
         int status = 0;
@@ -201,7 +200,6 @@ static int rsi_load_ta_instructions(struct rsi_common *common)
                 return status;
         }
 
-        fw = kmemdup(fw_entry->data, fw_entry->size, GFP_KERNEL);
         len = fw_entry->size;
 
         if (len % 4)
@@ -212,7 +210,7 @@ static int rsi_load_ta_instructions(struct rsi_common *common)
         rsi_dbg(INIT_ZONE, "%s: Instruction size:%d\n", __func__, len);
         rsi_dbg(INIT_ZONE, "%s: num blocks: %d\n", __func__, num_blocks);
 
-        status = rsi_copy_to_card(common, fw, len, num_blocks);
+        status = rsi_copy_to_card(common, fw_entry->data, len, num_blocks);
         release_firmware(fw_entry);
         return status;
 }
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index 81ee481487cf..be2d54f257b1 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -8020,13 +8020,13 @@ int rt2800_get_survey(struct ieee80211_hw *hw, int idx,
         rt2800_register_read(rt2x00dev, CH_BUSY_STA_SEC, &busy_ext);
 
         if (idle || busy) {
-                survey->filled = SURVEY_INFO_CHANNEL_TIME |
-                                 SURVEY_INFO_CHANNEL_TIME_BUSY |
-                                 SURVEY_INFO_CHANNEL_TIME_EXT_BUSY;
+                survey->filled = SURVEY_INFO_TIME |
+                                 SURVEY_INFO_TIME_BUSY |
+                                 SURVEY_INFO_TIME_EXT_BUSY;
 
-                survey->channel_time = (idle + busy) / 1000;
-                survey->channel_time_busy = busy / 1000;
-                survey->channel_time_ext_busy = busy_ext / 1000;
+                survey->time = (idle + busy) / 1000;
+                survey->time_busy = busy / 1000;
+                survey->time_ext_busy = busy_ext / 1000;
         }
 
         if (!(hw->conf.flags & IEEE80211_CONF_OFFCHANNEL))
diff --git a/drivers/net/wireless/rt2x00/rt2x00config.c b/drivers/net/wireless/rt2x00/rt2x00config.c
index 1122dc44c9fd..48a2cad29477 100644
--- a/drivers/net/wireless/rt2x00/rt2x00config.c
+++ b/drivers/net/wireless/rt2x00/rt2x00config.c
@@ -240,7 +240,7 @@ void rt2x00lib_config(struct rt2x00_dev *rt2x00dev,
                 rt2x00dev->rf_channel = libconf.rf.channel;
         }
 
-        if (test_bit(REQUIRE_PS_AUTOWAKE, &rt2x00dev->cap_flags) &&
+        if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_PS_AUTOWAKE) &&
             (ieee80211_flags & IEEE80211_CONF_CHANGE_PS))
                 cancel_delayed_work_sync(&rt2x00dev->autowakeup_work);
 
@@ -257,7 +257,7 @@ void rt2x00lib_config(struct rt2x00_dev *rt2x00dev,
                 rt2x00link_reset_tuner(rt2x00dev, false);
 
         if (test_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags) &&
-            test_bit(REQUIRE_PS_AUTOWAKE, &rt2x00dev->cap_flags) &&
+            rt2x00_has_cap_flag(rt2x00dev, REQUIRE_PS_AUTOWAKE) &&
             (ieee80211_flags & IEEE80211_CONF_CHANGE_PS) &&
             (conf->flags & IEEE80211_CONF_PS)) {
                 beacon_diff = (long)jiffies - (long)rt2x00dev->last_beacon;
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 9967a1d9f0ec..5639ed816813 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -351,7 +351,7 @@ void rt2x00lib_txdone(struct queue_entry *entry,
         /*
          * Remove L2 padding which was added during
          */
-        if (test_bit(REQUIRE_L2PAD, &rt2x00dev->cap_flags))
+        if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_L2PAD))
                 rt2x00queue_remove_l2pad(entry->skb, header_length);
 
         /*
@@ -460,7 +460,7 @@ void rt2x00lib_txdone(struct queue_entry *entry,
          * send the status report back.
          */
         if (!(skbdesc_flags & SKBDESC_NOT_MAC80211)) {
-                if (test_bit(REQUIRE_TASKLET_CONTEXT, &rt2x00dev->cap_flags))
+                if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_TASKLET_CONTEXT))
                         ieee80211_tx_status(rt2x00dev->hw, entry->skb);
                 else
                         ieee80211_tx_status_ni(rt2x00dev->hw, entry->skb);
@@ -1056,9 +1056,9 @@ static int rt2x00lib_probe_hw(struct rt2x00_dev *rt2x00dev)
         /*
          * Take TX headroom required for alignment into account.
          */
-        if (test_bit(REQUIRE_L2PAD, &rt2x00dev->cap_flags))
+        if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_L2PAD))
                 rt2x00dev->hw->extra_tx_headroom += RT2X00_L2PAD_SIZE;
-        else if (test_bit(REQUIRE_DMA, &rt2x00dev->cap_flags))
+        else if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_DMA))
                 rt2x00dev->hw->extra_tx_headroom += RT2X00_ALIGN_SIZE;
 
         /*
@@ -1069,7 +1069,7 @@ static int rt2x00lib_probe_hw(struct rt2x00_dev *rt2x00dev)
         /*
          * Allocate tx status FIFO for driver use.
          */
-        if (test_bit(REQUIRE_TXSTATUS_FIFO, &rt2x00dev->cap_flags)) {
+        if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_TXSTATUS_FIFO)) {
                 /*
                  * Allocate the txstatus fifo. In the worst case the tx
                  * status fifo has to hold the tx status of all entries
@@ -1131,7 +1131,7 @@ static void rt2x00lib_uninitialize(struct rt2x00_dev *rt2x00dev)
         /*
          * Stop rfkill polling.
          */
-        if (test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
+        if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_DELAYED_RFKILL))
                 rt2x00rfkill_unregister(rt2x00dev);
 
         /*
@@ -1173,7 +1173,7 @@ static int rt2x00lib_initialize(struct rt2x00_dev *rt2x00dev)
         /*
          * Start rfkill polling.
          */
-        if (test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
+        if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_DELAYED_RFKILL))
                 rt2x00rfkill_register(rt2x00dev);
 
         return 0;
@@ -1389,7 +1389,7 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
         /*
          * Start rfkill polling.
          */
-        if (!test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
+        if (!rt2x00_has_cap_flag(rt2x00dev, REQUIRE_DELAYED_RFKILL))
                 rt2x00rfkill_register(rt2x00dev);
 
         return 0;
@@ -1408,7 +1408,7 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
         /*
          * Stop rfkill polling.
          */
-        if (!test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
+        if (!rt2x00_has_cap_flag(rt2x00dev, REQUIRE_DELAYED_RFKILL))
                 rt2x00rfkill_unregister(rt2x00dev);
 
         /*
diff --git a/drivers/net/wireless/rt2x00/rt2x00firmware.c b/drivers/net/wireless/rt2x00/rt2x00firmware.c
index fbae2799e3ee..5813300f68a2 100644
--- a/drivers/net/wireless/rt2x00/rt2x00firmware.c
+++ b/drivers/net/wireless/rt2x00/rt2x00firmware.c
@@ -96,7 +96,7 @@ int rt2x00lib_load_firmware(struct rt2x00_dev *rt2x00dev)
 {
         int retval;
 
-        if (!test_bit(REQUIRE_FIRMWARE, &rt2x00dev->cap_flags))
+        if (!rt2x00_has_cap_flag(rt2x00dev, REQUIRE_FIRMWARE))
                 return 0;
 
         if (!rt2x00dev->fw) {
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
index cb40245a0695..300876df056f 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -119,7 +119,7 @@ void rt2x00mac_tx(struct ieee80211_hw *hw,
          * Use the ATIM queue if appropriate and present.
          */
         if (tx_info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM &&
-            test_bit(REQUIRE_ATIM_QUEUE, &rt2x00dev->cap_flags))
+            rt2x00_has_cap_flag(rt2x00dev, REQUIRE_ATIM_QUEUE))
                 qid = QID_ATIM;
 
         queue = rt2x00queue_get_tx_queue(rt2x00dev, qid);
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index 66ff36447b94..68b620b2462f 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -85,7 +85,7 @@ struct sk_buff *rt2x00queue_alloc_rxskb(struct queue_entry *entry, gfp_t gfp)
         memset(skbdesc, 0, sizeof(*skbdesc));
         skbdesc->entry = entry;
 
-        if (test_bit(REQUIRE_DMA, &rt2x00dev->cap_flags)) {
+        if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_DMA)) {
                 dma_addr_t skb_dma;
 
                 skb_dma = dma_map_single(rt2x00dev->dev, skb->data, skb->len,
@@ -198,7 +198,7 @@ static void rt2x00queue_create_tx_descriptor_seq(struct rt2x00_dev *rt2x00dev,
 
         __set_bit(ENTRY_TXD_GENERATE_SEQ, &txdesc->flags);
 
-        if (!test_bit(REQUIRE_SW_SEQNO, &rt2x00dev->cap_flags)) {
+        if (!rt2x00_has_cap_flag(rt2x00dev, REQUIRE_SW_SEQNO)) {
                 /*
                  * rt2800 has a H/W (or F/W) bug, device incorrectly increase
                  * seqno on retransmited data (non-QOS) frames. To workaround
@@ -484,7 +484,7 @@ static void rt2x00queue_create_tx_descriptor(struct rt2x00_dev *rt2x00dev,
         rt2x00crypto_create_tx_descriptor(rt2x00dev, skb, txdesc);
         rt2x00queue_create_tx_descriptor_seq(rt2x00dev, skb, txdesc);
 
-        if (test_bit(REQUIRE_HT_TX_DESC, &rt2x00dev->cap_flags))
+        if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_HT_TX_DESC))
                 rt2x00queue_create_tx_descriptor_ht(rt2x00dev, skb, txdesc,
                                                    sta, hwrate);
         else
@@ -526,7 +526,7 @@ static int rt2x00queue_write_tx_data(struct queue_entry *entry,
         /*
          * Map the skb to DMA.
          */
-        if (test_bit(REQUIRE_DMA, &rt2x00dev->cap_flags) &&
+        if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_DMA) &&
             rt2x00queue_map_txskb(entry))
                 return -ENOMEM;
 
@@ -646,7 +646,7 @@ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb,
          */
         if (test_bit(ENTRY_TXD_ENCRYPT, &txdesc.flags) &&
             !test_bit(ENTRY_TXD_ENCRYPT_IV, &txdesc.flags)) {
-                if (test_bit(REQUIRE_COPY_IV, &queue->rt2x00dev->cap_flags))
+                if (rt2x00_has_cap_flag(queue->rt2x00dev, REQUIRE_COPY_IV))
                         rt2x00crypto_tx_copy_iv(skb, &txdesc);
                 else
                         rt2x00crypto_tx_remove_iv(skb, &txdesc);
@@ -660,9 +660,9 @@ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb,
          * PCI and USB devices, while header alignment only is valid
          * for PCI devices.
          */
-        if (test_bit(REQUIRE_L2PAD, &queue->rt2x00dev->cap_flags))
+        if (rt2x00_has_cap_flag(queue->rt2x00dev, REQUIRE_L2PAD))
                 rt2x00queue_insert_l2pad(skb, txdesc.header_length);
-        else if (test_bit(REQUIRE_DMA, &queue->rt2x00dev->cap_flags))
+        else if (rt2x00_has_cap_flag(queue->rt2x00dev, REQUIRE_DMA))
                 rt2x00queue_align_frame(skb);
 
         /*
@@ -1178,7 +1178,7 @@ int rt2x00queue_initialize(struct rt2x00_dev *rt2x00dev)
         if (status)
                 goto exit;
 
-        if (test_bit(REQUIRE_ATIM_QUEUE, &rt2x00dev->cap_flags)) {
+        if (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_ATIM_QUEUE)) {
                 status = rt2x00queue_alloc_entries(rt2x00dev->atim);
                 if (status)
                         goto exit;
@@ -1234,7 +1234,7 @@ int rt2x00queue_allocate(struct rt2x00_dev *rt2x00dev)
         struct data_queue *queue;
         enum data_queue_qid qid;
         unsigned int req_atim =
-            !!test_bit(REQUIRE_ATIM_QUEUE, &rt2x00dev->cap_flags);
+            rt2x00_has_cap_flag(rt2x00dev, REQUIRE_ATIM_QUEUE);
 
         /*
          * We need the following queues:
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index 892270dd3e7b..7627af6098eb 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -274,7 +274,7 @@ static void rt2x00usb_interrupt_txdone(struct urb *urb)
          * Schedule the delayed work for reading the TX status
          * from the device.
          */
-        if (!test_bit(REQUIRE_TXSTATUS_FIFO, &rt2x00dev->cap_flags) ||
+        if (!rt2x00_has_cap_flag(rt2x00dev, REQUIRE_TXSTATUS_FIFO) ||
             !kfifo_is_empty(&rt2x00dev->txstatus_fifo))
                 queue_work(rt2x00dev->workqueue, &rt2x00dev->txdone_work);
 }
@@ -456,7 +456,7 @@ static bool rt2x00usb_flush_entry(struct queue_entry *entry, void *data)
          * Kill guardian urb (if required by driver).
          */
         if ((entry->queue->qid == QID_BEACON) &&
-            (test_bit(REQUIRE_BEACON_GUARD, &rt2x00dev->cap_flags)))
+            (rt2x00_has_cap_flag(rt2x00dev, REQUIRE_BEACON_GUARD)))
                 usb_kill_urb(bcn_priv->guardian_urb);
 
         return false;
@@ -655,7 +655,7 @@ static int rt2x00usb_alloc_entries(struct data_queue *queue)
          * then we are done.
          */
         if (queue->qid != QID_BEACON ||
-            !test_bit(REQUIRE_BEACON_GUARD, &rt2x00dev->cap_flags))
+            !rt2x00_has_cap_flag(rt2x00dev, REQUIRE_BEACON_GUARD))
                 return 0;
 
         for (i = 0; i < queue->limit; i++) {
@@ -690,7 +690,7 @@ static void rt2x00usb_free_entries(struct data_queue *queue)
          * then we are done.
          */
         if (queue->qid != QID_BEACON ||
-            !test_bit(REQUIRE_BEACON_GUARD, &rt2x00dev->cap_flags))
+            !rt2x00_has_cap_flag(rt2x00dev, REQUIRE_BEACON_GUARD))
                 return;
 
         for (i = 0; i < queue->limit; i++) {
diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
index 40b6d1d006d7..1d4677460711 100644
--- a/drivers/net/wireless/rtlwifi/base.c
+++ b/drivers/net/wireless/rtlwifi/base.c
@@ -867,63 +867,135 @@ static u8 _rtl_get_highest_n_rate(struct ieee80211_hw *hw,
  *
  * B/G rate:
  * (rx_status->flag & RX_FLAG_HT) = 0,
- * DESC92_RATE1M-->DESC92_RATE54M ==> idx is 0-->11,
+ * DESC_RATE1M-->DESC_RATE54M ==> idx is 0-->11,
  *
  * N rate:
  * (rx_status->flag & RX_FLAG_HT) = 1,
- * DESC92_RATEMCS0-->DESC92_RATEMCS15 ==> idx is 0-->15
+ * DESC_RATEMCS0-->DESC_RATEMCS15 ==> idx is 0-->15
  *
  * 5G band:rx_status->band == IEEE80211_BAND_5GHZ
  * A rate:
  * (rx_status->flag & RX_FLAG_HT) = 0,
- * DESC92_RATE6M-->DESC92_RATE54M ==> idx is 0-->7,
+ * DESC_RATE6M-->DESC_RATE54M ==> idx is 0-->7,
  *
  * N rate:
  * (rx_status->flag & RX_FLAG_HT) = 1,
- * DESC92_RATEMCS0-->DESC92_RATEMCS15 ==> idx is 0-->15
+ * DESC_RATEMCS0-->DESC_RATEMCS15 ==> idx is 0-->15
+ *
+ * VHT rates:
+ * DESC_RATEVHT1SS_MCS0-->DESC_RATEVHT1SS_MCS9 ==> idx is 0-->9
+ * DESC_RATEVHT2SS_MCS0-->DESC_RATEVHT2SS_MCS9 ==> idx is 0-->9
  */
-int rtlwifi_rate_mapping(struct ieee80211_hw *hw,
-                         bool isht, u8 desc_rate, bool first_ampdu)
+int rtlwifi_rate_mapping(struct ieee80211_hw *hw, bool isht, bool isvht,
+                         u8 desc_rate)
 {
         int rate_idx;
 
+        if (isvht) {
+                switch (desc_rate) {
+                case DESC_RATEVHT1SS_MCS0:
+                        rate_idx = 0;
+                        break;
+                case DESC_RATEVHT1SS_MCS1:
+                        rate_idx = 1;
+                        break;
+                case DESC_RATEVHT1SS_MCS2:
+                        rate_idx = 2;
+                        break;
+                case DESC_RATEVHT1SS_MCS3:
+                        rate_idx = 3;
+                        break;
+                case DESC_RATEVHT1SS_MCS4:
+                        rate_idx = 4;
+                        break;
+                case DESC_RATEVHT1SS_MCS5:
+                        rate_idx = 5;
+                        break;
+                case DESC_RATEVHT1SS_MCS6:
+                        rate_idx = 6;
+                        break;
+                case DESC_RATEVHT1SS_MCS7:
+                        rate_idx = 7;
+                        break;
+                case DESC_RATEVHT1SS_MCS8:
+                        rate_idx = 8;
+                        break;
+                case DESC_RATEVHT1SS_MCS9:
+                        rate_idx = 9;
+                        break;
+                case DESC_RATEVHT2SS_MCS0:
+                        rate_idx = 0;
+                        break;
+                case DESC_RATEVHT2SS_MCS1:
+                        rate_idx = 1;
+                        break;
+                case DESC_RATEVHT2SS_MCS2:
+                        rate_idx = 2;
+                        break;
+                case DESC_RATEVHT2SS_MCS3:
+                        rate_idx = 3;
+                        break;
+                case DESC_RATEVHT2SS_MCS4:
+                        rate_idx = 4;
+                        break;
+                case DESC_RATEVHT2SS_MCS5:
+                        rate_idx = 5;
+                        break;
+                case DESC_RATEVHT2SS_MCS6:
+                        rate_idx = 6;
+                        break;
+                case DESC_RATEVHT2SS_MCS7:
+                        rate_idx = 7;
+                        break;
+                case DESC_RATEVHT2SS_MCS8:
+                        rate_idx = 8;
+                        break;
+                case DESC_RATEVHT2SS_MCS9:
+                        rate_idx = 9;
+                        break;
+                default:
+                        rate_idx = 0;
+                        break;
+                }
+                return rate_idx;
+        }
         if (false == isht) {
                 if (IEEE80211_BAND_2GHZ == hw->conf.chandef.chan->band) {
                         switch (desc_rate) {
-                        case DESC92_RATE1M:
+                        case DESC_RATE1M:
                                 rate_idx = 0;
                                 break;
-                        case DESC92_RATE2M:
+                        case DESC_RATE2M:
                                 rate_idx = 1;
                                 break;
-                        case DESC92_RATE5_5M:
+                        case DESC_RATE5_5M:
                                 rate_idx = 2;
                                 break;
-                        case DESC92_RATE11M:
+                        case DESC_RATE11M:
                                 rate_idx = 3;
                                 break;
-                        case DESC92_RATE6M:
+                        case DESC_RATE6M:
                                 rate_idx = 4;
                                 break;
-                        case DESC92_RATE9M:
+                        case DESC_RATE9M:
                                 rate_idx = 5;
                                 break;
-                        case DESC92_RATE12M:
+                        case DESC_RATE12M:
                                 rate_idx = 6;
                                 break;
-                        case DESC92_RATE18M:
+                        case DESC_RATE18M:
                                 rate_idx = 7;
                                 break;
-                        case DESC92_RATE24M:
+                        case DESC_RATE24M:
                                 rate_idx = 8;
                                 break;
-                        case DESC92_RATE36M:
+                        case DESC_RATE36M:
                                 rate_idx = 9;
                                 break;
-                        case DESC92_RATE48M:
+                        case DESC_RATE48M:
                                 rate_idx = 10;
                                 break;
-                        case DESC92_RATE54M:
+                        case DESC_RATE54M:
                                 rate_idx = 11;
                                 break;
                         default:
@@ -932,28 +1004,28 @@ int rtlwifi_rate_mapping(struct ieee80211_hw *hw,
                         }
                 } else {
                         switch (desc_rate) {
-                        case DESC92_RATE6M:
+                        case DESC_RATE6M:
                                 rate_idx = 0;
                                 break;
-                        case DESC92_RATE9M:
+                        case DESC_RATE9M:
                                 rate_idx = 1;
                                 break;
-                        case DESC92_RATE12M:
+                        case DESC_RATE12M:
                                 rate_idx = 2;
                                 break;
-                        case DESC92_RATE18M:
+                        case DESC_RATE18M:
                                 rate_idx = 3;
                                 break;
-                        case DESC92_RATE24M:
+                        case DESC_RATE24M:
                                 rate_idx = 4;
                                 break;
-                        case DESC92_RATE36M:
+                        case DESC_RATE36M:
                                 rate_idx = 5;
                                 break;
-                        case DESC92_RATE48M:
+                        case DESC_RATE48M:
                                 rate_idx = 6;
                                 break;
-                        case DESC92_RATE54M:
+                        case DESC_RATE54M:
                                 rate_idx = 7;
                                 break;
                         default:
@@ -963,52 +1035,52 @@ int rtlwifi_rate_mapping(struct ieee80211_hw *hw,
                 }
         } else {
                 switch (desc_rate) {
-                case DESC92_RATEMCS0:
+                case DESC_RATEMCS0:
                         rate_idx = 0;
                         break;
-                case DESC92_RATEMCS1:
+                case DESC_RATEMCS1:
                         rate_idx = 1;
                         break;
-                case DESC92_RATEMCS2:
+                case DESC_RATEMCS2:
                         rate_idx = 2;
                         break;
-                case DESC92_RATEMCS3:
+                case DESC_RATEMCS3:
                         rate_idx = 3;
                         break;
-                case DESC92_RATEMCS4:
+                case DESC_RATEMCS4:
                         rate_idx = 4;
                         break;
-                case DESC92_RATEMCS5:
+                case DESC_RATEMCS5:
                         rate_idx = 5;
                         break;
-                case DESC92_RATEMCS6:
+                case DESC_RATEMCS6:
                         rate_idx = 6;
                         break;
-                case DESC92_RATEMCS7:
+                case DESC_RATEMCS7:
                         rate_idx = 7;
                         break;
-                case DESC92_RATEMCS8:
+                case DESC_RATEMCS8:
                         rate_idx = 8;
                         break;
-                case DESC92_RATEMCS9:
+                case DESC_RATEMCS9:
                         rate_idx = 9;
                         break;
-                case DESC92_RATEMCS10:
+                case DESC_RATEMCS10:
                         rate_idx = 10;
                         break;
-                case DESC92_RATEMCS11:
+                case DESC_RATEMCS11:
                         rate_idx = 11;
                         break;
-                case DESC92_RATEMCS12:
+                case DESC_RATEMCS12:
                         rate_idx = 12;
                         break;
-                case DESC92_RATEMCS13:
+                case DESC_RATEMCS13:
                         rate_idx = 13;
                         break;
-                case DESC92_RATEMCS14:
+                case DESC_RATEMCS14:
                         rate_idx = 14;
                         break;
-                case DESC92_RATEMCS15:
+                case DESC_RATEMCS15:
                         rate_idx = 15;
                         break;
                 default:
diff --git a/drivers/net/wireless/rtlwifi/base.h b/drivers/net/wireless/rtlwifi/base.h
index 982f2450feea..c6cb49c3ee32 100644
--- a/drivers/net/wireless/rtlwifi/base.h
+++ b/drivers/net/wireless/rtlwifi/base.h
@@ -123,8 +123,8 @@ void rtl_watch_dog_timer_callback(unsigned long data);
 void rtl_deinit_deferred_work(struct ieee80211_hw *hw);
 
 bool rtl_action_proc(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx);
-int rtlwifi_rate_mapping(struct ieee80211_hw *hw,
-                         bool isht, u8 desc_rate, bool first_ampdu);
+int rtlwifi_rate_mapping(struct ieee80211_hw *hw, bool isht,
+                         bool isvht, u8 desc_rate);
 bool rtl_tx_mgmt_proc(struct ieee80211_hw *hw, struct sk_buff *skb);
 u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx);
 
diff --git a/drivers/net/wireless/rtlwifi/core.c b/drivers/net/wireless/rtlwifi/core.c
index 5fc6f52641bd..a31a12775f1a 100644
--- a/drivers/net/wireless/rtlwifi/core.c
+++ b/drivers/net/wireless/rtlwifi/core.c
@@ -95,7 +95,8 @@ void rtl_bb_delay(struct ieee80211_hw *hw, u32 addr, u32 data)
 }
 EXPORT_SYMBOL(rtl_bb_delay);
 
-void rtl_fw_cb(const struct firmware *firmware, void *context)
+static void rtl_fw_do_work(const struct firmware *firmware, void *context,
+                           bool is_wow)
 {
         struct ieee80211_hw *hw = context;
         struct rtl_priv *rtlpriv = rtl_priv(hw);
@@ -125,12 +126,31 @@ found_alt:
                 release_firmware(firmware);
                 return;
         }
-        memcpy(rtlpriv->rtlhal.pfirmware, firmware->data, firmware->size);
+        if (!is_wow) {
+                memcpy(rtlpriv->rtlhal.pfirmware, firmware->data,
+                       firmware->size);
+                rtlpriv->rtlhal.fwsize = firmware->size;
+        } else {
+                memcpy(rtlpriv->rtlhal.wowlan_firmware, firmware->data,
+                       firmware->size);
+                rtlpriv->rtlhal.wowlan_fwsize = firmware->size;
+        }
         rtlpriv->rtlhal.fwsize = firmware->size;
         release_firmware(firmware);
 }
+
+void rtl_fw_cb(const struct firmware *firmware, void *context)
+{
+        rtl_fw_do_work(firmware, context, false);
+}
 EXPORT_SYMBOL(rtl_fw_cb);
 
+void rtl_wowlan_fw_cb(const struct firmware *firmware, void *context)
+{
+        rtl_fw_do_work(firmware, context, true);
+}
+EXPORT_SYMBOL(rtl_wowlan_fw_cb);
+
 /*mutex for start & stop is must here. */
 static int rtl_op_start(struct ieee80211_hw *hw)
 {
@@ -990,6 +1010,16 @@ static int rtl_op_conf_tx(struct ieee80211_hw *hw,
         return 0;
 }
 
+static void send_beacon_frame(struct ieee80211_hw *hw,
+                              struct ieee80211_vif *vif)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct sk_buff *skb = ieee80211_beacon_get(hw, vif);
+
+        if (skb)
+                rtlpriv->intf_ops->adapter_tx(hw, NULL, skb, NULL);
+}
+
 static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
                                     struct ieee80211_vif *vif,
                                     struct ieee80211_bss_conf *bss_conf,
@@ -1020,6 +1050,7 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
 
                                 if (rtlpriv->cfg->ops->linked_set_reg)
                                         rtlpriv->cfg->ops->linked_set_reg(hw);
+                                send_beacon_frame(hw, vif);
                         }
                 }
                 if ((changed & BSS_CHANGED_BEACON_ENABLED &&
@@ -1851,3 +1882,40 @@ bool rtl_btc_status_false(void)
         return false;
 }
 EXPORT_SYMBOL_GPL(rtl_btc_status_false);
+
+void rtl_dm_diginit(struct ieee80211_hw *hw, u32 cur_igvalue)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct dig_t *dm_digtable = &rtlpriv->dm_digtable;
+
+        dm_digtable->dig_enable_flag = true;
+        dm_digtable->dig_ext_port_stage = DIG_EXT_PORT_STAGE_MAX;
+        dm_digtable->cur_igvalue = cur_igvalue;
+        dm_digtable->pre_igvalue = 0;
+        dm_digtable->cur_sta_cstate = DIG_STA_DISCONNECT;
+        dm_digtable->presta_cstate = DIG_STA_DISCONNECT;
+        dm_digtable->curmultista_cstate = DIG_MULTISTA_DISCONNECT;
+        dm_digtable->rssi_lowthresh = DM_DIG_THRESH_LOW;
+        dm_digtable->rssi_highthresh = DM_DIG_THRESH_HIGH;
+        dm_digtable->fa_lowthresh = DM_FALSEALARM_THRESH_LOW;
+        dm_digtable->fa_highthresh = DM_FALSEALARM_THRESH_HIGH;
+        dm_digtable->rx_gain_max = DM_DIG_MAX;
+        dm_digtable->rx_gain_min = DM_DIG_MIN;
+        dm_digtable->back_val = DM_DIG_BACKOFF_DEFAULT;
+        dm_digtable->back_range_max = DM_DIG_BACKOFF_MAX;
+        dm_digtable->back_range_min = DM_DIG_BACKOFF_MIN;
+        dm_digtable->pre_cck_cca_thres = 0xff;
+        dm_digtable->cur_cck_cca_thres = 0x83;
+        dm_digtable->forbidden_igi = DM_DIG_MIN;
+        dm_digtable->large_fa_hit = 0;
+        dm_digtable->recover_cnt = 0;
+        dm_digtable->dig_min_0 = 0x25;
+        dm_digtable->dig_min_1 = 0x25;
+        dm_digtable->media_connect_0 = false;
+        dm_digtable->media_connect_1 = false;
+        rtlpriv->dm.dm_initialgain_enable = true;
+        dm_digtable->bt30_cur_igi = 0x32;
+        dm_digtable->pre_cck_pd_state = CCK_PD_STAGE_MAX;
+        dm_digtable->cur_cck_pd_state = CCK_PD_STAGE_LOWRSSI;
+}
+EXPORT_SYMBOL(rtl_dm_diginit);
diff --git a/drivers/net/wireless/rtlwifi/core.h b/drivers/net/wireless/rtlwifi/core.h
index 624e1dc16d31..7b64e34f421e 100644
--- a/drivers/net/wireless/rtlwifi/core.h
+++ b/drivers/net/wireless/rtlwifi/core.h
@@ -35,13 +35,55 @@
 
 #define RTL_SUPPORTED_CTRL_FILTER       0xFF
 
+#define DM_DIG_THRESH_HIGH              40
+#define DM_DIG_THRESH_LOW               35
+#define DM_FALSEALARM_THRESH_LOW        400
+#define DM_FALSEALARM_THRESH_HIGH       1000
+
+#define DM_DIG_MAX                      0x3e
+#define DM_DIG_MIN                      0x1e
+#define DM_DIG_MAX_AP                   0x32
+#define DM_DIG_BACKOFF_MAX              12
+#define DM_DIG_BACKOFF_MIN              -4
+#define DM_DIG_BACKOFF_DEFAULT          10
+
+enum cck_packet_detection_threshold {
+        CCK_PD_STAGE_LOWRSSI = 0,
+        CCK_PD_STAGE_HIGHRSSI = 1,
+        CCK_FA_STAGE_LOW = 2,
+        CCK_FA_STAGE_HIGH = 3,
+        CCK_PD_STAGE_MAX = 4,
+};
+
+enum dm_dig_ext_port_alg_e {
+        DIG_EXT_PORT_STAGE_0 = 0,
+        DIG_EXT_PORT_STAGE_1 = 1,
+        DIG_EXT_PORT_STAGE_2 = 2,
+        DIG_EXT_PORT_STAGE_3 = 3,
+        DIG_EXT_PORT_STAGE_MAX = 4,
+};
+
+enum dm_dig_connect_e {
+        DIG_STA_DISCONNECT,
+        DIG_STA_CONNECT,
+        DIG_STA_BEFORE_CONNECT,
+        DIG_MULTISTA_DISCONNECT,
+        DIG_MULTISTA_CONNECT,
+        DIG_AP_DISCONNECT,
+        DIG_AP_CONNECT,
+        DIG_AP_ADD_STATION,
+        DIG_CONNECT_MAX
+};
+
 extern const struct ieee80211_ops rtl_ops;
 void rtl_fw_cb(const struct firmware *firmware, void *context);
+void rtl_wowlan_fw_cb(const struct firmware *firmware, void *context);
 void rtl_addr_delay(u32 addr);
 void rtl_rfreg_delay(struct ieee80211_hw *hw, enum radio_path rfpath, u32 addr,
                      u32 mask, u32 data);
 void rtl_bb_delay(struct ieee80211_hw *hw, u32 addr, u32 data);
 bool rtl_cmd_send_packet(struct ieee80211_hw *hw, struct sk_buff *skb);
 bool rtl_btc_status_false(void);
+void rtl_dm_diginit(struct ieee80211_hw *hw, u32 cur_igval);
 
 #endif
diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
index c70efb9a6e78..ec456f0d972e 100644
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -578,6 +578,13 @@ static void _rtl_pci_tx_isr(struct ieee80211_hw *hw, int prio)
                 else
                         entry = (u8 *)(&ring->desc[ring->idx]);
 
+                if (rtlpriv->cfg->ops->get_available_desc &&
+                    rtlpriv->cfg->ops->get_available_desc(hw, prio) <= 1) {
+                        RT_TRACE(rtlpriv, (COMP_INTR | COMP_SEND), DBG_DMESG,
+                                 "no available desc!\n");
+                        return;
+                }
+
                 if (!rtlpriv->cfg->ops->is_tx_desc_closed(hw, prio, ring->idx))
                         return;
                 ring->idx = (ring->idx + 1) % ring->entries;
@@ -641,10 +648,9 @@ static void _rtl_pci_tx_isr(struct ieee80211_hw *hw, int prio)
 
                 ieee80211_tx_status_irqsafe(hw, skb);
 
-                if ((ring->entries - skb_queue_len(&ring->queue))
-                                == 2) {
+                if ((ring->entries - skb_queue_len(&ring->queue)) <= 4) {
 
-                        RT_TRACE(rtlpriv, COMP_ERR, DBG_LOUD,
+                        RT_TRACE(rtlpriv, COMP_ERR, DBG_DMESG,
                                  "more desc left, wake skb_queue@%d, ring->idx = %d, skb_queue_len = 0x%x\n",
                                  prio, ring->idx,
                                  skb_queue_len(&ring->queue));
@@ -793,7 +799,7 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
                         rx_remained_cnt =
                                 rtlpriv->cfg->ops->rx_desc_buff_remained_cnt(hw,
                                                                       hw_queue);
-                        if (rx_remained_cnt < 1)
+                        if (rx_remained_cnt == 0)
                                 return;
 
                 } else {        /* rx descriptor */
@@ -848,18 +854,18 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
                         else
                                 skb_reserve(skb, stats.rx_drvinfo_size +
                                             stats.rx_bufshift);
-
                 } else {
                         RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
                                  "skb->end - skb->tail = %d, len is %d\n",
                                  skb->end - skb->tail, len);
-                        break;
+                        dev_kfree_skb_any(skb);
+                        goto new_trx_end;
                 }
                 /* handle command packet here */
                 if (rtlpriv->cfg->ops->rx_command_packet &&
                     rtlpriv->cfg->ops->rx_command_packet(hw, stats, skb)) {
                                 dev_kfree_skb_any(skb);
-                                goto end;
+                                goto new_trx_end;
                 }
 
                 /*
@@ -909,6 +915,7 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
                 } else {
                         dev_kfree_skb_any(skb);
                 }
+new_trx_end:
                 if (rtlpriv->use_new_trx_flow) {
                         rtlpci->rx_ring[hw_queue].next_rx_rp += 1;
                         rtlpci->rx_ring[hw_queue].next_rx_rp %=
@@ -924,7 +931,6 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
                         rtlpriv->enter_ps = false;
                         schedule_work(&rtlpriv->works.lps_change_work);
                 }
-end:
                 skb = new_skb;
 no_new:
                 if (rtlpriv->use_new_trx_flow) {
@@ -1688,6 +1694,15 @@ static int rtl_pci_tx(struct ieee80211_hw *hw,
                 }
         }
 
+        if (rtlpriv->cfg->ops->get_available_desc &&
+            rtlpriv->cfg->ops->get_available_desc(hw, hw_queue) == 0) {
+                        RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+                                 "get_available_desc fail\n");
+                        spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock,
+                                               flags);
+                        return skb->len;
+        }
+
         if (ieee80211_is_data_qos(fc)) {
                 tid = rtl_get_tid(skb);
                 if (sta) {
diff --git a/drivers/net/wireless/rtlwifi/pci.h b/drivers/net/wireless/rtlwifi/pci.h
index 5e832306dba9..d4567d12e07e 100644
--- a/drivers/net/wireless/rtlwifi/pci.h
+++ b/drivers/net/wireless/rtlwifi/pci.h
@@ -325,4 +325,11 @@ static inline void pci_write32_async(struct rtl_priv *rtlpriv,
         writel(val, (u8 __iomem *) rtlpriv->io.pci_mem_start + addr);
 }
 
