ath10k: fix survey reporting
[cascardo/linux.git] / drivers / net / wireless / ath / ath10k / mac.c
index d6d2f0f..8df20e9 100644 (file)
 #include "testmode.h"
 #include "wmi.h"
 #include "wmi-ops.h"
+#include "wow.h"
+
+/*********/
+/* Rates */
+/*********/
+
+static struct ieee80211_rate ath10k_rates[] = {
+       { .bitrate = 10,
+         .hw_value = ATH10K_HW_RATE_CCK_LP_1M },
+       { .bitrate = 20,
+         .hw_value = ATH10K_HW_RATE_CCK_LP_2M,
+         .hw_value_short = ATH10K_HW_RATE_CCK_SP_2M,
+         .flags = IEEE80211_RATE_SHORT_PREAMBLE },
+       { .bitrate = 55,
+         .hw_value = ATH10K_HW_RATE_CCK_LP_5_5M,
+         .hw_value_short = ATH10K_HW_RATE_CCK_SP_5_5M,
+         .flags = IEEE80211_RATE_SHORT_PREAMBLE },
+       { .bitrate = 110,
+         .hw_value = ATH10K_HW_RATE_CCK_LP_11M,
+         .hw_value_short = ATH10K_HW_RATE_CCK_SP_11M,
+         .flags = IEEE80211_RATE_SHORT_PREAMBLE },
+
+       { .bitrate = 60, .hw_value = ATH10K_HW_RATE_OFDM_6M },
+       { .bitrate = 90, .hw_value = ATH10K_HW_RATE_OFDM_9M },
+       { .bitrate = 120, .hw_value = ATH10K_HW_RATE_OFDM_12M },
+       { .bitrate = 180, .hw_value = ATH10K_HW_RATE_OFDM_18M },
+       { .bitrate = 240, .hw_value = ATH10K_HW_RATE_OFDM_24M },
+       { .bitrate = 360, .hw_value = ATH10K_HW_RATE_OFDM_36M },
+       { .bitrate = 480, .hw_value = ATH10K_HW_RATE_OFDM_48M },
+       { .bitrate = 540, .hw_value = ATH10K_HW_RATE_OFDM_54M },
+};
+
+#define ATH10K_MAC_FIRST_OFDM_RATE_IDX 4
+
+#define ath10k_a_rates (ath10k_rates + ATH10K_MAC_FIRST_OFDM_RATE_IDX)
+#define ath10k_a_rates_size (ARRAY_SIZE(ath10k_rates) - \
+                            ATH10K_MAC_FIRST_OFDM_RATE_IDX)
+#define ath10k_g_rates (ath10k_rates + 0)
+#define ath10k_g_rates_size (ARRAY_SIZE(ath10k_rates))
+
+static bool ath10k_mac_bitrate_is_cck(int bitrate)
+{
+       switch (bitrate) {
+       case 10:
+       case 20:
+       case 55:
+       case 110:
+               return true;
+       }
+
+       return false;
+}
+
+static u8 ath10k_mac_bitrate_to_rate(int bitrate)
+{
+       return DIV_ROUND_UP(bitrate, 5) |
+              (ath10k_mac_bitrate_is_cck(bitrate) ? BIT(7) : 0);
+}
+
+u8 ath10k_mac_hw_rate_to_idx(const struct ieee80211_supported_band *sband,
+                            u8 hw_rate)
+{
+       const struct ieee80211_rate *rate;
+       int i;
+
+       for (i = 0; i < sband->n_bitrates; i++) {
+               rate = &sband->bitrates[i];
+
+               if (rate->hw_value == hw_rate)
+                       return i;
+               else if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE &&
+                        rate->hw_value_short == hw_rate)
+                       return i;
+       }
+
+       return 0;
+}
+
+u8 ath10k_mac_bitrate_to_idx(const struct ieee80211_supported_band *sband,
+                            u32 bitrate)
+{
+       int i;
+
+       for (i = 0; i < sband->n_bitrates; i++)
+               if (sband->bitrates[i].bitrate == bitrate)
+                       return i;
+
+       return 0;
+}
 
 /**********/
 /* Crypto */
 static int ath10k_send_key(struct ath10k_vif *arvif,
                           struct ieee80211_key_conf *key,
                           enum set_key_cmd cmd,
-                          const u8 *macaddr, bool def_idx)
+                          const u8 *macaddr, u32 flags)
 {
        struct ath10k *ar = arvif->ar;
        struct wmi_vdev_install_key_arg arg = {
@@ -45,16 +134,12 @@ static int ath10k_send_key(struct ath10k_vif *arvif,
                .key_idx = key->keyidx,
                .key_len = key->keylen,
                .key_data = key->key,
+               .key_flags = flags,
                .macaddr = macaddr,
        };
 
        lockdep_assert_held(&arvif->ar->conf_mutex);
 
-       if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE)
-               arg.key_flags = WMI_KEY_PAIRWISE;
-       else
-               arg.key_flags = WMI_KEY_GROUP;
-
        switch (key->cipher) {
        case WLAN_CIPHER_SUITE_CCMP:
                arg.key_cipher = WMI_CIPHER_AES_CCM;
@@ -68,17 +153,10 @@ static int ath10k_send_key(struct ath10k_vif *arvif,
        case WLAN_CIPHER_SUITE_WEP40:
        case WLAN_CIPHER_SUITE_WEP104:
                arg.key_cipher = WMI_CIPHER_WEP;
-               /* AP/IBSS mode requires self-key to be groupwise
-                * Otherwise pairwise key must be set */
-               if (memcmp(macaddr, arvif->vif->addr, ETH_ALEN))
-                       arg.key_flags = WMI_KEY_PAIRWISE;
-
-               if (def_idx)
-                       arg.key_flags |= WMI_KEY_TX_USAGE;
                break;
        case WLAN_CIPHER_SUITE_AES_CMAC:
-               /* this one needs to be done in software */
-               return 1;
+               WARN_ON(1);
+               return -EINVAL;
        default:
                ath10k_warn(ar, "cipher %d is not supported\n", key->cipher);
                return -EOPNOTSUPP;
@@ -95,21 +173,22 @@ static int ath10k_send_key(struct ath10k_vif *arvif,
 static int ath10k_install_key(struct ath10k_vif *arvif,
                              struct ieee80211_key_conf *key,
                              enum set_key_cmd cmd,
-                             const u8 *macaddr, bool def_idx)
+                             const u8 *macaddr, u32 flags)
 {
        struct ath10k *ar = arvif->ar;
        int ret;
+       unsigned long time_left;
 
        lockdep_assert_held(&ar->conf_mutex);
 
        reinit_completion(&ar->install_key_done);
 
-       ret = ath10k_send_key(arvif, key, cmd, macaddr, def_idx);
+       ret = ath10k_send_key(arvif, key, cmd, macaddr, flags);
        if (ret)
                return ret;
 
-       ret = wait_for_completion_timeout(&ar->install_key_done, 3*HZ);
-       if (ret == 0)
+       time_left = wait_for_completion_timeout(&ar->install_key_done, 3 * HZ);
+       if (time_left == 0)
                return -ETIMEDOUT;
 
        return 0;
@@ -122,7 +201,7 @@ static int ath10k_install_peer_wep_keys(struct ath10k_vif *arvif,
        struct ath10k_peer *peer;
        int ret;
        int i;
-       bool def_idx;
+       u32 flags;
 
        lockdep_assert_held(&ar->conf_mutex);
 
@@ -136,14 +215,16 @@ static int ath10k_install_peer_wep_keys(struct ath10k_vif *arvif,
        for (i = 0; i < ARRAY_SIZE(arvif->wep_keys); i++) {
                if (arvif->wep_keys[i] == NULL)
                        continue;
+
+               flags = 0;
+               flags |= WMI_KEY_PAIRWISE;
+
                /* set TX_USAGE flag for default key id */
                if (arvif->def_wep_key_idx == i)
-                       def_idx = true;
-               else
-                       def_idx = false;
+                       flags |= WMI_KEY_TX_USAGE;
 
                ret = ath10k_install_key(arvif, arvif->wep_keys[i], SET_KEY,
-                                        addr, def_idx);
+                                        addr, flags);
                if (ret)
                        return ret;
 
@@ -163,6 +244,7 @@ static int ath10k_clear_peer_keys(struct ath10k_vif *arvif,
        int first_errno = 0;
        int ret;
        int i;
+       u32 flags = 0;
 
        lockdep_assert_held(&ar->conf_mutex);
 
@@ -179,7 +261,7 @@ static int ath10k_clear_peer_keys(struct ath10k_vif *arvif,
 
                /* key flags are not required to delete the key */
                ret = ath10k_install_key(arvif, peer->keys[i],
-                                        DISABLE_KEY, addr, false);
+                                        DISABLE_KEY, addr, flags);
                if (ret && first_errno == 0)
                        first_errno = ret;
 
@@ -229,6 +311,7 @@ static int ath10k_clear_vdev_key(struct ath10k_vif *arvif,
        int first_errno = 0;
        int ret;
        int i;
+       u32 flags = 0;
 
        lockdep_assert_held(&ar->conf_mutex);
 
@@ -254,7 +337,7 @@ static int ath10k_clear_vdev_key(struct ath10k_vif *arvif,
                if (i == ARRAY_SIZE(peer->keys))
                        break;
                /* key flags are not required to delete the key */
-               ret = ath10k_install_key(arvif, key, DISABLE_KEY, addr, false);
+               ret = ath10k_install_key(arvif, key, DISABLE_KEY, addr, flags);
                if (ret && first_errno == 0)
                        first_errno = ret;
 
@@ -266,6 +349,77 @@ static int ath10k_clear_vdev_key(struct ath10k_vif *arvif,
        return first_errno;
 }
 
