Merge remote-tracking branch 'upstream/chromeos-4.14' into core35-for-chromeos-4.14

Change-Id: Ib36da2b41bf0acef982f8d888835dfb6d9df73b9
diff --git a/drivers/net/wireless/iwl7000/Makefile b/drivers/net/wireless/iwl7000/Makefile
index 1633e64..aa9c773 100644
--- a/drivers/net/wireless/iwl7000/Makefile
+++ b/drivers/net/wireless/iwl7000/Makefile
@@ -32,7 +32,7 @@
 export CPTCFG_IWLXVT=m
 endif
 
-subdir-ccflags-y = -I$(src) -include "hdrs/iwl-chrome.h"
+subdir-ccflags-y := -I$(src) -include "hdrs/iwl-chrome.h"
 subdir-ccflags-y += -I$(src)/hdrs/
 subdir-ccflags-y += $(call cc-option,-Wno-error=date-time)
 subdir-ccflags-y += $(call cc-option,-Wno-date-time)
diff --git a/drivers/net/wireless/iwl7000/hdrs/iwl-chrome.h b/drivers/net/wireless/iwl7000/hdrs/iwl-chrome.h
index 416affa..e52d9824 100644
--- a/drivers/net/wireless/iwl7000/hdrs/iwl-chrome.h
+++ b/drivers/net/wireless/iwl7000/hdrs/iwl-chrome.h
@@ -456,6 +456,9 @@
 #endif /* < 4.6 */
 
 #if LINUX_VERSION_CODE < KERNEL_VERSION(4,7,0)
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(4,5,0) ||	\
+     LINUX_VERSION_CODE < KERNEL_VERSION(4,4,0))
 /* We don't really care much about alignment, since nl80211 isn't using
  * this for hot paths. So just implement it using nla_put_u64().
  */
@@ -464,6 +467,8 @@
 {
 	return nla_put_u64(skb, attrtype, value);
 }
+#endif /* < 4.4 && > 4.5 */
+
 #define nla_put_s64 iwl7000_nla_put_s64
 static inline int nla_put_s64(struct sk_buff *skb, int attrtype, s64 value,
 			      int padattr)
diff --git a/drivers/net/wireless/iwl7000/hdrs/mac80211-bp.h b/drivers/net/wireless/iwl7000/hdrs/mac80211-bp.h
index d370205..5c2db271 100644
--- a/drivers/net/wireless/iwl7000/hdrs/mac80211-bp.h
+++ b/drivers/net/wireless/iwl7000/hdrs/mac80211-bp.h
@@ -1316,7 +1316,7 @@
 }
 #endif /* CFG80211_VERSION < KERNEL_VERSION(4,4,0) */
 
-#if CFG80211_VERSION < KERNEL_VERSION(4,99,0)
+#if CFG80211_VERSION < KERNEL_VERSION(99,0,0)
 /* not really on the way upstream yet */
 #define WIPHY_FLAG_HAS_FTM_RESPONDER 0
 
@@ -1505,7 +1505,7 @@
 		struct cfg80211_ftm_request ftm;
 	} u;
 };
-#endif /* CFG80211_VERSION < KERNEL_VERSION(4,99,0) */
+#endif /* CFG80211_VERSION < KERNEL_VERSION(99,0,0) */
 
 #if CFG80211_VERSION < KERNEL_VERSION(4,12,0)
 #define mon_opts_flags(p)	flags
@@ -1547,6 +1547,7 @@
 	return false;
 }
 
+#if CFG80211_VERSION < KERNEL_VERSION(4,4,0)
 struct cfg80211_nan_conf {
 	u8 master_pref;
 	u8 bands;
@@ -1627,6 +1628,7 @@
 	NL80211_NAN_SOLICITED_PUBLISH = 1 << 0,
 	NL80211_NAN_UNSOLICITED_PUBLISH = 1 << 1,
 };
+#endif /* CFG80211_VERSION < KERNEL_VERSION(4,4,0) */
 #else
 static inline bool ieee80211_viftype_nan(unsigned int iftype)
 {
@@ -1640,7 +1642,7 @@
 }
 #endif /* CFG80211_VERSION < KERNEL_VERSION(4,9,0) */
 
-#if CFG80211_VERSION < KERNEL_VERSION(4,99,0)
+#if CFG80211_VERSION < KERNEL_VERSION(99,0,0)
 #define nan_conf_cdw_2g(conf) 1
 #define nan_conf_cdw_5g(conf) 1
 #else
@@ -1743,7 +1745,7 @@
 #define NUM_NL80211_BANDS ((enum nl80211_band)IEEE80211_NUM_BANDS)
 #endif
 
-#if CFG80211_VERSION < KERNEL_VERSION(4,8,0)
+#if CFG80211_VERSION < KERNEL_VERSION(4,4,0)
 struct cfg80211_scan_info {
 	u64 scan_start_tsf;
 	u8 tsf_bssid[ETH_ALEN] __aligned(2);
@@ -1761,7 +1763,7 @@
 #define NL80211_EXT_FEATURE_SCAN_START_TIME -1
 #define NL80211_EXT_FEATURE_BSS_PARENT_TSF -1
 #define NL80211_EXT_FEATURE_SET_SCAN_DWELL -1
-#endif
+#endif /* CFG80211_VERSION < KERNEL_VERSION(4,4,0) */
 
 #if CFG80211_VERSION < KERNEL_VERSION(4,9,0)
 static inline
@@ -1853,6 +1855,14 @@
 	return wdev->p2p_started;
 }
 
+static inline const u8 *cfg80211_find_ext_ie(u8 ext_eid, const u8 *ies, int len)
+{
+	return cfg80211_find_ie_match(WLAN_EID_EXTENSION, ies, len,
+				      &ext_eid, 1, 2);
+}
+#endif /* CFG80211_VERSION < KERNEL_VERSION(4,10,0) */
+
+#if CFG80211_VERSION < KERNEL_VERSION(4,4,0)
 struct iface_combination_params {
 	int num_different_channels;
 	u8 radar_detect;
@@ -1886,13 +1896,7 @@
 }
 
 #define cfg80211_iter_combinations iwl7000_iter_combinations
-
-static inline const u8 *cfg80211_find_ext_ie(u8 ext_eid, const u8 *ies, int len)
-{
-	return cfg80211_find_ie_match(WLAN_EID_EXTENSION, ies, len,
-				      &ext_eid, 1, 2);
-}
-#endif
+#endif /* CFG80211_VERSION < KERNEL_VERSION(4,4,0) */
 
 #if CFG80211_VERSION >= KERNEL_VERSION(4,11,0) || \
      CFG80211_VERSION < KERNEL_VERSION(4,9,0)
@@ -2286,7 +2290,9 @@
 #define NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION BIT(7)
 #endif
 
-#if CFG80211_VERSION < KERNEL_VERSION(4,17,0)
+#if CFG80211_VERSION < KERNEL_VERSION(4,4,0) ||		\
+	(CFG80211_VERSION >= KERNEL_VERSION(4,5,0) &&	\
+	 CFG80211_VERSION < KERNEL_VERSION(4,17,0))
 struct ieee80211_wmm_ac {
 	u16 cw_min;
 	u16 cw_max;
@@ -2303,12 +2309,13 @@
 reg_query_regdb_wmm(char *alpha2, int freq, u32 *ptr,
 		    struct ieee80211_wmm_rule *rule)
 {
-	pr_debug_once("iwl7000: ETSI WMM data not implemented yet!\n");
+	pr_debug_once(KERN_DEBUG
+		      "iwl7000: ETSI WMM data not implemented yet!\n");
 	return -ENODATA;
 }
-#endif
+#endif /* < 4.4.0 || (>= 4.5.0 && < 4.17.0) */
 
-#if CFG80211_VERSION < KERNEL_VERSION(4,99,0)
+#if CFG80211_VERSION < KERNEL_VERSION(99,0,0)
 /* not yet upstream */
 static inline bool ieee80211_viftype_nan_data(unsigned int iftype)
 {
@@ -2321,7 +2328,7 @@
 }
 #endif
 
-#if CFG80211_VERSION < KERNEL_VERSION(4,99,0)
+#if CFG80211_VERSION < KERNEL_VERSION(99,0,0)
 /* not yet upstream */
 static inline int
 cfg80211_crypto_n_ciphers_group(struct cfg80211_crypto_settings *crypto)
diff --git a/drivers/net/wireless/iwl7000/iwlwifi/cfg/9000.c b/drivers/net/wireless/iwl7000/iwlwifi/cfg/9000.c
index e5bc00d..a50e61a 100644
--- a/drivers/net/wireless/iwl7000/iwlwifi/cfg/9000.c
+++ b/drivers/net/wireless/iwl7000/iwlwifi/cfg/9000.c
@@ -140,7 +140,7 @@
 	.base_params = &iwl9000_base_params,				\
 	.led_mode = IWL_LED_RF_STATE,					\
 	.nvm_hw_section_num = NVM_HW_SECTION_NUM_FAMILY_9000,		\
-	.non_shared_ant = ANT_A,					\
+	.non_shared_ant = ANT_B,					\
 	.dccm_offset = IWL9000_DCCM_OFFSET,				\
 	.dccm_len = IWL9000_DCCM_LEN,					\
 	.dccm2_offset = IWL9000_DCCM2_OFFSET,				\
@@ -182,6 +182,17 @@
 	.max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
 };
 
+const struct iwl_cfg iwl9260_killer_2ac_cfg = {
+	.name = "Killer (R) Wireless-AC 1550 Wireless Network Adapter (9260NGW)",
+	.fw_name_pre = IWL9260A_FW_PRE,
+	.fw_name_pre_b_or_c_step = IWL9260B_FW_PRE,
+	IWL_DEVICE_9000,
+	.ht_params = &iwl9000_ht_params,
+	.nvm_ver = IWL9000_NVM_VERSION,
+	.nvm_calib_ver = IWL9000_TX_POWER_VERSION,
+	.max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
+};
+
 const struct iwl_cfg iwl9270_2ac_cfg = {
 	.name = "Intel(R) Dual Band Wireless AC 9270",
 	.fw_name_pre = IWL9260A_FW_PRE,
@@ -271,6 +282,34 @@
 	.soc_latency = 5000,
 };
 
+const struct iwl_cfg iwl9560_killer_2ac_cfg_soc = {
+	.name = "Killer (R) Wireless-AC 1550i Wireless Network Adapter (9560NGW)",
+	.fw_name_pre = IWL9000A_FW_PRE,
+	.fw_name_pre_b_or_c_step = IWL9000B_FW_PRE,
+	.fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE,
+	IWL_DEVICE_9000,
+	.ht_params = &iwl9000_ht_params,
+	.nvm_ver = IWL9000_NVM_VERSION,
+	.nvm_calib_ver = IWL9000_TX_POWER_VERSION,
+	.max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
+	.integrated = true,
+	.soc_latency = 5000,
+};
+
+const struct iwl_cfg iwl9560_killer_s_2ac_cfg_soc = {
+	.name = "Killer (R) Wireless-AC 1550s Wireless Network Adapter (9560NGW)",
+	.fw_name_pre = IWL9000A_FW_PRE,
+	.fw_name_pre_b_or_c_step = IWL9000B_FW_PRE,
+	.fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE,
+	IWL_DEVICE_9000,
+	.ht_params = &iwl9000_ht_params,
+	.nvm_ver = IWL9000_NVM_VERSION,
+	.nvm_calib_ver = IWL9000_TX_POWER_VERSION,
+	.max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
+	.integrated = true,
+	.soc_latency = 5000,
+};
+
 const struct iwl_cfg iwl9460_2ac_cfg_shared_clk = {
 	.name = "Intel(R) Dual Band Wireless AC 9460",
 	.fw_name_pre = IWL9000A_FW_PRE,
@@ -331,6 +370,36 @@
 	.extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK
 };
 
+const struct iwl_cfg iwl9560_killer_2ac_cfg_shared_clk = {
+	.name = "Killer (R) Wireless-AC 1550i Wireless Network Adapter (9560NGW)",
+	.fw_name_pre = IWL9000A_FW_PRE,
+	.fw_name_pre_b_or_c_step = IWL9000B_FW_PRE,
+	.fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE,
+	IWL_DEVICE_9000,
+	.ht_params = &iwl9000_ht_params,
+	.nvm_ver = IWL9000_NVM_VERSION,
+	.nvm_calib_ver = IWL9000_TX_POWER_VERSION,
+	.max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
+	.integrated = true,
+	.soc_latency = 5000,
+	.extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK
+};
+
+const struct iwl_cfg iwl9560_killer_s_2ac_cfg_shared_clk = {
+	.name = "Killer (R) Wireless-AC 1550s Wireless Network Adapter (9560NGW)",
+	.fw_name_pre = IWL9000A_FW_PRE,
+	.fw_name_pre_b_or_c_step = IWL9000B_FW_PRE,
+	.fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE,
+	IWL_DEVICE_9000,
+	.ht_params = &iwl9000_ht_params,
+	.nvm_ver = IWL9000_NVM_VERSION,
+	.nvm_calib_ver = IWL9000_TX_POWER_VERSION,
+	.max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
+	.integrated = true,
+	.soc_latency = 5000,
+	.extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK
+};
+
 MODULE_FIRMWARE(IWL9000A_MODULE_FIRMWARE(IWL9000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL9000B_MODULE_FIRMWARE(IWL9000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL9000RFB_MODULE_FIRMWARE(IWL9000_UCODE_API_MAX));
diff --git a/drivers/net/wireless/iwl7000/iwlwifi/fw/api/nvm-reg.h b/drivers/net/wireless/iwl7000/iwlwifi/fw/api/nvm-reg.h
index 7a56921..892f210 100644
--- a/drivers/net/wireless/iwl7000/iwlwifi/fw/api/nvm-reg.h
+++ b/drivers/net/wireless/iwl7000/iwlwifi/fw/api/nvm-reg.h
@@ -165,7 +165,7 @@
  */
 struct iwl_nvm_get_info {
 	__le32 reserved;
-} __packed; /* GRP_REGULATORY_NVM_GET_INFO_CMD_S_VER_1 */
+} __packed; /* REGULATORY_NVM_GET_INFO_CMD_API_S_VER_1 */
 