+static inline u16 calc_fifo_space(u16 rp, u16 wp)
+{
+        if (rp <= wp)
+                return RTL_PCI_MAX_RX_COUNT - 1 + rp - wp;
+        return rp - wp - 1;
+}
+
 #endif
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/dm.c b/drivers/net/wireless/rtlwifi/rtl8188ee/dm.c
index 2aa34d9055f0..d930c1f78721 100644
--- a/drivers/net/wireless/rtlwifi/rtl8188ee/dm.c
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/dm.c
@@ -26,6 +26,7 @@
 #include "../wifi.h"
 #include "../base.h"
 #include "../pci.h"
+#include "../core.h"
 #include "reg.h"
 #include "def.h"
 #include "phy.h"
@@ -341,38 +342,6 @@ static void dm_tx_pwr_track_set_pwr(struct ieee80211_hw *hw,
         }
 }
 
-static void rtl88e_dm_diginit(struct ieee80211_hw *hw)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct dig_t *dm_dig = &rtlpriv->dm_digtable;
-
-        dm_dig->dig_enable_flag = true;
-        dm_dig->cur_igvalue = rtl_get_bbreg(hw, ROFDM0_XAAGCCORE1, 0x7f);
-        dm_dig->pre_igvalue = 0;
-        dm_dig->cur_sta_cstate = DIG_STA_DISCONNECT;
-        dm_dig->presta_cstate = DIG_STA_DISCONNECT;
-        dm_dig->curmultista_cstate = DIG_MULTISTA_DISCONNECT;
-        dm_dig->rssi_lowthresh = DM_DIG_THRESH_LOW;
-        dm_dig->rssi_highthresh = DM_DIG_THRESH_HIGH;
-        dm_dig->fa_lowthresh = DM_FALSEALARM_THRESH_LOW;
-        dm_dig->fa_highthresh = DM_FALSEALARM_THRESH_HIGH;
-        dm_dig->rx_gain_max = DM_DIG_MAX;
-        dm_dig->rx_gain_min = DM_DIG_MIN;
-        dm_dig->back_val = DM_DIG_BACKOFF_DEFAULT;
-        dm_dig->back_range_max = DM_DIG_BACKOFF_MAX;
-        dm_dig->back_range_min = DM_DIG_BACKOFF_MIN;
-        dm_dig->pre_cck_cca_thres = 0xff;
-        dm_dig->cur_cck_cca_thres = 0x83;
-        dm_dig->forbidden_igi = DM_DIG_MIN;
-        dm_dig->large_fa_hit = 0;
-        dm_dig->recover_cnt = 0;
-        dm_dig->dig_min_0 = 0x25;
-        dm_dig->dig_min_1 = 0x25;
-        dm_dig->media_connect_0 = false;
-        dm_dig->media_connect_1 = false;
-        rtlpriv->dm.dm_initialgain_enable = true;
-}
-
 static u8 rtl88e_dm_initial_gain_min_pwdb(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
@@ -1796,9 +1765,10 @@ static void rtl88e_dm_antenna_diversity(struct ieee80211_hw *hw)
 void rtl88e_dm_init(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
+        u32 cur_igvalue = rtl_get_bbreg(hw, ROFDM0_XAAGCCORE1, 0x7f);
 
         rtlpriv->dm.dm_type = DM_TYPE_BYDRIVER;
-        rtl88e_dm_diginit(hw);
+        rtl_dm_diginit(hw, cur_igvalue);
         rtl88e_dm_init_dynamic_txpower(hw);
         rtl88e_dm_init_edca_turbo(hw);
         rtl88e_dm_init_rate_adaptive_mask(hw);
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/dm.h b/drivers/net/wireless/rtlwifi/rtl8188ee/dm.h
index 64f1f3ea9807..071ccee69eae 100644
--- a/drivers/net/wireless/rtlwifi/rtl8188ee/dm.h
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/dm.h
@@ -186,28 +186,12 @@
 #define BW_AUTO_SWITCH_HIGH_LOW                         25
 #define BW_AUTO_SWITCH_LOW_HIGH                         30
 
-#define DM_DIG_THRESH_HIGH                              40
-#define DM_DIG_THRESH_LOW                               35
-
-#define DM_FALSEALARM_THRESH_LOW                        400
-#define DM_FALSEALARM_THRESH_HIGH                       1000
-
-#define DM_DIG_MAX                                      0x3e
-#define DM_DIG_MIN                                      0x1e
-
-#define DM_DIG_MAX_AP                                   0x32
-#define DM_DIG_MIN_AP                                   0x20
-
 #define DM_DIG_FA_UPPER                                 0x3e
 #define DM_DIG_FA_LOWER                                 0x1e
 #define DM_DIG_FA_TH0                                   0x200
 #define DM_DIG_FA_TH1                                   0x300
 #define DM_DIG_FA_TH2                                   0x400
 
-#define DM_DIG_BACKOFF_MAX                              12
-#define DM_DIG_BACKOFF_MIN                              -4
-#define DM_DIG_BACKOFF_DEFAULT                          10
-
 #define RXPATHSELECTION_SS_TH_W                         30
 #define RXPATHSELECTION_DIFF_TH                         18
 
@@ -262,14 +246,6 @@ enum tag_dynamic_init_gain_operation_type_definition {
         DIG_OP_TYPE_MAX
 };
 
-enum tag_cck_packet_detection_threshold_type_definition {
-        CCK_PD_STAGE_LOWRSSI = 0,
-        CCK_PD_STAGE_HIGHRSSI = 1,
-        CCK_FA_STAGE_LOW = 2,
-        CCK_FA_STAGE_HIGH = 3,
-        CCK_PD_STAGE_MAX = 4,
-};
-
 enum dm_1r_cca_e {
         CCA_1R = 0,
         CCA_2R = 1,
@@ -288,23 +264,6 @@ enum dm_sw_ant_switch_e {
         ANS_ANTENNA_MAX = 3,
 };
 
-enum dm_dig_ext_port_alg_e {
-        DIG_EXT_PORT_STAGE_0 = 0,
-        DIG_EXT_PORT_STAGE_1 = 1,
-        DIG_EXT_PORT_STAGE_2 = 2,
-        DIG_EXT_PORT_STAGE_3 = 3,
-        DIG_EXT_PORT_STAGE_MAX = 4,
-};
-
-enum dm_dig_connect_e {
-        DIG_STA_DISCONNECT = 0,
-        DIG_STA_CONNECT = 1,
-        DIG_STA_BEFORE_CONNECT = 2,
-        DIG_MULTISTA_DISCONNECT = 3,
-        DIG_MULTISTA_CONNECT = 4,
-        DIG_CONNECT_MAX
-};
-
 enum pwr_track_control_method {
         BBSWING,
         TXAGC
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c b/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c
index df549c96adef..791efbe6b18c 100644
--- a/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c
@@ -47,164 +47,6 @@ static u8 _rtl88ee_map_hwqueue_to_fwqueue(struct sk_buff *skb, u8 hw_queue)
         return skb->priority;
 }
 
-/* mac80211's rate_idx is like this:
- *
- * 2.4G band:rx_status->band == IEEE80211_BAND_2GHZ
- *
- * B/G rate:
- * (rx_status->flag & RX_FLAG_HT) = 0,
- * DESC92C_RATE1M-->DESC92C_RATE54M ==> idx is 0-->11,
- *
- * N rate:
- * (rx_status->flag & RX_FLAG_HT) = 1,
- * DESC92C_RATEMCS0-->DESC92C_RATEMCS15 ==> idx is 0-->15
- *
- * 5G band:rx_status->band == IEEE80211_BAND_5GHZ
- * A rate:
- * (rx_status->flag & RX_FLAG_HT) = 0,
- * DESC92C_RATE6M-->DESC92C_RATE54M ==> idx is 0-->7,
- *
- * N rate:
- * (rx_status->flag & RX_FLAG_HT) = 1,
- * DESC92C_RATEMCS0-->DESC92C_RATEMCS15 ==> idx is 0-->15
- */
-static int _rtl88ee_rate_mapping(struct ieee80211_hw *hw,
-                                 bool isht, u8 desc_rate)
-{
-        int rate_idx;
-
-        if (!isht) {
-                if (IEEE80211_BAND_2GHZ == hw->conf.chandef.chan->band) {
-                        switch (desc_rate) {
-                        case DESC92C_RATE1M:
-                                rate_idx = 0;
-                                break;
-                        case DESC92C_RATE2M:
-                                rate_idx = 1;
-                                break;
-                        case DESC92C_RATE5_5M:
-                                rate_idx = 2;
-                                break;
-                        case DESC92C_RATE11M:
-                                rate_idx = 3;
-                                break;
-                        case DESC92C_RATE6M:
-                                rate_idx = 4;
-                                break;
-                        case DESC92C_RATE9M:
-                                rate_idx = 5;
-                                break;
-                        case DESC92C_RATE12M:
-                                rate_idx = 6;
-                                break;
-                        case DESC92C_RATE18M:
-                                rate_idx = 7;
-                                break;
-                        case DESC92C_RATE24M:
-                                rate_idx = 8;
-                                break;
-                        case DESC92C_RATE36M:
-                                rate_idx = 9;
-                                break;
-                        case DESC92C_RATE48M:
-                                rate_idx = 10;
-                                break;
-                        case DESC92C_RATE54M:
-                                rate_idx = 11;
-                                break;
-                        default:
-                                rate_idx = 0;
-                                break;
-                        }
-                } else {
-                        switch (desc_rate) {
-                        case DESC92C_RATE6M:
-                                rate_idx = 0;
-                                break;
-                        case DESC92C_RATE9M:
-                                rate_idx = 1;
-                                break;
-                        case DESC92C_RATE12M:
-                                rate_idx = 2;
-                                break;
-                        case DESC92C_RATE18M:
-                                rate_idx = 3;
-                                break;
-                        case DESC92C_RATE24M:
-                                rate_idx = 4;
-                                break;
-                        case DESC92C_RATE36M:
-                                rate_idx = 5;
-                                break;
-                        case DESC92C_RATE48M:
-                                rate_idx = 6;
-                                break;
-                        case DESC92C_RATE54M:
-                                rate_idx = 7;
-                                break;
-                        default:
-                                rate_idx = 0;
-                                break;
-                        }
-                }
-        } else {
-                switch (desc_rate) {
-                case DESC92C_RATEMCS0:
-                        rate_idx = 0;
-                        break;
-                case DESC92C_RATEMCS1:
-                        rate_idx = 1;
-                        break;
-                case DESC92C_RATEMCS2:
-                        rate_idx = 2;
-                        break;
-                case DESC92C_RATEMCS3:
-                        rate_idx = 3;
-                        break;
-                case DESC92C_RATEMCS4:
-                        rate_idx = 4;
-                        break;
-                case DESC92C_RATEMCS5:
-                        rate_idx = 5;
-                        break;
-                case DESC92C_RATEMCS6:
-                        rate_idx = 6;
-                        break;
-                case DESC92C_RATEMCS7:
-                        rate_idx = 7;
-                        break;
-                case DESC92C_RATEMCS8:
-                        rate_idx = 8;
-                        break;
-                case DESC92C_RATEMCS9:
-                        rate_idx = 9;
-                        break;
-                case DESC92C_RATEMCS10:
-                        rate_idx = 10;
-                        break;
-                case DESC92C_RATEMCS11:
-                        rate_idx = 11;
-                        break;
-                case DESC92C_RATEMCS12:
-                        rate_idx = 12;
-                        break;
-                case DESC92C_RATEMCS13:
-                        rate_idx = 13;
-                        break;
-                case DESC92C_RATEMCS14:
-                        rate_idx = 14;
-                        break;
-                case DESC92C_RATEMCS15:
-                        rate_idx = 15;
-                        break;
-                default:
-                        rate_idx = 0;
-                        break;
-                }
-        }
-        return rate_idx;
-}
-
 static void _rtl88ee_query_rxphystatus(struct ieee80211_hw *hw,
                         struct rtl_stats *pstatus, u8 *pdesc,
                         struct rx_fwinfo_88e *p_drvinfo,
@@ -630,8 +472,8 @@ bool rtl88ee_rx_query_desc(struct ieee80211_hw *hw,
          * are use (RX_FLAG_HT)
          * Notice: this is diff with windows define
          */
-        rx_status->rate_idx = _rtl88ee_rate_mapping(hw,
-                                status->is_ht, status->rate);
+        rx_status->rate_idx = rtlwifi_rate_mapping(hw, status->is_ht,
+                                                   false, status->rate);
 
         rx_status->mactime = status->timestamp_low;
         if (phystatus == true) {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
index f6cb5aedfdd1..f5ee67cda73a 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
@@ -32,6 +32,7 @@
 #include "phy_common.h"
 #include "../pci.h"
 #include "../base.h"
+#include "../core.h"
 
 #define BT_RSSI_STATE_NORMAL_POWER      BIT_OFFSET_LEN_MASK_32(0, 1)
 #define BT_RSSI_STATE_AMDPU_OFF         BIT_OFFSET_LEN_MASK_32(1, 1)
@@ -194,36 +195,6 @@ void dm_savepowerindex(struct ieee80211_hw *hw)
 }
 EXPORT_SYMBOL_GPL(dm_savepowerindex);
 
-static void rtl92c_dm_diginit(struct ieee80211_hw *hw)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct dig_t *dm_digtable = &rtlpriv->dm_digtable;
-
-        dm_digtable->dig_enable_flag = true;
-        dm_digtable->dig_ext_port_stage = DIG_EXT_PORT_STAGE_MAX;
-        dm_digtable->cur_igvalue = 0x20;
-        dm_digtable->pre_igvalue = 0x0;
-        dm_digtable->cursta_cstate = DIG_STA_DISCONNECT;
-        dm_digtable->presta_cstate = DIG_STA_DISCONNECT;
-        dm_digtable->curmultista_cstate = DIG_MULTISTA_DISCONNECT;
-        dm_digtable->rssi_lowthresh = DM_DIG_THRESH_LOW;
-        dm_digtable->rssi_highthresh = DM_DIG_THRESH_HIGH;
-        dm_digtable->fa_lowthresh = DM_FALSEALARM_THRESH_LOW;
-        dm_digtable->fa_highthresh = DM_FALSEALARM_THRESH_HIGH;
-        dm_digtable->rx_gain_max = DM_DIG_MAX;
-        dm_digtable->rx_gain_min = DM_DIG_MIN;
-        dm_digtable->back_val = DM_DIG_BACKOFF_DEFAULT;
-        dm_digtable->back_range_max = DM_DIG_BACKOFF_MAX;
-        dm_digtable->back_range_min = DM_DIG_BACKOFF_MIN;
-        dm_digtable->pre_cck_pd_state = CCK_PD_STAGE_MAX;
-        dm_digtable->cur_cck_pd_state = CCK_PD_STAGE_LowRssi;
-
-        dm_digtable->forbidden_igi = DM_DIG_MIN;
-        dm_digtable->large_fa_hit = 0;
-        dm_digtable->recover_cnt = 0;
-        dm_digtable->dig_dynamic_min  = 0x25;
-}
-
 static u8 rtl92c_dm_initial_gain_min_pwdb(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
@@ -507,27 +478,27 @@ static void rtl92c_dm_cck_packet_detection_thresh(struct ieee80211_hw *hw)
                 if (dm_digtable->rssi_val_min > 100)
                         dm_digtable->rssi_val_min = 100;
 
-                if (dm_digtable->pre_cck_pd_state == CCK_PD_STAGE_LowRssi) {
+                if (dm_digtable->pre_cck_pd_state == CCK_PD_STAGE_LOWRSSI) {
                         if (dm_digtable->rssi_val_min <= 25)
                                 dm_digtable->cur_cck_pd_state =
-                                    CCK_PD_STAGE_LowRssi;
+                                    CCK_PD_STAGE_LOWRSSI;
                         else
                                 dm_digtable->cur_cck_pd_state =
-                                    CCK_PD_STAGE_HighRssi;
+                                    CCK_PD_STAGE_HIGHRSSI;
                 } else {
                         if (dm_digtable->rssi_val_min <= 20)
                                 dm_digtable->cur_cck_pd_state =
-                                    CCK_PD_STAGE_LowRssi;
+                                    CCK_PD_STAGE_LOWRSSI;
                         else
                                 dm_digtable->cur_cck_pd_state =
-                                    CCK_PD_STAGE_HighRssi;
+                                    CCK_PD_STAGE_HIGHRSSI;
                 }
         } else {
                 dm_digtable->cur_cck_pd_state = CCK_PD_STAGE_MAX;
         }
 
         if (dm_digtable->pre_cck_pd_state != dm_digtable->cur_cck_pd_state) {
-                if ((dm_digtable->cur_cck_pd_state == CCK_PD_STAGE_LowRssi) ||
+                if ((dm_digtable->cur_cck_pd_state == CCK_PD_STAGE_LOWRSSI) ||
                     (dm_digtable->cur_cck_pd_state == CCK_PD_STAGE_MAX))
                         rtl_set_bbreg(hw, RCCK0_CCA, MASKBYTE2, 0x83);
                 else
@@ -1374,7 +1345,7 @@ void rtl92c_dm_init(struct ieee80211_hw *hw)
         rtlpriv->dm.undec_sm_pwdb = -1;
         rtlpriv->dm.undec_sm_cck = -1;
         rtlpriv->dm.dm_initialgain_enable = true;
-        rtl92c_dm_diginit(hw);
+        rtl_dm_diginit(hw, 0x20);
 
         rtlpriv->dm.dm_flag |= HAL_DM_HIPWR_DISABLE;
         rtl92c_dm_init_dynamic_txpower(hw);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.h b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.h
index 4f232a063636..4422e31fedd9 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.h
@@ -47,25 +47,12 @@
 #define BW_AUTO_SWITCH_HIGH_LOW                 25
 #define BW_AUTO_SWITCH_LOW_HIGH                 30
 
-#define DM_DIG_THRESH_HIGH                      40
-#define DM_DIG_THRESH_LOW                       35
-
-#define DM_FALSEALARM_THRESH_LOW                400
-#define DM_FALSEALARM_THRESH_HIGH               1000
-
-#define DM_DIG_MAX                              0x3e
-#define DM_DIG_MIN                              0x1e
-
 #define DM_DIG_FA_UPPER                         0x32
 #define DM_DIG_FA_LOWER                         0x20
 #define DM_DIG_FA_TH0                           0x20
 #define DM_DIG_FA_TH1                           0x100
 #define DM_DIG_FA_TH2                           0x200
 
-#define DM_DIG_BACKOFF_MAX                      12
-#define DM_DIG_BACKOFF_MIN                      -4
-#define DM_DIG_BACKOFF_DEFAULT                  10
-
 #define RXPATHSELECTION_SS_TH_lOW               30
 #define RXPATHSELECTION_DIFF_TH                 18
 
@@ -123,14 +110,6 @@ enum tag_dynamic_init_gain_operation_type_definition {
         DIG_OP_TYPE_MAX
 };
 
-enum tag_cck_packet_detection_threshold_type_definition {
-        CCK_PD_STAGE_LowRssi = 0,
-        CCK_PD_STAGE_HighRssi = 1,
-        CCK_FA_STAGE_Low = 2,
-        CCK_FA_STAGE_High = 3,
-        CCK_PD_STAGE_MAX = 4,
-};
-
 enum dm_1r_cca_e {
         CCA_1R = 0,
         CCA_2R = 1,
@@ -149,23 +128,6 @@ enum dm_sw_ant_switch_e {
         ANS_ANTENNA_MAX = 3,
 };
 
-enum dm_dig_ext_port_alg_e {
-        DIG_EXT_PORT_STAGE_0 = 0,
-        DIG_EXT_PORT_STAGE_1 = 1,
-        DIG_EXT_PORT_STAGE_2 = 2,
-        DIG_EXT_PORT_STAGE_3 = 3,
-        DIG_EXT_PORT_STAGE_MAX = 4,
-};
-
-enum dm_dig_connect_e {
-        DIG_STA_DISCONNECT = 0,
-        DIG_STA_CONNECT = 1,
-        DIG_STA_BEFORE_CONNECT = 2,
-        DIG_MULTISTA_DISCONNECT = 3,
-        DIG_MULTISTA_CONNECT = 4,
-        DIG_CONNECT_MAX
-};
-
 void rtl92c_dm_init(struct ieee80211_hw *hw);
 void rtl92c_dm_watchdog(struct ieee80211_hw *hw);
 void rtl92c_dm_write_dig(struct ieee80211_hw *hw);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.h b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.h
index b64ae45dc674..e9f4281f5067 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.h
@@ -37,6 +37,7 @@
 #define FW_8192C_POLLING_DELAY                  5
 #define FW_8192C_POLLING_TIMEOUT_COUNT          100
 #define NORMAL_CHIP                             BIT(4)
+#define H2C_92C_KEEP_ALIVE_CTRL                 48
 
 #define IS_FW_HEADER_EXIST(_pfwhdr)     \
         ((le16_to_cpu(_pfwhdr->signature)&0xFFF0) == 0x92C0 ||\
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/dm.c b/drivers/net/wireless/rtlwifi/rtl8192ce/dm.c
index 74f9c083b80d..09898cf2e07a 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/dm.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/dm.c
@@ -30,6 +30,7 @@
 #include "../wifi.h"
 #include "../base.h"
 #include "../pci.h"
+#include "../core.h"
 #include "reg.h"
 #include "def.h"
 #include "phy.h"
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/dm.h b/drivers/net/wireless/rtlwifi/rtl8192ce/dm.h
index 9c5311c299fd..38ba707015f5 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/dm.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/dm.h
@@ -42,25 +42,12 @@
 #define BW_AUTO_SWITCH_HIGH_LOW                 25
 #define BW_AUTO_SWITCH_LOW_HIGH                 30
 
-#define DM_DIG_THRESH_HIGH                      40
-#define DM_DIG_THRESH_LOW                       35
-
-#define DM_FALSEALARM_THRESH_LOW                400
-#define DM_FALSEALARM_THRESH_HIGH               1000
-
-#define DM_DIG_MAX                              0x3e
-#define DM_DIG_MIN                              0x1e
-
 #define DM_DIG_FA_UPPER                         0x32
 #define DM_DIG_FA_LOWER                         0x20
 #define DM_DIG_FA_TH0                           0x20
 #define DM_DIG_FA_TH1                           0x100
 #define DM_DIG_FA_TH2                           0x200
 
-#define DM_DIG_BACKOFF_MAX                      12
-#define DM_DIG_BACKOFF_MIN                      -4
-#define DM_DIG_BACKOFF_DEFAULT                  10
-
 #define RXPATHSELECTION_SS_TH_lOW               30
 #define RXPATHSELECTION_DIFF_TH                 18
 
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
index 5c646d5f7bb8..303b299376c9 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
@@ -544,8 +544,13 @@ void rtl92ce_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
                                                 (u8 *)(&fw_current_inps));
                         }
                 break; }
-        case HW_VAR_KEEP_ALIVE:
-                break;
+        case HW_VAR_KEEP_ALIVE: {
+                u8 array[2];
+
+                array[0] = 0xff;
+                array[1] = *((u8 *)val);
+                rtl92c_fill_h2c_cmd(hw, H2C_92C_KEEP_ALIVE_CTRL, 2, array);
+                break; }
         default:
                 RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
                          "switch case %d not processed\n", variable);
@@ -1156,47 +1161,35 @@ static int _rtl92ce_set_media_status(struct ieee80211_hw *hw,
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         u8 bt_msr = rtl_read_byte(rtlpriv, MSR);
         enum led_ctl_mode ledaction = LED_CTL_NO_LINK;
-        bt_msr &= 0xfc;
+        u8 mode = MSR_NOLINK;
 
-        if (type == NL80211_IFTYPE_UNSPECIFIED ||
-            type == NL80211_IFTYPE_STATION) {
-                _rtl92ce_stop_tx_beacon(hw);
-                _rtl92ce_enable_bcn_sub_func(hw);
-        } else if (type == NL80211_IFTYPE_ADHOC || type == NL80211_IFTYPE_AP ||
-                   type == NL80211_IFTYPE_MESH_POINT) {
-                _rtl92ce_resume_tx_beacon(hw);
-                _rtl92ce_disable_bcn_sub_func(hw);
-        } else {
-                RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
-                         "Set HW_VAR_MEDIA_STATUS: No such media status(%x)\n",
-                         type);
-        }
+        bt_msr &= 0xfc;
 
         switch (type) {
         case NL80211_IFTYPE_UNSPECIFIED:
-                bt_msr |= MSR_NOLINK;
-                ledaction = LED_CTL_LINK;
+                mode = MSR_NOLINK;
                 RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
                          "Set Network type to NO LINK!\n");
                 break;
         case NL80211_IFTYPE_ADHOC:
-                bt_msr |= MSR_ADHOC;
+                mode = MSR_ADHOC;
                 RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
                          "Set Network type to Ad Hoc!\n");
                 break;
         case NL80211_IFTYPE_STATION:
-                bt_msr |= MSR_INFRA;
+                mode = MSR_INFRA;
                 ledaction = LED_CTL_LINK;
                 RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
                          "Set Network type to STA!\n");
                 break;
         case NL80211_IFTYPE_AP:
-                bt_msr |= MSR_AP;
+                mode = MSR_AP;
+                ledaction = LED_CTL_LINK;
                 RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
                          "Set Network type to AP!\n");
                 break;
         case NL80211_IFTYPE_MESH_POINT:
-                bt_msr |= MSR_ADHOC;
+                mode = MSR_ADHOC;
                 RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
                          "Set Network type to Mesh Point!\n");
                 break;
@@ -1207,9 +1200,32 @@ static int _rtl92ce_set_media_status(struct ieee80211_hw *hw,
 
         }
 
-        rtl_write_byte(rtlpriv, (MSR), bt_msr);
+        /* MSR_INFRA == Link in infrastructure network;
+         * MSR_ADHOC == Link in ad hoc network;
+         * Therefore, check link state is necessary.
+         *
+         * MSR_AP == AP mode; link state does not matter here.
+         */
+        if (mode != MSR_AP &&
+            rtlpriv->mac80211.link_state < MAC80211_LINKED) {
+                mode = MSR_NOLINK;
+                ledaction = LED_CTL_NO_LINK;
+        }
+        if (mode == MSR_NOLINK || mode == MSR_INFRA) {
+                _rtl92ce_stop_tx_beacon(hw);
+                _rtl92ce_enable_bcn_sub_func(hw);
+        } else if (mode == MSR_ADHOC || mode == MSR_AP) {
+                _rtl92ce_resume_tx_beacon(hw);
+                _rtl92ce_disable_bcn_sub_func(hw);
+        } else {
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+                         "Set HW_VAR_MEDIA_STATUS: No such media status(%x).\n",
+                         mode);
+        }
+        rtl_write_byte(rtlpriv, MSR, bt_msr | mode);
+
         rtlpriv->cfg->ops->led_control(hw, ledaction);
-        if ((bt_msr & MSR_MASK) == MSR_AP)
+        if (mode == MSR_AP)
                 rtl_write_byte(rtlpriv, REG_BCNTCFG + 1, 0x00);
         else
                 rtl_write_byte(rtlpriv, REG_BCNTCFG + 1, 0x66);
@@ -1833,7 +1849,6 @@ static void rtl92ce_update_hal_rate_table(struct ieee80211_hw *hw,
         u32 ratr_value;
         u8 ratr_index = 0;
         u8 nmode = mac->ht_enable;
-        u8 mimo_ps = IEEE80211_SMPS_OFF;
         u16 shortgi_rate;
         u32 tmp_ratr_value;
         u8 curtxbw_40mhz = mac->bw_40;
@@ -1842,6 +1857,7 @@ static void rtl92ce_update_hal_rate_table(struct ieee80211_hw *hw,
         u8 curshortgi_20mhz = (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20) ?
                                1 : 0;
         enum wireless_mode wirelessmode = mac->mode;
+        u32 ratr_mask;
 
         if (rtlhal->current_bandtype == BAND_ON_5G)
                 ratr_value = sta->supp_rates[1] << 4;
@@ -1865,19 +1881,13 @@ static void rtl92ce_update_hal_rate_table(struct ieee80211_hw *hw,
         case WIRELESS_MODE_N_24G:
         case WIRELESS_MODE_N_5G:
                 nmode = 1;
-                if (mimo_ps == IEEE80211_SMPS_STATIC) {
-                        ratr_value &= 0x0007F005;
-                } else {
-                        u32 ratr_mask;
-
-                        if (get_rf_type(rtlphy) == RF_1T2R ||
-                            get_rf_type(rtlphy) == RF_1T1R)
-                                ratr_mask = 0x000ff005;
-                        else
-                                ratr_mask = 0x0f0ff005;
+                if (get_rf_type(rtlphy) == RF_1T2R ||
+                    get_rf_type(rtlphy) == RF_1T1R)
+                        ratr_mask = 0x000ff005;
+                else
+                        ratr_mask = 0x0f0ff005;
 
-                        ratr_value &= ratr_mask;
-                }
+                ratr_value &= ratr_mask;
                 break;
         default:
                 if (rtlphy->rf_type == RF_1T2R)
@@ -1930,17 +1940,16 @@ static void rtl92ce_update_hal_rate_mask(struct ieee80211_hw *hw,
         struct rtl_sta_info *sta_entry = NULL;
         u32 ratr_bitmap;
         u8 ratr_index;
-        u8 curtxbw_40mhz = (sta->bandwidth >= IEEE80211_STA_RX_BW_40) ? 1 : 0;
-        u8 curshortgi_40mhz = curtxbw_40mhz &&
-                              (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40) ?
-                                1 : 0;
+        u8 curtxbw_40mhz = (sta->ht_cap.cap &
+                            IEEE80211_HT_CAP_SUP_WIDTH_20_40) ? 1 : 0;
+        u8 curshortgi_40mhz = (sta->ht_cap.cap &
+                               IEEE80211_HT_CAP_SGI_40) ?  1 : 0;
         u8 curshortgi_20mhz = (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20) ?
                                 1 : 0;
         enum wireless_mode wirelessmode = 0;
         bool shortgi = false;
         u8 rate_mask[5];
         u8 macid = 0;
-        u8 mimo_ps = IEEE80211_SMPS_OFF;
 
         sta_entry = (struct rtl_sta_info *) sta->drv_priv;
         wirelessmode = sta_entry->wireless_mode;
@@ -1985,47 +1994,38 @@ static void rtl92ce_update_hal_rate_mask(struct ieee80211_hw *hw,
         case WIRELESS_MODE_N_5G:
                 ratr_index = RATR_INX_WIRELESS_NGB;
 
-                if (mimo_ps == IEEE80211_SMPS_STATIC) {
-                        if (rssi_level == 1)
-                                ratr_bitmap &= 0x00070000;
-                        else if (rssi_level == 2)
-                                ratr_bitmap &= 0x0007f000;
-                        else
-                                ratr_bitmap &= 0x0007f005;
+                if (rtlphy->rf_type == RF_1T2R ||
+                    rtlphy->rf_type == RF_1T1R) {
+                        if (curtxbw_40mhz) {
+                                if (rssi_level == 1)
+                                        ratr_bitmap &= 0x000f0000;
+                                else if (rssi_level == 2)
+                                        ratr_bitmap &= 0x000ff000;
+                                else
+                                        ratr_bitmap &= 0x000ff015;
+                        } else {
+                                if (rssi_level == 1)
+                                        ratr_bitmap &= 0x000f0000;
+                                else if (rssi_level == 2)
+                                        ratr_bitmap &= 0x000ff000;
+                                else
+                                        ratr_bitmap &= 0x000ff005;
+                        }
                 } else {
-                        if (rtlphy->rf_type == RF_1T2R ||
-                            rtlphy->rf_type == RF_1T1R) {
-                                if (curtxbw_40mhz) {
-                                        if (rssi_level == 1)
-                                                ratr_bitmap &= 0x000f0000;
-                                        else if (rssi_level == 2)
-                                                ratr_bitmap &= 0x000ff000;
-                                        else
-                                                ratr_bitmap &= 0x000ff015;
-                                } else {
-                                        if (rssi_level == 1)
-                                                ratr_bitmap &= 0x000f0000;
-                                        else if (rssi_level == 2)
-                                                ratr_bitmap &= 0x000ff000;
-                                        else
-                                                ratr_bitmap &= 0x000ff005;
-                                }
+                        if (curtxbw_40mhz) {
+                                if (rssi_level == 1)
+                                        ratr_bitmap &= 0x0f0f0000;
+                                else if (rssi_level == 2)
+                                        ratr_bitmap &= 0x0f0ff000;
+                                else
+                                        ratr_bitmap &= 0x0f0ff015;
                         } else {
-                                if (curtxbw_40mhz) {
-                                        if (rssi_level == 1)
-                                                ratr_bitmap &= 0x0f0f0000;
-                                        else if (rssi_level == 2)
-                                                ratr_bitmap &= 0x0f0ff000;
-                                        else
-                                                ratr_bitmap &= 0x0f0ff015;
-                                } else {
-                                        if (rssi_level == 1)
-                                                ratr_bitmap &= 0x0f0f0000;
-                                        else if (rssi_level == 2)
-                                                ratr_bitmap &= 0x0f0ff000;
-                                        else
-                                                ratr_bitmap &= 0x0f0ff005;
-                                }
+                                if (rssi_level == 1)
+                                        ratr_bitmap &= 0x0f0f0000;
+                                else if (rssi_level == 2)
+                                        ratr_bitmap &= 0x0f0ff000;
+                                else
+                                        ratr_bitmap &= 0x0f0ff005;
                         }
                 }
 
@@ -2058,9 +2058,6 @@ static void rtl92ce_update_hal_rate_mask(struct ieee80211_hw *hw,
                  "Rate_index:%x, ratr_val:%x, %5phC\n",
                  ratr_index, ratr_bitmap, rate_mask);
         rtl92c_fill_h2c_cmd(hw, H2C_RA_MASK, 5, rate_mask);
-
-        if (macid != 0)
-                sta_entry->ratr_index = ratr_index;
 }
 
 void rtl92ce_update_hal_rate_tbl(struct ieee80211_hw *hw,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/phy.c b/drivers/net/wireless/rtlwifi/rtl8192ce/phy.c
index bc5ca989b915..1ee5a6ae9960 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/phy.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/phy.c
@@ -518,11 +518,12 @@ static bool _rtl92ce_phy_set_rf_power_state(struct ieee80211_hw *hw,
                 }
         case ERFSLEEP:{
                         if (ppsc->rfpwr_state == ERFOFF)
-                                return false;
+                                break;
                         for (queue_id = 0, i = 0;
                              queue_id < RTL_PCI_MAX_TX_QUEUE_COUNT;) {
                                 ring = &pcipriv->dev.tx_ring[queue_id];
-                                if (skb_queue_len(&ring->queue) == 0) {
+                                if (queue_id == BEACON_QUEUE ||
+                                    skb_queue_len(&ring->queue) == 0) {
                                         queue_id++;
                                         continue;
                                 } else {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
index dd5aa089126a..de6cb6c3a48c 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
@@ -334,21 +334,21 @@ static struct rtl_hal_cfg rtl92ce_hal_cfg = {
         .maps[RTL_IMR_ROK] = IMR_ROK,
         .maps[RTL_IBSS_INT_MASKS] = (IMR_BCNINT | IMR_TBDOK | IMR_TBDER),
 
