OSDN Git Service

Merge Linux 4.4.203-rc2 into 10
[sagit-ice-cold/kernel_xiaomi_msm8998.git] / drivers / net / wireless / ath / ath10k / mac.c
index 7fbf2ab..fdddb8c 100644 (file)
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2005-2011 Atheros Communications Inc.
- * Copyright (c) 2011-2013 Qualcomm Atheros, Inc.
+ * Copyright (c) 2011-2013, 2017 Qualcomm Atheros, Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -62,6 +62,32 @@ static struct ieee80211_rate ath10k_rates[] = {
        { .bitrate = 540, .hw_value = ATH10K_HW_RATE_OFDM_54M },
 };
 
+static struct ieee80211_rate ath10k_rates_rev2[] = {
+       { .bitrate = 10,
+         .hw_value = ATH10K_HW_RATE_REV2_CCK_LP_1M },
+       { .bitrate = 20,
+         .hw_value = ATH10K_HW_RATE_REV2_CCK_LP_2M,
+         .hw_value_short = ATH10K_HW_RATE_REV2_CCK_SP_2M,
+         .flags = IEEE80211_RATE_SHORT_PREAMBLE },
+       { .bitrate = 55,
+         .hw_value = ATH10K_HW_RATE_REV2_CCK_LP_5_5M,
+         .hw_value_short = ATH10K_HW_RATE_REV2_CCK_SP_5_5M,
+         .flags = IEEE80211_RATE_SHORT_PREAMBLE },
+       { .bitrate = 110,
+         .hw_value = ATH10K_HW_RATE_REV2_CCK_LP_11M,
+         .hw_value_short = ATH10K_HW_RATE_REV2_CCK_SP_11M,
+         .flags = IEEE80211_RATE_SHORT_PREAMBLE },
+
+       { .bitrate = 60, .hw_value = ATH10K_HW_RATE_OFDM_6M },
+       { .bitrate = 90, .hw_value = ATH10K_HW_RATE_OFDM_9M },
+       { .bitrate = 120, .hw_value = ATH10K_HW_RATE_OFDM_12M },
+       { .bitrate = 180, .hw_value = ATH10K_HW_RATE_OFDM_18M },
+       { .bitrate = 240, .hw_value = ATH10K_HW_RATE_OFDM_24M },
+       { .bitrate = 360, .hw_value = ATH10K_HW_RATE_OFDM_36M },
+       { .bitrate = 480, .hw_value = ATH10K_HW_RATE_OFDM_48M },
+       { .bitrate = 540, .hw_value = ATH10K_HW_RATE_OFDM_54M },
+};
+
 #define ATH10K_MAC_FIRST_OFDM_RATE_IDX 4
 
 #define ath10k_a_rates (ath10k_rates + ATH10K_MAC_FIRST_OFDM_RATE_IDX)
@@ -70,6 +96,9 @@ static struct ieee80211_rate ath10k_rates[] = {
 #define ath10k_g_rates (ath10k_rates + 0)
 #define ath10k_g_rates_size (ARRAY_SIZE(ath10k_rates))
 
+#define ath10k_g_rates_rev2 (ath10k_rates_rev2 + 0)
+#define ath10k_g_rates_rev2_size (ARRAY_SIZE(ath10k_rates_rev2))
+
 static bool ath10k_mac_bitrate_is_cck(int bitrate)
 {
        switch (bitrate) {
@@ -90,7 +119,7 @@ static u8 ath10k_mac_bitrate_to_rate(int bitrate)
 }
 
 u8 ath10k_mac_hw_rate_to_idx(const struct ieee80211_supported_band *sband,
-                            u8 hw_rate)
+                            u8 hw_rate, bool cck)
 {
        const struct ieee80211_rate *rate;
        int i;
@@ -98,6 +127,9 @@ u8 ath10k_mac_hw_rate_to_idx(const struct ieee80211_supported_band *sband,
        for (i = 0; i < sband->n_bitrates; i++) {
                rate = &sband->bitrates[i];
 
+               if (ath10k_mac_bitrate_is_cck(rate->bitrate) != cck)
+                       continue;
+
                if (rate->hw_value == hw_rate)
                        return i;
                else if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE &&
@@ -154,6 +186,26 @@ ath10k_mac_max_vht_nss(const u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
        return 1;
 }
 
+int ath10k_mac_ext_resource_config(struct ath10k *ar, u32 val)
+{
+       enum wmi_host_platform_type platform_type;
+       int ret;
+
+       if (test_bit(WMI_SERVICE_TX_MODE_DYNAMIC, ar->wmi.svc_map))
+               platform_type = WMI_HOST_PLATFORM_LOW_PERF;
+       else
+               platform_type = WMI_HOST_PLATFORM_HIGH_PERF;
+
+       ret = ath10k_wmi_ext_resource_config(ar, platform_type, val);
+
+       if (ret && ret != -EOPNOTSUPP) {
+               ath10k_warn(ar, "failed to configure ext resource: %d\n", ret);
+               return ret;
+       }
+
+       return 0;
+}
+
 /**********/
 /* Crypto */
 /**********/
@@ -247,7 +299,8 @@ static int ath10k_install_peer_wep_keys(struct ath10k_vif *arvif,
        lockdep_assert_held(&ar->conf_mutex);
 
        if (WARN_ON(arvif->vif->type != NL80211_IFTYPE_AP &&
-                   arvif->vif->type != NL80211_IFTYPE_ADHOC))
+                   arvif->vif->type != NL80211_IFTYPE_ADHOC &&
+                   arvif->vif->type != NL80211_IFTYPE_MESH_POINT))
                return -EINVAL;
 
        spin_lock_bh(&ar->data_lock);
@@ -445,10 +498,10 @@ static int ath10k_mac_vif_update_wep_key(struct ath10k_vif *arvif,
        lockdep_assert_held(&ar->conf_mutex);
 
        list_for_each_entry(peer, &ar->peers, list) {
-               if (!memcmp(peer->addr, arvif->vif->addr, ETH_ALEN))
+               if (ether_addr_equal(peer->addr, arvif->vif->addr))
                        continue;
 
-               if (!memcmp(peer->addr, arvif->bssid, ETH_ALEN))
+               if (ether_addr_equal(peer->addr, arvif->bssid))
                        continue;
 
                if (peer->keys[key->keyidx] == key)
@@ -478,7 +531,7 @@ chan_to_phymode(const struct cfg80211_chan_def *chandef)
        enum wmi_phy_mode phymode = MODE_UNKNOWN;
 
        switch (chandef->chan->band) {
-       case IEEE80211_BAND_2GHZ:
+       case NL80211_BAND_2GHZ:
                switch (chandef->width) {
                case NL80211_CHAN_WIDTH_20_NOHT:
                        if (chandef->chan->flags & IEEE80211_CHAN_NO_OFDM)
@@ -501,7 +554,7 @@ chan_to_phymode(const struct cfg80211_chan_def *chandef)
                        break;
                }
                break;
-       case IEEE80211_BAND_5GHZ:
+       case NL80211_BAND_5GHZ:
                switch (chandef->width) {
                case NL80211_CHAN_WIDTH_20_NOHT:
                        phymode = MODE_11A;
@@ -614,10 +667,45 @@ ath10k_mac_get_any_chandef_iter(struct ieee80211_hw *hw,
        *def = &conf->def;
 }
 
-static int ath10k_peer_create(struct ath10k *ar, u32 vdev_id, const u8 *addr,
+static int ath10k_peer_delete(struct ath10k *ar, u32 vdev_id, const u8 *addr)
+{
+       int ret;
+       unsigned long time_left;
+
+       lockdep_assert_held(&ar->conf_mutex);
+
+       ret = ath10k_wmi_peer_delete(ar, vdev_id, addr);
+       if (ret)
+               return ret;
+
+       ret = ath10k_wait_for_peer_deleted(ar, vdev_id, addr);
+       if (ret)
+               return ret;
+
+       if (QCA_REV_WCN3990(ar)) {
+               time_left = wait_for_completion_timeout(&ar->peer_delete_done,
+                                                       50 * HZ);
+
+               if (time_left == 0) {
+                       ath10k_warn(ar, "Timeout in receiving peer delete response\n");
+                       return -ETIMEDOUT;
+               }
+       }
+
+       ar->num_peers--;
+
+       return 0;
+}
+
+static int ath10k_peer_create(struct ath10k *ar,
+                             struct ieee80211_vif *vif,
+                             struct ieee80211_sta *sta,
+                             u32 vdev_id,
+                             const u8 *addr,
                              enum wmi_peer_type peer_type)
 {
        struct ath10k_vif *arvif;
+       struct ath10k_peer *peer;
        int num_peers = 0;
        int ret;
 
@@ -646,6 +734,22 @@ static int ath10k_peer_create(struct ath10k *ar, u32 vdev_id, const u8 *addr,
                return ret;
        }
 
+       spin_lock_bh(&ar->data_lock);
+
+       peer = ath10k_peer_find(ar, vdev_id, addr);
+       if (!peer) {
+               spin_unlock_bh(&ar->data_lock);
+               ath10k_warn(ar, "failed to find peer %pM on vdev %i after creation\n",
+                           addr, vdev_id);
+               ath10k_peer_delete(ar, vdev_id, addr);
+               return -ENOENT;
+       }
+
+       peer->vif = vif;
+       peer->sta = sta;
+
+       spin_unlock_bh(&ar->data_lock);
+
        ar->num_peers++;
 
        return 0;
@@ -705,28 +809,11 @@ static int ath10k_mac_set_rts(struct ath10k_vif *arvif, u32 value)
        return ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param, value);
 }
 
-static int ath10k_peer_delete(struct ath10k *ar, u32 vdev_id, const u8 *addr)
-{
-       int ret;
-
-       lockdep_assert_held(&ar->conf_mutex);
-
-       ret = ath10k_wmi_peer_delete(ar, vdev_id, addr);
-       if (ret)
-               return ret;
-
-       ret = ath10k_wait_for_peer_deleted(ar, vdev_id, addr);
-       if (ret)
-               return ret;
-
-       ar->num_peers--;
-
-       return 0;
-}
-
 static void ath10k_peer_cleanup(struct ath10k *ar, u32 vdev_id)
 {
        struct ath10k_peer *peer, *tmp;
+       int peer_id;
+       int i;
 
        lockdep_assert_held(&ar->conf_mutex);
 
@@ -738,6 +825,22 @@ static void ath10k_peer_cleanup(struct ath10k *ar, u32 vdev_id)
                ath10k_warn(ar, "removing stale peer %pM from vdev_id %d\n",
                            peer->addr, vdev_id);
 
+               for_each_set_bit(peer_id, peer->peer_ids,
+                                ATH10K_MAX_NUM_PEER_IDS) {
+                       ar->peer_map[peer_id] = NULL;
+               }
+
+               /* Double check that peer is properly un-referenced from
+                * the peer_map
+                */
+               for (i = 0; i < ARRAY_SIZE(ar->peer_map); i++) {
+                       if (ar->peer_map[i] == peer) {
+                               ath10k_warn(ar, "removing stale peer_map entry for %pM (ptr %pK idx %d)\n",
+                                           peer->addr, peer, i);
+                               ar->peer_map[i] = NULL;
+                       }
+               }
+
                list_del(&peer->list);
                kfree(peer);
                ar->num_peers--;
@@ -748,6 +851,7 @@ static void ath10k_peer_cleanup(struct ath10k *ar, u32 vdev_id)
 static void ath10k_peer_cleanup_all(struct ath10k *ar)
 {
        struct ath10k_peer *peer, *tmp;
+       int i;
 
        lockdep_assert_held(&ar->conf_mutex);
 
@@ -756,6 +860,10 @@ static void ath10k_peer_cleanup_all(struct ath10k *ar)
                list_del(&peer->list);
                kfree(peer);
        }
+
+       for (i = 0; i < ARRAY_SIZE(ar->peer_map); i++)
+               ar->peer_map[i] = NULL;
+
        spin_unlock_bh(&ar->data_lock);
 
        ar->num_peers = 0;
@@ -886,6 +994,7 @@ static int ath10k_monitor_vdev_start(struct ath10k *ar, int vdev_id)
        arg.channel.max_antenna_gain = channel->max_antenna_gain * 2;
 
        reinit_completion(&ar->vdev_setup_done);
+       reinit_completion(&ar->vdev_delete_done);
 
        ret = ath10k_wmi_vdev_start(ar, &arg);
        if (ret) {
@@ -935,6 +1044,7 @@ static int ath10k_monitor_vdev_stop(struct ath10k *ar)
                            ar->monitor_vdev_id, ret);
 
        reinit_completion(&ar->vdev_setup_done);
+       reinit_completion(&ar->vdev_delete_done);
 
        ret = ath10k_wmi_vdev_stop(ar, ar->monitor_vdev_id);
        if (ret)
@@ -1271,6 +1381,7 @@ static int ath10k_vdev_stop(struct ath10k_vif *arvif)
        lockdep_assert_held(&ar->conf_mutex);
 
        reinit_completion(&ar->vdev_setup_done);
+       reinit_completion(&ar->vdev_delete_done);
 
        ret = ath10k_wmi_vdev_stop(ar, arvif->vdev_id);
        if (ret) {
@@ -1306,7 +1417,12 @@ static int ath10k_vdev_start_restart(struct ath10k_vif *arvif,
 
        lockdep_assert_held(&ar->conf_mutex);
 
+       /* Clear arp and ns offload cache */
+       memset(&arvif->arp_offload, 0, sizeof(arvif->arp_offload));
+       memset(&arvif->ns_offload, 0, sizeof(arvif->ns_offload));
+
        reinit_completion(&ar->vdev_setup_done);
+       reinit_completion(&ar->vdev_delete_done);
 
        arg.vdev_id = arvif->vdev_id;
        arg.dtim_period = arvif->dtim_period;
@@ -1384,10 +1500,7 @@ static int ath10k_mac_setup_bcn_p2p_ie(struct ath10k_vif *arvif,
        const u8 *p2p_ie;
        int ret;
 