 /**
  * enum iwl_nvm_info_general_flags - flags in NVM_GET_INFO resp
@@ -180,14 +180,14 @@
  * @flags: bit 0: 1 - empty, 0 - non-empty
  * @nvm_version: nvm version
  * @board_type: board type
- * @reserved: reserved
+ * @n_hw_addrs: number of reserved MAC addresses
  */
 struct iwl_nvm_get_info_general {
 	__le32 flags;
 	__le16 nvm_version;
 	u8 board_type;
-	u8 reserved;
-} __packed; /* GRP_REGULATORY_NVM_GET_INFO_GENERAL_S_VER_1 */
+	u8 n_hw_addrs;
+} __packed; /* REGULATORY_NVM_GET_INFO_GENERAL_S_VER_2 */
 
 /**
  * enum iwl_nvm_mac_sku_flags - flags in &iwl_nvm_get_info_sku
@@ -227,7 +227,7 @@
 struct iwl_nvm_get_info_phy {
 	__le32 tx_chains;
 	__le32 rx_chains;
-} __packed; /* GRP_REGULATORY_NVM_GET_INFO_PHY_SKU_SECTION_S_VER_1 */
+} __packed; /* REGULATORY_NVM_GET_INFO_PHY_SKU_SECTION_S_VER_1 */
 
 #define IWL_NUM_CHANNELS (51)
 
@@ -241,7 +241,7 @@
 	__le32 lar_enabled;
 	__le16 channel_profile[IWL_NUM_CHANNELS];
 	__le16 reserved;
-} __packed; /* GRP_REGULATORY_NVM_GET_INFO_REGULATORY_S_VER_1 */
+} __packed; /* REGULATORY_NVM_GET_INFO_REGULATORY_S_VER_1 */
 
 /**
  * struct iwl_nvm_get_info_rsp - response to get NVM data
@@ -255,7 +255,7 @@
 	struct iwl_nvm_get_info_sku mac_sku;
 	struct iwl_nvm_get_info_phy phy_sku;
 	struct iwl_nvm_get_info_regulatory regulatory;
-} __packed; /* GRP_REGULATORY_NVM_GET_INFO_CMD_RSP_S_VER_2 */
+} __packed; /* REGULATORY_NVM_GET_INFO_RSP_API_S_VER_3 */
 
 /**
  * struct iwl_nvm_access_complete_cmd - NVM_ACCESS commands are completed
diff --git a/drivers/net/wireless/iwl7000/iwlwifi/fw/api/scan.h b/drivers/net/wireless/iwl7000/iwlwifi/fw/api/scan.h
index 36bff1b..4097549 100644
--- a/drivers/net/wireless/iwl7000/iwlwifi/fw/api/scan.h
+++ b/drivers/net/wireless/iwl7000/iwlwifi/fw/api/scan.h
@@ -8,6 +8,7 @@
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018        Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +31,7 @@
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018        Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -750,13 +751,9 @@
 } __packed;
 
 #define IWL_SCAN_REQ_UMAC_SIZE_V8 sizeof(struct iwl_scan_req_umac)
-#define IWL_SCAN_REQ_UMAC_SIZE_V7 (sizeof(struct iwl_scan_req_umac) - \
-					 4 * sizeof(u8))
-#define IWL_SCAN_REQ_UMAC_SIZE_V6 (sizeof(struct iwl_scan_req_umac) - \
-				   2 * sizeof(u8) - sizeof(__le16))
-#define IWL_SCAN_REQ_UMAC_SIZE_V1 (sizeof(struct iwl_scan_req_umac) - \
-				   2 * sizeof(__le32) - 2 * sizeof(u8) - \
-				   sizeof(__le16))
+#define IWL_SCAN_REQ_UMAC_SIZE_V7 48
+#define IWL_SCAN_REQ_UMAC_SIZE_V6 44
+#define IWL_SCAN_REQ_UMAC_SIZE_V1 36
 
 /**
  * struct iwl_umac_scan_abort
diff --git a/drivers/net/wireless/iwl7000/iwlwifi/fw/api/tx.h b/drivers/net/wireless/iwl7000/iwlwifi/fw/api/tx.h
index 3ddbf0d..6782580 100644
--- a/drivers/net/wireless/iwl7000/iwlwifi/fw/api/tx.h
+++ b/drivers/net/wireless/iwl7000/iwlwifi/fw/api/tx.h
@@ -722,9 +722,9 @@
  * @tfd_cnt: number of TFD-Q elements
  * @ra_tid_cnt: number of RATID-Q elements
  * @tfd: array of TFD queue status updates. See &iwl_mvm_compressed_ba_tfd
- *	for details.
+ *	for details. Length in @tfd_cnt.
  * @ra_tid: array of RA-TID queue status updates. For debug purposes only. See
- *	&iwl_mvm_compressed_ba_ratid for more details.
+ *	&iwl_mvm_compressed_ba_ratid for more details. Length in @ra_tid_cnt.
  */
 struct iwl_mvm_compressed_ba_notif {
 	__le32 flags;
@@ -741,7 +741,7 @@
 	__le32 tx_rate;
 	__le16 tfd_cnt;
 	__le16 ra_tid_cnt;
-	struct iwl_mvm_compressed_ba_tfd tfd[1];
+	struct iwl_mvm_compressed_ba_tfd tfd[0];
 	struct iwl_mvm_compressed_ba_ratid ra_tid[0];
 } __packed; /* COMPRESSED_BA_RES_API_S_VER_4 */
 
diff --git a/drivers/net/wireless/iwl7000/iwlwifi/fw/dbg.c b/drivers/net/wireless/iwl7000/iwlwifi/fw/dbg.c
index 9f091d9..27548218 100644
--- a/drivers/net/wireless/iwl7000/iwlwifi/fw/dbg.c
+++ b/drivers/net/wireless/iwl7000/iwlwifi/fw/dbg.c
@@ -829,7 +829,7 @@
 	}
 
 	/* We only dump the FIFOs if the FW is in error state */
-	if (test_bit(STATUS_FW_ERROR, &fwrt->trans->status)) {
+	if (fifo_data_len) {
 		iwl_fw_dump_fifos(fwrt, &dump_data);
 		if (radio_len)
 			iwl_read_radio_regs(fwrt, &dump_data);
@@ -1041,7 +1041,7 @@
 	 * If the loading of the FW completed successfully, the next step is to
 	 * get the SMEM config data. Thus, if fwrt->smem_cfg.num_lmacs is non
 	 * zero, the FW was already loaded successully. If the state is "NO_FW"
-	 * in such a case - WARN and exit, since FW may be dead. Otherwise, we
+	 * in such a case - exit, since FW may be dead. Otherwise, we
 	 * can try to collect the data, since FW might just not be fully
 	 * loaded (no "ALIVE" yet), and the debug data is accessible.
 	 *
@@ -1049,9 +1049,8 @@
 	 *	config. In such a case, due to HW access problems, we might
 	 *	collect garbage.
 	 */
-	if (WARN((fwrt->trans->state == IWL_TRANS_NO_FW) &&
-		 fwrt->smem_cfg.num_lmacs,
-		 "Can't collect dbg data when FW isn't alive\n"))
+	if (fwrt->trans->state == IWL_TRANS_NO_FW &&
+	    fwrt->smem_cfg.num_lmacs)
 		return -EIO;
 
 	if (test_and_set_bit(IWL_FWRT_STATUS_DUMPING, &fwrt->status))
@@ -1075,10 +1074,13 @@
 int iwl_fw_dbg_collect(struct iwl_fw_runtime *fwrt,
 		       enum iwl_fw_dbg_trigger trig,
 		       const char *str, size_t len,
-		       const struct iwl_fw_dbg_trigger_tlv *trigger)
+		       struct iwl_fw_dbg_trigger_tlv *trigger)
 {
 	struct iwl_fw_dump_desc *desc;
 
+	if (trigger && !le16_to_cpu(trigger->occurrences))
+		return 0;
+
 	if (trigger && trigger->flags & IWL_FW_DBG_FORCE_RESTART) {
 		IWL_WARN(fwrt, "Force restart: trigger %d fired.\n", trig);
 		iwl_force_nmi(fwrt->trans);
@@ -1089,6 +1091,12 @@
 	if (!desc)
 		return -ENOMEM;
 
+	if (trigger) {
+		u16 occurrences = le16_to_cpu(trigger->occurrences) - 1;
+
+		trigger->occurrences = cpu_to_le16(occurrences);
+	}
+
 	desc->len = len;
 	desc->trig_desc.type = cpu_to_le32(trig);
 	memcpy(desc->trig_desc.data, str, len);
@@ -1101,13 +1109,9 @@
 			    struct iwl_fw_dbg_trigger_tlv *trigger,
 			    const char *fmt, ...)
 {
-	u16 occurrences = le16_to_cpu(trigger->occurrences);
 	int ret, len = 0;
 	char buf[64];
 
-	if (!occurrences)
-		return 0;
-
 	if (fmt) {
 		va_list ap;
 
@@ -1130,7 +1134,6 @@
 	if (ret)
 		return ret;
 
-	trigger->occurrences = cpu_to_le16(occurrences - 1);
 	return 0;
 }
 IWL_EXPORT_SYMBOL(iwl_fw_dbg_collect_trig);
diff --git a/drivers/net/wireless/iwl7000/iwlwifi/fw/dbg.h b/drivers/net/wireless/iwl7000/iwlwifi/fw/dbg.h
index c7ac199..dce45164 100644
--- a/drivers/net/wireless/iwl7000/iwlwifi/fw/dbg.h
+++ b/drivers/net/wireless/iwl7000/iwlwifi/fw/dbg.h
@@ -103,7 +103,7 @@
 int iwl_fw_dbg_collect(struct iwl_fw_runtime *fwrt,
 		       enum iwl_fw_dbg_trigger trig,
 		       const char *str, size_t len,
-		       const struct iwl_fw_dbg_trigger_tlv *trigger);
+		       struct iwl_fw_dbg_trigger_tlv *trigger);
 int iwl_fw_dbg_collect_trig(struct iwl_fw_runtime *fwrt,
 			    struct iwl_fw_dbg_trigger_tlv *trigger,
 			    const char *fmt, ...) __printf(3, 4);
diff --git a/drivers/net/wireless/iwl7000/iwlwifi/fw/file.h b/drivers/net/wireless/iwl7000/iwlwifi/fw/file.h
index e7df0ff..0e18628 100644
--- a/drivers/net/wireless/iwl7000/iwlwifi/fw/file.h
+++ b/drivers/net/wireless/iwl7000/iwlwifi/fw/file.h
@@ -419,8 +419,8 @@
 	IWL_UCODE_TLV_CAPA_EXTEND_SHARED_MEM_CFG	= (__force iwl_ucode_tlv_capa_t)80,
 	IWL_UCODE_TLV_CAPA_LQM_SUPPORT			= (__force iwl_ucode_tlv_capa_t)81,
 	IWL_UCODE_TLV_CAPA_TX_POWER_ACK			= (__force iwl_ucode_tlv_capa_t)84,
-	IWL_UCODE_TLV_CAPA_LED_CMD_SUPPORT		= (__force iwl_ucode_tlv_capa_t)86,
 	IWL_UCODE_TLV_CAPA_D3_DEBUG			= (__force iwl_ucode_tlv_capa_t)87,
+	IWL_UCODE_TLV_CAPA_LED_CMD_SUPPORT		= (__force iwl_ucode_tlv_capa_t)88,
 	IWL_UCODE_TLV_CAPA_MLME_OFFLOAD			= (__force iwl_ucode_tlv_capa_t)96,
 
 	NUM_IWL_UCODE_TLV_CAPA
diff --git a/drivers/net/wireless/iwl7000/iwlwifi/iwl-config.h b/drivers/net/wireless/iwl7000/iwlwifi/iwl-config.h
index 21d1fdc..9916eb8a 100644
--- a/drivers/net/wireless/iwl7000/iwlwifi/iwl-config.h
+++ b/drivers/net/wireless/iwl7000/iwlwifi/iwl-config.h
@@ -430,6 +430,7 @@
 extern const struct iwl_cfg iwl4165_2ac_cfg;
 extern const struct iwl_cfg iwl9160_2ac_cfg;
 extern const struct iwl_cfg iwl9260_2ac_cfg;
+extern const struct iwl_cfg iwl9260_killer_2ac_cfg;
 extern const struct iwl_cfg iwl9270_2ac_cfg;
 extern const struct iwl_cfg iwl9460_2ac_cfg;
 extern const struct iwl_cfg iwl9560_2ac_cfg;
@@ -437,10 +438,14 @@
 extern const struct iwl_cfg iwl9461_2ac_cfg_soc;
 extern const struct iwl_cfg iwl9462_2ac_cfg_soc;
 extern const struct iwl_cfg iwl9560_2ac_cfg_soc;
+extern const struct iwl_cfg iwl9560_killer_2ac_cfg_soc;
+extern const struct iwl_cfg iwl9560_killer_s_2ac_cfg_soc;
 extern const struct iwl_cfg iwl9460_2ac_cfg_shared_clk;
 extern const struct iwl_cfg iwl9461_2ac_cfg_shared_clk;
 extern const struct iwl_cfg iwl9462_2ac_cfg_shared_clk;
 extern const struct iwl_cfg iwl9560_2ac_cfg_shared_clk;
+extern const struct iwl_cfg iwl9560_killer_2ac_cfg_shared_clk;
+extern const struct iwl_cfg iwl9560_killer_s_2ac_cfg_shared_clk;
 extern const struct iwl_cfg iwl22000_2ac_cfg_hr;
 extern const struct iwl_cfg iwl22000_2ac_cfg_hr_cdb;
 extern const struct iwl_cfg iwl22000_2ac_cfg_jf;
diff --git a/drivers/net/wireless/iwl7000/iwlwifi/iwl-eeprom-parse.c b/drivers/net/wireless/iwl7000/iwlwifi/iwl-eeprom-parse.c
index 777f5df..5ce4825 100644
--- a/drivers/net/wireless/iwl7000/iwlwifi/iwl-eeprom-parse.c
+++ b/drivers/net/wireless/iwl7000/iwlwifi/iwl-eeprom-parse.c
@@ -745,7 +745,9 @@
 	else
 		rx_chains = hweight8(rx_chains);
 
-	if (!(data->sku_cap_11n_enable) || !cfg->ht_params) {
+	if (!(data->sku_cap_11n_enable) ||
+	    (iwlwifi_mod_params.disable_11n & IWL_DISABLE_HT_ALL) ||
+	    !cfg->ht_params) {
 		ht_info->ht_supported = false;
 		return;
 	}
diff --git a/drivers/net/wireless/iwl7000/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/iwl7000/iwlwifi/iwl-nvm-parse.c
index 8e3365e..c4df12a 100644
--- a/drivers/net/wireless/iwl7000/iwlwifi/iwl-nvm-parse.c
+++ b/drivers/net/wireless/iwl7000/iwlwifi/iwl-nvm-parse.c
@@ -1040,8 +1040,7 @@
 			continue;
 
 		copy_rd->reg_rules[i].wmm_rule = d_wmm +
-			(regd->reg_rules[i].wmm_rule - s_wmm) /
-			sizeof(struct ieee80211_wmm_rule);
+			(regd->reg_rules[i].wmm_rule - s_wmm);
 	}
 #endif
 