-        .maps[RTL_RC_CCK_RATE1M] = DESC92_RATE1M,
-        .maps[RTL_RC_CCK_RATE2M] = DESC92_RATE2M,
-        .maps[RTL_RC_CCK_RATE5_5M] = DESC92_RATE5_5M,
-        .maps[RTL_RC_CCK_RATE11M] = DESC92_RATE11M,
-        .maps[RTL_RC_OFDM_RATE6M] = DESC92_RATE6M,
-        .maps[RTL_RC_OFDM_RATE9M] = DESC92_RATE9M,
-        .maps[RTL_RC_OFDM_RATE12M] = DESC92_RATE12M,
-        .maps[RTL_RC_OFDM_RATE18M] = DESC92_RATE18M,
-        .maps[RTL_RC_OFDM_RATE24M] = DESC92_RATE24M,
-        .maps[RTL_RC_OFDM_RATE36M] = DESC92_RATE36M,
-        .maps[RTL_RC_OFDM_RATE48M] = DESC92_RATE48M,
-        .maps[RTL_RC_OFDM_RATE54M] = DESC92_RATE54M,
-
-        .maps[RTL_RC_HT_RATEMCS7] = DESC92_RATEMCS7,
-        .maps[RTL_RC_HT_RATEMCS15] = DESC92_RATEMCS15,
+        .maps[RTL_RC_CCK_RATE1M] = DESC_RATE1M,
+        .maps[RTL_RC_CCK_RATE2M] = DESC_RATE2M,
+        .maps[RTL_RC_CCK_RATE5_5M] = DESC_RATE5_5M,
+        .maps[RTL_RC_CCK_RATE11M] = DESC_RATE11M,
+        .maps[RTL_RC_OFDM_RATE6M] = DESC_RATE6M,
+        .maps[RTL_RC_OFDM_RATE9M] = DESC_RATE9M,
+        .maps[RTL_RC_OFDM_RATE12M] = DESC_RATE12M,
+        .maps[RTL_RC_OFDM_RATE18M] = DESC_RATE18M,
+        .maps[RTL_RC_OFDM_RATE24M] = DESC_RATE24M,
+        .maps[RTL_RC_OFDM_RATE36M] = DESC_RATE36M,
+        .maps[RTL_RC_OFDM_RATE48M] = DESC_RATE48M,
+        .maps[RTL_RC_OFDM_RATE54M] = DESC_RATE54M,
+
+        .maps[RTL_RC_HT_RATEMCS7] = DESC_RATEMCS7,
+        .maps[RTL_RC_HT_RATEMCS15] = DESC_RATEMCS15,
 };
 
 static const struct pci_device_id rtl92ce_pci_ids[] = {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c b/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
index e88dcd0e0af1..84ddd4d07a1d 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
@@ -257,8 +257,8 @@ static void _rtl92ce_query_rxphystatus(struct ieee80211_hw *hw,
                 pstats->recvsignalpower = rx_pwr_all;
 
                 /* (3)EVM of HT rate */
-                if (pstats->is_ht && pstats->rate >= DESC92_RATEMCS8 &&
-                    pstats->rate <= DESC92_RATEMCS15)
+                if (pstats->is_ht && pstats->rate >= DESC_RATEMCS8 &&
+                    pstats->rate <= DESC_RATEMCS15)
                         max_spatial_stream = 2;
                 else
                         max_spatial_stream = 1;
@@ -400,9 +400,8 @@ bool rtl92ce_rx_query_desc(struct ieee80211_hw *hw,
          * are use (RX_FLAG_HT)
          * Notice: this is diff with windows define
          */
-        rx_status->rate_idx = rtlwifi_rate_mapping(hw,
-                                stats->is_ht, stats->rate,
-                                stats->isfirst_ampdu);
+        rx_status->rate_idx = rtlwifi_rate_mapping(hw, stats->is_ht,
+                                                   false, stats->rate);
 
         rx_status->mactime = stats->timestamp_low;
         if (phystatus) {
@@ -501,7 +500,7 @@ void rtl92ce_tx_fill_desc(struct ieee80211_hw *hw,
                 SET_TX_DESC_RTS_BW(pdesc, 0);
                 SET_TX_DESC_RTS_SC(pdesc, tcb_desc->rts_sc);
                 SET_TX_DESC_RTS_SHORT(pdesc,
-                                      ((tcb_desc->rts_rate <= DESC92_RATE54M) ?
+                                      ((tcb_desc->rts_rate <= DESC_RATE54M) ?
                                        (tcb_desc->rts_use_shortpreamble ? 1 : 0)
                                        : (tcb_desc->rts_use_shortgi ? 1 : 0)));
 
@@ -624,7 +623,7 @@ void rtl92ce_tx_fill_cmddesc(struct ieee80211_hw *hw,
         if (firstseg)
                 SET_TX_DESC_OFFSET(pdesc, USB_HWDESC_HEADER_LEN);
 
-        SET_TX_DESC_TX_RATE(pdesc, DESC92_RATE1M);
+        SET_TX_DESC_TX_RATE(pdesc, DESC_RATE1M);
 
         SET_TX_DESC_SEQ(pdesc, 0);
 
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
index 551321728ae0..fe4b699a12f5 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
@@ -1000,6 +1000,7 @@ int rtl92cu_hw_init(struct ieee80211_hw *hw)
         local_save_flags(flags);
         local_irq_enable();
 
+        rtlhal->fw_ready = false;
         rtlhal->hw_type = HARDWARE_TYPE_RTL8192CU;
         err = _rtl92cu_init_mac(hw);
         if (err) {
@@ -1013,6 +1014,8 @@ int rtl92cu_hw_init(struct ieee80211_hw *hw)
                 err = 1;
                 goto exit;
         }
+
+        rtlhal->fw_ready = true;
         rtlhal->last_hmeboxnum = 0; /* h2c */
         _rtl92cu_phy_param_tab_init(hw);
         rtl92cu_phy_mac_config(hw);
@@ -1509,6 +1512,7 @@ void rtl92cu_set_beacon_related_registers(struct ieee80211_hw *hw)
         /* TODO: Modify later (Find the right parameters)
          * NOTE: Fix test chip's bug (about contention windows's randomness) */
         if ((mac->opmode == NL80211_IFTYPE_ADHOC) ||
+            (mac->opmode == NL80211_IFTYPE_MESH_POINT) ||
             (mac->opmode == NL80211_IFTYPE_AP)) {
                 rtl_write_byte(rtlpriv, REG_RXTSF_OFFSET_CCK, 0x50);
                 rtl_write_byte(rtlpriv, REG_RXTSF_OFFSET_OFDM, 0x50);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c b/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c
index c2d8ec6afcda..133e395b7401 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c
@@ -880,8 +880,8 @@ static void _rtl92c_query_rxphystatus(struct ieee80211_hw *hw,
                 pstats->rxpower = rx_pwr_all;
                 pstats->recvsignalpower = rx_pwr_all;
                 if (GET_RX_DESC_RX_MCS(pdesc) &&
-                    GET_RX_DESC_RX_MCS(pdesc) >= DESC92_RATEMCS8 &&
-                    GET_RX_DESC_RX_MCS(pdesc) <= DESC92_RATEMCS15)
+                    GET_RX_DESC_RX_MCS(pdesc) >= DESC_RATEMCS8 &&
+                    GET_RX_DESC_RX_MCS(pdesc) <= DESC_RATEMCS15)
                         max_spatial_stream = 2;
                 else
                         max_spatial_stream = 1;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
index e06bafee37f9..90a714c189a8 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
@@ -257,20 +257,20 @@ static struct rtl_hal_cfg rtl92cu_hal_cfg = {
         .maps[RTL_IMR_ROK] = IMR_ROK,
         .maps[RTL_IBSS_INT_MASKS] = (IMR_BCNINT | IMR_TBDOK | IMR_TBDER),
 
-        .maps[RTL_RC_CCK_RATE1M] = DESC92_RATE1M,
-        .maps[RTL_RC_CCK_RATE2M] = DESC92_RATE2M,
-        .maps[RTL_RC_CCK_RATE5_5M] = DESC92_RATE5_5M,
-        .maps[RTL_RC_CCK_RATE11M] = DESC92_RATE11M,
-        .maps[RTL_RC_OFDM_RATE6M] = DESC92_RATE6M,
-        .maps[RTL_RC_OFDM_RATE9M] = DESC92_RATE9M,
-        .maps[RTL_RC_OFDM_RATE12M] = DESC92_RATE12M,
-        .maps[RTL_RC_OFDM_RATE18M] = DESC92_RATE18M,
-        .maps[RTL_RC_OFDM_RATE24M] = DESC92_RATE24M,
-        .maps[RTL_RC_OFDM_RATE36M] = DESC92_RATE36M,
-        .maps[RTL_RC_OFDM_RATE48M] = DESC92_RATE48M,
-        .maps[RTL_RC_OFDM_RATE54M] = DESC92_RATE54M,
-        .maps[RTL_RC_HT_RATEMCS7] = DESC92_RATEMCS7,
-        .maps[RTL_RC_HT_RATEMCS15] = DESC92_RATEMCS15,
+        .maps[RTL_RC_CCK_RATE1M] = DESC_RATE1M,
+        .maps[RTL_RC_CCK_RATE2M] = DESC_RATE2M,
+        .maps[RTL_RC_CCK_RATE5_5M] = DESC_RATE5_5M,
+        .maps[RTL_RC_CCK_RATE11M] = DESC_RATE11M,
+        .maps[RTL_RC_OFDM_RATE6M] = DESC_RATE6M,
+        .maps[RTL_RC_OFDM_RATE9M] = DESC_RATE9M,
+        .maps[RTL_RC_OFDM_RATE12M] = DESC_RATE12M,
+        .maps[RTL_RC_OFDM_RATE18M] = DESC_RATE18M,
+        .maps[RTL_RC_OFDM_RATE24M] = DESC_RATE24M,
+        .maps[RTL_RC_OFDM_RATE36M] = DESC_RATE36M,
+        .maps[RTL_RC_OFDM_RATE48M] = DESC_RATE48M,
+        .maps[RTL_RC_OFDM_RATE54M] = DESC_RATE54M,
+        .maps[RTL_RC_HT_RATEMCS7] = DESC_RATEMCS7,
+        .maps[RTL_RC_HT_RATEMCS15] = DESC_RATEMCS15,
 };
 
 #define USB_VENDER_ID_REALTEK           0x0bda
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
index f383d5f1fed5..cbead007171f 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
@@ -325,6 +325,7 @@ bool rtl92cu_rx_query_desc(struct ieee80211_hw *hw,
                                    && (GET_RX_DESC_FAGGR(pdesc) == 1));
         stats->timestamp_low = GET_RX_DESC_TSFL(pdesc);
         stats->rx_is40Mhzpacket = (bool) GET_RX_DESC_BW(pdesc);
+        stats->is_ht = (bool)GET_RX_DESC_RX_HT(pdesc);
         rx_status->freq = hw->conf.chandef.chan->center_freq;
         rx_status->band = hw->conf.chandef.chan->band;
         if (GET_RX_DESC_CRC32(pdesc))
@@ -338,10 +339,8 @@ bool rtl92cu_rx_query_desc(struct ieee80211_hw *hw,
         rx_status->flag |= RX_FLAG_MACTIME_START;
         if (stats->decrypted)
                 rx_status->flag |= RX_FLAG_DECRYPTED;
-        rx_status->rate_idx = rtlwifi_rate_mapping(hw,
-                                        (bool)GET_RX_DESC_RX_HT(pdesc),
-                                        (u8)GET_RX_DESC_RX_MCS(pdesc),
-                                        (bool)GET_RX_DESC_PAGGR(pdesc));
+        rx_status->rate_idx = rtlwifi_rate_mapping(hw, stats->is_ht,
+                                                   false, stats->rate);
         rx_status->mactime = GET_RX_DESC_TSFL(pdesc);
         if (phystatus) {
                 p_drvinfo = (struct rx_fwinfo_92c *)(skb->data +
@@ -393,6 +392,7 @@ static void _rtl_rx_process(struct ieee80211_hw *hw, struct sk_buff *skb)
                                    && (GET_RX_DESC_FAGGR(rxdesc) == 1));
         stats.timestamp_low = GET_RX_DESC_TSFL(rxdesc);
         stats.rx_is40Mhzpacket = (bool) GET_RX_DESC_BW(rxdesc);
+        stats.is_ht = (bool)GET_RX_DESC_RX_HT(rxdesc);
         /* TODO: is center_freq changed when doing scan? */
         /* TODO: Shall we add protection or just skip those two step? */
         rx_status->freq = hw->conf.chandef.chan->center_freq;
@@ -406,10 +406,8 @@ static void _rtl_rx_process(struct ieee80211_hw *hw, struct sk_buff *skb)
         if (GET_RX_DESC_RX_HT(rxdesc))
                 rx_status->flag |= RX_FLAG_HT;
         /* Data rate */
-        rx_status->rate_idx = rtlwifi_rate_mapping(hw,
-                                        (bool)GET_RX_DESC_RX_HT(rxdesc),
-                                        (u8)GET_RX_DESC_RX_MCS(rxdesc),
-                                        (bool)GET_RX_DESC_PAGGR(rxdesc));
+        rx_status->rate_idx = rtlwifi_rate_mapping(hw, stats.is_ht,
+                                                   false, stats.rate);
         /*  There is a phy status after this rx descriptor. */
         if (GET_RX_DESC_PHY_STATUS(rxdesc)) {
                 p_drvinfo = (struct rx_fwinfo_92c *)(rxdesc + RTL_RX_DESC_SIZE);
@@ -545,7 +543,7 @@ void rtl92cu_tx_fill_desc(struct ieee80211_hw *hw,
         SET_TX_DESC_RTS_BW(txdesc, 0);
         SET_TX_DESC_RTS_SC(txdesc, tcb_desc->rts_sc);
         SET_TX_DESC_RTS_SHORT(txdesc,
-                              ((tcb_desc->rts_rate <= DESC92_RATE54M) ?
+                              ((tcb_desc->rts_rate <= DESC_RATE54M) ?
                                (tcb_desc->rts_use_shortpreamble ? 1 : 0)
                                : (tcb_desc->rts_use_shortgi ? 1 : 0)));
         if (mac->bw_40) {
@@ -644,7 +642,7 @@ void rtl92cu_fill_fake_txdesc(struct ieee80211_hw *hw, u8 * pDesc,
         }
         SET_TX_DESC_USE_RATE(pDesc, 1); /* use data rate which is set by Sw */
         SET_TX_DESC_OWN(pDesc, 1);
-        SET_TX_DESC_TX_RATE(pDesc, DESC92_RATE1M);
+        SET_TX_DESC_TX_RATE(pDesc, DESC_RATE1M);
         _rtl_tx_desc_checksum(pDesc);
 }
 
@@ -660,7 +658,7 @@ void rtl92cu_tx_fill_cmddesc(struct ieee80211_hw *hw,
         memset((void *)pdesc, 0, RTL_TX_HEADER_SIZE);
         if (firstseg)
                 SET_TX_DESC_OFFSET(pdesc, RTL_TX_HEADER_SIZE);
-        SET_TX_DESC_TX_RATE(pdesc, DESC92_RATE1M);
+        SET_TX_DESC_TX_RATE(pdesc, DESC_RATE1M);
         SET_TX_DESC_SEQ(pdesc, 0);
         SET_TX_DESC_LINIP(pdesc, 0);
         SET_TX_DESC_QUEUE_SEL(pdesc, fw_queue);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/dm.c b/drivers/net/wireless/rtlwifi/rtl8192de/dm.c
index 304c443b89b2..a1be5a68edfb 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/dm.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/dm.c
@@ -29,6 +29,7 @@
 
 #include "../wifi.h"
 #include "../base.h"
+#include "../core.h"
 #include "reg.h"
 #include "def.h"
 #include "phy.h"
@@ -155,34 +156,6 @@ static const u8 cckswing_table_ch14[CCK_TABLE_SIZE][8] = {
         {0x09, 0x08, 0x07, 0x04, 0x00, 0x00, 0x00, 0x00}     /* 32, -16.0dB */
 };
 
-static void rtl92d_dm_diginit(struct ieee80211_hw *hw)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct dig_t *de_digtable = &rtlpriv->dm_digtable;
-
-        de_digtable->dig_enable_flag = true;
-        de_digtable->dig_ext_port_stage = DIG_EXT_PORT_STAGE_MAX;
-        de_digtable->cur_igvalue = 0x20;
-        de_digtable->pre_igvalue = 0x0;
-        de_digtable->cursta_cstate = DIG_STA_DISCONNECT;
-        de_digtable->presta_cstate = DIG_STA_DISCONNECT;
-        de_digtable->curmultista_cstate = DIG_MULTISTA_DISCONNECT;
-        de_digtable->rssi_lowthresh = DM_DIG_THRESH_LOW;
-        de_digtable->rssi_highthresh = DM_DIG_THRESH_HIGH;
-        de_digtable->fa_lowthresh = DM_FALSEALARM_THRESH_LOW;
-        de_digtable->fa_highthresh = DM_FALSEALARM_THRESH_HIGH;
-        de_digtable->rx_gain_max = DM_DIG_FA_UPPER;
-        de_digtable->rx_gain_min = DM_DIG_FA_LOWER;
-        de_digtable->back_val = DM_DIG_BACKOFF_DEFAULT;
-        de_digtable->back_range_max = DM_DIG_BACKOFF_MAX;
-        de_digtable->back_range_min = DM_DIG_BACKOFF_MIN;
-        de_digtable->pre_cck_pd_state = CCK_PD_STAGE_LOWRSSI;
-        de_digtable->cur_cck_pd_state = CCK_PD_STAGE_MAX;
-        de_digtable->large_fa_hit = 0;
-        de_digtable->recover_cnt = 0;
-        de_digtable->forbidden_igi = DM_DIG_FA_LOWER;
-}
-
 static void rtl92d_dm_false_alarm_counter_statistics(struct ieee80211_hw *hw)
 {
         u32 ret_value;
@@ -1305,7 +1278,9 @@ void rtl92d_dm_init(struct ieee80211_hw *hw)
         struct rtl_priv *rtlpriv = rtl_priv(hw);
 
         rtlpriv->dm.dm_type = DM_TYPE_BYDRIVER;
-        rtl92d_dm_diginit(hw);
+        rtl_dm_diginit(hw, 0x20);
+        rtlpriv->dm_digtable.rx_gain_max = DM_DIG_FA_UPPER;
+        rtlpriv->dm_digtable.rx_gain_min = DM_DIG_FA_LOWER;
         rtl92d_dm_init_dynamic_txpower(hw);
         rtl92d_dm_init_edca_turbo(hw);
         rtl92d_dm_init_rate_adaptive_mask(hw);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/dm.h b/drivers/net/wireless/rtlwifi/rtl8192de/dm.h
index 3fea0c11c24a..f2d318ceeb28 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/dm.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/dm.h
@@ -42,25 +42,12 @@
 #define BW_AUTO_SWITCH_HIGH_LOW                 25
 #define BW_AUTO_SWITCH_LOW_HIGH                 30
 
-#define DM_DIG_THRESH_HIGH                      40
-#define DM_DIG_THRESH_LOW                       35
-
-#define DM_FALSEALARM_THRESH_LOW                400
-#define DM_FALSEALARM_THRESH_HIGH               1000
-
-#define DM_DIG_MAX                              0x3e
-#define DM_DIG_MIN                              0x1c
-
 #define DM_DIG_FA_UPPER                         0x32
 #define DM_DIG_FA_LOWER                         0x20
 #define DM_DIG_FA_TH0                           0x100
 #define DM_DIG_FA_TH1                           0x400
 #define DM_DIG_FA_TH2                           0x600
 
-#define DM_DIG_BACKOFF_MAX                      12
-#define DM_DIG_BACKOFF_MIN                      -4
-#define DM_DIG_BACKOFF_DEFAULT                  10
-
 #define RXPATHSELECTION_SS_TH_lOW               30
 #define RXPATHSELECTION_DIFF_TH                 18
 
@@ -108,14 +95,6 @@ enum tag_dynamic_init_gain_operation_type_definition {
         DIG_OP_TYPE_MAX
 };
 
-enum tag_cck_packet_detection_threshold_type_definition {
-        CCK_PD_STAGE_LOWRSSI = 0,
-        CCK_PD_STAGE_HIGHRSSI = 1,
-        CCK_FA_STAGE_LOW = 2,
-        CCK_FA_STAGE_HIGH = 3,
-        CCK_PD_STAGE_MAX = 4,
-};
-
 enum dm_1r_cca {
         CCA_1R = 0,
         CCA_2R = 1,
@@ -134,23 +113,6 @@ enum dm_sw_ant_switch {
         ANS_ANTENNA_MAX = 3,
 };
 
-enum dm_dig_ext_port_alg {
-        DIG_EXT_PORT_STAGE_0 = 0,
-        DIG_EXT_PORT_STAGE_1 = 1,
-        DIG_EXT_PORT_STAGE_2 = 2,
-        DIG_EXT_PORT_STAGE_3 = 3,
-        DIG_EXT_PORT_STAGE_MAX = 4,
-};
-
-enum dm_dig_connect {
-        DIG_STA_DISCONNECT = 0,
-        DIG_STA_CONNECT = 1,
-        DIG_STA_BEFORE_CONNECT = 2,
-        DIG_MULTISTA_DISCONNECT = 3,
-        DIG_MULTISTA_CONNECT = 4,
-        DIG_CONNECT_MAX
-};
-
 void rtl92d_dm_init(struct ieee80211_hw *hw);
 void rtl92d_dm_watchdog(struct ieee80211_hw *hw);
 void rtl92d_dm_init_edca_turbo(struct ieee80211_hw *hw);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/fw.c b/drivers/net/wireless/rtlwifi/rtl8192de/fw.c
index 23177076b97f..62ef8209718f 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/fw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/fw.c
@@ -540,23 +540,6 @@ void rtl92d_fill_h2c_cmd(struct ieee80211_hw *hw,
         return;
 }
 
-void rtl92d_set_fw_pwrmode_cmd(struct ieee80211_hw *hw, u8 mode)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        u8 u1_h2c_set_pwrmode[3] = { 0 };
-        struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
-
-        RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD, "FW LPS mode = %d\n", mode);
-        SET_H2CCMD_PWRMODE_PARM_MODE(u1_h2c_set_pwrmode, mode);
-        SET_H2CCMD_PWRMODE_PARM_SMART_PS(u1_h2c_set_pwrmode, 1);
-        SET_H2CCMD_PWRMODE_PARM_BCN_PASS_TIME(u1_h2c_set_pwrmode,
-                                              ppsc->reg_max_lps_awakeintvl);
-        RT_PRINT_DATA(rtlpriv, COMP_CMD, DBG_DMESG,
-                      "rtl92d_set_fw_rsvdpagepkt(): u1_h2c_set_pwrmode",
-                      u1_h2c_set_pwrmode, 3);
-        rtl92d_fill_h2c_cmd(hw, H2C_SETPWRMODE, 3, u1_h2c_set_pwrmode);
-}
-
 static bool _rtl92d_cmd_send_packet(struct ieee80211_hw *hw,
                                     struct sk_buff *skb)
 {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/fw.h b/drivers/net/wireless/rtlwifi/rtl8192de/fw.h
index a55a803a0b4d..1646e7c3d0f8 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/fw.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/fw.h
@@ -136,7 +136,6 @@ int rtl92d_download_fw(struct ieee80211_hw *hw);
 void rtl92d_fill_h2c_cmd(struct ieee80211_hw *hw, u8 element_id,
                          u32 cmd_len, u8 *p_cmdbuffer);
 void rtl92d_firmware_selfreset(struct ieee80211_hw *hw);
-void rtl92d_set_fw_pwrmode_cmd(struct ieee80211_hw *hw, u8 mode);
 void rtl92d_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished);
 void rtl92d_set_fw_joinbss_report_cmd(struct ieee80211_hw *hw, u8 mstatus);
 
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/hw.c b/drivers/net/wireless/rtlwifi/rtl8192de/hw.c
index 280c3da42993..01bcc2d218dc 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/hw.c
@@ -546,7 +546,7 @@ static bool _rtl92de_llt_table_init(struct ieee80211_hw *hw)
                 txpktbuf_bndy = 246;
                 value8 = 0;
                 value32 = 0x80bf0d29;
-        } else if (rtlpriv->rtlhal.macphymode != SINGLEMAC_SINGLEPHY) {
+        } else {
                 maxPage = 127;
                 txpktbuf_bndy = 123;
                 value8 = 0;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/sw.c b/drivers/net/wireless/rtlwifi/rtl8192de/sw.c
index a0aba088259a..b19d0398215f 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/sw.c
@@ -337,21 +337,21 @@ static struct rtl_hal_cfg rtl92de_hal_cfg = {
         .maps[RTL_IMR_ROK] = IMR_ROK,
         .maps[RTL_IBSS_INT_MASKS] = (IMR_BCNINT | IMR_TBDOK | IMR_TBDER),
 
-        .maps[RTL_RC_CCK_RATE1M] = DESC92_RATE1M,
-        .maps[RTL_RC_CCK_RATE2M] = DESC92_RATE2M,
-        .maps[RTL_RC_CCK_RATE5_5M] = DESC92_RATE5_5M,
-        .maps[RTL_RC_CCK_RATE11M] = DESC92_RATE11M,
-        .maps[RTL_RC_OFDM_RATE6M] = DESC92_RATE6M,
-        .maps[RTL_RC_OFDM_RATE9M] = DESC92_RATE9M,
-        .maps[RTL_RC_OFDM_RATE12M] = DESC92_RATE12M,
-        .maps[RTL_RC_OFDM_RATE18M] = DESC92_RATE18M,
-        .maps[RTL_RC_OFDM_RATE24M] = DESC92_RATE24M,
-        .maps[RTL_RC_OFDM_RATE36M] = DESC92_RATE36M,
-        .maps[RTL_RC_OFDM_RATE48M] = DESC92_RATE48M,
-        .maps[RTL_RC_OFDM_RATE54M] = DESC92_RATE54M,
-
-        .maps[RTL_RC_HT_RATEMCS7] = DESC92_RATEMCS7,
-        .maps[RTL_RC_HT_RATEMCS15] = DESC92_RATEMCS15,
+        .maps[RTL_RC_CCK_RATE1M] = DESC_RATE1M,
+        .maps[RTL_RC_CCK_RATE2M] = DESC_RATE2M,
+        .maps[RTL_RC_CCK_RATE5_5M] = DESC_RATE5_5M,
+        .maps[RTL_RC_CCK_RATE11M] = DESC_RATE11M,
+        .maps[RTL_RC_OFDM_RATE6M] = DESC_RATE6M,
+        .maps[RTL_RC_OFDM_RATE9M] = DESC_RATE9M,
+        .maps[RTL_RC_OFDM_RATE12M] = DESC_RATE12M,
+        .maps[RTL_RC_OFDM_RATE18M] = DESC_RATE18M,
+        .maps[RTL_RC_OFDM_RATE24M] = DESC_RATE24M,
+        .maps[RTL_RC_OFDM_RATE36M] = DESC_RATE36M,
+        .maps[RTL_RC_OFDM_RATE48M] = DESC_RATE48M,
+        .maps[RTL_RC_OFDM_RATE54M] = DESC_RATE54M,
+
+        .maps[RTL_RC_HT_RATEMCS7] = DESC_RATEMCS7,
+        .maps[RTL_RC_HT_RATEMCS15] = DESC_RATEMCS15,
 };
 
 static struct pci_device_id rtl92de_pci_ids[] = {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/trx.c b/drivers/net/wireless/rtlwifi/rtl8192de/trx.c
index 8efbcc7af250..1feaa629dd4f 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/trx.c
@@ -235,8 +235,8 @@ static void _rtl92de_query_rxphystatus(struct ieee80211_hw *hw,
                 pstats->rx_pwdb_all = pwdb_all;
                 pstats->rxpower = rx_pwr_all;
                 pstats->recvsignalpower = rx_pwr_all;
-                if (pdesc->rxht && pdesc->rxmcs >= DESC92_RATEMCS8 &&
-                    pdesc->rxmcs <= DESC92_RATEMCS15)
+                if (pdesc->rxht && pdesc->rxmcs >= DESC_RATEMCS8 &&
+                    pdesc->rxmcs <= DESC_RATEMCS15)
                         max_spatial_stream = 2;
                 else
                         max_spatial_stream = 1;
@@ -499,6 +499,7 @@ bool rtl92de_rx_query_desc(struct ieee80211_hw *hw,	struct rtl_stats *stats,
                                          && (GET_RX_DESC_FAGGR(pdesc) == 1));
         stats->timestamp_low = GET_RX_DESC_TSFL(pdesc);
         stats->rx_is40Mhzpacket = (bool) GET_RX_DESC_BW(pdesc);
+        stats->is_ht = (bool)GET_RX_DESC_RXHT(pdesc);
         rx_status->freq = hw->conf.chandef.chan->center_freq;
         rx_status->band = hw->conf.chandef.chan->band;
         if (GET_RX_DESC_CRC32(pdesc))
@@ -512,10 +513,8 @@ bool rtl92de_rx_query_desc(struct ieee80211_hw *hw,	struct rtl_stats *stats,
         rx_status->flag |= RX_FLAG_MACTIME_START;
         if (stats->decrypted)
                 rx_status->flag |= RX_FLAG_DECRYPTED;
-        rx_status->rate_idx = rtlwifi_rate_mapping(hw,
-                                        (bool)GET_RX_DESC_RXHT(pdesc),
-                                        (u8)GET_RX_DESC_RXMCS(pdesc),
-                                        (bool)GET_RX_DESC_PAGGR(pdesc));
+        rx_status->rate_idx = rtlwifi_rate_mapping(hw, stats->is_ht,
+                                                   false, stats->rate);
         rx_status->mactime = GET_RX_DESC_TSFL(pdesc);
         if (phystatus) {
                 p_drvinfo = (struct rx_fwinfo_92d *)(skb->data +
@@ -612,14 +611,14 @@ void rtl92de_tx_fill_desc(struct ieee80211_hw *hw,
                 }
                 /* 5G have no CCK rate */
                 if (rtlhal->current_bandtype == BAND_ON_5G)
-                        if (ptcb_desc->hw_rate < DESC92_RATE6M)
-                                ptcb_desc->hw_rate = DESC92_RATE6M;
+                        if (ptcb_desc->hw_rate < DESC_RATE6M)
+                                ptcb_desc->hw_rate = DESC_RATE6M;
                 SET_TX_DESC_TX_RATE(pdesc, ptcb_desc->hw_rate);
                 if (ptcb_desc->use_shortgi || ptcb_desc->use_shortpreamble)
                         SET_TX_DESC_DATA_SHORTGI(pdesc, 1);
 
                 if (rtlhal->macphymode == DUALMAC_DUALPHY &&
-                        ptcb_desc->hw_rate == DESC92_RATEMCS7)
+                        ptcb_desc->hw_rate == DESC_RATEMCS7)
                         SET_TX_DESC_DATA_SHORTGI(pdesc, 1);
 
                 if (info->flags & IEEE80211_TX_CTL_AMPDU) {
@@ -635,13 +634,13 @@ void rtl92de_tx_fill_desc(struct ieee80211_hw *hw,
                 SET_TX_DESC_RTS_STBC(pdesc, ((ptcb_desc->rts_stbc) ? 1 : 0));
                 /* 5G have no CCK rate */
                 if (rtlhal->current_bandtype == BAND_ON_5G)
-                        if (ptcb_desc->rts_rate < DESC92_RATE6M)
-                                ptcb_desc->rts_rate = DESC92_RATE6M;
+                        if (ptcb_desc->rts_rate < DESC_RATE6M)
+                                ptcb_desc->rts_rate = DESC_RATE6M;
                 SET_TX_DESC_RTS_RATE(pdesc, ptcb_desc->rts_rate);
                 SET_TX_DESC_RTS_BW(pdesc, 0);
                 SET_TX_DESC_RTS_SC(pdesc, ptcb_desc->rts_sc);
                 SET_TX_DESC_RTS_SHORT(pdesc, ((ptcb_desc->rts_rate <=
-                        DESC92_RATE54M) ?
+                        DESC_RATE54M) ?
                         (ptcb_desc->rts_use_shortpreamble ? 1 : 0) :
                         (ptcb_desc->rts_use_shortgi ? 1 : 0)));
                 if (bw_40) {
@@ -756,9 +755,9 @@ void rtl92de_tx_fill_cmddesc(struct ieee80211_hw *hw,
          * The braces are needed no matter what checkpatch says
          */
         if (rtlhal->current_bandtype == BAND_ON_5G) {
-                SET_TX_DESC_TX_RATE(pdesc, DESC92_RATE6M);
+                SET_TX_DESC_TX_RATE(pdesc, DESC_RATE6M);
         } else {
-                SET_TX_DESC_TX_RATE(pdesc, DESC92_RATE1M);
+                SET_TX_DESC_TX_RATE(pdesc, DESC_RATE1M);
         }
         SET_TX_DESC_SEQ(pdesc, 0);
         SET_TX_DESC_LINIP(pdesc, 0);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ee/dm.c b/drivers/net/wireless/rtlwifi/rtl8192ee/dm.c
index 77deedf79d1d..459f3d0efa2f 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ee/dm.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ee/dm.c
@@ -26,6 +26,7 @@
 #include "../wifi.h"
 #include "../base.h"
 #include "../pci.h"
+#include "../core.h"
 #include "reg.h"
 #include "def.h"
 #include "phy.h"
@@ -151,35 +152,6 @@ static const u8 cckswing_table_ch14[CCK_TABLE_SIZE][8] = {
         {0x09, 0x08, 0x07, 0x04, 0x00, 0x00, 0x00, 0x00}  /* 32, -16.0dB */
 };
 
-static void rtl92ee_dm_diginit(struct ieee80211_hw *hw)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct dig_t *dm_dig = &rtlpriv->dm_digtable;
-
-        dm_dig->cur_igvalue = rtl_get_bbreg(hw, DM_REG_IGI_A_11N,
-                                            DM_BIT_IGI_11N);
-        dm_dig->rssi_lowthresh = DM_DIG_THRESH_LOW;
-        dm_dig->rssi_highthresh = DM_DIG_THRESH_HIGH;
-        dm_dig->fa_lowthresh = DM_FALSEALARM_THRESH_LOW;
-        dm_dig->fa_highthresh = DM_FALSEALARM_THRESH_HIGH;
-        dm_dig->rx_gain_max = DM_DIG_MAX;
-        dm_dig->rx_gain_min = DM_DIG_MIN;
-        dm_dig->back_val = DM_DIG_BACKOFF_DEFAULT;
-        dm_dig->back_range_max = DM_DIG_BACKOFF_MAX;
-        dm_dig->back_range_min = DM_DIG_BACKOFF_MIN;
-        dm_dig->pre_cck_cca_thres = 0xff;
-        dm_dig->cur_cck_cca_thres = 0x83;
-        dm_dig->forbidden_igi = DM_DIG_MIN;
-        dm_dig->large_fa_hit = 0;
-        dm_dig->recover_cnt = 0;
-        dm_dig->dig_dynamic_min = DM_DIG_MIN;
-        dm_dig->dig_dynamic_min_1 = DM_DIG_MIN;
-        dm_dig->media_connect_0 = false;
-        dm_dig->media_connect_1 = false;
-        rtlpriv->dm.dm_initialgain_enable = true;
-        dm_dig->bt30_cur_igi = 0x32;
-}
-
 static void rtl92ee_dm_false_alarm_counter_statistics(struct ieee80211_hw *hw)
 {
         u32 ret_value;
@@ -298,7 +270,7 @@ static void rtl92ee_dm_dig(struct ieee80211_hw *hw)
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
         struct dig_t *dm_dig = &rtlpriv->dm_digtable;
-        u8 dig_dynamic_min , dig_maxofmin;
+        u8 dig_min_0, dig_maxofmin;
         bool bfirstconnect , bfirstdisconnect;
         u8 dm_dig_max, dm_dig_min;
         u8 current_igi = dm_dig->cur_igvalue;
@@ -308,7 +280,7 @@ static void rtl92ee_dm_dig(struct ieee80211_hw *hw)
         if (mac->act_scanning)
                 return;
 
-        dig_dynamic_min = dm_dig->dig_dynamic_min;
+        dig_min_0 = dm_dig->dig_min_0;
         bfirstconnect = (mac->link_state >= MAC80211_LINKED) &&
                         !dm_dig->media_connect_0;
         bfirstdisconnect = (mac->link_state < MAC80211_LINKED) &&
@@ -329,19 +301,19 @@ static void rtl92ee_dm_dig(struct ieee80211_hw *hw)
                 if (rtlpriv->dm.one_entry_only) {
                         offset = 0;
                         if (dm_dig->rssi_val_min - offset < dm_dig_min)
-                                dig_dynamic_min = dm_dig_min;
+                                dig_min_0 = dm_dig_min;
                         else if (dm_dig->rssi_val_min - offset >
                                  dig_maxofmin)
-                                dig_dynamic_min = dig_maxofmin;
+                                dig_min_0 = dig_maxofmin;
                         else
-                                dig_dynamic_min = dm_dig->rssi_val_min - offset;
+                                dig_min_0 = dm_dig->rssi_val_min - offset;
                 } else {
-                        dig_dynamic_min = dm_dig_min;
+                        dig_min_0 = dm_dig_min;
                 }
 
         } else {
                 dm_dig->rx_gain_max = dm_dig_max;
-                dig_dynamic_min = dm_dig_min;
+                dig_min_0 = dm_dig_min;
                 RT_TRACE(rtlpriv, COMP_DIG, DBG_LOUD, "no link\n");
         }
 