+static int ath10k_mac_vif_sta_fix_wep_key(struct ath10k_vif *arvif)
+{
+       struct ath10k *ar = arvif->ar;
+       enum nl80211_iftype iftype = arvif->vif->type;
+       struct ieee80211_key_conf *key;
+       u32 flags = 0;
+       int num = 0;
+       int i;
+       int ret;
+
+       lockdep_assert_held(&ar->conf_mutex);
+
+       if (iftype != NL80211_IFTYPE_STATION)
+               return 0;
+
+       for (i = 0; i < ARRAY_SIZE(arvif->wep_keys); i++) {
+               if (arvif->wep_keys[i]) {
+                       key = arvif->wep_keys[i];
+                       ++num;
+               }
+       }
+
+       if (num != 1)
+               return 0;
+
+       flags |= WMI_KEY_PAIRWISE;
+       flags |= WMI_KEY_TX_USAGE;
+
+       ret = ath10k_install_key(arvif, key, SET_KEY, arvif->bssid, flags);
+       if (ret) {
+               ath10k_warn(ar, "failed to install key %i on vdev %i: %d\n",
+                           key->keyidx, arvif->vdev_id, ret);
+               return ret;
+       }
+
+       return 0;
+}
+
+static int ath10k_mac_vif_update_wep_key(struct ath10k_vif *arvif,
+                                        struct ieee80211_key_conf *key)
+{
+       struct ath10k *ar = arvif->ar;
+       struct ath10k_peer *peer;
+       int ret;
+
+       lockdep_assert_held(&ar->conf_mutex);
+
+       list_for_each_entry(peer, &ar->peers, list) {
+               if (!memcmp(peer->addr, arvif->vif->addr, ETH_ALEN))
+                       continue;
+
+               if (!memcmp(peer->addr, arvif->bssid, ETH_ALEN))
+                       continue;
+
+               if (peer->keys[key->keyidx] == key)
+                       continue;
+
+               ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vif vdev %i update key %i needs update\n",
+                          arvif->vdev_id, key->keyidx);
+
+               ret = ath10k_install_peer_wep_keys(arvif, peer->addr);
+               if (ret) {
+                       ath10k_warn(ar, "failed to update wep keys on vdev %i for peer %pM: %d\n",
+                                   arvif->vdev_id, peer->addr, ret);
+                       return ret;
+               }
+       }
+
+       return 0;
+}
+
 /*********************/
 /* General utilities */
 /*********************/
@@ -364,7 +518,8 @@ static u8 ath10k_parse_mpdudensity(u8 mpdudensity)
        }
 }
 
-static int ath10k_peer_create(struct ath10k *ar, u32 vdev_id, const u8 *addr)
+static int ath10k_peer_create(struct ath10k *ar, u32 vdev_id, const u8 *addr,
+                             enum wmi_peer_type peer_type)
 {
        int ret;
 
@@ -373,7 +528,7 @@ static int ath10k_peer_create(struct ath10k *ar, u32 vdev_id, const u8 *addr)
        if (ar->num_peers >= ar->max_num_peers)
                return -ENOBUFS;
 
-       ret = ath10k_wmi_peer_create(ar, vdev_id, addr);
+       ret = ath10k_wmi_peer_create(ar, vdev_id, addr, peer_type);
        if (ret) {
                ath10k_warn(ar, "failed to create wmi peer %pM on vdev %i: %i\n",
                            addr, vdev_id, ret);
@@ -517,6 +672,38 @@ static void ath10k_peer_cleanup_all(struct ath10k *ar)
        ar->num_stations = 0;
 }
 
+static int ath10k_mac_tdls_peer_update(struct ath10k *ar, u32 vdev_id,
+                                      struct ieee80211_sta *sta,
+                                      enum wmi_tdls_peer_state state)
+{
+       int ret;
+       struct wmi_tdls_peer_update_cmd_arg arg = {};
+       struct wmi_tdls_peer_capab_arg cap = {};
+       struct wmi_channel_arg chan_arg = {};
+
+       lockdep_assert_held(&ar->conf_mutex);
+
+       arg.vdev_id = vdev_id;
+       arg.peer_state = state;
+       ether_addr_copy(arg.addr, sta->addr);
+
+       cap.peer_max_sp = sta->max_sp;
+       cap.peer_uapsd_queues = sta->uapsd_queues;
+
+       if (state == WMI_TDLS_PEER_STATE_CONNECTED &&
+           !sta->tdls_initiator)
+               cap.is_peer_responder = 1;
+
+       ret = ath10k_wmi_tdls_peer_update(ar, &arg, &cap, &chan_arg);
+       if (ret) {
+               ath10k_warn(ar, "failed to update tdls peer %pM on vdev %i: %i\n",
+                           arg.addr, vdev_id, ret);
+               return ret;
+       }
+
+       return 0;
+}
+
 /************************/
 /* Interface management */
 /************************/
@@ -561,16 +748,16 @@ static void ath10k_mac_vif_beacon_cleanup(struct ath10k_vif *arvif)
 
 static inline int ath10k_vdev_setup_sync(struct ath10k *ar)
 {
-       int ret;
+       unsigned long time_left;
 
        lockdep_assert_held(&ar->conf_mutex);
 
        if (test_bit(ATH10K_FLAG_CRASH_FLUSH, &ar->dev_flags))
                return -ESHUTDOWN;
 
-       ret = wait_for_completion_timeout(&ar->vdev_setup_done,
-                                         ATH10K_VDEV_SETUP_TIMEOUT_HZ);
-       if (ret == 0)
+       time_left = wait_for_completion_timeout(&ar->vdev_setup_done,
+                                               ATH10K_VDEV_SETUP_TIMEOUT_HZ);
+       if (time_left == 0)
                return -ETIMEDOUT;
 
        return 0;
@@ -611,7 +798,7 @@ static int ath10k_monitor_vdev_start(struct ath10k *ar, int vdev_id)
 
        ret = ath10k_vdev_setup_sync(ar);
        if (ret) {
-               ath10k_warn(ar, "failed to synchronize setup for monitor vdev %i: %d\n",
+               ath10k_warn(ar, "failed to synchronize setup for monitor vdev %i start: %d\n",
                            vdev_id, ret);
                return ret;
        }
@@ -658,7 +845,7 @@ static int ath10k_monitor_vdev_stop(struct ath10k *ar)
 
        ret = ath10k_vdev_setup_sync(ar);
        if (ret)
-               ath10k_warn(ar, "failed to synchronise monitor vdev %i: %d\n",
+               ath10k_warn(ar, "failed to synchronize monitor vdev %i stop: %d\n",
                            ar->monitor_vdev_id, ret);
 
        ath10k_dbg(ar, ATH10K_DBG_MAC, "mac monitor vdev %i stopped\n",
@@ -766,6 +953,25 @@ static int ath10k_monitor_stop(struct ath10k *ar)
        return 0;
 }
 
+static bool ath10k_mac_should_disable_promisc(struct ath10k *ar)
+{
+       struct ath10k_vif *arvif;
+
+       if (!(ar->filter_flags & FIF_PROMISC_IN_BSS))
+               return true;
+
+       if (!ar->num_started_vdevs)
+               return false;
+
+       list_for_each_entry(arvif, &ar->arvifs, list)
+               if (arvif->vdev_type != WMI_VDEV_TYPE_AP)
+                       return false;
+
+       ath10k_dbg(ar, ATH10K_DBG_MAC,
+                  "mac disabling promiscuous mode because vdev is started\n");
+       return true;
+}
+
 static int ath10k_monitor_recalc(struct ath10k *ar)
 {
        bool should_start;
@@ -773,7 +979,7 @@ static int ath10k_monitor_recalc(struct ath10k *ar)
        lockdep_assert_held(&ar->conf_mutex);
 
        should_start = ar->monitor ||
-                      ar->filter_flags & FIF_PROMISC_IN_BSS ||
+                      !ath10k_mac_should_disable_promisc(ar) ||
                       test_bit(ATH10K_CAC_RUNNING, &ar->dev_flags);
 
        ath10k_dbg(ar, ATH10K_DBG_MAC,
@@ -798,12 +1004,14 @@ static int ath10k_recalc_rtscts_prot(struct ath10k_vif *arvif)
 
        vdev_param = ar->wmi.vdev_param->enable_rtscts;
 
-       if (arvif->use_cts_prot || arvif->num_legacy_stations > 0)
-               rts_cts |= SM(WMI_RTSCTS_ENABLED, WMI_RTSCTS_SET);
+       rts_cts |= SM(WMI_RTSCTS_ENABLED, WMI_RTSCTS_SET);
 
        if (arvif->num_legacy_stations > 0)
                rts_cts |= SM(WMI_RTSCTS_ACROSS_SW_RETRIES,
                              WMI_RTSCTS_PROFILE);
+       else
+               rts_cts |= SM(WMI_RTSCTS_FOR_SECOND_RATESERIES,
+                             WMI_RTSCTS_PROFILE);
 
        return ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
                                         rts_cts);
@@ -872,12 +1080,45 @@ static void ath10k_recalc_radar_detection(struct ath10k *ar)
        }
 }
 
+static int ath10k_vdev_stop(struct ath10k_vif *arvif)
+{
+       struct ath10k *ar = arvif->ar;
+       int ret;
+
+       lockdep_assert_held(&ar->conf_mutex);
+
+       reinit_completion(&ar->vdev_setup_done);
+
+       ret = ath10k_wmi_vdev_stop(ar, arvif->vdev_id);
+       if (ret) {
+               ath10k_warn(ar, "failed to stop WMI vdev %i: %d\n",
+                           arvif->vdev_id, ret);
+               return ret;
+       }
+
+       ret = ath10k_vdev_setup_sync(ar);
+       if (ret) {
+               ath10k_warn(ar, "failed to syncronise setup for vdev %i: %d\n",
+                           arvif->vdev_id, ret);
+               return ret;
+       }
+
+       WARN_ON(ar->num_started_vdevs == 0);
+
+       if (ar->num_started_vdevs != 0) {
+               ar->num_started_vdevs--;
+               ath10k_recalc_radar_detection(ar);
+       }
+
+       return ret;
+}
+
 static int ath10k_vdev_start_restart(struct ath10k_vif *arvif, bool restart)
 {
        struct ath10k *ar = arvif->ar;
        struct cfg80211_chan_def *chandef = &ar->chandef;
        struct wmi_vdev_start_request_arg arg = {};
-       int ret = 0;
+       int ret = 0, ret2;
 
        lockdep_assert_held(&ar->conf_mutex);
 
@@ -927,14 +1168,25 @@ static int ath10k_vdev_start_restart(struct ath10k_vif *arvif, bool restart)
 
        ret = ath10k_vdev_setup_sync(ar);
        if (ret) {
-               ath10k_warn(ar, "failed to synchronise setup for vdev %i: %d\n",
-                           arg.vdev_id, ret);
+               ath10k_warn(ar,
+                           "failed to synchronize setup for vdev %i restart %d: %d\n",
+                           arg.vdev_id, restart, ret);
                return ret;
        }
 
        ar->num_started_vdevs++;
        ath10k_recalc_radar_detection(ar);
 
+       ret = ath10k_monitor_recalc(ar);
+       if (ret) {
+               ath10k_warn(ar, "mac failed to recalc monitor for vdev %i restart %d: %d\n",
+                           arg.vdev_id, restart, ret);
+               ret2 = ath10k_vdev_stop(arvif);
+               if (ret2)
+                       ath10k_warn(ar, "mac failed to stop vdev %i restart %d: %d\n",
+                                   arg.vdev_id, restart, ret2);
+       }
+
        return ret;
 }
 
