Merge remote-tracking branch 'origin/q' into auto-kernel

* origin/q: cpuidle: lpm-levels: Fix clock prints in the suspend path sched: Fix out of bounds issue in for_each_cluster macro sched: core_ctl: Fix possible uninitialized variable sched: Improve the scheduler taskstats: extended taskstats2 with acct fields Revert "Revert "ANDROID: security,perf: Allow further restriction of perf_event_open"" fs: namespace: Fix use-after-free in unmount USB: f_mtp: Revert Avoid queuing of receive_file_work for 0 length usb: dwc3: Add boundary check while traversing the TRB ring buffer usb: dwc3-msm: Add support for 2nd set of wakeup IRQs usb: pd: Use break instead of return after soft reset is done USB: pd: Restart host mode in high speed if no usb3 & dp concurrency usb: f_cdev: USB remote wake up feature implementation for DUN usb: gadget: notify suspend clear to usb phy in udc usb: gadget: f_ipc: Fix race between ipc_free_inst and ipc_close usb: gadget: f_qdss: Allocate one string ID for all instances usb: gadget: Reset string ids upon unbind usb: dwc3: Write necessary registers for dual port enablement usb: dwc3: Add support for 4 PHYs for dual port controller BACKPORT: drivers: thermal: Re-initialize Tsens controller interrupt configuration BACKPORT: drivers: thermal: Avoid multiple TSENS controller re-init simultaneously drivers: thermal: Force notify thermal to re-evaluate TSENS sensors staging: android: ion: Add support for Carveout allocations in ion_alloc soc: qcom: dcc_v2: Add PM callbacks to support hibernation rpmsg: qcom_smd: Add SET signal support spi: spi-geni-qcom: Don't initialize GSI channels for FIFO/SE_DMA mode spi: spi-geni-qcom: Check for zero length transfer spi: spi-geni-qcom: Reset the dma engine on failure platform: msm: qcom-geni-se: Enable SSC QUP SE clks before SCM call msm: sps: SPS driver changes for dummy BAM connect msm: mhi_dev: update NHWER after M0 from host msm: mhi_dev: Do not flush events to host if channel is stopped msm: mhi_dev: Increase size of ipa_clnt_hndl array msm: mhi_dev: Disable IPA DMA during MHI cleanup msm: ipa3: Fix to map the npn phy address only once msm: ipa3: Add support to fastmap/geometry for each CB msm: ipa3: Send actual DL flt rule to Q6 msm: ipa3: Wait for IPA post init for 1000 msec before return msm: ipa: Support hardware accelerated DIAG over qdss msm: ipa3: Fix increase the NAPI budget to maximum msm: ipa: Fix rndis client disconnection gracefully msm: ipa3: Change IPA log type msm: kgsl: Dump GPU registers only when GX is ON msm: adsprpc: vote for CPU to stay awake during RPC call icnss: Avoid wlan driver unload if driver is not probed cpufreq: stats: Change return type of cpufreq_stats_update() as void cpufreq: stats: Handle the case when trans_table goes beyond PAGE_SIZE clk: qcom: Add enable_safe_config for gfx3d_clk_src clk: qcom: rcg2: Fix possible null pointer dereference ARM: dts: msm: Add smp2p based shutdown-ack ARM: dts: msm: add xo_clk for DP display on sm8150 ARM: dts: msm: add link clk rcg entry on sm8150 Linux 4.14.188 efi: Make it possible to disable efivar_ssdt entirely dm zoned: assign max_io_len correctly irqchip/gic: Atomically update affinity MIPS: Add missing EHB in mtc0 -> mfc0 sequence for DSPen cifs: Fix the target file was deleted when rename failed. SMB3: Honor persistent/resilient handle flags for multiuser mounts SMB3: Honor 'seal' flag for multiuser mounts Revert "ALSA: usb-audio: Improve frames size computation" nfsd: apply umask on fs without ACL support i2c: algo-pca: Add 0x78 as SCL stuck low status for PCA9665 virtio-blk: free vblk-vqs in error path of virtblk_probe() drm: sun4i: hdmi: Remove extra HPD polling hwmon: (acpi_power_meter) Fix potential memory leak in acpi_power_meter_add() hwmon: (max6697) Make sure the OVERT mask is set correctly cxgb4: parse TC-U32 key values and masks natively cxgb4: use unaligned conversion for fetching timestamp crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() kgdb: Avoid suspicious RCU usage warning usb: usbtest: fix missing kfree(dev->buf) in usbtest_disconnect mm/slub: fix stack overruns with SLUB_STATS mm/slub.c: fix corrupted freechain in deactivate_slab() usbnet: smsc95xx: Fix use-after-free after removal EDAC/amd64: Read back the scrub rate PCI register on F15h mm: fix swap cache node allocation mask btrfs: fix data block group relocation failure due to concurrent scrub btrfs: cow_file_range() num_bytes and disk_num_bytes are same btrfs: fix a block group ref counter leak after failure to remove block group UPSTREAM: binder: fix null deref of proc->context rmnet_shs: set gso_type when partially segmenting SKBs uapi: add ADM_AUDPROC_PERSISTENT cal type Release 5.2.03.27R qcacld-3.0: Validate session id before checking ps enable timer state Release 5.2.03.27Q qcacld-3.0: Print next RSSI threshold for periodic scan roam trigger qcacld-3.0: Add dealloc api to free memory allocated for ll_stats Release 5.2.03.27P qcacld-3.0: Correct VHT TX STBC setting according to target capability Release 5.2.03.27O qcacld-3.0: Don't create wifi-aware0 interface if NAN is not supported Release 5.2.03.27N qcacld-3.0: Add tgt layer for packet capture mode qcacld-3.0: Don't set hw_filter for NDI mode qcacmn: Fix null pointer dereference at extract_11kv_stats_tlv Release 5.2.03.27M qcacld-3.0: unregister peer hang notifier Release 5.2.03.27L qcacld-3.0: Add support to dynamically set dwell time for 2g qcacld-3.0: Update set dwell time correctly fw-api: Add rx_flow_search_entry.h for qca6750 fw-api: CL 10663966 - update fw common interface files fw-api: CL 10599980 - update fw common interface files fw-api: CL 10599978 - update fw common interface files fw-api: CL 10581227 - update fw common interface files fw-api: CL 10576300 - update fw common interface files fw-api: CL 10543175 - update fw common interface files qcacmn: Add support to dynamically set dwell time for 2g qcacmn: Update set dwell time correctly fw-api: Add HW header files for QCA5018 dsp: Fix a memory leak issue when nvmem read returns invalid length Signed-off-by: UtsavBalar1231 <utsavbalar1231@gmail.com>
2020-07-11 20:25:52 +05:30
parent 22d5c0065b 470e112ea9
commit 4614a8c871
236 changed files with 113075 additions and 651 deletions
--- a/Documentation/cpu-freq/cpufreq-stats.txt
+++ b/Documentation/cpu-freq/cpufreq-stats.txt
@@ -90,6 +90,9 @@ Freq_i to Freq_j. Freq_i is in descending order with increasing rows and
 Freq_j is in descending order with increasing columns. The output here also 
 contains the actual freq values for each row and column for better readability.

+If the transition table is bigger than PAGE_SIZE, reading this will
+return an -EFBIG error.
+
 --------------------------------------------------------------------------------
 <mysystem>:/sys/devices/system/cpu/cpu0/cpufreq/stats # cat trans_table
   From  :    To
--- a/Documentation/devicetree/bindings/usb/msm-ssusb.txt
+++ b/Documentation/devicetree/bindings/usb/msm-ssusb.txt
@@ -93,6 +93,8 @@ Optional properties :
 	capable DWC3 which does not have extcon handle.
 - qcom,default-mode-host: If present, start host mode on probe for an OTG
 	capable DWC3 which does not have extcon handle.
+- qcom,dual-port: If present, 2 different physical ports are supported by this
+	core. Please note that this flag is valid for cores supporting only host mode.

 Sub nodes:
 - Sub node for "DWC3- USB3 controller".
--- a/Documentation/devicetree/bindings/usb/qpnp-pdphy.txt
+++ b/Documentation/devicetree/bindings/usb/qpnp-pdphy.txt
@@ -43,6 +43,7 @@ Optional properties:
 - qcom,default-sink-caps: List of 32-bit values representing the nominal sink
 			capabilities in voltage (millivolts) and current
 			(milliamps) pairs.
+- qcom,no-usb3-dp-concurrency: If present, usb3 and dp concurrency is not supported.

 Example:
 	qcom,qpnp-pdphy@1700 {
--- a/Documentation/sysctl/kernel.txt
+++ b/Documentation/sysctl/kernel.txt
@@ -678,7 +678,8 @@ allowed to execute.
 perf_event_paranoid:

 Controls use of the performance events system by unprivileged
-users (without CAP_SYS_ADMIN).  The default value is 2.
+users (without CAP_SYS_ADMIN).  The default value is 3 if
+CONFIG_SECURITY_PERF_EVENTS_RESTRICT is set, or 2 otherwise.

 -1: Allow use of (almost) all events by all users
     Ignore mlock limit after perf_event_mlock_kb without CAP_IPC_LOCK
@@ -686,6 +687,7 @@ users (without CAP_SYS_ADMIN).  The default value is 2.
     Disallow raw tracepoint access by users without CAP_SYS_ADMIN
 >=1: Disallow CPU event access by users without CAP_SYS_ADMIN
 >=2: Disallow kernel profiling by users without CAP_SYS_ADMIN
+>=3: Disallow all event access by users without CAP_SYS_ADMIN

 ==============================================================

--- a/2
+++ b/2
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 4
 PATCHLEVEL = 14
-SUBLEVEL = 187
+SUBLEVEL = 188
 EXTRAVERSION =
 NAME = Petit Gorille

--- a/arch/arm64/boot/dts/qcom/sm6150.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm6150.dtsi
@@ -2387,13 +2387,15 @@
 				<&adsp_smp2p_in 0 0>,
 				<&adsp_smp2p_in 2 0>,
 				<&adsp_smp2p_in 1 0>,
-				<&adsp_smp2p_in 3 0>;
+				<&adsp_smp2p_in 3 0>,
+				<&adsp_smp2p_in 7 0>;

 		interrupt-names = "qcom,wdog",
 				"qcom,err-fatal",
 				"qcom,proxy-unvote",
 				"qcom,err-ready",
-				"qcom,stop-ack";
+				"qcom,stop-ack",
+				"qcom,shutdown-ack";

 		/* Outputs to lpass */
 		qcom,smem-states = <&adsp_smp2p_out 0>;
@@ -2478,13 +2480,15 @@
 				<&cdsp_smp2p_in 0 0>,
 				<&cdsp_smp2p_in 2 0>,
 				<&cdsp_smp2p_in 1 0>,
-				<&cdsp_smp2p_in 3 0>;
+				<&cdsp_smp2p_in 3 0>,
+				<&cdsp_smp2p_in 7 0>;

 		interrupt-names = "qcom,wdog",
 				"qcom,err-fatal",
 				"qcom,proxy-unvote",
 				"qcom,err-ready",
-				"qcom,stop-ack";
+				"qcom,stop-ack",
+				"qcom,shutdown-ack";

 		/* Outputs to turing */
 		qcom,smem-states = <&cdsp_smp2p_out 0>;
--- a/arch/arm64/boot/dts/qcom/sm8150-sde.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8150-sde.dtsi
@@ -1,4 +1,4 @@
-/* Copyright (c) 2016-2019, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2016-2020, The Linux Foundation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 and
@@ -632,13 +632,16 @@
 			 <&clock_dispcc DISP_CC_MDSS_DP_PIXEL1_CLK_SRC>,
 			 <&mdss_dp_pll DP_VCO_DIVIDED_CLK_SRC_MUX>,
 			 <&clock_dispcc DISP_CC_MDSS_DP_PIXEL_CLK>,
-			 <&clock_dispcc DISP_CC_MDSS_DP_PIXEL1_CLK>;
+			 <&clock_dispcc DISP_CC_MDSS_DP_PIXEL1_CLK>,
+			 <&clock_dispcc DISP_CC_MDSS_DP_LINK_CLK_SRC>,
+			 <&clock_rpmh RPMH_CXO_CLK>;
 		clock-names = "core_aux_clk", "core_usb_ref_clk_src",
 			"core_usb_ref_clk", "core_usb_pipe_clk",
 			"link_clk", "link_iface_clk",
 			"crypto_clk", "pixel_clk_rcg", "pixel_parent",
 			"pixel1_clk_rcg", "pixel1_parent",
-			"strm0_pixel_clk", "strm1_pixel_clk";
+			"strm0_pixel_clk", "strm1_pixel_clk",
+			"link_clk_rcg", "xo_clk";

 		qcom,phy-version = <0x420>;
 		qcom,aux-cfg0-settings = [20 00];
--- a/arch/arm64/boot/dts/qcom/sm8150.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8150.dtsi
@@ -1732,13 +1732,15 @@
 				<&adsp_smp2p_in 0 0>,
 				<&adsp_smp2p_in 2 0>,
 				<&adsp_smp2p_in 1 0>,
-				<&adsp_smp2p_in 3 0>;
+				<&adsp_smp2p_in 3 0>,
+				<&adsp_smp2p_in 7 0>;

 		interrupt-names = "qcom,wdog",
 				"qcom,err-fatal",
 				"qcom,proxy-unvote",
 				"qcom,err-ready",
-				"qcom,stop-ack";
+				"qcom,stop-ack",
+				"qcom,shutdown-ack";

 		/* Outputs to lpass */
 		qcom,smem-states = <&adsp_smp2p_out 0>;
@@ -1889,13 +1891,15 @@
 				<&cdsp_smp2p_in 0 0>,
 				<&cdsp_smp2p_in 2 0>,
 				<&cdsp_smp2p_in 1 0>,
-				<&cdsp_smp2p_in 3 0>;
+				<&cdsp_smp2p_in 3 0>,
+				<&cdsp_smp2p_in 7 0>;

 		interrupt-names = "qcom,wdog",
 				"qcom,err-fatal",
 				"qcom,proxy-unvote",
 				"qcom,err-ready",
-				"qcom,stop-ack";
+				"qcom,stop-ack",
+				"qcom,shutdown-ack";

 		/* Outputs to turing */
 		qcom,smem-states = <&cdsp_smp2p_out 0>;
--- a/arch/arm64/configs/cuttlefish_defconfig
+++ b/arch/arm64/configs/cuttlefish_defconfig
@@ -466,6 +466,7 @@ CONFIG_RCU_CPU_STALL_TIMEOUT=60
 CONFIG_ENABLE_DEFAULT_TRACERS=y
 CONFIG_TEST_MEMINIT=y
 CONFIG_TEST_STACKINIT=y
+CONFIG_SECURITY_PERF_EVENTS_RESTRICT=y
 CONFIG_SECURITY=y
 CONFIG_SECURITY_NETWORK=y
 CONFIG_LSM_MMAP_MIN_ADDR=65536
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -2135,6 +2135,7 @@ static void configure_status(void)

 	change_c0_status(ST0_CU|ST0_MX|ST0_RE|ST0_FR|ST0_BEV|ST0_TS|ST0_KX|ST0_SX|ST0_UX,
 			 status_set);
+	back_to_back_c0_hazard();
 }

 unsigned int hwrena;
--- a/arch/x86/configs/x86_64_cuttlefish_defconfig
+++ b/arch/x86/configs/x86_64_cuttlefish_defconfig
@@ -499,6 +499,7 @@ CONFIG_TEST_STACKINIT=y
 CONFIG_IO_DELAY_NONE=y
 CONFIG_OPTIMIZE_INLINING=y
 CONFIG_UNWINDER_FRAME_POINTER=y
+CONFIG_SECURITY_PERF_EVENTS_RESTRICT=y
 CONFIG_SECURITY=y
 CONFIG_SECURITY_NETWORK=y
 CONFIG_SECURITY_PATH=y
--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@ -133,21 +133,15 @@ EXPORT_SYMBOL_GPL(af_alg_release);
 void af_alg_release_parent(struct sock *sk)
 {
 	struct alg_sock *ask = alg_sk(sk);
-	unsigned int nokey = ask->nokey_refcnt;
-	bool last = nokey && !ask->refcnt;
+	unsigned int nokey = atomic_read(&ask->nokey_refcnt);

 	sk = ask->parent;
 	ask = alg_sk(sk);

-	local_bh_disable();
-	bh_lock_sock(sk);
-	ask->nokey_refcnt -= nokey;
-	if (!last)
-		last = !--ask->refcnt;
-	bh_unlock_sock(sk);
-	local_bh_enable();
+	if (nokey)
+		atomic_dec(&ask->nokey_refcnt);

-	if (last)
+	if (atomic_dec_and_test(&ask->refcnt))
 		sock_put(sk);
 }
 EXPORT_SYMBOL_GPL(af_alg_release_parent);
@@ -192,7 +186,7 @@ static int alg_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)

 	err = -EBUSY;
 	lock_sock(sk);
-	if (ask->refcnt | ask->nokey_refcnt)
+	if (atomic_read(&ask->refcnt))
 		goto unlock;

 	swap(ask->type, type);
@@ -241,7 +235,7 @@ static int alg_setsockopt(struct socket *sock, int level, int optname,
 	int err = -EBUSY;

 	lock_sock(sk);
-	if (ask->refcnt)
+	if (atomic_read(&ask->refcnt) != atomic_read(&ask->nokey_refcnt))
 		goto unlock;

 	type = ask->type;
@@ -308,12 +302,14 @@ int af_alg_accept(struct sock *sk, struct socket *newsock, bool kern)

 	sk2->sk_family = PF_ALG;

-	if (nokey || !ask->refcnt++)
+	if (atomic_inc_return_relaxed(&ask->refcnt) == 1)
 		sock_hold(sk);
-	ask->nokey_refcnt += nokey;
+	if (nokey) {
+		atomic_inc(&ask->nokey_refcnt);
+		atomic_set(&alg_sk(sk2)->nokey_refcnt, 1);
+	}
 	alg_sk(sk2)->parent = sk;
 	alg_sk(sk2)->type = type;
-	alg_sk(sk2)->nokey_refcnt = nokey;

 	newsock->ops = type->ops;
 	newsock->state = SS_CONNECTED;
--- a/crypto/algif_aead.c
+++ b/crypto/algif_aead.c
@@ -389,7 +389,7 @@ static int aead_check_key(struct socket *sock)
 	struct alg_sock *ask = alg_sk(sk);

 	lock_sock(sk);
-	if (ask->refcnt)
+	if (!atomic_read(&ask->nokey_refcnt))
 		goto unlock_child;

 	psk = ask->parent;
@@ -401,11 +401,8 @@ static int aead_check_key(struct socket *sock)
 	if (!tfm->has_key)
 		goto unlock;

-	if (!pask->refcnt++)
-		sock_hold(psk);
-
-	ask->refcnt = 1;
-	sock_put(psk);
+	atomic_dec(&pask->nokey_refcnt);
+	atomic_set(&ask->nokey_refcnt, 0);

 	err = 0;

--- a/crypto/algif_hash.c
+++ b/crypto/algif_hash.c
@@ -309,7 +309,7 @@ static int hash_check_key(struct socket *sock)
 	struct alg_sock *ask = alg_sk(sk);

 	lock_sock(sk);
-	if (ask->refcnt)
+	if (!atomic_read(&ask->nokey_refcnt))
 		goto unlock_child;

 	psk = ask->parent;
@@ -321,11 +321,8 @@ static int hash_check_key(struct socket *sock)
 	if (crypto_ahash_get_flags(tfm) & CRYPTO_TFM_NEED_KEY)
 		goto unlock;

-	if (!pask->refcnt++)
-		sock_hold(psk);
-
-	ask->refcnt = 1;
-	sock_put(psk);
+	atomic_dec(&pask->nokey_refcnt);
+	atomic_set(&ask->nokey_refcnt, 0);

 	err = 0;

--- a/crypto/algif_skcipher.c
+++ b/crypto/algif_skcipher.c
@@ -223,7 +223,7 @@ static int skcipher_check_key(struct socket *sock)
 	struct alg_sock *ask = alg_sk(sk);

 	lock_sock(sk);
-	if (ask->refcnt)
+	if (!atomic_read(&ask->nokey_refcnt))
 		goto unlock_child;

 	psk = ask->parent;
@@ -235,11 +235,8 @@ static int skcipher_check_key(struct socket *sock)
 	if (!tfm->has_key)
 		goto unlock;