@@ -1264,6 +1263,7 @@
 	bool lar_fw_supported = !iwlwifi_mod_params.lar_disable &&
 				fw_has_capa(&fw->ucode_capa,
 					    IWL_UCODE_TLV_CAPA_LAR_SUPPORT);
+	bool empty_otp;
 	u32 mac_flags;
 	u32 sbands_flags = 0;
 
@@ -1279,7 +1279,9 @@
 	}
 
 	rsp = (void *)hcmd.resp_pkt->data;
-	if (le32_to_cpu(rsp->general.flags) & NVM_GENERAL_FLAGS_EMPTY_OTP)
+	empty_otp = !!(le32_to_cpu(rsp->general.flags) &
+		       NVM_GENERAL_FLAGS_EMPTY_OTP);
+	if (empty_otp)
 		IWL_INFO(trans, "OTP is empty\n");
 
 	nvm = kzalloc(sizeof(*nvm) +
@@ -1314,6 +1316,11 @@
 
 	/* Initialize general data */
 	nvm->nvm_version = le16_to_cpu(rsp->general.nvm_version);
+	nvm->n_hw_addrs = rsp->general.n_hw_addrs;
+	if (nvm->n_hw_addrs == 0)
+		IWL_WARN(trans,
+			 "Firmware declares no reserved mac addresses. OTP is empty: %d\n",
+			 empty_otp);
 
 	/* Initialize MAC sku data */
 	mac_flags = le32_to_cpu(rsp->mac_sku.mac_sku_flags);
diff --git a/drivers/net/wireless/iwl7000/iwlwifi/iwl-vendor-cmd.h b/drivers/net/wireless/iwl7000/iwlwifi/iwl-vendor-cmd.h
index d436302..0f693dd 100644
--- a/drivers/net/wireless/iwl7000/iwlwifi/iwl-vendor-cmd.h
+++ b/drivers/net/wireless/iwl7000/iwlwifi/iwl-vendor-cmd.h
@@ -8,6 +8,7 @@
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -18,11 +19,6 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  * General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
- * USA
- *
  * The full GNU General Public License is included in this distribution
  * in the file called COPYING.
  *
@@ -35,6 +31,7 @@
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018 Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -149,39 +146,40 @@
  */
 
 enum iwl_mvm_vendor_cmd {
-	IWL_MVM_VENDOR_CMD_SET_LOW_LATENCY,
-	IWL_MVM_VENDOR_CMD_GET_LOW_LATENCY,
-	IWL_MVM_VENDOR_CMD_TCM_EVENT,
-	IWL_MVM_VENDOR_CMD_LTE_STATE,
-	IWL_MVM_VENDOR_CMD_LTE_COEX_CONFIG_INFO,
-	IWL_MVM_VENDOR_CMD_LTE_COEX_DYNAMIC_INFO,
-	IWL_MVM_VENDOR_CMD_LTE_COEX_SPS_INFO,
-	IWL_MVM_VENDOR_CMD_LTE_COEX_WIFI_RPRTD_CHAN,
-	IWL_MVM_VENDOR_CMD_SET_COUNTRY,
-	IWL_MVM_VENDOR_CMD_PROXY_FRAME_FILTERING,
-	IWL_MVM_VENDOR_CMD_TDLS_PEER_CACHE_ADD,
-	IWL_MVM_VENDOR_CMD_TDLS_PEER_CACHE_DEL,
-	IWL_MVM_VENDOR_CMD_TDLS_PEER_CACHE_QUERY,
-	IWL_MVM_VENDOR_CMD_SET_NIC_TXPOWER_LIMIT,
-	IWL_MVM_VENDOR_CMD_OPPPS_WA,
-	IWL_MVM_VENDOR_CMD_GSCAN_GET_CAPABILITIES,
-	IWL_MVM_VENDOR_CMD_GSCAN_START,
-	IWL_MVM_VENDOR_CMD_GSCAN_STOP,
-	IWL_MVM_VENDOR_CMD_GSCAN_RESULTS_EVENT,
-	IWL_MVM_VENDOR_CMD_GSCAN_SET_BSSID_HOTLIST,
-	IWL_MVM_VENDOR_CMD_GSCAN_SET_SIGNIFICANT_CHANGE,
-	IWL_MVM_VENDOR_CMD_GSCAN_HOTLIST_CHANGE_EVENT,
-	IWL_MVM_VENDOR_CMD_GSCAN_SIGNIFICANT_CHANGE_EVENT,
-	IWL_MVM_VENDOR_CMD_RXFILTER,
-	IWL_MVM_VENDOR_CMD_GSCAN_BEACON_EVENT,
-	IWL_MVM_VENDOR_CMD_DBG_COLLECT,
-	IWL_MVM_VENDOR_CMD_NAN_FAW_CONF,
-	IWL_MVM_VENDOR_CMD_SET_SAR_PROFILE,
-	IWL_MVM_VENDOR_CMD_GET_SAR_PROFILE_INFO,
-	IWL_MVM_VENDOR_CMD_NEIGHBOR_REPORT_REQUEST,
-	IWL_MVM_VENDOR_CMD_NEIGHBOR_REPORT_RESPONSE,
-	IWL_MVM_VENDOR_CMD_GET_SAR_GEO_PROFILE,
-	IWL_MVM_VENDOR_CMD_TEST_FIPS,
+	IWL_MVM_VENDOR_CMD_SET_LOW_LATENCY			= 0x00,
+	IWL_MVM_VENDOR_CMD_GET_LOW_LATENCY			= 0x01,
+	IWL_MVM_VENDOR_CMD_TCM_EVENT				= 0x02,
+	IWL_MVM_VENDOR_CMD_LTE_STATE				= 0x03,
+	IWL_MVM_VENDOR_CMD_LTE_COEX_CONFIG_INFO			= 0x04,
+	IWL_MVM_VENDOR_CMD_LTE_COEX_DYNAMIC_INFO		= 0x05,
+	IWL_MVM_VENDOR_CMD_LTE_COEX_SPS_INFO			= 0x06,
+	IWL_MVM_VENDOR_CMD_LTE_COEX_WIFI_RPRTD_CHAN		= 0x07,
+	IWL_MVM_VENDOR_CMD_SET_COUNTRY				= 0x08,
+	IWL_MVM_VENDOR_CMD_PROXY_FRAME_FILTERING		= 0x09,
+	IWL_MVM_VENDOR_CMD_TDLS_PEER_CACHE_ADD			= 0x0a,
+	IWL_MVM_VENDOR_CMD_TDLS_PEER_CACHE_DEL			= 0x0b,
+	IWL_MVM_VENDOR_CMD_TDLS_PEER_CACHE_QUERY		= 0x0c,
+	IWL_MVM_VENDOR_CMD_SET_NIC_TXPOWER_LIMIT		= 0x0d,
+	IWL_MVM_VENDOR_CMD_OPPPS_WA				= 0x0e,
+	IWL_MVM_VENDOR_CMD_GSCAN_GET_CAPABILITIES		= 0x0f,
+	IWL_MVM_VENDOR_CMD_GSCAN_START				= 0x10,
+	IWL_MVM_VENDOR_CMD_GSCAN_STOP				= 0x11,
+	IWL_MVM_VENDOR_CMD_GSCAN_RESULTS_EVENT			= 0x12,
+	IWL_MVM_VENDOR_CMD_GSCAN_SET_BSSID_HOTLIST		= 0x13,
+	IWL_MVM_VENDOR_CMD_GSCAN_SET_SIGNIFICANT_CHANGE		= 0x14,
+	IWL_MVM_VENDOR_CMD_GSCAN_HOTLIST_CHANGE_EVENT		= 0x15,
+	IWL_MVM_VENDOR_CMD_GSCAN_SIGNIFICANT_CHANGE_EVENT	= 0x16,
+	IWL_MVM_VENDOR_CMD_RXFILTER				= 0x17,
+	IWL_MVM_VENDOR_CMD_GSCAN_BEACON_EVENT			= 0x18,
+	IWL_MVM_VENDOR_CMD_DBG_COLLECT				= 0x19,
+	IWL_MVM_VENDOR_CMD_NAN_FAW_CONF				= 0x1a,
+	/* 0x1b is deprecated */
+	IWL_MVM_VENDOR_CMD_SET_SAR_PROFILE			= 0x1c,
+	IWL_MVM_VENDOR_CMD_GET_SAR_PROFILE_INFO			= 0x1d,
+	IWL_MVM_VENDOR_CMD_NEIGHBOR_REPORT_REQUEST		= 0x1e,
+	IWL_MVM_VENDOR_CMD_NEIGHBOR_REPORT_RESPONSE		= 0x1f,
+	IWL_MVM_VENDOR_CMD_GET_SAR_GEO_PROFILE			= 0x20,
+	IWL_MVM_VENDOR_CMD_TEST_FIPS				= 0x21,
 };
 