@@ -948,39 +1200,6 @@ static int ath10k_vdev_restart(struct ath10k_vif *arvif)
        return ath10k_vdev_start_restart(arvif, true);
 }
 
-static int ath10k_vdev_stop(struct ath10k_vif *arvif)
-{
-       struct ath10k *ar = arvif->ar;
-       int ret;
-
-       lockdep_assert_held(&ar->conf_mutex);
-
-       reinit_completion(&ar->vdev_setup_done);
-
-       ret = ath10k_wmi_vdev_stop(ar, arvif->vdev_id);
-       if (ret) {
-               ath10k_warn(ar, "failed to stop WMI vdev %i: %d\n",
-                           arvif->vdev_id, ret);
-               return ret;
-       }
-
-       ret = ath10k_vdev_setup_sync(ar);
-       if (ret) {
-               ath10k_warn(ar, "failed to syncronise setup for vdev %i: %d\n",
-                           arvif->vdev_id, ret);
-               return ret;
-       }
-
-       WARN_ON(ar->num_started_vdevs == 0);
-
-       if (ar->num_started_vdevs != 0) {
-               ar->num_started_vdevs--;
-               ath10k_recalc_radar_detection(ar);
-       }
-
-       return ret;
-}
-
 static int ath10k_mac_setup_bcn_p2p_ie(struct ath10k_vif *arvif,
                                       struct sk_buff *bcn)
 {
@@ -1055,6 +1274,10 @@ static int ath10k_mac_setup_bcn_tmpl(struct ath10k_vif *arvif)
        if (!test_bit(WMI_SERVICE_BEACON_OFFLOAD, ar->wmi.svc_map))
                return 0;
 
+       if (arvif->vdev_type != WMI_VDEV_TYPE_AP &&
+           arvif->vdev_type != WMI_VDEV_TYPE_IBSS)
+               return 0;
+
        bcn = ieee80211_beacon_get_template(hw, vif, &offs);
        if (!bcn) {
                ath10k_warn(ar, "failed to get beacon template from mac80211\n");
@@ -1100,6 +1323,9 @@ static int ath10k_mac_setup_prb_tmpl(struct ath10k_vif *arvif)
        if (!test_bit(WMI_SERVICE_BEACON_OFFLOAD, ar->wmi.svc_map))
                return 0;
 
+       if (arvif->vdev_type != WMI_VDEV_TYPE_AP)
+               return 0;
+
        prb = ieee80211_proberesp_get(hw, vif);
        if (!prb) {
                ath10k_warn(ar, "failed to get probe resp template from mac80211\n");
@@ -1187,7 +1413,8 @@ static void ath10k_control_ibss(struct ath10k_vif *arvif,
                return;
        }
 
-       ret = ath10k_peer_create(arvif->ar, arvif->vdev_id, self_peer);
+       ret = ath10k_peer_create(arvif->ar, arvif->vdev_id, self_peer,
+                                WMI_PEER_TYPE_DEFAULT);
        if (ret) {
                ath10k_warn(ar, "failed to create IBSS self peer %pM for vdev %d: %d\n",
                            self_peer, arvif->vdev_id, ret);
@@ -1253,6 +1480,20 @@ static int ath10k_mac_vif_recalc_ps_poll_count(struct ath10k_vif *arvif)
        return 0;
 }
 
+static int ath10k_mac_ps_vif_count(struct ath10k *ar)
+{
+       struct ath10k_vif *arvif;
+       int num = 0;
+
+       lockdep_assert_held(&ar->conf_mutex);
+
+       list_for_each_entry(arvif, &ar->arvifs, list)
+               if (arvif->ps)
+                       num++;
+
+       return num;
+}
+
 static int ath10k_mac_vif_setup_ps(struct ath10k_vif *arvif)
 {
        struct ath10k *ar = arvif->ar;
@@ -1262,13 +1503,24 @@ static int ath10k_mac_vif_setup_ps(struct ath10k_vif *arvif)
        enum wmi_sta_ps_mode psmode;
        int ret;
        int ps_timeout;
+       bool enable_ps;
 
        lockdep_assert_held(&arvif->ar->conf_mutex);
 
        if (arvif->vif->type != NL80211_IFTYPE_STATION)
                return 0;
 
-       if (vif->bss_conf.ps) {
+       enable_ps = arvif->ps;
+
+       if (enable_ps && ath10k_mac_ps_vif_count(ar) > 1 &&
+           !test_bit(ATH10K_FW_FEATURE_MULTI_VIF_PS_SUPPORT,
+                     ar->fw_features)) {
+               ath10k_warn(ar, "refusing to enable ps on vdev %i: not supported by fw\n",
+                           arvif->vdev_id);
+               enable_ps = false;
+       }
+
+       if (enable_ps) {
                psmode = WMI_STA_PS_MODE_ENABLED;
                param = WMI_STA_PS_PARAM_INACTIVITY_TIME;
 
@@ -1335,6 +1587,123 @@ static int ath10k_mac_vif_disable_keepalive(struct ath10k_vif *arvif)
        return 0;
 }
 
+static void ath10k_mac_vif_ap_csa_count_down(struct ath10k_vif *arvif)
+{
+       struct ath10k *ar = arvif->ar;
+       struct ieee80211_vif *vif = arvif->vif;
+       int ret;
+
+       lockdep_assert_held(&arvif->ar->conf_mutex);
+
+       if (WARN_ON(!test_bit(WMI_SERVICE_BEACON_OFFLOAD, ar->wmi.svc_map)))
+               return;
+
+       if (arvif->vdev_type != WMI_VDEV_TYPE_AP)
+               return;
+
+       if (!vif->csa_active)
+               return;
+
+       if (!arvif->is_up)
+               return;
+
+       if (!ieee80211_csa_is_complete(vif)) {
+               ieee80211_csa_update_counter(vif);
+
+               ret = ath10k_mac_setup_bcn_tmpl(arvif);
+               if (ret)
+                       ath10k_warn(ar, "failed to update bcn tmpl during csa: %d\n",
+                                   ret);
+
+               ret = ath10k_mac_setup_prb_tmpl(arvif);
+               if (ret)
+                       ath10k_warn(ar, "failed to update prb tmpl during csa: %d\n",
+                                   ret);
+       } else {
+               ieee80211_csa_finish(vif);
+       }
+}
+
+static void ath10k_mac_vif_ap_csa_work(struct work_struct *work)
+{
+       struct ath10k_vif *arvif = container_of(work, struct ath10k_vif,
+                                               ap_csa_work);
+       struct ath10k *ar = arvif->ar;
+
+       mutex_lock(&ar->conf_mutex);
+       ath10k_mac_vif_ap_csa_count_down(arvif);
+       mutex_unlock(&ar->conf_mutex);
+}
+
+static void ath10k_mac_handle_beacon_iter(void *data, u8 *mac,
+                                         struct ieee80211_vif *vif)
+{
+       struct sk_buff *skb = data;
+       struct ieee80211_mgmt *mgmt = (void *)skb->data;
+       struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
+
+       if (vif->type != NL80211_IFTYPE_STATION)
+               return;
+
+       if (!ether_addr_equal(mgmt->bssid, vif->bss_conf.bssid))
+               return;
+
+       cancel_delayed_work(&arvif->connection_loss_work);
+}
+
+void ath10k_mac_handle_beacon(struct ath10k *ar, struct sk_buff *skb)
+{
+       ieee80211_iterate_active_interfaces_atomic(ar->hw,
+                                                  IEEE80211_IFACE_ITER_NORMAL,
+                                                  ath10k_mac_handle_beacon_iter,
+                                                  skb);
+}
+
+static void ath10k_mac_handle_beacon_miss_iter(void *data, u8 *mac,
+                                              struct ieee80211_vif *vif)
+{
+       u32 *vdev_id = data;
+       struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
+       struct ath10k *ar = arvif->ar;
+       struct ieee80211_hw *hw = ar->hw;
+
+       if (arvif->vdev_id != *vdev_id)
+               return;
+
+       if (!arvif->is_up)
+               return;
+
+       ieee80211_beacon_loss(vif);
+
+       /* Firmware doesn't report beacon loss events repeatedly. If AP probe
+        * (done by mac80211) succeeds but beacons do not resume then it
+        * doesn't make sense to continue operation. Queue connection loss work
+        * which can be cancelled when beacon is received.
+        */
+       ieee80211_queue_delayed_work(hw, &arvif->connection_loss_work,
+                                    ATH10K_CONNECTION_LOSS_HZ);
+}
+
+void ath10k_mac_handle_beacon_miss(struct ath10k *ar, u32 vdev_id)
+{
+       ieee80211_iterate_active_interfaces_atomic(ar->hw,
+                                                  IEEE80211_IFACE_ITER_NORMAL,
+                                                  ath10k_mac_handle_beacon_miss_iter,
+                                                  &vdev_id);
+}
+
+static void ath10k_mac_vif_sta_connection_loss_work(struct work_struct *work)
+{
+       struct ath10k_vif *arvif = container_of(work, struct ath10k_vif,
+                                               connection_loss_work.work);
+       struct ieee80211_vif *vif = arvif->vif;
+
+       if (!arvif->is_up)
+               return;
+
+       ieee80211_connection_loss(vif);
+}
+
 /**********************/
 /* Station management */
 /**********************/
@@ -1362,12 +1731,18 @@ static void ath10k_peer_assoc_h_basic(struct ath10k *ar,
                                      struct wmi_peer_assoc_complete_arg *arg)
 {
        struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
+       u32 aid;
 
        lockdep_assert_held(&ar->conf_mutex);
 
+       if (vif->type == NL80211_IFTYPE_STATION)
+               aid = vif->bss_conf.aid;
+       else
+               aid = sta->aid;
+
        ether_addr_copy(arg->addr, sta->addr);
        arg->vdev_id = arvif->vdev_id;
-       arg->peer_aid = sta->aid;
+       arg->peer_aid = aid;
        arg->peer_flags |= WMI_PEER_AUTH;
        arg->peer_listen_intval = ath10k_peer_assoc_h_listen_intval(ar, vif);
        arg->peer_num_spatial_streams = 1;
@@ -1386,7 +1761,8 @@ static void ath10k_peer_assoc_h_crypto(struct ath10k *ar,
        lockdep_assert_held(&ar->conf_mutex);
 
        bss = cfg80211_get_bss(ar->hw->wiphy, ar->hw->conf.chandef.chan,
-                              info->bssid, NULL, 0, 0, 0);
+                              info->bssid, NULL, 0, IEEE80211_BSS_TYPE_ANY,
+                              IEEE80211_PRIVACY_ANY);
        if (bss) {
                const struct cfg80211_bss_ies *ies;
 