-       if (arvif->vdev_type != WMI_VDEV_TYPE_AP)
-               return 0;
-
-       if (arvif->vdev_subtype != WMI_VDEV_SUBTYPE_P2P_GO)
+       if (arvif->vif->type != NL80211_IFTYPE_AP || !arvif->vif->p2p)
                return 0;
 
        mgmt = (void *)bcn->data;
@@ -1758,7 +1871,7 @@ static int ath10k_mac_vif_setup_ps(struct ath10k_vif *arvif)
 
        if (enable_ps && ath10k_mac_num_vifs_started(ar) > 1 &&
            !test_bit(ATH10K_FW_FEATURE_MULTI_VIF_PS_SUPPORT,
-                     ar->fw_features)) {
+                     ar->running_fw->fw_file.fw_features)) {
                ath10k_warn(ar, "refusing to enable ps on vdev %i: not supported by fw\n",
                            arvif->vdev_id);
                enable_ps = false;
@@ -1994,7 +2107,7 @@ static void ath10k_peer_assoc_h_basic(struct ath10k *ar,
        ether_addr_copy(arg->addr, sta->addr);
        arg->vdev_id = arvif->vdev_id;
        arg->peer_aid = aid;
-       arg->peer_flags |= WMI_PEER_AUTH;
+       arg->peer_flags |= arvif->ar->wmi.peer_flags->auth;
        arg->peer_listen_intval = ath10k_peer_assoc_h_listen_intval(ar, vif);
        arg->peer_num_spatial_streams = 1;
        arg->peer_caps = vif->bss_conf.assoc_capability;
@@ -2002,6 +2115,7 @@ static void ath10k_peer_assoc_h_basic(struct ath10k *ar,
 
 static void ath10k_peer_assoc_h_crypto(struct ath10k *ar,
                                       struct ieee80211_vif *vif,
+                                      struct ieee80211_sta *sta,
                                       struct wmi_peer_assoc_complete_arg *arg)
 {
        struct ieee80211_bss_conf *info = &vif->bss_conf;
@@ -2036,12 +2150,18 @@ static void ath10k_peer_assoc_h_crypto(struct ath10k *ar,
        /* FIXME: base on RSN IE/WPA IE is a correct idea? */
        if (rsnie || wpaie) {
                ath10k_dbg(ar, ATH10K_DBG_WMI, "%s: rsn ie found\n", __func__);
-               arg->peer_flags |= WMI_PEER_NEED_PTK_4_WAY;
+               arg->peer_flags |= ar->wmi.peer_flags->need_ptk_4_way;
        }
 
        if (wpaie) {
                ath10k_dbg(ar, ATH10K_DBG_WMI, "%s: wpa ie found\n", __func__);
-               arg->peer_flags |= WMI_PEER_NEED_GTK_2_WAY;
+               arg->peer_flags |= ar->wmi.peer_flags->need_gtk_2_way;
+       }
+
+       if (sta->mfp &&
+           test_bit(ATH10K_FW_FEATURE_MFP_SUPPORT,
+                    ar->running_fw->fw_file.fw_features)) {
+               arg->peer_flags |= ar->wmi.peer_flags->pmf;
        }
 }
 
@@ -2055,7 +2175,7 @@ static void ath10k_peer_assoc_h_rates(struct ath10k *ar,
        struct cfg80211_chan_def def;
        const struct ieee80211_supported_band *sband;
        const struct ieee80211_rate *rates;
-       enum ieee80211_band band;
+       enum nl80211_band band;
        u32 ratemask;
        u8 rate;
        int i;
@@ -2115,7 +2235,7 @@ static void ath10k_peer_assoc_h_ht(struct ath10k *ar,
        const struct ieee80211_sta_ht_cap *ht_cap = &sta->ht_cap;
        struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
        struct cfg80211_chan_def def;
-       enum ieee80211_band band;
+       enum nl80211_band band;
        const u8 *ht_mcs_mask;
        const u16 *vht_mcs_mask;
        int i, n;
@@ -2138,7 +2258,7 @@ static void ath10k_peer_assoc_h_ht(struct ath10k *ar,
            ath10k_peer_assoc_h_vht_masked(vht_mcs_mask))
                return;
 
-       arg->peer_flags |= WMI_PEER_HT;
+       arg->peer_flags |= ar->wmi.peer_flags->ht;
        arg->peer_max_mpdu = (1 << (IEEE80211_HT_MAX_AMPDU_FACTOR +
                                    ht_cap->ampdu_factor)) - 1;
 
@@ -2149,10 +2269,10 @@ static void ath10k_peer_assoc_h_ht(struct ath10k *ar,
        arg->peer_rate_caps |= WMI_RC_HT_FLAG;
 
        if (ht_cap->cap & IEEE80211_HT_CAP_LDPC_CODING)
-               arg->peer_flags |= WMI_PEER_LDPC;
+               arg->peer_flags |= ar->wmi.peer_flags->ldbc;
 
        if (sta->bandwidth >= IEEE80211_STA_RX_BW_40) {
-               arg->peer_flags |= WMI_PEER_40MHZ;
+               arg->peer_flags |= ar->wmi.peer_flags->bw40;
                arg->peer_rate_caps |= WMI_RC_CW40_FLAG;
        }
 
@@ -2166,7 +2286,7 @@ static void ath10k_peer_assoc_h_ht(struct ath10k *ar,
 
        if (ht_cap->cap & IEEE80211_HT_CAP_TX_STBC) {
                arg->peer_rate_caps |= WMI_RC_TX_STBC_FLAG;
-               arg->peer_flags |= WMI_PEER_STBC;
+               arg->peer_flags |= ar->wmi.peer_flags->stbc;
        }
 
        if (ht_cap->cap & IEEE80211_HT_CAP_RX_STBC) {
@@ -2174,7 +2294,7 @@ static void ath10k_peer_assoc_h_ht(struct ath10k *ar,
                stbc = stbc >> IEEE80211_HT_CAP_RX_STBC_SHIFT;
                stbc = stbc << WMI_RC_RX_STBC_FLAG_S;
                arg->peer_rate_caps |= stbc;
-               arg->peer_flags |= WMI_PEER_STBC;
+               arg->peer_flags |= ar->wmi.peer_flags->stbc;
        }
 
        if (ht_cap->mcs.rx_mask[1] && ht_cap->mcs.rx_mask[2])
@@ -2339,7 +2459,7 @@ static void ath10k_peer_assoc_h_vht(struct ath10k *ar,
        const struct ieee80211_sta_vht_cap *vht_cap = &sta->vht_cap;
        struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
        struct cfg80211_chan_def def;
-       enum ieee80211_band band;
+       enum nl80211_band band;
        const u16 *vht_mcs_mask;
        u8 ampdu_factor;
 
@@ -2355,10 +2475,10 @@ static void ath10k_peer_assoc_h_vht(struct ath10k *ar,
        if (ath10k_peer_assoc_h_vht_masked(vht_mcs_mask))
                return;
 
-       arg->peer_flags |= WMI_PEER_VHT;
+       arg->peer_flags |= ar->wmi.peer_flags->vht;
 
-       if (def.chan->band == IEEE80211_BAND_2GHZ)
-               arg->peer_flags |= WMI_PEER_VHT_2G;
+       if (def.chan->band == NL80211_BAND_2GHZ)
+               arg->peer_flags |= ar->wmi.peer_flags->vht_2g;
 
        arg->peer_vht_caps = vht_cap->cap;
 
@@ -2375,7 +2495,7 @@ static void ath10k_peer_assoc_h_vht(struct ath10k *ar,
                                        ampdu_factor)) - 1);
 
        if (sta->bandwidth == IEEE80211_STA_RX_BW_80)
-               arg->peer_flags |= WMI_PEER_80MHZ;
+               arg->peer_flags |= ar->wmi.peer_flags->bw80;
 
        arg->peer_vht_rates.rx_max_rate =
                __le16_to_cpu(vht_cap->vht_mcs.rx_highest);
@@ -2400,32 +2520,33 @@ static void ath10k_peer_assoc_h_qos(struct ath10k *ar,
        switch (arvif->vdev_type) {
        case WMI_VDEV_TYPE_AP:
                if (sta->wme)
-                       arg->peer_flags |= WMI_PEER_QOS;
+                       arg->peer_flags |= arvif->ar->wmi.peer_flags->qos;
 
                if (sta->wme && sta->uapsd_queues) {
-                       arg->peer_flags |= WMI_PEER_APSD;
+                       arg->peer_flags |= arvif->ar->wmi.peer_flags->apsd;
                        arg->peer_rate_caps |= WMI_RC_UAPSD_FLAG;
                }
                break;
        case WMI_VDEV_TYPE_STA:
                if (vif->bss_conf.qos)
-                       arg->peer_flags |= WMI_PEER_QOS;
+                       arg->peer_flags |= arvif->ar->wmi.peer_flags->qos;
                break;
        case WMI_VDEV_TYPE_IBSS:
                if (sta->wme)
-                       arg->peer_flags |= WMI_PEER_QOS;
+                       arg->peer_flags |= arvif->ar->wmi.peer_flags->qos;
                break;
        default:
                break;
        }
 
        ath10k_dbg(ar, ATH10K_DBG_MAC, "mac peer %pM qos %d\n",
-                  sta->addr, !!(arg->peer_flags & WMI_PEER_QOS));
+                  sta->addr, !!(arg->peer_flags &
+                  arvif->ar->wmi.peer_flags->qos));
 }
 
 static bool ath10k_mac_sta_has_ofdm_only(struct ieee80211_sta *sta)
 {
-       return sta->supp_rates[IEEE80211_BAND_2GHZ] >>
+       return sta->supp_rates[NL80211_BAND_2GHZ] >>
               ATH10K_MAC_FIRST_OFDM_RATE_IDX;
 }
 
@@ -2436,7 +2557,7 @@ static void ath10k_peer_assoc_h_phymode(struct ath10k *ar,
 {
        struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
        struct cfg80211_chan_def def;
-       enum ieee80211_band band;
+       enum nl80211_band band;
        const u8 *ht_mcs_mask;
        const u16 *vht_mcs_mask;
        enum wmi_phy_mode phymode = MODE_UNKNOWN;
@@ -2449,7 +2570,7 @@ static void ath10k_peer_assoc_h_phymode(struct ath10k *ar,
        vht_mcs_mask = arvif->bitrate_mask.control[band].vht_mcs;
 
        switch (band) {
-       case IEEE80211_BAND_2GHZ:
+       case NL80211_BAND_2GHZ:
                if (sta->vht_cap.vht_supported &&
                    !ath10k_peer_assoc_h_vht_masked(vht_mcs_mask)) {
                        if (sta->bandwidth == IEEE80211_STA_RX_BW_40)
@@ -2469,7 +2590,7 @@ static void ath10k_peer_assoc_h_phymode(struct ath10k *ar,
                }
 
                break;
-       case IEEE80211_BAND_5GHZ:
+       case NL80211_BAND_5GHZ:
                /*
                 * Check VHT first.
                 */
@@ -2513,7 +2634,7 @@ static int ath10k_peer_assoc_prepare(struct ath10k *ar,
        memset(arg, 0, sizeof(*arg));
 
        ath10k_peer_assoc_h_basic(ar, vif, sta, arg);
-       ath10k_peer_assoc_h_crypto(ar, vif, arg);
+       ath10k_peer_assoc_h_crypto(ar, vif, sta, arg);
        ath10k_peer_assoc_h_rates(ar, vif, sta, arg);
        ath10k_peer_assoc_h_ht(ar, vif, sta, arg);
        ath10k_peer_assoc_h_vht(ar, vif, sta, arg);
@@ -2725,16 +2846,18 @@ static void ath10k_bss_disassoc(struct ieee80211_hw *hw,
 
        ret = ath10k_wmi_vdev_down(ar, arvif->vdev_id);
        if (ret)
-               ath10k_warn(ar, "faield to down vdev %i: %d\n",
+               ath10k_warn(ar, "failed to down vdev %i: %d\n",
                            arvif->vdev_id, ret);
 
        arvif->def_wep_key_idx = -1;
 
-       ret = ath10k_mac_vif_recalc_txbf(ar, vif, vht_cap);
-       if (ret) {
-               ath10k_warn(ar, "failed to recalc txbf for vdev %i: %d\n",
-                           arvif->vdev_id, ret);
-               return;
+       if (!QCA_REV_WCN3990(ar)) {
+               ret = ath10k_mac_vif_recalc_txbf(ar, vif, vht_cap);
+               if (ret) {
+                       ath10k_warn(ar, "failed to recalc txbf for vdev %i: %d\n",
+                                   arvif->vdev_id, ret);
+                       return;
+               }
        }
 
        arvif->is_up = false;
@@ -2847,7 +2970,7 @@ static int ath10k_update_channel_list(struct ath10k *ar)
 {
        struct ieee80211_hw *hw = ar->hw;
        struct ieee80211_supported_band **bands;
-       enum ieee80211_band band;
+       enum nl80211_band band;
        struct ieee80211_channel *channel;
        struct wmi_scan_chan_list_arg arg = {0};
        struct wmi_channel_arg *ch;
@@ -2859,7 +2982,7 @@ static int ath10k_update_channel_list(struct ath10k *ar)
        lockdep_assert_held(&ar->conf_mutex);
 
        bands = hw->wiphy->bands;
-       for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+       for (band = 0; band < NUM_NL80211_BANDS; band++) {
                if (!bands[band])
                        continue;
 
@@ -2878,7 +3001,7 @@ static int ath10k_update_channel_list(struct ath10k *ar)
                return -ENOMEM;
 
        ch = arg.channels;
-       for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+       for (band = 0; band < NUM_NL80211_BANDS; band++) {
                if (!bands[band])
                        continue;
 
@@ -2888,7 +3011,7 @@ static int ath10k_update_channel_list(struct ath10k *ar)
                        if (channel->flags & IEEE80211_CHAN_DISABLED)
                                continue;
 
-                       ch->allow_ht   = true;
+                       ch->allow_ht = true;
 
                        /* FIXME: when should we really allow VHT? */
                        ch->allow_vht = true;
@@ -2923,7 +3046,7 @@ static int ath10k_update_channel_list(struct ath10k *ar)
                        /* FIXME: why use only legacy modes, why not any
                         * HT/VHT modes? Would that even make any
                         * difference? */
-                       if (channel->band == IEEE80211_BAND_2GHZ)
+                       if (channel->band == NL80211_BAND_2GHZ)
                                ch->mode = MODE_11G;
                        else
                                ch->mode = MODE_11A;
@@ -2978,7 +3101,7 @@ static void ath10k_regd_update(struct ath10k *ar)
 
        regpair = ar->ath_common.regulatory.regpair;
 
-       if (config_enabled(CONFIG_ATH10K_DFS_CERTIFIED) && ar->dfs_detector) {
+       if (IS_ENABLED(CONFIG_ATH10K_DFS_CERTIFIED) && ar->dfs_detector) {
                nl_dfs_reg = ar->dfs_detector->region;
                wmi_dfs_reg = ath10k_mac_get_dfs_region(nl_dfs_reg);
        } else {
@@ -3007,7 +3130,7 @@ static void ath10k_reg_notifier(struct wiphy *wiphy,
 
        ath_reg_notifier_apply(wiphy, request, &ar->ath_common.regulatory);
 
-       if (config_enabled(CONFIG_ATH10K_DFS_CERTIFIED) && ar->dfs_detector) {
+       if (IS_ENABLED(CONFIG_ATH10K_DFS_CERTIFIED) && ar->dfs_detector) {
                ath10k_dbg(ar, ATH10K_DBG_REGULATORY, "dfs region 0x%x\n",
                           request->dfs_region);
                result = ar->dfs_detector->set_dfs_domain(ar->dfs_detector,
@@ -3027,6 +3150,13 @@ static void ath10k_reg_notifier(struct wiphy *wiphy,
 /* TX handlers */
 /***************/
 
+enum ath10k_mac_tx_path {
+       ATH10K_MAC_TX_HTT,
+       ATH10K_MAC_TX_HTT_MGMT,
+       ATH10K_MAC_TX_WMI_MGMT,
+       ATH10K_MAC_TX_UNKNOWN,
+};
+
 void ath10k_mac_tx_lock(struct ath10k *ar, int reason)
 {
        lockdep_assert_held(&ar->htt.tx_lock);
@@ -3153,35 +3283,11 @@ void ath10k_mac_handle_tx_pause_vdev(struct ath10k *ar, u32 vdev_id,
        spin_unlock_bh(&ar->htt.tx_lock);
 }
 