@@ -368,10 +340,10 @@ static void rtl92ee_dm_dig(struct ieee80211_hw *hw)
                 } else {
                         if (dm_dig->large_fa_hit < 3) {
                                 if ((dm_dig->forbidden_igi - 1) <
-                                    dig_dynamic_min) {
-                                        dm_dig->forbidden_igi = dig_dynamic_min;
+                                    dig_min_0) {
+                                        dm_dig->forbidden_igi = dig_min_0;
                                         dm_dig->rx_gain_min =
-                                                                dig_dynamic_min;
+                                                                dig_min_0;
                                 } else {
                                         dm_dig->forbidden_igi--;
                                         dm_dig->rx_gain_min =
@@ -430,7 +402,7 @@ static void rtl92ee_dm_dig(struct ieee80211_hw *hw)
         rtl92ee_dm_write_dig(hw , current_igi);
         dm_dig->media_connect_0 = ((mac->link_state >= MAC80211_LINKED) ?
                                    true : false);
-        dm_dig->dig_dynamic_min = dig_dynamic_min;
+        dm_dig->dig_min_0 = dig_min_0;
 }
 
 void rtl92ee_dm_write_cck_cca_thres(struct ieee80211_hw *hw, u8 cur_thres)
@@ -1088,10 +1060,11 @@ static void rtl92ee_dm_init_dynamic_atc_switch(struct ieee80211_hw *hw)
 void rtl92ee_dm_init(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
+        u32 cur_igvalue = rtl_get_bbreg(hw, DM_REG_IGI_A_11N, DM_BIT_IGI_11N);
 
         rtlpriv->dm.dm_type = DM_TYPE_BYDRIVER;
 
-        rtl92ee_dm_diginit(hw);
+        rtl_dm_diginit(hw, cur_igvalue);
         rtl92ee_dm_init_rate_adaptive_mask(hw);
         rtl92ee_dm_init_primary_cca_check(hw);
         rtl92ee_dm_init_edca_turbo(hw);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ee/dm.h b/drivers/net/wireless/rtlwifi/rtl8192ee/dm.h
index 881db7d6fef7..107d5a488fa8 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ee/dm.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192ee/dm.h
@@ -189,28 +189,12 @@
 #define BW_AUTO_SWITCH_HIGH_LOW                 25
 #define BW_AUTO_SWITCH_LOW_HIGH                 30
 
-#define DM_DIG_THRESH_HIGH                      40
-#define DM_DIG_THRESH_LOW                       35
-
-#define DM_FALSEALARM_THRESH_LOW                400
-#define DM_FALSEALARM_THRESH_HIGH               1000
-
-#define DM_DIG_MAX                              0x3e
-#define DM_DIG_MIN                              0x1e
-
-#define DM_DIG_MAX_AP                           0x32
-#define DM_DIG_MIN_AP                           0x20
-
 #define DM_DIG_FA_UPPER                         0x3e
 #define DM_DIG_FA_LOWER                         0x1e
 #define DM_DIG_FA_TH0                           0x200
 #define DM_DIG_FA_TH1                           0x300
 #define DM_DIG_FA_TH2                           0x400
 
-#define DM_DIG_BACKOFF_MAX                      12
-#define DM_DIG_BACKOFF_MIN                      -4
-#define DM_DIG_BACKOFF_DEFAULT                  10
-
 #define RXPATHSELECTION_SS_TH_LOW               30
 #define RXPATHSELECTION_DIFF_TH                 18
 
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ee/fw.c b/drivers/net/wireless/rtlwifi/rtl8192ee/fw.c
index 45c128b91f7f..c5d4b8013cde 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ee/fw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ee/fw.c
@@ -666,7 +666,6 @@ void rtl92ee_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished)
         struct sk_buff *skb = NULL;
 
         u32 totalpacketlen;
-        bool rtstatus;
         u8 u1rsvdpageloc[5] = { 0 };
         bool b_dlok = false;
 
@@ -728,10 +727,7 @@ void rtl92ee_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished)
         memcpy((u8 *)skb_put(skb, totalpacketlen),
                &reserved_page_packet, totalpacketlen);
 
-        rtstatus = rtl_cmd_send_packet(hw, skb);
-
-        if (rtstatus)
-                b_dlok = true;
+        b_dlok = true;
 
         if (b_dlok) {
                 RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD ,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c b/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
index 1a87edca2c3f..b461b3128da5 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
@@ -85,29 +85,6 @@ static void _rtl92ee_enable_bcn_sub_func(struct ieee80211_hw *hw)
         _rtl92ee_set_bcn_ctrl_reg(hw, 0, BIT(1));
 }
 
-static void _rtl92ee_return_beacon_queue_skb(struct ieee80211_hw *hw)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
-        struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[BEACON_QUEUE];
-        unsigned long flags;
-
-        spin_lock_irqsave(&rtlpriv->locks.irq_th_lock, flags);
-        while (skb_queue_len(&ring->queue)) {
-                struct rtl_tx_buffer_desc *entry =
-                                                &ring->buffer_desc[ring->idx];
-                struct sk_buff *skb = __skb_dequeue(&ring->queue);
-
-                pci_unmap_single(rtlpci->pdev,
-                                 rtlpriv->cfg->ops->get_desc(
-                                 (u8 *)entry, true, HW_DESC_TXBUFF_ADDR),
-                                 skb->len, PCI_DMA_TODEVICE);
-                kfree_skb(skb);
-                ring->idx = (ring->idx + 1) % ring->entries;
-        }
-        spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock, flags);
-}
-
 static void _rtl92ee_disable_bcn_sub_func(struct ieee80211_hw *hw)
 {
         _rtl92ee_set_bcn_ctrl_reg(hw, BIT(1), 0);
@@ -403,9 +380,6 @@ static void _rtl92ee_download_rsvd_page(struct ieee80211_hw *hw)
                 rtl_write_byte(rtlpriv, REG_DWBCN0_CTRL + 2,
                                bcnvalid_reg | BIT(0));
 
-                /* Return Beacon TCB */
-                _rtl92ee_return_beacon_queue_skb(hw);
-
                 /* download rsvd page */
                 rtl92ee_set_fw_rsvdpagepkt(hw, false);
 
@@ -1163,6 +1137,139 @@ void rtl92ee_enable_hw_security_config(struct ieee80211_hw *hw)
         rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_WPA_CONFIG, &sec_reg_value);
 }
 
+static bool _rtl8192ee_check_pcie_dma_hang(struct rtl_priv *rtlpriv)
+{
+        u8 tmp;
+
+        /* write reg 0x350 Bit[26]=1. Enable debug port. */
+        tmp = rtl_read_byte(rtlpriv, REG_BACKDOOR_DBI_DATA + 3);
+        if (!(tmp & BIT(2))) {
+                rtl_write_byte(rtlpriv, REG_BACKDOOR_DBI_DATA + 3,
+                               tmp | BIT(2));
+                mdelay(100); /* Suggested by DD Justin_tsai. */
+        }
+
+        /* read reg 0x350 Bit[25] if 1 : RX hang
+         * read reg 0x350 Bit[24] if 1 : TX hang
+         */
+        tmp = rtl_read_byte(rtlpriv, REG_BACKDOOR_DBI_DATA + 3);
+        if ((tmp & BIT(0)) || (tmp & BIT(1))) {
+                RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+                         "CheckPcieDMAHang8192EE(): true!!\n");
+                return true;
+        }
+        return false;
+}
+
+static void _rtl8192ee_reset_pcie_interface_dma(struct rtl_priv *rtlpriv,
+                                                bool mac_power_on)
+{
+        u8 tmp;
+        bool release_mac_rx_pause;
+        u8 backup_pcie_dma_pause;
+
+        RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+                 "ResetPcieInterfaceDMA8192EE()\n");
+
+        /* Revise Note: Follow the document "PCIe RX DMA Hang Reset Flow_v03"
+         * released by SD1 Alan.
+         */
+
+        /* 1. disable register write lock
+         *      write 0x1C bit[1:0] = 2'h0
+         *      write 0xCC bit[2] = 1'b1
+         */
+        tmp = rtl_read_byte(rtlpriv, REG_RSV_CTRL);
+        tmp &= ~(BIT(1) | BIT(0));
+        rtl_write_byte(rtlpriv, REG_RSV_CTRL, tmp);
+        tmp = rtl_read_byte(rtlpriv, REG_PMC_DBG_CTRL2);
+        tmp |= BIT(2);
+        rtl_write_byte(rtlpriv, REG_PMC_DBG_CTRL2, tmp);
+
+        /* 2. Check and pause TRX DMA
+         *      write 0x284 bit[18] = 1'b1
+         *      write 0x301 = 0xFF
+         */
+        tmp = rtl_read_byte(rtlpriv, REG_RXDMA_CONTROL);
+        if (tmp & BIT(2)) {
+                /* Already pause before the function for another reason. */
+                release_mac_rx_pause = false;
+        } else {
+                rtl_write_byte(rtlpriv, REG_RXDMA_CONTROL, (tmp | BIT(2)));
+                release_mac_rx_pause = true;
+        }
+
+        backup_pcie_dma_pause = rtl_read_byte(rtlpriv, REG_PCIE_CTRL_REG + 1);
+        if (backup_pcie_dma_pause != 0xFF)
+                rtl_write_byte(rtlpriv, REG_PCIE_CTRL_REG + 1, 0xFF);
+
+        if (mac_power_on) {
+                /* 3. reset TRX function
+                 *      write 0x100 = 0x00
+                 */
+                rtl_write_byte(rtlpriv, REG_CR, 0);
+        }
+
+        /* 4. Reset PCIe DMA
+         *      write 0x003 bit[0] = 0
+         */
+        tmp = rtl_read_byte(rtlpriv, REG_SYS_FUNC_EN + 1);
+        tmp &= ~(BIT(0));
+        rtl_write_byte(rtlpriv, REG_SYS_FUNC_EN + 1, tmp);
+
+        /* 5. Enable PCIe DMA
+         *      write 0x003 bit[0] = 1
+         */
+        tmp = rtl_read_byte(rtlpriv, REG_SYS_FUNC_EN + 1);
+        tmp |= BIT(0);
+        rtl_write_byte(rtlpriv, REG_SYS_FUNC_EN + 1, tmp);
+
+        if (mac_power_on) {
+                /* 6. enable TRX function
+                 *      write 0x100 = 0xFF
+                 */
+                rtl_write_byte(rtlpriv, REG_CR, 0xFF);
+
+                /* We should init LLT & RQPN and
+                 * prepare Tx/Rx descrptor address later
+                 * because MAC function is reset.
+                 */
+        }
+
+        /* 7. Restore PCIe autoload down bit
+         *      write 0xF8 bit[17] = 1'b1
+         */
+        tmp = rtl_read_byte(rtlpriv, REG_MAC_PHY_CTRL_NORMAL + 2);
+        tmp |= BIT(1);
+        rtl_write_byte(rtlpriv, REG_MAC_PHY_CTRL_NORMAL + 2, tmp);
+
+        /* In MAC power on state, BB and RF maybe in ON state,
+         * if we release TRx DMA here
+         * it will cause packets to be started to Tx/Rx,
+         * so we release Tx/Rx DMA later.
+         */
+        if (!mac_power_on) {
+                /* 8. release TRX DMA
+                 *      write 0x284 bit[18] = 1'b0
+                 *      write 0x301 = 0x00
+                 */
+                if (release_mac_rx_pause) {
+                        tmp = rtl_read_byte(rtlpriv, REG_RXDMA_CONTROL);
+                        rtl_write_byte(rtlpriv, REG_RXDMA_CONTROL,
+                                       (tmp & (~BIT(2))));
+                }
+                rtl_write_byte(rtlpriv, REG_PCIE_CTRL_REG + 1,
+                               backup_pcie_dma_pause);
+        }
+
+        /* 9. lock system register
+         *      write 0xCC bit[2] = 1'b0
+         */
+        tmp = rtl_read_byte(rtlpriv, REG_PMC_DBG_CTRL2);
+        tmp &= ~(BIT(2));
+        rtl_write_byte(rtlpriv, REG_PMC_DBG_CTRL2, tmp);
+}
+
 int rtl92ee_hw_init(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
@@ -1188,6 +1295,13 @@ int rtl92ee_hw_init(struct ieee80211_hw *hw)
                 rtlhal->fw_ps_state = FW_PS_STATE_ALL_ON_92E;
         }
 
+        if (_rtl8192ee_check_pcie_dma_hang(rtlpriv)) {
+                RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "92ee dma hang!\n");
+                _rtl8192ee_reset_pcie_interface_dma(rtlpriv,
+                                                    rtlhal->mac_func_enable);
+                rtlhal->mac_func_enable = false;
+        }
+
         rtstatus = _rtl92ee_init_mac(hw);
 
         rtl_write_byte(rtlpriv, 0x577, 0x03);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ee/reg.h b/drivers/net/wireless/rtlwifi/rtl8192ee/reg.h
index 3f2a9596e7cd..1eaa1fab550d 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ee/reg.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192ee/reg.h
@@ -77,9 +77,11 @@
 #define REG_HIMRE                               0x00B8
 #define REG_HISRE                               0x00BC
 
+#define REG_PMC_DBG_CTRL2                       0x00CC
 #define REG_EFUSE_ACCESS                        0x00CF
 #define REG_HPON_FSM                            0x00EC
 #define REG_SYS_CFG1                            0x00F0
+#define REG_MAC_PHY_CTRL_NORMAL                 0x00F8
 #define REG_SYS_CFG2                            0x00FC
 
 #define REG_CR                                  0x0100
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ee/sw.c b/drivers/net/wireless/rtlwifi/rtl8192ee/sw.c
index 9b5a7d5be121..c31c6bfb536d 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ee/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ee/sw.c
@@ -113,8 +113,6 @@ int rtl92ee_init_sw_vars(struct ieee80211_hw *hw)
                                   RCR_HTC_LOC_CTRL              |
                                   RCR_AMF                       |
                                   RCR_ACF                       |
-                                  RCR_ADF                       |
-                                  RCR_AICV                      |
                                   RCR_ACRC32                    |
                                   RCR_AB                        |
                                   RCR_AM                        |
@@ -241,6 +239,7 @@ static struct rtl_hal_ops rtl8192ee_hal_ops = {
         .set_desc = rtl92ee_set_desc,
         .get_desc = rtl92ee_get_desc,
         .is_tx_desc_closed = rtl92ee_is_tx_desc_closed,
+        .get_available_desc = rtl92ee_get_available_desc,
         .tx_polling = rtl92ee_tx_polling,
         .enable_hw_sec = rtl92ee_enable_hw_security_config,
         .set_key = rtl92ee_set_key,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ee/trx.c b/drivers/net/wireless/rtlwifi/rtl8192ee/trx.c
index 2fcbef1d029f..d39ee67f6113 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ee/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ee/trx.c
@@ -47,164 +47,6 @@ static u8 _rtl92ee_map_hwqueue_to_fwqueue(struct sk_buff *skb, u8 hw_queue)
         return skb->priority;
 }
 
-/* mac80211's rate_idx is like this:
- *
- * 2.4G band:rx_status->band == IEEE80211_BAND_2GHZ
- *
- * B/G rate:
- * (rx_status->flag & RX_FLAG_HT) = 0,
- * DESC92C_RATE1M-->DESC92C_RATE54M ==> idx is 0-->11,
- *
- * N rate:
- * (rx_status->flag & RX_FLAG_HT) = 1,
- * DESC92C_RATEMCS0-->DESC92C_RATEMCS15 ==> idx is 0-->15
- *
- * 5G band:rx_status->band == IEEE80211_BAND_5GHZ
- * A rate:
- * (rx_status->flag & RX_FLAG_HT) = 0,
- * DESC92C_RATE6M-->DESC92C_RATE54M ==> idx is 0-->7,
- *
- * N rate:
- * (rx_status->flag & RX_FLAG_HT) = 1,
- * DESC92C_RATEMCS0-->DESC92C_RATEMCS15 ==> idx is 0-->15
- */
-static int _rtl92ee_rate_mapping(struct ieee80211_hw *hw,
-                                 bool isht, u8 desc_rate)
-{
-        int rate_idx;
-
-        if (!isht) {
-                if (IEEE80211_BAND_2GHZ == hw->conf.chandef.chan->band) {
-                        switch (desc_rate) {
-                        case DESC92C_RATE1M:
-                                rate_idx = 0;
-                                break;
-                        case DESC92C_RATE2M:
-                                rate_idx = 1;
-                                break;
-                        case DESC92C_RATE5_5M:
-                                rate_idx = 2;
-                                break;
-                        case DESC92C_RATE11M:
-                                rate_idx = 3;
-                                break;
-                        case DESC92C_RATE6M:
-                                rate_idx = 4;
-                                break;
-                        case DESC92C_RATE9M:
-                                rate_idx = 5;
-                                break;
-                        case DESC92C_RATE12M:
-                                rate_idx = 6;
-                                break;
-                        case DESC92C_RATE18M:
-                                rate_idx = 7;
-                                break;
-                        case DESC92C_RATE24M:
-                                rate_idx = 8;
-                                break;
-                        case DESC92C_RATE36M:
-                                rate_idx = 9;
-                                break;
-                        case DESC92C_RATE48M:
-                                rate_idx = 10;
-                                break;
-                        case DESC92C_RATE54M:
-                                rate_idx = 11;
-                                break;
-                        default:
-                                rate_idx = 0;
-                                break;
-                        }
-                } else {
-                        switch (desc_rate) {
-                        case DESC92C_RATE6M:
-                                rate_idx = 0;
-                                break;
-                        case DESC92C_RATE9M:
-                                rate_idx = 1;
-                                break;
-                        case DESC92C_RATE12M:
-                                rate_idx = 2;
-                                break;
-                        case DESC92C_RATE18M:
-                                rate_idx = 3;
-                                break;
-                        case DESC92C_RATE24M:
-                                rate_idx = 4;
-                                break;
-                        case DESC92C_RATE36M:
-                                rate_idx = 5;
-                                break;
-                        case DESC92C_RATE48M:
-                                rate_idx = 6;
-                                break;
-                        case DESC92C_RATE54M:
-                                rate_idx = 7;
-                                break;
-                        default:
-                                rate_idx = 0;
-                                break;
-                        }
-                }
-        } else {
-                switch (desc_rate) {
-                case DESC92C_RATEMCS0:
-                        rate_idx = 0;
-                        break;
-                case DESC92C_RATEMCS1:
-                        rate_idx = 1;
-                        break;
-                case DESC92C_RATEMCS2:
-                        rate_idx = 2;
-                        break;
-                case DESC92C_RATEMCS3:
-                        rate_idx = 3;
-                        break;
-                case DESC92C_RATEMCS4:
-                        rate_idx = 4;
-                        break;
-                case DESC92C_RATEMCS5:
-                        rate_idx = 5;
-                        break;
-                case DESC92C_RATEMCS6:
-                        rate_idx = 6;
-                        break;
-                case DESC92C_RATEMCS7:
-                        rate_idx = 7;
-                        break;
-                case DESC92C_RATEMCS8:
-                        rate_idx = 8;
-                        break;
-                case DESC92C_RATEMCS9:
-                        rate_idx = 9;
-                        break;
-                case DESC92C_RATEMCS10:
-                        rate_idx = 10;
-                        break;
-                case DESC92C_RATEMCS11:
-                        rate_idx = 11;
-                        break;
-                case DESC92C_RATEMCS12:
-                        rate_idx = 12;
-                        break;
-                case DESC92C_RATEMCS13:
-                        rate_idx = 13;
-                        break;
-                case DESC92C_RATEMCS14:
-                        rate_idx = 14;
-                        break;
-                case DESC92C_RATEMCS15:
-                        rate_idx = 15;
-                        break;
-                default:
-                        rate_idx = 0;
-                        break;
-                }
-        }
-        return rate_idx;
-}
-
 static void _rtl92ee_query_rxphystatus(struct ieee80211_hw *hw,
                                        struct rtl_stats *pstatus, u8 *pdesc,
                                        struct rx_fwinfo *p_drvinfo,
@@ -345,8 +187,8 @@ static void _rtl92ee_query_rxphystatus(struct ieee80211_hw *hw,
                 pstatus->recvsignalpower = rx_pwr_all;
 
                 /* (3)EVM of HT rate */
-                if (pstatus->rate >= DESC92C_RATEMCS8 &&
-                    pstatus->rate <= DESC92C_RATEMCS15)
+                if (pstatus->rate >= DESC_RATEMCS8 &&
+                    pstatus->rate <= DESC_RATEMCS15)
                         max_spatial_stream = 2;
                 else
                         max_spatial_stream = 1;
@@ -512,6 +354,10 @@ bool rtl92ee_rx_query_desc(struct ieee80211_hw *hw,
         struct ieee80211_hdr *hdr;
         u32 phystatus = GET_RX_DESC_PHYST(pdesc);
 
+        if (GET_RX_STATUS_DESC_RPT_SEL(pdesc) == 0)
+                status->packet_report_type = NORMAL_RX;
+        else
+                status->packet_report_type = C2H_PACKET;
         status->length = (u16)GET_RX_DESC_PKT_LEN(pdesc);
         status->rx_drvinfo_size = (u8)GET_RX_DESC_DRV_INFO_SIZE(pdesc) *
                                   RX_DRV_INFO_SIZE_UNIT;
@@ -576,9 +422,8 @@ bool rtl92ee_rx_query_desc(struct ieee80211_hw *hw,
          * are use (RX_FLAG_HT)
          * Notice: this is diff with windows define
          */
-        rx_status->rate_idx = _rtl92ee_rate_mapping(hw,
-                                                    status->is_ht,
-                                                    status->rate);
+        rx_status->rate_idx = rtlwifi_rate_mapping(hw, status->is_ht,
+                                                   false, status->rate);
 
         rx_status->mactime = status->timestamp_low;
         if (phystatus) {
@@ -654,14 +499,7 @@ u16 rtl92ee_rx_desc_buff_remained_cnt(struct ieee80211_hw *hw, u8 queue_index)
         if (!start_rx)
                 return 0;
 
-        if ((last_read_point > (RX_DESC_NUM_92E / 2)) &&
-            (read_point <= (RX_DESC_NUM_92E / 2))) {
-                remind_cnt = RX_DESC_NUM_92E - write_point;
-        } else {
-                remind_cnt = (read_point >= write_point) ?
-                             (read_point - write_point) :
-                             (RX_DESC_NUM_92E - write_point + read_point);
-        }
+        remind_cnt = calc_fifo_space(read_point, write_point);
 
         if (remind_cnt == 0)
                 return 0;
@@ -710,7 +548,7 @@ static u16 get_desc_addr_fr_q_idx(u16 queue_index)
         return desc_address;
 }
 
-void rtl92ee_get_available_desc(struct ieee80211_hw *hw, u8 q_idx)
+u16 rtl92ee_get_available_desc(struct ieee80211_hw *hw, u8 q_idx)
 {
         struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
         struct rtl_priv *rtlpriv = rtl_priv(hw);
@@ -723,12 +561,11 @@ void rtl92ee_get_available_desc(struct ieee80211_hw *hw, u8 q_idx)
         current_tx_read_point = (u16)((tmp_4byte >> 16) & 0x0fff);
         current_tx_write_point = (u16)((tmp_4byte) & 0x0fff);
 
-        point_diff = ((current_tx_read_point > current_tx_write_point) ?
-                      (current_tx_read_point - current_tx_write_point) :
-                      (TX_DESC_NUM_92E - current_tx_write_point +
-                       current_tx_read_point));
+        point_diff = calc_fifo_space(current_tx_read_point,
+                                     current_tx_write_point);
 
         rtlpci->tx_ring[q_idx].avl_desc = point_diff;
+        return point_diff;
 }
 
 void rtl92ee_pre_fill_tx_bd_desc(struct ieee80211_hw *hw,
@@ -901,13 +738,13 @@ void rtl92ee_tx_fill_desc(struct ieee80211_hw *hw,
                 } else {
                         if (rtlpriv->ra.is_special_data) {
                                 ptcb_desc->use_driver_rate = true;
-                                SET_TX_DESC_TX_RATE(pdesc, DESC92C_RATE11M);
+                                SET_TX_DESC_TX_RATE(pdesc, DESC_RATE11M);
                         } else {
                                 ptcb_desc->use_driver_rate = false;
                         }
                 }
 
-                if (ptcb_desc->hw_rate > DESC92C_RATEMCS0)
+                if (ptcb_desc->hw_rate > DESC_RATEMCS0)
                         short_gi = (ptcb_desc->use_shortgi) ? 1 : 0;
                 else
                         short_gi = (ptcb_desc->use_shortpreamble) ? 1 : 0;
@@ -927,7 +764,7 @@ void rtl92ee_tx_fill_desc(struct ieee80211_hw *hw,
                 SET_TX_DESC_RTS_RATE(pdesc, ptcb_desc->rts_rate);
                 SET_TX_DESC_RTS_SC(pdesc, ptcb_desc->rts_sc);
                 SET_TX_DESC_RTS_SHORT(pdesc,
-                                ((ptcb_desc->rts_rate <= DESC92C_RATE54M) ?
+                                ((ptcb_desc->rts_rate <= DESC_RATE54M) ?
                                  (ptcb_desc->rts_use_shortpreamble ? 1 : 0) :
                                  (ptcb_desc->rts_use_shortgi ? 1 : 0)));
 
@@ -1038,7 +875,7 @@ void rtl92ee_tx_fill_cmddesc(struct ieee80211_hw *hw,
         if (firstseg)
                 SET_TX_DESC_OFFSET(pdesc, txdesc_len);
 
-        SET_TX_DESC_TX_RATE(pdesc, DESC92C_RATE1M);
+        SET_TX_DESC_TX_RATE(pdesc, DESC_RATE1M);
 
         SET_TX_DESC_SEQ(pdesc, 0);
 
@@ -1207,8 +1044,7 @@ bool rtl92ee_is_tx_desc_closed(struct ieee80211_hw *hw, u8 hw_queue, u16 index)
         static u8 stop_report_cnt;
         struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[hw_queue];
 
-        /*checking Read/Write Point each interrupt wastes CPU */
-        if (stop_report_cnt > 15 || !rtlpriv->link_info.busytraffic) {
+        {
                 u16 point_diff = 0;
                 u16 cur_tx_rp, cur_tx_wp;
                 u32 tmpu32 = 0;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ee/trx.h b/drivers/net/wireless/rtlwifi/rtl8192ee/trx.h
index 6f9be1c7515c..8f78ac9e6040 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ee/trx.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192ee/trx.h
@@ -542,6 +542,8 @@
         LE_BITS_TO_4BYTE(__pdesc+8, 12, 4)
 #define GET_RX_DESC_RX_IS_QOS(__pdesc)                  \
         LE_BITS_TO_4BYTE(__pdesc+8, 16, 1)
+#define GET_RX_STATUS_DESC_RPT_SEL(__pdesc)             \
+        LE_BITS_TO_4BYTE(__pdesc+8, 28, 1)
 
 #define GET_RX_DESC_RXMCS(__pdesc)                      \
         LE_BITS_TO_4BYTE(__pdesc+12, 0, 7)
@@ -591,10 +593,10 @@ do {								\
 } while (0)
 
 #define RTL92EE_RX_HAL_IS_CCK_RATE(rxmcs)\
-        (rxmcs == DESC92C_RATE1M ||\
-         rxmcs == DESC92C_RATE2M ||\
-         rxmcs == DESC92C_RATE5_5M ||\
-         rxmcs == DESC92C_RATE11M)
+        (rxmcs == DESC_RATE1M ||\
+         rxmcs == DESC_RATE2M ||\
+         rxmcs == DESC_RATE5_5M ||\
+         rxmcs == DESC_RATE11M)
 
 #define IS_LITTLE_ENDIAN        1
 
@@ -829,7 +831,7 @@ void rtl92ee_rx_check_dma_ok(struct ieee80211_hw *hw, u8 *header_desc,
                              u8 queue_index);
 u16     rtl92ee_rx_desc_buff_remained_cnt(struct ieee80211_hw *hw,
                                           u8 queue_index);
-void rtl92ee_get_available_desc(struct ieee80211_hw *hw, u8 queue_index);
+u16 rtl92ee_get_available_desc(struct ieee80211_hw *hw, u8 queue_index);
 void rtl92ee_pre_fill_tx_bd_desc(struct ieee80211_hw *hw,
                                  u8 *tx_bd_desc, u8 *desc, u8 queue_index,
                                  struct sk_buff *skb, dma_addr_t addr);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/def.h b/drivers/net/wireless/rtlwifi/rtl8192se/def.h
index 6e7a70b43949..ef87c09b77d0 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/def.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/def.h
@@ -450,10 +450,10 @@
         SHIFT_AND_MASK_LE(__pdesc + 24, 0, 32)
 
 #define SE_RX_HAL_IS_CCK_RATE(_pdesc)\
-        (GET_RX_STATUS_DESC_RX_MCS(_pdesc) == DESC92_RATE1M ||  \
-         GET_RX_STATUS_DESC_RX_MCS(_pdesc) == DESC92_RATE2M ||  \
-         GET_RX_STATUS_DESC_RX_MCS(_pdesc) == DESC92_RATE5_5M ||\
-         GET_RX_STATUS_DESC_RX_MCS(_pdesc) == DESC92_RATE11M)
+        (GET_RX_STATUS_DESC_RX_MCS(_pdesc) == DESC_RATE1M ||    \
+         GET_RX_STATUS_DESC_RX_MCS(_pdesc) == DESC_RATE2M ||    \
+         GET_RX_STATUS_DESC_RX_MCS(_pdesc) == DESC_RATE5_5M ||\
+         GET_RX_STATUS_DESC_RX_MCS(_pdesc) == DESC_RATE11M)
 
 enum rf_optype {
         RF_OP_BY_SW_3WIRE = 0,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/dm.c b/drivers/net/wireless/rtlwifi/rtl8192se/dm.c
index b3a2d5ec59e6..575980b88658 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/dm.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/dm.c
@@ -29,6 +29,7 @@
 
 #include "../wifi.h"
 #include "../base.h"
+#include "../core.h"
 #include "reg.h"
 #include "def.h"
 #include "phy.h"
@@ -469,7 +470,7 @@ static void _rtl92s_dm_initial_gain_sta_beforeconnect(struct ieee80211_hw *hw)
                         if (digtable->backoff_enable_flag)
                                 rtl92s_backoff_enable_flag(hw);
                         else
-                                digtable->back_val = DM_DIG_BACKOFF;
+                                digtable->back_val = DM_DIG_BACKOFF_MAX;
 
                         if ((digtable->rssi_val + 10 - digtable->back_val) >
                                 digtable->rx_gain_max)
@@ -503,7 +504,7 @@ static void _rtl92s_dm_initial_gain_sta_beforeconnect(struct ieee80211_hw *hw)
                 digtable->dig_ext_port_stage = DIG_EXT_PORT_STAGE_MAX;
                 rtl92s_phy_set_fw_cmd(hw, FW_CMD_DIG_ENABLE);
 
-                digtable->back_val = DM_DIG_BACKOFF;
+                digtable->back_val = DM_DIG_BACKOFF_MAX;
                 digtable->cur_igvalue = rtlpriv->phy.default_initialgain[0];
                 digtable->pre_igvalue = 0;
                 return;
@@ -691,7 +692,7 @@ static void _rtl92s_dm_init_dig(struct ieee80211_hw *hw)
 
         /* for dig debug rssi value */
         digtable->rssi_val = 50;
-        digtable->back_val = DM_DIG_BACKOFF;
+        digtable->back_val = DM_DIG_BACKOFF_MAX;
         digtable->rx_gain_max = DM_DIG_MAX;
 
         digtable->rx_gain_min = DM_DIG_MIN;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/dm.h b/drivers/net/wireless/rtlwifi/rtl8192se/dm.h
index 2e9052c8fe4b..de6ac796c74d 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/dm.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/dm.h
@@ -54,24 +54,6 @@ enum dm_dig_sta {
         DM_STA_DIG_MAX
 };
 
-enum dm_dig_connect {
-        DIG_STA_DISCONNECT = 0,
-        DIG_STA_CONNECT = 1,
-        DIG_STA_BEFORE_CONNECT = 2,
-        DIG_AP_DISCONNECT = 3,
-        DIG_AP_CONNECT = 4,
-        DIG_AP_ADD_STATION = 5,
-        DIG_CONNECT_MAX
-};
-
-enum dm_dig_ext_port_alg {
-        DIG_EXT_PORT_STAGE_0 = 0,
-        DIG_EXT_PORT_STAGE_1 = 1,
-        DIG_EXT_PORT_STAGE_2 = 2,
-        DIG_EXT_PORT_STAGE_3 = 3,
-        DIG_EXT_PORT_STAGE_MAX = 4,
-};
-
 enum dm_ratr_sta {
         DM_RATR_STA_HIGH = 0,
         DM_RATR_STA_MIDDLEHIGH = 1,
@@ -99,22 +81,12 @@ enum dm_ratr_sta {
 #define TX_POWER_NEAR_FIELD_THRESH_LVL2 74
 #define TX_POWER_NEAR_FIELD_THRESH_LVL1 67
 
-#define DM_DIG_THRESH_HIGH              40
-#define DM_DIG_THRESH_LOW               35
-#define DM_FALSEALARM_THRESH_LOW        40
-#define DM_FALSEALARM_THRESH_HIGH       1000
 #define DM_DIG_HIGH_PWR_THRESH_HIGH     75
 #define DM_DIG_HIGH_PWR_THRESH_LOW      70
-#define DM_DIG_BACKOFF                  12
-#define DM_DIG_MAX                      0x3e
-#define DM_DIG_MIN                      0x1c
 #define DM_DIG_MIN_Netcore              0x12
-#define DM_DIG_BACKOFF_MAX              12
-#define DM_DIG_BACKOFF_MIN              -4
 
 void rtl92s_dm_watchdog(struct ieee80211_hw *hw);
 void rtl92s_dm_init(struct ieee80211_hw *hw);
 void rtl92s_dm_init_edca_turbo(struct ieee80211_hw *hw);
 
 #endif
-
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
index fb003868bdef..e1fd27c888bf 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
@@ -383,21 +383,21 @@ static struct rtl_hal_cfg rtl92se_hal_cfg = {
         .maps[RTL_IMR_ROK] = IMR_ROK,
         .maps[RTL_IBSS_INT_MASKS] = (IMR_BCNINT | IMR_TBDOK | IMR_TBDER),
 
-        .maps[RTL_RC_CCK_RATE1M] = DESC92_RATE1M,
-        .maps[RTL_RC_CCK_RATE2M] = DESC92_RATE2M,
-        .maps[RTL_RC_CCK_RATE5_5M] = DESC92_RATE5_5M,
-        .maps[RTL_RC_CCK_RATE11M] = DESC92_RATE11M,
-        .maps[RTL_RC_OFDM_RATE6M] = DESC92_RATE6M,
-        .maps[RTL_RC_OFDM_RATE9M] = DESC92_RATE9M,
-        .maps[RTL_RC_OFDM_RATE12M] = DESC92_RATE12M,
-        .maps[RTL_RC_OFDM_RATE18M] = DESC92_RATE18M,
-        .maps[RTL_RC_OFDM_RATE24M] = DESC92_RATE24M,
-        .maps[RTL_RC_OFDM_RATE36M] = DESC92_RATE36M,
-        .maps[RTL_RC_OFDM_RATE48M] = DESC92_RATE48M,
-        .maps[RTL_RC_OFDM_RATE54M] = DESC92_RATE54M,
-
-        .maps[RTL_RC_HT_RATEMCS7] = DESC92_RATEMCS7,
-        .maps[RTL_RC_HT_RATEMCS15] = DESC92_RATEMCS15,
+        .maps[RTL_RC_CCK_RATE1M] = DESC_RATE1M,
+        .maps[RTL_RC_CCK_RATE2M] = DESC_RATE2M,
+        .maps[RTL_RC_CCK_RATE5_5M] = DESC_RATE5_5M,
+        .maps[RTL_RC_CCK_RATE11M] = DESC_RATE11M,
+        .maps[RTL_RC_OFDM_RATE6M] = DESC_RATE6M,
+        .maps[RTL_RC_OFDM_RATE9M] = DESC_RATE9M,
+        .maps[RTL_RC_OFDM_RATE12M] = DESC_RATE12M,
+        .maps[RTL_RC_OFDM_RATE18M] = DESC_RATE18M,
+        .maps[RTL_RC_OFDM_RATE24M] = DESC_RATE24M,
+        .maps[RTL_RC_OFDM_RATE36M] = DESC_RATE36M,
+        .maps[RTL_RC_OFDM_RATE48M] = DESC_RATE48M,
+        .maps[RTL_RC_OFDM_RATE54M] = DESC_RATE54M,
+
+        .maps[RTL_RC_HT_RATEMCS7] = DESC_RATEMCS7,
+        .maps[RTL_RC_HT_RATEMCS15] = DESC_RATEMCS15,
 };
 
 static struct pci_device_id rtl92se_pci_ids[] = {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
index 672fd3b02835..125b29bd2f93 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
@@ -191,8 +191,8 @@ static void _rtl92se_query_rxphystatus(struct ieee80211_hw *hw,
                 pstats->rxpower = rx_pwr_all;
                 pstats->recvsignalpower = rx_pwr_all;
 