-	if (!pask->refcnt++)
-		sock_hold(psk);
-
-	ask->refcnt = 1;
-	sock_put(psk);
+	atomic_dec(&pask->nokey_refcnt);
+	atomic_set(&ask->nokey_refcnt, 0);

 	err = 0;

--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -4650,8 +4650,15 @@ static struct binder_thread *binder_get_thread(struct binder_proc *proc)

 static void binder_free_proc(struct binder_proc *proc)
 {
+	struct binder_device *device;
+
 	BUG_ON(!list_empty(&proc->todo));
 	BUG_ON(!list_empty(&proc->delivered_death));
+	device = container_of(proc->context, struct binder_device, context);
+	if (refcount_dec_and_test(&device->ref)) {
+		kfree(proc->context->name);
+		kfree(device);
+	}
 	binder_alloc_deferred_release(&proc->alloc);
 	put_task_struct(proc->tsk);
 	binder_stats_deleted(BINDER_STAT_PROC);
@@ -5379,7 +5386,6 @@ static int binder_node_release(struct binder_node *node, int refs)
 static void binder_deferred_release(struct binder_proc *proc)
 {
 	struct binder_context *context = proc->context;
-	struct binder_device *device;
 	struct rb_node *n;
 	int threads, nodes, incoming_refs, outgoing_refs, active_transactions;

@@ -5398,12 +5404,6 @@ static void binder_deferred_release(struct binder_proc *proc)
 		context->binder_context_mgr_node = NULL;
 	}
 	mutex_unlock(&context->context_mgr_node_lock);
-	device = container_of(proc->context, struct binder_device, context);
-	if (refcount_dec_and_test(&device->ref)) {
-		kfree(context->name);
-		kfree(device);
-	}
-	proc->context = NULL;
 	binder_inner_proc_lock(proc);
 	/*
 	 * Make sure proc stays alive after we
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -1023,6 +1023,7 @@ out_put_disk:
 	put_disk(vblk->disk);
 out_free_vq:
 	vdev->config->del_vqs(vdev);
+	kfree(vblk->vqs);
 out_free_vblk:
 	kfree(vblk);
 out_free_index:
--- a/drivers/char/adsprpc.c
+++ b/drivers/char/adsprpc.c
@@ -225,6 +225,7 @@ struct smq_invoke_ctx {
 	struct fastrpc_buf *lbuf;
 	size_t used;
 	struct fastrpc_file *fl;
+	uint32_t handle;
 	uint32_t sc;
 	struct overlap *overs;
 	struct overlap **overps;
@@ -310,6 +311,8 @@ struct fastrpc_apps {
 	spinlock_t ctxlock;
 	struct smq_invoke_ctx *ctxtable[FASTRPC_CTX_MAX];
 	bool legacy_remote_heap;
+	struct wakeup_source *wake_source;
+	unsigned int wake_count;
 };

 struct fastrpc_mmap {
@@ -391,6 +394,8 @@ struct fastrpc_file {
 	/* Identifies the device (MINOR_NUM_DEV / MINOR_NUM_SECURE_DEV) */
 	int dev_minor;
 	char *debug_buf;
+	/* Flag to enable PM wake/relax voting for every remote invoke */
+	int wake_enable;
 };

 static struct fastrpc_apps gfa;
@@ -1228,6 +1233,7 @@ static int context_alloc(struct fastrpc_file *fl, uint32_t kernel,
 			goto bail;
 	}
 	ctx->crc = (uint32_t *)invokefd->crc;
+	ctx->handle = invoke->handle;
 	ctx->sc = invoke->sc;
 	if (bufs) {
 		VERIFY(err, 0 == context_build_overlap(ctx));
@@ -1907,7 +1913,36 @@ static void fastrpc_init(struct fastrpc_apps *me)
 	me->channel[CDSP_DOMAIN_ID].secure = NON_SECURE_CHANNEL;
 }

-static int fastrpc_release_current_dsp_process(struct fastrpc_file *fl);
+static inline void fastrpc_pm_awake(int fl_wake_enable, int *wake_enable)
+{
+	struct fastrpc_apps *me = &gfa;
+
+	if (!fl_wake_enable)
+		return;
+
+	spin_lock(&me->hlock);
+	if (!me->wake_count)
+		__pm_stay_awake(me->wake_source);
+	me->wake_count++;
+	spin_unlock(&me->hlock);
+	*wake_enable = 1;
+}
+
+static inline void fastrpc_pm_relax(int *wake_enable)
+{
+	struct fastrpc_apps *me = &gfa;
+
+	if (!(*wake_enable))
+		return;
+
+	spin_lock(&me->hlock);
+	if (me->wake_count)
+		me->wake_count--;
+	if (!me->wake_count)
+		__pm_relax(me->wake_source);
+	spin_unlock(&me->hlock);
+	*wake_enable = 0;
+}

 static int fastrpc_internal_invoke(struct fastrpc_file *fl, uint32_t mode,
 				   uint32_t kernel,
@@ -1916,6 +1951,7 @@ static int fastrpc_internal_invoke(struct fastrpc_file *fl, uint32_t mode,
 	struct smq_invoke_ctx *ctx = NULL;
 	struct fastrpc_ioctl_invoke *invoke = &inv->inv;
 	int err = 0, cid = -1, interrupted = 0;
+	int wake_enable = 0;
 	struct timespec invoket = {0};
 	int64_t *perf_counter = NULL;

@@ -1932,6 +1968,7 @@ static int fastrpc_internal_invoke(struct fastrpc_file *fl, uint32_t mode,
 	}
 	perf_counter = getperfcounter(fl, PERF_COUNT);

+	fastrpc_pm_awake(fl->wake_enable, &wake_enable);
 	if (fl->profile)
 		getnstimeofday(&invoket);

@@ -1982,14 +2019,15 @@ static int fastrpc_internal_invoke(struct fastrpc_file *fl, uint32_t mode,
 	if (err)
 		goto bail;
 wait:
+	fastrpc_pm_relax(&wake_enable);
 	if (kernel)
 		wait_for_completion(&ctx->work);
-	else {
+	else
 		interrupted = wait_for_completion_interruptible(&ctx->work);
-		VERIFY(err, 0 == (err = interrupted));
-		if (err)
-			goto bail;
-	}
+	fastrpc_pm_awake(fl->wake_enable, &wake_enable);
+	VERIFY(err, 0 == (err = interrupted));
+	if (err)
+		goto bail;

 	PERF(fl->profile, GET_COUNTER(perf_counter, PERF_INVARGS),
 	if (!fl->sctx->smmu.coherent)
@@ -2027,6 +2065,7 @@ static int fastrpc_internal_invoke(struct fastrpc_file *fl, uint32_t mode,
 				*count = *count+1;
 		}
 	}
+	fastrpc_pm_relax(&wake_enable);
 	return err;
 }

@@ -2808,9 +2847,12 @@ static int fastrpc_session_alloc_locked(struct fastrpc_channel_ctx *chan,
 				break;
 			}
 		}
-		VERIFY(err, idx < chan->sesscount);
-		if (err)
+		if (idx >= chan->sesscount) {
+			err = -EUSERS;
+			pr_err("adsprpc: ERROR %d: %s: max concurrent sessions limit (%d) already reached on %s\n",
+				err, __func__, chan->sesscount, chan->subsys);
 			goto bail;
+		}
 		chan->session[idx].smmu.faults = 0;
 	} else {
 		VERIFY(err, me->dev != NULL);
@@ -3265,7 +3307,7 @@ static int fastrpc_channel_open(struct fastrpc_file *fl)

 	VERIFY(err, fl && fl->sctx && fl->cid >= 0 && fl->cid < NUM_CHANNELS);
 	if (err) {
-		pr_err("adsprpc: ERROR: %s: user application %s domain is not set\n",
+		pr_err("adsprpc: ERROR: %s: kernel session not initialized yet for %s\n",
 			__func__, current->comm);
 		err = -EBADR;
 		return err;
@@ -3423,8 +3465,8 @@ static int fastrpc_get_info(struct fastrpc_file *fl, uint32_t *info)
 		fl->cid = cid;
 		fl->ssrcount = fl->apps->channel[cid].ssrcount;
 		mutex_lock(&fl->apps->channel[cid].smd_mutex);
-		VERIFY(err, !fastrpc_session_alloc_locked(
-				&fl->apps->channel[cid], 0, &fl->sctx));
+		err = fastrpc_session_alloc_locked(&fl->apps->channel[cid],
+				0, &fl->sctx);
 		mutex_unlock(&fl->apps->channel[cid].smd_mutex);
 		if (err)
 			goto bail;
@@ -3467,8 +3509,11 @@ static int fastrpc_internal_control(struct fastrpc_file *fl,
 	case FASTRPC_CONTROL_KALLOC:
 		cp->kalloc.kalloc_support = 1;
 		break;
+	case FASTRPC_CONTROL_WAKELOCK:
+		fl->wake_enable = cp->wp.enable;
+		break;
 	default:
-		err = -ENOTTY;
+		err = -EBADRQC;
 		break;
 	}
 bail:
@@ -4386,11 +4431,19 @@ static int __init fastrpc_device_init(void)

 	err = register_rpmsg_driver(&fastrpc_rpmsg_client);
 	if (err) {
-		pr_err("adsprpc: register_rpmsg_driver: failed with err %d\n",
-			err);
+		pr_err("adsprpc: %s: register_rpmsg_driver failed with err %d\n",
+			__func__, err);
 		goto device_create_bail;
 	}
 	me->rpmsg_register = 1;
+
+	me->wake_source = wakeup_source_register(NULL, "adsprpc");
+	VERIFY(err, !IS_ERR_OR_NULL(me->wake_source));
+	if (err) {
+		pr_err("adsprpc: Error: %s: wakeup_source_register failed with err %d\n",
+					__func__, PTR_ERR(me->wake_source));
+		goto device_create_bail;
+	}
 	return 0;
 device_create_bail:
 	for (i = 0; i < NUM_CHANNELS; i++) {
@@ -4439,6 +4492,8 @@ static void __exit fastrpc_device_exit(void)
 	unregister_chrdev_region(me->dev_no, NUM_CHANNELS);
 	if (me->rpmsg_register == 1)
 		unregister_rpmsg_driver(&fastrpc_rpmsg_client);
+	if (me->wake_source)
+		wakeup_source_unregister(me->wake_source);
 	debugfs_remove_recursive(debugfs_root);
 }

--- a/drivers/char/adsprpc_shared.h
+++ b/drivers/char/adsprpc_shared.h
@@ -241,22 +241,32 @@ struct fastrpc_ioctl_perf {			/* kernel performance data */
 	uintptr_t keys;
 };

-#define FASTRPC_CONTROL_LATENCY	(1)
+enum fastrpc_control_type {
+	FASTRPC_CONTROL_LATENCY		=	1,
+	FASTRPC_CONTROL_SMMU		=	2,
+	FASTRPC_CONTROL_KALLOC		=	3,
+	FASTRPC_CONTROL_WAKELOCK	=	4,
+};
+
 struct fastrpc_ctrl_latency {
 	uint32_t enable;	/* latency control enable */
 	uint32_t level;		/* level of control */
 };

-#define FASTRPC_CONTROL_KALLOC	(3)
 struct fastrpc_ctrl_kalloc {
 	uint32_t kalloc_support;  /* Remote memory allocation from kernel */
 };
-/* FASTRPC_CONTROL value 2 is reserved in user space */
+
+struct fastrpc_ctrl_wakelock {
+	uint32_t enable;	/* wakelock control enable */
+};
+
 struct fastrpc_ioctl_control {
 	uint32_t req;
 	union {
 		struct fastrpc_ctrl_latency lp;
 		struct fastrpc_ctrl_kalloc kalloc;
+		struct fastrpc_ctrl_wakelock wp;
 	};
 };

--- a/drivers/clk/qcom/clk-rcg2.c
+++ b/drivers/clk/qcom/clk-rcg2.c
@@ -1475,7 +1475,11 @@ static int clk_gfx3d_src_determine_rate(struct clk_hw *hw,
 	}

 	f = qcom_find_freq(rcg->freq_tbl, req->rate);
-	if (!f || (req->rate != f->freq))
+
+	if (!f)
+		return -EINVAL;
+
+	if (req->rate != f->freq)
 		req->rate = f->freq;

 	/* Indexes of source from the parent map */
--- a/drivers/clk/qcom/gpucc-sdm660.c
+++ b/drivers/clk/qcom/gpucc-sdm660.c
@@ -209,6 +209,7 @@ static struct clk_rcg2 gfx3d_clk_src = {
 	.freq_tbl = ftbl_gfx3d_clk_src,
 	.parent_map = gpucc_parent_map_1,
 	.flags = FORCE_ENABLE_RCG,
+	.enable_safe_config = true,
 	.clkr.hw.init = &gpu_clks_init[0],
 };

--- a/drivers/cpufreq/cpufreq_stats.c
+++ b/drivers/cpufreq/cpufreq_stats.c
@@ -25,14 +25,13 @@ struct cpufreq_stats {
 	unsigned int *trans_table;
 };

-static int cpufreq_stats_update(struct cpufreq_stats *stats)
+static void cpufreq_stats_update(struct cpufreq_stats *stats)
 {
 	unsigned long long cur_time = get_jiffies_64();
 	unsigned long long time = cur_time;

 	time = atomic64_xchg(&stats->last_time, time);
 	atomic64_add(cur_time - time, &stats->time_in_state[stats->last_index]);
-	return 0;
 }

 static void cpufreq_stats_clear_table(struct cpufreq_stats *stats)
@@ -110,8 +109,11 @@ static ssize_t show_trans_table(struct cpufreq_policy *policy, char *buf)
 			break;
 		len += snprintf(buf + len, PAGE_SIZE - len, "\n");
 	}
-	if (len >= PAGE_SIZE)
-		return PAGE_SIZE;
+
+	if (len >= PAGE_SIZE) {
+		pr_warn_once("cpufreq transition table exceeds PAGE_SIZE. Disabling\n");
+		return -EFBIG;
+	}
 	return len;
 }
 cpufreq_freq_attr_ro(trans_table);
--- a/drivers/cpuidle/lpm-levels.c
+++ b/drivers/cpuidle/lpm-levels.c
@@ -1089,15 +1089,6 @@ static int cluster_configure(struct lpm_cluster *cluster, int idx,
 	}

 	if (level->notify_rpm) {
-		/*
-		 * Print the clocks which are enabled during system suspend
-		 * This debug information is useful to know which are the
-		 * clocks that are enabled and preventing the system level
-		 * LPMs(XO and Vmin).
-		 */
-		if (!from_idle)
-			clock_debug_print_enabled(false);
-
 		cpu = get_next_online_cpu(from_idle);
 		cpumask_copy(&cpumask, cpumask_of(cpu));
 		clear_predict_history();
@@ -1711,6 +1702,15 @@ static int lpm_suspend_enter(suspend_state_t state)
 		pr_err("Failed suspend\n");
 		return 0;
 	}
+
+	/*
+	 * Print the clocks which are enabled during system suspend.
+	 * This debug information is useful to know which
+	 * resources are enabled and preventing the system level
+	 * LPMs (XO and Vmin).
+	 */
+	clock_debug_print_enabled(false);
+
 	cpu_prepare(lpm_cpu, idx, false);
 	cluster_prepare(cluster, cpumask, idx, false, 0);

--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -261,6 +261,8 @@ static int get_scrub_rate(struct mem_ctl_info *mci)

 		if (pvt->model == 0x60)
 			amd64_read_pci_cfg(pvt->F2, F15H_M60H_SCRCTRL, &scrubval);
+		else
+			amd64_read_pci_cfg(pvt->F3, SCRCTRL, &scrubval);
 		break;

 	case 0x17:
--- a/drivers/firmware/efi/Kconfig
+++ b/drivers/firmware/efi/Kconfig
@@ -164,6 +164,17 @@ config RESET_ATTACK_MITIGATION
 	  have been evicted, since otherwise it will trigger even on clean
 	  reboots.

+config EFI_CUSTOM_SSDT_OVERLAYS
+	bool "Load custom ACPI SSDT overlay from an EFI variable"
+	depends on EFI_VARS && ACPI
+	default ACPI_TABLE_UPGRADE
+	help
+	  Allow loading of an ACPI SSDT overlay from an EFI variable specified
+	  by a kernel command line option.
+
+	  See Documentation/admin-guide/acpi/ssdt-overlays.rst for more
+	  information.endmenu
+
 endmenu

 config UEFI_CPER
--- a/drivers/firmware/efi/efi.c
+++ b/drivers/firmware/efi/efi.c
@@ -221,7 +221,7 @@ static void generic_ops_unregister(void)
 	efivars_unregister(&generic_efivars);
 }

-#if IS_ENABLED(CONFIG_ACPI)
+#ifdef CONFIG_EFI_CUSTOM_SSDT_OVERLAYS
 #define EFIVAR_SSDT_NAME_MAX	16
 static char efivar_ssdt[EFIVAR_SSDT_NAME_MAX] __initdata;
 static int __init efivar_ssdt_setup(char *str)
--- a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
+++ b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
@@ -214,9 +214,8 @@ sun4i_hdmi_connector_detect(struct drm_connector *connector, bool force)
 	struct sun4i_hdmi *hdmi = drm_connector_to_sun4i_hdmi(connector);
 	unsigned long reg;

-	if (readl_poll_timeout(hdmi->base + SUN4I_HDMI_HPD_REG, reg,
-			       reg & SUN4I_HDMI_HPD_HIGH,
-			       0, 500000)) {
+	reg = readl(hdmi->base + SUN4I_HDMI_HPD_REG);
+	if (reg & SUN4I_HDMI_HPD_HIGH) {
 		cec_phys_addr_invalidate(hdmi->cec_adap);
 		return connector_status_disconnected;
 	}
--- a/drivers/gpu/msm/adreno_a6xx_gmu.c
+++ b/drivers/gpu/msm/adreno_a6xx_gmu.c
@@ -928,12 +928,9 @@ static int a6xx_gmu_wait_for_lowest_idle(struct adreno_device *adreno_dev)

 	/* Collect abort data to help with debugging */
 	gmu_core_regread(device, A6XX_GPU_GMU_AO_GPU_CX_BUSY_STATUS, &reg2);
-	kgsl_regread(device, A6XX_CP_STATUS_1, &reg3);
-	gmu_core_regread(device, A6XX_GMU_RBBM_INT_UNMASKED_STATUS, &reg4);
-	gmu_core_regread(device, A6XX_GMU_GMU_PWR_COL_KEEPALIVE, &reg5);
-	kgsl_regread(device, A6XX_CP_CP2GMU_STATUS, &reg6);
-	kgsl_regread(device, A6XX_CP_CONTEXT_SWITCH_CNTL, &reg7);
-	gmu_core_regread(device, A6XX_GMU_AO_SPARE_CNTL, &reg8);
+	gmu_core_regread(device, A6XX_GMU_RBBM_INT_UNMASKED_STATUS, &reg3);
+	gmu_core_regread(device, A6XX_GMU_GMU_PWR_COL_KEEPALIVE, &reg4);
+	gmu_core_regread(device, A6XX_GMU_AO_SPARE_CNTL, &reg5);

 	dev_err(&gmu->pdev->dev,
 		"----------------------[ GMU error ]----------------------\n");
@@ -943,14 +940,23 @@ static int a6xx_gmu_wait_for_lowest_idle(struct adreno_device *adreno_dev)
 		"Timestamps: %llx %llx %llx\n", ts1, ts2, ts3);
 	dev_err(&gmu->pdev->dev,
 		"RPMH_POWER_STATE=%x SPTPRAC_PWR_CLK_STATUS=%x\n", reg, reg1);
-	dev_err(&gmu->pdev->dev,
-		"CX_BUSY_STATUS=%x CP_STATUS_1=%x\n", reg2, reg3);
+	dev_err(&gmu->pdev->dev, "CX_BUSY_STATUS=%x\n", reg2);
 	dev_err(&gmu->pdev->dev,
 		"RBBM_INT_UNMASKED_STATUS=%x PWR_COL_KEEPALIVE=%x\n",
-		reg4, reg5);
-	dev_err(&gmu->pdev->dev,
-		"CP2GMU_STATUS=%x CONTEXT_SWITCH_CNTL=%x AO_SPARE_CNTL=%x\n",
-		reg6, reg7, reg8);
+		reg3, reg4);
+	dev_err(&gmu->pdev->dev, "A6XX_GMU_AO_SPARE_CNTL=%x\n", reg5);
+
+	/* Access GX registers only when GX is ON */
+	if (is_on(reg1)) {
+		kgsl_regread(device, A6XX_CP_STATUS_1, &reg6);
+		kgsl_regread(device, A6XX_CP_CP2GMU_STATUS, &reg7);
+		kgsl_regread(device, A6XX_CP_CONTEXT_SWITCH_CNTL, &reg8);
+
+		dev_err(&gmu->pdev->dev, "A6XX_CP_STATUS_1=%x\n", reg6);
+		dev_err(&gmu->pdev->dev,
+			"CP2GMU_STATUS=%x CONTEXT_SWITCH_CNTL=%x\n",
+			reg7, reg8);
+	}