 /**
@@ -782,76 +780,79 @@
  *	test. &enum iwl_vendor_fips_test_vector_hw.
  */
 enum iwl_mvm_vendor_attr {
-	__IWL_MVM_VENDOR_ATTR_INVALID,
-	IWL_MVM_VENDOR_ATTR_LOW_LATENCY,
-	IWL_MVM_VENDOR_ATTR_VIF_ADDR,
-	IWL_MVM_VENDOR_ATTR_VIF_LL,
-	IWL_MVM_VENDOR_ATTR_LL,
-	IWL_MVM_VENDOR_ATTR_VIF_LOAD,
-	IWL_MVM_VENDOR_ATTR_LOAD,
-	IWL_MVM_VENDOR_ATTR_COUNTRY,
-	IWL_MVM_VENDOR_ATTR_FILTER_ARP_NA,
-	IWL_MVM_VENDOR_ATTR_FILTER_GTK,
-	IWL_MVM_VENDOR_ATTR_ADDR,
-	IWL_MVM_VENDOR_ATTR_TX_BYTES,
-	IWL_MVM_VENDOR_ATTR_RX_BYTES,
-	IWL_MVM_VENDOR_ATTR_TXP_LIMIT_24,
-	IWL_MVM_VENDOR_ATTR_TXP_LIMIT_52L,
-	IWL_MVM_VENDOR_ATTR_TXP_LIMIT_52H,
-	IWL_MVM_VENDOR_ATTR_OPPPS_WA,
-	IWL_MVM_VENDOR_ATTR_GSCAN_MAX_SCAN_CACHE_SIZE,
-	IWL_MVM_VENDOR_ATTR_GSCAN_MAX_SCAN_BUCKETS,
-	IWL_MVM_VENDOR_ATTR_GSCAN_MAX_AP_CACHE_PER_SCAN,
-	IWL_MVM_VENDOR_ATTR_GSCAN_MAX_RSSI_SAMPLE_SIZE,
-	IWL_MVM_VENDOR_ATTR_GSCAN_MAX_SCAN_REPORTING_THRESHOLD,
-	IWL_MVM_VENDOR_ATTR_GSCAN_MAX_HOTLIST_APS,
-	IWL_MVM_VENDOR_ATTR_GSCAN_MAX_SIGNIFICANT_CHANGE_APS,
-	IWL_MVM_VENDOR_ATTR_GSCAN_MAX_BSSID_HISTORY_ENTRIES,
-	IWL_MVM_VENDOR_ATTR_GSCAN_MAC_ADDR,
-	IWL_MVM_VENDOR_ATTR_GSCAN_MAC_ADDR_MASK,
-	IWL_MVM_VENDOR_ATTR_GSCAN_MAX_AP_PER_SCAN,
-	IWL_MVM_VENDOR_ATTR_GSCAN_REPORT_THRESHOLD,
-	IWL_MVM_VENDOR_ATTR_GSCAN_BUCKET_SPECS,
-	IWL_MVM_VENDOR_ATTR_GSCAN_RESULTS_EVENT_TYPE,
-	IWL_MVM_VENDOR_ATTR_GSCAN_RESULTS,
-	IWL_MVM_VENDOR_ATTR_GSCAN_LOST_AP_SAMPLE_SIZE,
-	IWL_MVM_VENDOR_ATTR_GSCAN_AP_LIST,
-	IWL_MVM_VENDOR_ATTR_GSCAN_RSSI_SAMPLE_SIZE,
-	IWL_MVM_VENDOR_ATTR_GSCAN_MIN_BREACHING,
-	IWL_MVM_VENDOR_ATTR_GSCAN_HOTLIST_AP_STATUS,
-	IWL_MVM_VENDOR_ATTR_GSCAN_SIG_CHANGE_RESULTS,
-	IWL_MVM_VENDOR_ATTR_RXFILTER,
-	IWL_MVM_VENDOR_ATTR_RXFILTER_OP,
-	IWL_MVM_VENDOR_ATTR_DBG_COLLECT_TRIGGER,
-	IWL_MVM_VENDOR_ATTR_NAN_FAW_FREQ,
-	IWL_MVM_VENDOR_ATTR_NAN_FAW_SLOTS,
-	IWL_MVM_VENDOR_ATTR_GSCAN_MAX_HOTLIST_SSIDS,
-	IWL_MVM_VENDOR_ATTR_GSCAN_MAX_NUM_EPNO_NETWORKS,
-	IWL_MVM_VENDOR_ATTR_GSCAN_MAX_NUM_EPNO_NETWORKS_BY_SSID,
-	IWL_MVM_VENDOR_ATTR_GSCAN_MAX_NUM_WHITE_LISTED_SSID,
-	IWL_MVM_VENDOR_ATTR_GSCAN_MAX_NUM_BLACK_LISTED_SSID,
-	IWL_MVM_VENDOR_ATTR_WIPHY_FREQ,
-	IWL_MVM_VENDOR_ATTR_CHANNEL_WIDTH,
-	IWL_MVM_VENDOR_ATTR_CENTER_FREQ1,
-	IWL_MVM_VENDOR_ATTR_CENTER_FREQ2,
-	IWL_MVM_VENDOR_ATTR_GSCAN_REPORT_THRESHOLD_NUM,
-	IWL_MVM_VENDOR_ATTR_GSCAN_CACHED_RESULTS,
-	IWL_MVM_VENDOR_ATTR_LAST_MSG,
-	IWL_MVM_VENDOR_ATTR_SAR_CHAIN_A_PROFILE,
-	IWL_MVM_VENDOR_ATTR_SAR_CHAIN_B_PROFILE,
-	IWL_MVM_VENDOR_ATTR_SAR_ENABLED_PROFILE_NUM,
-	IWL_MVM_VENDOR_ATTR_SSID,
-	IWL_MVM_VENDOR_ATTR_NEIGHBOR_LCI,
-	IWL_MVM_VENDOR_ATTR_NEIGHBOR_CIVIC,
-	IWL_MVM_VENDOR_ATTR_NEIGHBOR_REPORT,
-	IWL_MVM_VENDOR_ATTR_SAR_GEO_PROFILE,
-	IWL_MVM_VENDOR_ATTR_FIPS_TEST_VECTOR_SHA,
-	IWL_MVM_VENDOR_ATTR_FIPS_TEST_VECTOR_HMAC,
-	IWL_MVM_VENDOR_ATTR_FIPS_TEST_VECTOR_KDF,
-	IWL_MVM_VENDOR_ATTR_FIPS_TEST_RESULT,
-	IWL_MVM_VENDOR_ATTR_FIPS_TEST_VECTOR_HW_AES,
-	IWL_MVM_VENDOR_ATTR_FIPS_TEST_VECTOR_HW_CCM,
-	IWL_MVM_VENDOR_ATTR_FIPS_TEST_VECTOR_HW_GCM,
+	__IWL_MVM_VENDOR_ATTR_INVALID				= 0x00,
+	IWL_MVM_VENDOR_ATTR_LOW_LATENCY				= 0x01,
+	IWL_MVM_VENDOR_ATTR_VIF_ADDR				= 0x02,
+	IWL_MVM_VENDOR_ATTR_VIF_LL				= 0x03,
+	IWL_MVM_VENDOR_ATTR_LL					= 0x04,
+	IWL_MVM_VENDOR_ATTR_VIF_LOAD				= 0x05,
+	IWL_MVM_VENDOR_ATTR_LOAD				= 0x06,
+	IWL_MVM_VENDOR_ATTR_COUNTRY				= 0x07,
+	IWL_MVM_VENDOR_ATTR_FILTER_ARP_NA			= 0x08,
+	IWL_MVM_VENDOR_ATTR_FILTER_GTK				= 0x09,
+	IWL_MVM_VENDOR_ATTR_ADDR				= 0x0a,
+	IWL_MVM_VENDOR_ATTR_TX_BYTES				= 0x0b,
+	IWL_MVM_VENDOR_ATTR_RX_BYTES				= 0x0c,
+	IWL_MVM_VENDOR_ATTR_TXP_LIMIT_24			= 0x0d,
+	IWL_MVM_VENDOR_ATTR_TXP_LIMIT_52L			= 0x0e,
+	IWL_MVM_VENDOR_ATTR_TXP_LIMIT_52H			= 0x0f,
+	IWL_MVM_VENDOR_ATTR_OPPPS_WA				= 0x10,
+	IWL_MVM_VENDOR_ATTR_GSCAN_MAX_SCAN_CACHE_SIZE		= 0x11,
+	IWL_MVM_VENDOR_ATTR_GSCAN_MAX_SCAN_BUCKETS		= 0x12,
+	IWL_MVM_VENDOR_ATTR_GSCAN_MAX_AP_CACHE_PER_SCAN		= 0x13,
+	IWL_MVM_VENDOR_ATTR_GSCAN_MAX_RSSI_SAMPLE_SIZE		= 0x14,
+	IWL_MVM_VENDOR_ATTR_GSCAN_MAX_SCAN_REPORTING_THRESHOLD	= 0x15,
+	IWL_MVM_VENDOR_ATTR_GSCAN_MAX_HOTLIST_APS		= 0x16,
+	IWL_MVM_VENDOR_ATTR_GSCAN_MAX_SIGNIFICANT_CHANGE_APS	= 0x17,
+	IWL_MVM_VENDOR_ATTR_GSCAN_MAX_BSSID_HISTORY_ENTRIES	= 0x18,
+	IWL_MVM_VENDOR_ATTR_GSCAN_MAC_ADDR			= 0x19,
+	IWL_MVM_VENDOR_ATTR_GSCAN_MAC_ADDR_MASK			= 0x1a,
+	IWL_MVM_VENDOR_ATTR_GSCAN_MAX_AP_PER_SCAN		= 0x1b,
+	IWL_MVM_VENDOR_ATTR_GSCAN_REPORT_THRESHOLD		= 0x1c,
+	IWL_MVM_VENDOR_ATTR_GSCAN_BUCKET_SPECS			= 0x1d,
+	IWL_MVM_VENDOR_ATTR_GSCAN_RESULTS_EVENT_TYPE		= 0x1e,
+	IWL_MVM_VENDOR_ATTR_GSCAN_RESULTS			= 0x1f,
+	IWL_MVM_VENDOR_ATTR_GSCAN_LOST_AP_SAMPLE_SIZE		= 0x20,
+	IWL_MVM_VENDOR_ATTR_GSCAN_AP_LIST			= 0x21,
+	IWL_MVM_VENDOR_ATTR_GSCAN_RSSI_SAMPLE_SIZE		= 0x22,
+	IWL_MVM_VENDOR_ATTR_GSCAN_MIN_BREACHING			= 0x23,
+	IWL_MVM_VENDOR_ATTR_GSCAN_HOTLIST_AP_STATUS		= 0x24,
+	IWL_MVM_VENDOR_ATTR_GSCAN_SIG_CHANGE_RESULTS		= 0x25,
+	IWL_MVM_VENDOR_ATTR_RXFILTER				= 0x26,
+	IWL_MVM_VENDOR_ATTR_RXFILTER_OP				= 0x27,
+	IWL_MVM_VENDOR_ATTR_DBG_COLLECT_TRIGGER			= 0x28,
+	IWL_MVM_VENDOR_ATTR_NAN_FAW_FREQ			= 0x29,
+	IWL_MVM_VENDOR_ATTR_NAN_FAW_SLOTS			= 0x2a,
+	IWL_MVM_VENDOR_ATTR_GSCAN_MAX_HOTLIST_SSIDS		= 0x2b,
+	IWL_MVM_VENDOR_ATTR_GSCAN_MAX_NUM_EPNO_NETWORKS		= 0x2c,
+	IWL_MVM_VENDOR_ATTR_GSCAN_MAX_NUM_EPNO_NETWORKS_BY_SSID	= 0x2d,
+	IWL_MVM_VENDOR_ATTR_GSCAN_MAX_NUM_WHITE_LISTED_SSID	= 0x2e,
+	IWL_MVM_VENDOR_ATTR_GSCAN_MAX_NUM_BLACK_LISTED_SSID	= 0x2f,
+	IWL_MVM_VENDOR_ATTR_WIPHY_FREQ				= 0x30,
+	IWL_MVM_VENDOR_ATTR_CHANNEL_WIDTH			= 0x31,
+	IWL_MVM_VENDOR_ATTR_CENTER_FREQ1			= 0x32,
+	IWL_MVM_VENDOR_ATTR_CENTER_FREQ2			= 0x33,
+	/* 0x34 is deprecated */
+	/* 0x35 is deprecated */
+	/* 0x36 is deprecated */
+	IWL_MVM_VENDOR_ATTR_GSCAN_REPORT_THRESHOLD_NUM		= 0x37,
+	IWL_MVM_VENDOR_ATTR_GSCAN_CACHED_RESULTS		= 0x38,
+	IWL_MVM_VENDOR_ATTR_LAST_MSG				= 0x39,
+	IWL_MVM_VENDOR_ATTR_SAR_CHAIN_A_PROFILE			= 0x3a,
+	IWL_MVM_VENDOR_ATTR_SAR_CHAIN_B_PROFILE			= 0x3b,
+	IWL_MVM_VENDOR_ATTR_SAR_ENABLED_PROFILE_NUM		= 0x3c,
+	IWL_MVM_VENDOR_ATTR_SSID				= 0x3d,
+	IWL_MVM_VENDOR_ATTR_NEIGHBOR_LCI			= 0x3e,
+	IWL_MVM_VENDOR_ATTR_NEIGHBOR_CIVIC			= 0x3f,
+	IWL_MVM_VENDOR_ATTR_NEIGHBOR_REPORT			= 0x40,
+	IWL_MVM_VENDOR_ATTR_SAR_GEO_PROFILE			= 0x41,
+	IWL_MVM_VENDOR_ATTR_FIPS_TEST_VECTOR_SHA		= 0x42,
+	IWL_MVM_VENDOR_ATTR_FIPS_TEST_VECTOR_HMAC		= 0x43,
+	IWL_MVM_VENDOR_ATTR_FIPS_TEST_VECTOR_KDF		= 0x44,
+	IWL_MVM_VENDOR_ATTR_FIPS_TEST_RESULT			= 0x45,
+	IWL_MVM_VENDOR_ATTR_FIPS_TEST_VECTOR_HW_AES		= 0x46,
+	IWL_MVM_VENDOR_ATTR_FIPS_TEST_VECTOR_HW_CCM		= 0x47,
+	IWL_MVM_VENDOR_ATTR_FIPS_TEST_VECTOR_HW_GCM		= 0x48,
 
 	NUM_IWL_MVM_VENDOR_ATTR,
 	MAX_IWL_MVM_VENDOR_ATTR = NUM_IWL_MVM_VENDOR_ATTR - 1,
diff --git a/drivers/net/wireless/iwl7000/iwlwifi/mvm/d3.c b/drivers/net/wireless/iwl7000/iwlwifi/mvm/d3.c
index 289ddf3..abc693e 100644
--- a/drivers/net/wireless/iwl7000/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/iwl7000/iwlwifi/mvm/d3.c
@@ -732,8 +732,10 @@
 {
 	struct iwl_wowlan_kek_kck_material_cmd kek_kck_cmd = {};
 	struct iwl_wowlan_tkip_params_cmd tkip_cmd = {};
+	bool unified = fw_has_capa(&mvm->fw->ucode_capa,
+				   IWL_UCODE_TLV_CAPA_CNSLDTD_D3_D0_IMG);
 	struct wowlan_key_data key_data = {
-		.configure_keys = !d0i3,
+		.configure_keys = !d0i3 && !unified,
 		.use_rsc_tsc = false,
 		.tkip = &tkip_cmd,
 		.use_tkip = false,
diff --git a/drivers/net/wireless/iwl7000/iwlwifi/mvm/debugfs-vif.c b/drivers/net/wireless/iwl7000/iwlwifi/mvm/debugfs-vif.c
index cce6262..7212f30 100644
--- a/drivers/net/wireless/iwl7000/iwlwifi/mvm/debugfs-vif.c
+++ b/drivers/net/wireless/iwl7000/iwlwifi/mvm/debugfs-vif.c
@@ -261,7 +261,7 @@
 	case NL80211_IFTYPE_P2P_DEVICE:
 		pos += scnprintf(buf+pos, bufsz-pos, "type: p2p dev\n");
 		break;
-#if CFG80211_VERSION >= KERNEL_VERSION(4,9,0)
+#if CFG80211_VERSION >= KERNEL_VERSION(4,4,0)
 	case NL80211_IFTYPE_NAN:
 		/* keep code in case of fall-through (spatch generated) */
 #endif
diff --git a/drivers/net/wireless/iwl7000/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwl7000/iwlwifi/mvm/mac80211.c
index 7150444..1af48fc 100644
--- a/drivers/net/wireless/iwl7000/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwl7000/iwlwifi/mvm/mac80211.c
@@ -97,6 +97,41 @@
 #include "tof.h"
 #include "fw/api/nan.h"
 
+/* The ETSI patches were introduced in 4.17 and backported to
+ * chromeos-4.4, we need our limits on any version outside that
+ */
+#if (CFG80211_VERSION < KERNEL_VERSION(4,17,0) &&	\
+	!(CFG80211_VERSION >= KERNEL_VERSION(4,4,0) && \
+	  CFG80211_VERSION < KERNEL_VERSION(4,5,0)))
+#define IWL7000_NEED_ETSI_WMM_LIMITS
+#endif
+
+#ifdef IWL7000_NEED_ETSI_WMM_LIMITS
+const static struct ieee80211_wmm_rule wmm_rules = {
+	.client = {
+		{.cw_min = 3, .cw_max = 7, .aifsn = 2, .cot = 2000},
+		{.cw_min = 7, .cw_max = 15, .aifsn = 2, .cot = 4000},
+		{.cw_min = 15, .cw_max = 1023, .aifsn = 3, .cot = 6000},
+		{.cw_min = 15, .cw_max = 1023, .aifsn = 7, .cot = 6000},
+		},
+	.ap = {
+		{.cw_min = 3, .cw_max = 7, .aifsn = 1, .cot = 2000},
+		{.cw_min = 7, .cw_max = 15, .aifsn = 1, .cot = 4000},
+		{.cw_min = 15, .cw_max = 63, .aifsn = 3, .cot = 6000},
+		{.cw_min = 15, .cw_max = 1023, .aifsn = 7, .cot = 6000},
+	}
+};
+
+const static char *wmm_cc_list[] = {
+	"AT", "BE", "BA", "BG", "HR", "CY", "CZ", "DK", "EE", "FI", "FR", "DE",
+	"GR", "HU", "IS", "IE", "IT", "LV", "LI", "LT", "LU", "MK", "MT", "ME",
+	"NL", "NO", "PL", "PT", "RO", "SK", "SI", "ES", "SE", "CH", "GB", "GF",
+	"PF", "GP", "MQ", "YT", "MC", "NC", "RE", "MF", "PM", "WF", "SM", "VA",
+	"CW", "BQ", "SX", "GL", "AD", "AI", "FK", "JE", "GI", "GG", "MS", "SH",
+	"TC", "VG",
+};
+#endif
+
 static const struct ieee80211_iface_limit iwl_mvm_limits[] = {
 	{
 		.max = CPTCFG_IWLWIFI_NUM_STA_INTERFACES,
@@ -591,7 +626,7 @@
 		hw->wiphy->n_cipher_suites++;
 	}
 
-#if CFG80211_VERSION >= KERNEL_VERSION(4,99,0)
+#if CFG80211_VERSION >= KERNEL_VERSION(99,0,0)
 	/* Basic support of FTM is limited to driver/FW, so this flag should be
 	 * set (depending on capbilities specified in TLV).
 	 */
@@ -2438,6 +2473,9 @@
 
 	iwl_mvm_mac_ctxt_remove(mvm, vif);
 
+	kfree(mvmvif->ap_wep_key);
+	mvmvif->ap_wep_key = NULL;
+
 	mutex_unlock(&mvm->mutex);
 }
 