-                if (pstats->is_ht && pstats->rate >= DESC92_RATEMCS8 &&
-                    pstats->rate <= DESC92_RATEMCS15)
+                if (pstats->is_ht && pstats->rate >= DESC_RATEMCS8 &&
+                    pstats->rate <= DESC_RATEMCS15)
                         max_spatial_stream = 2;
                 else
                         max_spatial_stream = 1;
@@ -264,7 +264,6 @@ bool rtl92se_rx_query_desc(struct ieee80211_hw *hw, struct rtl_stats *stats,
         struct rx_fwinfo *p_drvinfo;
         u32 phystatus = (u32)GET_RX_STATUS_DESC_PHY_STATUS(pdesc);
         struct ieee80211_hdr *hdr;
-        bool first_ampdu = false;
 
         stats->length = (u16)GET_RX_STATUS_DESC_PKT_LEN(pdesc);
         stats->rx_drvinfo_size = (u8)GET_RX_STATUS_DESC_DRVINFO_SIZE(pdesc) * 8;
@@ -319,8 +318,8 @@ bool rtl92se_rx_query_desc(struct ieee80211_hw *hw, struct rtl_stats *stats,
                         rx_status->flag |= RX_FLAG_DECRYPTED;
         }
 
-        rx_status->rate_idx = rtlwifi_rate_mapping(hw,
-                              stats->is_ht, stats->rate, first_ampdu);
+        rx_status->rate_idx = rtlwifi_rate_mapping(hw, stats->is_ht,
+                                                   false, stats->rate);
 
         rx_status->mactime = stats->timestamp_low;
         if (phystatus) {
@@ -394,14 +393,14 @@ void rtl92se_tx_fill_desc(struct ieee80211_hw *hw,
                 SET_TX_DESC_RSVD_MACID(pdesc, reserved_macid);
 
                 SET_TX_DESC_TXHT(pdesc, ((ptcb_desc->hw_rate >=
-                                 DESC92_RATEMCS0) ? 1 : 0));
+                                 DESC_RATEMCS0) ? 1 : 0));
 
                 if (rtlhal->version == VERSION_8192S_ACUT) {
-                        if (ptcb_desc->hw_rate == DESC92_RATE1M ||
-                                ptcb_desc->hw_rate  == DESC92_RATE2M ||
-                                ptcb_desc->hw_rate == DESC92_RATE5_5M ||
-                                ptcb_desc->hw_rate == DESC92_RATE11M) {
-                                ptcb_desc->hw_rate = DESC92_RATE12M;
+                        if (ptcb_desc->hw_rate == DESC_RATE1M ||
+                            ptcb_desc->hw_rate  == DESC_RATE2M ||
+                            ptcb_desc->hw_rate == DESC_RATE5_5M ||
+                            ptcb_desc->hw_rate == DESC_RATE11M) {
+                                ptcb_desc->hw_rate = DESC_RATE12M;
                         }
                 }
 
@@ -430,7 +429,7 @@ void rtl92se_tx_fill_desc(struct ieee80211_hw *hw,
                 SET_TX_DESC_RTS_BANDWIDTH(pdesc, 0);
                 SET_TX_DESC_RTS_SUB_CARRIER(pdesc, ptcb_desc->rts_sc);
                 SET_TX_DESC_RTS_SHORT(pdesc, ((ptcb_desc->rts_rate <=
-                       DESC92_RATE54M) ?
+                       DESC_RATE54M) ?
                        (ptcb_desc->rts_use_shortpreamble ? 1 : 0)
                        : (ptcb_desc->rts_use_shortgi ? 1 : 0)));
 
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/dm.c b/drivers/net/wireless/rtlwifi/rtl8723ae/dm.c
index a0e86922780a..4c1c96c96a5a 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/dm.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/dm.c
@@ -26,6 +26,7 @@
 #include "../wifi.h"
 #include "../base.h"
 #include "../pci.h"
+#include "../core.h"
 #include "reg.h"
 #include "def.h"
 #include "phy.h"
@@ -146,31 +147,6 @@ static const u8 cckswing_table_ch14[CCK_TABLE_SIZE][8] = {
         {0x09, 0x08, 0x07, 0x04, 0x00, 0x00, 0x00, 0x00}
 };
 
-static void rtl8723e_dm_diginit(struct ieee80211_hw *hw)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct dig_t *dm_digtable = &rtlpriv->dm_digtable;
-
-        dm_digtable->dig_enable_flag = true;
-        dm_digtable->dig_ext_port_stage = DIG_EXT_PORT_STAGE_MAX;
-        dm_digtable->cur_igvalue = 0x20;
-        dm_digtable->pre_igvalue = 0x0;
-        dm_digtable->cursta_cstate = DIG_STA_DISCONNECT;
-        dm_digtable->presta_cstate = DIG_STA_DISCONNECT;
-        dm_digtable->curmultista_cstate = DIG_MULTISTA_DISCONNECT;
-        dm_digtable->rssi_lowthresh = DM_DIG_THRESH_LOW;
-        dm_digtable->rssi_highthresh = DM_DIG_THRESH_HIGH;
-        dm_digtable->fa_lowthresh = DM_FALSEALARM_THRESH_LOW;
-        dm_digtable->fa_highthresh = DM_FALSEALARM_THRESH_HIGH;
-        dm_digtable->rx_gain_max = DM_DIG_MAX;
-        dm_digtable->rx_gain_min = DM_DIG_MIN;
-        dm_digtable->back_val = DM_DIG_BACKOFF_DEFAULT;
-        dm_digtable->back_range_max = DM_DIG_BACKOFF_MAX;
-        dm_digtable->back_range_min = DM_DIG_BACKOFF_MIN;
-        dm_digtable->pre_cck_pd_state = CCK_PD_STAGE_MAX;
-        dm_digtable->cur_cck_pd_state = CCK_PD_STAGE_MAX;
-}
-
 static u8 rtl8723e_dm_initial_gain_min_pwdb(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
@@ -395,30 +371,30 @@ static void rtl8723e_dm_cck_packet_detection_thresh(struct ieee80211_hw *hw)
         if (dm_digtable->cursta_cstate == DIG_STA_CONNECT) {
                 dm_digtable->rssi_val_min = rtl8723e_dm_initial_gain_min_pwdb(hw);
 
-                if (dm_digtable->pre_cck_pd_state == CCK_PD_STAGE_LowRssi) {
+                if (dm_digtable->pre_cck_pd_state == CCK_PD_STAGE_LOWRSSI) {
                         if (dm_digtable->rssi_val_min <= 25)
                                 dm_digtable->cur_cck_pd_state =
-                                    CCK_PD_STAGE_LowRssi;
+                                    CCK_PD_STAGE_LOWRSSI;
                         else
                                 dm_digtable->cur_cck_pd_state =
-                                    CCK_PD_STAGE_HighRssi;
+                                    CCK_PD_STAGE_HIGHRSSI;
                 } else {
                         if (dm_digtable->rssi_val_min <= 20)
                                 dm_digtable->cur_cck_pd_state =
-                                    CCK_PD_STAGE_LowRssi;
+                                    CCK_PD_STAGE_LOWRSSI;
                         else
                                 dm_digtable->cur_cck_pd_state =
-                                    CCK_PD_STAGE_HighRssi;
+                                    CCK_PD_STAGE_HIGHRSSI;
                 }
         } else {
                 dm_digtable->cur_cck_pd_state = CCK_PD_STAGE_MAX;
         }
 
         if (dm_digtable->pre_cck_pd_state != dm_digtable->cur_cck_pd_state) {
-                if (dm_digtable->cur_cck_pd_state == CCK_PD_STAGE_LowRssi) {
+                if (dm_digtable->cur_cck_pd_state == CCK_PD_STAGE_LOWRSSI) {
                         if (rtlpriv->falsealm_cnt.cnt_cck_fail > 800)
                                 dm_digtable->cur_cck_fa_state =
-                                    CCK_FA_STAGE_High;
+                                    CCK_FA_STAGE_HIGH;
                         else
                                 dm_digtable->cur_cck_fa_state =
                                     CCK_FA_STAGE_LOW;
@@ -818,7 +794,7 @@ void rtl8723e_dm_init(struct ieee80211_hw *hw)
         struct rtl_priv *rtlpriv = rtl_priv(hw);
 
         rtlpriv->dm.dm_type = DM_TYPE_BYDRIVER;
-        rtl8723e_dm_diginit(hw);
+        rtl_dm_diginit(hw, 0x20);
         rtl8723_dm_init_dynamic_txpower(hw);
         rtl8723_dm_init_edca_turbo(hw);
         rtl8723e_dm_init_rate_adaptive_mask(hw);
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/dm.h b/drivers/net/wireless/rtlwifi/rtl8723ae/dm.h
index 6fa0feb05f6d..57111052e86b 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/dm.h
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/dm.h
@@ -42,25 +42,12 @@
 #define BW_AUTO_SWITCH_HIGH_LOW                 25
 #define BW_AUTO_SWITCH_LOW_HIGH                 30
 
-#define DM_DIG_THRESH_HIGH                      40
-#define DM_DIG_THRESH_LOW                       35
-
-#define DM_FALSEALARM_THRESH_LOW                400
-#define DM_FALSEALARM_THRESH_HIGH               1000
-
-#define DM_DIG_MAX                              0x3e
-#define DM_DIG_MIN                              0x1e
-
 #define DM_DIG_FA_UPPER                         0x32
 #define DM_DIG_FA_LOWER                         0x20
 #define DM_DIG_FA_TH0                           0x20
 #define DM_DIG_FA_TH1                           0x100
 #define DM_DIG_FA_TH2                           0x200
 
-#define DM_DIG_BACKOFF_MAX                      12
-#define DM_DIG_BACKOFF_MIN                      -4
-#define DM_DIG_BACKOFF_DEFAULT                  10
-
 #define RXPATHSELECTION_SS_TH_LOW               30
 #define RXPATHSELECTION_DIFF_TH                 18
 
@@ -108,14 +95,6 @@ enum tag_dynamic_init_gain_operation_type_definition {
         DIG_OP_TYPE_MAX
 };
 
-enum tag_cck_packet_detection_threshold_type_definition {
-        CCK_PD_STAGE_LowRssi = 0,
-        CCK_PD_STAGE_HighRssi = 1,
-        CCK_FA_STAGE_LOW = 2,
-        CCK_FA_STAGE_High = 3,
-        CCK_PD_STAGE_MAX = 4,
-};
-
 enum dm_1r_cca_e {
         CCA_1R = 0,
         CCA_2R = 1,
@@ -134,23 +113,6 @@ enum dm_sw_ant_switch_e {
         ANS_ANTENNA_MAX = 3,
 };
 
-enum dm_dig_ext_port_alg_e {
-        DIG_EXT_PORT_STAGE_0 = 0,
-        DIG_EXT_PORT_STAGE_1 = 1,
-        DIG_EXT_PORT_STAGE_2 = 2,
-        DIG_EXT_PORT_STAGE_3 = 3,
-        DIG_EXT_PORT_STAGE_MAX = 4,
-};
-
-enum dm_dig_connect_e {
-        DIG_STA_DISCONNECT = 0,
-        DIG_STA_CONNECT = 1,
-        DIG_STA_BEFORE_CONNECT = 2,
-        DIG_MULTISTA_DISCONNECT = 3,
-        DIG_MULTISTA_CONNECT = 4,
-        DIG_CONNECT_MAX
-};
-
 #define BT_RSSI_STATE_NORMAL_POWER      BIT_OFFSET_LEN_MASK_32(0, 1)
 #define BT_RSSI_STATE_AMDPU_OFF         BIT_OFFSET_LEN_MASK_32(1, 1)
 #define BT_RSSI_STATE_SPECIAL_LOW       BIT_OFFSET_LEN_MASK_32(2, 1)
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/trx.c b/drivers/net/wireless/rtlwifi/rtl8723ae/trx.c
index d372ccaf3465..2f7c144d7980 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/trx.c
@@ -45,164 +45,6 @@ static u8 _rtl8723e_map_hwqueue_to_fwqueue(struct sk_buff *skb, u8 hw_queue)
         return skb->priority;
 }
 
-/* mac80211's rate_idx is like this:
- *
- * 2.4G band:rx_status->band == IEEE80211_BAND_2GHZ
- *
- * B/G rate:
- * (rx_status->flag & RX_FLAG_HT) = 0,
- * DESC92C_RATE1M-->DESC92C_RATE54M ==> idx is 0-->11,
- *
- * N rate:
- * (rx_status->flag & RX_FLAG_HT) = 1,
- * DESC92C_RATEMCS0-->DESC92C_RATEMCS15 ==> idx is 0-->15
- *
- * 5G band:rx_status->band == IEEE80211_BAND_5GHZ
- * A rate:
- * (rx_status->flag & RX_FLAG_HT) = 0,
- * DESC92C_RATE6M-->DESC92C_RATE54M ==> idx is 0-->7,
- *
- * N rate:
- * (rx_status->flag & RX_FLAG_HT) = 1,
- * DESC92C_RATEMCS0-->DESC92C_RATEMCS15 ==> idx is 0-->15
- */
-static int _rtl8723e_rate_mapping(struct ieee80211_hw *hw,
-                                  bool isht, u8 desc_rate)
-{
-        int rate_idx;
-
-        if (!isht) {
-                if (IEEE80211_BAND_2GHZ == hw->conf.chandef.chan->band) {
-                        switch (desc_rate) {
-                        case DESC92C_RATE1M:
-                                rate_idx = 0;
-                                break;
-                        case DESC92C_RATE2M:
-                                rate_idx = 1;
-                                break;
-                        case DESC92C_RATE5_5M:
-                                rate_idx = 2;
-                                break;
-                        case DESC92C_RATE11M:
-                                rate_idx = 3;
-                                break;
-                        case DESC92C_RATE6M:
-                                rate_idx = 4;
-                                break;
-                        case DESC92C_RATE9M:
-                                rate_idx = 5;
-                                break;
-                        case DESC92C_RATE12M:
-                                rate_idx = 6;
-                                break;
-                        case DESC92C_RATE18M:
-                                rate_idx = 7;
-                                break;
-                        case DESC92C_RATE24M:
-                                rate_idx = 8;
-                                break;
-                        case DESC92C_RATE36M:
-                                rate_idx = 9;
-                                break;
-                        case DESC92C_RATE48M:
-                                rate_idx = 10;
-                                break;
-                        case DESC92C_RATE54M:
-                                rate_idx = 11;
-                                break;
-                        default:
-                                rate_idx = 0;
-                                break;
-                        }
-                } else {
-                        switch (desc_rate) {
-                        case DESC92C_RATE6M:
-                                rate_idx = 0;
-                                break;
-                        case DESC92C_RATE9M:
-                                rate_idx = 1;
-                                break;
-                        case DESC92C_RATE12M:
-                                rate_idx = 2;
-                                break;
-                        case DESC92C_RATE18M:
-                                rate_idx = 3;
-                                break;
-                        case DESC92C_RATE24M:
-                                rate_idx = 4;
-                                break;
-                        case DESC92C_RATE36M:
-                                rate_idx = 5;
-                                break;
-                        case DESC92C_RATE48M:
-                                rate_idx = 6;
-                                break;
-                        case DESC92C_RATE54M:
-                                rate_idx = 7;
-                                break;
-                        default:
-                                rate_idx = 0;
-                                break;
-                        }
-                }
-        } else {
-                switch (desc_rate) {
-                case DESC92C_RATEMCS0:
-                        rate_idx = 0;
-                        break;
-                case DESC92C_RATEMCS1:
-                        rate_idx = 1;
-                        break;
-                case DESC92C_RATEMCS2:
-                        rate_idx = 2;
-                        break;
-                case DESC92C_RATEMCS3:
-                        rate_idx = 3;
-                        break;
-                case DESC92C_RATEMCS4:
-                        rate_idx = 4;
-                        break;
-                case DESC92C_RATEMCS5:
-                        rate_idx = 5;
-                        break;
-                case DESC92C_RATEMCS6:
-                        rate_idx = 6;
-                        break;
-                case DESC92C_RATEMCS7:
-                        rate_idx = 7;
-                        break;
-                case DESC92C_RATEMCS8:
-                        rate_idx = 8;
-                        break;
-                case DESC92C_RATEMCS9:
-                        rate_idx = 9;
-                        break;
-                case DESC92C_RATEMCS10:
-                        rate_idx = 10;
-                        break;
-                case DESC92C_RATEMCS11:
-                        rate_idx = 11;
-                        break;
-                case DESC92C_RATEMCS12:
-                        rate_idx = 12;
-                        break;
-                case DESC92C_RATEMCS13:
-                        rate_idx = 13;
-                        break;
-                case DESC92C_RATEMCS14:
-                        rate_idx = 14;
-                        break;
-                case DESC92C_RATEMCS15:
-                        rate_idx = 15;
-                        break;
-                default:
-                        rate_idx = 0;
-                        break;
-                }
-        }
-        return rate_idx;
-}
-
 static void _rtl8723e_query_rxphystatus(struct ieee80211_hw *hw,
                                         struct rtl_stats *pstatus, u8 *pdesc,
                                         struct rx_fwinfo_8723e *p_drvinfo,
@@ -503,8 +345,8 @@ bool rtl8723e_rx_query_desc(struct ieee80211_hw *hw,
          * are use (RX_FLAG_HT)
          * Notice: this is diff with windows define
          */
-        rx_status->rate_idx = _rtl8723e_rate_mapping(hw,
-                                status->is_ht, status->rate);
+        rx_status->rate_idx = rtlwifi_rate_mapping(hw, status->is_ht,
+                                                   false, status->rate);
 
         rx_status->mactime = status->timestamp_low;
         if (phystatus == true) {
diff --git a/drivers/net/wireless/rtlwifi/rtl8723be/dm.c b/drivers/net/wireless/rtlwifi/rtl8723be/dm.c
index dd7eb4371f49..2367e8f47a5b 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723be/dm.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723be/dm.c
@@ -26,6 +26,7 @@
 #include "../wifi.h"
 #include "../base.h"
 #include "../pci.h"
+#include "../core.h"
 #include "reg.h"
 #include "def.h"
 #include "phy.h"
@@ -211,35 +212,6 @@ void rtl8723be_dm_txpower_track_adjust(struct ieee80211_hw *hw, u8 type,
                 (pwr_val << 16) | (pwr_val << 24);
 }
 
-static void rtl8723be_dm_diginit(struct ieee80211_hw *hw)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct dig_t *dm_digtable = &rtlpriv->dm_digtable;
-
-        dm_digtable->dig_enable_flag = true;
-        dm_digtable->cur_igvalue = rtl_get_bbreg(hw, ROFDM0_XAAGCCORE1, 0x7f);
-        dm_digtable->rssi_lowthresh = DM_DIG_THRESH_LOW;
-        dm_digtable->rssi_highthresh = DM_DIG_THRESH_HIGH;
-        dm_digtable->fa_lowthresh = DM_FALSEALARM_THRESH_LOW;
-        dm_digtable->fa_highthresh = DM_FALSEALARM_THRESH_HIGH;
-        dm_digtable->rx_gain_max = DM_DIG_MAX;
-        dm_digtable->rx_gain_min = DM_DIG_MIN;
-        dm_digtable->back_val = DM_DIG_BACKOFF_DEFAULT;
-        dm_digtable->back_range_max = DM_DIG_BACKOFF_MAX;
-        dm_digtable->back_range_min = DM_DIG_BACKOFF_MIN;
-        dm_digtable->pre_cck_cca_thres = 0xff;
-        dm_digtable->cur_cck_cca_thres = 0x83;
-        dm_digtable->forbidden_igi = DM_DIG_MIN;
-        dm_digtable->large_fa_hit = 0;
-        dm_digtable->recover_cnt = 0;
-        dm_digtable->dig_dynamic_min = DM_DIG_MIN;
-        dm_digtable->dig_dynamic_min_1 = DM_DIG_MIN;
-        dm_digtable->media_connect_0 = false;
-        dm_digtable->media_connect_1 = false;
-        rtlpriv->dm.dm_initialgain_enable = true;
-        dm_digtable->bt30_cur_igi = 0x32;
-}
-
 void rtl8723be_dm_init_rate_adaptive_mask(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
@@ -293,9 +265,10 @@ static void rtl8723be_dm_init_dynamic_atc_switch(struct ieee80211_hw *hw)
 void rtl8723be_dm_init(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
+        u32 cur_igvalue = rtl_get_bbreg(hw, ROFDM0_XAAGCCORE1, 0x7f);
 
         rtlpriv->dm.dm_type = DM_TYPE_BYDRIVER;
-        rtl8723be_dm_diginit(hw);
+        rtl_dm_diginit(hw, cur_igvalue);
         rtl8723be_dm_init_rate_adaptive_mask(hw);
         rtl8723_dm_init_edca_turbo(hw);
         rtl8723_dm_init_dynamic_bb_powersaving(hw);
@@ -424,7 +397,7 @@ static void rtl8723be_dm_dig(struct ieee80211_hw *hw)
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct dig_t *dm_digtable = &rtlpriv->dm_digtable;
         struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
-        u8 dig_dynamic_min, dig_maxofmin;
+        u8 dig_min_0, dig_maxofmin;
         bool bfirstconnect, bfirstdisconnect;
         u8 dm_dig_max, dm_dig_min;
         u8 current_igi = dm_digtable->cur_igvalue;
@@ -434,7 +407,7 @@ static void rtl8723be_dm_dig(struct ieee80211_hw *hw)
         if (mac->act_scanning)
                 return;
 
-        dig_dynamic_min = dm_digtable->dig_dynamic_min;
+        dig_min_0 = dm_digtable->dig_min_0;
         bfirstconnect = (mac->link_state >= MAC80211_LINKED) &&
                         !dm_digtable->media_connect_0;
         bfirstdisconnect = (mac->link_state < MAC80211_LINKED) &&
@@ -456,20 +429,20 @@ static void rtl8723be_dm_dig(struct ieee80211_hw *hw)
                 if (rtlpriv->dm.one_entry_only) {
                         offset = 12;
                         if (dm_digtable->rssi_val_min - offset < dm_dig_min)
-                                dig_dynamic_min = dm_dig_min;
+                                dig_min_0 = dm_dig_min;
                         else if (dm_digtable->rssi_val_min - offset >
                                                         dig_maxofmin)
-                                dig_dynamic_min = dig_maxofmin;
+                                dig_min_0 = dig_maxofmin;
                         else
-                                dig_dynamic_min =
+                                dig_min_0 =
                                         dm_digtable->rssi_val_min - offset;
                 } else {
-                        dig_dynamic_min = dm_dig_min;
+                        dig_min_0 = dm_dig_min;
                 }
 
         } else {
                 dm_digtable->rx_gain_max = dm_dig_max;
-                dig_dynamic_min = dm_dig_min;
+                dig_min_0 = dm_dig_min;
                 RT_TRACE(rtlpriv, COMP_DIG, DBG_LOUD, "no link\n");
         }
 
@@ -497,11 +470,11 @@ static void rtl8723be_dm_dig(struct ieee80211_hw *hw)
                 } else {
                         if (dm_digtable->large_fa_hit < 3) {
                                 if ((dm_digtable->forbidden_igi - 1) <
-                                     dig_dynamic_min) {
+                                     dig_min_0) {
                                         dm_digtable->forbidden_igi =
-                                                        dig_dynamic_min;
+                                                        dig_min_0;
                                         dm_digtable->rx_gain_min =
-                                                        dig_dynamic_min;
+                                                        dig_min_0;
                                 } else {
                                         dm_digtable->forbidden_igi--;
                                         dm_digtable->rx_gain_min =
@@ -552,7 +525,7 @@ static void rtl8723be_dm_dig(struct ieee80211_hw *hw)
         rtl8723be_dm_write_dig(hw, current_igi);
         dm_digtable->media_connect_0 =
                 ((mac->link_state >= MAC80211_LINKED) ? true : false);
-        dm_digtable->dig_dynamic_min = dig_dynamic_min;
+        dm_digtable->dig_min_0 = dig_min_0;
 }
 
 static void rtl8723be_dm_false_alarm_counter_statistics(
diff --git a/drivers/net/wireless/rtlwifi/rtl8723be/dm.h b/drivers/net/wireless/rtlwifi/rtl8723be/dm.h
index e4c0e8ae6f47..f752a2cad63d 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723be/dm.h
+++ b/drivers/net/wireless/rtlwifi/rtl8723be/dm.h
@@ -180,28 +180,12 @@
 #define BW_AUTO_SWITCH_HIGH_LOW                 25
 #define BW_AUTO_SWITCH_LOW_HIGH                 30
 
-#define DM_DIG_THRESH_HIGH                      40
-#define DM_DIG_THRESH_LOW                       35
-
-#define DM_FALSEALARM_THRESH_LOW                400
-#define DM_FALSEALARM_THRESH_HIGH               1000
-
-#define DM_DIG_MAX                              0x3e
-#define DM_DIG_MIN                              0x1e
-
-#define DM_DIG_MAX_AP                           0x32
-#define DM_DIG_MIN_AP                           0x20
-
 #define DM_DIG_FA_UPPER                         0x3e
 #define DM_DIG_FA_LOWER                         0x1e
 #define DM_DIG_FA_TH0                           0x200
 #define DM_DIG_FA_TH1                           0x300
 #define DM_DIG_FA_TH2                           0x400
 
-#define DM_DIG_BACKOFF_MAX                      12
-#define DM_DIG_BACKOFF_MIN                      -4
-#define DM_DIG_BACKOFF_DEFAULT                  10
-
 #define RXPATHSELECTION_SS_TH_LOW               30
 #define RXPATHSELECTION_DIFF_TH                 18
 
@@ -252,23 +236,6 @@ enum dm_sw_ant_switch_e {
         ANS_ANTENNA_MAX = 3,
 };
 
-enum dm_dig_ext_port_alg_e {
-        DIG_EXT_PORT_STAGE_0    = 0,
-        DIG_EXT_PORT_STAGE_1    = 1,
-        DIG_EXT_PORT_STAGE_2    = 2,
-        DIG_EXT_PORT_STAGE_3    = 3,
-        DIG_EXT_PORT_STAGE_MAX  = 4,
-};
-
-enum dm_dig_connect_e {
-        DIG_STA_DISCONNECT      = 0,
-        DIG_STA_CONNECT         = 1,
-        DIG_STA_BEFORE_CONNECT  = 2,
-        DIG_MULTISTA_DISCONNECT = 3,
-        DIG_MULTISTA_CONNECT    = 4,
-        DIG_CONNECT_MAX
-};
-
 enum pwr_track_control_method {
         BBSWING,
         TXAGC
diff --git a/drivers/net/wireless/rtlwifi/rtl8723be/phy.c b/drivers/net/wireless/rtlwifi/rtl8723be/phy.c
index 20dcc25c506c..b7b73cbe346d 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723be/phy.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723be/phy.c
@@ -874,31 +874,6 @@ void rtl8723be_phy_get_hw_reg_originalvalue(struct ieee80211_hw *hw)
                   ROFDM0_RXDETECTOR3, rtlphy->framesync);
 }
 
-void rtl8723be_phy_get_txpower_level(struct ieee80211_hw *hw, long *powerlevel)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct rtl_phy *rtlphy = &rtlpriv->phy;
-        u8 txpwr_level;
-        long txpwr_dbm;
-
-        txpwr_level = rtlphy->cur_cck_txpwridx;
-        txpwr_dbm = rtl8723_phy_txpwr_idx_to_dbm(hw, WIRELESS_MODE_B,
-                                                 txpwr_level);
-        txpwr_level = rtlphy->cur_ofdm24g_txpwridx;
-        if (rtl8723_phy_txpwr_idx_to_dbm(hw, WIRELESS_MODE_G, txpwr_level) >
-            txpwr_dbm)
-                txpwr_dbm =
-                    rtl8723_phy_txpwr_idx_to_dbm(hw, WIRELESS_MODE_G,
-                                                 txpwr_level);
-        txpwr_level = rtlphy->cur_ofdm24g_txpwridx;
-        if (rtl8723_phy_txpwr_idx_to_dbm(hw, WIRELESS_MODE_N_24G,
-                                         txpwr_level) > txpwr_dbm)
-                txpwr_dbm =
-                    rtl8723_phy_txpwr_idx_to_dbm(hw, WIRELESS_MODE_N_24G,
-                                                 txpwr_level);
-        *powerlevel = txpwr_dbm;
-}
-
 static u8 _rtl8723be_phy_get_ratesection_intxpower_byrate(enum radio_path path,
                                                           u8 rate)
 {
diff --git a/drivers/net/wireless/rtlwifi/rtl8723be/phy.h b/drivers/net/wireless/rtlwifi/rtl8723be/phy.h
index 6339738a0e33..9021d4745ab7 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723be/phy.h
+++ b/drivers/net/wireless/rtlwifi/rtl8723be/phy.h
@@ -114,8 +114,6 @@ bool rtl8723be_phy_mac_config(struct ieee80211_hw *hw);
 bool rtl8723be_phy_bb_config(struct ieee80211_hw *hw);
 bool rtl8723be_phy_rf_config(struct ieee80211_hw *hw);
 void rtl8723be_phy_get_hw_reg_originalvalue(struct ieee80211_hw *hw);
-void rtl8723be_phy_get_txpower_level(struct ieee80211_hw *hw,
-                                     long *powerlevel);
 void rtl8723be_phy_set_txpower_level(struct ieee80211_hw *hw,
                                      u8 channel);
 void rtl8723be_phy_scan_operation_backup(struct ieee80211_hw *hw,
diff --git a/drivers/net/wireless/rtlwifi/rtl8723be/sw.c b/drivers/net/wireless/rtlwifi/rtl8723be/sw.c
index 223eb42992bd..1017f02d7bf7 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723be/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723be/sw.c
@@ -387,12 +387,14 @@ module_param_named(swlps, rtl8723be_mod_params.swctrl_lps, bool, 0444);
 module_param_named(fwlps, rtl8723be_mod_params.fwctrl_lps, bool, 0444);
 module_param_named(disable_watchdog, rtl8723be_mod_params.disable_watchdog,
                    bool, 0444);
-MODULE_PARM_DESC(swenc, "using hardware crypto (default 0 [hardware])\n");
-MODULE_PARM_DESC(ips, "using no link power save (default 1 is open)\n");
-MODULE_PARM_DESC(fwlps, "using linked fw control power save (default 1 is open)\n");
+MODULE_PARM_DESC(swenc, "Set to 1 for software crypto (default 0)\n");
+MODULE_PARM_DESC(ips, "Set to 0 to not use link power save (default 1)\n");
+MODULE_PARM_DESC(swlps, "Set to 1 to use SW control power save (default 0)\n");
+MODULE_PARM_DESC(fwlps, "Set to 1 to use FW control power save (default 1)\n");
 MODULE_PARM_DESC(msi, "Set to 1 to use MSI interrupts mode (default 0)\n");
 MODULE_PARM_DESC(debug, "Set debug level (0-5) (default 0)");
-MODULE_PARM_DESC(disable_watchdog, "Set to 1 to disable the watchdog (default 0)\n");
+MODULE_PARM_DESC(disable_watchdog,
+                 "Set to 1 to disable the watchdog (default 0)\n");
 
 static SIMPLE_DEV_PM_OPS(rtlwifi_pm_ops, rtl_pci_suspend, rtl_pci_resume);
 
diff --git a/drivers/net/wireless/rtlwifi/rtl8723be/trx.c b/drivers/net/wireless/rtlwifi/rtl8723be/trx.c
index d6a1c70cb657..338ec9a9d09b 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723be/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723be/trx.c
@@ -47,164 +47,6 @@ static u8 _rtl8723be_map_hwqueue_to_fwqueue(struct sk_buff *skb, u8 hw_queue)
         return skb->priority;
 }
 
-/* mac80211's rate_idx is like this:
- *
- * 2.4G band:rx_status->band == IEEE80211_BAND_2GHZ
- *
- * B/G rate:
- * (rx_status->flag & RX_FLAG_HT) = 0,
- * DESC92C_RATE1M-->DESC92C_RATE54M ==> idx is 0-->11,
- *
- * N rate:
- * (rx_status->flag & RX_FLAG_HT) = 1,
- * DESC92C_RATEMCS0-->DESC92C_RATEMCS15 ==> idx is 0-->15
- *
- * 5G band:rx_status->band == IEEE80211_BAND_5GHZ
- * A rate:
- * (rx_status->flag & RX_FLAG_HT) = 0,
- * DESC92C_RATE6M-->DESC92C_RATE54M ==> idx is 0-->7,
- *
- * N rate:
- * (rx_status->flag & RX_FLAG_HT) = 1,
- * DESC92C_RATEMCS0-->DESC92C_RATEMCS15 ==> idx is 0-->15
- */
-static int _rtl8723be_rate_mapping(struct ieee80211_hw *hw,
-                                   bool isht, u8 desc_rate)
-{
-        int rate_idx;
-
-        if (!isht) {
-                if (IEEE80211_BAND_2GHZ == hw->conf.chandef.chan->band) {
-                        switch (desc_rate) {
-                        case DESC92C_RATE1M:
-                                rate_idx = 0;
-                                break;
-                        case DESC92C_RATE2M:
-                                rate_idx = 1;
-                                break;
-                        case DESC92C_RATE5_5M:
-                                rate_idx = 2;
-                                break;
-                        case DESC92C_RATE11M:
-                                rate_idx = 3;
-                                break;
-                        case DESC92C_RATE6M:
-                                rate_idx = 4;
-                                break;
-                        case DESC92C_RATE9M:
-                                rate_idx = 5;
-                                break;
-                        case DESC92C_RATE12M:
-                                rate_idx = 6;
-                                break;
-                        case DESC92C_RATE18M:
-                                rate_idx = 7;
-                                break;
-                        case DESC92C_RATE24M:
-                                rate_idx = 8;
-                                break;
-                        case DESC92C_RATE36M:
-                                rate_idx = 9;
-                                break;
-                        case DESC92C_RATE48M:
-                                rate_idx = 10;
-                                break;
-                        case DESC92C_RATE54M:
-                                rate_idx = 11;
-                                break;
-                        default:
-                                rate_idx = 0;
-                                break;
-                        }
-                } else {
-                        switch (desc_rate) {
-                        case DESC92C_RATE6M:
-                                rate_idx = 0;
-                                break;
-                        case DESC92C_RATE9M:
-                                rate_idx = 1;
-                                break;
-                        case DESC92C_RATE12M:
-                                rate_idx = 2;
-                                break;
-                        case DESC92C_RATE18M:
-                                rate_idx = 3;
-                                break;
-                        case DESC92C_RATE24M:
-                                rate_idx = 4;
-                                break;
-                        case DESC92C_RATE36M:
-                                rate_idx = 5;
-                                break;
-                        case DESC92C_RATE48M:
-                                rate_idx = 6;
-                                break;
-                        case DESC92C_RATE54M:
-                                rate_idx = 7;
-                                break;
-                        default:
-                                rate_idx = 0;
-                                break;
-                        }
-                }
-        } else {
-                switch (desc_rate) {
-                case DESC92C_RATEMCS0:
-                        rate_idx = 0;
-                        break;
-                case DESC92C_RATEMCS1:
-                        rate_idx = 1;
-                        break;
-                case DESC92C_RATEMCS2:
-                        rate_idx = 2;
-                        break;
-                case DESC92C_RATEMCS3:
-                        rate_idx = 3;
-                        break;
-                case DESC92C_RATEMCS4:
-                        rate_idx = 4;
-                        break;
-                case DESC92C_RATEMCS5:
-                        rate_idx = 5;
-                        break;
-                case DESC92C_RATEMCS6:
-                        rate_idx = 6;
-                        break;
-                case DESC92C_RATEMCS7:
-                        rate_idx = 7;
-                        break;
-                case DESC92C_RATEMCS8:
-                        rate_idx = 8;
-                        break;
-                case DESC92C_RATEMCS9:
-                        rate_idx = 9;
-                        break;
-                case DESC92C_RATEMCS10:
-                        rate_idx = 10;
-                        break;
-                case DESC92C_RATEMCS11:
-                        rate_idx = 11;
-                        break;
-                case DESC92C_RATEMCS12:
-                        rate_idx = 12;
-                        break;
-                case DESC92C_RATEMCS13:
-                        rate_idx = 13;
-                        break;
-                case DESC92C_RATEMCS14:
-                        rate_idx = 14;
-                        break;
-                case DESC92C_RATEMCS15:
-                        rate_idx = 15;
-                        break;
-                default:
-                        rate_idx = 0;
-                        break;
-                }
-        }
-        return rate_idx;
-}
-
 static void _rtl8723be_query_rxphystatus(struct ieee80211_hw *hw,
                                          struct rtl_stats *pstatus, u8 *pdesc,
                                          struct rx_fwinfo_8723be *p_drvinfo,
@@ -558,8 +400,8 @@ bool rtl8723be_rx_query_desc(struct ieee80211_hw *hw,
          * supported rates or MCS index if HT rates
          * are use (RX_FLAG_HT)
          */
-        rx_status->rate_idx = _rtl8723be_rate_mapping(hw, status->is_ht,
-                                                      status->rate);
+        rx_status->rate_idx = rtlwifi_rate_mapping(hw, status->is_ht,
+                                                   false, status->rate);
 
         rx_status->mactime = status->timestamp_low;
         if (phystatus) {
diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/def.h b/drivers/net/wireless/rtlwifi/rtl8821ae/def.h
index a730985ae81d..ee7c208bd070 100644
--- a/drivers/net/wireless/rtlwifi/rtl8821ae/def.h
+++ b/drivers/net/wireless/rtlwifi/rtl8821ae/def.h
@@ -373,60 +373,6 @@ enum rtl_desc_qsel {
         QSLT_CMD = 0x13,
 };
 