 	WARN_ON(1);
 	return -ETIMEDOUT;
--- a/drivers/hwmon/acpi_power_meter.c
+++ b/drivers/hwmon/acpi_power_meter.c
@@ -895,7 +895,7 @@ static int acpi_power_meter_add(struct acpi_device *device)

 	res = setup_attrs(resource);
 	if (res)
-		goto exit_free;
+		goto exit_free_capability;

 	resource->hwmon_dev = hwmon_device_register(&device->dev);
 	if (IS_ERR(resource->hwmon_dev)) {
@@ -908,6 +908,8 @@ static int acpi_power_meter_add(struct acpi_device *device)

 exit_remove:
 	remove_attrs(resource);
+exit_free_capability:
+	free_capabilities(resource);
 exit_free:
 	kfree(resource);
 exit:
--- a/drivers/hwmon/max6697.c
+++ b/drivers/hwmon/max6697.c
@@ -47,8 +47,9 @@ static const u8 MAX6697_REG_CRIT[] = {
 * Map device tree / platform data register bit map to chip bit map.
 * Applies to alert register and over-temperature register.
 */
-#define MAX6697_MAP_BITS(reg)	((((reg) & 0x7e) >> 1) | \
+#define MAX6697_ALERT_MAP_BITS(reg)	((((reg) & 0x7e) >> 1) | \
 				 (((reg) & 0x01) << 6) | ((reg) & 0x80))
+#define MAX6697_OVERT_MAP_BITS(reg) (((reg) >> 1) | (((reg) & 0x01) << 7))

 #define MAX6697_REG_STAT(n)		(0x44 + (n))

@@ -587,12 +588,12 @@ static int max6697_init_chip(struct max6697_data *data,
 		return ret;

 	ret = i2c_smbus_write_byte_data(client, MAX6697_REG_ALERT_MASK,
-					MAX6697_MAP_BITS(pdata->alert_mask));
+				MAX6697_ALERT_MAP_BITS(pdata->alert_mask));
 	if (ret < 0)
 		return ret;

 	ret = i2c_smbus_write_byte_data(client, MAX6697_REG_OVERT_MASK,
-				MAX6697_MAP_BITS(pdata->over_temperature_mask));
+			MAX6697_OVERT_MAP_BITS(pdata->over_temperature_mask));
 	if (ret < 0)
 		return ret;

--- a/drivers/i2c/algos/i2c-algo-pca.c
+++ b/drivers/i2c/algos/i2c-algo-pca.c
@@ -326,7 +326,8 @@ static int pca_xfer(struct i2c_adapter *i2c_adap,
 			DEB2("BUS ERROR - SDA Stuck low\n");
 			pca_reset(adap);
 			goto out;
-		case 0x90: /* Bus error - SCL stuck low */
+		case 0x78: /* Bus error - SCL stuck low (PCA9665) */
+		case 0x90: /* Bus error - SCL stuck low (PCA9564) */
 			DEB2("BUS ERROR - SCL Stuck low\n");
 			pca_reset(adap);
 			goto out;
--- a/drivers/irqchip/irq-gic.c
+++ b/drivers/irqchip/irq-gic.c
@@ -448,10 +448,8 @@ static int gic_irq_set_vcpu_affinity(struct irq_data *d, void *vcpu)
 static int gic_set_affinity(struct irq_data *d, const struct cpumask *mask_val,
 			    bool force)
 {
-	void __iomem *reg = gic_dist_base(d) + GIC_DIST_TARGET + (gic_irq(d) & ~3);
-	unsigned int cpu, shift = (gic_irq(d) % 4) * 8;
-	u32 val, mask, bit;
-	unsigned long flags;
+	void __iomem *reg = gic_dist_base(d) + GIC_DIST_TARGET + gic_irq(d);
+	unsigned int cpu;

 	if (!force)
 		cpu = cpumask_any_and(mask_val, cpu_online_mask);
@@ -461,13 +459,7 @@ static int gic_set_affinity(struct irq_data *d, const struct cpumask *mask_val,
 	if (cpu >= NR_GIC_CPU_IF || cpu >= nr_cpu_ids)
 		return -EINVAL;

-	gic_lock_irqsave(flags);
-	mask = 0xff << shift;
-	bit = gic_cpu_map[cpu] << shift;
-	val = readl_relaxed(reg) & ~mask;
-	writel_relaxed(val | bit, reg);
-	gic_unlock_irqrestore(flags);
-
+	writeb_relaxed(gic_cpu_map[cpu], reg);
 	irq_data_update_effective_affinity(d, cpumask_of(cpu));

 	return IRQ_SET_MASK_OK_DONE;
--- a/drivers/md/dm-zoned-target.c
+++ b/drivers/md/dm-zoned-target.c
@@ -789,7 +789,7 @@ static int dmz_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 	}

 	/* Set target (no write same support) */
-	ti->max_io_len = dev->zone_nr_sectors << 9;
+	ti->max_io_len = dev->zone_nr_sectors;
 	ti->num_flush_bios = 1;
 	ti->num_discard_bios = 1;
 	ti->num_write_zeroes_bios = 1;
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_u32.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_u32.c
@@ -47,7 +47,7 @@ static int fill_match_fields(struct adapter *adap,
 			     bool next_header)
 {
 	unsigned int i, j;
-	u32 val, mask;
+	__be32 val, mask;
 	int off, err;
 	bool found;

@@ -217,7 +217,7 @@ int cxgb4_config_knode(struct net_device *dev, struct tc_cls_u32_offload *cls)
 		const struct cxgb4_next_header *next;
 		bool found = false;
 		unsigned int i, j;
-		u32 val, mask;
+		__be32 val, mask;
 		int off;

 		if (t->table[link_uhtid - 1].link_handle) {
@@ -231,10 +231,10 @@ int cxgb4_config_knode(struct net_device *dev, struct tc_cls_u32_offload *cls)

 		/* Try to find matches that allow jumps to next header. */
 		for (i = 0; next[i].jump; i++) {
-			if (next[i].offoff != cls->knode.sel->offoff ||
-			    next[i].shift != cls->knode.sel->offshift ||
-			    next[i].mask != cls->knode.sel->offmask ||
-			    next[i].offset != cls->knode.sel->off)
+			if (next[i].sel.offoff != cls->knode.sel->offoff ||
+			    next[i].sel.offshift != cls->knode.sel->offshift ||
+			    next[i].sel.offmask != cls->knode.sel->offmask ||
+			    next[i].sel.off != cls->knode.sel->off)
 				continue;

 			/* Found a possible candidate.  Find a key that
@@ -246,9 +246,9 @@ int cxgb4_config_knode(struct net_device *dev, struct tc_cls_u32_offload *cls)
 				val = cls->knode.sel->keys[j].val;
 				mask = cls->knode.sel->keys[j].mask;

-				if (next[i].match_off == off &&
-				    next[i].match_val == val &&
-				    next[i].match_mask == mask) {
+				if (next[i].key.off == off &&
+				    next[i].key.val == val &&
+				    next[i].key.mask == mask) {
 					found = true;
 					break;
 				}
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_u32_parse.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_u32_parse.h
@@ -38,12 +38,12 @@
 struct cxgb4_match_field {
 	int off; /* Offset from the beginning of the header to match */
 	/* Fill the value/mask pair in the spec if matched */
-	int (*val)(struct ch_filter_specification *f, u32 val, u32 mask);
+	int (*val)(struct ch_filter_specification *f, __be32 val, __be32 mask);
 };

 /* IPv4 match fields */
 static inline int cxgb4_fill_ipv4_tos(struct ch_filter_specification *f,
-				      u32 val, u32 mask)
+				      __be32 val, __be32 mask)
 {
 	f->val.tos  = (ntohl(val)  >> 16) & 0x000000FF;
 	f->mask.tos = (ntohl(mask) >> 16) & 0x000000FF;
@@ -52,7 +52,7 @@ static inline int cxgb4_fill_ipv4_tos(struct ch_filter_specification *f,
 }

 static inline int cxgb4_fill_ipv4_frag(struct ch_filter_specification *f,
-				       u32 val, u32 mask)
+				       __be32 val, __be32 mask)
 {
 	u32 mask_val;
 	u8 frag_val;
@@ -74,7 +74,7 @@ static inline int cxgb4_fill_ipv4_frag(struct ch_filter_specification *f,
 }

 static inline int cxgb4_fill_ipv4_proto(struct ch_filter_specification *f,
-					u32 val, u32 mask)
+					__be32 val, __be32 mask)
 {
 	f->val.proto  = (ntohl(val)  >> 16) & 0x000000FF;
 	f->mask.proto = (ntohl(mask) >> 16) & 0x000000FF;
@@ -83,7 +83,7 @@ static inline int cxgb4_fill_ipv4_proto(struct ch_filter_specification *f,
 }

 static inline int cxgb4_fill_ipv4_src_ip(struct ch_filter_specification *f,
-					 u32 val, u32 mask)
+					 __be32 val, __be32 mask)
 {
 	memcpy(&f->val.fip[0],  &val,  sizeof(u32));
 	memcpy(&f->mask.fip[0], &mask, sizeof(u32));
@@ -92,7 +92,7 @@ static inline int cxgb4_fill_ipv4_src_ip(struct ch_filter_specification *f,
 }

 static inline int cxgb4_fill_ipv4_dst_ip(struct ch_filter_specification *f,
-					 u32 val, u32 mask)
+					 __be32 val, __be32 mask)
 {
 	memcpy(&f->val.lip[0],  &val,  sizeof(u32));
 	memcpy(&f->mask.lip[0], &mask, sizeof(u32));
@@ -111,7 +111,7 @@ static const struct cxgb4_match_field cxgb4_ipv4_fields[] = {

 /* IPv6 match fields */
 static inline int cxgb4_fill_ipv6_tos(struct ch_filter_specification *f,
-				      u32 val, u32 mask)
+				      __be32 val, __be32 mask)
 {
 	f->val.tos  = (ntohl(val)  >> 20) & 0x000000FF;
 	f->mask.tos = (ntohl(mask) >> 20) & 0x000000FF;
@@ -120,7 +120,7 @@ static inline int cxgb4_fill_ipv6_tos(struct ch_filter_specification *f,
 }

 static inline int cxgb4_fill_ipv6_proto(struct ch_filter_specification *f,
-					u32 val, u32 mask)
+					__be32 val, __be32 mask)
 {
 	f->val.proto  = (ntohl(val)  >> 8) & 0x000000FF;
 	f->mask.proto = (ntohl(mask) >> 8) & 0x000000FF;
@@ -129,7 +129,7 @@ static inline int cxgb4_fill_ipv6_proto(struct ch_filter_specification *f,
 }

 static inline int cxgb4_fill_ipv6_src_ip0(struct ch_filter_specification *f,
-					  u32 val, u32 mask)
+					  __be32 val, __be32 mask)
 {
 	memcpy(&f->val.fip[0],  &val,  sizeof(u32));
 	memcpy(&f->mask.fip[0], &mask, sizeof(u32));
@@ -138,7 +138,7 @@ static inline int cxgb4_fill_ipv6_src_ip0(struct ch_filter_specification *f,
 }

 static inline int cxgb4_fill_ipv6_src_ip1(struct ch_filter_specification *f,
-					  u32 val, u32 mask)
+					  __be32 val, __be32 mask)
 {
 	memcpy(&f->val.fip[4],  &val,  sizeof(u32));
 	memcpy(&f->mask.fip[4], &mask, sizeof(u32));
@@ -147,7 +147,7 @@ static inline int cxgb4_fill_ipv6_src_ip1(struct ch_filter_specification *f,
 }

 static inline int cxgb4_fill_ipv6_src_ip2(struct ch_filter_specification *f,
-					  u32 val, u32 mask)
+					  __be32 val, __be32 mask)
 {
 	memcpy(&f->val.fip[8],  &val,  sizeof(u32));
 	memcpy(&f->mask.fip[8], &mask, sizeof(u32));
@@ -156,7 +156,7 @@ static inline int cxgb4_fill_ipv6_src_ip2(struct ch_filter_specification *f,
 }

 static inline int cxgb4_fill_ipv6_src_ip3(struct ch_filter_specification *f,
-					  u32 val, u32 mask)
+					  __be32 val, __be32 mask)
 {
 	memcpy(&f->val.fip[12],  &val,  sizeof(u32));
 	memcpy(&f->mask.fip[12], &mask, sizeof(u32));
@@ -165,7 +165,7 @@ static inline int cxgb4_fill_ipv6_src_ip3(struct ch_filter_specification *f,
 }

 static inline int cxgb4_fill_ipv6_dst_ip0(struct ch_filter_specification *f,
-					  u32 val, u32 mask)
+					  __be32 val, __be32 mask)
 {
 	memcpy(&f->val.lip[0],  &val,  sizeof(u32));
 	memcpy(&f->mask.lip[0], &mask, sizeof(u32));
@@ -174,7 +174,7 @@ static inline int cxgb4_fill_ipv6_dst_ip0(struct ch_filter_specification *f,
 }

 static inline int cxgb4_fill_ipv6_dst_ip1(struct ch_filter_specification *f,
-					  u32 val, u32 mask)
+					  __be32 val, __be32 mask)
 {
 	memcpy(&f->val.lip[4],  &val,  sizeof(u32));
 	memcpy(&f->mask.lip[4], &mask, sizeof(u32));
@@ -183,7 +183,7 @@ static inline int cxgb4_fill_ipv6_dst_ip1(struct ch_filter_specification *f,
 }

 static inline int cxgb4_fill_ipv6_dst_ip2(struct ch_filter_specification *f,
-					  u32 val, u32 mask)
+					  __be32 val, __be32 mask)
 {
 	memcpy(&f->val.lip[8],  &val,  sizeof(u32));
 	memcpy(&f->mask.lip[8], &mask, sizeof(u32));
@@ -192,7 +192,7 @@ static inline int cxgb4_fill_ipv6_dst_ip2(struct ch_filter_specification *f,
 }

 static inline int cxgb4_fill_ipv6_dst_ip3(struct ch_filter_specification *f,
-					  u32 val, u32 mask)
+					  __be32 val, __be32 mask)
 {
 	memcpy(&f->val.lip[12],  &val,  sizeof(u32));
 	memcpy(&f->mask.lip[12], &mask, sizeof(u32));
@@ -216,7 +216,7 @@ static const struct cxgb4_match_field cxgb4_ipv6_fields[] = {

 /* TCP/UDP match */
 static inline int cxgb4_fill_l4_ports(struct ch_filter_specification *f,
-				      u32 val, u32 mask)
+				      __be32 val, __be32 mask)
 {
 	f->val.fport  = ntohl(val)  >> 16;
 	f->mask.fport = ntohl(mask) >> 16;
@@ -237,19 +237,13 @@ static const struct cxgb4_match_field cxgb4_udp_fields[] = {
 };

 struct cxgb4_next_header {
-	unsigned int offset; /* Offset to next header */
-	/* offset, shift, and mask added to offset above
+	/* Offset, shift, and mask added to beginning of the header
 	 * to get to next header.  Useful when using a header
 	 * field's value to jump to next header such as IHL field
 	 * in IPv4 header.
 	 */
-	unsigned int offoff;
-	u32 shift;
-	u32 mask;
-	/* match criteria to make this jump */
-	unsigned int match_off;
-	u32 match_val;
-	u32 match_mask;
+	struct tc_u32_sel sel;
+	struct tc_u32_key key;
 	/* location of jump to make */
 	const struct cxgb4_match_field *jump;
 };
@@ -258,26 +252,74 @@ struct cxgb4_next_header {
 * IPv4 header.
 */
 static const struct cxgb4_next_header cxgb4_ipv4_jumps[] = {
-	{ .offset = 0, .offoff = 0, .shift = 6, .mask = 0xF,
-	  .match_off = 8, .match_val = 0x600, .match_mask = 0xFF00,
-	  .jump = cxgb4_tcp_fields },
-	{ .offset = 0, .offoff = 0, .shift = 6, .mask = 0xF,
-	  .match_off = 8, .match_val = 0x1100, .match_mask = 0xFF00,
-	  .jump = cxgb4_udp_fields },
-	{ .jump = NULL }
+	{
+		/* TCP Jump */
+		.sel = {
+			.off = 0,
+			.offoff = 0,
+			.offshift = 6,
+			.offmask = cpu_to_be16(0x0f00),
+		},
+		.key = {
+			.off = 8,
+			.val = cpu_to_be32(0x00060000),
+			.mask = cpu_to_be32(0x00ff0000),
+		},
+		.jump = cxgb4_tcp_fields,
+	},
+	{
+		/* UDP Jump */
+		.sel = {
+			.off = 0,
+			.offoff = 0,
+			.offshift = 6,
+			.offmask = cpu_to_be16(0x0f00),
+		},
+		.key = {
+			.off = 8,
+			.val = cpu_to_be32(0x00110000),
+			.mask = cpu_to_be32(0x00ff0000),
+		},
+		.jump = cxgb4_udp_fields,
+	},
+	{ .jump = NULL },
 };

 /* Accept a rule with a jump directly past the 40 Bytes of IPv6 fixed header
 * to get to transport layer header.
 */
 static const struct cxgb4_next_header cxgb4_ipv6_jumps[] = {
-	{ .offset = 0x28, .offoff = 0, .shift = 0, .mask = 0,
-	  .match_off = 4, .match_val = 0x60000, .match_mask = 0xFF0000,
-	  .jump = cxgb4_tcp_fields },
-	{ .offset = 0x28, .offoff = 0, .shift = 0, .mask = 0,
-	  .match_off = 4, .match_val = 0x110000, .match_mask = 0xFF0000,
-	  .jump = cxgb4_udp_fields },
-	{ .jump = NULL }
+	{
+		/* TCP Jump */
+		.sel = {
+			.off = 40,
+			.offoff = 0,
+			.offshift = 0,
+			.offmask = 0,
+		},
+		.key = {
+			.off = 4,
+			.val = cpu_to_be32(0x00000600),
+			.mask = cpu_to_be32(0x0000ff00),
+		},
+		.jump = cxgb4_tcp_fields,
+	},
+	{
+		/* UDP Jump */
+		.sel = {
+			.off = 40,
+			.offoff = 0,
+			.offshift = 0,
+			.offmask = 0,
+		},
+		.key = {
+			.off = 4,
+			.val = cpu_to_be32(0x00001100),
+			.mask = cpu_to_be32(0x0000ff00),
+		},
+		.jump = cxgb4_udp_fields,
+	},
+	{ .jump = NULL },
 };

 struct cxgb4_link {
--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c
@@ -2088,7 +2088,7 @@ static noinline int t4_systim_to_hwstamp(struct adapter *adapter,

 	hwtstamps = skb_hwtstamps(skb);
 	memset(hwtstamps, 0, sizeof(*hwtstamps));
-	hwtstamps->hwtstamp = ns_to_ktime(be64_to_cpu(*((u64 *)data)));
+	hwtstamps->hwtstamp = ns_to_ktime(get_unaligned_be64(data));

 	return RX_PTP_PKT_SUC;
 }
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -1338,7 +1338,7 @@ static void smsc95xx_unbind(struct usbnet *dev, struct usb_interface *intf)
 	struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]);

 	if (pdata) {
-		cancel_delayed_work(&pdata->carrier_check);
+		cancel_delayed_work_sync(&pdata->carrier_check);
 		netif_dbg(dev, ifdown, dev->net, "free pdata\n");
 		kfree(pdata);
 		pdata = NULL;
--- a/drivers/platform/msm/gsi/gsi.c
+++ b/drivers/platform/msm/gsi/gsi.c
@@ -2173,6 +2173,7 @@ static void gsi_program_chan_ctx(struct gsi_chan_props *props, unsigned int ee,
 		break;
 	case GSI_CHAN_PROT_AQC:
 	case GSI_CHAN_PROT_11AD:
+	case GSI_CHAN_PROT_QDSS:
 		prot_msb = 1;
 		break;
 	default:
--- a/drivers/platform/msm/ipa/ipa_api.c
+++ b/drivers/platform/msm/ipa/ipa_api.c
@@ -222,7 +222,7 @@ const char *ipa_clients_strings[IPA_CLIENT_MAX] = {
 	__stringify(IPA_CLIENT_Q6_CV2X_CONS),
 	__stringify(IPA_CLIENT_MHI_LOW_LAT_PROD),
 	__stringify(IPA_CLIENT_MHI_LOW_LAT_CONS),
-	__stringify(RESERVERD_PROD_110),
+	__stringify(IPA_CLIENT_QDSS_PROD),
 	__stringify(IPA_CLIENT_MHI_QDSS_CONS),
 };