-static u8 ath10k_tx_h_get_tid(struct ieee80211_hdr *hdr)
-{
-       if (ieee80211_is_mgmt(hdr->frame_control))
-               return HTT_DATA_TX_EXT_TID_MGMT;
-
-       if (!ieee80211_is_data_qos(hdr->frame_control))
-               return HTT_DATA_TX_EXT_TID_NON_QOS_MCAST_BCAST;
-
-       if (!is_unicast_ether_addr(ieee80211_get_DA(hdr)))
-               return HTT_DATA_TX_EXT_TID_NON_QOS_MCAST_BCAST;
-
-       return ieee80211_get_qos_ctl(hdr)[0] & IEEE80211_QOS_CTL_TID_MASK;
-}
-
-static u8 ath10k_tx_h_get_vdev_id(struct ath10k *ar, struct ieee80211_vif *vif)
-{
-       if (vif)
-               return ath10k_vif_to_arvif(vif)->vdev_id;
-
-       if (ar->monitor_started)
-               return ar->monitor_vdev_id;
-
-       ath10k_warn(ar, "failed to resolve vdev id\n");
-       return 0;
-}
-
 static enum ath10k_hw_txrx_mode
-ath10k_tx_h_get_txmode(struct ath10k *ar, struct ieee80211_vif *vif,
-                      struct ieee80211_sta *sta, struct sk_buff *skb)
+ath10k_mac_tx_h_get_txmode(struct ath10k *ar,
+                          struct ieee80211_vif *vif,
+                          struct ieee80211_sta *sta,
+                          struct sk_buff *skb)
 {
        const struct ieee80211_hdr *hdr = (void *)skb->data;
        __le16 fc = hdr->frame_control;
@@ -3210,7 +3316,10 @@ ath10k_tx_h_get_txmode(struct ath10k *ar, struct ieee80211_vif *vif,
         */
        if (ar->htt.target_version_major < 3 &&
            (ieee80211_is_nullfunc(fc) || ieee80211_is_qos_nullfunc(fc)) &&
-           !test_bit(ATH10K_FW_FEATURE_HAS_WMI_MGMT_TX, ar->fw_features))
+           !test_bit(ATH10K_FW_FEATURE_HAS_WMI_MGMT_TX,
+                     ar->running_fw->fw_file.fw_features) &&
+           !test_bit(ATH10K_FW_FEATURE_SKIP_NULL_FUNC_WAR,
+                     ar->running_fw->fw_file.fw_features))
                return ATH10K_HW_TXRX_MGMT;
 
        /* Workaround:
@@ -3231,14 +3340,22 @@ ath10k_tx_h_get_txmode(struct ath10k *ar, struct ieee80211_vif *vif,
 }
 
 static bool ath10k_tx_h_use_hwcrypto(struct ieee80211_vif *vif,
-                                    struct sk_buff *skb) {
-       struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+                                    struct sk_buff *skb)
+{
+       const struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+       const struct ieee80211_hdr *hdr = (void *)skb->data;
        const u32 mask = IEEE80211_TX_INTFL_DONT_ENCRYPT |
                         IEEE80211_TX_CTL_INJECTED;
+
+       if (!ieee80211_has_protected(hdr->frame_control))
+               return false;
+
        if ((info->flags & mask) == mask)
                return false;
+
        if (vif)
                return !ath10k_vif_to_arvif(vif)->nohwcrypt;
+
        return true;
 }
 
@@ -3265,7 +3382,7 @@ static void ath10k_tx_h_nwifi(struct ieee80211_hw *hw, struct sk_buff *skb)
         */
        hdr = (void *)skb->data;
        if (ieee80211_is_qos_nullfunc(hdr->frame_control))
-               cb->htt.tid = HTT_DATA_TX_EXT_TID_NON_QOS_MCAST_BCAST;
+               cb->flags &= ~ATH10K_SKB_F_QOS;
 
        hdr->frame_control &= ~__cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
 }
@@ -3305,8 +3422,7 @@ static void ath10k_tx_h_add_p2p_noa_ie(struct ath10k *ar,
        struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
 
        /* This is case only for P2P_GO */
-       if (arvif->vdev_type != WMI_VDEV_TYPE_AP ||
-           arvif->vdev_subtype != WMI_VDEV_SUBTYPE_P2P_GO)
+       if (vif->type != NL80211_IFTYPE_AP || !vif->p2p)
                return;
 
        if (unlikely(ieee80211_is_probe_resp(hdr->frame_control))) {
@@ -3321,7 +3437,29 @@ static void ath10k_tx_h_add_p2p_noa_ie(struct ath10k *ar,
        }
 }
 
-static bool ath10k_mac_need_offchan_tx_work(struct ath10k *ar)
+static void ath10k_mac_tx_h_fill_cb(struct ath10k *ar,
+                                   struct ieee80211_vif *vif,
+                                   struct ieee80211_txq *txq,
+                                   struct sk_buff *skb)
+{
+       struct ieee80211_hdr *hdr = (void *)skb->data;
+       struct ath10k_skb_cb *cb = ATH10K_SKB_CB(skb);
+
+       cb->flags = 0;
+       if (!ath10k_tx_h_use_hwcrypto(vif, skb))
+               cb->flags |= ATH10K_SKB_F_NO_HWCRYPT;
+
+       if (ieee80211_is_mgmt(hdr->frame_control))
+               cb->flags |= ATH10K_SKB_F_MGMT;
+
+       if (ieee80211_is_data_qos(hdr->frame_control))
+               cb->flags |= ATH10K_SKB_F_QOS;
+
+       cb->vif = vif;
+       cb->txq = txq;
+}
+
+bool ath10k_mac_tx_frm_has_freq(struct ath10k *ar)
 {
        /* FIXME: Not really sure since when the behaviour changed. At some
         * point new firmware stopped requiring creation of peer entries for
@@ -3329,8 +3467,9 @@ static bool ath10k_mac_need_offchan_tx_work(struct ath10k *ar)
         * tx credit replenishment and reliability). Assuming it's at least 3.4
         * because that's when the `freq` was introduced to TX_FRM HTT command.
         */
-       return !(ar->htt.target_version_major >= 3 &&
-                ar->htt.target_version_minor >= 4);
+       return (ar->htt.target_version_major >= 3 &&
+               ar->htt.target_version_minor >= 4 &&
+               ar->running_fw->fw_file.htt_op_version == ATH10K_FW_HTT_OP_VERSION_TLV);
 }
 
 static int ath10k_mac_tx_wmi_mgmt(struct ath10k *ar, struct sk_buff *skb)
@@ -3355,26 +3494,52 @@ unlock:
        return ret;
 }
 
-static void ath10k_mac_tx(struct ath10k *ar, struct sk_buff *skb)
+static enum ath10k_mac_tx_path
+ath10k_mac_tx_h_get_txpath(struct ath10k *ar,
+                          struct sk_buff *skb,
+                          enum ath10k_hw_txrx_mode txmode)
 {
-       struct ath10k_skb_cb *cb = ATH10K_SKB_CB(skb);
-       struct ath10k_htt *htt = &ar->htt;
-       int ret = 0;
-
-       switch (cb->txmode) {
+       switch (txmode) {
        case ATH10K_HW_TXRX_RAW:
        case ATH10K_HW_TXRX_NATIVE_WIFI:
        case ATH10K_HW_TXRX_ETHERNET:
-               ret = ath10k_htt_tx(htt, skb);
-               break;
+               return ATH10K_MAC_TX_HTT;
        case ATH10K_HW_TXRX_MGMT:
                if (test_bit(ATH10K_FW_FEATURE_HAS_WMI_MGMT_TX,
-                            ar->fw_features))
-                       ret = ath10k_mac_tx_wmi_mgmt(ar, skb);
+                            ar->running_fw->fw_file.fw_features) ||
+                            test_bit(WMI_SERVICE_MGMT_TX_WMI,
+                                     ar->wmi.svc_map))
+                       return ATH10K_MAC_TX_WMI_MGMT;
                else if (ar->htt.target_version_major >= 3)
-                       ret = ath10k_htt_tx(htt, skb);
+                       return ATH10K_MAC_TX_HTT;
                else
-                       ret = ath10k_htt_mgmt_tx(htt, skb);
+                       return ATH10K_MAC_TX_HTT_MGMT;
+       }
+
+       return ATH10K_MAC_TX_UNKNOWN;
+}
+
+static int ath10k_mac_tx_submit(struct ath10k *ar,
+                               enum ath10k_hw_txrx_mode txmode,
+                               enum ath10k_mac_tx_path txpath,
+                               struct sk_buff *skb)
+{
+       struct ath10k_htt *htt = &ar->htt;
+       int ret = -EINVAL;
+
+       switch (txpath) {
+       case ATH10K_MAC_TX_HTT:
+               ret = ath10k_htt_tx(htt, txmode, skb);
+               break;
+       case ATH10K_MAC_TX_HTT_MGMT:
+               ret = ath10k_htt_mgmt_tx(htt, skb);
+               break;
+       case ATH10K_MAC_TX_WMI_MGMT:
+               ret = ath10k_mac_tx_wmi_mgmt(ar, skb);
+               break;
+       case ATH10K_MAC_TX_UNKNOWN:
+               WARN_ON_ONCE(1);
+               ret = -EINVAL;
                break;
        }
 
@@ -3383,6 +3548,65 @@ static void ath10k_mac_tx(struct ath10k *ar, struct sk_buff *skb)
                            ret);
                ieee80211_free_txskb(ar->hw, skb);
        }
+
+       return ret;
+}
+
+/* This function consumes the sk_buff regardless of return value as far as
+ * caller is concerned so no freeing is necessary afterwards.
+ */
+static int ath10k_mac_tx(struct ath10k *ar,
+                        struct ieee80211_vif *vif,
+                        struct ieee80211_sta *sta,
+                        enum ath10k_hw_txrx_mode txmode,
+                        enum ath10k_mac_tx_path txpath,
+                        struct sk_buff *skb)
+{
+       struct ieee80211_hw *hw = ar->hw;
+       struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+       int ret;
+
+       skb_orphan(skb);
+       /* We should disable CCK RATE due to P2P */
+       if (info->flags & IEEE80211_TX_CTL_NO_CCK_RATE)
+               ath10k_dbg(ar, ATH10K_DBG_MAC, "IEEE80211_TX_CTL_NO_CCK_RATE\n");
+
+       switch (txmode) {
+       case ATH10K_HW_TXRX_MGMT:
+       case ATH10K_HW_TXRX_NATIVE_WIFI:
+               ath10k_tx_h_nwifi(hw, skb);
+               ath10k_tx_h_add_p2p_noa_ie(ar, vif, skb);
+               ath10k_tx_h_seq_no(vif, skb);
+               break;
+       case ATH10K_HW_TXRX_ETHERNET:
+               ath10k_tx_h_8023(skb);
+               break;
+       case ATH10K_HW_TXRX_RAW:
+               if (!test_bit(ATH10K_FLAG_RAW_MODE, &ar->dev_flags)) {
+                       WARN_ON_ONCE(1);
+                       ieee80211_free_txskb(hw, skb);
+                       return -ENOTSUPP;
+               }
+       }
+
+       if (info->flags & IEEE80211_TX_CTL_TX_OFFCHAN) {
+               if (!ath10k_mac_tx_frm_has_freq(ar)) {
+                       ath10k_dbg(ar, ATH10K_DBG_MAC, "queued offchannel skb %pK\n",
+                                  skb);
+
+                       skb_queue_tail(&ar->offchan_tx_queue, skb);
+                       ieee80211_queue_work(hw, &ar->offchan_tx_work);
+                       return 0;
+               }
+       }
+
+       ret = ath10k_mac_tx_submit(ar, txmode, txpath, skb);
+       if (ret) {
+               ath10k_warn(ar, "failed to submit frame: %d\n", ret);
+               return ret;
+       }
+
+       return 0;
 }
 
 void ath10k_offchan_tx_purge(struct ath10k *ar)
@@ -3402,7 +3626,12 @@ void ath10k_offchan_tx_work(struct work_struct *work)
 {
        struct ath10k *ar = container_of(work, struct ath10k, offchan_tx_work);
        struct ath10k_peer *peer;
+       struct ath10k_vif *arvif;
+       enum ath10k_hw_txrx_mode txmode;
+       enum ath10k_mac_tx_path txpath;
        struct ieee80211_hdr *hdr;
+       struct ieee80211_vif *vif;
+       struct ieee80211_sta *sta;
        struct sk_buff *skb;
        const u8 *peer_addr;
        int vdev_id;
@@ -3424,14 +3653,14 @@ void ath10k_offchan_tx_work(struct work_struct *work)
 
                mutex_lock(&ar->conf_mutex);
 
-               ath10k_dbg(ar, ATH10K_DBG_MAC, "mac offchannel skb %p\n",
+               ath10k_dbg(ar, ATH10K_DBG_MAC, "mac offchannel skb %pK\n",
                           skb);
 
                hdr = (struct ieee80211_hdr *)skb->data;
                peer_addr = ieee80211_get_DA(hdr);
-               vdev_id = ATH10K_SKB_CB(skb)->vdev_id;
 
                spin_lock_bh(&ar->data_lock);
+               vdev_id = ar->scan.vdev_id;
                peer = ath10k_peer_find(ar, vdev_id, peer_addr);
                spin_unlock_bh(&ar->data_lock);
 
@@ -3441,7 +3670,8 @@ void ath10k_offchan_tx_work(struct work_struct *work)
                                   peer_addr, vdev_id);
 
                if (!peer) {
-                       ret = ath10k_peer_create(ar, vdev_id, peer_addr,
+                       ret = ath10k_peer_create(ar, NULL, NULL, vdev_id,
+                                                peer_addr,
                                                 WMI_PEER_TYPE_DEFAULT);
                        if (ret)
                                ath10k_warn(ar, "failed to create peer %pM on vdev %d: %d\n",
@@ -3454,12 +3684,33 @@ void ath10k_offchan_tx_work(struct work_struct *work)
                ar->offchan_tx_skb = skb;
                spin_unlock_bh(&ar->data_lock);
 
-               ath10k_mac_tx(ar, skb);
+               /* It's safe to access vif and sta - conf_mutex guarantees that
+                * sta_state() and remove_interface() are locked exclusively
+                * out wrt to this offchannel worker.
+                */
+               arvif = ath10k_get_arvif(ar, vdev_id);
+               if (arvif) {
+                       vif = arvif->vif;
+                       sta = ieee80211_find_sta(vif, peer_addr);
+               } else {
+                       vif = NULL;
+                       sta = NULL;
+               }
+
+               txmode = ath10k_mac_tx_h_get_txmode(ar, vif, sta, skb);
+               txpath = ath10k_mac_tx_h_get_txpath(ar, skb, txmode);
+
+               ret = ath10k_mac_tx(ar, vif, sta, txmode, txpath, skb);
+               if (ret) {
+                       ath10k_warn(ar, "failed to transmit offchannel frame: %d\n",
+                                   ret);
+                       /* not serious */
+               }
 
                time_left =
                wait_for_completion_timeout(&ar->offchan_tx_completed, 3 * HZ);
                if (time_left == 0)
-                       ath10k_warn(ar, "timed out waiting for offchannel skb %p\n",
+                       ath10k_warn(ar, "timed out waiting for offchannel skb %pK\n",
                                    skb);
 
                if (!peer && tmp_peer_created) {
@@ -3490,6 +3741,7 @@ void ath10k_mgmt_over_wmi_tx_work(struct work_struct *work)
 {
        struct ath10k *ar = container_of(work, struct ath10k, wmi_mgmt_tx_work);
        struct sk_buff *skb;
+       dma_addr_t paddr;
        int ret;
 
        for (;;) {
@@ -3497,13 +3749,222 @@ void ath10k_mgmt_over_wmi_tx_work(struct work_struct *work)
                if (!skb)
                        break;
 