-enum rtl_desc8821ae_rate {
-        DESC_RATE1M = 0x00,
-        DESC_RATE2M = 0x01,
-        DESC_RATE5_5M = 0x02,
-        DESC_RATE11M = 0x03,
-
-        DESC_RATE6M = 0x04,
-        DESC_RATE9M = 0x05,
-        DESC_RATE12M = 0x06,
-        DESC_RATE18M = 0x07,
-        DESC_RATE24M = 0x08,
-        DESC_RATE36M = 0x09,
-        DESC_RATE48M = 0x0a,
-        DESC_RATE54M = 0x0b,
-
-        DESC_RATEMCS0 = 0x0c,
-        DESC_RATEMCS1 = 0x0d,
-        DESC_RATEMCS2 = 0x0e,
-        DESC_RATEMCS3 = 0x0f,
-        DESC_RATEMCS4 = 0x10,
-        DESC_RATEMCS5 = 0x11,
-        DESC_RATEMCS6 = 0x12,
-        DESC_RATEMCS7 = 0x13,
-        DESC_RATEMCS8 = 0x14,
-        DESC_RATEMCS9 = 0x15,
-        DESC_RATEMCS10 = 0x16,
-        DESC_RATEMCS11 = 0x17,
-        DESC_RATEMCS12 = 0x18,
-        DESC_RATEMCS13 = 0x19,
-        DESC_RATEMCS14 = 0x1a,
-        DESC_RATEMCS15 = 0x1b,
-
-        DESC_RATEVHT1SS_MCS0 = 0x2c,
-        DESC_RATEVHT1SS_MCS1 = 0x2d,
-        DESC_RATEVHT1SS_MCS2 = 0x2e,
-        DESC_RATEVHT1SS_MCS3 = 0x2f,
-        DESC_RATEVHT1SS_MCS4 = 0x30,
-        DESC_RATEVHT1SS_MCS5 = 0x31,
-        DESC_RATEVHT1SS_MCS6 = 0x32,
-        DESC_RATEVHT1SS_MCS7 = 0x33,
-        DESC_RATEVHT1SS_MCS8 = 0x34,
-        DESC_RATEVHT1SS_MCS9 = 0x35,
-        DESC_RATEVHT2SS_MCS0 = 0x36,
-        DESC_RATEVHT2SS_MCS1 = 0x37,
-        DESC_RATEVHT2SS_MCS2 = 0x38,
-        DESC_RATEVHT2SS_MCS3 = 0x39,
-        DESC_RATEVHT2SS_MCS4 = 0x3a,
-        DESC_RATEVHT2SS_MCS5 = 0x3b,
-        DESC_RATEVHT2SS_MCS6 = 0x3c,
-        DESC_RATEVHT2SS_MCS7 = 0x3d,
-        DESC_RATEVHT2SS_MCS8 = 0x3e,
-        DESC_RATEVHT2SS_MCS9 = 0x3f,
-};
-
 enum rx_packet_type {
         NORMAL_RX,
         TX_REPORT1,
diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/dm.c b/drivers/net/wireless/rtlwifi/rtl8821ae/dm.c
index ba30b0d250fd..0b2082dc48f1 100644
--- a/drivers/net/wireless/rtlwifi/rtl8821ae/dm.c
+++ b/drivers/net/wireless/rtlwifi/rtl8821ae/dm.c
@@ -26,6 +26,7 @@
 #include "../wifi.h"
 #include "../base.h"
 #include "../pci.h"
+#include "../core.h"
 #include "reg.h"
 #include "def.h"
 #include "phy.h"
@@ -519,34 +520,6 @@ void rtl8821ae_dm_initialize_txpower_tracking_thermalmeter(
         }
 }
 
-static void rtl8821ae_dm_diginit(struct ieee80211_hw *hw)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct dig_t *dm_digtable = &rtlpriv->dm_digtable;
-
-        dm_digtable->cur_igvalue = rtl_get_bbreg(hw, ROFDM0_XAAGCCORE1, 0x7f);
-        dm_digtable->rssi_lowthresh = DM_DIG_THRESH_LOW;
-        dm_digtable->rssi_highthresh = DM_DIG_THRESH_HIGH;
-        dm_digtable->fa_lowthresh = DM_FALSEALARM_THRESH_LOW;
-        dm_digtable->fa_highthresh = DM_FALSEALARM_THRESH_HIGH;
-        dm_digtable->rx_gain_max = DM_DIG_MAX;
-        dm_digtable->rx_gain_min = DM_DIG_MIN;
-        dm_digtable->back_val = DM_DIG_BACKOFF_DEFAULT;
-        dm_digtable->back_range_max = DM_DIG_BACKOFF_MAX;
-        dm_digtable->back_range_min = DM_DIG_BACKOFF_MIN;
-        dm_digtable->pre_cck_cca_thres = 0xff;
-        dm_digtable->cur_cck_cca_thres = 0x83;
-        dm_digtable->forbidden_igi = DM_DIG_MIN;
-        dm_digtable->large_fa_hit = 0;
-        dm_digtable->recover_cnt = 0;
-        dm_digtable->dig_dynamic_min = DM_DIG_MIN;
-        dm_digtable->dig_dynamic_min_1 = DM_DIG_MIN;
-        dm_digtable->media_connect_0 = false;
-        dm_digtable->media_connect_1 = false;
-        rtlpriv->dm.dm_initialgain_enable = true;
-        dm_digtable->bt30_cur_igi = 0x32;
-}
-
 void rtl8821ae_dm_init_edca_turbo(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
@@ -606,6 +579,7 @@ void rtl8821ae_dm_init(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct rtl_phy *rtlphy = &rtlpriv->phy;
+        u32 cur_igvalue = rtl_get_bbreg(hw, ROFDM0_XAAGCCORE1, 0x7f);
 
         spin_lock(&rtlpriv->locks.iqk_lock);
         rtlphy->lck_inprogress = false;
@@ -613,7 +587,7 @@ void rtl8821ae_dm_init(struct ieee80211_hw *hw)
 
         rtlpriv->dm.dm_type = DM_TYPE_BYDRIVER;
         rtl8821ae_dm_common_info_self_init(hw);
-        rtl8821ae_dm_diginit(hw);
+        rtl_dm_diginit(hw, cur_igvalue);
         rtl8821ae_dm_init_rate_adaptive_mask(hw);
         rtl8821ae_dm_init_edca_turbo(hw);
         rtl8821ae_dm_initialize_txpower_tracking_thermalmeter(hw);
@@ -822,7 +796,7 @@ static void rtl8821ae_dm_dig(struct ieee80211_hw *hw)
         struct dig_t *dm_digtable = &rtlpriv->dm_digtable;
         struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
         struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
-        u8 dig_dynamic_min;
+        u8 dig_min_0;
         u8 dig_max_of_min;
         bool first_connect, first_disconnect;
         u8 dm_dig_max, dm_dig_min, offset;
@@ -837,7 +811,7 @@ static void rtl8821ae_dm_dig(struct ieee80211_hw *hw)
         }
 
         /*add by Neil Chen to avoid PSD is processing*/
-        dig_dynamic_min = dm_digtable->dig_dynamic_min;
+        dig_min_0 = dm_digtable->dig_min_0;
         first_connect = (mac->link_state >= MAC80211_LINKED) &&
                         (!dm_digtable->media_connect_0);
         first_disconnect = (mac->link_state < MAC80211_LINKED) &&
@@ -876,23 +850,23 @@ static void rtl8821ae_dm_dig(struct ieee80211_hw *hw)
                         offset = 0;
 
                         if (dm_digtable->rssi_val_min - offset < dm_dig_min)
-                                dig_dynamic_min = dm_dig_min;
+                                dig_min_0 = dm_dig_min;
                         else if (dm_digtable->rssi_val_min -
                                 offset > dig_max_of_min)
-                                dig_dynamic_min = dig_max_of_min;
+                                dig_min_0 = dig_max_of_min;
                         else
-                                dig_dynamic_min =
+                                dig_min_0 =
                                         dm_digtable->rssi_val_min - offset;
 
                         RT_TRACE(rtlpriv, COMP_DIG, DBG_LOUD,
-                                 "bOneEntryOnly=TRUE, dig_dynamic_min=0x%x\n",
-                                 dig_dynamic_min);
+                                 "bOneEntryOnly=TRUE, dig_min_0=0x%x\n",
+                                 dig_min_0);
                 } else {
-                        dig_dynamic_min = dm_dig_min;
+                        dig_min_0 = dm_dig_min;
                 }
         } else {
                 dm_digtable->rx_gain_max = dm_dig_max;
-                dig_dynamic_min = dm_dig_min;
+                dig_min_0 = dm_dig_min;
                 RT_TRACE(rtlpriv, COMP_DIG, DBG_LOUD,
                          "No Link\n");
         }
@@ -925,11 +899,11 @@ static void rtl8821ae_dm_dig(struct ieee80211_hw *hw)
                 } else {
                         if (dm_digtable->large_fa_hit < 3) {
                                 if ((dm_digtable->forbidden_igi - 1) <
-                                    dig_dynamic_min) {
+                                    dig_min_0) {
                                         dm_digtable->forbidden_igi =
-                                                dig_dynamic_min;
+                                                dig_min_0;
                                         dm_digtable->rx_gain_min =
-                                                dig_dynamic_min;
+                                                dig_min_0;
                                         RT_TRACE(rtlpriv, COMP_DIG, DBG_LOUD,
                                                  "Normal Case: At Lower Bound\n");
                                 } else {
@@ -1024,7 +998,7 @@ static void rtl8821ae_dm_dig(struct ieee80211_hw *hw)
         rtl8821ae_dm_write_dig(hw, current_igi);
         dm_digtable->media_connect_0 =
                 ((mac->link_state >= MAC80211_LINKED) ? true : false);
-        dm_digtable->dig_dynamic_min = dig_dynamic_min;
+        dm_digtable->dig_min_0 = dig_min_0;
 }
 
 static void rtl8821ae_dm_common_info_self_update(struct ieee80211_hw *hw)
diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/dm.h b/drivers/net/wireless/rtlwifi/rtl8821ae/dm.h
index 9dd40dd316c1..625a6bbb21fc 100644
--- a/drivers/net/wireless/rtlwifi/rtl8821ae/dm.h
+++ b/drivers/net/wireless/rtlwifi/rtl8821ae/dm.h
@@ -187,28 +187,12 @@
 #define BW_AUTO_SWITCH_HIGH_LOW         25
 #define BW_AUTO_SWITCH_LOW_HIGH         30
 
-#define DM_DIG_THRESH_HIGH                      40
-#define DM_DIG_THRESH_LOW                       35
-
-#define DM_FALSEALARM_THRESH_LOW        400
-#define DM_FALSEALARM_THRESH_HIGH       1000
-
-#define DM_DIG_MAX                                      0x3e
-#define DM_DIG_MIN                                      0x1e
-
-#define DM_DIG_MAX_AP                           0x32
-#define DM_DIG_MIN_AP                           0x20
-
 #define DM_DIG_FA_UPPER                         0x3e
 #define DM_DIG_FA_LOWER                         0x1e
 #define DM_DIG_FA_TH0                           200
 #define DM_DIG_FA_TH1                           0x300
 #define DM_DIG_FA_TH2                           0x400
 
-#define DM_DIG_BACKOFF_MAX                      12
-#define DM_DIG_BACKOFF_MIN                      -4
-#define DM_DIG_BACKOFF_DEFAULT          10
-
 #define RXPATHSELECTION_SS_TH_LOW       30
 #define RXPATHSELECTION_DIFF_TH         18
 
@@ -262,14 +246,6 @@ enum tag_dynamic_init_gain_operation_type_definition {
         DIG_OP_TYPE_MAX
 };
 
-enum tag_cck_packet_detection_threshold_type_definition {
-        CCK_PD_STAGE_LOWRSSI = 0,
-        CCK_PD_STAGE_HIGHRSSI = 1,
-        CCK_FA_STAGE_LOW = 2,
-        CCK_FA_STAGE_HIGH = 3,
-        CCK_PD_STAGE_MAX = 4,
-};
-
 enum dm_1r_cca_e {
         CCA_1R = 0,
         CCA_2R = 1,
@@ -288,23 +264,6 @@ enum dm_sw_ant_switch_e {
         ANS_ANTENNA_MAX = 3,
 };
 
-enum dm_dig_ext_port_alg_e {
-        DIG_EXT_PORT_STAGE_0 = 0,
-        DIG_EXT_PORT_STAGE_1 = 1,
-        DIG_EXT_PORT_STAGE_2 = 2,
-        DIG_EXT_PORT_STAGE_3 = 3,
-        DIG_EXT_PORT_STAGE_MAX = 4,
-};
-
-enum dm_dig_connect_e {
-        DIG_STA_DISCONNECT = 0,
-        DIG_STA_CONNECT = 1,
-        DIG_STA_BEFORE_CONNECT = 2,
-        DIG_MULTISTA_DISCONNECT = 3,
-        DIG_MULTISTA_CONNECT = 4,
-        DIG_CONNECT_MAX
-};
-
 enum pwr_track_control_method {
         BBSWING,
         TXAGC,
diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/pwrseq.h b/drivers/net/wireless/rtlwifi/rtl8821ae/pwrseq.h
index bf0b0ce9519c..36b3e91d996e 100644
--- a/drivers/net/wireless/rtlwifi/rtl8821ae/pwrseq.h
+++ b/drivers/net/wireless/rtlwifi/rtl8821ae/pwrseq.h
@@ -93,9 +93,9 @@
 
 #define RTL8812_TRANS_CARDEMU_TO_SUS                                    \
         {0x0042, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_USB_MSK,\
-        PWR_BASEADDR_MAC, PWR_CMD_WRITE, 0xF0, 0xcc}, \
+        PWR_BASEADDR_MAC, PWR_CMD_WRITE, 0xF0, 0xc0}, \
         {0x0042, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_PCI_MSK,\
-        PWR_BASEADDR_MAC, PWR_CMD_WRITE, 0xF0, 0xEC}, \
+        PWR_BASEADDR_MAC, PWR_CMD_WRITE, 0xF0, 0xE0}, \
         {0x0043, PWR_CUT_ALL_MSK, PWR_FAB_ALL_MSK, PWR_INTF_ALL_MSK,\
         PWR_BASEADDR_MAC, PWR_CMD_WRITE, 0xFF, 0x07 \
         /* gpio11 input mode, gpio10~8 output mode */}, \
diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/sw.c b/drivers/net/wireless/rtlwifi/rtl8821ae/sw.c
index fc92dd6a0d07..a4988121e1ab 100644
--- a/drivers/net/wireless/rtlwifi/rtl8821ae/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8821ae/sw.c
@@ -85,52 +85,6 @@ static void rtl8821ae_init_aspm_vars(struct ieee80211_hw *hw)
         rtlpci->const_support_pciaspm = 1;
 }
 
-static void load_wowlan_fw(struct rtl_priv *rtlpriv)
-{
-        /* callback routine to load wowlan firmware after main fw has
-         * been loaded
-         */
-        const struct firmware *wowlan_firmware;
-        char *fw_name = NULL;
-        int err;
-
-        /* for wowlan firmware buf */
-        rtlpriv->rtlhal.wowlan_firmware = vzalloc(0x8000);
-        if (!rtlpriv->rtlhal.wowlan_firmware) {
-                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
-                         "Can't alloc buffer for wowlan fw.\n");
-                return;
-        }
-
-        if (rtlpriv->rtlhal.hw_type == HARDWARE_TYPE_RTL8821AE)
-                fw_name = "rtlwifi/rtl8821aefw_wowlan.bin";
-        else
-                fw_name = "rtlwifi/rtl8812aefw_wowlan.bin";
-        err = request_firmware(&wowlan_firmware, fw_name, rtlpriv->io.dev);
-        if (err) {
-                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
-                         "Failed to request wowlan firmware!\n");
-                goto error;
-        }
-
-        if (wowlan_firmware->size > 0x8000) {
-                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
-                         "Wowlan Firmware is too big!\n");
-                goto error;
-        }
-
-        memcpy(rtlpriv->rtlhal.wowlan_firmware, wowlan_firmware->data,
-               wowlan_firmware->size);
-        rtlpriv->rtlhal.wowlan_fwsize = wowlan_firmware->size;
-        release_firmware(wowlan_firmware);
-
-        RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "WOWLAN FirmwareDownload OK\n");
-        return;
-error:
-        release_firmware(wowlan_firmware);
-        vfree(rtlpriv->rtlhal.wowlan_firmware);
-}
-
 /*InitializeVariables8812E*/
 int rtl8821ae_init_sw_vars(struct ieee80211_hw *hw)
 {
@@ -231,7 +185,6 @@ int rtl8821ae_init_sw_vars(struct ieee80211_hw *hw)
         else if (rtlpriv->psc.reg_fwctrl_lps == 3)
                 rtlpriv->psc.fwctrl_psmode = FW_PS_DTIM_MODE;
 
-        rtlpriv->rtl_fw_second_cb = load_wowlan_fw;
         /* for firmware buf */
         rtlpriv->rtlhal.pfirmware = vzalloc(0x8000);
         if (!rtlpriv->rtlhal.pfirmware) {
@@ -239,20 +192,41 @@ int rtl8821ae_init_sw_vars(struct ieee80211_hw *hw)
                          "Can't alloc buffer for fw.\n");
                 return 1;
         }
+        rtlpriv->rtlhal.wowlan_firmware = vzalloc(0x8000);
+        if (!rtlpriv->rtlhal.wowlan_firmware) {
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                         "Can't alloc buffer for wowlan fw.\n");
+                return 1;
+        }
 
-        if (rtlhal->hw_type == HARDWARE_TYPE_RTL8812AE)
+        if (rtlhal->hw_type == HARDWARE_TYPE_RTL8812AE) {
                 rtlpriv->cfg->fw_name = "rtlwifi/rtl8812aefw.bin";
-        else
+                rtlpriv->cfg->wowlan_fw_name = "rtlwifi/rtl8812aefw_wowlan.bin";
+        } else {
                 rtlpriv->cfg->fw_name = "rtlwifi/rtl8821aefw.bin";
+                rtlpriv->cfg->wowlan_fw_name = "rtlwifi/rtl8821aefw_wowlan.bin";
+        }
 
         rtlpriv->max_fw_size = 0x8000;
+        /*load normal firmware*/
         pr_info("Using firmware %s\n", rtlpriv->cfg->fw_name);
         err = request_firmware_nowait(THIS_MODULE, 1, rtlpriv->cfg->fw_name,
                                       rtlpriv->io.dev, GFP_KERNEL, hw,
                                       rtl_fw_cb);
         if (err) {
                 RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
-                         "Failed to request firmware!\n");
+                         "Failed to request normal firmware!\n");
+                return 1;
+        }
+        /*load wowlan firmware*/
+        pr_info("Using firmware %s\n", rtlpriv->cfg->wowlan_fw_name);
+        err = request_firmware_nowait(THIS_MODULE, 1,
+                                      rtlpriv->cfg->wowlan_fw_name,
+                                      rtlpriv->io.dev, GFP_KERNEL, hw,
+                                      rtl_wowlan_fw_cb);
+        if (err) {
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                         "Failed to request wowlan firmware!\n");
                 return 1;
         }
         return 0;
diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/trx.c b/drivers/net/wireless/rtlwifi/rtl8821ae/trx.c
index 383b86b05cba..72af4b9ee32b 100644
--- a/drivers/net/wireless/rtlwifi/rtl8821ae/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8821ae/trx.c
@@ -48,232 +48,6 @@ static u8 _rtl8821ae_map_hwqueue_to_fwqueue(struct sk_buff *skb, u8 hw_queue)
         return skb->priority;
 }
 
-/* mac80211's rate_idx is like this:
- *
- * 2.4G band:rx_status->band == IEEE80211_BAND_2GHZ
- *
- * B/G rate:
- * (rx_status->flag & RX_FLAG_HT) = 0,
- * DESC_RATE1M-->DESC_RATE54M ==> idx is 0-->11,
- *
- * N rate:
- * (rx_status->flag & RX_FLAG_HT) = 1,
- * DESC_RATEMCS0-->DESC_RATEMCS15 ==> idx is 0-->15
- *
- * 5G band:rx_status->band == IEEE80211_BAND_5GHZ
- * A rate:
- * (rx_status->flag & RX_FLAG_HT) = 0,
- * DESC_RATE6M-->DESC_RATE54M ==> idx is 0-->7,
- *
- * N rate:
- * (rx_status->flag & RX_FLAG_HT) = 1,
- * DESC_RATEMCS0-->DESC_RATEMCS15 ==> idx is 0-->15
- */
-static int _rtl8821ae_rate_mapping(struct ieee80211_hw *hw,
-                                   bool isht, bool isvht, u8 desc_rate)
-{
-        int rate_idx;
-
-        if (!isht) {
-                if (IEEE80211_BAND_2GHZ == hw->conf.chandef.chan->band) {
-                        switch (desc_rate) {
-                        case DESC_RATE1M:
-                                rate_idx = 0;
-                                break;
-                        case DESC_RATE2M:
-                                rate_idx = 1;
-                                break;
-                        case DESC_RATE5_5M:
-                                rate_idx = 2;
-                                break;
-                        case DESC_RATE11M:
-                                rate_idx = 3;
-                                break;
-                        case DESC_RATE6M:
-                                rate_idx = 4;
-                                break;
-                        case DESC_RATE9M:
-                                rate_idx = 5;
-                                break;
-                        case DESC_RATE12M:
-                                rate_idx = 6;
-                                break;
-                        case DESC_RATE18M:
-                                rate_idx = 7;
-                                break;
-                        case DESC_RATE24M:
-                                rate_idx = 8;
-                                break;
-                        case DESC_RATE36M:
-                                rate_idx = 9;
-                                break;
-                        case DESC_RATE48M:
-                                rate_idx = 10;
-                                break;
-                        case DESC_RATE54M:
-                                rate_idx = 11;
-                                break;
-                        default:
-                                rate_idx = 0;
-                                break;
-                        }
-                } else {
-                        switch (desc_rate) {
-                        case DESC_RATE6M:
-                                rate_idx = 0;
-                                break;
-                        case DESC_RATE9M:
-                                rate_idx = 1;
-                                break;
-                        case DESC_RATE12M:
-                                rate_idx = 2;
-                                break;
-                        case DESC_RATE18M:
-                                rate_idx = 3;
-                                break;
-                        case DESC_RATE24M:
-                                rate_idx = 4;
-                                break;
-                        case DESC_RATE36M:
-                                rate_idx = 5;
-                                break;
-                        case DESC_RATE48M:
-                                rate_idx = 6;
-                                break;
-                        case DESC_RATE54M:
-                                rate_idx = 7;
-                                break;
-                        default:
-                                rate_idx = 0;
-                                break;
-                        }
-                }
-        } else {
-                switch (desc_rate) {
-                case DESC_RATEMCS0:
-                        rate_idx = 0;
-                        break;
-                case DESC_RATEMCS1:
-                        rate_idx = 1;
-                        break;
-                case DESC_RATEMCS2:
-                        rate_idx = 2;
-                        break;
-                case DESC_RATEMCS3:
-                        rate_idx = 3;
-                        break;
-                case DESC_RATEMCS4:
-                        rate_idx = 4;
-                        break;
-                case DESC_RATEMCS5:
-                        rate_idx = 5;
-                        break;
-                case DESC_RATEMCS6:
-                        rate_idx = 6;
-                        break;
-                case DESC_RATEMCS7:
-                        rate_idx = 7;
-                        break;
-                case DESC_RATEMCS8:
-                        rate_idx = 8;
-                        break;
-                case DESC_RATEMCS9:
-                        rate_idx = 9;
-                        break;
-                case DESC_RATEMCS10:
-                        rate_idx = 10;
-                        break;
-                case DESC_RATEMCS11:
-                        rate_idx = 11;
-                        break;
-                case DESC_RATEMCS12:
-                        rate_idx = 12;
-                        break;
-                case DESC_RATEMCS13:
-                        rate_idx = 13;
-                        break;
-                case DESC_RATEMCS14:
-                        rate_idx = 14;
-                        break;
-                case DESC_RATEMCS15:
-                        rate_idx = 15;
-                        break;
-                default:
-                        rate_idx = 0;
-                        break;
-                }
-        }
-
-        if (isvht) {
-                switch (desc_rate) {
-                case DESC_RATEVHT1SS_MCS0:
-                        rate_idx = 0;
-                        break;
-                case DESC_RATEVHT1SS_MCS1:
-                        rate_idx = 1;
-                        break;
-                case DESC_RATEVHT1SS_MCS2:
-                        rate_idx = 2;
-                        break;
-                case DESC_RATEVHT1SS_MCS3:
-                        rate_idx = 3;
-                        break;
-                case DESC_RATEVHT1SS_MCS4:
-                        rate_idx = 4;
-                        break;
-                case DESC_RATEVHT1SS_MCS5:
-                        rate_idx = 5;
-                        break;
-                case DESC_RATEVHT1SS_MCS6:
-                        rate_idx = 6;
-                        break;
-                case DESC_RATEVHT1SS_MCS7:
-                        rate_idx = 7;
-                        break;
-                case DESC_RATEVHT1SS_MCS8:
-                        rate_idx = 8;
-                        break;
-                case DESC_RATEVHT1SS_MCS9:
-                        rate_idx = 9;
-                        break;
-                case DESC_RATEVHT2SS_MCS0:
-                        rate_idx = 0;
-                        break;
-                case DESC_RATEVHT2SS_MCS1:
-                        rate_idx = 1;
-                        break;
-                case DESC_RATEVHT2SS_MCS2:
-                        rate_idx = 2;
-                        break;
-                case DESC_RATEVHT2SS_MCS3:
-                        rate_idx = 3;
-                        break;
-                case DESC_RATEVHT2SS_MCS4:
-                        rate_idx = 4;
-                        break;
-                case DESC_RATEVHT2SS_MCS5:
-                        rate_idx = 5;
-                        break;
-                case DESC_RATEVHT2SS_MCS6:
-                        rate_idx = 6;
-                        break;
-                case DESC_RATEVHT2SS_MCS7:
-                        rate_idx = 7;
-                        break;
-                case DESC_RATEVHT2SS_MCS8:
-                        rate_idx = 8;
-                        break;
-                case DESC_RATEVHT2SS_MCS9:
-                        rate_idx = 9;
-                        break;
-                default:
-                        rate_idx = 0;
-                        break;
-                }
-        }
-        return rate_idx;
-}
-
 static u16 odm_cfo(char value)
 {
         int ret_val;
@@ -766,9 +540,9 @@ bool rtl8821ae_rx_query_desc(struct ieee80211_hw *hw,
          * supported rates or MCS index if HT rates
          * are use (RX_FLAG_HT)
          */
-        rx_status->rate_idx =
-          _rtl8821ae_rate_mapping(hw, status->is_ht,
-                                  status->is_vht, status->rate);
+        rx_status->rate_idx = rtlwifi_rate_mapping(hw, status->is_ht,
+                                                   status->is_vht,
+                                                   status->rate);
 
         rx_status->mactime = status->timestamp_low;
         if (phystatus) {
diff --git a/drivers/net/wireless/rtlwifi/wifi.h b/drivers/net/wireless/rtlwifi/wifi.h
index 6866dcf24340..51572912c53d 100644
--- a/drivers/net/wireless/rtlwifi/wifi.h
+++ b/drivers/net/wireless/rtlwifi/wifi.h
@@ -331,10 +331,10 @@ enum hardware_type {
 (IS_HARDWARE_TYPE_8723E(rtlhal) || IS_HARDWARE_TYPE_8723U(rtlhal))
 
 #define RX_HAL_IS_CCK_RATE(rxmcs)                       \
-        ((rxmcs) == DESC92_RATE1M ||                    \
-         (rxmcs) == DESC92_RATE2M ||                    \
-         (rxmcs) == DESC92_RATE5_5M ||                  \
-         (rxmcs) == DESC92_RATE11M)
+        ((rxmcs) == DESC_RATE1M ||                      \
+         (rxmcs) == DESC_RATE2M ||                      \
+         (rxmcs) == DESC_RATE5_5M ||                    \
+         (rxmcs) == DESC_RATE11M)
 
 enum scan_operation_backup_opt {
         SCAN_OPT_BACKUP = 0,
@@ -579,38 +579,59 @@ enum rtl_hal_state {
 };
 
 enum rtl_desc92_rate {
-        DESC92_RATE1M = 0x00,
-        DESC92_RATE2M = 0x01,
-        DESC92_RATE5_5M = 0x02,
-        DESC92_RATE11M = 0x03,
-
-        DESC92_RATE6M = 0x04,
-        DESC92_RATE9M = 0x05,
-        DESC92_RATE12M = 0x06,
-        DESC92_RATE18M = 0x07,
-        DESC92_RATE24M = 0x08,
-        DESC92_RATE36M = 0x09,
-        DESC92_RATE48M = 0x0a,
-        DESC92_RATE54M = 0x0b,
-
-        DESC92_RATEMCS0 = 0x0c,
-        DESC92_RATEMCS1 = 0x0d,
-        DESC92_RATEMCS2 = 0x0e,
-        DESC92_RATEMCS3 = 0x0f,
-        DESC92_RATEMCS4 = 0x10,
-        DESC92_RATEMCS5 = 0x11,
-        DESC92_RATEMCS6 = 0x12,
-        DESC92_RATEMCS7 = 0x13,
-        DESC92_RATEMCS8 = 0x14,
-        DESC92_RATEMCS9 = 0x15,
-        DESC92_RATEMCS10 = 0x16,
-        DESC92_RATEMCS11 = 0x17,
-        DESC92_RATEMCS12 = 0x18,
-        DESC92_RATEMCS13 = 0x19,
-        DESC92_RATEMCS14 = 0x1a,
-        DESC92_RATEMCS15 = 0x1b,
-        DESC92_RATEMCS15_SG = 0x1c,
-        DESC92_RATEMCS32 = 0x20,
+        DESC_RATE1M = 0x00,
+        DESC_RATE2M = 0x01,
+        DESC_RATE5_5M = 0x02,
+        DESC_RATE11M = 0x03,
+
+        DESC_RATE6M = 0x04,
+        DESC_RATE9M = 0x05,
+        DESC_RATE12M = 0x06,
+        DESC_RATE18M = 0x07,
+        DESC_RATE24M = 0x08,
+        DESC_RATE36M = 0x09,
+        DESC_RATE48M = 0x0a,
+        DESC_RATE54M = 0x0b,
+
+        DESC_RATEMCS0 = 0x0c,
+        DESC_RATEMCS1 = 0x0d,
+        DESC_RATEMCS2 = 0x0e,
+        DESC_RATEMCS3 = 0x0f,
+        DESC_RATEMCS4 = 0x10,
+        DESC_RATEMCS5 = 0x11,
+        DESC_RATEMCS6 = 0x12,
+        DESC_RATEMCS7 = 0x13,
+        DESC_RATEMCS8 = 0x14,
+        DESC_RATEMCS9 = 0x15,
+        DESC_RATEMCS10 = 0x16,
+        DESC_RATEMCS11 = 0x17,
+        DESC_RATEMCS12 = 0x18,
+        DESC_RATEMCS13 = 0x19,
+        DESC_RATEMCS14 = 0x1a,
+        DESC_RATEMCS15 = 0x1b,
+        DESC_RATEMCS15_SG = 0x1c,
+        DESC_RATEMCS32 = 0x20,
+
+        DESC_RATEVHT1SS_MCS0 = 0x2c,
+        DESC_RATEVHT1SS_MCS1 = 0x2d,
+        DESC_RATEVHT1SS_MCS2 = 0x2e,
+        DESC_RATEVHT1SS_MCS3 = 0x2f,
+        DESC_RATEVHT1SS_MCS4 = 0x30,
+        DESC_RATEVHT1SS_MCS5 = 0x31,
+        DESC_RATEVHT1SS_MCS6 = 0x32,
+        DESC_RATEVHT1SS_MCS7 = 0x33,
+        DESC_RATEVHT1SS_MCS8 = 0x34,
+        DESC_RATEVHT1SS_MCS9 = 0x35,
+        DESC_RATEVHT2SS_MCS0 = 0x36,
+        DESC_RATEVHT2SS_MCS1 = 0x37,
+        DESC_RATEVHT2SS_MCS2 = 0x38,
+        DESC_RATEVHT2SS_MCS3 = 0x39,
+        DESC_RATEVHT2SS_MCS4 = 0x3a,
+        DESC_RATEVHT2SS_MCS5 = 0x3b,
+        DESC_RATEVHT2SS_MCS6 = 0x3c,
+        DESC_RATEVHT2SS_MCS7 = 0x3d,
+        DESC_RATEVHT2SS_MCS8 = 0x3e,
+        DESC_RATEVHT2SS_MCS9 = 0x3f,
 };
 
 enum rtl_var_map {
@@ -2161,6 +2182,7 @@ struct rtl_hal_ops {
         void (*add_wowlan_pattern)(struct ieee80211_hw *hw,
                                    struct rtl_wow_pattern *rtl_pattern,
                                    u8 index);
+        u16 (*get_available_desc)(struct ieee80211_hw *hw, u8 q_idx);
 };
 
 struct rtl_intf_ops {
@@ -2242,6 +2264,7 @@ struct rtl_hal_cfg {
         char *name;
         char *fw_name;
         char *alt_fw_name;
+        char *wowlan_fw_name;
         struct rtl_hal_ops *ops;
         struct rtl_mod_params *mod_params;
         struct rtl_hal_usbint_cfg *usb_interface_cfg;
@@ -2390,8 +2413,6 @@ struct dig_t {
         u8 pre_ccastate;
         u8 cur_ccasate;
         u8 large_fa_hit;
-        u8 dig_dynamic_min;
-        u8 dig_dynamic_min_1;
         u8 forbidden_igi;
         u8 dig_state;
         u8 dig_highpwrstate;
@@ -2518,8 +2539,6 @@ struct proxim {
 
 struct rtl_priv {
         struct ieee80211_hw *hw;
-        /* Used to load a second firmware */
-        void (*rtl_fw_second_cb)(struct rtl_priv *rtlpriv);
         struct completion firmware_loading_complete;
         struct list_head list;
         struct rtl_priv *buddy_priv;
diff --git a/drivers/net/wireless/ti/wl1251/main.c b/drivers/net/wireless/ti/wl1251/main.c
index 0b30a7b4d663..d4ba009ac9aa 100644
--- a/drivers/net/wireless/ti/wl1251/main.c
+++ b/drivers/net/wireless/ti/wl1251/main.c
@@ -500,6 +500,7 @@ static int wl1251_op_add_interface(struct ieee80211_hw *hw,
         int ret = 0;
 
         vif->driver_flags |= IEEE80211_VIF_BEACON_FILTER |
+                             IEEE80211_VIF_SUPPORTS_UAPSD |
                              IEEE80211_VIF_SUPPORTS_CQM_RSSI;
 
         wl1251_debug(DEBUG_MAC80211, "mac80211 add interface type %d mac %pM",
@@ -1480,9 +1481,7 @@ int wl1251_init_ieee80211(struct wl1251 *wl)
         /* unit us */
         /* FIXME: find a proper value */
 