@@ -3827,6 +3827,33 @@ bool ipa_pm_is_used(void)
 	return ret;
 }

+/**
+ * ipa_conn_qdss_pipes() - connect qdss pipes
+ */
+int ipa_qdss_conn_pipes(struct ipa_qdss_conn_in_params *in,
+	struct ipa_qdss_conn_out_params *out)
+{
+	int ret;
+
+	IPA_API_DISPATCH_RETURN(ipa_conn_qdss_pipes, in, out);
+
+	return ret;
+}
+EXPORT_SYMBOL(ipa_qdss_conn_pipes);
+
+/**
+ * ipa_disconn_qdss_pipes() - disconnect qdss pipes
+ */
+int ipa_qdss_disconn_pipes(void)
+{
+	int ret;
+
+	IPA_API_DISPATCH_RETURN(ipa_disconn_qdss_pipes);
+
+	return ret;
+}
+EXPORT_SYMBOL(ipa_qdss_disconn_pipes);
+
 static const struct dev_pm_ops ipa_pm_ops = {
 	.suspend_noirq = ipa_ap_suspend,
 	.resume_noirq = ipa_ap_resume,
--- a/drivers/platform/msm/ipa/ipa_api.h
+++ b/drivers/platform/msm/ipa/ipa_api.h
@@ -13,6 +13,7 @@
 #include <linux/ipa_mhi.h>
 #include <linux/ipa_uc_offload.h>
 #include <linux/ipa_wdi3.h>
+#include <linux/ipa_qdss.h>
 #include "ipa_common_i.h"

 #ifndef _IPA_API_H_
@@ -498,6 +499,11 @@ struct ipa_api_controller {

 	int (*ipa_del_socksv5_conn)(uint32_t handle);

+	int (*ipa_conn_qdss_pipes)(struct ipa_qdss_conn_in_params *in,
+		struct ipa_qdss_conn_out_params *out);
+
+	int (*ipa_disconn_qdss_pipes)(void);
+
 };

 #ifdef CONFIG_IPA
--- a/drivers/platform/msm/ipa/ipa_clients/ecm_ipa.c
+++ b/drivers/platform/msm/ipa/ipa_clients/ecm_ipa.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2013-2018, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2013-2019, The Linux Foundation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 and
@@ -681,13 +681,21 @@ static void ecm_ipa_packet_receive_notify
 	packet_len = skb->len;
 	ECM_IPA_DEBUG("packet RX, len=%d\n", skb->len);

+	if (unlikely(ecm_ipa_ctx == NULL)) {
+		ECM_IPA_DEBUG("Private context is NULL. Drop SKB.\n");
+		dev_kfree_skb_any(skb);
+		return;
+	}
+
 	if (unlikely(ecm_ipa_ctx->state != ECM_IPA_CONNECTED_AND_UP)) {
 		ECM_IPA_DEBUG("Missing pipe connected and/or iface up\n");
+		dev_kfree_skb_any(skb);
 		return;
 	}

 	if (evt != IPA_RECEIVE)	{
 		ECM_IPA_ERROR("A none IPA_RECEIVE event in ecm_ipa_receive\n");
+		dev_kfree_skb_any(skb);
 		return;
 	}

--- a/drivers/platform/msm/ipa/ipa_clients/ipa_uc_offload.c
+++ b/drivers/platform/msm/ipa/ipa_clients/ipa_uc_offload.c
@@ -592,6 +592,10 @@ int ipa_uc_offload_conn_pipes(struct ipa_uc_offload_conn_in_params *inp,
 		return -EPERM;
 	}

+	/*Store the connection info, required during disconnect pipe */
+	memcpy(&offload_ctx->conn, &inp->u.ntn,
+			sizeof(struct ipa_ntn_conn_in_params));
+
 	switch (offload_ctx->proto) {
 	case IPA_UC_NTN:
 		ret = ipa_uc_ntn_conn_pipes(&inp->u.ntn, &outp->u.ntn,
--- a/drivers/platform/msm/ipa/ipa_clients/rndis_ipa.c
+++ b/drivers/platform/msm/ipa/ipa_clients/rndis_ipa.c
@@ -1166,6 +1166,12 @@ static void rndis_ipa_packet_receive_notify(
 		("packet Rx, len=%d\n",
 		skb->len);

+	if (unlikely(rndis_ipa_ctx == NULL)) {
+		RNDIS_IPA_DEBUG("Private context is NULL. Drop SKB.\n");
+		dev_kfree_skb_any(skb);
+		return;
+	}
+
 	if (unlikely(rndis_ipa_ctx->rx_dump_enable))
 		rndis_ipa_dump_skb(skb);

@@ -1173,11 +1179,15 @@ static void rndis_ipa_packet_receive_notify(
 		RNDIS_IPA_DEBUG("use connect()/up() before receive()\n");
 		RNDIS_IPA_DEBUG("packet dropped (length=%d)\n",
 				skb->len);
+		rndis_ipa_ctx->rx_dropped++;
+		dev_kfree_skb_any(skb);
 		return;
 	}

 	if (evt != IPA_RECEIVE)	{
 		RNDIS_IPA_ERROR("a none IPA_RECEIVE event in driver RX\n");
+		rndis_ipa_ctx->rx_dropped++;
+		dev_kfree_skb_any(skb);
 		return;
 	}

--- a/drivers/platform/msm/ipa/ipa_v3/Makefile
+++ b/drivers/platform/msm/ipa/ipa_v3/Makefile
@@ -5,7 +5,7 @@ obj-$(CONFIG_IPA3) += ipat.o
 ipat-y := ipa.o ipa_debugfs.o ipa_hdr.o ipa_flt.o ipa_rt.o ipa_dp.o ipa_client.o \
 	ipa_utils.o ipa_nat.o ipa_intf.o teth_bridge.o ipa_interrupts.o \
 	ipa_uc.o ipa_uc_wdi.o ipa_dma.o ipa_uc_mhi.o ipa_mhi.o ipa_uc_ntn.o \
-	ipa_hw_stats.o ipa_pm.o ipa_wdi3_i.o ipa_odl.o ipa_wigig_i.o
+	ipa_hw_stats.o ipa_pm.o ipa_wdi3_i.o ipa_odl.o ipa_wigig_i.o ipa_qdss.o

 ipat-$(CONFIG_IPA_EMULATION) += ipa_dt_replacement.o

--- a/drivers/platform/msm/ipa/ipa_v3/ipa.c
+++ b/drivers/platform/msm/ipa/ipa_v3/ipa.c
@@ -145,6 +145,7 @@ static struct {
 	bool present[IPA_SMMU_CB_MAX];
 	bool arm_smmu;
 	bool fast_map;
+	bool fast_map_arr[IPA_SMMU_CB_MAX];
 	bool s1_bypass_arr[IPA_SMMU_CB_MAX];
 	bool use_64_bit_dma_mask;
 	u32 ipa_base;
@@ -1014,7 +1015,16 @@ static long ipa3_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)

 	if (!ipa3_is_ready()) {
 		IPAERR("IPA not ready, waiting for init completion\n");
-		wait_for_completion(&ipa3_ctx->init_completion_obj);
+		if (ipa3_ctx->manual_fw_load) {
+			if (!wait_for_completion_timeout(
+					&ipa3_ctx->init_completion_obj,
+					msecs_to_jiffies(1000))) {
+				IPAERR("IPA not ready, return\n");
+				return -ETIME;
+			}
+		} else {
+			wait_for_completion(&ipa3_ctx->init_completion_obj);
+		}
 	}

 	IPA_ACTIVE_CLIENTS_INC_SIMPLE();
@@ -6899,6 +6909,7 @@ static int ipa3_pre_init(const struct ipa3_plat_drv_res *resource_p,
 	ipa3_ctx->uc_act_tbl_total = 0;
 	ipa3_ctx->uc_act_tbl_next_index = 0;
 	ipa3_ctx->ipa_config_is_auto = resource_p->ipa_config_is_auto;
+	ipa3_ctx->manual_fw_load = resource_p->manual_fw_load;

 	if (ipa3_ctx->secure_debug_check_action == USE_SCM) {
 		if (ipa_is_mem_dump_allowed())
@@ -7566,6 +7577,7 @@ static int get_ipa_dts_configuration(struct platform_device *pdev,
 	ipa_drv_res->ipa_fltrt_not_hashable = false;
 	ipa_drv_res->ipa_endp_delay_wa = false;
 	ipa_drv_res->ipa_config_is_auto = false;
+	ipa_drv_res->manual_fw_load = false;

 	/* Get IPA HW Version */
 	result = of_property_read_u32(pdev->dev.of_node, "qcom,ipa-hw-ver",
@@ -7975,6 +7987,13 @@ static int get_ipa_dts_configuration(struct platform_device *pdev,
 	IPADBG(": secure-debug-check-action = %d\n",
 		   ipa_drv_res->secure_debug_check_action);

+	ipa_drv_res->manual_fw_load =
+		of_property_read_bool(pdev->dev.of_node,
+		"qcom,manual-fw-load");
+	IPADBG(": manual-fw-load (%s)\n",
+		ipa_drv_res->manual_fw_load
+		? "True" : "False");
+
 	return 0;
 }

@@ -8008,6 +8027,9 @@ static int ipa_smmu_wlan_cb_probe(struct device *dev)
 							"dma-coherent");
 	cb->valid = true;

+	if (of_property_read_bool(dev->of_node,
+			"qcom,smmu-fast-map"))
+		smmu_info.fast_map_arr[IPA_SMMU_CB_WLAN] = true;
 	if (of_property_read_bool(dev->of_node, "qcom,smmu-s1-bypass") ||
 		ipa3_ctx->ipa_config_is_mhi) {
 		smmu_info.s1_bypass_arr[IPA_SMMU_CB_WLAN] = true;
@@ -8035,7 +8057,8 @@ static int ipa_smmu_wlan_cb_probe(struct device *dev)
 		}
 		IPADBG(" WLAN SMMU ATTR ATOMIC\n");

-		if (smmu_info.fast_map) {
+		if (smmu_info.fast_map_arr[IPA_SMMU_CB_WLAN] ||
+						smmu_info.fast_map) {
 			if (iommu_domain_set_attr(cb->iommu,
 						DOMAIN_ATTR_FAST,
 						&fast)) {
@@ -8048,7 +8071,8 @@ static int ipa_smmu_wlan_cb_probe(struct device *dev)
 	}

 	pr_info("IPA smmu_info.s1_bypass_arr[WLAN]=%d smmu_info.fast_map=%d\n",
-		smmu_info.s1_bypass_arr[IPA_SMMU_CB_WLAN], smmu_info.fast_map);
+		smmu_info.s1_bypass_arr[IPA_SMMU_CB_WLAN],
+				smmu_info.fast_map_arr[IPA_SMMU_CB_WLAN]);

 	ret = iommu_attach_device(cb->iommu, dev);
 	if (ret) {
@@ -8116,6 +8140,10 @@ static int ipa_smmu_uc_cb_probe(struct device *dev)
 		IPAERR("Fail to read UC start/size iova addresses\n");
 		return ret;
 	}
+
+	if (of_property_read_bool(dev->of_node,
+			"qcom,smmu-fast-map"))
+		smmu_info.fast_map_arr[IPA_SMMU_CB_UC] = true;
 	cb->va_start = iova_ap_mapping[0];
 	cb->va_size = iova_ap_mapping[1];
 	cb->va_end = cb->va_start + cb->va_size;
@@ -8180,7 +8208,8 @@ static int ipa_smmu_uc_cb_probe(struct device *dev)
 		}
 		IPADBG("SMMU atomic set\n");

-		if (smmu_info.fast_map) {
+		if (smmu_info.fast_map_arr[IPA_SMMU_CB_UC] ||
+						smmu_info.fast_map) {
 			if (iommu_domain_set_attr(cb->mapping->domain,
 				DOMAIN_ATTR_FAST,
 				&fast)) {
@@ -8194,7 +8223,8 @@ static int ipa_smmu_uc_cb_probe(struct device *dev)
 	}

 	pr_info("IPA smmu_info.s1_bypass_arr[UC]=%d smmu_info.fast_map=%d\n",
-		smmu_info.s1_bypass_arr[IPA_SMMU_CB_UC], smmu_info.fast_map);
+		smmu_info.s1_bypass_arr[IPA_SMMU_CB_UC],
+				smmu_info.fast_map_arr[IPA_SMMU_CB_UC]);

 	IPADBG("UC CB PROBE sub pdev=%pK attaching IOMMU device\n", dev);
 	ret = arm_iommu_attach_device(cb->dev, cb->mapping);
@@ -8243,6 +8273,8 @@ static int ipa_smmu_ap_cb_probe(struct device *dev)
 	u32 size_p;
 	phys_addr_t iova;
 	phys_addr_t pa;
+	u32 geometry_mapping[2];
+	struct iommu_domain_geometry geometry = {0};

 	IPADBG("AP CB probe: sub pdev=%pK\n", dev);

@@ -8257,6 +8289,9 @@ static int ipa_smmu_ap_cb_probe(struct device *dev)
 		IPAERR("Fail to read AP start/size iova addresses\n");
 		return result;
 	}
+	if (of_property_read_bool(dev->of_node,
+			"qcom,smmu-fast-map"))
+		smmu_info.fast_map_arr[IPA_SMMU_CB_AP] = true;
 	cb->va_start = iova_ap_mapping[0];
 	cb->va_size = iova_ap_mapping[1];
 	cb->va_end = cb->va_start + cb->va_size;
@@ -8317,7 +8352,8 @@ static int ipa_smmu_ap_cb_probe(struct device *dev)
 		}
 		IPADBG("AP/USB SMMU atomic set\n");

-		if (smmu_info.fast_map) {
+		if (smmu_info.fast_map_arr[IPA_SMMU_CB_AP] ||
+						smmu_info.fast_map) {
 			if (iommu_domain_set_attr(cb->mapping->domain,
 				DOMAIN_ATTR_FAST,
 				&fast)) {
@@ -8327,11 +8363,26 @@ static int ipa_smmu_ap_cb_probe(struct device *dev)
 				return -EIO;
 			}
 			IPADBG("SMMU fast map set\n");
+			result = of_property_read_u32_array(dev->of_node,
+					"qcom,geometry-mapping",
+					geometry_mapping, 2);
+			if (!result) {
+				IPAERR("AP Geometry start = %x size= %x\n",
+				geometry_mapping[0], geometry_mapping[1]);
+				geometry.aperture_start = geometry_mapping[0];
+				geometry.aperture_end = geometry_mapping[1];
+				if (iommu_domain_set_attr(cb->mapping->domain,
+					DOMAIN_ATTR_GEOMETRY,  &geometry)) {
+					IPAERR("Failed to set AP GEOMETRY\n");
+					return -EIO;
+				}
+			}
 		}
 	}

 	pr_info("IPA smmu_info.s1_bypass_arr[AP]=%d smmu_info.fast_map=%d\n",
-		smmu_info.s1_bypass_arr[IPA_SMMU_CB_AP], smmu_info.fast_map);
+		smmu_info.s1_bypass_arr[IPA_SMMU_CB_AP],
+					smmu_info.fast_map_arr[IPA_SMMU_CB_AP]);

 	result = arm_iommu_attach_device(cb->dev, cb->mapping);
 	if (result) {
--- a/drivers/platform/msm/ipa/ipa_v3/ipa_client.c
+++ b/drivers/platform/msm/ipa/ipa_v3/ipa_client.c
@@ -1474,7 +1474,10 @@ int ipa3_release_gsi_channel(u32 clnt_hdl)
 		IPA_ACTIVE_CLIENTS_INC_EP(ipa3_get_client_mapping(clnt_hdl));

 	/* Set the disconnect in progress flag to avoid calling cb.*/
+	spin_lock(&ipa3_ctx->disconnect_lock);
 	atomic_set(&ep->disconnect_in_progress, 1);
+	spin_unlock(&ipa3_ctx->disconnect_lock);
+

 	gsi_res = gsi_dealloc_channel(ep->gsi_chan_hdl);
 	if (gsi_res != GSI_STATUS_SUCCESS) {
@@ -1494,7 +1497,9 @@ int ipa3_release_gsi_channel(u32 clnt_hdl)
 	if (!ep->keep_ipa_awake)
 		IPA_ACTIVE_CLIENTS_DEC_EP(ipa3_get_client_mapping(clnt_hdl));

+	spin_lock(&ipa3_ctx->disconnect_lock);
 	memset(&ipa3_ctx->ep[clnt_hdl], 0, sizeof(struct ipa3_ep_context));
+	spin_unlock(&ipa3_ctx->disconnect_lock);

 	IPADBG("exit\n");
 	return 0;
--- a/drivers/platform/msm/ipa/ipa_v3/ipa_dp.c
+++ b/drivers/platform/msm/ipa/ipa_v3/ipa_dp.c
@@ -23,7 +23,7 @@
 #include "ipahal/ipahal.h"
 #include "ipahal/ipahal_fltrt.h"

-#define IPA_WAN_AGGR_PKT_CNT 5
+#define IPA_WAN_AGGR_PKT_CNT 1
 #define IPA_WAN_NAPI_MAX_FRAMES (NAPI_WEIGHT / IPA_WAN_AGGR_PKT_CNT)
 #define IPA_WAN_PAGE_ORDER 3
 #define IPA_LAST_DESC_CNT 0xFFFF
@@ -3212,13 +3212,17 @@ void ipa3_lan_rx_cb(void *priv, enum ipa_dp_evt_type evt, unsigned long data)
 	unsigned int src_pipe;
 	u32 metadata;
 	u8 ucp;
+	void (*client_notify)(void *client_priv, enum ipa_dp_evt_type evt,
+		       unsigned long data);
+	void *client_priv;

 	ipahal_pkt_status_parse(rx_skb->data, &status);
 	src_pipe = status.endp_src_idx;
 	metadata = status.metadata;
 	ucp = status.ucp;
 	ep = &ipa3_ctx->ep[src_pipe];
-	if (unlikely(src_pipe >= ipa3_ctx->ipa_num_pipes)) {
+	if (unlikely(src_pipe >= ipa3_ctx->ipa_num_pipes) ||
+		unlikely(atomic_read(&ep->disconnect_in_progress))) {
 		IPAERR_RL("drop pipe=%d\n", src_pipe);
 		dev_kfree_skb_any(rx_skb);
 		return;
@@ -3241,12 +3245,19 @@ void ipa3_lan_rx_cb(void *priv, enum ipa_dp_evt_type evt, unsigned long data)
 			metadata, *(u32 *)rx_skb->cb);
 	IPADBG_LOW("ucp: %d\n", *(u8 *)(rx_skb->cb + 4));

+	spin_lock(&ipa3_ctx->disconnect_lock);
 	if (likely((!atomic_read(&ep->disconnect_in_progress)) &&
-				ep->valid && ep->client_notify))
-		ep->client_notify(ep->priv, IPA_RECEIVE,
+				ep->valid && ep->client_notify)) {
+		client_notify = ep->client_notify;
+		client_priv = ep->priv;
+		spin_unlock(&ipa3_ctx->disconnect_lock);
+		client_notify(client_priv, IPA_RECEIVE,
 				(unsigned long)(rx_skb));
-	else
+	} else {
+		spin_unlock(&ipa3_ctx->disconnect_lock);
 		dev_kfree_skb_any(rx_skb);
+	}
+
 }

 static void ipa3_recycle_rx_wrapper(struct ipa3_rx_pkt_wrapper *rx_pkt)
--- a/drivers/platform/msm/ipa/ipa_v3/ipa_i.h
+++ b/drivers/platform/msm/ipa/ipa_v3/ipa_i.h
@@ -84,7 +84,7 @@