@@ -1423,6 +1799,7 @@ static void ath10k_peer_assoc_h_rates(struct ath10k *ar,
        const struct ieee80211_supported_band *sband;
        const struct ieee80211_rate *rates;
        u32 ratemask;
+       u8 rate;
        int i;
 
        lockdep_assert_held(&ar->conf_mutex);
@@ -1437,7 +1814,8 @@ static void ath10k_peer_assoc_h_rates(struct ath10k *ar,
                if (!(ratemask & 1))
                        continue;
 
-               rateset->rates[rateset->num_rates] = rates->hw_value;
+               rate = ath10k_mac_bitrate_to_rate(rates->bitrate);
+               rateset->rates[rateset->num_rates] = rate;
                rateset->num_rates++;
        }
 }
@@ -1670,10 +2048,10 @@ static void ath10k_peer_assoc_h_qos(struct ath10k *ar,
                   sta->addr, !!(arg->peer_flags & WMI_PEER_QOS));
 }
 
-static bool ath10k_mac_sta_has_11g_rates(struct ieee80211_sta *sta)
+static bool ath10k_mac_sta_has_ofdm_only(struct ieee80211_sta *sta)
 {
-       /* First 4 rates in ath10k_rates are CCK (11b) rates. */
-       return sta->supp_rates[IEEE80211_BAND_2GHZ] >> 4;
+       return sta->supp_rates[IEEE80211_BAND_2GHZ] >>
+              ATH10K_MAC_FIRST_OFDM_RATE_IDX;
 }
 
 static void ath10k_peer_assoc_h_phymode(struct ath10k *ar,
@@ -1695,7 +2073,7 @@ static void ath10k_peer_assoc_h_phymode(struct ath10k *ar,
                                phymode = MODE_11NG_HT40;
                        else
                                phymode = MODE_11NG_HT20;
-               } else if (ath10k_mac_sta_has_11g_rates(sta)) {
+               } else if (ath10k_mac_sta_has_ofdm_only(sta)) {
                        phymode = MODE_11G;
                } else {
                        phymode = MODE_11B;
@@ -1781,6 +2159,68 @@ static int ath10k_setup_peer_smps(struct ath10k *ar, struct ath10k_vif *arvif,
                                         ath10k_smps_map[smps]);
 }
 
+static int ath10k_mac_vif_recalc_txbf(struct ath10k *ar,
+                                     struct ieee80211_vif *vif,
+                                     struct ieee80211_sta_vht_cap vht_cap)
+{
+       struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
+       int ret;
+       u32 param;
+       u32 value;
+
+       if (!(ar->vht_cap_info &
+             (IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
+              IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE |
+              IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE |
+              IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE)))
+               return 0;
+
+       param = ar->wmi.vdev_param->txbf;
+       value = 0;
+
+       if (WARN_ON(param == WMI_VDEV_PARAM_UNSUPPORTED))
+               return 0;
+
+       /* The following logic is correct. If a remote STA advertises support
+        * for being a beamformer then we should enable us being a beamformee.
+        */
+
+       if (ar->vht_cap_info &
+           (IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
+            IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE)) {
+               if (vht_cap.cap & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)
+                       value |= WMI_VDEV_PARAM_TXBF_SU_TX_BFEE;
+
+               if (vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE)
+                       value |= WMI_VDEV_PARAM_TXBF_MU_TX_BFEE;
+       }
+
+       if (ar->vht_cap_info &
+           (IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE |
+            IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE)) {
+               if (vht_cap.cap & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE)
+                       value |= WMI_VDEV_PARAM_TXBF_SU_TX_BFER;
+
+               if (vht_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE)
+                       value |= WMI_VDEV_PARAM_TXBF_MU_TX_BFER;
+       }
+
+       if (value & WMI_VDEV_PARAM_TXBF_MU_TX_BFEE)
+               value |= WMI_VDEV_PARAM_TXBF_SU_TX_BFEE;
+
+       if (value & WMI_VDEV_PARAM_TXBF_MU_TX_BFER)
+               value |= WMI_VDEV_PARAM_TXBF_SU_TX_BFER;
+
+       ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, param, value);
+       if (ret) {
+               ath10k_warn(ar, "failed to submit vdev param txbf 0x%x: %d\n",
+                           value, ret);
+               return ret;
+       }
+
+       return 0;
+}
+
 /* can be called only in mac80211 callbacks due to `key_count` usage */
 static void ath10k_bss_assoc(struct ieee80211_hw *hw,
                             struct ieee80211_vif *vif,
@@ -1789,6 +2229,7 @@ static void ath10k_bss_assoc(struct ieee80211_hw *hw,
        struct ath10k *ar = hw->priv;
        struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
        struct ieee80211_sta_ht_cap ht_cap;
+       struct ieee80211_sta_vht_cap vht_cap;
        struct wmi_peer_assoc_complete_arg peer_arg;
        struct ieee80211_sta *ap_sta;
        int ret;
@@ -1811,6 +2252,7 @@ static void ath10k_bss_assoc(struct ieee80211_hw *hw,
        /* ap_sta must be accessed only within rcu section which must be left
         * before calling ath10k_setup_peer_smps() which might sleep. */
        ht_cap = ap_sta->ht_cap;
+       vht_cap = ap_sta->vht_cap;
 
        ret = ath10k_peer_assoc_prepare(ar, vif, ap_sta, &peer_arg);
        if (ret) {
@@ -1836,6 +2278,13 @@ static void ath10k_bss_assoc(struct ieee80211_hw *hw,
                return;
        }
 
+       ret = ath10k_mac_vif_recalc_txbf(ar, vif, vht_cap);
+       if (ret) {
+               ath10k_warn(ar, "failed to recalc txbf for vdev %i on bss %pM: %d\n",
+                           arvif->vdev_id, bss_conf->bssid, ret);
+               return;
+       }
+
        ath10k_dbg(ar, ATH10K_DBG_MAC,
                   "mac vdev %d up (associated) bssid %pM aid %d\n",
                   arvif->vdev_id, bss_conf->bssid, bss_conf->aid);
@@ -1853,6 +2302,18 @@ static void ath10k_bss_assoc(struct ieee80211_hw *hw,
        }
 
        arvif->is_up = true;
+
+       /* Workaround: Some firmware revisions (tested with qca6174
+        * WLAN.RM.2.0-00073) have buggy powersave state machine and must be
+        * poked with peer param command.
+        */
+       ret = ath10k_wmi_peer_set_param(ar, arvif->vdev_id, arvif->bssid,
+                                       WMI_PEER_DUMMY_VAR, 1);
+       if (ret) {
+               ath10k_warn(ar, "failed to poke peer %pM param for ps workaround on vdev %i: %d\n",
+                           arvif->bssid, arvif->vdev_id, ret);
+               return;
+       }
 }
 
 static void ath10k_bss_disassoc(struct ieee80211_hw *hw,
@@ -1860,6 +2321,7 @@ static void ath10k_bss_disassoc(struct ieee80211_hw *hw,
 {
        struct ath10k *ar = hw->priv;
        struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
+       struct ieee80211_sta_vht_cap vht_cap = {};
        int ret;
 
        lockdep_assert_held(&ar->conf_mutex);
@@ -1874,7 +2336,16 @@ static void ath10k_bss_disassoc(struct ieee80211_hw *hw,
 
        arvif->def_wep_key_idx = -1;
 
+       ret = ath10k_mac_vif_recalc_txbf(ar, vif, vht_cap);
+       if (ret) {
+               ath10k_warn(ar, "failed to recalc txbf for vdev %i: %d\n",
+                           arvif->vdev_id, ret);
+               return;
+       }
+
        arvif->is_up = false;
+
+       cancel_delayed_work_sync(&arvif->connection_loss_work);
 }
 
 static int ath10k_station_assoc(struct ath10k *ar,
@@ -2182,6 +2653,52 @@ static u8 ath10k_tx_h_get_vdev_id(struct ath10k *ar, struct ieee80211_vif *vif)
        return 0;
 }
 
+static enum ath10k_hw_txrx_mode
+ath10k_tx_h_get_txmode(struct ath10k *ar, struct ieee80211_vif *vif,
+                      struct ieee80211_sta *sta, struct sk_buff *skb)
+{
+       const struct ieee80211_hdr *hdr = (void *)skb->data;
+       __le16 fc = hdr->frame_control;
+
+       if (!vif || vif->type == NL80211_IFTYPE_MONITOR)
+               return ATH10K_HW_TXRX_RAW;
+
+       if (ieee80211_is_mgmt(fc))
+               return ATH10K_HW_TXRX_MGMT;
+
+       /* Workaround:
+        *
+        * NullFunc frames are mostly used to ping if a client or AP are still
+        * reachable and responsive. This implies tx status reports must be
+        * accurate - otherwise either mac80211 or userspace (e.g. hostapd) can
+        * come to a conclusion that the other end disappeared and tear down
+        * BSS connection or it can never disconnect from BSS/client (which is
+        * the case).
+        *
+        * Firmware with HTT older than 3.0 delivers incorrect tx status for
+        * NullFunc frames to driver. However there's a HTT Mgmt Tx command
+        * which seems to deliver correct tx reports for NullFunc frames. The
+        * downside of using it is it ignores client powersave state so it can
+        * end up disconnecting sleeping clients in AP mode. It should fix STA
+        * mode though because AP don't sleep.
+        */
+       if (ar->htt.target_version_major < 3 &&
+           (ieee80211_is_nullfunc(fc) || ieee80211_is_qos_nullfunc(fc)) &&
+           !test_bit(ATH10K_FW_FEATURE_HAS_WMI_MGMT_TX, ar->fw_features))
+               return ATH10K_HW_TXRX_MGMT;
+
+       /* Workaround:
+        *
+        * Some wmi-tlv firmwares for qca6174 have broken Tx key selection for
+        * NativeWifi txmode - it selects AP key instead of peer key. It seems
+        * to work with Ethernet txmode so use it.
+        */
+       if (ieee80211_is_data_present(fc) && sta && sta->tdls)
+               return ATH10K_HW_TXRX_ETHERNET;
+
+       return ATH10K_HW_TXRX_NATIVE_WIFI;
+}
+
 /* HTT Tx uses Native Wifi tx mode which expects 802.11 frames without QoS
  * Control in the header.
  */
@@ -2199,16 +2716,42 @@ static void ath10k_tx_h_nwifi(struct ieee80211_hw *hw, struct sk_buff *skb)
                skb->data, (void *)qos_ctl - (void *)skb->data);
        skb_pull(skb, IEEE80211_QOS_CTL_LEN);
 