@@ -2934,7 +2972,13 @@
 		iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band,
 				     true);
 
-		ret = 0;
+		/* if wep is used, need to set the key for the station now */
+		if (vif->type == NL80211_IFTYPE_AP && mvmvif->ap_wep_key)
+			ret = iwl_mvm_set_sta_key(mvm, vif, sta,
+						  mvmvif->ap_wep_key,
+						  STA_KEY_IDX_INVALID);
+		else
+			ret = 0;
 	} else if (old_state == IEEE80211_STA_AUTHORIZED &&
 		   new_state == IEEE80211_STA_ASSOC) {
 		/* disable beacon filtering */
@@ -2996,6 +3040,60 @@
 		iwl_mvm_sf_update(mvm, vif, false);
 }
 
+#ifdef IWL7000_NEED_ETSI_WMM_LIMITS
+static void iwl_mvm_limit_wmm_ac(struct iwl_mvm *mvm,
+				 struct ieee80211_vif *vif,
+				 struct ieee80211_tx_queue_params *params,
+				 u16 ac)
+{
+	struct ieee80211_regdomain *rd;
+	struct ieee80211_chanctx_conf *chanctx_conf;
+	const struct ieee80211_wmm_ac *wmm_ac;
+	u16 center_freq = 0;
+	int i;
+
+	rcu_read_lock();
+	chanctx_conf = rcu_dereference(vif->chanctx_conf);
+	if (chanctx_conf)
+		center_freq = chanctx_conf->def.chan->center_freq;
+
+	rcu_read_unlock();
+
+	if (!center_freq || center_freq < 5180 || center_freq > 5720)
+		return;
+
+	if (vif->type != NL80211_IFTYPE_STATION &&
+	    vif->type != NL80211_IFTYPE_AP &&
+	    vif->type != NL80211_IFTYPE_P2P_CLIENT &&
+	    vif->type != NL80211_IFTYPE_P2P_GO)
+		return;
+
+	rd = iwl_mvm_get_current_regdomain(mvm, NULL);
+	if (IS_ERR_OR_NULL(rd))
+		return;
+
+	for  (i = 0; i < ARRAY_SIZE(wmm_cc_list); i++) {
+		if (!strncmp(wmm_cc_list[i], rd->alpha2, 2)) {
+			if (vif->type == NL80211_IFTYPE_STATION ||
+			    vif->type == NL80211_IFTYPE_P2P_CLIENT)
+				wmm_ac = &wmm_rules.client[ac];
+			else
+				wmm_ac = &wmm_rules.ap[ac];
+
+			params->txop =
+				min_t(u16, params->txop, wmm_ac->cot / 32);
+			params->cw_min =
+				max_t(u16, params->cw_min, wmm_ac->cw_min);
+			params->cw_max =
+				max_t(u16, params->cw_max, wmm_ac->cw_max);
+			params->aifs =
+				max_t(u8, params->aifs, wmm_ac->aifsn);
+			return;
+		}
+	}
+}
+#endif
+
 static int iwl_mvm_mac_conf_tx(struct ieee80211_hw *hw,
 			       struct ieee80211_vif *vif, u16 ac,
 			       const struct ieee80211_tx_queue_params *params)
@@ -3005,6 +3103,10 @@
 
 	mvmvif->queue_params[ac] = *params;
 
+#ifdef IWL7000_NEED_ETSI_WMM_LIMITS
+	iwl_mvm_limit_wmm_ac(mvm, vif, &mvmvif->queue_params[ac], ac);
+#endif
+
 	/*
 	 * No need to update right away, we'll get BSS_CHANGED_QOS
 	 * The exception is P2P_DEVICE interface which needs immediate update.
@@ -3133,13 +3235,17 @@
 		break;
 	case WLAN_CIPHER_SUITE_WEP40:
 	case WLAN_CIPHER_SUITE_WEP104:
-		/* For non-client mode, only use WEP keys for TX as we probably
-		 * don't have a station yet anyway and would then have to keep
-		 * track of the keys, linking them to each of the clients/peers
-		 * as they appear. For now, don't do that, for performance WEP
-		 * offload doesn't really matter much, but we need it for some
-		 * other offload features in client mode.
-		 */
+		if (vif->type == NL80211_IFTYPE_AP) {
+			struct iwl_mvm_vif *mvmvif =
+				iwl_mvm_vif_from_mac80211(vif);
+
+			mvmvif->ap_wep_key = kmemdup(key,
+						     sizeof(*key) + key->keylen,
+						     GFP_KERNEL);
+			if (!mvmvif->ap_wep_key)
+				return -ENOMEM;
+		}
+
 		if (vif->type != NL80211_IFTYPE_STATION)
 			return 0;
 		break;
@@ -4687,7 +4793,7 @@
 	return ret;
 }
 
-#if CFG80211_VERSION >= KERNEL_VERSION(4,99,0)
+#if CFG80211_VERSION >= KERNEL_VERSION(99,0,0)
 static int
 iwl_mvm_mac_get_ftm_responder_stats(struct ieee80211_hw *hw,
 				    struct ieee80211_vif *vif,
@@ -4796,7 +4902,7 @@
 	.perform_ftm = iwl_mvm_perform_ftm,
 	.abort_ftm = iwl_mvm_abort_ftm,
 	.start_ftm_responder = iwl_mvm_mac_start_ftm_responder,
-#if CFG80211_VERSION >= KERNEL_VERSION(4,99,0)
+#if CFG80211_VERSION >= KERNEL_VERSION(99,0,0)
 	.get_ftm_responder_stats = iwl_mvm_mac_get_ftm_responder_stats,
 #endif
 
diff --git a/drivers/net/wireless/iwl7000/iwlwifi/mvm/mvm.h b/drivers/net/wireless/iwl7000/iwlwifi/mvm/mvm.h
index fe5f970..a61c4e5 100644
--- a/drivers/net/wireless/iwl7000/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/iwl7000/iwlwifi/mvm/mvm.h
@@ -471,6 +471,8 @@
 	netdev_features_t features;
 
 	bool ftm_responder;
+
+	struct ieee80211_key_conf *ap_wep_key;
 };
 
 static inline struct iwl_mvm_vif *
diff --git a/drivers/net/wireless/iwl7000/iwlwifi/mvm/ops.c b/drivers/net/wireless/iwl7000/iwlwifi/mvm/ops.c
index b250ccf..7120ce5 100644
--- a/drivers/net/wireless/iwl7000/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/iwl7000/iwlwifi/mvm/ops.c
@@ -813,10 +813,6 @@
 		trans_cfg.rx_buf_size = IWL_AMSDU_4K;
 	}
 
-	/* the hardware splits the A-MSDU */
-	if (mvm->cfg->mq_rx_supported)
-		trans_cfg.rx_buf_size = IWL_AMSDU_4K;
-
 	trans->wide_cmd_header = true;
 	trans_cfg.bc_table_dword = true;
 
diff --git a/drivers/net/wireless/iwl7000/iwlwifi/mvm/power.c b/drivers/net/wireless/iwl7000/iwlwifi/mvm/power.c
index 9866d617..17b9d57e 100644
--- a/drivers/net/wireless/iwl7000/iwlwifi/mvm/power.c
+++ b/drivers/net/wireless/iwl7000/iwlwifi/mvm/power.c
@@ -284,7 +284,7 @@
 	switch (vif->type) {
 	case NL80211_IFTYPE_AP:
 	case NL80211_IFTYPE_ADHOC:
-#if CFG80211_VERSION >= KERNEL_VERSION(4,9,0)
+#if CFG80211_VERSION >= KERNEL_VERSION(4,4,0)
 	case NL80211_IFTYPE_NAN:
 		/* keep code in case of fall-through (spatch generated) */
 #endif
@@ -629,7 +629,7 @@
 
 	switch (ieee80211_vif_type_p2p(vif)) {
 	case NL80211_IFTYPE_P2P_DEVICE:
-#if CFG80211_VERSION >= KERNEL_VERSION(4,9,0)
+#if CFG80211_VERSION >= KERNEL_VERSION(4,4,0)
 	case NL80211_IFTYPE_NAN:
 		/* keep code in case of fall-through (spatch generated) */
 #endif
diff --git a/drivers/net/wireless/iwl7000/iwlwifi/mvm/quota.c b/drivers/net/wireless/iwl7000/iwlwifi/mvm/quota.c
index 838fe49..bc28374 100644
--- a/drivers/net/wireless/iwl7000/iwlwifi/mvm/quota.c
+++ b/drivers/net/wireless/iwl7000/iwlwifi/mvm/quota.c
@@ -8,6 +8,7 @@
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * Copyright (C) 2018 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -35,6 +36,7 @@
  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
  * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * Copyright (C) 2018 Intel Corporation
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -121,7 +123,7 @@
 			break;
 		return;
 	case NL80211_IFTYPE_P2P_DEVICE:
-#if CFG80211_VERSION >= KERNEL_VERSION(4,9,0)
+#if CFG80211_VERSION >= KERNEL_VERSION(4,4,0)
 	case NL80211_IFTYPE_NAN:
 		/* keep code in case of fall-through (spatch generated) */
 #endif
@@ -168,9 +170,12 @@
 
 	phy_id = mvm->p2p_opps_test_wa_vif->phy_ctxt->id;
 	for (i = 0; i < MAX_BINDINGS; i++) {
+		u32 id;
+		u32 id_n_c;
+
 		quota = iwl_mvm_quota_cmd_get_quota(mvm, cmd, i);
-		u32 id_n_c = le32_to_cpu(quota->id_and_color);
-		u32 id = (id_n_c & FW_CTXT_ID_MSK) >> FW_CTXT_ID_POS;
+		id_n_c = le32_to_cpu(quota->id_and_color);
+		id = (id_n_c & FW_CTXT_ID_MSK) >> FW_CTXT_ID_POS;
 
 		if (id != phy_id)
 			continue;
diff --git a/drivers/net/wireless/iwl7000/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/iwl7000/iwlwifi/mvm/rxmq.c
index 523405a..b20e939 100644
--- a/drivers/net/wireless/iwl7000/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/iwl7000/iwlwifi/mvm/rxmq.c
@@ -607,14 +607,10 @@
 	notif = (void *)pkt->data;
 	internal_notif = (void *)notif->payload;
 
-	if (internal_notif->sync) {
-		if (mvm->queue_sync_cookie != internal_notif->cookie) {
-			WARN_ONCE(1,
-				  "Received expired RX queue sync message\n");
-			return;
-		}
-		if (!atomic_dec_return(&mvm->queue_sync_counter))
-			wake_up(&mvm->rx_sync_waitq);
+	if (internal_notif->sync &&
+	    mvm->queue_sync_cookie != internal_notif->cookie) {
+		WARN_ONCE(1, "Received expired RX queue sync message\n");
+		return;
 	}
 
 	switch (internal_notif->type) {
@@ -626,6 +622,10 @@
 	default:
 		WARN_ONCE(1, "Invalid identifier %d", internal_notif->type);
 	}
+
+	if (internal_notif->sync &&
+	    !atomic_dec_return(&mvm->queue_sync_counter))
+		wake_up(&mvm->rx_sync_waitq);
 }
 
 /*
diff --git a/drivers/net/wireless/iwl7000/iwlwifi/mvm/sta.c b/drivers/net/wireless/iwl7000/iwlwifi/mvm/sta.c
index 18db1ed..ccefc6b 100644
--- a/drivers/net/wireless/iwl7000/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/iwl7000/iwlwifi/mvm/sta.c
@@ -72,6 +72,14 @@
 #include "sta.h"
 #include "rs.h"
 
+static int iwl_mvm_set_fw_key_idx(struct iwl_mvm *mvm);
+
+static int iwl_mvm_send_sta_key(struct iwl_mvm *mvm,
+				u32 sta_id,
+				struct ieee80211_key_conf *key, bool mcast,
+				u32 tkip_iv32, u16 *tkip_p1k, u32 cmd_flags,
+				u8 key_offset, bool mfp);
+
 /*
  * New version of ADD_STA_sta command added new fields at the end of the
  * structure, so sending the size of the relevant API's structure is enough to
@@ -2101,6 +2109,19 @@
 		iwl_mvm_enable_txq(mvm, vif->cab_queue, vif->cab_queue, 0,
 				   &cfg, timeout);
 
+	if (mvmvif->ap_wep_key) {
+		u8 key_offset = iwl_mvm_set_fw_key_idx(mvm);
+
+		if (key_offset == STA_KEY_IDX_INVALID)
+			return -ENOSPC;
+
+		ret = iwl_mvm_send_sta_key(mvm, mvmvif->mcast_sta.sta_id,
+					   mvmvif->ap_wep_key, 1, 0, NULL, 0,
+					   key_offset, 0);
+		if (ret)
+			return ret;
+	}
+
 	return 0;
 }
 
@@ -3133,10 +3154,6 @@
 
 	switch (keyconf->cipher) {
 	case WLAN_CIPHER_SUITE_TKIP:
-		if (vif->type == NL80211_IFTYPE_AP) {
-			ret = -EINVAL;
-			break;
-		}
 		addr = iwl_mvm_get_mac_addr(mvm, vif, sta);
 		/* get phase 1 key from mac80211 */
 		ieee80211_get_key_rx_seq(keyconf, 0, &seq);
diff --git a/drivers/net/wireless/iwl7000/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwl7000/iwlwifi/mvm/tx.c
index 9cab171f..052d636 100644
--- a/drivers/net/wireless/iwl7000/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/iwl7000/iwlwifi/mvm/tx.c
@@ -654,7 +654,7 @@
 		if (info.control.vif->type == NL80211_IFTYPE_P2P_DEVICE ||
 		    info.control.vif->type == NL80211_IFTYPE_AP ||
 		    info.control.vif->type == NL80211_IFTYPE_ADHOC) {
-			if (info.control.vif->type == NL80211_IFTYPE_P2P_DEVICE)
+			if (!ieee80211_is_data(hdr->frame_control))
 				sta_id = mvmvif->bcast_sta.sta_id;
 			else
 				sta_id = mvmvif->mcast_sta.sta_id;
@@ -850,8 +850,10 @@
 	 * N * subf_len + (N - 1) * pad.
 	 */
 	num_subframes = (max_amsdu_len + pad) / (subf_len + pad);
-	if (num_subframes > 1)
-		*ieee80211_get_qos_ctl(hdr) |= IEEE80211_QOS_CTL_A_MSDU_PRESENT;
+
+	if (sta->max_amsdu_subframes &&
+	    num_subframes > sta->max_amsdu_subframes)
+		num_subframes = sta->max_amsdu_subframes;
 
 	tcp_payload_len = skb_tail_pointer(skb) - skb_transport_header(skb) -
 		tcp_hdrlen(skb) + skb->data_len;
@@ -862,10 +864,12 @@
 	 *	1 more for each fragment
 	 *	1 more for the potential data in the header
 	 */
-	num_subframes =
-		min_t(unsigned int, num_subframes,
-		      (mvm->trans->max_skb_frags - 1 -
-		       skb_shinfo(skb)->nr_frags) / 2);
+	if ((num_subframes * 2 + skb_shinfo(skb)->nr_frags + 1) >
+	    mvm->trans->max_skb_frags)
+		num_subframes = 1;
+
+	if (num_subframes > 1)
+		*ieee80211_get_qos_ctl(hdr) |= IEEE80211_QOS_CTL_A_MSDU_PRESENT;
 