 #define IPA_MAX_NUM_REQ_CACHE 10

-#define NAPI_WEIGHT 60
+#define NAPI_WEIGHT 64

 /* Bit pattern for SW to identify in middle of PC saving */
 #define PC_SAVE_CONTEXT_SAVE_ENTERED            0xDEAFDEAF
@@ -1840,6 +1840,7 @@ struct ipa3_app_clock_vote {
 * @app_vote: holds userspace application clock vote count
 * IPA context - holds all relevant info about IPA driver and its state
 * @coal_cmd_pyld: holds the coslescing close frame command payload
+ * @manual_fw_load: bool,if fw load is done manually
 */
 struct ipa3_context {
 	struct ipa3_char_device_context cdev;
@@ -2019,6 +2020,7 @@ struct ipa3_context {
 	struct mutex act_tbl_lock;
 	int uc_act_tbl_total;
 	int uc_act_tbl_next_index;
+	bool manual_fw_load;
 };

 struct ipa3_plat_drv_res {
@@ -2068,6 +2070,7 @@ struct ipa3_plat_drv_res {
 	u32 secure_debug_check_action;
 	bool ipa_mhi_proxy;
 	bool ipa_wan_skb_page;
+	bool manual_fw_load;
 };

 /**
@@ -2391,6 +2394,9 @@ int ipa3_cfg_ep_route(u32 clnt_hdl, const struct ipa_ep_cfg_route *ipa_ep_cfg);

 int ipa3_cfg_ep_holb(u32 clnt_hdl, const struct ipa_ep_cfg_holb *ipa_ep_cfg);

+int ipa3_force_cfg_ep_holb(u32 clnt_hdl,
+	struct ipa_ep_cfg_holb *ipa_ep_cfg);
+
 void ipa3_cal_ep_holb_scale_base_val(u32 tmr_val,
 				struct ipa_ep_cfg_holb *ep_holb);

@@ -2820,6 +2826,10 @@ void ipa3_debugfs_post_init(void);
 void ipa3_debugfs_remove(void);

 void ipa3_dump_buff_internal(void *base, dma_addr_t phy_base, u32 size);
+
+int ipa3_conn_qdss_pipes(struct ipa_qdss_conn_in_params *in,
+	struct ipa_qdss_conn_out_params *out);
+int ipa3_disconn_qdss_pipes(void);
 #ifdef IPA_DEBUG
 #define IPA_DUMP_BUFF(base, phy_base, size) \
 	ipa3_dump_buff_internal(base, phy_base, size)
--- a/drivers/platform/msm/ipa/ipa_v3/ipa_qdss.c
+++ b/drivers/platform/msm/ipa/ipa_v3/ipa_qdss.c
@@ -0,0 +1,267 @@
+/* Copyright (c) 2018-2020, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <linux/ipa_qdss.h>
+#include <linux/msm_ipa.h>
+#include <linux/string.h>
+#include <linux/ipa_qdss.h>
+#include "ipa_i.h"
+
+#define IPA_HOLB_TMR_VALUE 0
+#define OFFLOAD_DRV_NAME "ipa_qdss"
+#define IPA_QDSS_DBG(fmt, args...) \
+	do { \
+		pr_debug(OFFLOAD_DRV_NAME " %s:%d " fmt, \
+			__func__, __LINE__, ## args); \
+		IPA_IPC_LOGGING(ipa_get_ipc_logbuf(), \
+			OFFLOAD_DRV_NAME " %s:%d " fmt, ## args); \
+		IPA_IPC_LOGGING(ipa_get_ipc_logbuf_low(), \
+			OFFLOAD_DRV_NAME " %s:%d " fmt, ## args); \
+	} while (0)
+
+#define IPA_QDSS_ERR(fmt, args...) \
+	do { \
+		pr_err(OFFLOAD_DRV_NAME " %s:%d " fmt, \
+			__func__, __LINE__, ## args); \
+		IPA_IPC_LOGGING(ipa_get_ipc_logbuf(), \
+			OFFLOAD_DRV_NAME " %s:%d " fmt, ## args); \
+		IPA_IPC_LOGGING(ipa_get_ipc_logbuf_low(), \
+			OFFLOAD_DRV_NAME " %s:%d " fmt, ## args); \
+	} while (0)
+
+static void ipa3_qdss_gsi_chan_err_cb(struct gsi_chan_err_notify *notify)
+{
+	switch (notify->evt_id) {
+	case GSI_CHAN_INVALID_TRE_ERR:
+			IPAERR("Got GSI_CHAN_INVALID_TRE_ERR\n");
+			break;
+	case GSI_CHAN_NON_ALLOCATED_EVT_ACCESS_ERR:
+			IPAERR("Got GSI_CHAN_NON_ALLOCATED_EVT_ACCESS_ERR\n");
+			break;
+	case GSI_CHAN_OUT_OF_BUFFERS_ERR:
+			IPAERR("Got GSI_CHAN_OUT_OF_BUFFERS_ERR\n");
+			break;
+	case GSI_CHAN_OUT_OF_RESOURCES_ERR:
+			IPAERR("Got GSI_CHAN_OUT_OF_RESOURCES_ERR\n");
+			break;
+	case GSI_CHAN_UNSUPPORTED_INTER_EE_OP_ERR:
+			IPAERR("Got GSI_CHAN_UNSUPPORTED_INTER_EE_OP_ERR\n");
+			break;
+	case GSI_CHAN_HWO_1_ERR:
+			IPAERR("Got GSI_CHAN_HWO_1_ERR\n");
+			break;
+	default:
+		IPAERR("Unexpected err evt: %d\n", notify->evt_id);
+	}
+	ipa_assert();
+}
+
+int ipa3_conn_qdss_pipes(struct ipa_qdss_conn_in_params *in,
+	struct ipa_qdss_conn_out_params *out)
+{
+	struct gsi_chan_props gsi_channel_props;
+	struct ipa3_ep_context *ep_rx;
+	const struct ipa_gsi_ep_config *gsi_ep_info;
+	union __packed gsi_channel_scratch ch_scratch;
+	u32 gsi_db_addr_low, gsi_db_addr_high;
+	struct ipa_ep_cfg ep_cfg = { { 0 } };
+	int ipa_ep_idx_rx, ipa_ep_idx_tx;
+	int result = 0;
+	struct ipa_ep_cfg_holb holb_cfg;
+
+	if (!(in && out)) {
+		IPA_QDSS_ERR("Empty parameters. in=%pK out=%pK\n", in, out);
+		return -IPA_QDSS_PIPE_CONN_FAILURE;
+	}
+
+	ipa_ep_idx_tx = ipa3_get_ep_mapping(IPA_CLIENT_MHI_QDSS_CONS);
+	if ((ipa_ep_idx_tx) < 0 || (!ipa3_ctx->ipa_config_is_mhi)) {
+		IPA_QDSS_ERR("getting EP map failed\n");
+		return -IPA_QDSS_PIPE_CONN_FAILURE;
+	}
+
+	ipa_ep_idx_rx = ipa3_get_ep_mapping(IPA_CLIENT_QDSS_PROD);
+	if ((ipa_ep_idx_rx == -1) ||
+		(ipa_ep_idx_rx >= IPA3_MAX_NUM_PIPES)) {
+		IPA_QDSS_ERR("out of range ipa_ep_idx_rx = %d\n",
+			ipa_ep_idx_rx);
+		return -IPA_QDSS_PIPE_CONN_FAILURE;
+	}
+
+	ep_rx = &ipa3_ctx->ep[ipa_ep_idx_rx];
+
+	if (ep_rx->valid) {
+		IPA_QDSS_ERR("EP already allocated.\n");
+		return IPA_QDSS_SUCCESS;
+	}
+
+	memset(ep_rx, 0, offsetof(struct ipa3_ep_context, sys));
+
+	IPA_ACTIVE_CLIENTS_INC_SIMPLE();
+
+	ep_rx->valid = 1;
+	ep_rx->client = IPA_CLIENT_QDSS_PROD;
+	if (ipa3_cfg_ep(ipa_ep_idx_rx, &ep_rx->cfg)) {
+		IPAERR("fail to setup rx pipe cfg\n");
+		goto fail;
+	}
+
+	/* setup channel ring */
+	memset(&gsi_channel_props, 0, sizeof(gsi_channel_props));
+	gsi_channel_props.prot = GSI_CHAN_PROT_QDSS;
+	gsi_channel_props.dir = GSI_CHAN_DIR_TO_GSI;
+
+	gsi_ep_info = ipa3_get_gsi_ep_info(ep_rx->client);
+	if (!gsi_ep_info) {
+		IPA_QDSS_ERR("Failed getting GSI EP info for client=%d\n",
+			ep_rx->client);
+		goto fail;
+	}
+
+	gsi_channel_props.ch_id = gsi_ep_info->ipa_gsi_chan_num;
+	gsi_channel_props.re_size = GSI_CHAN_RE_SIZE_8B;
+	gsi_channel_props.use_db_eng = GSI_CHAN_DB_MODE;
+	gsi_channel_props.err_cb = ipa3_qdss_gsi_chan_err_cb;
+	gsi_channel_props.ring_len = in->desc_fifo_size;
+	gsi_channel_props.ring_base_addr =
+			in->desc_fifo_base_addr;
+	result = gsi_alloc_channel(&gsi_channel_props, ipa3_ctx->gsi_dev_hdl,
+				&ep_rx->gsi_chan_hdl);
+	if (result != GSI_STATUS_SUCCESS) {
+		IPA_QDSS_ERR("Failed allocating gsi_chan_hdl=%d\n",
+				&ep_rx->gsi_chan_hdl);
+		goto fail;
+	}
+
+	ep_rx->gsi_mem_info.chan_ring_len = gsi_channel_props.ring_len;
+	ep_rx->gsi_mem_info.chan_ring_base_addr =
+				gsi_channel_props.ring_base_addr;
+
+	/* write channel scratch, do we need this? */
+	memset(&ch_scratch, 0, sizeof(ch_scratch));
+	ch_scratch.qdss.bam_p_evt_dest_addr = in->bam_p_evt_dest_addr;
+	ch_scratch.qdss.data_fifo_base_addr = in->data_fifo_base_addr;
+	ch_scratch.qdss.data_fifo_size = in->data_fifo_size;
+	ch_scratch.qdss.bam_p_evt_threshold = in->bam_p_evt_threshold;
+	ch_scratch.qdss.override_eot = in->override_eot;
+	result = gsi_write_channel_scratch(
+				ep_rx->gsi_chan_hdl, ch_scratch);
+	if (result != GSI_STATUS_SUCCESS) {
+		IPA_QDSS_ERR("failed to write channel scratch\n");
+		goto fail_write_scratch;
+	}
+
+	/* query channel db address */
+	if (gsi_query_channel_db_addr(ep_rx->gsi_chan_hdl,
+		&gsi_db_addr_low, &gsi_db_addr_high)) {
+		IPA_QDSS_ERR("failed to query gsi rx db addr\n");
+		goto fail_write_scratch;
+	}
+	out->ipa_rx_db_pa = (phys_addr_t)(gsi_db_addr_low);
+	IPA_QDSS_DBG("QDSS out->ipa_rx_db_pa %llu\n", out->ipa_rx_db_pa);
+
+	/* Configuring HOLB on MHI endpoint */
+	memset(&holb_cfg, 0, sizeof(holb_cfg));
+	holb_cfg.en = IPA_HOLB_TMR_EN;
+	holb_cfg.tmr_val = IPA_HOLB_TMR_VALUE;
+	result = ipa3_force_cfg_ep_holb(ipa_ep_idx_tx, &holb_cfg);
+	if (result)
+		IPA_QDSS_ERR("Configuring HOLB failed client_type =%d\n",
+			IPA_CLIENT_MHI_QDSS_CONS);
+
+	/* Set DMA */
+	IPA_QDSS_DBG("DMA from %d to %d", IPA_CLIENT_QDSS_PROD,
+		IPA_CLIENT_MHI_QDSS_CONS);
+	ep_cfg.mode.mode = IPA_DMA;
+	ep_cfg.mode.dst = IPA_CLIENT_MHI_QDSS_CONS;
+	ep_cfg.seq.set_dynamic = true;
+	if (ipa3_cfg_ep(ipa3_get_ep_mapping(IPA_CLIENT_QDSS_PROD),
+		&ep_cfg)) {
+		IPA_QDSS_ERR("Setting DMA mode failed\n");
+		goto fail_write_scratch;
+	}
+
+	/* Start QDSS_rx gsi channel */
+	result = ipa3_start_gsi_channel(ipa_ep_idx_rx);
+	if (result) {
+		IPA_QDSS_ERR("Failed starting QDSS gsi channel\n");
+		goto fail_write_scratch;
+	}
+
+	IPA_QDSS_DBG("QDSS connect pipe success");
+
+	return IPA_QDSS_SUCCESS;
+
+fail_write_scratch:
+	gsi_dealloc_channel(ep_rx->gsi_chan_hdl);
+	memset(ep_rx, 0, sizeof(struct ipa3_ep_context));
+fail:
+	IPA_ACTIVE_CLIENTS_DEC_SIMPLE();
+	return -IPA_QDSS_PIPE_CONN_FAILURE;
+}
+
+int ipa3_disconn_qdss_pipes(void)
+{
+	int result = 0;
+	int ipa_ep_idx_rx;
+	struct ipa3_ep_context *ep_rx;
+	struct ipa_ep_cfg ep_cfg = { { 0 } };
+
+	ipa_ep_idx_rx = ipa_get_ep_mapping(IPA_CLIENT_QDSS_PROD);
+	if (ipa_ep_idx_rx == -1) {
+		IPA_QDSS_ERR("fail to get ep mapping\n");
+		return -IPA_QDSS_PIPE_DISCONN_FAILURE;
+	}
+
+	if (ipa_ep_idx_rx >= IPA3_MAX_NUM_PIPES) {
+		IPA_QDSS_ERR("ep out of range.\n");
+		return -IPA_QDSS_PIPE_DISCONN_FAILURE;
+	}
+
+	/* Stop QDSS_rx gsi channel / release channel */
+	result = ipa3_stop_gsi_channel(ipa_ep_idx_rx);
+	if (result) {
+		IPA_QDSS_ERR("Failed stopping QDSS gsi channel\n");
+		goto fail;
+	}
+
+	/* Resetting gsi channel */
+	result = ipa3_reset_gsi_channel(ipa_ep_idx_rx);
+	if (result) {
+		IPA_QDSS_ERR("Failed resetting QDSS gsi channel\n");
+		goto fail;
+	}
+
+	/* Reset DMA */
+	IPA_QDSS_ERR("Resetting DMA %d to %d",
+		IPA_CLIENT_QDSS_PROD, IPA_CLIENT_MHI_QDSS_CONS);
+	ep_cfg.mode.mode = IPA_BASIC;
+	ep_cfg.mode.dst = IPA_CLIENT_MHI_QDSS_CONS;
+	ep_cfg.seq.set_dynamic = true;
+	if (ipa3_cfg_ep(ipa3_get_ep_mapping(IPA_CLIENT_QDSS_PROD),
+		&ep_cfg)) {
+		IPAERR("Resetting DMA mode failed\n");
+	}
+
+	/* Deallocating and Clearing ep config */
+	ep_rx = &ipa3_ctx->ep[ipa_ep_idx_rx];
+	gsi_dealloc_channel(ep_rx->gsi_chan_hdl);
+	memset(ep_rx, 0, sizeof(struct ipa3_ep_context));
+
+	IPA_ACTIVE_CLIENTS_DEC_SIMPLE();
+	IPA_QDSS_DBG("QDSS disconnect pipe success");
+
+	return IPA_QDSS_SUCCESS;
+fail:
+	IPA_ACTIVE_CLIENTS_DEC_SIMPLE();
+	return -IPA_QDSS_PIPE_DISCONN_FAILURE;
+}
--- a/drivers/platform/msm/ipa/ipa_v3/ipa_qmi_service.c
+++ b/drivers/platform/msm/ipa/ipa_v3/ipa_qmi_service.c
@@ -790,6 +790,44 @@ int ipa3_qmi_filter_request_send(struct ipa_install_fltr_rule_req_msg_v01 *req)
 		resp.resp.error, "ipa_install_filter");
 }

+static int ipa3_qmi_filter_request_ex_calc_length(
+	struct ipa_install_fltr_rule_req_ex_msg_v01 *req)
+{
+	int len = 0;
+
+	/* caller should validate and send the req */
+	/* instead of sending max length,the approximate length is calculated */
+	len += ((sizeof(struct ipa_install_fltr_rule_req_ex_msg_v01)) -
+		(QMI_IPA_MAX_FILTERS_EX_V01 *
+		sizeof(struct ipa_filter_spec_ex_type_v01) -
+		QMI_IPA_MAX_FILTERS_EX_V01 * sizeof(uint32_t)) -
+		(QMI_IPA_MAX_FILTERS_V01 *
+		sizeof(struct ipa_filter_spec_ex2_type_v01)));
+
+	if (req->filter_spec_ex_list_valid &&
+		req->filter_spec_ex_list_len > 0) {
+		len += sizeof(struct ipa_filter_spec_ex_type_v01)*
+			req->filter_spec_ex_list_len;
+	}
+	if (req->xlat_filter_indices_list_valid &&
+		req->xlat_filter_indices_list_len > 0) {
+		len += sizeof(uint32_t)*req->xlat_filter_indices_list_len;
+	}
+
+	if (req->filter_spec_ex2_list_valid &&
+		req->filter_spec_ex2_list_len > 0) {
+		len += sizeof(struct ipa_filter_spec_ex2_type_v01)*
+		req->filter_spec_ex2_list_len;
+	}
+
+	if (req->ul_firewall_indices_list_valid &&
+		req->ul_firewall_indices_list_len > 0) {
+		len += sizeof(uint32_t)*req->ul_firewall_indices_list_len;
+	}
+
+	return len;
+}
+
 /* sending filter-install-request to modem*/
 int ipa3_qmi_filter_request_ex_send(
 	struct ipa_install_fltr_rule_req_ex_msg_v01 *req)
@@ -855,8 +893,9 @@ int ipa3_qmi_filter_request_ex_send(
 	}
 	mutex_unlock(&ipa3_qmi_lock);

-	req_desc.max_msg_len =
-		QMI_IPA_INSTALL_FILTER_RULE_EX_REQ_MAX_MSG_LEN_V01;
+	req_desc.max_msg_len = ipa3_qmi_filter_request_ex_calc_length(req);
+	IPAWANDBG("QMI send request length = %d\n", req_desc.max_msg_len);
+
 	req_desc.msg_id = QMI_IPA_INSTALL_FILTER_RULE_EX_REQ_V01;
 	req_desc.ei_array = ipa3_install_fltr_rule_req_ex_msg_data_v01_ei;

--- a/drivers/platform/msm/ipa/ipa_v3/ipa_rt.c
+++ b/drivers/platform/msm/ipa/ipa_v3/ipa_rt.c
@@ -344,8 +344,7 @@ static int ipa_prep_rt_tbl_for_cmt(enum ipa_ip_type ip,

 	if ((tbl->sz[IPA_RULE_HASHABLE] +
 		tbl->sz[IPA_RULE_NON_HASHABLE]) == 0) {
-		WARN_ON_RATELIMIT_IPA(1);
-		IPAERR_RL("rt tbl %s is with zero total size\n", tbl->name);
+		IPADBG("rt tbl %s is with zero total size\n", tbl->name);
 	}

 	hdr_width = ipahal_get_hw_tbl_hdr_width();
--- a/drivers/platform/msm/ipa/ipa_v3/ipa_uc_ntn.c
+++ b/drivers/platform/msm/ipa/ipa_v3/ipa_uc_ntn.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2016-2019, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2016-2020, The Linux Foundation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 and
@@ -263,7 +263,7 @@ static int ipa3_uc_send_ntn_setup_pipe_cmd(
 }

 static int ipa3_smmu_map_uc_ntn_pipes(struct ipa_ntn_setup_info *params,
-	bool map)
+	bool map, bool map_unmap_once)
 {
 	struct iommu_domain *smmu_domain;
 	int result;
@@ -279,14 +279,16 @@ static int ipa3_smmu_map_uc_ntn_pipes(struct ipa_ntn_setup_info *params,
 		return -EINVAL;
 	}