-       /* Fw/Hw generates a corrupted QoS Control Field for QoS NullFunc
-        * frames. Powersave is handled by the fw/hw so QoS NyllFunc frames are
-        * used only for CQM purposes (e.g. hostapd station keepalive ping) so
-        * it is safe to downgrade to NullFunc.
+       /* Some firmware revisions don't handle sending QoS NullFunc well.
+        * These frames are mainly used for CQM purposes so it doesn't really
+        * matter whether QoS NullFunc or NullFunc are sent.
         */
        hdr = (void *)skb->data;
-       if (ieee80211_is_qos_nullfunc(hdr->frame_control)) {
-               hdr->frame_control &= ~__cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
+       if (ieee80211_is_qos_nullfunc(hdr->frame_control))
                cb->htt.tid = HTT_DATA_TX_EXT_TID_NON_QOS_MCAST_BCAST;
-       }
+
+       hdr->frame_control &= ~__cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
+}
+
+static void ath10k_tx_h_8023(struct sk_buff *skb)
+{
+       struct ieee80211_hdr *hdr;
+       struct rfc1042_hdr *rfc1042;
+       struct ethhdr *eth;
+       size_t hdrlen;
+       u8 da[ETH_ALEN];
+       u8 sa[ETH_ALEN];
+       __be16 type;
+
+       hdr = (void *)skb->data;
+       hdrlen = ieee80211_hdrlen(hdr->frame_control);
+       rfc1042 = (void *)skb->data + hdrlen;
+
+       ether_addr_copy(da, ieee80211_get_DA(hdr));
+       ether_addr_copy(sa, ieee80211_get_SA(hdr));
+       type = rfc1042->snap_type;
+
+       skb_pull(skb, hdrlen + sizeof(*rfc1042));
+       skb_push(skb, sizeof(*eth));
+
+       eth = (void *)skb->data;
+       ether_addr_copy(eth->h_dest, da);
+       ether_addr_copy(eth->h_source, sa);
+       eth->h_proto = type;
 }
 
 static void ath10k_tx_h_add_p2p_noa_ie(struct ath10k *ar,
@@ -2247,45 +2790,51 @@ static bool ath10k_mac_need_offchan_tx_work(struct ath10k *ar)
                 ar->htt.target_version_minor >= 4);
 }
 
-static void ath10k_tx_htt(struct ath10k *ar, struct sk_buff *skb)
+static int ath10k_mac_tx_wmi_mgmt(struct ath10k *ar, struct sk_buff *skb)
 {
-       struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+       struct sk_buff_head *q = &ar->wmi_mgmt_tx_queue;
        int ret = 0;
 
-       if (ar->htt.target_version_major >= 3) {
-               /* Since HTT 3.0 there is no separate mgmt tx command */
-               ret = ath10k_htt_tx(&ar->htt, skb);
-               goto exit;
+       spin_lock_bh(&ar->data_lock);
+
+       if (skb_queue_len(q) == ATH10K_MAX_NUM_MGMT_PENDING) {
+               ath10k_warn(ar, "wmi mgmt tx queue is full\n");
+               ret = -ENOSPC;
+               goto unlock;
        }
 
-       if (ieee80211_is_mgmt(hdr->frame_control)) {
-               if (test_bit(ATH10K_FW_FEATURE_HAS_WMI_MGMT_TX,
-                            ar->fw_features)) {
-                       if (skb_queue_len(&ar->wmi_mgmt_tx_queue) >=
-                           ATH10K_MAX_NUM_MGMT_PENDING) {
-                               ath10k_warn(ar, "reached WMI management transmit queue limit\n");
-                               ret = -EBUSY;
-                               goto exit;
-                       }
+       __skb_queue_tail(q, skb);
+       ieee80211_queue_work(ar->hw, &ar->wmi_mgmt_tx_work);
 
-                       skb_queue_tail(&ar->wmi_mgmt_tx_queue, skb);
-                       ieee80211_queue_work(ar->hw, &ar->wmi_mgmt_tx_work);
-               } else {
-                       ret = ath10k_htt_mgmt_tx(&ar->htt, skb);
-               }
-       } else if (!test_bit(ATH10K_FW_FEATURE_HAS_WMI_MGMT_TX,
-                            ar->fw_features) &&
-                  ieee80211_is_nullfunc(hdr->frame_control)) {
-               /* FW does not report tx status properly for NullFunc frames
-                * unless they are sent through mgmt tx path. mac80211 sends
-                * those frames when it detects link/beacon loss and depends
-                * on the tx status to be correct. */
-               ret = ath10k_htt_mgmt_tx(&ar->htt, skb);
-       } else {
-               ret = ath10k_htt_tx(&ar->htt, skb);
+unlock:
+       spin_unlock_bh(&ar->data_lock);
+
+       return ret;
+}
+
+static void ath10k_mac_tx(struct ath10k *ar, struct sk_buff *skb)
+{
+       struct ath10k_skb_cb *cb = ATH10K_SKB_CB(skb);
+       struct ath10k_htt *htt = &ar->htt;
+       int ret = 0;
+
+       switch (cb->txmode) {
+       case ATH10K_HW_TXRX_RAW:
+       case ATH10K_HW_TXRX_NATIVE_WIFI:
+       case ATH10K_HW_TXRX_ETHERNET:
+               ret = ath10k_htt_tx(htt, skb);
+               break;
+       case ATH10K_HW_TXRX_MGMT:
+               if (test_bit(ATH10K_FW_FEATURE_HAS_WMI_MGMT_TX,
+                            ar->fw_features))
+                       ret = ath10k_mac_tx_wmi_mgmt(ar, skb);
+               else if (ar->htt.target_version_major >= 3)
+                       ret = ath10k_htt_tx(htt, skb);
+               else
+                       ret = ath10k_htt_mgmt_tx(htt, skb);
+               break;
        }
 
-exit:
        if (ret) {
                ath10k_warn(ar, "failed to transmit packet, dropping: %d\n",
                            ret);
@@ -2315,6 +2864,7 @@ void ath10k_offchan_tx_work(struct work_struct *work)
        const u8 *peer_addr;
        int vdev_id;
        int ret;
+       unsigned long time_left;
 
        /* FW requirement: We must create a peer before FW will send out
         * an offchannel frame. Otherwise the frame will be stuck and
@@ -2347,7 +2897,8 @@ void ath10k_offchan_tx_work(struct work_struct *work)
                                   peer_addr, vdev_id);
 
                if (!peer) {
-                       ret = ath10k_peer_create(ar, vdev_id, peer_addr);
+                       ret = ath10k_peer_create(ar, vdev_id, peer_addr,
+                                                WMI_PEER_TYPE_DEFAULT);
                        if (ret)
                                ath10k_warn(ar, "failed to create peer %pM on vdev %d: %d\n",
                                            peer_addr, vdev_id, ret);
@@ -2358,11 +2909,11 @@ void ath10k_offchan_tx_work(struct work_struct *work)
                ar->offchan_tx_skb = skb;
                spin_unlock_bh(&ar->data_lock);
 
-               ath10k_tx_htt(ar, skb);
+               ath10k_mac_tx(ar, skb);
 
-               ret = wait_for_completion_timeout(&ar->offchan_tx_completed,
-                                                 3 * HZ);
-               if (ret == 0)
+               time_left =
+               wait_for_completion_timeout(&ar->offchan_tx_completed, 3 * HZ);
+               if (time_left == 0)
                        ath10k_warn(ar, "timed out waiting for offchannel skb %p\n",
                                    skb);
 
@@ -2554,6 +3105,17 @@ static int ath10k_start_scan(struct ath10k *ar,
                return -ETIMEDOUT;
        }
 
+       /* If we failed to start the scan, return error code at
+        * this point.  This is probably due to some issue in the
+        * firmware, but no need to wedge the driver due to that...
+        */
+       spin_lock_bh(&ar->data_lock);
+       if (ar->scan.state == ATH10K_SCAN_IDLE) {
+               spin_unlock_bh(&ar->data_lock);
+               return -EINVAL;
+       }
+       spin_unlock_bh(&ar->data_lock);
+
        /* Add a 200ms margin to account for event/command processing */
        ieee80211_queue_delayed_work(ar->hw, &ar->scan.timeout,
                                     msecs_to_jiffies(arg->max_scan_time+200));
@@ -2571,21 +3133,38 @@ static void ath10k_tx(struct ieee80211_hw *hw,
        struct ath10k *ar = hw->priv;
        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
        struct ieee80211_vif *vif = info->control.vif;
+       struct ieee80211_sta *sta = control->sta;
        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+       __le16 fc = hdr->frame_control;
 
        /* We should disable CCK RATE due to P2P */
        if (info->flags & IEEE80211_TX_CTL_NO_CCK_RATE)
                ath10k_dbg(ar, ATH10K_DBG_MAC, "IEEE80211_TX_CTL_NO_CCK_RATE\n");
 
        ATH10K_SKB_CB(skb)->htt.is_offchan = false;
+       ATH10K_SKB_CB(skb)->htt.freq = 0;
        ATH10K_SKB_CB(skb)->htt.tid = ath10k_tx_h_get_tid(hdr);
        ATH10K_SKB_CB(skb)->vdev_id = ath10k_tx_h_get_vdev_id(ar, vif);
+       ATH10K_SKB_CB(skb)->txmode = ath10k_tx_h_get_txmode(ar, vif, sta, skb);
+       ATH10K_SKB_CB(skb)->is_protected = ieee80211_has_protected(fc);
 
-       /* it makes no sense to process injected frames like that */
-       if (vif && vif->type != NL80211_IFTYPE_MONITOR) {
+       switch (ATH10K_SKB_CB(skb)->txmode) {
+       case ATH10K_HW_TXRX_MGMT:
+       case ATH10K_HW_TXRX_NATIVE_WIFI:
                ath10k_tx_h_nwifi(hw, skb);
                ath10k_tx_h_add_p2p_noa_ie(ar, vif, skb);
                ath10k_tx_h_seq_no(vif, skb);
+               break;
+       case ATH10K_HW_TXRX_ETHERNET:
+               ath10k_tx_h_8023(skb);
+               break;
+       case ATH10K_HW_TXRX_RAW:
+               /* FIXME: Packet injection isn't implemented. It should be
+                * doable with firmware 10.2 on qca988x.
+                */
+               WARN_ON_ONCE(1);
+               ieee80211_free_txskb(hw, skb);
+               return;
        }
 
        if (info->flags & IEEE80211_TX_CTL_TX_OFFCHAN) {
@@ -2607,7 +3186,7 @@ static void ath10k_tx(struct ieee80211_hw *hw,
                }
        }
 