-               ret = ath10k_wmi_mgmt_tx(ar, skb);
+               if (QCA_REV_WCN3990(ar)) {
+                       paddr = dma_map_single(ar->dev, skb->data,
+                                              skb->len, DMA_TO_DEVICE);
+                       if (!paddr)
+                               continue;
+                       ret = ath10k_wmi_mgmt_tx_send(ar, skb, paddr);
+                       if (ret) {
+                               ath10k_warn(ar, "failed to transmit management frame by ref via WMI: %d\n",
+                                           ret);
+                               dma_unmap_single(ar->dev, paddr, skb->len,
+                                                DMA_FROM_DEVICE);
+                               ieee80211_free_txskb(ar->hw, skb);
+                       }
+               } else {
+                       ret = ath10k_wmi_mgmt_tx(ar, skb);
+                       if (ret) {
+                               ath10k_warn(ar, "failed to transmit management frame via WMI: %d\n",
+                                           ret);
+                               ieee80211_free_txskb(ar->hw, skb);
+                       }
+               }
+       }
+}
+
+static void ath10k_mac_txq_init(struct ieee80211_txq *txq)
+{
+       struct ath10k_txq *artxq;
+
+       if (!txq)
+               return;
+
+       artxq = (void *)txq->drv_priv;
+       INIT_LIST_HEAD(&artxq->list);
+}
+
+static void ath10k_mac_txq_unref(struct ath10k *ar, struct ieee80211_txq *txq)
+{
+       struct ath10k_txq *artxq;
+       struct ath10k_skb_cb *cb;
+       struct sk_buff *msdu;
+       int msdu_id;
+
+       if (!txq)
+               return;
+
+       artxq = (void *)txq->drv_priv;
+       spin_lock_bh(&ar->txqs_lock);
+       if (!list_empty(&artxq->list))
+               list_del_init(&artxq->list);
+       spin_unlock_bh(&ar->txqs_lock);
+
+       spin_lock_bh(&ar->htt.tx_lock);
+       idr_for_each_entry(&ar->htt.pending_tx, msdu, msdu_id) {
+               cb = ATH10K_SKB_CB(msdu);
+               if (cb->txq == txq)
+                       cb->txq = NULL;
+       }
+       spin_unlock_bh(&ar->htt.tx_lock);
+}
+
+struct ieee80211_txq *ath10k_mac_txq_lookup(struct ath10k *ar,
+                                           u16 peer_id,
+                                           u8 tid)
+{
+       struct ath10k_peer *peer;
+
+       lockdep_assert_held(&ar->data_lock);
+
+       peer = ar->peer_map[peer_id];
+       if (!peer)
+               return NULL;
+
+       if (peer->sta)
+               return peer->sta->txq[tid];
+       else if (peer->vif)
+               return peer->vif->txq;
+       else
+               return NULL;
+}
+
+static bool ath10k_mac_tx_can_push(struct ieee80211_hw *hw,
+                                  struct ieee80211_txq *txq)
+{
+       struct ath10k *ar = hw->priv;
+       struct ath10k_txq *artxq = (void *)txq->drv_priv;
+
+       /* No need to get locks */
+
+       if (ar->htt.tx_q_state.mode == HTT_TX_MODE_SWITCH_PUSH)
+               return true;
+
+       if (ar->htt.num_pending_tx < ar->htt.tx_q_state.num_push_allowed)
+               return true;
+
+       if (artxq->num_fw_queued < artxq->num_push_allowed)
+               return true;
+
+       return false;
+}
+
+int ath10k_mac_tx_push_txq(struct ieee80211_hw *hw,
+                          struct ieee80211_txq *txq)
+{
+       struct ath10k *ar = hw->priv;
+       struct ath10k_htt *htt = &ar->htt;
+       struct ath10k_txq *artxq = (void *)txq->drv_priv;
+       struct ieee80211_vif *vif = txq->vif;
+       struct ieee80211_sta *sta = txq->sta;
+       enum ath10k_hw_txrx_mode txmode;
+       enum ath10k_mac_tx_path txpath;
+       struct sk_buff *skb;
+       struct ieee80211_hdr *hdr;
+       size_t skb_len;
+       bool is_mgmt, is_presp;
+       int ret;
+
+       spin_lock_bh(&ar->htt.tx_lock);
+       ret = ath10k_htt_tx_inc_pending(htt);
+       spin_unlock_bh(&ar->htt.tx_lock);
+
+       if (ret)
+               return ret;
+
+       skb = ieee80211_tx_dequeue(hw, txq);
+       if (!skb) {
+               spin_lock_bh(&ar->htt.tx_lock);
+               ath10k_htt_tx_dec_pending(htt);
+               spin_unlock_bh(&ar->htt.tx_lock);
+
+               return -ENOENT;
+       }
+
+       ath10k_mac_tx_h_fill_cb(ar, vif, txq, skb);
+
+       skb_len = skb->len;
+       txmode = ath10k_mac_tx_h_get_txmode(ar, vif, sta, skb);
+       txpath = ath10k_mac_tx_h_get_txpath(ar, skb, txmode);
+       is_mgmt = (txpath == ATH10K_MAC_TX_HTT_MGMT);
+
+       if (is_mgmt) {
+               hdr = (struct ieee80211_hdr *)skb->data;
+               is_presp = ieee80211_is_probe_resp(hdr->frame_control);
+
+               spin_lock_bh(&ar->htt.tx_lock);
+               ret = ath10k_htt_tx_mgmt_inc_pending(htt, is_mgmt, is_presp);
+
                if (ret) {
-                       ath10k_warn(ar, "failed to transmit management frame via WMI: %d\n",
-                                   ret);
-                       ieee80211_free_txskb(ar->hw, skb);
+                       ath10k_htt_tx_dec_pending(htt);
+                       spin_unlock_bh(&ar->htt.tx_lock);
+                       return ret;
                }
+               spin_unlock_bh(&ar->htt.tx_lock);
        }
+
+       ret = ath10k_mac_tx(ar, vif, sta, txmode, txpath, skb);
+       if (unlikely(ret)) {
+               ath10k_warn(ar, "failed to push frame: %d\n", ret);
+
+               spin_lock_bh(&ar->htt.tx_lock);
+               ath10k_htt_tx_dec_pending(htt);
+               if (is_mgmt)
+                       ath10k_htt_tx_mgmt_dec_pending(htt);
+               spin_unlock_bh(&ar->htt.tx_lock);
+
+               return ret;
+       }
+
+       spin_lock_bh(&ar->htt.tx_lock);
+       artxq->num_fw_queued++;
+       spin_unlock_bh(&ar->htt.tx_lock);
+
+       return skb_len;
+}
+
+void ath10k_mac_tx_push_pending(struct ath10k *ar)
+{
+       struct ieee80211_hw *hw = ar->hw;
+       struct ieee80211_txq *txq;
+       struct ath10k_txq *artxq;
+       struct ath10k_txq *last;
+       int ret;
+       int max;
+
+       if (ar->htt.num_pending_tx >= (ar->htt.max_num_pending_tx / 2))
+               return;
+
+       spin_lock_bh(&ar->txqs_lock);
+       rcu_read_lock();
+
+       last = list_last_entry(&ar->txqs, struct ath10k_txq, list);
+       while (!list_empty(&ar->txqs)) {
+               artxq = list_first_entry(&ar->txqs, struct ath10k_txq, list);
+               txq = container_of((void *)artxq, struct ieee80211_txq,
+                                  drv_priv);
+
+               /* Prevent aggressive sta/tid taking over tx queue */
+               max = 16;
+               ret = 0;
+               while (ath10k_mac_tx_can_push(hw, txq) && max--) {
+                       ret = ath10k_mac_tx_push_txq(hw, txq);
+                       if (ret < 0)
+                               break;
+               }
+
+               list_del_init(&artxq->list);
+               if (ret != -ENOENT)
+                       list_add_tail(&artxq->list, &ar->txqs);
+
+               ath10k_htt_tx_txq_update(hw, txq);
+
+               if (artxq == last || (ret < 0 && ret != -ENOENT))
+                       break;
+       }
+
+       rcu_read_unlock();
+       spin_unlock_bh(&ar->txqs_lock);
 }
 
 /************/
@@ -3529,9 +3990,10 @@ void __ath10k_scan_finish(struct ath10k *ar)
        case ATH10K_SCAN_STARTING:
                ar->scan.state = ATH10K_SCAN_IDLE;
                ar->scan_channel = NULL;
+               ar->scan.roc_freq = 0;
                ath10k_offchan_tx_purge(ar);
                cancel_delayed_work(&ar->scan.timeout);
-               complete_all(&ar->scan.completed);
+               complete(&ar->scan.completed);
                break;
        }
 }
@@ -3560,7 +4022,7 @@ static int ath10k_scan_stop(struct ath10k *ar)
                goto out;
        }
 
-       ret = wait_for_completion_timeout(&ar->scan.completed, 3*HZ);
+       ret = wait_for_completion_timeout(&ar->scan.completed, 3 * HZ);
        if (ret == 0) {
                ath10k_warn(ar, "failed to receive scan abortion completion: timed out\n");
                ret = -ETIMEDOUT;
@@ -3640,7 +4102,7 @@ static int ath10k_start_scan(struct ath10k *ar,
        if (ret)
                return ret;
 
-       ret = wait_for_completion_timeout(&ar->scan.started, 1*HZ);
+       ret = wait_for_completion_timeout(&ar->scan.started, 1 * HZ);
        if (ret == 0) {
                ret = ath10k_scan_stop(ar);
                if (ret)
@@ -3667,67 +4129,100 @@ static int ath10k_start_scan(struct ath10k *ar,
 /* mac80211 callbacks */
 /**********************/
 
-static void ath10k_tx(struct ieee80211_hw *hw,
-                     struct ieee80211_tx_control *control,
-                     struct sk_buff *skb)
+static void ath10k_mac_op_tx(struct ieee80211_hw *hw,
+                            struct ieee80211_tx_control *control,
+                            struct sk_buff *skb)
 {
        struct ath10k *ar = hw->priv;
+       struct ath10k_htt *htt = &ar->htt;
        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
        struct ieee80211_vif *vif = info->control.vif;
        struct ieee80211_sta *sta = control->sta;
-       struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
-       __le16 fc = hdr->frame_control;
+       struct ieee80211_txq *txq = NULL;
+       struct ieee80211_hdr *hdr = (void *)skb->data;
+       enum ath10k_hw_txrx_mode txmode;
+       enum ath10k_mac_tx_path txpath;
+       bool is_htt;
+       bool is_mgmt;
+       bool is_presp;
+       int ret;
 
-       /* We should disable CCK RATE due to P2P */
-       if (info->flags & IEEE80211_TX_CTL_NO_CCK_RATE)
-               ath10k_dbg(ar, ATH10K_DBG_MAC, "IEEE80211_TX_CTL_NO_CCK_RATE\n");
+       ath10k_mac_tx_h_fill_cb(ar, vif, txq, skb);
 
-       ATH10K_SKB_CB(skb)->htt.is_offchan = false;
-       ATH10K_SKB_CB(skb)->htt.freq = 0;
-       ATH10K_SKB_CB(skb)->htt.tid = ath10k_tx_h_get_tid(hdr);
-       ATH10K_SKB_CB(skb)->htt.nohwcrypt = !ath10k_tx_h_use_hwcrypto(vif, skb);
-       ATH10K_SKB_CB(skb)->vdev_id = ath10k_tx_h_get_vdev_id(ar, vif);
-       ATH10K_SKB_CB(skb)->txmode = ath10k_tx_h_get_txmode(ar, vif, sta, skb);
-       ATH10K_SKB_CB(skb)->is_protected = ieee80211_has_protected(fc);
+       txmode = ath10k_mac_tx_h_get_txmode(ar, vif, sta, skb);
+       txpath = ath10k_mac_tx_h_get_txpath(ar, skb, txmode);
+       is_htt = (txpath == ATH10K_MAC_TX_HTT ||
+                 txpath == ATH10K_MAC_TX_HTT_MGMT);
+       is_mgmt = (txpath == ATH10K_MAC_TX_HTT_MGMT);
 
-       switch (ATH10K_SKB_CB(skb)->txmode) {
-       case ATH10K_HW_TXRX_MGMT:
-       case ATH10K_HW_TXRX_NATIVE_WIFI:
-               ath10k_tx_h_nwifi(hw, skb);
-               ath10k_tx_h_add_p2p_noa_ie(ar, vif, skb);
-               ath10k_tx_h_seq_no(vif, skb);
-               break;
-       case ATH10K_HW_TXRX_ETHERNET:
-               ath10k_tx_h_8023(skb);
-               break;
-       case ATH10K_HW_TXRX_RAW:
-               if (!test_bit(ATH10K_FLAG_RAW_MODE, &ar->dev_flags)) {
-                       WARN_ON_ONCE(1);
-                       ieee80211_free_txskb(hw, skb);
+       if (is_htt) {
+               spin_lock_bh(&ar->htt.tx_lock);
+               is_presp = ieee80211_is_probe_resp(hdr->frame_control);
+
+               ret = ath10k_htt_tx_inc_pending(htt);
+               if (ret) {
+                       ath10k_warn(ar, "failed to increase tx pending count: %d, dropping\n",
+                                   ret);
+                       spin_unlock_bh(&ar->htt.tx_lock);
+                       ieee80211_free_txskb(ar->hw, skb);
+                       return;
+               }
+
+               ret = ath10k_htt_tx_mgmt_inc_pending(htt, is_mgmt, is_presp);
+               if (ret) {
+                       ath10k_dbg(ar, ATH10K_DBG_MAC, "failed to increase tx mgmt pending count: %d, dropping\n",
+                                  ret);
+                       ath10k_htt_tx_dec_pending(htt);
+                       spin_unlock_bh(&ar->htt.tx_lock);
+                       ieee80211_free_txskb(ar->hw, skb);
                        return;
                }
+               spin_unlock_bh(&ar->htt.tx_lock);
        }
 
-       if (info->flags & IEEE80211_TX_CTL_TX_OFFCHAN) {
-               spin_lock_bh(&ar->data_lock);
-               ATH10K_SKB_CB(skb)->htt.freq = ar->scan.roc_freq;
-               ATH10K_SKB_CB(skb)->vdev_id = ar->scan.vdev_id;
-               spin_unlock_bh(&ar->data_lock);
+       ret = ath10k_mac_tx(ar, vif, sta, txmode, txpath, skb);
+       if (ret) {
+               ath10k_warn(ar, "failed to transmit frame: %d\n", ret);
+               if (is_htt) {
+                       spin_lock_bh(&ar->htt.tx_lock);
+                       ath10k_htt_tx_dec_pending(htt);
+                       if (is_mgmt)
+                               ath10k_htt_tx_mgmt_dec_pending(htt);
+                       spin_unlock_bh(&ar->htt.tx_lock);
+               }
+               return;
+       }
+}
+
+static void ath10k_mac_op_wake_tx_queue(struct ieee80211_hw *hw,
+                                       struct ieee80211_txq *txq)
+{
+       struct ath10k *ar = hw->priv;
+       struct ath10k_txq *artxq = (void *)txq->drv_priv;
+       struct ieee80211_txq *f_txq;
+       struct ath10k_txq *f_artxq;
+       int ret = 0;
+       int max = 16;
 