-        wl->hw->flags = IEEE80211_HW_SIGNAL_DBM |
-                IEEE80211_HW_SUPPORTS_PS |
-                IEEE80211_HW_SUPPORTS_UAPSD;
+        wl->hw->flags = IEEE80211_HW_SIGNAL_DBM | IEEE80211_HW_SUPPORTS_PS;
 
         wl->hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
                                          BIT(NL80211_IFTYPE_ADHOC);
diff --git a/drivers/net/wireless/ti/wl12xx/main.c b/drivers/net/wireless/ti/wl12xx/main.c
index d6d0d6d9c7a8..144d1f8ba473 100644
--- a/drivers/net/wireless/ti/wl12xx/main.c
+++ b/drivers/net/wireless/ti/wl12xx/main.c
@@ -250,6 +250,7 @@ static struct wlcore_conf wl12xx_conf = {
                 .keep_alive_interval         = 55000,
                 .max_listen_interval         = 20,
                 .sta_sleep_auth              = WL1271_PSM_ILLEGAL,
+                .suspend_rx_ba_activity      = 0,
         },
         .itrim = {
                 .enable = false,
@@ -1728,6 +1729,9 @@ static struct wlcore_ops wl12xx_ops = {
         .convert_hwaddr         = wl12xx_convert_hwaddr,
         .lnk_high_prio          = wl12xx_lnk_high_prio,
         .lnk_low_prio           = wl12xx_lnk_low_prio,
+        .interrupt_notify       = NULL,
+        .rx_ba_filter           = NULL,
+        .ap_sleep               = NULL,
 };
 
 static struct ieee80211_sta_ht_cap wl12xx_ht_cap = {
diff --git a/drivers/net/wireless/ti/wl18xx/acx.c b/drivers/net/wireless/ti/wl18xx/acx.c
index a169bb5a5dbf..67f2a0eec854 100644
--- a/drivers/net/wireless/ti/wl18xx/acx.c
+++ b/drivers/net/wireless/ti/wl18xx/acx.c
@@ -24,6 +24,7 @@
 #include "../wlcore/acx.h"
 
 #include "acx.h"
+#include "wl18xx.h"
 
 int wl18xx_acx_host_if_cfg_bitmap(struct wl1271 *wl, u32 host_cfg_bitmap,
                                   u32 sdio_blk_size, u32 extra_mem_blks,
@@ -194,3 +195,90 @@ out:
         kfree(acx);
         return ret;
 }
+
+/*
+ * When the host is suspended, we don't want to get any fast-link/PSM
+ * notifications
+ */
+int wl18xx_acx_interrupt_notify_config(struct wl1271 *wl,
+                                       bool action)
+{
+        struct wl18xx_acx_interrupt_notify *acx;
+        int ret = 0;
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        acx->enable = action;
+        ret = wl1271_cmd_configure(wl, ACX_INTERRUPT_NOTIFY, acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1271_warning("acx interrupt notify setting failed: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(acx);
+        return ret;
+}
+
+/*
+ * When the host is suspended, we can configure the FW to disable RX BA
+ * notifications.
+ */
+int wl18xx_acx_rx_ba_filter(struct wl1271 *wl, bool action)
+{
+        struct wl18xx_acx_rx_ba_filter *acx;
+        int ret = 0;
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        acx->enable = (u32)action;
+        ret = wl1271_cmd_configure(wl, ACX_RX_BA_FILTER, acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1271_warning("acx rx ba activity filter setting failed: %d",
+                               ret);
+                goto out;
+        }
+
+out:
+        kfree(acx);
+        return ret;
+}
+
+int wl18xx_acx_ap_sleep(struct wl1271 *wl)
+{
+        struct wl18xx_priv *priv = wl->priv;
+        struct acx_ap_sleep_cfg *acx;
+        struct conf_ap_sleep_settings *conf = &priv->conf.ap_sleep;
+        int ret;
+
+        wl1271_debug(DEBUG_ACX, "acx config ap sleep");
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+        if (!acx) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        acx->idle_duty_cycle = conf->idle_duty_cycle;
+        acx->connected_duty_cycle = conf->connected_duty_cycle;
+        acx->max_stations_thresh = conf->max_stations_thresh;
+        acx->idle_conn_thresh = conf->idle_conn_thresh;
+
+        ret = wl1271_cmd_configure(wl, ACX_AP_SLEEP_CFG, acx, sizeof(*acx));
+        if (ret < 0) {
+                wl1271_warning("acx config ap-sleep failed: %d", ret);
+                goto out;
+        }
+
+out:
+        kfree(acx);
+        return ret;
+}
diff --git a/drivers/net/wireless/ti/wl18xx/acx.h b/drivers/net/wireless/ti/wl18xx/acx.h
index 0e636def1217..4afccd4b9467 100644
--- a/drivers/net/wireless/ti/wl18xx/acx.h
+++ b/drivers/net/wireless/ti/wl18xx/acx.h
@@ -32,7 +32,10 @@ enum {
         ACX_SIM_CONFIG                   = 0x0053,
         ACX_CLEAR_STATISTICS             = 0x0054,
         ACX_AUTO_RX_STREAMING            = 0x0055,
-        ACX_PEER_CAP                     = 0x0056
+        ACX_PEER_CAP                     = 0x0056,
+        ACX_INTERRUPT_NOTIFY             = 0x0057,
+        ACX_RX_BA_FILTER                 = 0x0058,
+        ACX_AP_SLEEP_CFG                 = 0x0059
 };
 
 /* numbers of bits the length field takes (add 1 for the actual number) */
@@ -326,6 +329,44 @@ struct wlcore_acx_peer_cap {
         u8 padding;
 } __packed;
 
+/*
+ * ACX_INTERRUPT_NOTIFY
+ * enable/disable fast-link/PSM notification from FW
+ */
+struct wl18xx_acx_interrupt_notify {
+        struct acx_header header;
+        u32 enable;
+};
+
+/*
+ * ACX_RX_BA_FILTER
+ * enable/disable RX BA filtering in FW
+ */
+struct wl18xx_acx_rx_ba_filter {
+        struct acx_header header;
+        u32 enable;
+};
+
+struct acx_ap_sleep_cfg {
+        struct acx_header header;
+        /* Duty Cycle (20-80% of staying Awake) for IDLE AP
+         * (0: disable)
+         */
+        u8 idle_duty_cycle;
+        /* Duty Cycle (20-80% of staying Awake) for Connected AP
+         * (0: disable)
+         */
+        u8 connected_duty_cycle;
+        /* Maximum stations that are allowed to be connected to AP
+         *  (255: no limit)
+         */
+        u8 max_stations_thresh;
+        /* Timeout till enabling the Sleep Mechanism after data stops
+         * [unit: 100 msec]
+         */
+        u8 idle_conn_thresh;
+} __packed;
+
 int wl18xx_acx_host_if_cfg_bitmap(struct wl1271 *wl, u32 host_cfg_bitmap,
                                   u32 sdio_blk_size, u32 extra_mem_blks,
                                   u32 len_field_size);
@@ -336,5 +377,8 @@ int wl18xx_acx_set_peer_cap(struct wl1271 *wl,
                             struct ieee80211_sta_ht_cap *ht_cap,
                             bool allow_ht_operation,
                             u32 rate_set, u8 hlid);
+int wl18xx_acx_interrupt_notify_config(struct wl1271 *wl, bool action);
+int wl18xx_acx_rx_ba_filter(struct wl1271 *wl, bool action);
+int wl18xx_acx_ap_sleep(struct wl1271 *wl);
 
 #endif /* __WL18XX_ACX_H__ */
diff --git a/drivers/net/wireless/ti/wl18xx/cmd.c b/drivers/net/wireless/ti/wl18xx/cmd.c
index 44f0b205b065..a8d176ddc73c 100644
--- a/drivers/net/wireless/ti/wl18xx/cmd.c
+++ b/drivers/net/wireless/ti/wl18xx/cmd.c
@@ -33,7 +33,8 @@ int wl18xx_cmd_channel_switch(struct wl1271 *wl,
         u32 supported_rates;
         int ret;
 
-        wl1271_debug(DEBUG_ACX, "cmd channel switch");
+        wl1271_debug(DEBUG_ACX, "cmd channel switch (count=%d)",
+                     ch_switch->count);
 
         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
         if (!cmd) {
@@ -60,8 +61,12 @@ int wl18xx_cmd_channel_switch(struct wl1271 *wl,
                 goto out_free;
         }
 
-        supported_rates = CONF_TX_ENABLED_RATES | CONF_TX_MCS_RATES |
-                          wlcore_hw_sta_get_ap_rate_mask(wl, wlvif);
+        supported_rates = CONF_TX_ENABLED_RATES | CONF_TX_MCS_RATES;
+        if (wlvif->bss_type == BSS_TYPE_STA_BSS)
+                supported_rates |= wlcore_hw_sta_get_ap_rate_mask(wl, wlvif);
+        else
+                supported_rates |=
+                        wlcore_hw_ap_get_mimo_wide_rate_mask(wl, wlvif);
         if (wlvif->p2p)
                 supported_rates &= ~CONF_TX_CCK_RATES;
         cmd->local_supported_rates = cpu_to_le32(supported_rates);
@@ -167,3 +172,85 @@ out_free:
 out:
         return ret;
 }
+
+int wl18xx_cmd_set_cac(struct wl1271 *wl, struct wl12xx_vif *wlvif, bool start)
+{
+        struct wlcore_cmd_cac_start *cmd;
+        int ret = 0;
+
+        wl1271_debug(DEBUG_CMD, "cmd cac (channel %d) %s",
+                     wlvif->channel, start ? "start" : "stop");
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (!cmd)
+                return -ENOMEM;
+
+        cmd->role_id = wlvif->role_id;
+        cmd->channel = wlvif->channel;
+        if (wlvif->band == IEEE80211_BAND_5GHZ)
+                cmd->band = WLCORE_BAND_5GHZ;
+        cmd->bandwidth = wlcore_get_native_channel_type(wlvif->channel_type);
+
+        ret = wl1271_cmd_send(wl,
+                              start ? CMD_CAC_START : CMD_CAC_STOP,
+                              cmd, sizeof(*cmd), 0);
+        if (ret < 0) {
+                wl1271_error("failed to send cac command");
+                goto out_free;
+        }
+
+out_free:
+        kfree(cmd);
+        return ret;
+}
+
+int wl18xx_cmd_radar_detection_debug(struct wl1271 *wl, u8 channel)
+{
+        struct wl18xx_cmd_dfs_radar_debug *cmd;
+        int ret = 0;
+
+        wl1271_debug(DEBUG_CMD, "cmd radar detection debug (chan %d)",
+                     channel);
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (!cmd)
+                return -ENOMEM;
+
+        cmd->channel = channel;
+
+        ret = wl1271_cmd_send(wl, CMD_DFS_RADAR_DETECTION_DEBUG,
+                              cmd, sizeof(*cmd), 0);
+        if (ret < 0) {
+                wl1271_error("failed to send radar detection debug command");
+                goto out_free;
+        }
+
+out_free:
+        kfree(cmd);
+        return ret;
+}
+
+int wl18xx_cmd_dfs_master_restart(struct wl1271 *wl, struct wl12xx_vif *wlvif)
+{
+        struct wl18xx_cmd_dfs_master_restart *cmd;
+        int ret = 0;
+
+        wl1271_debug(DEBUG_CMD, "cmd dfs master restart (role %d)",
+                     wlvif->role_id);
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (!cmd)
+                return -ENOMEM;
+
+        cmd->role_id = wlvif->role_id;
+
+        ret = wl1271_cmd_send(wl, CMD_DFS_MASTER_RESTART,
+                              cmd, sizeof(*cmd), 0);
+        if (ret < 0) {
+                wl1271_error("failed to send dfs master restart command");
+                goto out_free;
+        }
+out_free:
+        kfree(cmd);
+        return ret;
+}
diff --git a/drivers/net/wireless/ti/wl18xx/cmd.h b/drivers/net/wireless/ti/wl18xx/cmd.h
index 92499e2dfa83..7f9440a2bff8 100644
--- a/drivers/net/wireless/ti/wl18xx/cmd.h
+++ b/drivers/net/wireless/ti/wl18xx/cmd.h
@@ -59,6 +59,30 @@ struct wl18xx_cmd_smart_config_set_group_key {
         u8 key[16];
 } __packed;
 
+struct wl18xx_cmd_dfs_radar_debug {
+        struct wl1271_cmd_header header;
+
+        u8 channel;
+        u8 padding[3];
+} __packed;
+
+struct wl18xx_cmd_dfs_master_restart {
+        struct wl1271_cmd_header header;
+
+        u8 role_id;
+        u8 padding[3];
+} __packed;
+
+/* cac_start and cac_stop share the same params */
+struct wlcore_cmd_cac_start {
+        struct wl1271_cmd_header header;
+
+        u8 role_id;
+        u8 channel;
+        u8 band;
+        u8 bandwidth;
+} __packed;
+
 int wl18xx_cmd_channel_switch(struct wl1271 *wl,
                               struct wl12xx_vif *wlvif,
                               struct ieee80211_channel_switch *ch_switch);
@@ -66,4 +90,7 @@ int wl18xx_cmd_smart_config_start(struct wl1271 *wl, u32 group_bitmap);
 int wl18xx_cmd_smart_config_stop(struct wl1271 *wl);
 int wl18xx_cmd_smart_config_set_group_key(struct wl1271 *wl, u16 group_id,
                                           u8 key_len, u8 *key);
+int wl18xx_cmd_set_cac(struct wl1271 *wl, struct wl12xx_vif *wlvif, bool start);
+int wl18xx_cmd_radar_detection_debug(struct wl1271 *wl, u8 channel);
+int wl18xx_cmd_dfs_master_restart(struct wl1271 *wl, struct wl12xx_vif *wlvif);
 #endif
diff --git a/drivers/net/wireless/ti/wl18xx/conf.h b/drivers/net/wireless/ti/wl18xx/conf.h
index e34302e3b51d..71f1ec448ba5 100644
--- a/drivers/net/wireless/ti/wl18xx/conf.h
+++ b/drivers/net/wireless/ti/wl18xx/conf.h
@@ -23,7 +23,7 @@
 #define __WL18XX_CONF_H__
 
 #define WL18XX_CONF_MAGIC       0x10e100ca
-#define WL18XX_CONF_VERSION     (WLCORE_CONF_VERSION | 0x0006)
+#define WL18XX_CONF_VERSION     (WLCORE_CONF_VERSION | 0x0007)
 #define WL18XX_CONF_MASK        0x0000ffff
 #define WL18XX_CONF_SIZE        (WLCORE_CONF_SIZE + \
                                  sizeof(struct wl18xx_priv_conf))
@@ -110,12 +110,33 @@ struct wl18xx_ht_settings {
         u8 mode;
 } __packed;
 
+struct conf_ap_sleep_settings {
+        /* Duty Cycle (20-80% of staying Awake) for IDLE AP
+         * (0: disable)
+         */
+        u8 idle_duty_cycle;
+        /* Duty Cycle (20-80% of staying Awake) for Connected AP
+         * (0: disable)
+         */
+        u8 connected_duty_cycle;
+        /* Maximum stations that are allowed to be connected to AP
+         *  (255: no limit)
+         */
+        u8 max_stations_thresh;
+        /* Timeout till enabling the Sleep Mechanism after data stops
+         * [unit: 100 msec]
+         */
+        u8 idle_conn_thresh;
+} __packed;
+
 struct wl18xx_priv_conf {
         /* Module params structures */
         struct wl18xx_ht_settings ht;
 
         /* this structure is copied wholesale to FW */
         struct wl18xx_mac_and_phy_params phy;
+
+        struct conf_ap_sleep_settings ap_sleep;
 } __packed;
 
 #endif /* __WL18XX_CONF_H__ */
diff --git a/drivers/net/wireless/ti/wl18xx/debugfs.c b/drivers/net/wireless/ti/wl18xx/debugfs.c
index 7f1669cdea09..c93fae95baac 100644
--- a/drivers/net/wireless/ti/wl18xx/debugfs.c
+++ b/drivers/net/wireless/ti/wl18xx/debugfs.c
@@ -22,9 +22,12 @@
 
 #include "../wlcore/debugfs.h"
 #include "../wlcore/wlcore.h"
+#include "../wlcore/debug.h"
+#include "../wlcore/ps.h"
 
 #include "wl18xx.h"
 #include "acx.h"
+#include "cmd.h"
 #include "debugfs.h"
 
 #define WL18XX_DEBUGFS_FWSTATS_FILE(a, b, c) \
@@ -239,6 +242,45 @@ static const struct file_operations clear_fw_stats_ops = {
         .llseek = default_llseek,
 };
 
+static ssize_t radar_detection_write(struct file *file,
+                                     const char __user *user_buf,
+                                     size_t count, loff_t *ppos)
+{
+        struct wl1271 *wl = file->private_data;
+        int ret;
+        u8 channel;
+
+        ret = kstrtou8_from_user(user_buf, count, 10, &channel);
+        if (ret < 0) {
+                wl1271_warning("illegal channel");
+                return -EINVAL;
+        }
+
+        mutex_lock(&wl->mutex);
+
+        if (unlikely(wl->state != WLCORE_STATE_ON))
+                goto out;
+
+        ret = wl1271_ps_elp_wakeup(wl);
+        if (ret < 0)
+                goto out;
+
+        ret = wl18xx_cmd_radar_detection_debug(wl, channel);
+        if (ret < 0)
+                count = ret;
+
+        wl1271_ps_elp_sleep(wl);
+out:
+        mutex_unlock(&wl->mutex);
+        return count;
+}
+
+static const struct file_operations radar_detection_ops = {
+        .write = radar_detection_write,
+        .open = simple_open,
+        .llseek = default_llseek,
+};
+
 int wl18xx_debugfs_add_files(struct wl1271 *wl,
                              struct dentry *rootdir)
 {
@@ -390,6 +432,7 @@ int wl18xx_debugfs_add_files(struct wl1271 *wl,
         DEBUGFS_FWSTATS_ADD(mem, fw_gen_free_mem_blks);
 
         DEBUGFS_ADD(conf, moddir);
+        DEBUGFS_ADD(radar_detection, moddir);
 
         return 0;
 
diff --git a/drivers/net/wireless/ti/wl18xx/event.c b/drivers/net/wireless/ti/wl18xx/event.c
index eb1848e08424..c28f06854195 100644
--- a/drivers/net/wireless/ti/wl18xx/event.c
+++ b/drivers/net/wireless/ti/wl18xx/event.c
@@ -47,6 +47,19 @@ int wl18xx_wait_for_event(struct wl1271 *wl, enum wlcore_wait_event event,
         return wlcore_cmd_wait_for_event_or_timeout(wl, local_event, timeout);
 }
 
+static const char *wl18xx_radar_type_decode(u8 radar_type)
+{
+        switch (radar_type) {
+        case RADAR_TYPE_REGULAR:
+                return "REGULAR";
+        case RADAR_TYPE_CHIRP:
+                return "CHIRP";
+        case RADAR_TYPE_NONE:
+        default:
+                return "N/A";
+        }
+}
+
 static int wlcore_smart_config_sync_event(struct wl1271 *wl, u8 sync_channel,
                                           u8 sync_band)
 {
@@ -115,6 +128,14 @@ int wl18xx_process_mailbox_events(struct wl1271 *wl)
                         wl18xx_scan_completed(wl, wl->scan_wlvif);
         }
 
+        if (vector & RADAR_DETECTED_EVENT_ID) {
+                wl1271_info("radar event: channel %d type %s",
+                            mbox->radar_channel,
+                            wl18xx_radar_type_decode(mbox->radar_type));
+
+                ieee80211_radar_detected(wl->hw);
+        }
+
         if (vector & PERIODIC_SCAN_REPORT_EVENT_ID) {
                 wl1271_debug(DEBUG_EVENT,
                              "PERIODIC_SCAN_REPORT_EVENT (results %d)",
diff --git a/drivers/net/wireless/ti/wl18xx/event.h b/drivers/net/wireless/ti/wl18xx/event.h
index 0680312d4943..266ee87834e4 100644
--- a/drivers/net/wireless/ti/wl18xx/event.h
+++ b/drivers/net/wireless/ti/wl18xx/event.h
@@ -42,6 +42,12 @@ enum {
         SMART_CONFIG_DECODE_EVENT_ID             = BIT(23),
 };
 
+enum wl18xx_radar_types {
+        RADAR_TYPE_NONE,
+        RADAR_TYPE_REGULAR,
+        RADAR_TYPE_CHIRP
+};
+
 struct wl18xx_event_mailbox {
         __le32 events_vector;
 
@@ -83,13 +89,19 @@ struct wl18xx_event_mailbox {
         u8 sc_token_len;
         u8 padding1;
         u8 sc_ssid[32];
-        u8 sc_pwd[32];
+        u8 sc_pwd[64];
         u8 sc_token[32];
 
         /* smart config sync channel */
         u8 sc_sync_channel;
         u8 sc_sync_band;
         u8 padding2[2];
+
+        /* radar detect */
+        u8 radar_channel;
+        u8 radar_type;
+
+        u8 padding3[2];
 } __packed;
 
 int wl18xx_wait_for_event(struct wl1271 *wl, enum wlcore_wait_event event,
diff --git a/drivers/net/wireless/ti/wl18xx/main.c b/drivers/net/wireless/ti/wl18xx/main.c
index 8e562610bf16..717c4f5a02c2 100644
--- a/drivers/net/wireless/ti/wl18xx/main.c
+++ b/drivers/net/wireless/ti/wl18xx/main.c
@@ -378,6 +378,7 @@ static struct wlcore_conf wl18xx_conf = {
                 .keep_alive_interval         = 55000,
                 .max_listen_interval         = 20,
                 .sta_sleep_auth              = WL1271_PSM_ILLEGAL,
+                .suspend_rx_ba_activity      = 0,
         },
         .itrim = {
                 .enable = false,
@@ -567,6 +568,12 @@ static struct wl18xx_priv_conf wl18xx_default_priv_conf = {
                 .high_power_val_2nd             = 0xff,
                 .tx_rf_margin                   = 1,
         },
+        .ap_sleep = {               /* disabled by default */
+                .idle_duty_cycle        = 0,
+                .connected_duty_cycle   = 0,
+                .max_stations_thresh    = 0,
+                .idle_conn_thresh       = 0,
+        },
 };
 
 static const struct wlcore_partition_set wl18xx_ptable[PART_TABLE_LEN] = {
@@ -648,7 +655,7 @@ static const struct wl18xx_clk_cfg wl18xx_clk_table[NUM_CLOCK_CONFIGS] = {
 };
 
 /* TODO: maybe move to a new header file? */
-#define WL18XX_FW_NAME "ti-connectivity/wl18xx-fw-3.bin"
+#define WL18XX_FW_NAME "ti-connectivity/wl18xx-fw-4.bin"
 
 static int wl18xx_identify_chip(struct wl1271 *wl)
 {
@@ -983,6 +990,7 @@ static int wl18xx_boot(struct wl1271 *wl)
 
         wl->event_mask = BSS_LOSS_EVENT_ID |
                 SCAN_COMPLETE_EVENT_ID |
+                RADAR_DETECTED_EVENT_ID |
                 RSSI_SNR_TRIGGER_0_EVENT_ID |
                 PERIODIC_SCAN_COMPLETE_EVENT_ID |
                 PERIODIC_SCAN_REPORT_EVENT_ID |
@@ -1559,26 +1567,19 @@ static u32 wl18xx_pre_pkt_send(struct wl1271 *wl,
 }
 
 static void wl18xx_sta_rc_update(struct wl1271 *wl,
-                                 struct wl12xx_vif *wlvif,
-                                 struct ieee80211_sta *sta,
-                                 u32 changed)
+                                 struct wl12xx_vif *wlvif)
 {
-        bool wide = sta->bandwidth >= IEEE80211_STA_RX_BW_40;
+        bool wide = wlvif->rc_update_bw >= IEEE80211_STA_RX_BW_40;
 
         wl1271_debug(DEBUG_MAC80211, "mac80211 sta_rc_update wide %d", wide);
 
-        if (!(changed & IEEE80211_RC_BW_CHANGED))
-                return;
-
-        mutex_lock(&wl->mutex);
-
         /* sanity */
         if (WARN_ON(wlvif->bss_type != BSS_TYPE_STA_BSS))
-                goto out;
+                return;
 
         /* ignore the change before association */
         if (!test_bit(WLVIF_FLAG_STA_ASSOCIATED, &wlvif->flags))
-                goto out;
+                return;
 
         /*
          * If we started out as wide, we can change the operation mode. If we
@@ -1589,9 +1590,6 @@ static void wl18xx_sta_rc_update(struct wl1271 *wl,
                 wl18xx_acx_peer_ht_operation_mode(wl, wlvif->sta.hlid, wide);
         else
                 ieee80211_connection_loss(wl12xx_wlvif_to_vif(wlvif));
-
-out:
-        mutex_unlock(&wl->mutex);
 }
 
 static int wl18xx_set_peer_cap(struct wl1271 *wl,
@@ -1703,6 +1701,11 @@ static struct wlcore_ops wl18xx_ops = {
         .smart_config_start = wl18xx_cmd_smart_config_start,
         .smart_config_stop  = wl18xx_cmd_smart_config_stop,
         .smart_config_set_group_key = wl18xx_cmd_smart_config_set_group_key,
+        .interrupt_notify = wl18xx_acx_interrupt_notify_config,
+        .rx_ba_filter   = wl18xx_acx_rx_ba_filter,
+        .ap_sleep       = wl18xx_acx_ap_sleep,
+        .set_cac        = wl18xx_cmd_set_cac,
+        .dfs_master_restart     = wl18xx_cmd_dfs_master_restart,
 };
 
 /* HT cap appropriate for wide channels in 2Ghz */
@@ -1796,6 +1799,10 @@ wl18xx_iface_combinations[] = {
                 .limits = wl18xx_iface_ap_limits,
                 .n_limits = ARRAY_SIZE(wl18xx_iface_ap_limits),
                 .num_different_channels = 1,
+                .radar_detect_widths =  BIT(NL80211_CHAN_NO_HT) |
+                                        BIT(NL80211_CHAN_HT20) |
+                                        BIT(NL80211_CHAN_HT40MINUS) |
+                                        BIT(NL80211_CHAN_HT40PLUS),
         }
 };
 
diff --git a/drivers/net/wireless/ti/wl18xx/wl18xx.h b/drivers/net/wireless/ti/wl18xx/wl18xx.h
index 6a2b88030c1d..71e9e382ce80 100644
--- a/drivers/net/wireless/ti/wl18xx/wl18xx.h
+++ b/drivers/net/wireless/ti/wl18xx/wl18xx.h
@@ -26,10 +26,10 @@
 
 /* minimum FW required for driver */
 #define WL18XX_CHIP_VER         8
-#define WL18XX_IFTYPE_VER       8
+#define WL18XX_IFTYPE_VER       9
 #define WL18XX_MAJOR_VER        WLCORE_FW_VER_IGNORE
 #define WL18XX_SUBTYPE_VER      WLCORE_FW_VER_IGNORE
-#define WL18XX_MINOR_VER        13
+#define WL18XX_MINOR_VER        11
 
 #define WL18XX_CMD_MAX_SIZE          740
 
diff --git a/drivers/net/wireless/ti/wlcore/acx.c b/drivers/net/wireless/ti/wlcore/acx.c
index b924ceadc02c..f28fa3b5029d 100644
--- a/drivers/net/wireless/ti/wlcore/acx.c
+++ b/drivers/net/wireless/ti/wlcore/acx.c
@@ -1725,7 +1725,7 @@ int wl12xx_acx_config_hangover(struct wl1271 *wl)
         acx->decrease_delta = conf->decrease_delta;
         acx->quiet_time = conf->quiet_time;
         acx->increase_time = conf->increase_time;
-        acx->window_size = acx->window_size;
+        acx->window_size = conf->window_size;
 
         ret = wl1271_cmd_configure(wl, ACX_CONFIG_HANGOVER, acx,
                                    sizeof(*acx));
diff --git a/drivers/net/wireless/ti/wlcore/cmd.c b/drivers/net/wireless/ti/wlcore/cmd.c
index b82661962d33..c26fc2106e5b 100644
--- a/drivers/net/wireless/ti/wlcore/cmd.c
+++ b/drivers/net/wireless/ti/wlcore/cmd.c
@@ -403,7 +403,7 @@ void wl12xx_free_link(struct wl1271 *wl, struct wl12xx_vif *wlvif, u8 *hlid)
         WARN_ON_ONCE(wl->active_link_count < 0);
 }
 
-static u8 wlcore_get_native_channel_type(u8 nl_channel_type)
+u8 wlcore_get_native_channel_type(u8 nl_channel_type)
 {
         switch (nl_channel_type) {
         case NL80211_CHAN_NO_HT:
@@ -419,6 +419,7 @@ static u8 wlcore_get_native_channel_type(u8 nl_channel_type)
                 return WLCORE_CHAN_NO_HT;
         }
 }
+EXPORT_SYMBOL_GPL(wlcore_get_native_channel_type);
 
 static int wl12xx_cmd_role_start_dev(struct wl1271 *wl,
                                      struct wl12xx_vif *wlvif,
@@ -1686,9 +1687,7 @@ int wlcore_cmd_regdomain_config_locked(struct wl1271 *wl)
 {
         struct wl12xx_cmd_regdomain_dfs_config *cmd = NULL;
         int ret = 0, i, b, ch_bit_idx;
-        struct ieee80211_channel *channel;
         u32 tmp_ch_bitmap[2];
-        u16 ch;
         struct wiphy *wiphy = wl->hw->wiphy;
         struct ieee80211_supported_band *band;
         bool timeout = false;
@@ -1703,12 +1702,16 @@ int wlcore_cmd_regdomain_config_locked(struct wl1271 *wl)
         for (b = IEEE80211_BAND_2GHZ; b <= IEEE80211_BAND_5GHZ; b++) {
                 band = wiphy->bands[b];
                 for (i = 0; i < band->n_channels; i++) {
-                        channel = &band->channels[i];
-                        ch = channel->hw_value;
+                        struct ieee80211_channel *channel = &band->channels[i];
+                        u16 ch = channel->hw_value;
+                        u32 flags = channel->flags;
 
-                        if (channel->flags & (IEEE80211_CHAN_DISABLED |
-                                              IEEE80211_CHAN_RADAR |
-                                              IEEE80211_CHAN_NO_IR))
+                        if (flags & (IEEE80211_CHAN_DISABLED |
+                                     IEEE80211_CHAN_NO_IR))
+                                continue;
+
+                        if ((flags & IEEE80211_CHAN_RADAR) &&
+                            channel->dfs_state != NL80211_DFS_AVAILABLE)
                                 continue;
 
                         ch_bit_idx = wlcore_get_reg_conf_ch_idx(b, ch);
@@ -1733,6 +1736,7 @@ int wlcore_cmd_regdomain_config_locked(struct wl1271 *wl)
 
         cmd->ch_bit_map1 = cpu_to_le32(tmp_ch_bitmap[0]);
         cmd->ch_bit_map2 = cpu_to_le32(tmp_ch_bitmap[1]);
+        cmd->dfs_region = wl->dfs_region;
 
         wl1271_debug(DEBUG_CMD,
                      "cmd reg domain bitmap1: 0x%08x, bitmap2: 0x%08x",
diff --git a/drivers/net/wireless/ti/wlcore/cmd.h b/drivers/net/wireless/ti/wlcore/cmd.h
index 453684a71d30..e14cd407a6ae 100644
--- a/drivers/net/wireless/ti/wlcore/cmd.h
+++ b/drivers/net/wireless/ti/wlcore/cmd.h
@@ -105,6 +105,7 @@ int wl12xx_allocate_link(struct wl1271 *wl, struct wl12xx_vif *wlvif,
 void wl12xx_free_link(struct wl1271 *wl, struct wl12xx_vif *wlvif, u8 *hlid);
 int wlcore_cmd_wait_for_event_or_timeout(struct wl1271 *wl,
                                          u32 mask, bool *timeout);
+u8 wlcore_get_native_channel_type(u8 nl_channel_type);
 
 enum wl1271_commands {
         CMD_INTERROGATE = 1, /* use this to read information elements */
@@ -172,6 +173,11 @@ enum wl1271_commands {
         CMD_SMART_CONFIG_STOP           = 62,
         CMD_SMART_CONFIG_SET_GROUP_KEY  = 63,
 
+        CMD_CAC_START                   = 64,
+        CMD_CAC_STOP                    = 65,
+        CMD_DFS_MASTER_RESTART          = 66,
+        CMD_DFS_RADAR_DETECTION_DEBUG   = 67,
+
         MAX_COMMAND_ID = 0xFFFF,
 };
 
@@ -642,6 +648,8 @@ struct wl12xx_cmd_regdomain_dfs_config {
 
         __le32 ch_bit_map1;
         __le32 ch_bit_map2;
+        u8 dfs_region;
+        u8 padding[3];
 } __packed;
 
 struct wl12xx_cmd_config_fwlog {
diff --git a/drivers/net/wireless/ti/wlcore/conf.h b/drivers/net/wireless/ti/wlcore/conf.h
index 40995c42bef8..166add00b50f 100644
--- a/drivers/net/wireless/ti/wlcore/conf.h
+++ b/drivers/net/wireless/ti/wlcore/conf.h
@@ -997,6 +997,11 @@ struct conf_conn_settings {
          * whether we can go to ELP.
          */
         u8 sta_sleep_auth;
+
+        /*
+         * Default RX BA Activity filter configuration
+         */
+        u8 suspend_rx_ba_activity;
 } __packed;
 
 enum {
@@ -1347,7 +1352,7 @@ struct conf_recovery_settings {
  * version, the two LSB are the lower driver's private conf
  * version.
  */
-#define WLCORE_CONF_VERSION     (0x0005 << 16)
+#define WLCORE_CONF_VERSION     (0x0006 << 16)
 #define WLCORE_CONF_MASK        0xffff0000
 #define WLCORE_CONF_SIZE        (sizeof(struct wlcore_conf_header) +    \
                                  sizeof(struct wlcore_conf))
diff --git a/drivers/net/wireless/ti/wlcore/debugfs.c b/drivers/net/wireless/ti/wlcore/debugfs.c
index 0be21f62fcb0..68f3bf229b5a 100644
--- a/drivers/net/wireless/ti/wlcore/debugfs.c
+++ b/drivers/net/wireless/ti/wlcore/debugfs.c
@@ -929,17 +929,10 @@ static ssize_t beacon_filtering_write(struct file *file,
 {
         struct wl1271 *wl = file->private_data;
         struct wl12xx_vif *wlvif;
-        char buf[10];
-        size_t len;
         unsigned long value;
         int ret;
 
-        len = min(count, sizeof(buf) - 1);
-        if (copy_from_user(buf, user_buf, len))
-                return -EFAULT;
-        buf[len] = '\0';
-
-        ret = kstrtoul(buf, 0, &value);
+        ret = kstrtoul_from_user(user_buf, count, 0, &value);
         if (ret < 0) {
                 wl1271_warning("illegal value for beacon_filtering!");
                 return -EINVAL;
diff --git a/drivers/net/wireless/ti/wlcore/event.c b/drivers/net/wireless/ti/wlcore/event.c
index 5153640f4532..c42e78955e7b 100644
--- a/drivers/net/wireless/ti/wlcore/event.c
+++ b/drivers/net/wireless/ti/wlcore/event.c
@@ -139,7 +139,7 @@ void wlcore_event_channel_switch(struct wl1271 *wl,
         wl1271_debug(DEBUG_EVENT, "%s: roles=0x%lx success=%d",
                      __func__, roles_bitmap, success);
 
-        wl12xx_for_each_wlvif_sta(wl, wlvif) {
+        wl12xx_for_each_wlvif(wl, wlvif) {
                 if (wlvif->role_id == WL12XX_INVALID_ROLE_ID ||
                     !test_bit(wlvif->role_id , &roles_bitmap))
                         continue;
@@ -150,8 +150,13 @@ void wlcore_event_channel_switch(struct wl1271 *wl,
 
                 vif = wl12xx_wlvif_to_vif(wlvif);
 