-       ath10k_tx_htt(ar, skb);
+       ath10k_mac_tx(ar, skb);
 }
 
 /* Must not be called with conf_mutex held as workers can use that also. */
@@ -2805,10 +3384,21 @@ static int ath10k_start(struct ieee80211_hw *hw)
                goto err_core_stop;
        }
 
+       ret = ath10k_wmi_pdev_set_param(ar,
+                                       ar->wmi.pdev_param->ani_enable, 1);
+       if (ret) {
+               ath10k_warn(ar, "failed to enable ani by default: %d\n",
+                           ret);
+               goto err_core_stop;
+       }
+
+       ar->ani_enabled = true;
+
        ar->num_started_vdevs = 0;
        ath10k_regd_update(ar);
 
        ath10k_spectral_start(ar);
+       ath10k_thermal_set_throttling(ar);
 
        mutex_unlock(&ar->conf_mutex);
        return 0;
@@ -2931,6 +3521,16 @@ static void ath10k_config_chan(struct ath10k *ar)
                if (arvif->vdev_type == WMI_VDEV_TYPE_MONITOR)
                        continue;
 
+               ret = ath10k_mac_setup_bcn_tmpl(arvif);
+               if (ret)
+                       ath10k_warn(ar, "failed to update bcn tmpl during csa: %d\n",
+                                   ret);
+
+               ret = ath10k_mac_setup_prb_tmpl(arvif);
+               if (ret)
+                       ath10k_warn(ar, "failed to update prb tmpl during csa: %d\n",
+                                   ret);
+
                ret = ath10k_vdev_restart(arvif);
                if (ret) {
                        ath10k_warn(ar, "failed to restart vdev %d: %d\n",
@@ -3091,6 +3691,9 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
        arvif->vif = vif;
 
        INIT_LIST_HEAD(&arvif->list);
+       INIT_WORK(&arvif->ap_csa_work, ath10k_mac_vif_ap_csa_work);
+       INIT_DELAYED_WORK(&arvif->connection_loss_work,
+                         ath10k_mac_vif_sta_connection_loss_work);
 
        if (ar->free_vdev_map == 0) {
                ath10k_warn(ar, "Free vdev map is empty, no more interfaces allowed.\n");
@@ -3215,7 +3818,8 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
        }
 
        if (arvif->vdev_type == WMI_VDEV_TYPE_AP) {
-               ret = ath10k_peer_create(ar, arvif->vdev_id, vif->addr);
+               ret = ath10k_peer_create(ar, arvif->vdev_id, vif->addr,
+                                        WMI_PEER_TYPE_DEFAULT);
                if (ret) {
                        ath10k_warn(ar, "failed to create vdev %i peer for AP: %d\n",
                                    arvif->vdev_id, ret);
@@ -3308,6 +3912,9 @@ static void ath10k_remove_interface(struct ieee80211_hw *hw,
        struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
        int ret;
 
+       cancel_work_sync(&arvif->ap_csa_work);
+       cancel_delayed_work_sync(&arvif->connection_loss_work);
+
        mutex_lock(&ar->conf_mutex);
 
        spin_lock_bh(&ar->data_lock);
@@ -3323,9 +3930,10 @@ static void ath10k_remove_interface(struct ieee80211_hw *hw,
        list_del(&arvif->list);
 
        if (arvif->vdev_type == WMI_VDEV_TYPE_AP) {
-               ret = ath10k_peer_delete(arvif->ar, arvif->vdev_id, vif->addr);
+               ret = ath10k_wmi_peer_delete(arvif->ar, arvif->vdev_id,
+                                            vif->addr);
                if (ret)
-                       ath10k_warn(ar, "failed to remove peer for AP vdev %i: %d\n",
+                       ath10k_warn(ar, "failed to submit AP self-peer removal on vdev %i: %d\n",
                                    arvif->vdev_id, ret);
 
                kfree(arvif->u.ap.noa_data);
@@ -3339,6 +3947,21 @@ static void ath10k_remove_interface(struct ieee80211_hw *hw,
                ath10k_warn(ar, "failed to delete WMI vdev %i: %d\n",
                            arvif->vdev_id, ret);
 
+       /* Some firmware revisions don't notify host about self-peer removal
+        * until after associated vdev is deleted.
+        */
+       if (arvif->vdev_type == WMI_VDEV_TYPE_AP) {
+               ret = ath10k_wait_for_peer_deleted(ar, arvif->vdev_id,
+                                                  vif->addr);
+               if (ret)
+                       ath10k_warn(ar, "failed to remove AP self-peer on vdev %i: %d\n",
+                                   arvif->vdev_id, ret);
+
+               spin_lock_bh(&ar->data_lock);
+               ar->num_peers--;
+               spin_unlock_bh(&ar->data_lock);
+       }
+
        ath10k_peer_cleanup(ar, arvif->vdev_id);
 
        mutex_unlock(&ar->conf_mutex);
@@ -3470,6 +4093,13 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
                if (ret)
                        ath10k_warn(ar, "failed to recalculate rts/cts prot for vdev %d: %d\n",
                                    arvif->vdev_id, ret);
+
+               vdev_param = ar->wmi.vdev_param->protection_mode;
+               ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
+                                               info->use_cts_prot ? 1 : 0);
+               if (ret)
+                       ath10k_warn(ar, "failed to set protection mode %d on vdev %i: %d\n",
+                                       info->use_cts_prot, arvif->vdev_id, ret);
        }
 
        if (changed & BSS_CHANGED_ERP_SLOT) {
@@ -3534,7 +4164,9 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
        }
 
        if (changed & BSS_CHANGED_PS) {
-               ret = ath10k_mac_vif_setup_ps(arvif);
+               arvif->ps = vif->bss_conf.ps;
+
+               ret = ath10k_config_ps(ar);
                if (ret)
                        ath10k_warn(ar, "failed to setup ps on vdev %i: %d\n",
                                    arvif->vdev_id, ret);
@@ -3679,8 +4311,12 @@ static int ath10k_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
        const u8 *peer_addr;
        bool is_wep = key->cipher == WLAN_CIPHER_SUITE_WEP40 ||
                      key->cipher == WLAN_CIPHER_SUITE_WEP104;
-       bool def_idx = false;
        int ret = 0;
+       u32 flags = 0;
+
+       /* this one needs to be done in software */
+       if (key->cipher == WLAN_CIPHER_SUITE_AES_CMAC)
+               return 1;
 
        if (key->keyidx > WMI_MAX_KEY_INDEX)
                return -ENOSPC;
@@ -3715,6 +4351,11 @@ static int ath10k_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                }
        }
 
+       if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE)
+               flags |= WMI_KEY_PAIRWISE;
+       else
+               flags |= WMI_KEY_GROUP;
+
        if (is_wep) {
                if (cmd == SET_KEY)
                        arvif->wep_keys[key->keyidx] = key;
@@ -3723,16 +4364,44 @@ static int ath10k_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
 
                if (cmd == DISABLE_KEY)
                        ath10k_clear_vdev_key(arvif, key);
-       }
 
-       /* set TX_USAGE flag for all the keys incase of dot1x-WEP. For
-        * static WEP, do not set this flag for the keys whose key id
-        * is  greater than default key id.
-        */
-       if (arvif->def_wep_key_idx == -1)
-               def_idx = true;
+               /* When WEP keys are uploaded it's possible that there are
+                * stations associated already (e.g. when merging) without any
+                * keys. Static WEP needs an explicit per-peer key upload.
+                */
+               if (vif->type == NL80211_IFTYPE_ADHOC &&
+                   cmd == SET_KEY)
+                       ath10k_mac_vif_update_wep_key(arvif, key);
+
+               /* 802.1x never sets the def_wep_key_idx so each set_key()
+                * call changes default tx key.
+                *
+                * Static WEP sets def_wep_key_idx via .set_default_unicast_key
+                * after first set_key().
+                */
+               if (cmd == SET_KEY && arvif->def_wep_key_idx == -1)
+                       flags |= WMI_KEY_TX_USAGE;
+
+               /* mac80211 uploads static WEP keys as groupwise while fw/hw
+                * requires pairwise keys for non-self peers, i.e. BSSID in STA
+                * mode and associated stations in AP/IBSS.
+                *
+                * Static WEP keys for peer_addr=vif->addr and 802.1X WEP keys
+                * work fine when mapped directly from mac80211.
+                *
+                * Note: When installing first static WEP groupwise key (which
+                * should be pairwise) def_wep_key_idx isn't known yet (it's
+                * equal to -1).  Since .set_default_unicast_key is called only
+                * for static WEP it's used to re-upload the key as pairwise.
+                */
+               if (arvif->def_wep_key_idx >= 0 &&
+                   memcmp(peer_addr, arvif->vif->addr, ETH_ALEN)) {
+                       flags &= ~WMI_KEY_GROUP;
+                       flags |= WMI_KEY_PAIRWISE;
+               }
+       }
 
-       ret = ath10k_install_key(arvif, key, cmd, peer_addr, def_idx);
+       ret = ath10k_install_key(arvif, key, cmd, peer_addr, flags);
        if (ret) {
                ath10k_warn(ar, "failed to install key for vdev %i peer %pM: %d\n",
                            arvif->vdev_id, peer_addr, ret);
@@ -3786,6 +4455,14 @@ static void ath10k_set_default_unicast_key(struct ieee80211_hw *hw,
        }
 
        arvif->def_wep_key_idx = keyidx;
+
+       ret = ath10k_mac_vif_sta_fix_wep_key(arvif);
+       if (ret) {
+               ath10k_warn(ar, "failed to fix sta wep key on vdev %i: %d\n",
+                           arvif->vdev_id, ret);
+               goto unlock;
+       }
+
 unlock:
        mutex_unlock(&arvif->ar->conf_mutex);
 }
@@ -3864,14 +4541,14 @@ static void ath10k_sta_rc_update_wk(struct work_struct *wk)
        mutex_unlock(&ar->conf_mutex);
 }
 
-static int ath10k_mac_inc_num_stations(struct ath10k_vif *arvif)
+static int ath10k_mac_inc_num_stations(struct ath10k_vif *arvif,
+                                      struct ieee80211_sta *sta)
 {
        struct ath10k *ar = arvif->ar;
 
        lockdep_assert_held(&ar->conf_mutex);
 