-               if (ath10k_mac_need_offchan_tx_work(ar)) {
-                       ATH10K_SKB_CB(skb)->htt.freq = 0;
-                       ATH10K_SKB_CB(skb)->htt.is_offchan = true;
+       spin_lock_bh(&ar->txqs_lock);
+       if (list_empty(&artxq->list))
+               list_add_tail(&artxq->list, &ar->txqs);
 
-                       ath10k_dbg(ar, ATH10K_DBG_MAC, "queued offchannel skb %p\n",
-                                  skb);
+       f_artxq = list_first_entry(&ar->txqs, struct ath10k_txq, list);
+       f_txq = container_of((void *)f_artxq, struct ieee80211_txq, drv_priv);
+       list_del_init(&f_artxq->list);
 
-                       skb_queue_tail(&ar->offchan_tx_queue, skb);
-                       ieee80211_queue_work(hw, &ar->offchan_tx_work);
-                       return;
-               }
+       while (ath10k_mac_tx_can_push(hw, f_txq) && max--) {
+               ret = ath10k_mac_tx_push_txq(hw, f_txq);
+               if (ret)
+                       break;
        }
+       if (ret != -ENOENT)
+               list_add_tail(&f_artxq->list, &ar->txqs);
+       spin_unlock_bh(&ar->txqs_lock);
 
-       ath10k_mac_tx(ar, skb);
+       ath10k_htt_tx_txq_update(hw, f_txq);
+       ath10k_htt_tx_txq_update(hw, txq);
 }
 
 /* Must not be called with conf_mutex held as workers can use that also. */
@@ -3867,6 +4362,9 @@ static struct ieee80211_sta_vht_cap ath10k_create_vht_cap(struct ath10k *ar)
                        mcs_map |= IEEE80211_VHT_MCS_NOT_SUPPORTED << (i * 2);
        }
 
+       if (ar->cfg_tx_chainmask <= 1)
+               vht_cap.cap &= ~IEEE80211_VHT_CAP_TXSTBC;
+
        vht_cap.vht_mcs.rx_mcs_map = cpu_to_le16(mcs_map);
        vht_cap.vht_mcs.tx_mcs_map = cpu_to_le16(mcs_map);
 
@@ -3886,7 +4384,8 @@ static struct ieee80211_sta_ht_cap ath10k_get_ht_cap(struct ath10k *ar)
        ht_cap.ampdu_density = IEEE80211_HT_MPDU_DENSITY_8;
        ht_cap.cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
        ht_cap.cap |= IEEE80211_HT_CAP_DSSSCCK40;
-       ht_cap.cap |= WLAN_HT_CAP_SM_PS_STATIC << IEEE80211_HT_CAP_SM_PS_SHIFT;
+       ht_cap.cap |=
+               WLAN_HT_CAP_SM_PS_DISABLED << IEEE80211_HT_CAP_SM_PS_SHIFT;
 
        if (ar->ht_cap_info & WMI_HT_CAP_HT20_SGI)
                ht_cap.cap |= IEEE80211_HT_CAP_SGI_20;
@@ -3903,7 +4402,7 @@ static struct ieee80211_sta_ht_cap ath10k_get_ht_cap(struct ath10k *ar)
                ht_cap.cap |= smps;
        }
 
-       if (ar->ht_cap_info & WMI_HT_CAP_TX_STBC)
+       if (ar->ht_cap_info & WMI_HT_CAP_TX_STBC && (ar->cfg_tx_chainmask > 1))
                ht_cap.cap |= IEEE80211_HT_CAP_TX_STBC;
 
        if (ar->ht_cap_info & WMI_HT_CAP_RX_STBC) {
@@ -3948,14 +4447,11 @@ static void ath10k_mac_setup_ht_vht_cap(struct ath10k *ar)
        vht_cap = ath10k_create_vht_cap(ar);
 
        if (ar->phy_capability & WHAL_WLAN_11G_CAPABILITY) {
-               band = &ar->mac.sbands[IEEE80211_BAND_2GHZ];
+               band = &ar->mac.sbands[NL80211_BAND_2GHZ];
                band->ht_cap = ht_cap;
-
-               /* Enable the VHT support at 2.4 GHz */
-               band->vht_cap = vht_cap;
        }
        if (ar->phy_capability & WHAL_WLAN_11A_CAPABILITY) {
-               band = &ar->mac.sbands[IEEE80211_BAND_5GHZ];
+               band = &ar->mac.sbands[NL80211_BAND_5GHZ];
                band->ht_cap = ht_cap;
                band->vht_cap = vht_cap;
        }
@@ -4013,12 +4509,12 @@ static int ath10k_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant)
 static int ath10k_start(struct ieee80211_hw *hw)
 {
        struct ath10k *ar = hw->priv;
-       u32 burst_enable;
+       u32 param;
        int ret = 0;
 
        /*
         * This makes sense only when restarting hw. It is harmless to call
-        * uncoditionally. This is necessary to make sure no HTT/WMI tx
+        * unconditionally. This is necessary to make sure no HTT/WMI tx
         * commands will be submitted while restarting.
         */
        ath10k_drain_tx(ar);
@@ -4030,7 +4526,8 @@ static int ath10k_start(struct ieee80211_hw *hw)
                ar->state = ATH10K_STATE_ON;
                break;
        case ATH10K_STATE_RESTARTING:
-               ath10k_halt(ar);
+               if (!test_bit(ATH10K_FLAG_CRASH_FLUSH, &ar->dev_flags))
+                       ath10k_halt(ar);
                ar->state = ATH10K_STATE_RESTARTED;
                break;
        case ATH10K_STATE_ON:
@@ -4050,24 +4547,34 @@ static int ath10k_start(struct ieee80211_hw *hw)
                goto err_off;
        }
 
-       ret = ath10k_core_start(ar, ATH10K_FIRMWARE_MODE_NORMAL);
+       ret = ath10k_core_start(ar, ATH10K_FIRMWARE_MODE_NORMAL,
+                               &ar->normal_mode_fw);
        if (ret) {
                ath10k_err(ar, "Could not init core: %d\n", ret);
                goto err_power_down;
        }
 
-       ret = ath10k_wmi_pdev_set_param(ar, ar->wmi.pdev_param->pmf_qos, 1);
+       param = ar->wmi.pdev_param->pmf_qos;
+       ret = ath10k_wmi_pdev_set_param(ar, param, 1);
        if (ret) {
                ath10k_warn(ar, "failed to enable PMF QOS: %d\n", ret);
                goto err_core_stop;
        }
 
-       ret = ath10k_wmi_pdev_set_param(ar, ar->wmi.pdev_param->dynamic_bw, 1);
+       param = ar->wmi.pdev_param->dynamic_bw;
+       ret = ath10k_wmi_pdev_set_param(ar, param, 1);
        if (ret) {
                ath10k_warn(ar, "failed to enable dynamic BW: %d\n", ret);
                goto err_core_stop;
        }
 
+       param = ar->wmi.pdev_param->idle_ps_config;
+       ret = ath10k_wmi_pdev_set_param(ar, param, 1);
+       if (ret) {
+               ath10k_warn(ar, "failed to enable idle_ps_config: %d\n", ret);
+               goto err_core_stop;
+       }
+
        if (test_bit(WMI_SERVICE_ADAPTIVE_OCS, ar->wmi.svc_map)) {
                ret = ath10k_wmi_adaptive_qcs(ar, true);
                if (ret) {
@@ -4078,8 +4585,8 @@ static int ath10k_start(struct ieee80211_hw *hw)
        }
 
        if (test_bit(WMI_SERVICE_BURST, ar->wmi.svc_map)) {
-               burst_enable = ar->wmi.pdev_param->burst_enable;
-               ret = ath10k_wmi_pdev_set_param(ar, burst_enable, 0);
+               param = ar->wmi.pdev_param->burst_enable;
+               ret = ath10k_wmi_pdev_set_param(ar, param, 0);
                if (ret) {
                        ath10k_warn(ar, "failed to disable burst: %d\n", ret);
                        goto err_core_stop;
@@ -4097,8 +4604,8 @@ static int ath10k_start(struct ieee80211_hw *hw)
         * this problem.
         */
 
-       ret = ath10k_wmi_pdev_set_param(ar,
-                                       ar->wmi.pdev_param->arp_ac_override, 0);
+       param = ar->wmi.pdev_param->arp_ac_override;
+       ret = ath10k_wmi_pdev_set_param(ar, param, 0);
        if (ret) {
                ath10k_warn(ar, "failed to set arp ac override parameter: %d\n",
                            ret);
@@ -4106,7 +4613,7 @@ static int ath10k_start(struct ieee80211_hw *hw)
        }
 
        if (test_bit(ATH10K_FW_FEATURE_SUPPORTS_ADAPTIVE_CCA,
-                    ar->fw_features)) {
+                    ar->running_fw->fw_file.fw_features)) {
                ret = ath10k_wmi_pdev_enable_adaptive_cca(ar, 1,
                                                          WMI_CCA_DETECT_LEVEL_AUTO,
                                                          WMI_CCA_DETECT_MARGIN_AUTO);
@@ -4115,10 +4622,11 @@ static int ath10k_start(struct ieee80211_hw *hw)
                                    ret);
                        goto err_core_stop;
                }
+               ar->sifs_burst_enabled = false;
        }
 
-       ret = ath10k_wmi_pdev_set_param(ar,
-                                       ar->wmi.pdev_param->ani_enable, 1);
+       param = ar->wmi.pdev_param->ani_enable;
+       ret = ath10k_wmi_pdev_set_param(ar, param, 1);
        if (ret) {
                ath10k_warn(ar, "failed to enable ani by default: %d\n",
                            ret);
@@ -4127,6 +4635,31 @@ static int ath10k_start(struct ieee80211_hw *hw)
 
        ar->ani_enabled = true;
 
+       if (ath10k_peer_stats_enabled(ar)) {
+               param = ar->wmi.pdev_param->peer_stats_update_period;
+               ret = ath10k_wmi_pdev_set_param(ar, param,
+                                               PEER_DEFAULT_STATS_UPDATE_PERIOD);
+               if (ret) {
+                       ath10k_warn(ar,
+                                   "failed to set peer stats period : %d\n",
+                                   ret);
+                       goto err_core_stop;
+               }
+       }
+
+       param = ar->wmi.pdev_param->enable_btcoex;
+       if (test_bit(WMI_SERVICE_COEX_GPIO, ar->wmi.svc_map) &&
+           test_bit(ATH10K_FW_FEATURE_BTCOEX_PARAM,
+                    ar->running_fw->fw_file.fw_features)) {
+               ret = ath10k_wmi_pdev_set_param(ar, param, 0);
+               if (ret) {
+                       ath10k_warn(ar,
+                                   "failed to set btcoex param: %d\n", ret);
+                       goto err_core_stop;
+               }
+               clear_bit(ATH10K_FLAG_BTCOEX, &ar->dev_flags);
+       }
+
        ar->num_started_vdevs = 0;
        ath10k_regd_update(ar);
 
@@ -4329,6 +4862,7 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
 {
        struct ath10k *ar = hw->priv;
        struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
+       struct ath10k_peer *peer;
        enum wmi_sta_powersave_param param;
        int ret = 0;
        u32 value;
@@ -4341,6 +4875,7 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
        mutex_lock(&ar->conf_mutex);
 
        memset(arvif, 0, sizeof(*arvif));
+       ath10k_mac_txq_init(vif->txq);
 
        arvif->ar = ar;
        arvif->vif = vif;
@@ -4375,24 +4910,30 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
                   bit, ar->free_vdev_map);
 
        arvif->vdev_id = bit;
-       arvif->vdev_subtype = WMI_VDEV_SUBTYPE_NONE;
+       arvif->vdev_subtype =
+               ath10k_wmi_get_vdev_subtype(ar, WMI_VDEV_SUBTYPE_NONE);
 
        switch (vif->type) {
        case NL80211_IFTYPE_P2P_DEVICE:
                arvif->vdev_type = WMI_VDEV_TYPE_STA;
-               arvif->vdev_subtype = WMI_VDEV_SUBTYPE_P2P_DEVICE;
+               arvif->vdev_subtype = ath10k_wmi_get_vdev_subtype
+                                       (ar, WMI_VDEV_SUBTYPE_P2P_DEVICE);
                break;
        case NL80211_IFTYPE_UNSPECIFIED:
        case NL80211_IFTYPE_STATION:
                arvif->vdev_type = WMI_VDEV_TYPE_STA;
                if (vif->p2p)
-                       arvif->vdev_subtype = WMI_VDEV_SUBTYPE_P2P_CLIENT;
+                       arvif->vdev_subtype = ath10k_wmi_get_vdev_subtype
+                                       (ar, WMI_VDEV_SUBTYPE_P2P_CLIENT);
                break;
        case NL80211_IFTYPE_ADHOC:
                arvif->vdev_type = WMI_VDEV_TYPE_IBSS;
                break;
        case NL80211_IFTYPE_MESH_POINT:
-               if (!test_bit(ATH10K_FLAG_RAW_MODE, &ar->dev_flags)) {
+               if (test_bit(WMI_SERVICE_MESH_11S, ar->wmi.svc_map)) {
+                       arvif->vdev_subtype = ath10k_wmi_get_vdev_subtype
+                                               (ar, WMI_VDEV_SUBTYPE_MESH_11S);
+               } else if (!test_bit(ATH10K_FLAG_RAW_MODE, &ar->dev_flags)) {
                        ret = -EINVAL;
                        ath10k_warn(ar, "must load driver with rawmode=1 to add mesh interfaces\n");
                        goto err;
@@ -4403,7 +4944,8 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
                arvif->vdev_type = WMI_VDEV_TYPE_AP;
 
                if (vif->p2p)
-                       arvif->vdev_subtype = WMI_VDEV_SUBTYPE_P2P_GO;
+                       arvif->vdev_subtype = ath10k_wmi_get_vdev_subtype
+                                               (ar, WMI_VDEV_SUBTYPE_P2P_GO);
                break;
        case NL80211_IFTYPE_MONITOR:
                arvif->vdev_type = WMI_VDEV_TYPE_MONITOR;
@@ -4473,6 +5015,15 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
                goto err;
        }
 