-	result = ipa3_smmu_map_peer_reg(rounddown(params->ntn_reg_base_ptr_pa,
-		PAGE_SIZE), map, IPA_SMMU_CB_UC);
-	if (result) {
-		IPAERR("failed to %s uC regs %d\n",
-			map ? "map" : "unmap", result);
-		goto fail;
+	if (map_unmap_once) {
+		result = ipa3_smmu_map_peer_reg(rounddown(
+					params->ntn_reg_base_ptr_pa, PAGE_SIZE),
+					map, IPA_SMMU_CB_UC);
+		if (result) {
+			IPAERR("failed to %s uC regs %d\n",
+					map ? "map" : "unmap", result);
+			goto fail;
+		}
 	}
-
 	if (params->smmu_enabled) {
 		IPADBG("smmu is enabled on EMAC\n");
 		result = ipa3_smmu_map_peer_buff((u64)params->ring_base_iova,
@@ -349,14 +351,13 @@ static int ipa3_smmu_map_uc_ntn_pipes(struct ipa_ntn_setup_info *params,
 				IPAERR("Fail to map 0x%llx\n", iova);
 		} else {
 			result = iommu_unmap(smmu_domain, iova_p, size_p);
-			if (result != params->data_buff_size)
+			if (result != size_p) {
 				IPAERR("Fail to unmap 0x%llx\n", iova);
-		}
-		if (result) {
-			if (params->smmu_enabled)
-				goto fail_map_data_buff_smmu_enabled;
-			else
-				goto fail_map_data_buff_smmu_disabled;
+				if (params->smmu_enabled)
+					goto fail_map_data_buff_smmu_enabled;
+				else
+					goto fail_map_data_buff_smmu_disabled;
+			}
 		}
 	}
 	return 0;
@@ -396,6 +397,7 @@ int ipa3_setup_uc_ntn_pipes(struct ipa_ntn_conn_in_params *in,
 	int ipa_ep_idx_ul;
 	int ipa_ep_idx_dl;
 	int result = 0;
+	bool unmapped = false;

 	if (in == NULL) {
 		IPAERR("invalid input\n");
@@ -449,7 +451,7 @@ int ipa3_setup_uc_ntn_pipes(struct ipa_ntn_conn_in_params *in,
 		goto fail;
 	}

-	result = ipa3_smmu_map_uc_ntn_pipes(&in->ul, true);
+	result = ipa3_smmu_map_uc_ntn_pipes(&in->ul, true, true);
 	if (result) {
 		IPAERR("failed to map SMMU for UL %d\n", result);
 		goto fail;
@@ -488,7 +490,7 @@ int ipa3_setup_uc_ntn_pipes(struct ipa_ntn_conn_in_params *in,
 		goto fail_disable_dp_ul;
 	}

-	result = ipa3_smmu_map_uc_ntn_pipes(&in->dl, true);
+	result = ipa3_smmu_map_uc_ntn_pipes(&in->dl, true, false);
 	if (result) {
 		IPAERR("failed to map SMMU for DL %d\n", result);
 		goto fail_disable_dp_ul;
@@ -519,11 +521,12 @@ int ipa3_setup_uc_ntn_pipes(struct ipa_ntn_conn_in_params *in,
 fail_disable_dp_dl:
 	ipa3_disable_data_path(ipa_ep_idx_dl);
 fail_smmu_unmap_dl:
-	ipa3_smmu_map_uc_ntn_pipes(&in->dl, false);
+	ipa3_smmu_map_uc_ntn_pipes(&in->dl, false, true);
+	unmapped = true;
 fail_disable_dp_ul:
 	ipa3_disable_data_path(ipa_ep_idx_ul);
 fail_smmu_unmap_ul:
-	ipa3_smmu_map_uc_ntn_pipes(&in->ul, false);
+	ipa3_smmu_map_uc_ntn_pipes(&in->ul, false, !unmapped);
 fail:
 	IPA_ACTIVE_CLIENTS_DEC_SIMPLE();
 	return result;
@@ -603,7 +606,7 @@ int ipa3_tear_down_uc_offload_pipes(int ipa_ep_idx_ul,
 	}

 	/* unmap the DL pipe */
-	result = ipa3_smmu_map_uc_ntn_pipes(&params->dl, false);
+	result = ipa3_smmu_map_uc_ntn_pipes(&params->dl, false, true);
 	if (result) {
 		IPAERR("failed to unmap SMMU for DL %d\n", result);
 		goto fail;
@@ -624,7 +627,7 @@ int ipa3_tear_down_uc_offload_pipes(int ipa_ep_idx_ul,
 	}

 	/* unmap the UL pipe */
-	result = ipa3_smmu_map_uc_ntn_pipes(&params->ul, false);
+	result = ipa3_smmu_map_uc_ntn_pipes(&params->ul, false, false);
 	if (result) {
 		IPAERR("failed to unmap SMMU for UL %d\n", result);
 		goto fail;
--- a/drivers/platform/msm/ipa/ipa_v3/ipa_utils.c
+++ b/drivers/platform/msm/ipa/ipa_v3/ipa_utils.c
@@ -2608,6 +2608,12 @@ static const struct ipa_ep_configuration ipa3_ep_mapping
 			IPA_DPS_HPS_SEQ_TYPE_2ND_PKT_PROCESS_PASS_NO_DEC_UCP,
 			QMB_MASTER_SELECT_PCIE,
 			{ 3, 5, 8, 16, IPA_EE_AP, GSI_SMART_PRE_FETCH, 3 } },
+	[IPA_4_5_MHI][IPA_CLIENT_QDSS_PROD] = {
+			true, IPA_v4_5_MHI_GROUP_QDSS,
+			false,
+			IPA_DPS_HPS_SEQ_TYPE_DMA_ONLY,
+			QMB_MASTER_SELECT_DDR,
+			{ 11, 14, 10, 16, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY, 0 } },
 	/* Only for test purpose */
 	[IPA_4_5_MHI][IPA_CLIENT_TEST_PROD]           = {
 			true, QMB_MASTER_SELECT_DDR,
@@ -2701,11 +2707,11 @@ static const struct ipa_ep_configuration ipa3_ep_mapping
 			QMB_MASTER_SELECT_PCIE,
 			{ 30, 6, 9, 9, IPA_EE_AP, GSI_SMART_PRE_FETCH, 4 } },
 	[IPA_4_5_MHI][IPA_CLIENT_MHI_QDSS_CONS] = {
-			true, IPA_v4_5_MHI_GROUP_PCIE,
+			true, IPA_v4_5_MHI_GROUP_QDSS,
 			false,
 			IPA_DPS_HPS_SEQ_TYPE_INVALID,
 			QMB_MASTER_SELECT_PCIE,
-			{ 24, 3, 8, 14, IPA_EE_AP, GSI_SMART_PRE_FETCH, 3 } },
+			{ 24, 3, 8, 14, IPA_EE_AP, GSI_ESCAPE_BUF_ONLY, 0 } },
 	/* Dummy consumer (pipe 31) is used in L2TP rt rule */
 	[IPA_4_5_MHI][IPA_CLIENT_DUMMY_CONS]          = {
 			true, QMB_MASTER_SELECT_DDR,
@@ -5495,6 +5501,78 @@ success:
 	return 0;
 }

+/**
+ * ipa3_force_cfg_ep_holb() - IPA end-point holb configuration
+ *			for QDSS_MHI_CONS pipe
+ *
+ * If an IPA producer pipe is full, IPA HW by default will block
+ * indefinitely till space opens up. During this time no packets
+ * including those from unrelated pipes will be processed. Enabling
+ * HOLB means IPA HW will be allowed to drop packets as/when needed
+ * and indefinite blocking is avoided.
+ *
+ * @clnt_hdl:	[in] opaque client handle assigned by IPA to client
+ * @ipa_ep_cfg:	[in] IPA end-point configuration params
+ *
+ * Returns:	0 on success, negative on failure
+ */
+int ipa3_force_cfg_ep_holb(u32 clnt_hdl,
+	struct ipa_ep_cfg_holb *ep_holb)
+{
+	if (clnt_hdl >= ipa3_ctx->ipa_num_pipes ||
+		ep_holb == NULL) {
+		IPAERR("bad parm.\n");
+		return -EINVAL;
+	}
+
+	IPA_ACTIVE_CLIENTS_INC_EP(ipa3_get_client_mapping(clnt_hdl));
+
+	if (ep_holb->en == IPA_HOLB_TMR_DIS) {
+		ipahal_write_reg_n_fields(IPA_ENDP_INIT_HOL_BLOCK_EN_n,
+			clnt_hdl, ep_holb);
+		goto success;
+	}
+
+	/* Follow HPG sequence to DIS_HOLB, Configure Timer, and HOLB_EN */
+	if (ipa3_ctx->ipa_hw_type >= IPA_HW_v4_5) {
+		ep_holb->en = IPA_HOLB_TMR_DIS;
+		ipahal_write_reg_n_fields(IPA_ENDP_INIT_HOL_BLOCK_EN_n,
+			clnt_hdl, ep_holb);
+	}
+
+	if (ipa3_ctx->ipa_hw_type >= IPA_HW_v4_5) {
+		int res;
+
+		res = ipa3_process_timer_cfg(ep_holb->tmr_val * 1000,
+			&ep_holb->pulse_generator,
+			&ep_holb->scaled_time);
+		if (res) {
+			IPAERR("failed to process HOLB timer tmr=%u\n",
+				ep_holb->tmr_val);
+			ipa_assert();
+			return res;
+		}
+	}
+
+	ipahal_write_reg_n_fields(IPA_ENDP_INIT_HOL_BLOCK_TIMER_n,
+		clnt_hdl, ep_holb);
+
+	/* Enable HOLB */
+	ep_holb->en = IPA_HOLB_TMR_EN;
+	ipahal_write_reg_n_fields(IPA_ENDP_INIT_HOL_BLOCK_EN_n,
+		clnt_hdl, ep_holb);
+	/* IPA4.5 issue requires HOLB_EN to be written twice */
+	if (ipa3_ctx->ipa_hw_type >= IPA_HW_v4_5)
+		ipahal_write_reg_n_fields(IPA_ENDP_INIT_HOL_BLOCK_EN_n,
+			clnt_hdl, ep_holb);
+
+success:
+	IPA_ACTIVE_CLIENTS_DEC_EP(ipa3_get_client_mapping(clnt_hdl));
+	IPADBG("cfg holb %u ep=%d tmr=%d\n", ep_holb->en, clnt_hdl,
+		ep_holb->tmr_val);
+	return 0;
+}
+
 /**
 * ipa3_cfg_ep_holb_by_client() - IPA end-point holb configuration
 *
@@ -7293,6 +7371,8 @@ int ipa3_bind_api_controller(enum ipa_hw_type ipa_hw_type,
 		ipa3_get_prot_id;
 	api_ctrl->ipa_add_socksv5_conn = ipa3_add_socksv5_conn;
 	api_ctrl->ipa_del_socksv5_conn = ipa3_del_socksv5_conn;
+	api_ctrl->ipa_conn_qdss_pipes = ipa3_conn_qdss_pipes;
+	api_ctrl->ipa_disconn_qdss_pipes = ipa3_disconn_qdss_pipes;
 	return 0;
 }

--- a/drivers/platform/msm/ipa/ipa_v3/rmnet_ipa_fd_ioctl.c
+++ b/drivers/platform/msm/ipa/ipa_v3/rmnet_ipa_fd_ioctl.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2013-2019, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2013-2020, The Linux Foundation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 and
@@ -103,7 +103,7 @@ static long ipa3_wan_ioctl(struct file *filp,
 		IPAWANDBG("device %s got WAN_IOC_ADD_FLT_RULE :>>>\n",
 		DRIVER_NAME);
 		pyld_sz = sizeof(struct ipa_install_fltr_rule_req_msg_v01);
-		param = kzalloc(pyld_sz, GFP_KERNEL);
+		param = vzalloc(pyld_sz);
 		if (!param) {
 			retval = -ENOMEM;
 			break;
@@ -128,7 +128,7 @@ static long ipa3_wan_ioctl(struct file *filp,
 		IPAWANDBG("device %s got WAN_IOC_ADD_FLT_RULE_EX :>>>\n",
 		DRIVER_NAME);
 		pyld_sz = sizeof(struct ipa_install_fltr_rule_req_ex_msg_v01);
-		param = kzalloc(pyld_sz, GFP_KERNEL);
+		param = vzalloc(pyld_sz);
 		if (!param) {
 			retval = -ENOMEM;
 			break;
@@ -153,7 +153,7 @@ static long ipa3_wan_ioctl(struct file *filp,
 		IPAWANDBG("device %s got WAN_IOC_ADD_OFFLOAD_CONNECTION :>>>\n",
 		DRIVER_NAME);
 		pyld_sz = sizeof(struct ipa_add_offload_connection_req_msg_v01);
-		param = kzalloc(pyld_sz, GFP_KERNEL);
+		param = vzalloc(pyld_sz);
 		if (!param) {
 			retval = -ENOMEM;
 			break;
@@ -180,7 +180,7 @@ static long ipa3_wan_ioctl(struct file *filp,
 		DRIVER_NAME);
 		pyld_sz =
 			rmv_offload_req__msg_size;
-		param = kzalloc(pyld_sz, GFP_KERNEL);
+		param = vzalloc(pyld_sz);
 		if (!param) {
 			retval = -ENOMEM;
 			break;
@@ -207,7 +207,7 @@ static long ipa3_wan_ioctl(struct file *filp,
 		DRIVER_NAME);
 		pyld_sz =
 		sizeof(struct ipa_configure_ul_firewall_rules_req_msg_v01);
-		param = kzalloc(pyld_sz, GFP_KERNEL);
+		param = vzalloc(pyld_sz);
 		if (!param) {
 			retval = -ENOMEM;
 			break;
@@ -233,7 +233,7 @@ static long ipa3_wan_ioctl(struct file *filp,
 		IPAWANDBG("device %s got WAN_IOC_ADD_FLT_RULE_INDEX :>>>\n",
 		DRIVER_NAME);
 		pyld_sz = sizeof(struct ipa_fltr_installed_notif_req_msg_v01);
-		param = kzalloc(pyld_sz, GFP_KERNEL);
+		param = vzalloc(pyld_sz);
 		if (!param) {
 			retval = -ENOMEM;
 			break;
@@ -258,7 +258,7 @@ static long ipa3_wan_ioctl(struct file *filp,
 		IPAWANDBG("device %s got WAN_IOC_VOTE_FOR_BW_MBPS :>>>\n",
 		DRIVER_NAME);
 		pyld_sz = sizeof(uint32_t);
-		param = kzalloc(pyld_sz, GFP_KERNEL);
+		param = vzalloc(pyld_sz);
 		if (!param) {
 			retval = -ENOMEM;
 			break;
@@ -281,7 +281,7 @@ static long ipa3_wan_ioctl(struct file *filp,
 	case WAN_IOC_POLL_TETHERING_STATS:
 		IPAWANDBG_LOW("got WAN_IOCTL_POLL_TETHERING_STATS :>>>\n");
 		pyld_sz = sizeof(struct wan_ioctl_poll_tethering_stats);
-		param = kzalloc(pyld_sz, GFP_KERNEL);
+		param = vzalloc(pyld_sz);
 		if (!param) {
 			retval = -ENOMEM;
 			break;
@@ -305,7 +305,7 @@ static long ipa3_wan_ioctl(struct file *filp,
 	case WAN_IOC_SET_DATA_QUOTA:
 		IPAWANDBG_LOW("got WAN_IOCTL_SET_DATA_QUOTA :>>>\n");
 		pyld_sz = sizeof(struct wan_ioctl_set_data_quota);
-		param = kzalloc(pyld_sz, GFP_KERNEL);
+		param = vzalloc(pyld_sz);
 		if (!param) {
 			retval = -ENOMEM;
 			break;
@@ -333,7 +333,7 @@ static long ipa3_wan_ioctl(struct file *filp,
 	case WAN_IOC_SET_TETHER_CLIENT_PIPE:
 		IPAWANDBG_LOW("got WAN_IOC_SET_TETHER_CLIENT_PIPE :>>>\n");
 		pyld_sz = sizeof(struct wan_ioctl_set_tether_client_pipe);
-		param = kzalloc(pyld_sz, GFP_KERNEL);
+		param = vzalloc(pyld_sz);
 		if (!param) {
 			retval = -ENOMEM;
 			break;
@@ -353,7 +353,7 @@ static long ipa3_wan_ioctl(struct file *filp,
 	case WAN_IOC_QUERY_TETHER_STATS:
 		IPAWANDBG_LOW("got WAN_IOC_QUERY_TETHER_STATS :>>>\n");
 		pyld_sz = sizeof(struct wan_ioctl_query_tether_stats);
-		param = kzalloc(pyld_sz, GFP_KERNEL);
+		param = vzalloc(pyld_sz);
 		if (!param) {
 			retval = -ENOMEM;
 			break;
@@ -379,7 +379,7 @@ static long ipa3_wan_ioctl(struct file *filp,
 	case WAN_IOC_QUERY_TETHER_STATS_ALL:
 		IPAWANDBG_LOW("got WAN_IOC_QUERY_TETHER_STATS_ALL :>>>\n");
 		pyld_sz = sizeof(struct wan_ioctl_query_tether_stats_all);
-		param = kzalloc(pyld_sz, GFP_KERNEL);
+		param = vzalloc(pyld_sz);
 		if (!param) {
 			retval = -ENOMEM;
 			break;
@@ -406,7 +406,7 @@ static long ipa3_wan_ioctl(struct file *filp,
 		IPAWANDBG_LOW("device %s got WAN_IOC_RESET_TETHER_STATS :>>>\n",
 				DRIVER_NAME);
 		pyld_sz = sizeof(struct wan_ioctl_reset_tether_stats);
-		param = kzalloc(pyld_sz, GFP_KERNEL);
+		param = vzalloc(pyld_sz);
 		if (!param) {
 			retval = -ENOMEM;
 			break;
@@ -428,7 +428,7 @@ static long ipa3_wan_ioctl(struct file *filp,
 		IPAWANDBG_LOW("device %s got WAN_IOC_NOTIFY_WAN_STATE :>>>\n",
 			DRIVER_NAME);
 		pyld_sz = sizeof(struct wan_ioctl_notify_wan_state);
-		param = kzalloc(pyld_sz, GFP_KERNEL);
+		param = vzalloc(pyld_sz);
 		if (!param) {
 			retval = -ENOMEM;
 			break;
@@ -454,7 +454,7 @@ static long ipa3_wan_ioctl(struct file *filp,
 	case WAN_IOC_ENABLE_PER_CLIENT_STATS:
 		IPAWANDBG_LOW("got WAN_IOC_ENABLE_PER_CLIENT_STATS :>>>\n");
 		pyld_sz = sizeof(bool);
-		param = kzalloc(pyld_sz, GFP_KERNEL);
+		param = vzalloc(pyld_sz);
 		if (!param) {
 			retval = -ENOMEM;
 			break;
@@ -473,7 +473,7 @@ static long ipa3_wan_ioctl(struct file *filp,
 	case WAN_IOC_QUERY_PER_CLIENT_STATS:
 		IPAWANDBG_LOW("got WAN_IOC_QUERY_PER_CLIENT_STATS :>>>\n");
 		pyld_sz = sizeof(struct wan_ioctl_query_per_client_stats);
-		param = kzalloc(pyld_sz, GFP_KERNEL);
+		param = vzalloc(pyld_sz);
 		if (!param) {
 			retval = -ENOMEM;
 			break;
@@ -502,7 +502,7 @@ static long ipa3_wan_ioctl(struct file *filp,
 	case WAN_IOC_SET_LAN_CLIENT_INFO:
 		IPAWANDBG_LOW("got WAN_IOC_SET_LAN_CLIENT_INFO :>>>\n");
 		pyld_sz = sizeof(struct wan_ioctl_lan_client_info);
-		param = kzalloc(pyld_sz, GFP_KERNEL);
+		param = vzalloc(pyld_sz);
 		if (!param) {
 			retval = -ENOMEM;
 			break;
@@ -522,7 +522,7 @@ static long ipa3_wan_ioctl(struct file *filp,
 	case WAN_IOC_CLEAR_LAN_CLIENT_INFO:
 		IPAWANDBG_LOW("got WAN_IOC_CLEAR_LAN_CLIENT_INFO :>>>\n");
 		pyld_sz = sizeof(struct wan_ioctl_lan_client_info);
-		param = kzalloc(pyld_sz, GFP_KERNEL);
+		param = vzalloc(pyld_sz);
 		if (!param) {
 			retval = -ENOMEM;
 			break;
@@ -543,7 +543,7 @@ static long ipa3_wan_ioctl(struct file *filp,
 	case WAN_IOC_SEND_LAN_CLIENT_MSG:
 		IPAWANDBG_LOW("got WAN_IOC_SEND_LAN_CLIENT_MSG :>>>\n");
 		pyld_sz = sizeof(struct wan_ioctl_send_lan_client_msg);
-		param = kzalloc(pyld_sz, GFP_KERNEL);
+		param = vzalloc(pyld_sz);
 		if (!param) {
 			retval = -ENOMEM;
 			break;
@@ -564,7 +564,8 @@ static long ipa3_wan_ioctl(struct file *filp,
 	default:
 		retval = -ENOTTY;
 	}
-	kfree(param);
+	if (param)
+		vfree(param);
 	return retval;
 }