-       if (arvif->vdev_type != WMI_VDEV_TYPE_AP &&
-           arvif->vdev_type != WMI_VDEV_TYPE_IBSS)
+       if (arvif->vdev_type == WMI_VDEV_TYPE_STA && !sta->tdls)
                return 0;
 
        if (ar->num_stations >= ar->max_num_stations)
@@ -3882,19 +4559,72 @@ static int ath10k_mac_inc_num_stations(struct ath10k_vif *arvif)
        return 0;
 }
 
-static void ath10k_mac_dec_num_stations(struct ath10k_vif *arvif)
+static void ath10k_mac_dec_num_stations(struct ath10k_vif *arvif,
+                                       struct ieee80211_sta *sta)
 {
        struct ath10k *ar = arvif->ar;
 
        lockdep_assert_held(&ar->conf_mutex);
 
-       if (arvif->vdev_type != WMI_VDEV_TYPE_AP &&
-           arvif->vdev_type != WMI_VDEV_TYPE_IBSS)
+       if (arvif->vdev_type == WMI_VDEV_TYPE_STA && !sta->tdls)
                return;
 
        ar->num_stations--;
 }
 
+struct ath10k_mac_tdls_iter_data {
+       u32 num_tdls_stations;
+       struct ieee80211_vif *curr_vif;
+};
+
+static void ath10k_mac_tdls_vif_stations_count_iter(void *data,
+                                                   struct ieee80211_sta *sta)
+{
+       struct ath10k_mac_tdls_iter_data *iter_data = data;
+       struct ath10k_sta *arsta = (struct ath10k_sta *)sta->drv_priv;
+       struct ieee80211_vif *sta_vif = arsta->arvif->vif;
+
+       if (sta->tdls && sta_vif == iter_data->curr_vif)
+               iter_data->num_tdls_stations++;
+}
+
+static int ath10k_mac_tdls_vif_stations_count(struct ieee80211_hw *hw,
+                                             struct ieee80211_vif *vif)
+{
+       struct ath10k_mac_tdls_iter_data data = {};
+
+       data.curr_vif = vif;
+
+       ieee80211_iterate_stations_atomic(hw,
+                                         ath10k_mac_tdls_vif_stations_count_iter,
+                                         &data);
+       return data.num_tdls_stations;
+}
+
+static void ath10k_mac_tdls_vifs_count_iter(void *data, u8 *mac,
+                                           struct ieee80211_vif *vif)
+{
+       struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
+       int *num_tdls_vifs = data;
+
+       if (vif->type != NL80211_IFTYPE_STATION)
+               return;
+
+       if (ath10k_mac_tdls_vif_stations_count(arvif->ar->hw, vif) > 0)
+               (*num_tdls_vifs)++;
+}
+
+static int ath10k_mac_tdls_vifs_count(struct ieee80211_hw *hw)
+{
+       int num_tdls_vifs = 0;
+
+       ieee80211_iterate_active_interfaces_atomic(hw,
+                                                  IEEE80211_IFACE_ITER_NORMAL,
+                                                  ath10k_mac_tdls_vifs_count_iter,
+                                                  &num_tdls_vifs);
+       return num_tdls_vifs;
+}
+
 static int ath10k_sta_state(struct ieee80211_hw *hw,
                            struct ieee80211_vif *vif,
                            struct ieee80211_sta *sta,
@@ -3925,28 +4655,37 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
                /*
                 * New station addition.
                 */
+               enum wmi_peer_type peer_type = WMI_PEER_TYPE_DEFAULT;
+               u32 num_tdls_stations;
+               u32 num_tdls_vifs;
+
                ath10k_dbg(ar, ATH10K_DBG_MAC,
                           "mac vdev %d peer create %pM (new sta) sta %d / %d peer %d / %d\n",
                           arvif->vdev_id, sta->addr,
                           ar->num_stations + 1, ar->max_num_stations,
                           ar->num_peers + 1, ar->max_num_peers);
 
-               ret = ath10k_mac_inc_num_stations(arvif);
+               ret = ath10k_mac_inc_num_stations(arvif, sta);
                if (ret) {
                        ath10k_warn(ar, "refusing to associate station: too many connected already (%d)\n",
                                    ar->max_num_stations);
                        goto exit;
                }
 
-               ret = ath10k_peer_create(ar, arvif->vdev_id, sta->addr);
+               if (sta->tdls)
+                       peer_type = WMI_PEER_TYPE_TDLS;
+
+               ret = ath10k_peer_create(ar, arvif->vdev_id, sta->addr,
+                                        peer_type);
                if (ret) {
                        ath10k_warn(ar, "failed to add peer %pM for vdev %d when adding a new sta: %i\n",
                                    sta->addr, arvif->vdev_id, ret);
-                       ath10k_mac_dec_num_stations(arvif);
+                       ath10k_mac_dec_num_stations(arvif, sta);
                        goto exit;
                }
 
-               if (vif->type == NL80211_IFTYPE_STATION) {
+               if (vif->type == NL80211_IFTYPE_STATION &&
+                   !sta->tdls) {
                        WARN_ON(arvif->is_started);
 
                        ret = ath10k_vdev_start(arvif);
@@ -3955,12 +4694,59 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
                                            arvif->vdev_id, ret);
                                WARN_ON(ath10k_peer_delete(ar, arvif->vdev_id,
                                                           sta->addr));
-                               ath10k_mac_dec_num_stations(arvif);
+                               ath10k_mac_dec_num_stations(arvif, sta);
                                goto exit;
                        }
 
                        arvif->is_started = true;
                }
+
+               if (!sta->tdls)
+                       goto exit;
+
+               num_tdls_stations = ath10k_mac_tdls_vif_stations_count(hw, vif);
+               num_tdls_vifs = ath10k_mac_tdls_vifs_count(hw);
+
+               if (num_tdls_vifs >= ar->max_num_tdls_vdevs &&
+                   num_tdls_stations == 0) {
+                       ath10k_warn(ar, "vdev %i exceeded maximum number of tdls vdevs %i\n",
+                                   arvif->vdev_id, ar->max_num_tdls_vdevs);
+                       ath10k_peer_delete(ar, arvif->vdev_id, sta->addr);
+                       ath10k_mac_dec_num_stations(arvif, sta);
+                       ret = -ENOBUFS;
+                       goto exit;
+               }
+
+               if (num_tdls_stations == 0) {
+                       /* This is the first tdls peer in current vif */
+                       enum wmi_tdls_state state = WMI_TDLS_ENABLE_ACTIVE;
+
+                       ret = ath10k_wmi_update_fw_tdls_state(ar, arvif->vdev_id,
+                                                             state);
+                       if (ret) {
+                               ath10k_warn(ar, "failed to update fw tdls state on vdev %i: %i\n",
+                                           arvif->vdev_id, ret);
+                               ath10k_peer_delete(ar, arvif->vdev_id,
+                                                  sta->addr);
+                               ath10k_mac_dec_num_stations(arvif, sta);
+                               goto exit;
+                       }
+               }
+
+               ret = ath10k_mac_tdls_peer_update(ar, arvif->vdev_id, sta,
+                                                 WMI_TDLS_PEER_STATE_PEERING);
+               if (ret) {
+                       ath10k_warn(ar,
+                                   "failed to update tdls peer %pM for vdev %d when adding a new sta: %i\n",
+                                   sta->addr, arvif->vdev_id, ret);
+                       ath10k_peer_delete(ar, arvif->vdev_id, sta->addr);
+                       ath10k_mac_dec_num_stations(arvif, sta);
+
+                       if (num_tdls_stations != 0)
+                               goto exit;
+                       ath10k_wmi_update_fw_tdls_state(ar, arvif->vdev_id,
+                                                       WMI_TDLS_DISABLE);
+               }
        } else if ((old_state == IEEE80211_STA_NONE &&
                    new_state == IEEE80211_STA_NOTEXIST)) {
                /*
@@ -3970,7 +4756,8 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
                           "mac vdev %d peer delete %pM (sta gone)\n",
                           arvif->vdev_id, sta->addr);
 
-               if (vif->type == NL80211_IFTYPE_STATION) {
+               if (vif->type == NL80211_IFTYPE_STATION &&
+                   !sta->tdls) {
                        WARN_ON(!arvif->is_started);
 
                        ret = ath10k_vdev_stop(arvif);
@@ -3986,7 +4773,21 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
                        ath10k_warn(ar, "failed to delete peer %pM for vdev %d: %i\n",
                                    sta->addr, arvif->vdev_id, ret);
 
-               ath10k_mac_dec_num_stations(arvif);
+               ath10k_mac_dec_num_stations(arvif, sta);
+
+               if (!sta->tdls)
+                       goto exit;
+
+               if (ath10k_mac_tdls_vif_stations_count(hw, vif))
+                       goto exit;
+
+               /* This was the last tdls peer in current vif */
+               ret = ath10k_wmi_update_fw_tdls_state(ar, arvif->vdev_id,
+                                                     WMI_TDLS_DISABLE);
+               if (ret) {
+                       ath10k_warn(ar, "failed to update fw tdls state on vdev %i: %i\n",
+                                   arvif->vdev_id, ret);
+               }
        } else if (old_state == IEEE80211_STA_AUTH &&
                   new_state == IEEE80211_STA_ASSOC &&
                   (vif->type == NL80211_IFTYPE_AP ||
@@ -4002,9 +4803,30 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
                        ath10k_warn(ar, "failed to associate station %pM for vdev %i: %i\n",
                                    sta->addr, arvif->vdev_id, ret);
        } else if (old_state == IEEE80211_STA_ASSOC &&
-                  new_state == IEEE80211_STA_AUTH &&
-                  (vif->type == NL80211_IFTYPE_AP ||
-                   vif->type == NL80211_IFTYPE_ADHOC)) {
+                  new_state == IEEE80211_STA_AUTHORIZED &&
+                  sta->tdls) {
+               /*
+                * Tdls station authorized.
+                */
+               ath10k_dbg(ar, ATH10K_DBG_MAC, "mac tdls sta %pM authorized\n",
+                          sta->addr);
+
+               ret = ath10k_station_assoc(ar, vif, sta, false);
+               if (ret) {
+                       ath10k_warn(ar, "failed to associate tdls station %pM for vdev %i: %i\n",
+                                   sta->addr, arvif->vdev_id, ret);
+                       goto exit;
+               }
+
+               ret = ath10k_mac_tdls_peer_update(ar, arvif->vdev_id, sta,
+                                                 WMI_TDLS_PEER_STATE_CONNECTED);
+               if (ret)
+                       ath10k_warn(ar, "failed to update tdls peer %pM for vdev %i: %i\n",
+                                   sta->addr, arvif->vdev_id, ret);
+       } else if (old_state == IEEE80211_STA_ASSOC &&
+                   new_state == IEEE80211_STA_AUTH &&
+                   (vif->type == NL80211_IFTYPE_AP ||
+                    vif->type == NL80211_IFTYPE_ADHOC)) {
                /*
                 * Disassociation.
                 */
@@ -4365,70 +5187,6 @@ static int ath10k_tx_last_beacon(struct ieee80211_hw *hw)
        return 1;
 }
 