+       if ((arvif->vdev_type == WMI_VDEV_TYPE_STA) && QCA_REV_WCN3990(ar)) {
+               ret = ath10k_wmi_csa_offload(ar, arvif->vdev_id, true);
+               if (ret) {
+                       ath10k_err(ar, "CSA offload failed for vdev %i: %d\n",
+                                  arvif->vdev_id, ret);
+                       goto err_vdev_delete;
+               }
+       }
+
        ar->free_vdev_map &= ~(1LL << arvif->vdev_id);
        spin_lock_bh(&ar->data_lock);
        list_add(&arvif->list, &ar->arvifs);
@@ -4519,13 +5070,31 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
 
        if (arvif->vdev_type == WMI_VDEV_TYPE_AP ||
            arvif->vdev_type == WMI_VDEV_TYPE_IBSS) {
-               ret = ath10k_peer_create(ar, arvif->vdev_id, vif->addr,
-                                        WMI_PEER_TYPE_DEFAULT);
+               ret = ath10k_peer_create(ar, vif, NULL, arvif->vdev_id,
+                                        vif->addr, WMI_PEER_TYPE_DEFAULT);
                if (ret) {
                        ath10k_warn(ar, "failed to create vdev %i peer for AP/IBSS: %d\n",
                                    arvif->vdev_id, ret);
                        goto err_vdev_delete;
                }
+
+               spin_lock_bh(&ar->data_lock);
+
+               peer = ath10k_peer_find(ar, arvif->vdev_id, vif->addr);
+               if (!peer) {
+                       ath10k_warn(ar, "failed to lookup peer %pM on vdev %i\n",
+                                   vif->addr, arvif->vdev_id);
+                       spin_unlock_bh(&ar->data_lock);
+                       ret = -ENOENT;
+                       goto err_peer_delete;
+               }
+
+               arvif->peer_id = find_first_bit(peer->peer_ids,
+                                               ATH10K_MAX_NUM_PEER_IDS);
+
+               spin_unlock_bh(&ar->data_lock);
+       } else {
+               arvif->peer_id = HTT_INVALID_PEERID;
        }
 
        if (arvif->vdev_type == WMI_VDEV_TYPE_AP) {
@@ -4604,7 +5173,7 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
 err_peer_delete:
        if (arvif->vdev_type == WMI_VDEV_TYPE_AP ||
            arvif->vdev_type == WMI_VDEV_TYPE_IBSS)
-               ath10k_wmi_peer_delete(ar, arvif->vdev_id, vif->addr);
+               ath10k_peer_delete(ar, arvif->vdev_id, vif->addr);
 
 err_vdev_delete:
        ath10k_wmi_vdev_delete(ar, arvif->vdev_id);
@@ -4638,7 +5207,10 @@ static void ath10k_remove_interface(struct ieee80211_hw *hw,
 {
        struct ath10k *ar = hw->priv;
        struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
+       struct ath10k_peer *peer;
+       unsigned long time_left;
        int ret;
+       int i;
 
        cancel_work_sync(&arvif->ap_csa_work);
        cancel_delayed_work_sync(&arvif->connection_loss_work);
@@ -4661,8 +5233,8 @@ static void ath10k_remove_interface(struct ieee80211_hw *hw,
 
        if (arvif->vdev_type == WMI_VDEV_TYPE_AP ||
            arvif->vdev_type == WMI_VDEV_TYPE_IBSS) {
-               ret = ath10k_wmi_peer_delete(arvif->ar, arvif->vdev_id,
-                                            vif->addr);
+               ret = ath10k_peer_delete(arvif->ar, arvif->vdev_id,
+                                        vif->addr);
                if (ret)
                        ath10k_warn(ar, "failed to submit AP/IBSS self-peer removal on vdev %i: %d\n",
                                    arvif->vdev_id, ret);
@@ -4670,6 +5242,9 @@ static void ath10k_remove_interface(struct ieee80211_hw *hw,
                kfree(arvif->u.ap.noa_data);
        }
 
+       if ((arvif->vdev_type == WMI_VDEV_TYPE_STA) && QCA_REV_WCN3990(ar))
+               ath10k_wmi_csa_offload(ar, arvif->vdev_id, false);
+
        ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev %i delete (remove interface)\n",
                   arvif->vdev_id);
 
@@ -4678,6 +5253,16 @@ static void ath10k_remove_interface(struct ieee80211_hw *hw,
                ath10k_warn(ar, "failed to delete WMI vdev %i: %d\n",
                            arvif->vdev_id, ret);
 
+       if (QCA_REV_WCN3990(ar)) {
+               time_left = wait_for_completion_timeout(
+                                               &ar->vdev_delete_done,
+                                               ATH10K_VDEV_DELETE_TIMEOUT_HZ);
+               if (time_left == 0) {
+                       ath10k_warn(ar, "Timeout in receiving vdev delete resp\n");
+                       return;
+               }
+       }
+
        /* Some firmware revisions don't notify host about self-peer removal
         * until after associated vdev is deleted.
         */
@@ -4694,7 +5279,22 @@ static void ath10k_remove_interface(struct ieee80211_hw *hw,
                spin_unlock_bh(&ar->data_lock);
        }
 
+       spin_lock_bh(&ar->data_lock);
+       for (i = 0; i < ARRAY_SIZE(ar->peer_map); i++) {
+               peer = ar->peer_map[i];
+               if (!peer)
+                       continue;
+
+               if (peer->vif == vif) {
+                       ath10k_warn(ar, "found vif peer %pM entry on vdev %i after it was supposedly removed\n",
+                                   vif->addr, arvif->vdev_id);
+                       peer->vif = NULL;
+               }
+       }
+       spin_unlock_bh(&ar->data_lock);
+
        ath10k_peer_cleanup(ar, arvif->vdev_id);
+       ath10k_mac_txq_unref(ar, vif->txq);
 
        if (vif->type == NL80211_IFTYPE_MONITOR) {
                ar->monitor_arvif = NULL;
@@ -4703,13 +5303,39 @@ static void ath10k_remove_interface(struct ieee80211_hw *hw,
                        ath10k_warn(ar, "failed to recalc monitor: %d\n", ret);
        }
 
+       ret = ath10k_mac_txpower_recalc(ar);
+       if (ret)
+               ath10k_warn(ar, "failed to recalc tx power: %d\n", ret);
+
        spin_lock_bh(&ar->htt.tx_lock);
        ath10k_mac_vif_tx_unlock_all(arvif);
        spin_unlock_bh(&ar->htt.tx_lock);
 
+       ath10k_mac_txq_unref(ar, vif->txq);
+
        mutex_unlock(&ar->conf_mutex);
 }
 
+static int ath10k_change_interface(struct ieee80211_hw *hw,
+                                  struct ieee80211_vif *vif,
+                                  enum nl80211_iftype new_type, bool p2p)
+{
+       struct ath10k *ar = hw->priv;
+       int ret = 0;
+
+       ath10k_dbg(ar, ATH10K_DBG_MAC,
+                  "change_interface new: %d (%d), old: %d (%d)\n", new_type,
+                  p2p, vif->type, vif->p2p);
+
+       if (new_type != vif->type || vif->p2p != p2p) {
+               ath10k_remove_interface(hw, vif);
+               vif->type = new_type;
+               vif->p2p = p2p;
+               ret = ath10k_add_interface(hw, vif);
+       }
+       return ret;
+}
+
 /*
  * FIXME: Has to be verified.
  */
@@ -4738,7 +5364,7 @@ static void ath10k_configure_filter(struct ieee80211_hw *hw,
 
        ret = ath10k_monitor_recalc(ar);
        if (ret)
-               ath10k_warn(ar, "failed to recalc montior: %d\n", ret);
+               ath10k_warn(ar, "failed to recalc monitor: %d\n", ret);
 
        mutex_unlock(&ar->conf_mutex);
 }
@@ -4930,7 +5556,8 @@ static int ath10k_hw_scan(struct ieee80211_hw *hw,
        struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
        struct cfg80211_scan_request *req = &hw_req->req;
        struct wmi_start_scan_arg arg;
-       int ret = 0;
+       const u8 *ptr;
+       int ret = 0, ie_skip_len = 0;
        int i;
 
        mutex_lock(&ar->conf_mutex);
@@ -4962,8 +5589,16 @@ static int ath10k_hw_scan(struct ieee80211_hw *hw,
        arg.scan_id = ATH10K_SCAN_ID;
 
        if (req->ie_len) {
-               arg.ie_len = req->ie_len;
-               memcpy(arg.ie, req->ie, arg.ie_len);
+               if (QCA_REV_WCN3990(ar)) {
+                       ptr = req->ie;
+                       while (ptr[0] == WLAN_EID_SUPP_RATES ||
+                              ptr[0] == WLAN_EID_EXT_SUPP_RATES) {
+                               ie_skip_len = ptr[1] + 2;
+                               ptr += ie_skip_len;
+                       }
+               }
+               arg.ie_len = req->ie_len - ie_skip_len;
+               memcpy(arg.ie, req->ie + ie_skip_len, arg.ie_len);
        }
 
        if (req->n_ssids) {
@@ -4972,6 +5607,11 @@ static int ath10k_hw_scan(struct ieee80211_hw *hw,
                        arg.ssids[i].len  = req->ssids[i].ssid_len;
                        arg.ssids[i].ssid = req->ssids[i].ssid;
                }
+               if (QCA_REV_WCN3990(ar)) {
+                       arg.scan_ctrl_flags &=
+                                       ~(WMI_SCAN_ADD_BCAST_PROBE_REQ |
+                                         WMI_SCAN_CHAN_STAT_EVENT);
+               }
        } else {
                arg.scan_ctrl_flags |= WMI_SCAN_FLAG_PASSIVE;
        }
@@ -5054,6 +5694,22 @@ static void ath10k_set_key_h_def_keyidx(struct ath10k *ar,
                            arvif->vdev_id, ret);
 }
 
+static void ath10k_set_rekey_data(struct ieee80211_hw *hw,
+                                 struct ieee80211_vif *vif,
+                                 struct cfg80211_gtk_rekey_data *data)
+{
+       struct ath10k *ar = hw->priv;
+       struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
+
+       mutex_lock(&ar->conf_mutex);
+       memcpy(&arvif->gtk_rekey_data.kek, data->kek, NL80211_KEK_LEN);
+       memcpy(&arvif->gtk_rekey_data.kck, data->kck, NL80211_KCK_LEN);
+       arvif->gtk_rekey_data.replay_ctr =
+                       be64_to_cpup((__be64 *)data->replay_ctr);
+       arvif->gtk_rekey_data.valid = true;
+       mutex_unlock(&ar->conf_mutex);
+}
+
 static int ath10k_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                          struct ieee80211_vif *vif, struct ieee80211_sta *sta,
                          struct ieee80211_key_conf *key)
@@ -5234,7 +5890,7 @@ static void ath10k_sta_rc_update_wk(struct work_struct *wk)
        struct ath10k_sta *arsta;
        struct ieee80211_sta *sta;
        struct cfg80211_chan_def def;
-       enum ieee80211_band band;
+       enum nl80211_band band;
        const u8 *ht_mcs_mask;
        const u16 *vht_mcs_mask;
        u32 changed, bw, nss, smps;
@@ -5408,13 +6064,18 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
        struct ath10k *ar = hw->priv;
        struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
        struct ath10k_sta *arsta = (struct ath10k_sta *)sta->drv_priv;
+       struct ath10k_peer *peer;
        int ret = 0;
+       int i;
 
        if (old_state == IEEE80211_STA_NOTEXIST &&
            new_state == IEEE80211_STA_NONE) {
                memset(arsta, 0, sizeof(*arsta));
                arsta->arvif = arvif;
                INIT_WORK(&arsta->update_wk, ath10k_sta_rc_update_wk);
+
+               for (i = 0; i < ARRAY_SIZE(sta->txq); i++)
+                       ath10k_mac_txq_init(sta->txq[i]);
        }
 
        /* cancel must be done outside the mutex to avoid deadlock */
@@ -5422,6 +6083,9 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
             new_state == IEEE80211_STA_NOTEXIST))
                cancel_work_sync(&arsta->update_wk);
 
+       if (vif->type == NL80211_IFTYPE_STATION && new_state > ar->sta_state)
+               ar->sta_state = new_state;
+
        mutex_lock(&ar->conf_mutex);
 
        if (old_state == IEEE80211_STA_NOTEXIST &&
@@ -5449,8 +6113,8 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
                if (sta->tdls)
                        peer_type = WMI_PEER_TYPE_TDLS;
 
-               ret = ath10k_peer_create(ar, arvif->vdev_id, sta->addr,
-                                        peer_type);
+               ret = ath10k_peer_create(ar, vif, sta, arvif->vdev_id,
+                                        sta->addr, peer_type);
                if (ret) {
                        ath10k_warn(ar, "failed to add peer %pM for vdev %d when adding a new sta: %i\n",
                                    sta->addr, arvif->vdev_id, ret);
@@ -5458,6 +6122,24 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
                        goto exit;
                }
 
+               spin_lock_bh(&ar->data_lock);
+
+               peer = ath10k_peer_find(ar, arvif->vdev_id, sta->addr);
+               if (!peer) {
+                       ath10k_warn(ar, "failed to lookup peer %pM on vdev %i\n",
+                                   vif->addr, arvif->vdev_id);
+                       spin_unlock_bh(&ar->data_lock);
+                       ath10k_peer_delete(ar, arvif->vdev_id, sta->addr);
+                       ath10k_mac_dec_num_stations(arvif, sta);
+                       ret = -ENOENT;
+                       goto exit;
+               }
+
+               arsta->peer_id = find_first_bit(peer->peer_ids,
+                                               ATH10K_MAX_NUM_PEER_IDS);
+
+               spin_unlock_bh(&ar->data_lock);
+
                if (!sta->tdls)
                        goto exit;
 
@@ -5510,8 +6192,8 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
                 * Existing station deletion.
                 */
                ath10k_dbg(ar, ATH10K_DBG_MAC,
-                          "mac vdev %d peer delete %pM (sta gone)\n",
-                          arvif->vdev_id, sta->addr);
+                          "mac vdev %d peer delete %pM sta %pK (sta gone)\n",
+                          arvif->vdev_id, sta->addr, sta);
 
                if (sta->tdls) {
                        ret = ath10k_mac_tdls_peer_update(ar, arvif->vdev_id,
@@ -5530,6 +6212,31 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
 
                ath10k_mac_dec_num_stations(arvif, sta);
 
+               spin_lock_bh(&ar->data_lock);
+               for (i = 0; i < ARRAY_SIZE(ar->peer_map); i++) {
+                       peer = ar->peer_map[i];
+                       if (!peer)
+                               continue;
+
+                       if (peer->sta == sta) {
+                               ath10k_warn(ar, "found sta peer %pM (ptr %pK id %d) entry on vdev %i after it was supposedly removed\n",
+                                           sta->addr, peer, i, arvif->vdev_id);
+                               peer->sta = NULL;
+
+                               /* Clean up the peer object as well since we
+                                * must have failed to do this above.
+                                */
+                               list_del(&peer->list);
+                               ar->peer_map[i] = NULL;
+                               kfree(peer);
+                               ar->num_peers--;
+                       }
+               }
+               spin_unlock_bh(&ar->data_lock);
+
+               for (i = 0; i < ARRAY_SIZE(sta->txq); i++)
+                       ath10k_mac_txq_unref(ar, sta->txq[i]);
+
                if (!sta->tdls)
                        goto exit;
 
@@ -5776,7 +6483,7 @@ exit:
        return ret;
 }
 
-#define ATH10K_ROC_TIMEOUT_HZ (2*HZ)
+#define ATH10K_ROC_TIMEOUT_HZ (2 * HZ)
 
 static int ath10k_remain_on_channel(struct ieee80211_hw *hw,
                                    struct ieee80211_vif *vif,
@@ -5828,7 +6535,13 @@ static int ath10k_remain_on_channel(struct ieee80211_hw *hw,
        arg.dwell_time_passive = scan_time_msec;
        arg.max_scan_time = scan_time_msec;
        arg.scan_ctrl_flags |= WMI_SCAN_FLAG_PASSIVE;
-       arg.scan_ctrl_flags |= WMI_SCAN_FILTER_PROBE_REQ;
+       if (QCA_REV_WCN3990(ar)) {
+               arg.scan_ctrl_flags &= ~(WMI_SCAN_FILTER_PROBE_REQ |
+                                         WMI_SCAN_CHAN_STAT_EVENT |
+                                         WMI_SCAN_ADD_BCAST_PROBE_REQ);
+       } else {
+               arg.scan_ctrl_flags |= WMI_SCAN_FILTER_PROBE_REQ;
+       }
        arg.burst_duration_ms = duration;
 
        ret = ath10k_start_scan(ar, &arg);
@@ -5840,7 +6553,7 @@ static int ath10k_remain_on_channel(struct ieee80211_hw *hw,
                goto exit;
        }
 