-                ieee80211_chswitch_done(vif, success);
-                cancel_delayed_work(&wlvif->channel_switch_work);
+                if (wlvif->bss_type == BSS_TYPE_STA_BSS) {
+                        ieee80211_chswitch_done(vif, success);
+                        cancel_delayed_work(&wlvif->channel_switch_work);
+                } else {
+                        set_bit(WLVIF_FLAG_BEACON_DISABLED, &wlvif->flags);
+                        ieee80211_csa_finish(vif);
+                }
         }
 }
 EXPORT_SYMBOL_GPL(wlcore_event_channel_switch);
diff --git a/drivers/net/wireless/ti/wlcore/hw_ops.h b/drivers/net/wireless/ti/wlcore/hw_ops.h
index aa9f82c72296..eec56935b1b6 100644
--- a/drivers/net/wireless/ti/wlcore/hw_ops.h
+++ b/drivers/net/wireless/ti/wlcore/hw_ops.h
@@ -211,11 +211,35 @@ wlcore_hw_pre_pkt_send(struct wl1271 *wl, u32 buf_offset, u32 last_len)
 }
 
 static inline void
-wlcore_hw_sta_rc_update(struct wl1271 *wl, struct wl12xx_vif *wlvif,
-                        struct ieee80211_sta *sta, u32 changed)
+wlcore_hw_sta_rc_update(struct wl1271 *wl, struct wl12xx_vif *wlvif)
 {
         if (wl->ops->sta_rc_update)
-                wl->ops->sta_rc_update(wl, wlvif, sta, changed);
+                wl->ops->sta_rc_update(wl, wlvif);
+}
+
+static inline int
+wlcore_hw_interrupt_notify(struct wl1271 *wl, bool action)
+{
+        if (wl->ops->interrupt_notify)
+                return wl->ops->interrupt_notify(wl, action);
+        return 0;
+}
+
+static inline int
+wlcore_hw_rx_ba_filter(struct wl1271 *wl, bool action)
+{
+        if (wl->ops->rx_ba_filter)
+                return wl->ops->rx_ba_filter(wl, action);
+        return 0;
+}
+
+static inline int
+wlcore_hw_ap_sleep(struct wl1271 *wl)
+{
+        if (wl->ops->ap_sleep)
+                return wl->ops->ap_sleep(wl);
+
+        return 0;
 }
 
 static inline int
@@ -287,4 +311,22 @@ wlcore_smart_config_set_group_key(struct wl1271 *wl, u16 group_id,
 
         return wl->ops->smart_config_set_group_key(wl, group_id, key_len, key);
 }
+
+static inline int
+wlcore_hw_set_cac(struct wl1271 *wl, struct wl12xx_vif *wlvif, bool start)
+{
+        if (!wl->ops->set_cac)
+                return -EINVAL;
+
+        return wl->ops->set_cac(wl, wlvif, start);
+}
+
+static inline int
+wlcore_hw_dfs_master_restart(struct wl1271 *wl, struct wl12xx_vif *wlvif)
+{
+        if (!wl->ops->dfs_master_restart)
+                return -EINVAL;
+
+        return wl->ops->dfs_master_restart(wl, wlvif);
+}
 #endif
diff --git a/drivers/net/wireless/ti/wlcore/init.c b/drivers/net/wireless/ti/wlcore/init.c
index 199e94120864..5ca1fb161a50 100644
--- a/drivers/net/wireless/ti/wlcore/init.c
+++ b/drivers/net/wireless/ti/wlcore/init.c
@@ -392,6 +392,11 @@ static int wl1271_ap_hw_init(struct wl1271 *wl, struct wl12xx_vif *wlvif)
         if (ret < 0)
                 return ret;
 
+        /* configure AP sleep, if enabled */
+        ret = wlcore_hw_ap_sleep(wl);
+        if (ret < 0)
+                return ret;
+
         return 0;
 }
 
@@ -567,8 +572,7 @@ int wl1271_init_vif_specific(struct wl1271 *wl, struct ieee80211_vif *vif)
         /* consider all existing roles before configuring psm. */
 
         if (wl->ap_count == 0 && is_ap) { /* first AP */
-                /* Configure for power always on */
-                ret = wl1271_acx_sleep_auth(wl, WL1271_PSM_CAM);
+                ret = wl1271_acx_sleep_auth(wl, WL1271_PSM_ELP);
                 if (ret < 0)
                         return ret;
 
diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
index 6ad3fcedab9b..1e136993580f 100644
--- a/drivers/net/wireless/ti/wlcore/main.c
+++ b/drivers/net/wireless/ti/wlcore/main.c
@@ -79,22 +79,12 @@ static int wl12xx_set_authorized(struct wl1271 *wl, struct wl12xx_vif *wlvif)
 static void wl1271_reg_notify(struct wiphy *wiphy,
                               struct regulatory_request *request)
 {
-        struct ieee80211_supported_band *band;
-        struct ieee80211_channel *ch;
-        int i;
         struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
         struct wl1271 *wl = hw->priv;
 
-        band = wiphy->bands[IEEE80211_BAND_5GHZ];
-        for (i = 0; i < band->n_channels; i++) {
-                ch = &band->channels[i];
-                if (ch->flags & IEEE80211_CHAN_DISABLED)
-                        continue;
-
-                if (ch->flags & IEEE80211_CHAN_RADAR)
-                        ch->flags |= IEEE80211_CHAN_NO_IR;
-
-        }
+        /* copy the current dfs region */
+        if (request)
+                wl->dfs_region = request->dfs_region;
 
         wlcore_regdomain_config(wl);
 }
@@ -226,6 +216,29 @@ void wl12xx_rearm_tx_watchdog_locked(struct wl1271 *wl)
                 msecs_to_jiffies(wl->conf.tx.tx_watchdog_timeout));
 }
 
+static void wlcore_rc_update_work(struct work_struct *work)
+{
+        int ret;
+        struct wl12xx_vif *wlvif = container_of(work, struct wl12xx_vif,
+                                                rc_update_work);
+        struct wl1271 *wl = wlvif->wl;
+
+        mutex_lock(&wl->mutex);
+
+        if (unlikely(wl->state != WLCORE_STATE_ON))
+                goto out;
+
+        ret = wl1271_ps_elp_wakeup(wl);
+        if (ret < 0)
+                goto out;
+
+        wlcore_hw_sta_rc_update(wl, wlvif);
+
+        wl1271_ps_elp_sleep(wl);
+out:
+        mutex_unlock(&wl->mutex);
+}
+
 static void wl12xx_tx_watchdog_work(struct work_struct *work)
 {
         struct delayed_work *dwork;
@@ -1662,19 +1675,15 @@ static int wl1271_configure_suspend_sta(struct wl1271 *wl,
         if (!test_bit(WLVIF_FLAG_STA_ASSOCIATED, &wlvif->flags))
                 goto out;
 
-        ret = wl1271_ps_elp_wakeup(wl);
-        if (ret < 0)
-                goto out;
-
         ret = wl1271_configure_wowlan(wl, wow);
         if (ret < 0)
-                goto out_sleep;
+                goto out;
 
         if ((wl->conf.conn.suspend_wake_up_event ==
              wl->conf.conn.wake_up_event) &&
             (wl->conf.conn.suspend_listen_interval ==
              wl->conf.conn.listen_interval))
-                goto out_sleep;
+                goto out;
 
         ret = wl1271_acx_wake_up_conditions(wl, wlvif,
                                     wl->conf.conn.suspend_wake_up_event,
@@ -1682,29 +1691,28 @@ static int wl1271_configure_suspend_sta(struct wl1271 *wl,
 
         if (ret < 0)
                 wl1271_error("suspend: set wake up conditions failed: %d", ret);
-
-out_sleep:
-        wl1271_ps_elp_sleep(wl);
 out:
         return ret;
 
 }
 
 static int wl1271_configure_suspend_ap(struct wl1271 *wl,
-                                       struct wl12xx_vif *wlvif)
+                                        struct wl12xx_vif *wlvif,
+                                        struct cfg80211_wowlan *wow)
 {
         int ret = 0;
 
         if (!test_bit(WLVIF_FLAG_AP_STARTED, &wlvif->flags))
                 goto out;
 
-        ret = wl1271_ps_elp_wakeup(wl);
+        ret = wl1271_acx_beacon_filter_opt(wl, wlvif, true);
         if (ret < 0)
                 goto out;
 
-        ret = wl1271_acx_beacon_filter_opt(wl, wlvif, true);
+        ret = wl1271_configure_wowlan(wl, wow);
+        if (ret < 0)
+                goto out;
 
-        wl1271_ps_elp_sleep(wl);
 out:
         return ret;
 
@@ -1717,7 +1725,7 @@ static int wl1271_configure_suspend(struct wl1271 *wl,
         if (wlvif->bss_type == BSS_TYPE_STA_BSS)
                 return wl1271_configure_suspend_sta(wl, wlvif, wow);
         if (wlvif->bss_type == BSS_TYPE_AP_BSS)
-                return wl1271_configure_suspend_ap(wl, wlvif);
+                return wl1271_configure_suspend_ap(wl, wlvif, wow);
         return 0;
 }
 
@@ -1730,21 +1738,18 @@ static void wl1271_configure_resume(struct wl1271 *wl, struct wl12xx_vif *wlvif)
         if ((!is_ap) && (!is_sta))
                 return;
 
-        if (is_sta && !test_bit(WLVIF_FLAG_STA_ASSOCIATED, &wlvif->flags))
+        if ((is_sta && !test_bit(WLVIF_FLAG_STA_ASSOCIATED, &wlvif->flags)) ||
+            (is_ap && !test_bit(WLVIF_FLAG_AP_STARTED, &wlvif->flags)))
                 return;
 
-        ret = wl1271_ps_elp_wakeup(wl);
-        if (ret < 0)
-                return;
+        wl1271_configure_wowlan(wl, NULL);
 
         if (is_sta) {
-                wl1271_configure_wowlan(wl, NULL);
-
                 if ((wl->conf.conn.suspend_wake_up_event ==
                      wl->conf.conn.wake_up_event) &&
                     (wl->conf.conn.suspend_listen_interval ==
                      wl->conf.conn.listen_interval))
-                        goto out_sleep;
+                        return;
 
                 ret = wl1271_acx_wake_up_conditions(wl, wlvif,
                                     wl->conf.conn.wake_up_event,
@@ -1757,9 +1762,6 @@ static void wl1271_configure_resume(struct wl1271 *wl, struct wl12xx_vif *wlvif)
         } else if (is_ap) {
                 ret = wl1271_acx_beacon_filter_opt(wl, wlvif, false);
         }
-
-out_sleep:
-        wl1271_ps_elp_sleep(wl);
 }
 
 static int wl1271_op_suspend(struct ieee80211_hw *hw,
@@ -1781,6 +1783,13 @@ static int wl1271_op_suspend(struct ieee80211_hw *hw,
         wl1271_tx_flush(wl);
 
         mutex_lock(&wl->mutex);
+
+        ret = wl1271_ps_elp_wakeup(wl);
+        if (ret < 0) {
+                mutex_unlock(&wl->mutex);
+                return ret;
+        }
+
         wl->wow_enabled = true;
         wl12xx_for_each_wlvif(wl, wlvif) {
                 ret = wl1271_configure_suspend(wl, wlvif, wow);
@@ -1790,7 +1799,27 @@ static int wl1271_op_suspend(struct ieee80211_hw *hw,
                         return ret;
                 }
         }
+
+        /* disable fast link flow control notifications from FW */
+        ret = wlcore_hw_interrupt_notify(wl, false);
+        if (ret < 0)
+                goto out_sleep;
+
+        /* if filtering is enabled, configure the FW to drop all RX BA frames */
+        ret = wlcore_hw_rx_ba_filter(wl,
+                                     !!wl->conf.conn.suspend_rx_ba_activity);
+        if (ret < 0)
+                goto out_sleep;
+
+out_sleep:
+        wl1271_ps_elp_sleep(wl);
         mutex_unlock(&wl->mutex);
+
+        if (ret < 0) {
+                wl1271_warning("couldn't prepare device to suspend");
+                return ret;
+        }
+
         /* flush any remaining work */
         wl1271_debug(DEBUG_MAC80211, "flushing remaining works");
 
@@ -1864,13 +1893,29 @@ static int wl1271_op_resume(struct ieee80211_hw *hw)
         if (pending_recovery) {
                 wl1271_warning("queuing forgotten recovery on resume");
                 ieee80211_queue_work(wl->hw, &wl->recovery_work);
-                goto out;
+                goto out_sleep;
         }
 
+        ret = wl1271_ps_elp_wakeup(wl);
+        if (ret < 0)
+                goto out;
+
         wl12xx_for_each_wlvif(wl, wlvif) {
                 wl1271_configure_resume(wl, wlvif);
         }
 
+        ret = wlcore_hw_interrupt_notify(wl, true);
+        if (ret < 0)
+                goto out_sleep;
+
+        /* if filtering is enabled, configure the FW to drop all RX BA frames */
+        ret = wlcore_hw_rx_ba_filter(wl, false);
+        if (ret < 0)
+                goto out_sleep;
+
+out_sleep:
+        wl1271_ps_elp_sleep(wl);
+
 out:
         wl->wow_enabled = false;
 
@@ -2279,6 +2324,7 @@ static int wl12xx_init_vif_data(struct wl1271 *wl, struct ieee80211_vif *vif)
                   wl1271_rx_streaming_enable_work);
         INIT_WORK(&wlvif->rx_streaming_disable_work,
                   wl1271_rx_streaming_disable_work);
+        INIT_WORK(&wlvif->rc_update_work, wlcore_rc_update_work);
         INIT_DELAYED_WORK(&wlvif->channel_switch_work,
                           wlcore_channel_switch_work);
         INIT_DELAYED_WORK(&wlvif->connection_loss_work,
@@ -2508,6 +2554,7 @@ static int wl1271_op_add_interface(struct ieee80211_hw *hw,
         }
 
         vif->driver_flags |= IEEE80211_VIF_BEACON_FILTER |
+                             IEEE80211_VIF_SUPPORTS_UAPSD |
                              IEEE80211_VIF_SUPPORTS_CQM_RSSI;
 
         wl1271_debug(DEBUG_MAC80211, "mac80211 add interface type %d mac %pM",
@@ -2723,6 +2770,7 @@ unlock:
         del_timer_sync(&wlvif->rx_streaming_timer);
         cancel_work_sync(&wlvif->rx_streaming_enable_work);
         cancel_work_sync(&wlvif->rx_streaming_disable_work);
+        cancel_work_sync(&wlvif->rc_update_work);
         cancel_delayed_work_sync(&wlvif->connection_loss_work);
         cancel_delayed_work_sync(&wlvif->channel_switch_work);
         cancel_delayed_work_sync(&wlvif->pending_auth_complete_work);
@@ -4072,8 +4120,14 @@ static int wl1271_bss_beacon_info_changed(struct wl1271 *wl,
                 ret = wlcore_set_beacon_template(wl, vif, is_ap);
                 if (ret < 0)
                         goto out;
-        }
 
+                if (test_and_clear_bit(WLVIF_FLAG_BEACON_DISABLED,
+                                       &wlvif->flags)) {
+                        ret = wlcore_hw_dfs_master_restart(wl, wlvif);
+                        if (ret < 0)
+                                goto out;
+                }
+        }
 out:
         if (ret != 0)
                 wl1271_error("beacon info change failed: %d", ret);
@@ -4574,10 +4628,46 @@ static void wlcore_op_change_chanctx(struct ieee80211_hw *hw,
                                      struct ieee80211_chanctx_conf *ctx,
                                      u32 changed)
 {
+        struct wl1271 *wl = hw->priv;
+        struct wl12xx_vif *wlvif;
+        int ret;
+        int channel = ieee80211_frequency_to_channel(
+                ctx->def.chan->center_freq);
+
         wl1271_debug(DEBUG_MAC80211,
                      "mac80211 change chanctx %d (type %d) changed 0x%x",
-                     ieee80211_frequency_to_channel(ctx->def.chan->center_freq),
-                     cfg80211_get_chandef_type(&ctx->def), changed);
+                     channel, cfg80211_get_chandef_type(&ctx->def), changed);
+
+        mutex_lock(&wl->mutex);
+
+        ret = wl1271_ps_elp_wakeup(wl);
+        if (ret < 0)
+                goto out;
+
+        wl12xx_for_each_wlvif(wl, wlvif) {
+                struct ieee80211_vif *vif = wl12xx_wlvif_to_vif(wlvif);
+
+                rcu_read_lock();
+                if (rcu_access_pointer(vif->chanctx_conf) != ctx) {
+                        rcu_read_unlock();
+                        continue;
+                }
+                rcu_read_unlock();
+
+                /* start radar if needed */
+                if (changed & IEEE80211_CHANCTX_CHANGE_RADAR &&
+                    wlvif->bss_type == BSS_TYPE_AP_BSS &&
+                    ctx->radar_enabled && !wlvif->radar_enabled &&
+                    ctx->def.chan->dfs_state == NL80211_DFS_USABLE) {
+                        wl1271_debug(DEBUG_MAC80211, "Start radar detection");
+                        wlcore_hw_set_cac(wl, wlvif, true);
+                        wlvif->radar_enabled = true;
+                }
+        }
+
+        wl1271_ps_elp_sleep(wl);
+out:
+        mutex_unlock(&wl->mutex);
 }
 
 static int wlcore_op_assign_vif_chanctx(struct ieee80211_hw *hw,
@@ -4588,13 +4678,26 @@ static int wlcore_op_assign_vif_chanctx(struct ieee80211_hw *hw,
         struct wl12xx_vif *wlvif = wl12xx_vif_to_data(vif);
         int channel = ieee80211_frequency_to_channel(
                 ctx->def.chan->center_freq);
+        int ret = -EINVAL;
 
         wl1271_debug(DEBUG_MAC80211,
-                     "mac80211 assign chanctx (role %d) %d (type %d)",
-                     wlvif->role_id, channel, cfg80211_get_chandef_type(&ctx->def));
+                     "mac80211 assign chanctx (role %d) %d (type %d) (radar %d dfs_state %d)",
+                     wlvif->role_id, channel,
+                     cfg80211_get_chandef_type(&ctx->def),
+                     ctx->radar_enabled, ctx->def.chan->dfs_state);
 
         mutex_lock(&wl->mutex);
 
+        if (unlikely(wl->state != WLCORE_STATE_ON))
+                goto out;
+
+        if (unlikely(!test_bit(WLVIF_FLAG_INITIALIZED, &wlvif->flags)))
+                goto out;
+
+        ret = wl1271_ps_elp_wakeup(wl);
+        if (ret < 0)
+                goto out;
+
         wlvif->band = ctx->def.chan->band;
         wlvif->channel = channel;
         wlvif->channel_type = cfg80211_get_chandef_type(&ctx->def);
@@ -4602,6 +4705,15 @@ static int wlcore_op_assign_vif_chanctx(struct ieee80211_hw *hw,
         /* update default rates according to the band */
         wl1271_set_band_rate(wl, wlvif);
 
+        if (ctx->radar_enabled &&
+            ctx->def.chan->dfs_state == NL80211_DFS_USABLE) {
+                wl1271_debug(DEBUG_MAC80211, "Start radar detection");
+                wlcore_hw_set_cac(wl, wlvif, true);
+                wlvif->radar_enabled = true;
+        }
+
+        wl1271_ps_elp_sleep(wl);
+out:
         mutex_unlock(&wl->mutex);
 
         return 0;
@@ -4613,6 +4725,7 @@ static void wlcore_op_unassign_vif_chanctx(struct ieee80211_hw *hw,
 {
         struct wl1271 *wl = hw->priv;
         struct wl12xx_vif *wlvif = wl12xx_vif_to_data(vif);
+        int ret;
 
         wl1271_debug(DEBUG_MAC80211,
                      "mac80211 unassign chanctx (role %d) %d (type %d)",
@@ -4621,6 +4734,99 @@ static void wlcore_op_unassign_vif_chanctx(struct ieee80211_hw *hw,
                      cfg80211_get_chandef_type(&ctx->def));
 
         wl1271_tx_flush(wl);
+
+        mutex_lock(&wl->mutex);
+
+        if (unlikely(wl->state != WLCORE_STATE_ON))
+                goto out;
+
+        if (unlikely(!test_bit(WLVIF_FLAG_INITIALIZED, &wlvif->flags)))
+                goto out;
+
+        ret = wl1271_ps_elp_wakeup(wl);
+        if (ret < 0)
+                goto out;
+
+        if (wlvif->radar_enabled) {
+                wl1271_debug(DEBUG_MAC80211, "Stop radar detection");
+                wlcore_hw_set_cac(wl, wlvif, false);
+                wlvif->radar_enabled = false;
+        }
+
+        wl1271_ps_elp_sleep(wl);
+out:
+        mutex_unlock(&wl->mutex);
+}
+
+static int __wlcore_switch_vif_chan(struct wl1271 *wl,
+                                    struct wl12xx_vif *wlvif,
+                                    struct ieee80211_chanctx_conf *new_ctx)
+{
+        int channel = ieee80211_frequency_to_channel(
+                new_ctx->def.chan->center_freq);
+
+        wl1271_debug(DEBUG_MAC80211,
+                     "switch vif (role %d) %d -> %d chan_type: %d",
+                     wlvif->role_id, wlvif->channel, channel,
+                     cfg80211_get_chandef_type(&new_ctx->def));
+
+        if (WARN_ON_ONCE(wlvif->bss_type != BSS_TYPE_AP_BSS))
+                return 0;
+
+        WARN_ON(!test_bit(WLVIF_FLAG_BEACON_DISABLED, &wlvif->flags));
+
+        if (wlvif->radar_enabled) {
+                wl1271_debug(DEBUG_MAC80211, "Stop radar detection");
+                wlcore_hw_set_cac(wl, wlvif, false);
+                wlvif->radar_enabled = false;
+        }
+
+        wlvif->band = new_ctx->def.chan->band;
+        wlvif->channel = channel;
+        wlvif->channel_type = cfg80211_get_chandef_type(&new_ctx->def);
+
+        /* start radar if needed */
+        if (new_ctx->radar_enabled) {
+                wl1271_debug(DEBUG_MAC80211, "Start radar detection");
+                wlcore_hw_set_cac(wl, wlvif, true);
+                wlvif->radar_enabled = true;
+        }
+
+        return 0;
+}
+
+static int
+wlcore_op_switch_vif_chanctx(struct ieee80211_hw *hw,
+                             struct ieee80211_vif_chanctx_switch *vifs,
+                             int n_vifs,
+                             enum ieee80211_chanctx_switch_mode mode)
+{
+        struct wl1271 *wl = hw->priv;
+        int i, ret;
+
+        wl1271_debug(DEBUG_MAC80211,
+                     "mac80211 switch chanctx n_vifs %d mode %d",
+                     n_vifs, mode);
+
+        mutex_lock(&wl->mutex);
+
+        ret = wl1271_ps_elp_wakeup(wl);
+        if (ret < 0)
+                goto out;
+
+        for (i = 0; i < n_vifs; i++) {
+                struct wl12xx_vif *wlvif = wl12xx_vif_to_data(vifs[i].vif);
+
+                ret = __wlcore_switch_vif_chan(wl, wlvif, vifs[i].new_ctx);
+                if (ret)
+                        goto out_sleep;
+        }
+out_sleep:
+        wl1271_ps_elp_sleep(wl);
+out:
+        mutex_unlock(&wl->mutex);
+
+        return 0;
 }
 
 static int wl1271_op_conf_tx(struct ieee80211_hw *hw,
@@ -5228,6 +5434,83 @@ out:
         mutex_unlock(&wl->mutex);
 }
 
+static const void *wlcore_get_beacon_ie(struct wl1271 *wl,
+                                        struct wl12xx_vif *wlvif,
+                                        u8 eid)
+{
+        int ieoffset = offsetof(struct ieee80211_mgmt, u.beacon.variable);
+        struct sk_buff *beacon =
+                ieee80211_beacon_get(wl->hw, wl12xx_wlvif_to_vif(wlvif));
+
+        if (!beacon)
+                return NULL;
+
+        return cfg80211_find_ie(eid,
+                                beacon->data + ieoffset,
+                                beacon->len - ieoffset);
+}
+
+static int wlcore_get_csa_count(struct wl1271 *wl, struct wl12xx_vif *wlvif,
+                                u8 *csa_count)
+{
+        const u8 *ie;
+        const struct ieee80211_channel_sw_ie *ie_csa;
+
+        ie = wlcore_get_beacon_ie(wl, wlvif, WLAN_EID_CHANNEL_SWITCH);
+        if (!ie)
+                return -EINVAL;
+
+        ie_csa = (struct ieee80211_channel_sw_ie *)&ie[2];
+        *csa_count = ie_csa->count;
+
+        return 0;
+}
+
+static void wlcore_op_channel_switch_beacon(struct ieee80211_hw *hw,
+                                            struct ieee80211_vif *vif,
+                                            struct cfg80211_chan_def *chandef)
+{
+        struct wl1271 *wl = hw->priv;
+        struct wl12xx_vif *wlvif = wl12xx_vif_to_data(vif);
+        struct ieee80211_channel_switch ch_switch = {
+                .block_tx = true,
+                .chandef = *chandef,
+        };
+        int ret;
+
+        wl1271_debug(DEBUG_MAC80211,
+                     "mac80211 channel switch beacon (role %d)",
+                     wlvif->role_id);
+
+        ret = wlcore_get_csa_count(wl, wlvif, &ch_switch.count);
+        if (ret < 0) {
+                wl1271_error("error getting beacon (for CSA counter)");
+                return;
+        }
+
+        mutex_lock(&wl->mutex);
+
+        if (unlikely(wl->state != WLCORE_STATE_ON)) {
+                ret = -EBUSY;
+                goto out;
+        }
+
+        ret = wl1271_ps_elp_wakeup(wl);
+        if (ret < 0)
+                goto out;
+
+        ret = wl->ops->channel_switch(wl, wlvif, &ch_switch);
+        if (ret)
+                goto out_sleep;
+
+        set_bit(WLVIF_FLAG_CS_PROGRESS, &wlvif->flags);
+
+out_sleep:
+        wl1271_ps_elp_sleep(wl);
+out:
+        mutex_unlock(&wl->mutex);
+}
+
 static void wlcore_op_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                             u32 queues, bool drop)
 {
@@ -5370,19 +5653,26 @@ static void wlcore_op_sta_rc_update(struct ieee80211_hw *hw,
                                     u32 changed)
 {
         struct wl12xx_vif *wlvif = wl12xx_vif_to_data(vif);
-        struct wl1271 *wl = hw->priv;
 
-        wlcore_hw_sta_rc_update(wl, wlvif, sta, changed);
+        wl1271_debug(DEBUG_MAC80211, "mac80211 sta_rc_update");
+
+        if (!(changed & IEEE80211_RC_BW_CHANGED))
+                return;
+
+        /* this callback is atomic, so schedule a new work */
+        wlvif->rc_update_bw = sta->bandwidth;
+        ieee80211_queue_work(hw, &wlvif->rc_update_work);
 }
 
-static int wlcore_op_get_rssi(struct ieee80211_hw *hw,
-                               struct ieee80211_vif *vif,
-                               struct ieee80211_sta *sta,
-                               s8 *rssi_dbm)
+static void wlcore_op_sta_statistics(struct ieee80211_hw *hw,
+                                     struct ieee80211_vif *vif,
+                                     struct ieee80211_sta *sta,
+                                     struct station_info *sinfo)
 {
         struct wl1271 *wl = hw->priv;
         struct wl12xx_vif *wlvif = wl12xx_vif_to_data(vif);
-        int ret = 0;
+        s8 rssi_dbm;
+        int ret;
 
         wl1271_debug(DEBUG_MAC80211, "mac80211 get_rssi");
 
@@ -5395,17 +5685,18 @@ static int wlcore_op_get_rssi(struct ieee80211_hw *hw,
         if (ret < 0)
                 goto out_sleep;
 
-        ret = wlcore_acx_average_rssi(wl, wlvif, rssi_dbm);
+        ret = wlcore_acx_average_rssi(wl, wlvif, &rssi_dbm);
         if (ret < 0)
                 goto out_sleep;
 
+        sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
+        sinfo->signal = rssi_dbm;
+
 out_sleep:
         wl1271_ps_elp_sleep(wl);
 
 out:
         mutex_unlock(&wl->mutex);
-
-        return ret;
 }
 
 static bool wl1271_tx_frames_pending(struct ieee80211_hw *hw)
@@ -5596,6 +5887,7 @@ static const struct ieee80211_ops wl1271_ops = {
         .set_bitrate_mask = wl12xx_set_bitrate_mask,
         .set_default_unicast_key = wl1271_op_set_default_key_idx,
         .channel_switch = wl12xx_op_channel_switch,
+        .channel_switch_beacon = wlcore_op_channel_switch_beacon,
         .flush = wlcore_op_flush,
         .remain_on_channel = wlcore_op_remain_on_channel,
         .cancel_remain_on_channel = wlcore_op_cancel_remain_on_channel,
@@ -5604,8 +5896,9 @@ static const struct ieee80211_ops wl1271_ops = {
         .change_chanctx = wlcore_op_change_chanctx,
         .assign_vif_chanctx = wlcore_op_assign_vif_chanctx,
         .unassign_vif_chanctx = wlcore_op_unassign_vif_chanctx,
+        .switch_vif_chanctx = wlcore_op_switch_vif_chanctx,
         .sta_rc_update = wlcore_op_sta_rc_update,
-        .get_rssi = wlcore_op_get_rssi,
+        .sta_statistics = wlcore_op_sta_statistics,
         CFG80211_TESTMODE_CMD(wl1271_tm_cmd)
 };
 
@@ -5776,7 +6069,6 @@ static int wl1271_init_ieee80211(struct wl1271 *wl)
         wl->hw->flags = IEEE80211_HW_SIGNAL_DBM |
                 IEEE80211_HW_SUPPORTS_PS |
                 IEEE80211_HW_SUPPORTS_DYNAMIC_PS |
-                IEEE80211_HW_SUPPORTS_UAPSD |
                 IEEE80211_HW_HAS_RATE_CONTROL |
                 IEEE80211_HW_CONNECTION_MONITOR |
                 IEEE80211_HW_REPORTS_TX_ACK_STATUS |
@@ -5811,7 +6103,8 @@ static int wl1271_init_ieee80211(struct wl1271 *wl)
 
         wl->hw->wiphy->flags |= WIPHY_FLAG_AP_UAPSD |
                                 WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL |
-                                WIPHY_FLAG_SUPPORTS_SCHED_SCAN;
+                                WIPHY_FLAG_SUPPORTS_SCHED_SCAN |
+                                WIPHY_FLAG_HAS_CHANNEL_SWITCH;
 
         /* make sure all our channels fit in the scanned_ch bitmask */
         BUILD_BUG_ON(ARRAY_SIZE(wl1271_channels) +
diff --git a/drivers/net/wireless/ti/wlcore/ps.c b/drivers/net/wireless/ti/wlcore/ps.c
index b52516eed7b2..4cd316e61466 100644
--- a/drivers/net/wireless/ti/wlcore/ps.c
+++ b/drivers/net/wireless/ti/wlcore/ps.c
@@ -56,9 +56,6 @@ void wl1271_elp_work(struct work_struct *work)
                 goto out;
 
         wl12xx_for_each_wlvif(wl, wlvif) {
-                if (wlvif->bss_type == BSS_TYPE_AP_BSS)
-                        goto out;
-
                 if (!test_bit(WLVIF_FLAG_IN_PS, &wlvif->flags) &&
                     test_bit(WLVIF_FLAG_IN_USE, &wlvif->flags))
                         goto out;
@@ -95,9 +92,6 @@ void wl1271_ps_elp_sleep(struct wl1271 *wl)
                 return;
 
         wl12xx_for_each_wlvif(wl, wlvif) {
-                if (wlvif->bss_type == BSS_TYPE_AP_BSS)
-                        return;
-
                 if (!test_bit(WLVIF_FLAG_IN_PS, &wlvif->flags) &&
                     test_bit(WLVIF_FLAG_IN_USE, &wlvif->flags))
                         return;
@@ -108,6 +102,7 @@ void wl1271_ps_elp_sleep(struct wl1271 *wl)
         ieee80211_queue_delayed_work(wl->hw, &wl->elp_work,
                                      msecs_to_jiffies(timeout));
 }
+EXPORT_SYMBOL_GPL(wl1271_ps_elp_sleep);
 
 int wl1271_ps_elp_wakeup(struct wl1271 *wl)
 {
@@ -175,6 +170,7 @@ err:
 out:
         return 0;
 }
+EXPORT_SYMBOL_GPL(wl1271_ps_elp_wakeup);
 
 int wl1271_ps_set_mode(struct wl1271 *wl, struct wl12xx_vif *wlvif,
                        enum wl1271_cmd_ps_mode mode)
diff --git a/drivers/net/wireless/ti/wlcore/vendor_cmd.c b/drivers/net/wireless/ti/wlcore/vendor_cmd.c
index ad86a48dcfcb..fd4e9ba176c9 100644
--- a/drivers/net/wireless/ti/wlcore/vendor_cmd.c
+++ b/drivers/net/wireless/ti/wlcore/vendor_cmd.c
@@ -21,7 +21,7 @@ static const
 struct nla_policy wlcore_vendor_attr_policy[NUM_WLCORE_VENDOR_ATTR] = {
         [WLCORE_VENDOR_ATTR_FREQ]               = { .type = NLA_U32 },
         [WLCORE_VENDOR_ATTR_GROUP_ID]           = { .type = NLA_U32 },
-        [WLCORE_VENDOR_ATTR_GROUP_KEY]          = { .type = NLA_U32,
+        [WLCORE_VENDOR_ATTR_GROUP_KEY]          = { .type = NLA_BINARY,
                                                     .len = WLAN_MAX_KEY_LEN },
 };
 
diff --git a/drivers/net/wireless/ti/wlcore/wlcore.h b/drivers/net/wireless/ti/wlcore/wlcore.h
index df78cf12ef15..d599c869e6e8 100644
--- a/drivers/net/wireless/ti/wlcore/wlcore.h
+++ b/drivers/net/wireless/ti/wlcore/wlcore.h
@@ -106,8 +106,7 @@ struct wlcore_ops {
                               struct wl12xx_vif *wlvif,
                               struct ieee80211_channel_switch *ch_switch);
         u32 (*pre_pkt_send)(struct wl1271 *wl, u32 buf_offset, u32 last_len);
-        void (*sta_rc_update)(struct wl1271 *wl, struct wl12xx_vif *wlvif,
-                              struct ieee80211_sta *sta, u32 changed);
+        void (*sta_rc_update)(struct wl1271 *wl, struct wl12xx_vif *wlvif);
         int (*set_peer_cap)(struct wl1271 *wl,
                             struct ieee80211_sta_ht_cap *ht_cap,
                             bool allow_ht_operation,
@@ -117,10 +116,16 @@ struct wlcore_ops {
                               struct wl1271_link *lnk);
         bool (*lnk_low_prio)(struct wl1271 *wl, u8 hlid,
                              struct wl1271_link *lnk);
+        int (*interrupt_notify)(struct wl1271 *wl, bool action);
+        int (*rx_ba_filter)(struct wl1271 *wl, bool action);
+        int (*ap_sleep)(struct wl1271 *wl);
         int (*smart_config_start)(struct wl1271 *wl, u32 group_bitmap);
         int (*smart_config_stop)(struct wl1271 *wl);
         int (*smart_config_set_group_key)(struct wl1271 *wl, u16 group_id,
                                           u8 key_len, u8 *key);
+        int (*set_cac)(struct wl1271 *wl, struct wl12xx_vif *wlvif,
+                       bool start);
+        int (*dfs_master_restart)(struct wl1271 *wl, struct wl12xx_vif *wlvif);
 };
 
 enum wlcore_partitions {
@@ -460,6 +465,9 @@ struct wl1271 {
         /* HW HT (11n) capabilities */
         struct ieee80211_sta_ht_cap ht_cap[WLCORE_NUM_BANDS];
 
+        /* the current dfs region */
+        enum nl80211_dfs_regions dfs_region;
+
         /* size of the private FW status data */
         size_t fw_status_len;
         size_t fw_status_priv_len;
diff --git a/drivers/net/wireless/ti/wlcore/wlcore_i.h b/drivers/net/wireless/ti/wlcore/wlcore_i.h
index 0e52556044d9..3396ce5a934d 100644
--- a/drivers/net/wireless/ti/wlcore/wlcore_i.h
+++ b/drivers/net/wireless/ti/wlcore/wlcore_i.h
@@ -251,6 +251,7 @@ enum wl12xx_vif_flags {
         WLVIF_FLAG_AP_PROBE_RESP_SET,
         WLVIF_FLAG_IN_USE,
         WLVIF_FLAG_ACTIVE,
+        WLVIF_FLAG_BEACON_DISABLED,
 };
 
 struct wl12xx_vif;
@@ -434,6 +435,8 @@ struct wl12xx_vif {
 
         bool wmm_enabled;
 
+        bool radar_enabled;
+
         /* Rx Streaming */
         struct work_struct rx_streaming_enable_work;
         struct work_struct rx_streaming_disable_work;
@@ -463,6 +466,10 @@ struct wl12xx_vif {
         /* work for canceling ROC after pending auth reply */
         struct delayed_work pending_auth_complete_work;
 
+        /* update rate conrol */
+        enum ieee80211_sta_rx_bandwidth rc_update_bw;
+        struct work_struct rc_update_work;
+
         /*
          * total freed FW packets on the link.
          * For STA this holds the PN of the link to the AP.