-#ifdef CONFIG_PM
-static int ath10k_suspend(struct ieee80211_hw *hw,
-                         struct cfg80211_wowlan *wowlan)
-{
-       struct ath10k *ar = hw->priv;
-       int ret;
-
-       mutex_lock(&ar->conf_mutex);
-
-       ret = ath10k_wait_for_suspend(ar, WMI_PDEV_SUSPEND);
-       if (ret) {
-               if (ret == -ETIMEDOUT)
-                       goto resume;
-               ret = 1;
-               goto exit;
-       }
-
-       ret = ath10k_hif_suspend(ar);
-       if (ret) {
-               ath10k_warn(ar, "failed to suspend hif: %d\n", ret);
-               goto resume;
-       }
-
-       ret = 0;
-       goto exit;
-resume:
-       ret = ath10k_wmi_pdev_resume_target(ar);
-       if (ret)
-               ath10k_warn(ar, "failed to resume target: %d\n", ret);
-
-       ret = 1;
-exit:
-       mutex_unlock(&ar->conf_mutex);
-       return ret;
-}
-
-static int ath10k_resume(struct ieee80211_hw *hw)
-{
-       struct ath10k *ar = hw->priv;
-       int ret;
-
-       mutex_lock(&ar->conf_mutex);
-
-       ret = ath10k_hif_resume(ar);
-       if (ret) {
-               ath10k_warn(ar, "failed to resume hif: %d\n", ret);
-               ret = 1;
-               goto exit;
-       }
-
-       ret = ath10k_wmi_pdev_resume_target(ar);
-       if (ret) {
-               ath10k_warn(ar, "failed to resume target: %d\n", ret);
-               ret = 1;
-               goto exit;
-       }
-
-       ret = 0;
-exit:
-       mutex_unlock(&ar->conf_mutex);
-       return ret;
-}
-#endif
-
 static void ath10k_reconfig_complete(struct ieee80211_hw *hw,
                                     enum ieee80211_reconfig_type reconfig_type)
 {
@@ -4488,24 +5246,6 @@ exit:
        return ret;
 }
 
-/* Helper table for legacy fixed_rate/bitrate_mask */
-static const u8 cck_ofdm_rate[] = {
-       /* CCK */
-       3, /* 1Mbps */
-       2, /* 2Mbps */
-       1, /* 5.5Mbps */
-       0, /* 11Mbps */
-       /* OFDM */
-       3, /* 6Mbps */
-       7, /* 9Mbps */
-       2, /* 12Mbps */
-       6, /* 18Mbps */
-       1, /* 24Mbps */
-       5, /* 36Mbps */
-       0, /* 48Mbps */
-       4, /* 54Mbps */
-};
-
 /* Check if only one bit set */
 static int ath10k_check_single_mask(u32 mask)
 {
@@ -4653,6 +5393,7 @@ ath10k_bitrate_mask_rate(struct ath10k *ar,
                         u8 *fixed_rate,
                         u8 *fixed_nss)
 {
+       struct ieee80211_supported_band *sband;
        u8 rate = 0, pream = 0, nss = 0, i;
        enum wmi_rate_preamble preamble;
 
@@ -4666,17 +5407,12 @@ ath10k_bitrate_mask_rate(struct ath10k *ar,
        case WMI_RATE_PREAMBLE_CCK:
        case WMI_RATE_PREAMBLE_OFDM:
                i = ffs(mask->control[band].legacy) - 1;
+               sband = &ar->mac.sbands[band];
 
-               if (band == IEEE80211_BAND_2GHZ && i < 4)
-                       pream = WMI_RATE_PREAMBLE_CCK;
-
-               if (band == IEEE80211_BAND_5GHZ)
-                       i += 4;
-
-               if (i >= ARRAY_SIZE(cck_ofdm_rate))
+               if (WARN_ON(i >= sband->n_bitrates))
                        return false;
 
-               rate = cck_ofdm_rate[i];
+               rate = sband->bitrates[i].hw_value;
                break;
        case WMI_RATE_PREAMBLE_HT:
                for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
@@ -4978,20 +5714,14 @@ static const struct ieee80211_ops ath10k_ops = {
        CFG80211_TESTMODE_CMD(ath10k_tm_cmd)
 
 #ifdef CONFIG_PM
-       .suspend                        = ath10k_suspend,
-       .resume                         = ath10k_resume,
+       .suspend                        = ath10k_wow_op_suspend,
+       .resume                         = ath10k_wow_op_resume,
 #endif
 #ifdef CONFIG_MAC80211_DEBUGFS
        .sta_add_debugfs                = ath10k_sta_add_debugfs,
 #endif
 };
 
-#define RATETAB_ENT(_rate, _rateid, _flags) { \
-       .bitrate                = (_rate), \
-       .flags                  = (_flags), \
-       .hw_value               = (_rateid), \
-}
-
 #define CHAN2G(_channel, _freq, _flags) { \
        .band                   = IEEE80211_BAND_2GHZ, \
        .hw_value               = (_channel), \
@@ -5047,6 +5777,7 @@ static const struct ieee80211_channel ath10k_5ghz_channels[] = {
        CHAN5G(132, 5660, 0),
        CHAN5G(136, 5680, 0),
        CHAN5G(140, 5700, 0),
+       CHAN5G(144, 5720, 0),
        CHAN5G(149, 5745, 0),
        CHAN5G(153, 5765, 0),
        CHAN5G(157, 5785, 0),
@@ -5054,31 +5785,6 @@ static const struct ieee80211_channel ath10k_5ghz_channels[] = {
        CHAN5G(165, 5825, 0),
 };
 
-/* Note: Be careful if you re-order these. There is code which depends on this
- * ordering.
- */
-static struct ieee80211_rate ath10k_rates[] = {
-       /* CCK */
-       RATETAB_ENT(10,  0x82, 0),
-       RATETAB_ENT(20,  0x84, 0),
-       RATETAB_ENT(55,  0x8b, 0),
-       RATETAB_ENT(110, 0x96, 0),
-       /* OFDM */
-       RATETAB_ENT(60,  0x0c, 0),
-       RATETAB_ENT(90,  0x12, 0),
-       RATETAB_ENT(120, 0x18, 0),
-       RATETAB_ENT(180, 0x24, 0),
-       RATETAB_ENT(240, 0x30, 0),
-       RATETAB_ENT(360, 0x48, 0),
-       RATETAB_ENT(480, 0x60, 0),
-       RATETAB_ENT(540, 0x6c, 0),
-};
-
-#define ath10k_a_rates (ath10k_rates + 4)
-#define ath10k_a_rates_size (ARRAY_SIZE(ath10k_rates) - 4)
-#define ath10k_g_rates (ath10k_rates + 0)
-#define ath10k_g_rates_size (ARRAY_SIZE(ath10k_rates))
-
 struct ath10k *ath10k_mac_create(size_t priv_size)
 {
        struct ieee80211_hw *hw;
@@ -5156,11 +5862,30 @@ static struct ieee80211_sta_vht_cap ath10k_create_vht_cap(struct ath10k *ar)
 {
        struct ieee80211_sta_vht_cap vht_cap = {0};
        u16 mcs_map;
+       u32 val;
        int i;
 
        vht_cap.vht_supported = 1;
        vht_cap.cap = ar->vht_cap_info;
 
+       if (ar->vht_cap_info & (IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
+                               IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE)) {
+               val = ar->num_rf_chains - 1;
+               val <<= IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT;
+               val &= IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK;
+
+               vht_cap.cap |= val;
+       }
+
+       if (ar->vht_cap_info & (IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE |
+                               IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE)) {
+               val = ar->num_rf_chains - 1;
+               val <<= IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_SHIFT;
+               val &= IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK;
+
+               vht_cap.cap |= val;
+       }
+
        mcs_map = 0;
        for (i = 0; i < 8; i++) {
                if (i < ar->num_rf_chains)
@@ -5291,6 +6016,10 @@ int ath10k_mac_register(struct ath10k *ar)
        ht_cap = ath10k_get_ht_cap(ar);
        vht_cap = ath10k_create_vht_cap(ar);
 
+       BUILD_BUG_ON((ARRAY_SIZE(ath10k_2ghz_channels) +
+                     ARRAY_SIZE(ath10k_5ghz_channels)) !=
+                    ATH10K_NUM_CHANS);
+
        if (ar->phy_capability & WHAL_WLAN_11G_CAPABILITY) {
                channels = kmemdup(ath10k_2ghz_channels,
                                   sizeof(ath10k_2ghz_channels),
@@ -5353,7 +6082,8 @@ int ath10k_mac_register(struct ath10k *ar)
                        IEEE80211_HW_HAS_RATE_CONTROL |
                        IEEE80211_HW_AP_LINK_PS |
                        IEEE80211_HW_SPECTRUM_MGMT |
-                       IEEE80211_HW_SW_CRYPTO_CONTROL;
+                       IEEE80211_HW_SW_CRYPTO_CONTROL |
+                       IEEE80211_HW_CONNECTION_MONITOR;
 
        ar->hw->wiphy->features |= NL80211_FEATURE_STATIC_SMPS;
 
@@ -5386,6 +6116,9 @@ int ath10k_mac_register(struct ath10k *ar)
                        NL80211_PROBE_RESP_OFFLOAD_SUPPORT_P2P;
        }
 
+       if (test_bit(WMI_SERVICE_TDLS, ar->wmi.svc_map))
+               ar->hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS;
+
        ar->hw->wiphy->flags |= WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
        ar->hw->wiphy->flags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH;
        ar->hw->wiphy->max_remain_on_channel_duration = 5000;
@@ -5393,6 +6126,14 @@ int ath10k_mac_register(struct ath10k *ar)
        ar->hw->wiphy->flags |= WIPHY_FLAG_AP_UAPSD;
        ar->hw->wiphy->features |= NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE;
 
+       ar->hw->wiphy->max_ap_assoc_sta = ar->max_num_stations;
+
+       ret = ath10k_wow_init(ar);
+       if (ret) {
+               ath10k_warn(ar, "failed to init wow: %d\n", ret);
+               goto err_free;
+       }
+
        /*
         * on LL hardware queues are managed entirely by the FW
         * so we only advertise to mac we can do the queues thing