--- a/drivers/platform/msm/mhi_dev/mhi.c
+++ b/drivers/platform/msm/mhi_dev/mhi.c
@@ -444,10 +444,11 @@ static int mhi_dev_flush_transfer_completion_events(struct mhi_dev *mhi,
 	struct event_req *flush_ereq;

 	/*
-	 * Channel got closed with transfers pending
+	 * Channel got stopped or closed with transfers pending
 	 * Do not send completion events to host
 	 */
-	if (ch->state == MHI_DEV_CH_CLOSED) {
+	if (ch->state == MHI_DEV_CH_CLOSED ||
+		ch->state == MHI_DEV_CH_STOPPED) {
 		mhi_log(MHI_MSG_DBG, "Ch %d closed with %d writes pending\n",
 			ch->ch_id, ch->pend_wr_count + 1);
 		return -ENODEV;
@@ -1294,6 +1295,11 @@ static int mhi_hwc_chcmd(struct mhi_dev *mhi, uint chid,
 	switch (type) {
 	case MHI_DEV_RING_EL_RESET:
 	case MHI_DEV_RING_EL_STOP:
+		if ((chid-HW_CHANNEL_BASE) > NUM_HW_CHANNELS) {
+			pr_err("Invalid Channel ID = 0x%X\n", chid);
+			return -EINVAL;
+		}
+
 		rc = ipa_mhi_disconnect_pipe(
 			mhi->ipa_clnt_hndl[chid-HW_CHANNEL_BASE]);
 		if (rc)
@@ -1304,6 +1310,16 @@ static int mhi_hwc_chcmd(struct mhi_dev *mhi, uint chid,
 		connect_params.channel_id = chid;
 		connect_params.sys.skip_ep_cfg = true;

+		if (chid > HW_CHANNEL_END) {
+			pr_err("Channel DB for %d not enabled\n", chid);
+			return -EINVAL;
+		}
+
+		if ((chid-HW_CHANNEL_BASE) > NUM_HW_CHANNELS) {
+			pr_err("Invalid Channel = 0x%X\n", chid);
+			return -EINVAL;
+		}
+
 		rc = ipa_mhi_connect_pipe(&connect_params,
 			&mhi->ipa_clnt_hndl[chid-HW_CHANNEL_BASE]);
 		if (rc)
@@ -2124,12 +2140,14 @@ static void mhi_dev_transfer_completion_cb(void *mreq)
 			req->len, DMA_FROM_DEVICE);

 	/*
-	 * Channel got closed with transfers pending
+	 * Channel got stopped or closed with transfers pending
 	 * Do not trigger callback or send cmpl to host
 	 */
-	if (ch->state == MHI_DEV_CH_CLOSED) {
-		mhi_log(MHI_MSG_DBG, "Ch %d closed with %d writes pending\n",
-				ch->ch_id, ch->pend_wr_count + 1);
+	if (ch->state == MHI_DEV_CH_CLOSED ||
+		ch->state == MHI_DEV_CH_STOPPED) {
+		mhi_log(MHI_MSG_DBG,
+			"Ch %d not in started state, %d writes pending\n",
+			ch->ch_id, ch->pend_wr_count + 1);
 		return;
 	}

@@ -2364,6 +2382,10 @@ static int mhi_dev_cache_host_cfg(struct mhi_dev *mhi)
 		return rc;
 	}

+	mhi_log(MHI_MSG_VERBOSE,
+		"Number of Event rings : %d, HW Event rings : %d\n",
+			mhi->cfg.event_rings, mhi->cfg.hw_event_rings);
+
 	mhi->cmd_ctx_shadow.size = sizeof(struct mhi_dev_cmd_ctx);
 	mhi->ev_ctx_shadow.size = sizeof(struct mhi_dev_ev_ctx) *
 					mhi->cfg.event_rings;
@@ -2976,6 +2998,7 @@ int mhi_dev_write_channel(struct mhi_req *wreq)
 	size_t bytes_written = 0;
 	uint32_t tre_len = 0, suspend_wait_timeout = 0;
 	bool async_wr_sched = false;
+	enum mhi_ctrl_info info;

 	if (WARN_ON(!wreq || !wreq->client || !wreq->buf)) {
 		pr_err("%s: invalid parameters\n", __func__);
@@ -3024,6 +3047,14 @@ int mhi_dev_write_channel(struct mhi_req *wreq)

 	mutex_lock(&ch->ch_lock);

+	rc = mhi_ctrl_state_info(ch->ch_id, &info);
+	if (rc || (info != MHI_STATE_CONNECTED)) {
+		mhi_log(MHI_MSG_ERROR, "Channel %d not started by host\n",
+				ch->ch_id);
+		mutex_unlock(&ch->ch_lock);
+		return -ENODEV;
+	}
+
 	ch->pend_wr_count++;
 	if (ch->state == MHI_DEV_CH_STOPPED) {
 		mhi_log(MHI_MSG_ERROR,
--- a/drivers/platform/msm/mhi_dev/mhi.h
+++ b/drivers/platform/msm/mhi_dev/mhi.h
@@ -271,6 +271,7 @@ struct mhi_config {

 #define NUM_CHANNELS			128
 #define HW_CHANNEL_BASE			100
+#define NUM_HW_CHANNELS			15
 #define HW_CHANNEL_END			110
 #define MHI_ENV_VALUE			2
 #define MHI_MASK_ROWS_CH_EV_DB		4
@@ -549,7 +550,7 @@ struct mhi_dev {
 	size_t			ch_ring_start;

 	/* IPA Handles */
-	u32				ipa_clnt_hndl[4];
+	u32				ipa_clnt_hndl[NUM_HW_CHANNELS];
 	struct workqueue_struct		*ring_init_wq;
 	struct work_struct		ring_init_cb_work;
 	struct work_struct		re_init;
--- a/drivers/platform/msm/mhi_dev/mhi_mmio.c
+++ b/drivers/platform/msm/mhi_dev/mhi_mmio.c
@@ -709,13 +709,21 @@ EXPORT_SYMBOL(mhi_dev_mmio_init);

 int mhi_dev_update_ner(struct mhi_dev *dev)
 {
+	int rc = 0, mhi_cfg = 0;
+
 	if (WARN_ON(!dev))
 		return -EINVAL;

-	mhi_dev_mmio_masked_read(dev, MHICFG, MHICFG_NER_MASK,
-				  MHICFG_NER_SHIFT, &dev->cfg.event_rings);
+	rc = mhi_dev_mmio_read(dev, MHICFG, &mhi_cfg);
+	if (rc)
+		return rc;

-	pr_debug("NER in HW :%d\n", dev->cfg.event_rings);
+	pr_debug("MHICFG: 0x%x", mhi_cfg);
+
+	dev->cfg.event_rings =
+		(mhi_cfg & MHICFG_NER_MASK) >> MHICFG_NER_SHIFT;
+	dev->cfg.hw_event_rings =
+		(mhi_cfg & MHICFG_NHWER_MASK) >> MHICFG_NHWER_SHIFT;

 	return 0;
 }
--- a/drivers/platform/msm/mhi_dev/mhi_sm.c
+++ b/drivers/platform/msm/mhi_dev/mhi_sm.c
@@ -1142,6 +1142,7 @@ int mhi_dev_sm_exit(struct mhi_dev *mhi_dev)
 	flush_workqueue(mhi_sm_ctx->mhi_sm_wq);
 	destroy_workqueue(mhi_sm_ctx->mhi_sm_wq);
 	/* Initiate MHI IPA reset */
+	ipa_dma_disable();
 	ipa_mhi_destroy();
 	ipa_dma_destroy();
 	mutex_destroy(&mhi_sm_ctx->mhi_state_lock);
--- a/drivers/platform/msm/qcom-geni-se.c
+++ b/drivers/platform/msm/qcom-geni-se.c
@@ -50,6 +50,12 @@ static unsigned long default_bus_bw_set[] = {0, 19200000, 50000000,
 #define TZ_PIL_AUTH_GSI_QUP_PROC	0x13
 #define SSR_SCM_CMD	0x2

+enum ssc_core_clocks {
+	SSC_CORE_CLK,
+	SSC_CORE2X_CLK,
+	SSC_NUM_CLKS
+};
+
 struct bus_vectors {
 	int src;
 	int dst;
@@ -133,6 +139,7 @@ struct geni_se_device {
 	int update;
 	bool vote_for_bw;
 	struct ssc_qup_ssr ssr;
+	struct clk_bulk_data *ssc_clks;
 };

 #define HW_VER_MAJOR_MASK GENMASK(31, 28)
@@ -375,10 +382,17 @@ static void geni_se_ssc_qup_down(struct geni_se_device *dev)
 	struct se_geni_rsc *rsc = NULL;

 	dev->ssr.is_ssr_down = true;
+	if (list_empty(&dev->ssr.active_list_head)) {
+		GENI_SE_ERR(dev->log_ctx, false, NULL,
+			"%s: No Active usecase\n", __func__);
+		return;
+	}
+
 	list_for_each_entry(rsc, &dev->ssr.active_list_head,
 					rsc_ssr.active_list) {
 		rsc->rsc_ssr.force_suspend(rsc->ctrl_dev);
 	}
+	clk_bulk_disable_unprepare(SSC_NUM_CLKS, dev->ssc_clks);
 }

 static void geni_se_ssc_qup_up(struct geni_se_device *dev)
@@ -391,17 +405,40 @@ static void geni_se_ssc_qup_up(struct geni_se_device *dev)
 	desc.args[1] = TZ_SCM_CALL_FROM_HLOS;
 	desc.arginfo = SCM_ARGS(2, SCM_VAL);

-	ret = scm_call2(SCM_SIP_FNID(SCM_SVC_MP, SSR_SCM_CMD), &desc);
+	if (list_empty(&dev->ssr.active_list_head)) {
+		GENI_SE_ERR(dev->log_ctx, false, NULL,
+			"%s: No Active usecase\n", __func__);
+		return;
+	}
+	/* Enable core/2x clk before TZ SCM call */
+	ret = clk_bulk_prepare_enable(SSC_NUM_CLKS, dev->ssc_clks);
 	if (ret) {
-		dev_err(dev->dev, "Unable to load firmware after SSR\n");
+		GENI_SE_ERR(dev->log_ctx, false, NULL,
+			"%s: corex/2x clk enable failed ret:%d\n",
+							__func__, ret);
 		return;
 	}

 	list_for_each_entry(rsc, &dev->ssr.active_list_head,
-					rsc_ssr.active_list) {
-		rsc->rsc_ssr.force_resume(rsc->ctrl_dev);
+						rsc_ssr.active_list)
+		se_geni_clks_on(rsc);
+
+	ret = scm_call2(SCM_SIP_FNID(SCM_SVC_MP, SSR_SCM_CMD), &desc);
+	if (ret) {
+		GENI_SE_ERR(dev->log_ctx, false, NULL,
+			"%s: Unable to load firmware after SSR ret:%d\n",
+								__func__, ret);
+		return;
 	}

+	list_for_each_entry(rsc, &dev->ssr.active_list_head,
+						rsc_ssr.active_list)
+		se_geni_clks_off(rsc);
+
+	list_for_each_entry(rsc, &dev->ssr.active_list_head,
+						rsc_ssr.active_list)
+		rsc->rsc_ssr.force_resume(rsc->ctrl_dev);
+
 	dev->ssr.is_ssr_down = false;
 }

@@ -1988,6 +2025,25 @@ static int geni_se_probe(struct platform_device *pdev)
 	ret = of_property_read_string(geni_se_dev->dev->of_node,
 			"qcom,subsys-name", &geni_se_dev->ssr.subsys_name);
 	if (!ret) {
+
+		geni_se_dev->ssc_clks = devm_kcalloc(dev, SSC_NUM_CLKS,
+				sizeof(*geni_se_dev->ssc_clks), GFP_KERNEL);
+		if (!geni_se_dev->ssc_clks) {
+			ret = -ENOMEM;
+			dev_err(dev, "%s: Unable to allocate memmory ret:%d\n",
+					__func__, ret);
+			return ret;
+		}
+
+		geni_se_dev->ssc_clks[SSC_CORE_CLK].id = "corex";
+		geni_se_dev->ssc_clks[SSC_CORE2X_CLK].id = "core2x";
+		ret = devm_clk_bulk_get(dev, SSC_NUM_CLKS,
+						geni_se_dev->ssc_clks);
+		if (ret) {
+			dev_err(dev, "%s: Err getting core/2x clk:%d\n", ret);
+			return ret;
+		}
+
 		INIT_LIST_HEAD(&geni_se_dev->ssr.active_list_head);
 		geni_se_dev->ssr.probe_completed = false;
 		ret = geni_se_ssc_qup_ssr_reg(geni_se_dev);
--- a/drivers/platform/msm/sps/bam.c
+++ b/drivers/platform/msm/sps/bam.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2011-2017, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2011-2017, 2020, The Linux Foundation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 and
@@ -1388,8 +1388,13 @@ int bam_pipe_init(void *base, u32 pipe,	struct bam_pipe_parameters *param,
 		bam_write_reg_field(base, P_FIFO_SIZES, pipe,
 				    P_DATA_FIFO_SIZE, param->data_size);

-		bam_write_reg(base, P_EVNT_DEST_ADDR, pipe, peer_dest_addr);
-
+		if (!(param->dummy_peer)) {
+			bam_write_reg(base, P_EVNT_DEST_ADDR, pipe,
+						peer_dest_addr);
+		} else {
+			bam_write_reg(base, P_EVNT_DEST_ADDR, pipe,
+						param->peer_phys_addr);
+		}
 		SPS_DBG2(dev,
 			"sps:bam=0x%pK(va).pipe=%d.peer_bam=0x%x.peer_pipe=%d.\n",
 			dev->base, pipe,
--- a/drivers/platform/msm/sps/bam.h
+++ b/drivers/platform/msm/sps/bam.h
@@ -1,4 +1,4 @@
-/* Copyright (c) 2011-2017, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2011-2017, 2020, The Linux Foundation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 and
@@ -83,6 +83,7 @@ struct bam_pipe_parameters {
 	u32 peer_pipe;
 	phys_addr_t data_base;	/* Physical address of data FIFO */
 	u32 data_size;	/* Size (bytes) of data FIFO */
+	bool dummy_peer;
 };

 /**
--- a/drivers/platform/msm/sps/sps_bam.c
+++ b/drivers/platform/msm/sps/sps_bam.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2011-2017, 2019, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2011-2017, 2019-2020, The Linux Foundation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 and
@@ -875,13 +875,15 @@ int sps_bam_pipe_connect(struct sps_pipe *bam_pipe,
 	}

 	/* Determine operational mode */
-	if (other_pipe->bam != NULL) {
+	if ((bam_pipe->connect.options & SPS_O_DUMMY_PEER) ||
+						other_pipe->bam != NULL) {
 		unsigned long iova;
-		struct sps_bam *peer_bam = (struct sps_bam *)(other_pipe->bam);
+		struct sps_bam *peer_bam;
 		/* BAM-to-BAM mode */
 		bam_pipe->state |= BAM_STATE_BAM2BAM;
 		hw_params.mode = BAM_PIPE_MODE_BAM2BAM;
-
+		if (!(bam_pipe->connect.options & SPS_O_DUMMY_PEER))
+			peer_bam = (struct sps_bam *)(other_pipe->bam);
 		if (dev->props.options & SPS_BAM_SMMU_EN) {
 			if (bam_pipe->mode == SPS_MODE_SRC)
 				iova = bam_pipe->connect.dest_iova;
@@ -892,11 +894,21 @@ int sps_bam_pipe_connect(struct sps_pipe *bam_pipe,
 				 BAM_ID(dev), pipe_index, (void *)iova);
 			hw_params.peer_phys_addr = (u32)iova;
 		} else {
-			hw_params.peer_phys_addr = peer_bam->props.phys_addr;
+			if (!(bam_pipe->connect.options & SPS_O_DUMMY_PEER))
+				hw_params.peer_phys_addr =
+					peer_bam->props.phys_addr;
+		}
+		if (!(bam_pipe->connect.options & SPS_O_DUMMY_PEER)) {
+			hw_params.peer_phys_addr =
+				bam_pipe->connect.destination;
+			hw_params.peer_pipe =
+				bam_pipe->connect.dest_pipe_index;
+		} else {
+			hw_params.peer_phys_addr =
+					bam_pipe->connect.destination;
+			hw_params.peer_pipe = other_pipe->pipe_index;
+			hw_params.dummy_peer = true;
 		}
-
-		hw_params.peer_pipe = other_pipe->pipe_index;
-
 		/* Verify FIFO buffers are allocated for BAM-to-BAM pipes */
 		if (map->desc.phys_base == SPS_ADDR_INVALID ||
 		    map->data.phys_base == SPS_ADDR_INVALID ||
--- a/drivers/platform/msm/sps/sps_rm.c
+++ b/drivers/platform/msm/sps/sps_rm.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2011-2015, 2017-2019, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2011-2015, 2017-2020, The Linux Foundation. All rights reserved.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 and
@@ -402,16 +402,20 @@ static struct sps_connection *sps_rm_create(struct sps_pipe *pipe)
 					(void *)(&map->src.dev));
 			goto exit_err;
 		}
-		map->src.pipe_index = SPS_BAM_PIPE_INVALID;
+	map->src.pipe_index = SPS_BAM_PIPE_INVALID;
 	}
-	map->dest.bam = sps_h2bam(map->dest.dev);
-	if (map->dest.bam == NULL) {
-		if (map->dest.dev != SPS_DEV_HANDLE_MEM) {
-			SPS_ERR(sps, "sps:Invalid BAM handle: %pK",
-					(void *)(&map->dest.dev));
-			goto exit_err;
-		}
+
+	if (!(pipe->connect.options & SPS_O_DUMMY_PEER)) {
+		map->dest.bam = sps_h2bam(map->dest.dev);
+		if (map->dest.bam == NULL) {
+			if (map->dest.dev != SPS_DEV_HANDLE_MEM) {
+				SPS_ERR(sps,
+				"sps:Invalid BAM handle: %pK",
+				(void *)(&map->dest.dev));
+				goto exit_err;
+			}
 		map->dest.pipe_index = SPS_BAM_PIPE_INVALID;
+		}
 	}

 	/* Check the BAM device for the pipe */
@@ -504,7 +508,8 @@ static struct sps_connection *sps_rm_create(struct sps_pipe *pipe)
 		if (map->data.size == SPSRM_CLEAR)
 			map->data.size = data_size;
 	} else {
-		map->data.size = 0;
+		if (!(pipe->connect.options & SPS_O_DUMMY_PEER))
+			map->data.size = 0;
 	}
 	if (map->desc.size > SPSRM_MAX_DESC_FIFO_SIZE) {
 		SPS_ERR(sps, "sps:Invalid desc FIFO size: 0x%x",
--- a/drivers/rpmsg/qcom_smd.c
+++ b/drivers/rpmsg/qcom_smd.c
@@ -289,7 +289,9 @@ struct smd_channel_info_word_pair {
 		(GET_RX_CHANNEL_FLAG(channel, fDSR) ? TIOCM_DSR : 0) |	      \
 		(GET_RX_CHANNEL_FLAG(channel, fCTS) ? TIOCM_CTS : 0) |	      \
 		(GET_RX_CHANNEL_FLAG(channel, fCD) ? TIOCM_CD : 0) |	      \
-		(GET_RX_CHANNEL_FLAG(channel, fRI) ? TIOCM_RI : 0);	      \
+		(GET_RX_CHANNEL_FLAG(channel, fRI) ? TIOCM_RI : 0) |	      \
+		(GET_TX_CHANNEL_FLAG(channel, fDSR) ? TIOCM_DTR : 0) |        \
+		(GET_TX_CHANNEL_FLAG(channel, fCTS) ? TIOCM_RTS : 0);         \
 	})