-       ret = wait_for_completion_timeout(&ar->scan.on_channel, 3*HZ);
+       ret = wait_for_completion_timeout(&ar->scan.on_channel, 3 * HZ);
        if (ret == 0) {
                ath10k_warn(ar, "failed to switch to channel for roc scan\n");
 
@@ -5992,6 +6705,39 @@ static void ath10k_reconfig_complete(struct ieee80211_hw *hw,
        mutex_unlock(&ar->conf_mutex);
 }
 
+static void
+ath10k_mac_update_bss_chan_survey(struct ath10k *ar,
+                                 struct ieee80211_channel *channel)
+{
+       int ret;
+       enum wmi_bss_survey_req_type type = WMI_BSS_SURVEY_REQ_TYPE_READ_CLEAR;
+
+       lockdep_assert_held(&ar->conf_mutex);
+
+       if (!test_bit(WMI_SERVICE_BSS_CHANNEL_INFO_64, ar->wmi.svc_map) ||
+           (ar->rx_channel != channel))
+               return;
+
+       if (ar->scan.state != ATH10K_SCAN_IDLE) {
+               ath10k_dbg(ar, ATH10K_DBG_MAC, "ignoring bss chan info request while scanning..\n");
+               return;
+       }
+
+       reinit_completion(&ar->bss_survey_done);
+
+       ret = ath10k_wmi_pdev_bss_chan_info_request(ar, type);
+       if (ret) {
+               ath10k_warn(ar, "failed to send pdev bss chan info request\n");
+               return;
+       }
+
+       ret = wait_for_completion_timeout(&ar->bss_survey_done, 3 * HZ);
+       if (!ret) {
+               ath10k_warn(ar, "bss channel survey timed out\n");
+               return;
+       }
+}
+
 static int ath10k_get_survey(struct ieee80211_hw *hw, int idx,
                             struct survey_info *survey)
 {
@@ -6002,20 +6748,23 @@ static int ath10k_get_survey(struct ieee80211_hw *hw, int idx,
 
        mutex_lock(&ar->conf_mutex);
 
-       sband = hw->wiphy->bands[IEEE80211_BAND_2GHZ];
+       sband = hw->wiphy->bands[NL80211_BAND_2GHZ];
        if (sband && idx >= sband->n_channels) {
                idx -= sband->n_channels;
                sband = NULL;
        }
 
        if (!sband)
-               sband = hw->wiphy->bands[IEEE80211_BAND_5GHZ];
+               sband = hw->wiphy->bands[NL80211_BAND_5GHZ];
 
        if (!sband || idx >= sband->n_channels) {
                ret = -ENOENT;
                goto exit;
        }
 
+       if (!QCA_REV_WCN3990(ar))
+               ath10k_mac_update_bss_chan_survey(ar, &sband->channels[idx]);
+
        spin_lock_bh(&ar->data_lock);
        memcpy(survey, ar_survey, sizeof(*survey));
        spin_unlock_bh(&ar->data_lock);
@@ -6032,7 +6781,7 @@ exit:
 
 static bool
 ath10k_mac_bitrate_mask_has_single_rate(struct ath10k *ar,
-                                       enum ieee80211_band band,
+                                       enum nl80211_band band,
                                        const struct cfg80211_bitrate_mask *mask)
 {
        int num_rates = 0;
@@ -6051,7 +6800,7 @@ ath10k_mac_bitrate_mask_has_single_rate(struct ath10k *ar,
 
 static bool
 ath10k_mac_bitrate_mask_get_single_nss(struct ath10k *ar,
-                                      enum ieee80211_band band,
+                                      enum nl80211_band band,
                                       const struct cfg80211_bitrate_mask *mask,
                                       int *nss)
 {
@@ -6100,7 +6849,7 @@ ath10k_mac_bitrate_mask_get_single_nss(struct ath10k *ar,
 
 static int
 ath10k_mac_bitrate_mask_get_single_rate(struct ath10k *ar,
-                                       enum ieee80211_band band,
+                                       enum nl80211_band band,
                                        const struct cfg80211_bitrate_mask *mask,
                                        u8 *rate, u8 *nss)
 {
@@ -6201,7 +6950,7 @@ static int ath10k_mac_set_fixed_rate_params(struct ath10k_vif *arvif,
 
 static bool
 ath10k_mac_can_set_bitrate_mask(struct ath10k *ar,
-                               enum ieee80211_band band,
+                               enum nl80211_band band,
                                const struct cfg80211_bitrate_mask *mask)
 {
        int i;
@@ -6253,7 +7002,7 @@ static int ath10k_mac_op_set_bitrate_mask(struct ieee80211_hw *hw,
        struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
        struct cfg80211_chan_def def;
        struct ath10k *ar = arvif->ar;
-       enum ieee80211_band band;
+       enum nl80211_band band;
        const u8 *ht_mcs_mask;
        const u16 *vht_mcs_mask;
        u8 rate;
@@ -6414,6 +7163,32 @@ static u64 ath10k_get_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
        return 0;
 }
 
+static void ath10k_set_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                          u64 tsf)
+{
+       struct ath10k *ar = hw->priv;
+       struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
+       u32 tsf_offset, vdev_param = ar->wmi.vdev_param->set_tsf;
+       int ret;
+
+       /* Workaround:
+        *
+        * Given tsf argument is entire TSF value, but firmware accepts
+        * only TSF offset to current TSF.
+        *
+        * get_tsf function is used to get offset value, however since
+        * ath10k_get_tsf is not implemented properly, it will return 0 always.
+        * Luckily all the caller functions to set_tsf, as of now, also rely on
+        * get_tsf function to get entire tsf value such get_tsf() + tsf_delta,
+        * final tsf offset value to firmware will be arithmetically correct.
+        */
+       tsf_offset = tsf - ath10k_get_tsf(hw, vif);
+       ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id,
+                                       vdev_param, tsf_offset);
+       if (ret && ret != -EOPNOTSUPP)
+               ath10k_warn(ar, "failed to set tsf offset: %d\n", ret);
+}
+
 static int ath10k_ampdu_action(struct ieee80211_hw *hw,
                               struct ieee80211_vif *vif,
                               struct ieee80211_ampdu_params *params)
@@ -6532,12 +7307,25 @@ ath10k_mac_update_vif_chan(struct ath10k *ar,
 
                if (WARN_ON(!arvif->is_up))
                        continue;
+               if (QCA_REV_WCN3990(ar)) {
+                       /* In the case of wcn3990 WLAN module we send
+                        * vdev restart only, no need to send vdev down.
+                        */
 
-               ret = ath10k_wmi_vdev_down(ar, arvif->vdev_id);
-               if (ret) {
-                       ath10k_warn(ar, "failed to down vdev %d: %d\n",
-                                   arvif->vdev_id, ret);
-                       continue;
+                       ret = ath10k_vdev_restart(arvif, &vifs[i].new_ctx->def);
+                       if (ret) {
+                               ath10k_warn(ar,
+                                           "failed to restart vdev %d: %d\n",
+                                           arvif->vdev_id, ret);
+                               continue;
+                       }
+               } else {
+                       ret = ath10k_wmi_vdev_down(ar, arvif->vdev_id);
+                       if (ret) {
+                               ath10k_warn(ar, "failed to down vdev %d: %d\n",
+                                           arvif->vdev_id, ret);
+                               continue;
+                       }
                }
        }
 
@@ -6568,11 +7356,17 @@ ath10k_mac_update_vif_chan(struct ath10k *ar,
                        ath10k_warn(ar, "failed to update prb tmpl during csa: %d\n",
                                    ret);
 
-               ret = ath10k_vdev_restart(arvif, &vifs[i].new_ctx->def);
-               if (ret) {
-                       ath10k_warn(ar, "failed to restart vdev %d: %d\n",
-                                   arvif->vdev_id, ret);
-                       continue;
+               if (!QCA_REV_WCN3990(ar)) {
+                       /* In case of other than wcn3990 WLAN module we
+                        * send vdev down and vdev restart to the firmware.
+                        */
+
+                       ret = ath10k_vdev_restart(arvif, &vifs[i].new_ctx->def);
+                       if (ret) {
+                               ath10k_warn(ar, "failed to restart vdev %d: %d\n",
+                                           arvif->vdev_id, ret);
+                               continue;
+                       }
                }
 
                ret = ath10k_wmi_vdev_up(arvif->ar, arvif->vdev_id, arvif->aid,
@@ -6594,7 +7388,7 @@ ath10k_mac_op_add_chanctx(struct ieee80211_hw *hw,
        struct ath10k *ar = hw->priv;
 
        ath10k_dbg(ar, ATH10K_DBG_MAC,
-                  "mac chanctx add freq %hu width %d ptr %p\n",
+                  "mac chanctx add freq %hu width %d ptr %pK\n",
                   ctx->def.chan->center_freq, ctx->def.width, ctx);
 
        mutex_lock(&ar->conf_mutex);
@@ -6618,7 +7412,7 @@ ath10k_mac_op_remove_chanctx(struct ieee80211_hw *hw,
        struct ath10k *ar = hw->priv;
 
        ath10k_dbg(ar, ATH10K_DBG_MAC,
-                  "mac chanctx remove freq %hu width %d ptr %p\n",
+                  "mac chanctx remove freq %hu width %d ptr %pK\n",
                   ctx->def.chan->center_freq, ctx->def.width, ctx);
 
        mutex_lock(&ar->conf_mutex);
@@ -6683,7 +7477,7 @@ ath10k_mac_op_change_chanctx(struct ieee80211_hw *hw,
        mutex_lock(&ar->conf_mutex);
 
        ath10k_dbg(ar, ATH10K_DBG_MAC,
-                  "mac chanctx change freq %hu width %d ptr %p changed %x\n",
+                  "mac chanctx change freq %hu width %d ptr %pK changed %x\n",
                   ctx->def.chan->center_freq, ctx->def.width, ctx, changed);
 
        /* This shouldn't really happen because channel switching should use
@@ -6741,7 +7535,7 @@ ath10k_mac_op_assign_vif_chanctx(struct ieee80211_hw *hw,
        mutex_lock(&ar->conf_mutex);
 
        ath10k_dbg(ar, ATH10K_DBG_MAC,
-                  "mac chanctx assign ptr %p vdev_id %i\n",
+                  "mac chanctx assign ptr %pK vdev_id %i\n",
                   ctx, arvif->vdev_id);
 
        if (WARN_ON(arvif->is_started)) {
@@ -6809,12 +7603,13 @@ ath10k_mac_op_unassign_vif_chanctx(struct ieee80211_hw *hw,
        mutex_lock(&ar->conf_mutex);
 
        ath10k_dbg(ar, ATH10K_DBG_MAC,
-                  "mac chanctx unassign ptr %p vdev_id %i\n",
+                  "mac chanctx unassign ptr %pK vdev_id %i\n",
                   ctx, arvif->vdev_id);
 
        WARN_ON(!arvif->is_started);
-
-       if (vif->type == NL80211_IFTYPE_MONITOR) {
+       if (vif->type == NL80211_IFTYPE_MONITOR ||
+           (vif->type == NL80211_IFTYPE_STATION &&
+            ar->sta_state < IEEE80211_STA_ASSOC)) {
                WARN_ON(!arvif->is_up);
 
                ret = ath10k_wmi_vdev_down(ar, arvif->vdev_id);
@@ -6830,6 +7625,7 @@ ath10k_mac_op_unassign_vif_chanctx(struct ieee80211_hw *hw,
                ath10k_warn(ar, "failed to stop vdev %i: %d\n",
                            arvif->vdev_id, ret);
 
+       ar->sta_state = IEEE80211_STA_NOTEXIST;
        arvif->is_started = false;
 
        mutex_unlock(&ar->conf_mutex);
@@ -6855,16 +7651,19 @@ ath10k_mac_op_switch_vif_chanctx(struct ieee80211_hw *hw,
 }
 
 static const struct ieee80211_ops ath10k_ops = {
-       .tx                             = ath10k_tx,
+       .tx                             = ath10k_mac_op_tx,
+       .wake_tx_queue                  = ath10k_mac_op_wake_tx_queue,
        .start                          = ath10k_start,
        .stop                           = ath10k_stop,
        .config                         = ath10k_config,
        .add_interface                  = ath10k_add_interface,
+       .change_interface               = ath10k_change_interface,
        .remove_interface               = ath10k_remove_interface,
        .configure_filter               = ath10k_configure_filter,
        .bss_info_changed               = ath10k_bss_info_changed,
        .hw_scan                        = ath10k_hw_scan,
        .cancel_hw_scan                 = ath10k_cancel_hw_scan,
+       .set_rekey_data                 = ath10k_set_rekey_data,
        .set_key                        = ath10k_set_key,
        .set_default_unicast_key        = ath10k_set_default_unicast_key,
        .sta_state                      = ath10k_sta_state,
@@ -6882,6 +7681,7 @@ static const struct ieee80211_ops ath10k_ops = {
        .set_bitrate_mask               = ath10k_mac_op_set_bitrate_mask,
        .sta_rc_update                  = ath10k_sta_rc_update,
        .get_tsf                        = ath10k_get_tsf,
+       .set_tsf                        = ath10k_set_tsf,
        .ampdu_action                   = ath10k_ampdu_action,
        .get_et_sset_count              = ath10k_debug_get_et_sset_count,
        .get_et_stats                   = ath10k_debug_get_et_stats,
@@ -6898,14 +7698,16 @@ static const struct ieee80211_ops ath10k_ops = {
 #ifdef CONFIG_PM
        .suspend                        = ath10k_wow_op_suspend,
        .resume                         = ath10k_wow_op_resume,
+       .set_wakeup                     = ath10k_wow_op_set_wakeup,
 #endif
 #ifdef CONFIG_MAC80211_DEBUGFS
        .sta_add_debugfs                = ath10k_sta_add_debugfs,
+       .sta_statistics                 = ath10k_sta_statistics,
 #endif
 };
 
 #define CHAN2G(_channel, _freq, _flags) { \
-       .band                   = IEEE80211_BAND_2GHZ, \
+       .band                   = NL80211_BAND_2GHZ, \
        .hw_value               = (_channel), \
        .center_freq            = (_freq), \
        .flags                  = (_flags), \
@@ -6914,7 +7716,7 @@ static const struct ieee80211_ops ath10k_ops = {
 }
 
 #define CHAN5G(_channel, _freq, _flags) { \
-       .band                   = IEEE80211_BAND_5GHZ, \
+       .band                   = NL80211_BAND_5GHZ, \
        .hw_value               = (_channel), \
        .center_freq            = (_freq), \
        .flags                  = (_flags), \
@@ -6970,54 +7772,69 @@ static const struct ieee80211_channel ath10k_5ghz_channels[] = {
 struct ath10k *ath10k_mac_create(size_t priv_size)
 {
        struct ieee80211_hw *hw;
+       struct ieee80211_ops *ops;
        struct ath10k *ar;
 