 	/* This skb fits in one single A-MSDU */
 	if (num_subframes * mss >= tcp_payload_len) {
@@ -1394,6 +1398,7 @@
 	while (!skb_queue_empty(&skbs)) {
 		struct sk_buff *skb = __skb_dequeue(&skbs);
 		struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+		struct ieee80211_hdr *hdr = (void *)skb->data;
 		bool flushed = false;
 
 		skb_freed++;
@@ -1423,6 +1428,14 @@
 			break;
 		}
 
+		/*
+		 * If we are freeing multiple frames, mark all the frames
+		 * but the first one as acked, since they were acknowledged
+		 * before
+		 * */
+		if (skb_freed > 1)
+			info->flags |= IEEE80211_TX_STAT_ACK;
+
 		iwl_mvm_tx_status_check_trigger(mvm, status);
 
 		info->status.rates[0].count = tx_resp->failure_frame + 1;
@@ -1439,11 +1452,11 @@
 			info->flags |= IEEE80211_TX_STAT_AMPDU_NO_BACK;
 		info->flags &= ~IEEE80211_TX_CTL_AMPDU;
 
-		/* W/A FW bug: seq_ctl is wrong when the status isn't success */
-		if (status != TX_STATUS_SUCCESS) {
-			struct ieee80211_hdr *hdr = (void *)skb->data;
+		/* W/A FW bug: seq_ctl is wrong upon failure / BAR frame */
+		if (ieee80211_is_back_req(hdr->frame_control))
+			seq_ctl = 0;
+		else if (status != TX_STATUS_SUCCESS)
 			seq_ctl = le16_to_cpu(hdr->seq_ctrl);
-		}
 
 		if (unlikely(!seq_ctl)) {
 			struct ieee80211_hdr *hdr = (void *)skb->data;
diff --git a/drivers/net/wireless/iwl7000/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwl7000/iwlwifi/pcie/drv.c
index 00553aa..a0240c2 100644
--- a/drivers/net/wireless/iwl7000/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwl7000/iwlwifi/pcie/drv.c
@@ -357,6 +357,9 @@
 	{IWL_PCI_DEVICE(0x2526, 0x1210, iwl9260_2ac_cfg)},
 	{IWL_PCI_DEVICE(0x2526, 0x1410, iwl9270_2ac_cfg)},
 	{IWL_PCI_DEVICE(0x2526, 0x1420, iwl9460_2ac_cfg_soc)},
+	{IWL_PCI_DEVICE(0x2526, 0x1550, iwl9260_killer_2ac_cfg)},
+	{IWL_PCI_DEVICE(0x2526, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+	{IWL_PCI_DEVICE(0x2526, 0x1552, iwl9560_killer_2ac_cfg_soc)},
 	{IWL_PCI_DEVICE(0x2526, 0x1610, iwl9270_2ac_cfg)},
 	{IWL_PCI_DEVICE(0x2526, 0x2030, iwl9560_2ac_cfg_soc)},
 	{IWL_PCI_DEVICE(0x2526, 0x2034, iwl9560_2ac_cfg_soc)},
@@ -366,6 +369,7 @@
 	{IWL_PCI_DEVICE(0x2526, 0x40A4, iwl9460_2ac_cfg)},
 	{IWL_PCI_DEVICE(0x2526, 0x4234, iwl9560_2ac_cfg_soc)},
 	{IWL_PCI_DEVICE(0x2526, 0x42A4, iwl9462_2ac_cfg_soc)},
+	{IWL_PCI_DEVICE(0x2526, 0x8014, iwl9260_2ac_cfg)},
 	{IWL_PCI_DEVICE(0x2526, 0xA014, iwl9260_2ac_cfg)},
 	{IWL_PCI_DEVICE(0x271B, 0x0010, iwl9160_2ac_cfg)},
 	{IWL_PCI_DEVICE(0x271B, 0x0014, iwl9160_2ac_cfg)},
@@ -390,6 +394,8 @@
 	{IWL_PCI_DEVICE(0x2720, 0x1010, iwl9260_2ac_cfg)},
 	{IWL_PCI_DEVICE(0x2720, 0x1030, iwl9560_2ac_cfg_soc)},
 	{IWL_PCI_DEVICE(0x2720, 0x1210, iwl9260_2ac_cfg)},
+	{IWL_PCI_DEVICE(0x2720, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+	{IWL_PCI_DEVICE(0x2720, 0x1552, iwl9560_killer_2ac_cfg_soc)},
 	{IWL_PCI_DEVICE(0x2720, 0x2030, iwl9560_2ac_cfg_soc)},
 	{IWL_PCI_DEVICE(0x2720, 0x2034, iwl9560_2ac_cfg_soc)},
 	{IWL_PCI_DEVICE(0x2720, 0x4030, iwl9560_2ac_cfg)},
@@ -416,6 +422,8 @@
 	{IWL_PCI_DEVICE(0x30DC, 0x1010, iwl9260_2ac_cfg)},
 	{IWL_PCI_DEVICE(0x30DC, 0x1030, iwl9560_2ac_cfg_soc)},
 	{IWL_PCI_DEVICE(0x30DC, 0x1210, iwl9260_2ac_cfg)},
+	{IWL_PCI_DEVICE(0x30DC, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+	{IWL_PCI_DEVICE(0x30DC, 0x1552, iwl9560_killer_2ac_cfg_soc)},
 	{IWL_PCI_DEVICE(0x30DC, 0x2030, iwl9560_2ac_cfg_soc)},
 	{IWL_PCI_DEVICE(0x30DC, 0x2034, iwl9560_2ac_cfg_soc)},
 	{IWL_PCI_DEVICE(0x30DC, 0x4030, iwl9560_2ac_cfg_soc)},
@@ -442,6 +450,8 @@
 	{IWL_PCI_DEVICE(0x31DC, 0x1010, iwl9260_2ac_cfg)},
 	{IWL_PCI_DEVICE(0x31DC, 0x1030, iwl9560_2ac_cfg_shared_clk)},
 	{IWL_PCI_DEVICE(0x31DC, 0x1210, iwl9260_2ac_cfg)},
+	{IWL_PCI_DEVICE(0x31DC, 0x1551, iwl9560_killer_s_2ac_cfg_shared_clk)},
+	{IWL_PCI_DEVICE(0x31DC, 0x1552, iwl9560_killer_2ac_cfg_shared_clk)},
 	{IWL_PCI_DEVICE(0x31DC, 0x2030, iwl9560_2ac_cfg_shared_clk)},
 	{IWL_PCI_DEVICE(0x31DC, 0x2034, iwl9560_2ac_cfg_shared_clk)},
 	{IWL_PCI_DEVICE(0x31DC, 0x4030, iwl9560_2ac_cfg_shared_clk)},
@@ -468,6 +478,8 @@
 	{IWL_PCI_DEVICE(0x34F0, 0x1010, iwl9260_2ac_cfg)},
 	{IWL_PCI_DEVICE(0x34F0, 0x1030, iwl9560_2ac_cfg_soc)},
 	{IWL_PCI_DEVICE(0x34F0, 0x1210, iwl9260_2ac_cfg)},
+	{IWL_PCI_DEVICE(0x34F0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+	{IWL_PCI_DEVICE(0x34F0, 0x1552, iwl9560_killer_2ac_cfg_soc)},
 	{IWL_PCI_DEVICE(0x34F0, 0x2030, iwl9560_2ac_cfg_soc)},
 	{IWL_PCI_DEVICE(0x34F0, 0x2034, iwl9560_2ac_cfg_soc)},
 	{IWL_PCI_DEVICE(0x34F0, 0x4030, iwl9560_2ac_cfg_soc)},
@@ -494,6 +506,8 @@
 	{IWL_PCI_DEVICE(0x3DF0, 0x1010, iwl9260_2ac_cfg)},
 	{IWL_PCI_DEVICE(0x3DF0, 0x1030, iwl9560_2ac_cfg_soc)},
 	{IWL_PCI_DEVICE(0x3DF0, 0x1210, iwl9260_2ac_cfg)},
+	{IWL_PCI_DEVICE(0x3DF0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+	{IWL_PCI_DEVICE(0x3DF0, 0x1552, iwl9560_killer_2ac_cfg_soc)},
 	{IWL_PCI_DEVICE(0x3DF0, 0x2030, iwl9560_2ac_cfg_soc)},
 	{IWL_PCI_DEVICE(0x3DF0, 0x2034, iwl9560_2ac_cfg_soc)},
 	{IWL_PCI_DEVICE(0x3DF0, 0x4030, iwl9560_2ac_cfg_soc)},
@@ -520,6 +534,8 @@
 	{IWL_PCI_DEVICE(0x43F0, 0x1010, iwl9260_2ac_cfg)},
 	{IWL_PCI_DEVICE(0x43F0, 0x1030, iwl9560_2ac_cfg_soc)},
 	{IWL_PCI_DEVICE(0x43F0, 0x1210, iwl9260_2ac_cfg)},
+	{IWL_PCI_DEVICE(0x43F0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+	{IWL_PCI_DEVICE(0x43F0, 0x1552, iwl9560_killer_2ac_cfg_soc)},
 	{IWL_PCI_DEVICE(0x43F0, 0x2030, iwl9560_2ac_cfg_soc)},
 	{IWL_PCI_DEVICE(0x43F0, 0x2034, iwl9560_2ac_cfg_soc)},
 	{IWL_PCI_DEVICE(0x43F0, 0x4030, iwl9560_2ac_cfg_soc)},
@@ -555,6 +571,8 @@
 	{IWL_PCI_DEVICE(0x9DF0, 0x1010, iwl9260_2ac_cfg)},
 	{IWL_PCI_DEVICE(0x9DF0, 0x1030, iwl9560_2ac_cfg_soc)},
 	{IWL_PCI_DEVICE(0x9DF0, 0x1210, iwl9260_2ac_cfg)},
+	{IWL_PCI_DEVICE(0x9DF0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+	{IWL_PCI_DEVICE(0x9DF0, 0x1552, iwl9560_killer_2ac_cfg_soc)},
 	{IWL_PCI_DEVICE(0x9DF0, 0x2010, iwl9460_2ac_cfg_soc)},
 	{IWL_PCI_DEVICE(0x9DF0, 0x2030, iwl9560_2ac_cfg_soc)},
 	{IWL_PCI_DEVICE(0x9DF0, 0x2034, iwl9560_2ac_cfg_soc)},
@@ -583,6 +601,8 @@
 	{IWL_PCI_DEVICE(0xA0F0, 0x1010, iwl9260_2ac_cfg)},
 	{IWL_PCI_DEVICE(0xA0F0, 0x1030, iwl9560_2ac_cfg_soc)},
 	{IWL_PCI_DEVICE(0xA0F0, 0x1210, iwl9260_2ac_cfg)},
+	{IWL_PCI_DEVICE(0xA0F0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+	{IWL_PCI_DEVICE(0xA0F0, 0x1552, iwl9560_killer_2ac_cfg_soc)},
 	{IWL_PCI_DEVICE(0xA0F0, 0x2030, iwl9560_2ac_cfg_soc)},
 	{IWL_PCI_DEVICE(0xA0F0, 0x2034, iwl9560_2ac_cfg_soc)},
 	{IWL_PCI_DEVICE(0xA0F0, 0x4030, iwl9560_2ac_cfg_soc)},
@@ -609,6 +629,8 @@
 	{IWL_PCI_DEVICE(0xA370, 0x1010, iwl9260_2ac_cfg)},
 	{IWL_PCI_DEVICE(0xA370, 0x1030, iwl9560_2ac_cfg_soc)},
 	{IWL_PCI_DEVICE(0xA370, 0x1210, iwl9260_2ac_cfg)},
+	{IWL_PCI_DEVICE(0xA370, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+	{IWL_PCI_DEVICE(0xA370, 0x1552, iwl9560_killer_2ac_cfg_soc)},
 	{IWL_PCI_DEVICE(0xA370, 0x2030, iwl9560_2ac_cfg_soc)},
 	{IWL_PCI_DEVICE(0xA370, 0x2034, iwl9560_2ac_cfg_soc)},
 	{IWL_PCI_DEVICE(0xA370, 0x4030, iwl9560_2ac_cfg_soc)},
@@ -622,18 +644,22 @@
 	/* TODO: remove this entry */
 	{IWL_PCI_DEVICE(0x0000, 0x0000, iwl22000_2ac_cfg_hr_cdb)},
 	{IWL_PCI_DEVICE(0x2720, 0x0000, iwl22000_2ax_cfg_hr)},
+	{IWL_PCI_DEVICE(0x2720, 0x0040, iwl22000_2ax_cfg_hr)},
 	{IWL_PCI_DEVICE(0x2720, 0x0078, iwl22000_2ax_cfg_hr)},
 	{IWL_PCI_DEVICE(0x2720, 0x0070, iwl22000_2ac_cfg_hr_cdb)},
 	{IWL_PCI_DEVICE(0x2720, 0x0030, iwl22000_2ac_cfg_hr_cdb)},
 	{IWL_PCI_DEVICE(0x2720, 0x1080, iwl22000_2ax_cfg_hr)},
 	{IWL_PCI_DEVICE(0x2720, 0x0090, iwl22000_2ac_cfg_hr_cdb)},
 	{IWL_PCI_DEVICE(0x2720, 0x0310, iwl22000_2ac_cfg_hr_cdb)},
+	{IWL_PCI_DEVICE(0x34F0, 0x0040, iwl22000_2ax_cfg_hr)},
 	{IWL_PCI_DEVICE(0x34F0, 0x0070, iwl22000_2ax_cfg_hr)},
 	{IWL_PCI_DEVICE(0x34F0, 0x0078, iwl22000_2ax_cfg_hr)},
 	{IWL_PCI_DEVICE(0x34F0, 0x0310, iwl22000_2ac_cfg_jf)},
+	{IWL_PCI_DEVICE(0x43F0, 0x0040, iwl22000_2ax_cfg_hr)},
 	{IWL_PCI_DEVICE(0x43F0, 0x0070, iwl22000_2ax_cfg_hr)},
 	{IWL_PCI_DEVICE(0x43F0, 0x0078, iwl22000_2ax_cfg_hr)},
 	{IWL_PCI_DEVICE(0xA0F0, 0x0000, iwl22000_2ax_cfg_hr)},
+	{IWL_PCI_DEVICE(0xA0F0, 0x0040, iwl22000_2ax_cfg_hr)},
 	{IWL_PCI_DEVICE(0xA0F0, 0x0070, iwl22000_2ax_cfg_hr)},
 	{IWL_PCI_DEVICE(0xA0F0, 0x0078, iwl22000_2ax_cfg_hr)},
 	{IWL_PCI_DEVICE(0xA0F0, 0x00B0, iwl22000_2ax_cfg_hr)},
diff --git a/drivers/net/wireless/iwl7000/iwlwifi/pcie/rx.c b/drivers/net/wireless/iwl7000/iwlwifi/pcie/rx.c
index d57f2a08..f20754d 100644
--- a/drivers/net/wireless/iwl7000/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/iwl7000/iwlwifi/pcie/rx.c
@@ -990,6 +990,9 @@
 
 int iwl_pcie_gen2_rx_init(struct iwl_trans *trans)
 {
+	/* Set interrupt coalescing timer to default (2048 usecs) */
+	iwl_write8(trans, CSR_INT_COALESCING, IWL_HOST_INT_TIMEOUT_DEF);
+
 	/*
 	 * We don't configure the RFH.
 	 * Restock will be done at alive, after firmware configured the RFH.
@@ -1049,6 +1052,14 @@
 	kfree(trans_pcie->rxq);
 }
 
+static void iwl_pcie_rx_move_to_allocator(struct iwl_rxq *rxq,
+					  struct iwl_rb_allocator *rba)
+{
+	spin_lock(&rba->lock);
+	list_splice_tail_init(&rxq->rx_used, &rba->rbd_empty);
+	spin_unlock(&rba->lock);
+}
+
 /*
  * iwl_pcie_rx_reuse_rbd - Recycle used RBDs
  *
@@ -1080,9 +1091,7 @@
 	if ((rxq->used_count % RX_CLAIM_REQ_ALLOC) == RX_POST_REQ_ALLOC) {
 		/* Move the 2 RBDs to the allocator ownership.
 		 Allocator has another 6 from pool for the request completion*/
-		spin_lock(&rba->lock);
-		list_splice_tail_init(&rxq->rx_used, &rba->rbd_empty);
-		spin_unlock(&rba->lock);
+		iwl_pcie_rx_move_to_allocator(rxq, rba);
 
 		atomic_inc(&rba->req_pending);
 		queue_work(rba->alloc_wq, &rba->rx_alloc);
@@ -1260,10 +1269,18 @@
 		IWL_DEBUG_RX(trans, "Q %d: HW = SW = %d\n", rxq->id, r);
 
 	while (i != r) {
+		struct iwl_rb_allocator *rba = &trans_pcie->rba;
 		struct iwl_rx_mem_buffer *rxb;
+		/* number of RBDs still waiting for page allocation */
+		u32 rb_pending_alloc =
+			atomic_read(&trans_pcie->rba.req_pending) *
+			RX_CLAIM_REQ_ALLOC;
 
-		if (unlikely(rxq->used_count == rxq->queue_size / 2))
+		if (unlikely(rb_pending_alloc >= rxq->queue_size / 2 &&
+			     !emergency)) {
+			iwl_pcie_rx_move_to_allocator(rxq, rba);
 			emergency = true;
+		}
 
 		if (trans->cfg->mq_rx_supported) {
 			/*
@@ -1306,17 +1323,13 @@
 			iwl_pcie_rx_allocator_get(trans, rxq);
 
 		if (rxq->used_count % RX_CLAIM_REQ_ALLOC == 0 && !emergency) {
-			struct iwl_rb_allocator *rba = &trans_pcie->rba;
-
 			/* Add the remaining empty RBDs for allocator use */
-			spin_lock(&rba->lock);
-			list_splice_tail_init(&rxq->rx_used, &rba->rbd_empty);
-			spin_unlock(&rba->lock);
+			iwl_pcie_rx_move_to_allocator(rxq, rba);
 		} else if (emergency) {
 			count++;
 			if (count == 8) {
 				count = 0;
-				if (rxq->used_count < rxq->queue_size / 3)
+				if (rb_pending_alloc < rxq->queue_size / 3)
 					emergency = false;
 
 				rxq->read = i;
diff --git a/drivers/net/wireless/iwl7000/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwl7000/iwlwifi/pcie/trans.c
index f96697d..9ac721c 100644
--- a/drivers/net/wireless/iwl7000/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwl7000/iwlwifi/pcie/trans.c
@@ -325,9 +325,9 @@
 
 	pcie_capability_read_word(trans_pcie->pci_dev, PCI_EXP_DEVCTL2, &cap);
 	trans->ltr_enabled = cap & PCI_EXP_DEVCTL2_LTR_EN;
-	dev_info(trans->dev, "L1 %sabled - LTR %sabled\n",
-		 (lctl & PCI_EXP_LNKCTL_ASPM_L1) ? "En" : "Dis",
-		 trans->ltr_enabled ? "En" : "Dis");
+	IWL_DEBUG_POWER(trans, "L1 %sabled - LTR %sabled\n",
+			(lctl & PCI_EXP_LNKCTL_ASPM_L1) ? "En" : "Dis",
+			trans->ltr_enabled ? "En" : "Dis");
 }
 
 /*
@@ -1640,14 +1640,13 @@
 					struct iwl_trans *trans)
 {
 	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-	int max_irqs, num_irqs, i, ret, nr_online_cpus;
+	int max_irqs, num_irqs, i, ret;
 	u16 pci_cmd;
 
 	if (!trans->cfg->mq_rx_supported || iwlwifi_mod_params.disable_msix)
 		goto enable_msi;
 
-	nr_online_cpus = num_online_cpus();
-	max_irqs = min_t(u32, nr_online_cpus + 2, IWL_MAX_RX_HW_QUEUES);
+	max_irqs = min_t(u32, num_online_cpus() + 2, IWL_MAX_RX_HW_QUEUES);
 	for (i = 0; i < max_irqs; i++)
 		trans_pcie->msix_entries[i].entry = i;
 
@@ -1673,16 +1672,17 @@
 	 * Two interrupts less: non rx causes shared with FBQ and RSS.
 	 * More than two interrupts: we will use fewer RSS queues.
 	 */
-	if (num_irqs <= nr_online_cpus) {
+	if (num_irqs <= max_irqs - 2) {
 		trans_pcie->trans->num_rx_queues = num_irqs + 1;
 		trans_pcie->shared_vec_mask = IWL_SHARED_IRQ_NON_RX |
 			IWL_SHARED_IRQ_FIRST_RSS;
-	} else if (num_irqs == nr_online_cpus + 1) {
+	} else if (num_irqs == max_irqs - 1) {
 		trans_pcie->trans->num_rx_queues = num_irqs;
 		trans_pcie->shared_vec_mask = IWL_SHARED_IRQ_NON_RX;
 	} else {
 		trans_pcie->trans->num_rx_queues = num_irqs - 1;
 	}
+	WARN_ON(trans_pcie->trans->num_rx_queues > IWL_MAX_RX_HW_QUEUES);
 
 	trans_pcie->alloc_vecs = num_irqs;
 	trans_pcie->msix_enabled = true;
@@ -3365,6 +3365,7 @@
 		ret = -EIO;
 		goto out_no_pci;
 	}
+
 	/*
 	 * In the 8000 HW family the format of the 4 bytes of CSR_HW_REV have
 	 * changed, and now the revision step also includes bit 0-1 (no more
diff --git a/drivers/net/wireless/iwl7000/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwl7000/iwlwifi/pcie/tx.c
index b009615..76422e5 100644
--- a/drivers/net/wireless/iwl7000/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/iwl7000/iwlwifi/pcie/tx.c
@@ -1092,7 +1092,7 @@
 
 	if (!iwl_queue_used(txq, last_to_free)) {
 		IWL_ERR(trans,
-			"%s: Read index for DMA queue txq id (%d), last_to_free %d is out of range [0-%d] %d %d.\n",
+			"%s: Read index for txq id (%d), last_to_free %d is out of range [0-%d] %d %d.\n",
 			__func__, txq_id, last_to_free, TFD_QUEUE_SIZE_MAX,
 			txq->write_ptr, txq->read_ptr);
 		goto out;
@@ -2007,6 +2007,8 @@
 		}
 		tb_idx = iwl_pcie_txq_build_tfd(trans, txq, tb_phys,
 						skb_frag_size(frag), false);
+		if (tb_idx < 0)
+			return tb_idx;
 
 		out_meta->tbs |= BIT(tb_idx);
 	}
diff --git a/drivers/net/wireless/iwl7000/mac80211/cfg.c b/drivers/net/wireless/iwl7000/mac80211/cfg.c
index bda2c2d..5f02473 100644
--- a/drivers/net/wireless/iwl7000/mac80211/cfg.c
+++ b/drivers/net/wireless/iwl7000/mac80211/cfg.c
@@ -63,7 +63,7 @@
 #if CFG80211_VERSION < KERNEL_VERSION(4,12,0)
 				     u32 flags,
 #endif
-				     struct vif_params *params)
+struct vif_params *params)
 {
 	struct ieee80211_local *local = sdata->local;
 	struct ieee80211_sub_if_data *monitor_sdata;
@@ -126,7 +126,7 @@
 #if CFG80211_VERSION < KERNEL_VERSION(4,12,0)
 						u32 *flags,
 #endif
-						struct vif_params *params)
+struct vif_params *params)
 {
 #if CFG80211_VERSION <= KERNEL_VERSION(4,0,0)
 	unsigned char name_assign_type = NET_NAME_UNKNOWN;
@@ -167,7 +167,7 @@
 #if CFG80211_VERSION < KERNEL_VERSION(4,12,0)
 				  u32 *flags,
 #endif
-				  struct vif_params *params)
+struct vif_params *params)
 {
 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 	int ret;
@@ -284,7 +284,7 @@
 #endif
 	}
 
-#if CFG80211_VERSION >= KERNEL_VERSION(4,99,0)
+#if CFG80211_VERSION >= KERNEL_VERSION(99,0,0)
 	if (changes & CFG80211_NAN_CONF_CHANGED_CDW_2G)
 		new_conf.cdw_2g = nan_conf_cdw_2g(conf);
 
@@ -486,7 +486,7 @@
 	case NL80211_IFTYPE_WDS:
 	case NL80211_IFTYPE_MONITOR:
 	case NL80211_IFTYPE_P2P_DEVICE:
-#if CFG80211_VERSION >= KERNEL_VERSION(4,9,0)
+#if CFG80211_VERSION >= KERNEL_VERSION(4,4,0)
 	case NL80211_IFTYPE_NAN:
 		/* keep code in case of fall-through (spatch generated) */
 #endif
@@ -498,7 +498,7 @@
 	case NL80211_IFTYPE_OCB:
 		/* keep code in case of fall-through (spatch generated) */
 #endif
-#if CFG80211_VERSION >= KERNEL_VERSION(4,99,0)
+#if CFG80211_VERSION >= KERNEL_VERSION(99,0,0)
 	case NL80211_IFTYPE_NAN_DATA:
 		/* keep code in case of fall-through (spatch generated) */
 #endif
@@ -2305,7 +2305,7 @@
 		     !(req->flags & NL80211_SCAN_FLAG_AP)))
 			return -EOPNOTSUPP;
 		break;
-#if CFG80211_VERSION >= KERNEL_VERSION(4,9,0)
+#if CFG80211_VERSION >= KERNEL_VERSION(4,4,0)
 	case NL80211_IFTYPE_NAN:
 		/* keep code in case of fall-through (spatch generated) */
 #endif
@@ -3736,7 +3736,7 @@
 }
 #endif
 
-#if CFG80211_VERSION >= KERNEL_VERSION(4,99,0)
+#if CFG80211_VERSION >= KERNEL_VERSION(99,0,0)
 static u64 ieee80211_msrment_cookie(struct ieee80211_local *local,
 				    enum nl80211_msrment_type type)
 {
@@ -3750,7 +3750,7 @@
 }
 #endif
 
-#if CFG80211_VERSION >= KERNEL_VERSION(4,99,0)
+#if CFG80211_VERSION >= KERNEL_VERSION(99,0,0)
 static int ieee80211_perform_msrment(struct wiphy *wiphy,
 				     struct wireless_dev *wdev,
 				     struct cfg80211_msrment_request *request,
@@ -3775,7 +3775,7 @@
 }
 #endif
 
-#if CFG80211_VERSION >= KERNEL_VERSION(4,99,0)
+#if CFG80211_VERSION >= KERNEL_VERSION(99,0,0)
 static int ieee80211_abort_msrment(struct wiphy *wiphy,
 				   struct wireless_dev *wdev, u64 cookie)
 {
@@ -3796,7 +3796,7 @@
 }
 #endif
 
-#if CFG80211_VERSION >= KERNEL_VERSION(4,99,0)
+#if CFG80211_VERSION >= KERNEL_VERSION(99,0,0)
 static int ieee80211_start_ftm_responder(struct wiphy *wiphy,
 					 struct net_device *dev,
 			       struct cfg80211_ftm_responder_params *params)
@@ -3808,7 +3808,7 @@
 }
 #endif
 