-       hw = ieee80211_alloc_hw(sizeof(struct ath10k) + priv_size, &ath10k_ops);
-       if (!hw)
+       ops = kmemdup(&ath10k_ops, sizeof(ath10k_ops), GFP_KERNEL);
+       if (!ops)
+               return NULL;
+
+       hw = ieee80211_alloc_hw(sizeof(struct ath10k) + priv_size, ops);
+       if (!hw) {
+               kfree(ops);
                return NULL;
+       }
 
        ar = hw->priv;
        ar->hw = hw;
+       ar->ops = ops;
 
        return ar;
 }
 
 void ath10k_mac_destroy(struct ath10k *ar)
 {
+       struct ieee80211_ops *ops = ar->ops;
+
        ieee80211_free_hw(ar->hw);
+       kfree(ops);
 }
 
 static const struct ieee80211_iface_limit ath10k_if_limits[] = {
        {
-       .max    = 8,
-       .types  = BIT(NL80211_IFTYPE_STATION)
-               | BIT(NL80211_IFTYPE_P2P_CLIENT)
+               .max    = 8,
+               .types  = BIT(NL80211_IFTYPE_STATION)
+                       | BIT(NL80211_IFTYPE_P2P_CLIENT)
        },
        {
-       .max    = 3,
-       .types  = BIT(NL80211_IFTYPE_P2P_GO)
+               .max    = 3,
+               .types  = BIT(NL80211_IFTYPE_P2P_GO)
        },
        {
-       .max    = 1,
-       .types  = BIT(NL80211_IFTYPE_P2P_DEVICE)
+               .max    = 1,
+               .types  = BIT(NL80211_IFTYPE_P2P_DEVICE)
        },
        {
-       .max    = 7,
-       .types  = BIT(NL80211_IFTYPE_AP)
+               .max    = 7,
+               .types  = BIT(NL80211_IFTYPE_AP)
 #ifdef CONFIG_MAC80211_MESH
-               | BIT(NL80211_IFTYPE_MESH_POINT)
+                       | BIT(NL80211_IFTYPE_MESH_POINT)
 #endif
        },
 };
 
 static const struct ieee80211_iface_limit ath10k_10x_if_limits[] = {
        {
-       .max    = 8,
-       .types  = BIT(NL80211_IFTYPE_AP)
+               .max    = 8,
+               .types  = BIT(NL80211_IFTYPE_AP)
 #ifdef CONFIG_MAC80211_MESH
-               | BIT(NL80211_IFTYPE_MESH_POINT)
+                       | BIT(NL80211_IFTYPE_MESH_POINT)
 #endif
        },
+       {
+               .max    = 1,
+               .types  = BIT(NL80211_IFTYPE_STATION)
+       },
 };
 
 static const struct ieee80211_iface_combination ath10k_if_comb[] = {
@@ -7139,6 +7956,85 @@ static struct ieee80211_iface_combination ath10k_tlv_qcs_if_comb[] = {
        },
 };
 
+static const struct ieee80211_iface_limit ath10k_wcn3990_if_limit[] = {
+       {
+               .max = 2,
+               .types = BIT(NL80211_IFTYPE_STATION),
+       },
+       {
+               .max = 2,
+               .types = BIT(NL80211_IFTYPE_AP) |
+#ifdef CONFIG_MAC80211_MESH
+                        BIT(NL80211_IFTYPE_MESH_POINT) |
+#endif
+                        BIT(NL80211_IFTYPE_P2P_CLIENT) |
+                        BIT(NL80211_IFTYPE_P2P_GO),
+       },
+};
+
+static const struct ieee80211_iface_limit ath10k_wcn3990_qcs_if_limit[] = {
+       {
+               .max = 2,
+               .types = BIT(NL80211_IFTYPE_STATION),
+       },
+       {
+               .max = 2,
+               .types = BIT(NL80211_IFTYPE_P2P_CLIENT),
+       },
+       {
+               .max = 1,
+               .types = BIT(NL80211_IFTYPE_AP) |
+#ifdef CONFIG_MAC80211_MESH
+                        BIT(NL80211_IFTYPE_MESH_POINT) |
+#endif
+                        BIT(NL80211_IFTYPE_P2P_GO),
+       },
+};
+
+static const struct ieee80211_iface_limit ath10k_wcn3990_if_limit_ibss[] = {
+       {
+               .max = 1,
+               .types = BIT(NL80211_IFTYPE_STATION),
+       },
+       {
+               .max = 1,
+               .types = BIT(NL80211_IFTYPE_ADHOC),
+       },
+};
+
+static struct ieee80211_iface_combination ath10k_wcn3990_qcs_if_comb[] = {
+       {
+               .limits = ath10k_wcn3990_if_limit,
+               .num_different_channels = 1,
+               .max_interfaces = 4,
+               .n_limits = ARRAY_SIZE(ath10k_wcn3990_if_limit),
+#ifdef CONFIG_ATH10K_DFS_CERTIFIED
+               .radar_detect_widths =  BIT(NL80211_CHAN_WIDTH_20_NOHT) |
+                                      BIT(NL80211_CHAN_WIDTH_20) |
+                                      BIT(NL80211_CHAN_WIDTH_40) |
+                                      BIT(NL80211_CHAN_WIDTH_80),
+#endif
+       },
+       {
+               .limits = ath10k_wcn3990_qcs_if_limit,
+               .num_different_channels = 2,
+               .max_interfaces = 4,
+               .n_limits = ARRAY_SIZE(ath10k_wcn3990_qcs_if_limit),
+       },
+       {
+               .limits = ath10k_wcn3990_if_limit_ibss,
+               .num_different_channels = 1,
+               .max_interfaces = 2,
+               .n_limits = ARRAY_SIZE(ath10k_wcn3990_if_limit_ibss),
+#ifdef CONFIG_ATH10K_DFS_CERTIFIED
+               .radar_detect_widths =  BIT(NL80211_CHAN_WIDTH_20_NOHT) |
+                                      BIT(NL80211_CHAN_WIDTH_20) |
+                                      BIT(NL80211_CHAN_WIDTH_40) |
+                                      BIT(NL80211_CHAN_WIDTH_80),
+#endif
+       },
+};
+
 static const struct ieee80211_iface_limit ath10k_10_4_if_limits[] = {
        {
                .max = 1,
@@ -7230,13 +8126,19 @@ int ath10k_mac_register(struct ath10k *ar)
                        goto err_free;
                }
 
-               band = &ar->mac.sbands[IEEE80211_BAND_2GHZ];
+               band = &ar->mac.sbands[NL80211_BAND_2GHZ];
                band->n_channels = ARRAY_SIZE(ath10k_2ghz_channels);
                band->channels = channels;
-               band->n_bitrates = ath10k_g_rates_size;
-               band->bitrates = ath10k_g_rates;
 
-               ar->hw->wiphy->bands[IEEE80211_BAND_2GHZ] = band;
+               if (ar->hw_params.cck_rate_map_rev2) {
+                       band->n_bitrates = ath10k_g_rates_rev2_size;
+                       band->bitrates = ath10k_g_rates_rev2;
+               } else {
+                       band->n_bitrates = ath10k_g_rates_size;
+                       band->bitrates = ath10k_g_rates;
+               }
+
+               ar->hw->wiphy->bands[NL80211_BAND_2GHZ] = band;
        }
 
        if (ar->phy_capability & WHAL_WLAN_11A_CAPABILITY) {
@@ -7248,12 +8150,12 @@ int ath10k_mac_register(struct ath10k *ar)
                        goto err_free;
                }
 
-               band = &ar->mac.sbands[IEEE80211_BAND_5GHZ];
+               band = &ar->mac.sbands[NL80211_BAND_5GHZ];
                band->n_channels = ARRAY_SIZE(ath10k_5ghz_channels);
                band->channels = channels;
                band->n_bitrates = ath10k_a_rates_size;
                band->bitrates = ath10k_a_rates;
-               ar->hw->wiphy->bands[IEEE80211_BAND_5GHZ] = band;
+               ar->hw->wiphy->bands[NL80211_BAND_5GHZ] = band;
        }
 
        ath10k_mac_setup_ht_vht_cap(ar);
@@ -7266,12 +8168,16 @@ int ath10k_mac_register(struct ath10k *ar)
        ar->hw->wiphy->available_antennas_rx = ar->cfg_rx_chainmask;
        ar->hw->wiphy->available_antennas_tx = ar->cfg_tx_chainmask;
 
-       if (!test_bit(ATH10K_FW_FEATURE_NO_P2P, ar->fw_features))
+       if (!test_bit(ATH10K_FW_FEATURE_NO_P2P, ar->normal_mode_fw.fw_file.fw_features))
                ar->hw->wiphy->interface_modes |=
                        BIT(NL80211_IFTYPE_P2P_DEVICE) |
                        BIT(NL80211_IFTYPE_P2P_CLIENT) |
                        BIT(NL80211_IFTYPE_P2P_GO);
 
+       if (QCA_REV_WCN3990(ar))
+               ar->hw->wiphy->interface_modes &=
+                       ~BIT(NL80211_IFTYPE_P2P_DEVICE);
+
        ieee80211_hw_set(ar->hw, SIGNAL_DBM);
        ieee80211_hw_set(ar->hw, SUPPORTS_PS);
        ieee80211_hw_set(ar->hw, SUPPORTS_DYNAMIC_PS);
@@ -7306,6 +8212,7 @@ int ath10k_mac_register(struct ath10k *ar)
 
        ar->hw->vif_data_size = sizeof(struct ath10k_vif);
        ar->hw->sta_data_size = sizeof(struct ath10k_sta);
+       ar->hw->txq_data_size = sizeof(struct ath10k_txq);
 
        ar->hw->max_listen_interval = ATH10K_MAX_HW_LISTEN_INTERVAL;
 
@@ -7330,7 +8237,8 @@ int ath10k_mac_register(struct ath10k *ar)
        ar->hw->wiphy->max_remain_on_channel_duration = 5000;
 
        ar->hw->wiphy->flags |= WIPHY_FLAG_AP_UAPSD;
-       ar->hw->wiphy->features |= NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE;
+       ar->hw->wiphy->features |= NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE |
+                                  NL80211_FEATURE_AP_SCAN;
 
        ar->hw->wiphy->max_ap_assoc_sta = ar->max_num_stations;
 
@@ -7354,7 +8262,7 @@ int ath10k_mac_register(struct ath10k *ar)
         */
        ar->hw->offchannel_tx_hw_queue = IEEE80211_MAX_QUEUES - 1;
 
-       switch (ar->wmi.op_version) {
+       switch (ar->running_fw->fw_file.wmi_op_version) {
        case ATH10K_FW_WMI_OP_VERSION_MAIN:
                ar->hw->wiphy->iface_combinations = ath10k_if_comb;
                ar->hw->wiphy->n_iface_combinations =
@@ -7362,6 +8270,14 @@ int ath10k_mac_register(struct ath10k *ar)
                ar->hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_ADHOC);
                break;
        case ATH10K_FW_WMI_OP_VERSION_TLV:
+               ar->hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_ADHOC);
+               if (QCA_REV_WCN3990(ar)) {
+                       ar->hw->wiphy->iface_combinations =
+                               ath10k_wcn3990_qcs_if_comb;
+                       ar->hw->wiphy->n_iface_combinations =
+                               ARRAY_SIZE(ath10k_wcn3990_qcs_if_comb);
+                       break;
+               }
                if (test_bit(WMI_SERVICE_ADAPTIVE_OCS, ar->wmi.svc_map)) {
                        ar->hw->wiphy->iface_combinations =
                                ath10k_tlv_qcs_if_comb;
@@ -7372,7 +8288,6 @@ int ath10k_mac_register(struct ath10k *ar)
                        ar->hw->wiphy->n_iface_combinations =
                                ARRAY_SIZE(ath10k_tlv_if_comb);
                }
-               ar->hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_ADHOC);
                break;
        case ATH10K_FW_WMI_OP_VERSION_10_1:
        case ATH10K_FW_WMI_OP_VERSION_10_2:
@@ -7396,7 +8311,7 @@ int ath10k_mac_register(struct ath10k *ar)
        if (!test_bit(ATH10K_FLAG_RAW_MODE, &ar->dev_flags))
                ar->hw->netdev_features = NETIF_F_HW_CSUM;
 
-       if (config_enabled(CONFIG_ATH10K_DFS_CERTIFIED)) {
+       if (IS_ENABLED(CONFIG_ATH10K_DFS_CERTIFIED)) {
                /* Init ath dfs pattern detector */
                ar->ath_common.debug_mask = ATH_DBG_DFS;
                ar->dfs_detector = dfs_pattern_detector_init(&ar->ath_common,
@@ -7406,6 +8321,15 @@ int ath10k_mac_register(struct ath10k *ar)
                        ath10k_warn(ar, "failed to initialise DFS pattern detector\n");
        }
 
+       /* Current wake_tx_queue implementation imposes a significant
+        * performance penalty in some setups. The tx scheduling code needs
+        * more work anyway so disable the wake_tx_queue unless firmware
+        * supports the pull-push mechanism.
+        */
+       if (!test_bit(ATH10K_FW_FEATURE_PEER_FLOW_CONTROL,
+                     ar->running_fw->fw_file.fw_features))
+               ar->ops->wake_tx_queue = NULL;
+
        ret = ath_regd_init(&ar->ath_common.regulatory, ar->hw->wiphy,
                            ath10k_reg_notifier);
        if (ret) {
@@ -7435,12 +8359,12 @@ err_unregister:
        ieee80211_unregister_hw(ar->hw);
 
 err_dfs_detector_exit:
-       if (config_enabled(CONFIG_ATH10K_DFS_CERTIFIED) && ar->dfs_detector)
+       if (IS_ENABLED(CONFIG_ATH10K_DFS_CERTIFIED) && ar->dfs_detector)
                ar->dfs_detector->exit(ar->dfs_detector);
 
 err_free:
-       kfree(ar->mac.sbands[IEEE80211_BAND_2GHZ].channels);
-       kfree(ar->mac.sbands[IEEE80211_BAND_5GHZ].channels);
+       kfree(ar->mac.sbands[NL80211_BAND_2GHZ].channels);
+       kfree(ar->mac.sbands[NL80211_BAND_5GHZ].channels);
 
        SET_IEEE80211_DEV(ar->hw, NULL);
        return ret;
@@ -7448,13 +8372,14 @@ err_free:
 
 void ath10k_mac_unregister(struct ath10k *ar)
 {
+       ath10k_wow_deinit(ar);
        ieee80211_unregister_hw(ar->hw);
 
-       if (config_enabled(CONFIG_ATH10K_DFS_CERTIFIED) && ar->dfs_detector)
+       if (IS_ENABLED(CONFIG_ATH10K_DFS_CERTIFIED) && ar->dfs_detector)
                ar->dfs_detector->exit(ar->dfs_detector);
 
-       kfree(ar->mac.sbands[IEEE80211_BAND_2GHZ].channels);
-       kfree(ar->mac.sbands[IEEE80211_BAND_5GHZ].channels);
+       kfree(ar->mac.sbands[NL80211_BAND_2GHZ].channels);
+       kfree(ar->mac.sbands[NL80211_BAND_5GHZ].channels);
 
        SET_IEEE80211_DEV(ar->hw, NULL);
 }