-#if CFG80211_VERSION >= KERNEL_VERSION(4,99,0)
+#if CFG80211_VERSION >= KERNEL_VERSION(99,0,0)
 static int ieee80211_get_ftm_responder_stats(struct wiphy *wiphy,
 					    struct net_device *dev,
 			       struct cfg80211_ftm_responder_stats *ftm_stats)
@@ -3951,16 +3951,16 @@
 	.get_station = ieee80211_get_station,
 	.dump_station = ieee80211_dump_station,
 	.dump_survey = ieee80211_dump_survey,
-#if CFG80211_VERSION >= KERNEL_VERSION(4,99,0)
+#if CFG80211_VERSION >= KERNEL_VERSION(99,0,0)
 	.perform_msrment = ieee80211_perform_msrment,
 #endif
-#if CFG80211_VERSION >= KERNEL_VERSION(4,99,0)
+#if CFG80211_VERSION >= KERNEL_VERSION(99,0,0)
 	.abort_msrment = ieee80211_abort_msrment,
 #endif
-#if CFG80211_VERSION >= KERNEL_VERSION(4,99,0)
+#if CFG80211_VERSION >= KERNEL_VERSION(99,0,0)
 	.start_ftm_responder = ieee80211_start_ftm_responder,
 #endif
-#if CFG80211_VERSION >= KERNEL_VERSION(4,99,0)
+#if CFG80211_VERSION >= KERNEL_VERSION(99,0,0)
 	.get_ftm_responder_stats = ieee80211_get_ftm_responder_stats,
 #endif
 #ifdef CPTCFG_MAC80211_MESH
@@ -4016,6 +4016,7 @@
 #else
 	.mgmt_tx = _wrap_mgmt_tx,
 #endif
+
 	.mgmt_tx_cancel_wait = ieee80211_mgmt_tx_cancel_wait,
 	.set_cqm_rssi_config = ieee80211_set_cqm_rssi_config,
 #if CFG80211_VERSION >= KERNEL_VERSION(4,12,0)
diff --git a/drivers/net/wireless/iwl7000/mac80211/chan.c b/drivers/net/wireless/iwl7000/mac80211/chan.c
index 7bc87fd..5bdf3b2 100644
--- a/drivers/net/wireless/iwl7000/mac80211/chan.c
+++ b/drivers/net/wireless/iwl7000/mac80211/chan.c
@@ -271,7 +271,7 @@
 				    ieee80211_get_max_required_bw(sdata));
 			break;
 		case NL80211_IFTYPE_P2P_DEVICE:
-#if CFG80211_VERSION >= KERNEL_VERSION(4,9,0)
+#if CFG80211_VERSION >= KERNEL_VERSION(4,4,0)
 		case NL80211_IFTYPE_NAN:
 			/* keep code in case of fall-through (spatch generated) */
 #endif
@@ -290,7 +290,7 @@
 		case NL80211_IFTYPE_MONITOR:
 		case NL80211_IFTYPE_P2P_CLIENT:
 		case NL80211_IFTYPE_P2P_GO:
-#if CFG80211_VERSION >= KERNEL_VERSION(4,99,0)
+#if CFG80211_VERSION >= KERNEL_VERSION(99,0,0)
 		case NL80211_IFTYPE_NAN_DATA:
 			/* keep code in case of fall-through (spatch generated) */
 #endif
@@ -729,7 +729,7 @@
 
 		switch (sdata->vif.type) {
 		case NL80211_IFTYPE_P2P_DEVICE:
-#if CFG80211_VERSION >= KERNEL_VERSION(4,9,0)
+#if CFG80211_VERSION >= KERNEL_VERSION(4,4,0)
 		case NL80211_IFTYPE_NAN:
 			/* keep code in case of fall-through (spatch generated) */
 #endif
@@ -1001,11 +1001,11 @@
 	case NL80211_IFTYPE_P2P_CLIENT:
 	case NL80211_IFTYPE_P2P_GO:
 	case NL80211_IFTYPE_P2P_DEVICE:
-#if CFG80211_VERSION >= KERNEL_VERSION(4,9,0)
+#if CFG80211_VERSION >= KERNEL_VERSION(4,4,0)
 	case NL80211_IFTYPE_NAN:
 		/* keep code in case of fall-through (spatch generated) */
 #endif
-#if CFG80211_VERSION >= KERNEL_VERSION(4,99,0)
+#if CFG80211_VERSION >= KERNEL_VERSION(99,0,0)
 	case NL80211_IFTYPE_NAN_DATA:
 		/* keep code in case of fall-through (spatch generated) */
 #endif
diff --git a/drivers/net/wireless/iwl7000/mac80211/iface.c b/drivers/net/wireless/iwl7000/mac80211/iface.c
index bdd6606..710634c 100644
--- a/drivers/net/wireless/iwl7000/mac80211/iface.c
+++ b/drivers/net/wireless/iwl7000/mac80211/iface.c
@@ -543,7 +543,7 @@
 	case NL80211_IFTYPE_OCB:
 		/* keep code in case of fall-through (spatch generated) */
 #endif
-#if CFG80211_VERSION >= KERNEL_VERSION(4,9,0)
+#if CFG80211_VERSION >= KERNEL_VERSION(4,4,0)
 	case NL80211_IFTYPE_NAN:
 		/* keep code in case of fall-through (spatch generated) */
 #endif
@@ -553,7 +553,7 @@
 	case NUM_NL80211_IFTYPES:
 	case NL80211_IFTYPE_P2P_CLIENT:
 	case NL80211_IFTYPE_P2P_GO:
-#if CFG80211_VERSION >= KERNEL_VERSION(4,99,0)
+#if CFG80211_VERSION >= KERNEL_VERSION(99,0,0)
 	case NL80211_IFTYPE_NAN_DATA:
 		/* keep code in case of fall-through (spatch generated) */
 #endif
@@ -670,7 +670,7 @@
 			break;
 		case NL80211_IFTYPE_WDS:
 		case NL80211_IFTYPE_P2P_DEVICE:
-#if CFG80211_VERSION >= KERNEL_VERSION(4,9,0)
+#if CFG80211_VERSION >= KERNEL_VERSION(4,4,0)
 		case NL80211_IFTYPE_NAN:
 			/* keep code in case of fall-through (spatch generated) */
 #endif
@@ -975,7 +975,7 @@
 
 		ieee80211_adjust_monitor_flags(sdata, -1);
 		break;
-#if CFG80211_VERSION >= KERNEL_VERSION(4,9,0)
+#if CFG80211_VERSION >= KERNEL_VERSION(4,4,0)
 	case NL80211_IFTYPE_NAN:
 		/* keep code in case of fall-through (spatch generated) */
 #endif
@@ -1551,7 +1551,7 @@
 	case NL80211_IFTYPE_WDS:
 		sdata->vif.bss_conf.bssid = NULL;
 		break;
-#if CFG80211_VERSION >= KERNEL_VERSION(4,9,0)
+#if CFG80211_VERSION >= KERNEL_VERSION(4,4,0)
 	case NL80211_IFTYPE_NAN:
 		/* keep code in case of fall-through (spatch generated) */
 #endif
@@ -1565,7 +1565,7 @@
 		break;
 	case NL80211_IFTYPE_UNSPECIFIED:
 	case NUM_NL80211_IFTYPES:
-#if CFG80211_VERSION >= KERNEL_VERSION(4,99,0)
+#if CFG80211_VERSION >= KERNEL_VERSION(99,0,0)
 	case NL80211_IFTYPE_NAN_DATA:
 		/* keep code in case of fall-through (spatch generated) */
 #endif
diff --git a/drivers/net/wireless/iwl7000/mac80211/main.c b/drivers/net/wireless/iwl7000/mac80211/main.c
index ebe6a50..6d1b529 100644
--- a/drivers/net/wireless/iwl7000/mac80211/main.c
+++ b/drivers/net/wireless/iwl7000/mac80211/main.c
@@ -256,8 +256,27 @@
 
 	flush_work(&local->radar_detected_work);
 	rtnl_lock();
-	list_for_each_entry(sdata, &local->interfaces, list)
+	list_for_each_entry(sdata, &local->interfaces, list) {
+		/*
+		 * XXX: there may be more work for other vif types and even
+		 * for station mode: a good thing would be to run most of
+		 * the iface type's dependent _stop (ieee80211_mg_stop,
+		 * ieee80211_ibss_stop) etc...
+		 * For now, fix only the specific bug that was seen: race
+		 * between csa_connection_drop_work and us.
+		 */
+		if (sdata->vif.type == NL80211_IFTYPE_STATION) {
+			/*
+			 * This worker is scheduled from the iface worker that
+			 * runs on mac80211's workqueue, so we can't be
+			 * scheduling this worker after the cancel right here.
+			 * The exception is ieee80211_chswitch_done.
+			 * Then we can have a race...
+			 */
+			cancel_work_sync(&sdata->u.mgd.csa_connection_drop_work);
+		}
 		flush_delayed_work(&sdata->dec_tailroom_needed_wk);
+	}
 	ieee80211_scan_cancel(local);
 
 	/* make sure any new ROC will consider local->in_reconfig */
diff --git a/drivers/net/wireless/iwl7000/mac80211/mlme.c b/drivers/net/wireless/iwl7000/mac80211/mlme.c
index 3e65112..7b4a2e1c 100644
--- a/drivers/net/wireless/iwl7000/mac80211/mlme.c
+++ b/drivers/net/wireless/iwl7000/mac80211/mlme.c
@@ -325,8 +325,9 @@
 {
 	struct ieee80211_local *local = sdata->local;
 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-	struct ieee80211_supported_band *sband;
-	struct ieee80211_channel *chan;
+	struct ieee80211_channel *chan = sdata->vif.bss_conf.chandef.chan;
+	struct ieee80211_supported_band *sband =
+		local->hw.wiphy->bands[chan->band];
 	struct cfg80211_chan_def chandef;
 	u16 ht_opmode;
 	u32 flags;
@@ -359,9 +360,6 @@
 		sdata->vif.bss_conf.ht_operation_mode = ht_opmode;
 	}
 
-	chan = sdata->vif.bss_conf.chandef.chan;
-	sband = local->hw.wiphy->bands[chan->band];
-
 	/* calculate new channel (type) based on HT/VHT/HE operation IEs */
 	flags = ieee80211_determine_chantype(sdata, sband, chan,
 					     ht_oper, vht_oper, he_oper,
@@ -697,6 +695,9 @@
 			2 + 2 * sband->n_channels + /* supported channels */
 			2 + sizeof(struct ieee80211_ht_cap) + /* HT */
 			2 + sizeof(struct ieee80211_vht_cap) + /* VHT */
+			2 + 1 + sizeof(struct ieee80211_he_cap_elem) + /* HE */
+				sizeof(struct ieee80211_he_mcs_nss_supp) +
+				IEEE80211_HE_PPE_THRES_MAX_LEN +
 			assoc_data->ie_len + /* extra IEs */
 			(assoc_data->fils_kek_len ? 16 /* AES-SIV */ : 0) +
 			9, /* WMM */
diff --git a/drivers/net/wireless/iwl7000/mac80211/offchannel.c b/drivers/net/wireless/iwl7000/mac80211/offchannel.c
index 7be2dea..840beaa 100644
--- a/drivers/net/wireless/iwl7000/mac80211/offchannel.c
+++ b/drivers/net/wireless/iwl7000/mac80211/offchannel.c
@@ -841,7 +841,7 @@
 	case NL80211_IFTYPE_P2P_DEVICE:
 		need_offchan = true;
 		break;
-#if CFG80211_VERSION >= KERNEL_VERSION(4,9,0)
+#if CFG80211_VERSION >= KERNEL_VERSION(4,4,0)
 	case NL80211_IFTYPE_NAN:
 		/* keep code in case of fall-through (spatch generated) */
 #endif
diff --git a/drivers/net/wireless/iwl7000/mac80211/rx.c b/drivers/net/wireless/iwl7000/mac80211/rx.c
index 3bbc200..1586631 100644
--- a/drivers/net/wireless/iwl7000/mac80211/rx.c
+++ b/drivers/net/wireless/iwl7000/mac80211/rx.c
@@ -3823,7 +3823,7 @@
 		       ieee80211_is_probe_req(hdr->frame_control) ||
 		       ieee80211_is_probe_resp(hdr->frame_control) ||
 		       ieee80211_is_beacon(hdr->frame_control);
-#if CFG80211_VERSION >= KERNEL_VERSION(4,9,0)
+#if CFG80211_VERSION >= KERNEL_VERSION(4,4,0)
 	case NL80211_IFTYPE_NAN:
 		/* keep code in case of fall-through (spatch generated) */
 #endif
diff --git a/drivers/net/wireless/iwl7000/mac80211/sta_info.c b/drivers/net/wireless/iwl7000/mac80211/sta_info.c
index c9b2ef7..d0cfe38 100644
--- a/drivers/net/wireless/iwl7000/mac80211/sta_info.c
+++ b/drivers/net/wireless/iwl7000/mac80211/sta_info.c
@@ -2012,7 +2012,7 @@
 		break;
 		}
 	case STA_STATS_RATE_TYPE_HE:
-#if CFG80211_VERSION >= KERNEL_VERSION(4,99,0)
+#if CFG80211_VERSION >= KERNEL_VERSION(99,0,0)
 		rinfo->flags |= RATE_INFO_FLAGS_HE_MCS;
 		rinfo->mcs = STA_STATS_GET(HE_MCS, rate);
 		rinfo->nss = STA_STATS_GET(HE_NSS, rate);
diff --git a/drivers/net/wireless/iwl7000/mac80211/util.c b/drivers/net/wireless/iwl7000/mac80211/util.c
index b297c15..247bd60 100644
--- a/drivers/net/wireless/iwl7000/mac80211/util.c
+++ b/drivers/net/wireless/iwl7000/mac80211/util.c
@@ -1167,8 +1167,7 @@
 	qparam->cw_min = max_t(u16, qparam->cw_min, wmm_ac->cw_min);
 	qparam->cw_max = max_t(u16, qparam->cw_max, wmm_ac->cw_max);
 	qparam->aifs = max_t(u8, qparam->aifs, wmm_ac->aifsn);
-	qparam->txop = !qparam->txop ? wmm_ac->cot / 32 :
-		min_t(u16, qparam->txop, wmm_ac->cot / 32);
+	qparam->txop = min_t(u16, qparam->txop, wmm_ac->cot / 32);
 	rcu_read_unlock();
 #endif
 }
@@ -2116,7 +2115,7 @@
 				ieee80211_bss_info_change_notify(sdata, changed);
 			}
 			break;
-#if CFG80211_VERSION >= KERNEL_VERSION(4,9,0)
+#if CFG80211_VERSION >= KERNEL_VERSION(4,4,0)
 		case NL80211_IFTYPE_NAN:
 			/* keep code in case of fall-through (spatch generated) */
 #endif
@@ -2136,7 +2135,7 @@
 		case NUM_NL80211_IFTYPES:
 		case NL80211_IFTYPE_P2P_CLIENT:
 		case NL80211_IFTYPE_P2P_GO:
-#if CFG80211_VERSION >= KERNEL_VERSION(4,99,0)
+#if CFG80211_VERSION >= KERNEL_VERSION(99,0,0)
 		case NL80211_IFTYPE_NAN_DATA:
 			/* keep code in case of fall-through (spatch generated) */
 #endif