 #define SET_RX_CHANNEL_FLAG(channel, param, value)			     \
--- a/drivers/soc/qcom/dcc_v2.c
+++ b/drivers/soc/qcom/dcc_v2.c
@@ -114,6 +114,22 @@ struct rpm_trig_req {
 	uint32_t    reserved;
 };

+/**
+ * struct dcc_save_state - state to be preserved when dcc is without power
+ */
+struct dcc_save_state {
+	uint32_t	dcc_exec_ctrl;
+	uint32_t	dcc_cfg;
+	uint32_t	dcc_ll_lock[DCC_MAX_LINK_LIST];
+	uint32_t	dcc_ll_cfg[DCC_MAX_LINK_LIST];
+	uint32_t	dcc_ll_base[DCC_MAX_LINK_LIST];
+	uint32_t	dcc_fd_base[DCC_MAX_LINK_LIST];
+	uint32_t	dcc_ll_timeout[DCC_MAX_LINK_LIST];
+	uint32_t	dcc_ll_int_enable[DCC_MAX_LINK_LIST];
+	uint32_t	dcc_ll_int_status[DCC_MAX_LINK_LIST];
+	uint32_t	dcc_ll_sw_trigger[DCC_MAX_LINK_LIST];
+};
+
 struct dcc_config_entry {
 	uint32_t			base;
 	uint32_t			offset;
@@ -150,6 +166,8 @@ struct dcc_drvdata {
 	uint8_t			curr_list;
 	uint8_t			cti_trig;
 	uint8_t			loopoff;
+	struct dcc_save_state	*reg_save_state;
+	void                    *sram_save_state;
 };

 static int dcc_sram_writel(struct dcc_drvdata *drvdata,
@@ -1843,6 +1861,136 @@ static int dcc_remove(struct platform_device *pdev)
 	return 0;
 }

+static int dcc_v2_freeze(struct device *dev)
+{
+	int i;
+	struct dcc_save_state *state;
+	struct dcc_drvdata *drvdata = dev_get_drvdata(dev);
+
+	if (!drvdata)
+		return -EINVAL;
+
+	drvdata->reg_save_state = kmalloc(sizeof(struct dcc_save_state),
+								GFP_KERNEL);
+	if (!drvdata->reg_save_state)
+		return -ENOMEM;
+
+	state = drvdata->reg_save_state;
+
+	mutex_lock(&drvdata->mutex);
+
+	state->dcc_exec_ctrl = dcc_readl(drvdata, DCC_EXEC_CTRL);
+	state->dcc_cfg = dcc_readl(drvdata, DCC_CFG);
+
+	for (i = 0; i < DCC_MAX_LINK_LIST; i++) {
+		state->dcc_ll_lock[i] = dcc_readl(drvdata,
+						DCC_LL_LOCK(i));
+		state->dcc_ll_cfg[i] = dcc_readl(drvdata,
+						DCC_LL_CFG(i));
+		state->dcc_ll_base[i] = dcc_readl(drvdata,
+						DCC_LL_BASE(i));
+		state->dcc_fd_base[i] = dcc_readl(drvdata,
+						DCC_FD_BASE(i));
+		state->dcc_ll_timeout[i] = dcc_readl(drvdata,
+						DCC_LL_TIMEOUT(i));
+		state->dcc_ll_int_enable[i] = dcc_readl(drvdata,
+						DCC_LL_INT_ENABLE(i));
+		state->dcc_ll_int_status[i] = dcc_readl(drvdata,
+						DCC_LL_INT_STATUS(i));
+	}
+
+	mutex_unlock(&drvdata->mutex);
+
+	drvdata->sram_save_state = kmalloc(drvdata->ram_size, GFP_KERNEL);
+	if (!drvdata->sram_save_state)
+		return -ENOMEM;
+
+	if (dcc_sram_memcpy(drvdata->sram_save_state, drvdata->ram_base,
+						drvdata->ram_size)) {
+		dev_info(dev, "Failed to copy DCC SRAM contents\n");
+	}
+
+	if (drvdata->enable[drvdata->curr_list])
+		drvdata->enable[drvdata->curr_list] = 0;
+
+	return 0;
+}
+
+static int dcc_v2_restore(struct device *dev)
+{
+	int i;
+	int *data;
+	struct dcc_save_state *state;
+	struct dcc_drvdata *drvdata = dev_get_drvdata(dev);
+
+	if (!drvdata && !drvdata->sram_save_state && !drvdata->reg_save_state)
+		return -EINVAL;
+
+	data = drvdata->sram_save_state;
+
+	for (i = 0; i < drvdata->ram_size / 4; i++)
+		__raw_writel(data[i],
+			drvdata->ram_base + (i * 4));
+
+	state = drvdata->reg_save_state;
+
+	mutex_lock(&drvdata->mutex);
+
+	dcc_writel(drvdata, state->dcc_exec_ctrl, DCC_EXEC_CTRL);
+	dcc_writel(drvdata, state->dcc_cfg, DCC_CFG);
+
+	for (i = 0; i < DCC_MAX_LINK_LIST; i++) {
+
+		if (dcc_valid_list(drvdata, i))
+			continue;
+
+		dcc_writel(drvdata, BIT(0), DCC_LL_LOCK(i));
+		dcc_writel(drvdata, state->dcc_ll_base[i], DCC_LL_BASE(i));
+		dcc_writel(drvdata, state->dcc_fd_base[i], DCC_FD_BASE(i));
+		dcc_writel(drvdata, state->dcc_ll_timeout[i],
+							DCC_LL_TIMEOUT(i));
+		dcc_writel(drvdata, state->dcc_ll_int_enable[i],
+							DCC_LL_INT_ENABLE(i));
+		dcc_writel(drvdata, state->dcc_ll_int_status[i],
+						DCC_LL_INT_STATUS(i));
+		/* Make sure all config is written in sram */
+		mb();
+		dcc_writel(drvdata, state->dcc_ll_cfg[i], DCC_LL_CFG(i));
+	}
+
+	mutex_unlock(&drvdata->mutex);
+
+	if (drvdata->enable[drvdata->curr_list])
+		drvdata->enable[drvdata->curr_list] = 1;
+
+	kfree(drvdata->sram_save_state);
+	kfree(drvdata->reg_save_state);
+
+	return 0;
+}
+
+static int dcc_v2_thaw(struct device *dev)
+{
+	struct dcc_drvdata *drvdata = dev_get_drvdata(dev);
+
+	if (!drvdata)
+		return -EINVAL;
+
+	if (drvdata->enable[drvdata->curr_list])
+		drvdata->enable[drvdata->curr_list] = 1;
+
+	kfree(drvdata->sram_save_state);
+	kfree(drvdata->reg_save_state);
+
+	return 0;
+}
+
+static const struct dev_pm_ops dcc_v2_pm_ops = {
+	.freeze		= dcc_v2_freeze,
+	.restore	= dcc_v2_restore,
+	.thaw		= dcc_v2_thaw,
+};
+
 static const struct of_device_id msm_dcc_match[] = {
 	{ .compatible = "qcom,dcc-v2"},
 	{}
@@ -1854,6 +2002,7 @@ static struct platform_driver dcc_driver = {
 	.driver         = {
 		.name   = "msm-dcc",
 		.owner	= THIS_MODULE,
+		.pm     = &dcc_v2_pm_ops,
 		.of_match_table	= msm_dcc_match,
 	},
 };
--- a/drivers/soc/qcom/icnss.c
+++ b/drivers/soc/qcom/icnss.c
@@ -2147,8 +2147,8 @@ int icnss_unregister_driver(struct icnss_driver_ops *ops)

 	icnss_pr_dbg("Unregistering driver, state: 0x%lx\n", penv->state);

-	if (!penv->ops) {
-		icnss_pr_err("Driver not registered\n");
+	if (!penv->ops || (!test_bit(ICNSS_DRIVER_PROBED, &penv->state))) {
+		icnss_pr_err("Driver not registered/probed\n");
 		ret = -ENOENT;
 		goto out;
 	}
--- a/drivers/spi/spi-geni-qcom.c
+++ b/drivers/spi/spi-geni-qcom.c
@@ -924,16 +924,24 @@ static int spi_geni_prepare_transfer_hardware(struct spi_master *spi)
 		/* Transmit an entire FIFO worth of data per IRQ */
 		mas->tx_wm = 1;

-		mas->tx = dma_request_slave_channel(mas->dev, "tx");
-		if (IS_ERR_OR_NULL(mas->tx)) {
-			dev_info(mas->dev, "Failed to get tx DMA ch %ld",
+
+		mas->shared_se =
+			(geni_read_reg(mas->base, GENI_IF_FIFO_DISABLE_RO) &
+							FIFO_IF_DISABLE);
+		if (mas->shared_se) {
+			mas->tx = dma_request_slave_channel(mas->dev, "tx");
+			if (IS_ERR_OR_NULL(mas->tx)) {
+				dev_info(mas->dev,
+					"Failed to get tx DMA ch %ld",
 							PTR_ERR(mas->tx));
-		} else {
+				goto setup_ipc;
+			}
 			mas->rx = dma_request_slave_channel(mas->dev, "rx");
 			if (IS_ERR_OR_NULL(mas->rx)) {
 				dev_info(mas->dev, "Failed to get rx DMA ch %ld",
 							PTR_ERR(mas->rx));
 				dma_release_channel(mas->tx);
+				goto setup_ipc;
 			}
 			mas->gsi = devm_kzalloc(mas->dev,
 				(sizeof(struct spi_geni_gsi) * NUM_SPI_XFER),
@@ -992,9 +1000,6 @@ setup_ipc:
 				"%s:Major:%d Minor:%d step:%dos%d\n",
 			__func__, major, minor, step, mas->oversampling);
 		}
-		mas->shared_se =
-			(geni_read_reg(mas->base, GENI_IF_FIFO_DISABLE_RO) &
-							FIFO_IF_DISABLE);
 		if (mas->dis_autosuspend)
 			GENI_SE_DBG(mas->ipc, false, mas->dev,
 					"Auto Suspend is disabled\n");
@@ -1204,12 +1209,30 @@ static void handle_fifo_timeout(struct spi_geni_master *mas,
 				"Failed to cancel/abort m_cmd\n");
 	}
 	if (mas->cur_xfer_mode == SE_DMA) {
-		if (xfer->tx_buf)
+		if (xfer->tx_buf) {
+			reinit_completion(&mas->xfer_done);
+			writel_relaxed(1, mas->base +
+				SE_DMA_TX_FSM_RST);
+			timeout =
+			wait_for_completion_timeout(&mas->xfer_done, HZ);
+			if (!timeout)
+				dev_err(mas->dev,
+					"DMA TX RESET failed\n");
 			geni_se_tx_dma_unprep(mas->wrapper_dev,
-					xfer->tx_dma, xfer->len);
-		if (xfer->rx_buf)
+				xfer->tx_dma, xfer->len);
+		}
+		if (xfer->rx_buf) {
+			reinit_completion(&mas->xfer_done);
+			writel_relaxed(1, mas->base +
+				SE_DMA_RX_FSM_RST);
+			timeout =
+			wait_for_completion_timeout(&mas->xfer_done, HZ);
+			if (!timeout)
+				dev_err(mas->dev,
+					"DMA RX RESET failed\n");
 			geni_se_rx_dma_unprep(mas->wrapper_dev,
-					xfer->rx_dma, xfer->len);
+				xfer->rx_dma, xfer->len);
+		}
 	}

 }
@@ -1233,6 +1256,12 @@ static int spi_geni_transfer_one(struct spi_master *spi,
 		return -EINVAL;
 	}

+	/* Check for zero length transfer */
+	if (xfer->len < 1) {
+		dev_err(mas->dev, "Zero length transfer\n");
+		return -EINVAL;
+	}
+
 	if (mas->cur_xfer_mode != GSI_DMA) {
 		reinit_completion(&mas->xfer_done);
 		setup_fifo_xfer(xfer, mas, slv->mode, spi);
--- a/drivers/staging/android/ion/ion.c
+++ b/drivers/staging/android/ion/ion.c
@@ -1130,6 +1130,7 @@ struct dma_buf *ion_alloc(size_t len, unsigned int heap_id_mask,
 		if (!((1 << heap->id) & heap_id_mask))
 			continue;
 		if (heap->type == ION_HEAP_TYPE_SYSTEM ||
+		    heap->type == ION_HEAP_TYPE_CARVEOUT ||
 		    heap->type == (enum ion_heap_type)ION_HEAP_TYPE_HYP_CMA ||
 		    heap->type ==
 			(enum ion_heap_type)ION_HEAP_TYPE_SYSTEM_SECURE) {
--- a/drivers/staging/fw-api/fw/htt_ppdu_stats.h
+++ b/drivers/staging/fw-api/fw/htt_ppdu_stats.h
@@ -714,13 +714,22 @@ typedef struct {
     *               of the BSS and is used to assist a receiving STA in
     *               identifying the BSS from which a PPDU originates.
     *               Value in the range 0 to 63
-     * BIT [31 : 6] -reserved
+     * BIT [6 : 6] - PPDU transmitted using Non-SRG opportunity
+     * BIT [7 : 7] - PPDU transmitted using SRG opportunity
+     * BIT [15: 8] - RSSI of the aborted OBSS frame (in dB w.r.t. noise floor)
+     *               by which SRG/Non-SRG based spatial reuse opportunity
+     *               was created.
+     * BIT [31:16] - reserved
     */
    union {
+        A_UINT32 reserved__aborted_obss_rssi__srg_tx__non_srg_tx___bss_color_id;
        A_UINT32 reserved__bss_color_id;
        struct {
-            A_UINT32 bss_color_id:   6,
-                     reserved2:     26;
+            A_UINT32 bss_color_id:       6,
+                     non_srg_tx:         1,
+                     srg_tx:             1,
+                     aborted_obss_rssi:  8,
+                     reserved2:         16;
        };
    };
 } htt_ppdu_stats_common_tlv;
--- a/drivers/staging/fw-api/fw/wmi_services.h
+++ b/drivers/staging/fw-api/fw/wmi_services.h
@@ -443,6 +443,7 @@ typedef  enum  {
    WMI_SERVICE_MU_PREAMBLE_PUNCTURE_SUPPORT = 248, /* Indicates FW supports MU preamble puncture */
    WMI_SERVICE_SRG_SRP_SPATIAL_REUSE_SUPPORT = 249, /* Support for SRG, SRP based spatial reuse support */
    WMI_REQUEST_CTRL_PATH_STATS_REQUEST = 250, /* FW supports control path stats */
+    WMI_SERVICE_TPC_STATS_EVENT = 251, /* FW support to dump the TPC tables */


    /******* ADD NEW SERVICES UP TO 256 HERE *******/
--- a/drivers/staging/fw-api/fw/wmi_tlv_defs.h
+++ b/drivers/staging/fw-api/fw/wmi_tlv_defs.h
@@ -199,6 +199,7 @@ typedef enum {
    WMITLV_TAG_ARRAY_BYTE,
    WMITLV_TAG_ARRAY_STRUC,
    WMITLV_TAG_ARRAY_FIXED_STRUC,
+    WMITLV_TAG_ARRAY_INT16,
    WMITLV_TAG_LAST_ARRAY_ENUM = 31,   /* Last entry of ARRAY type tags */
    WMITLV_TAG_STRUC_wmi_service_ready_event_fixed_param,
    WMITLV_TAG_STRUC_HAL_REG_CAPABILITIES,
@@ -1081,6 +1082,13 @@ typedef enum {
    WMITLV_TAG_STRUC_wmi_request_ctrl_path_stats_cmd_fixed_param,
    WMITLV_TAG_STRUC_wmi_ctrl_path_stats_event_fixed_param,
    WMITLV_TAG_STRUC_wmi_ctrl_path_pdev_stats_struct,
+    WMITLV_TAG_STRUC_wmi_pdev_get_tpc_stats_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_pdev_get_tpc_stats_event_fixed_param,
+    WMITLV_TAG_STRUC_wmi_tpc_configs,
+    WMITLV_TAG_STRUC_wmi_max_reg_power_allowed,
+    WMITLV_TAG_STRUC_wmi_tpc_rates_array,
+    WMITLV_TAG_STRUC_wmi_tpc_ctl_pwr_table,
+    WMITLV_TAG_STRUC_wmi_vdev_bcn_latency_fixed_param,
 } WMITLV_TAG_ID;

 /*
@@ -1526,6 +1534,7 @@ typedef enum {
    OP(WMI_PDEV_SET_NON_SRG_OBSS_COLOR_ENABLE_BITMAP_CMDID) \
    OP(WMI_PDEV_SET_NON_SRG_OBSS_BSSID_ENABLE_BITMAP_CMDID) \
    OP(WMI_REQUEST_CTRL_PATH_STATS_CMDID) \
+    OP(WMI_PDEV_GET_TPC_STATS_CMDID) \
    /* add new CMD_LIST elements above this line */


@@ -1777,6 +1786,8 @@ typedef enum {
    OP(WMI_PDEV_SSCAN_FW_PARAM_EVENTID) \
    OP(WMI_ROAM_CAPABILITY_REPORT_EVENTID) \
    OP(WMI_CTRL_PATH_STATS_EVENTID) \
+    OP(WMI_PDEV_GET_TPC_STATS_EVENTID) \
+    OP(WMI_VDEV_BCN_LATENCY_EVENTID) \
    /* add new EVT_LIST elements above this line */


@@ -4428,6 +4439,11 @@ WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_SET_NON_SRG_OBSS_COLOR_ENABLE_BITMAP_CMDID);
    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_non_srg_obss_bssid_enable_bitmap_cmd_fixed_param, wmi_pdev_non_srg_obss_bssid_enable_bitmap_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
 WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_SET_NON_SRG_OBSS_BSSID_ENABLE_BITMAP_CMDID);

+/* PDEV Get TPC STATS Cmd */
+#define WMITLV_TABLE_WMI_PDEV_GET_TPC_STATS_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_get_tpc_stats_cmd_fixed_param, wmi_pdev_get_tpc_stats_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_GET_TPC_STATS_CMDID);
+

 /************************** TLV definitions of WMI events *******************************/

@@ -5963,6 +5979,22 @@ WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_SSCAN_FW_PARAM_EVENTID);
    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_roam_capability_report_event_fixed_param, wmi_roam_capability_report_event_fixed_param, fixed_param, WMITLV_SIZE_FIX)
 WMITLV_CREATE_PARAM_STRUC(WMI_ROAM_CAPABILITY_REPORT_EVENTID);

+/* PDEV TPC STATS Event */
+#define WMITLV_TABLE_WMI_PDEV_GET_TPC_STATS_EVENTID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_get_tpc_stats_event_fixed_param, wmi_pdev_get_tpc_stats_event_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_tpc_configs, tpc_configs, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_max_reg_power_allowed, regulatory_power, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_INT16, A_INT16, reg_buf, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_tpc_rates_array, tpc_rates, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_INT16, A_UINT16, rates_buf, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_tpc_ctl_pwr_table, ctl_power, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_INT8, ctl_buf, WMITLV_SIZE_VAR)
+WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_GET_TPC_STATS_EVENTID);
+
+/* Send Bcn Latency ie related params to host */
+#define WMITLV_TABLE_WMI_VDEV_BCN_LATENCY_EVENTID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_vdev_bcn_latency_fixed_param, wmi_vdev_bcn_latency_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_VDEV_BCN_LATENCY_EVENTID);

 #ifdef __cplusplus
 }
--- a/drivers/staging/fw-api/fw/wmi_unified.h
+++ b/drivers/staging/fw-api/fw/wmi_unified.h
@@ -434,6 +434,8 @@ typedef enum {
    WMI_PDEV_SET_NON_SRG_OBSS_COLOR_ENABLE_BITMAP_CMDID,
    /** OBSS BSSID enable bitmap for NON_SRG based spatial reuse feature */
    WMI_PDEV_SET_NON_SRG_OBSS_BSSID_ENABLE_BITMAP_CMDID,
+    /** TPC stats display command */
+    WMI_PDEV_GET_TPC_STATS_CMDID,

    /* VDEV (virtual device) specific commands */
    /** vdev create */
@@ -1446,6 +1448,10 @@ typedef enum {
     */
    WMI_PDEV_MULTIPLE_VDEV_RESTART_RESP_EVENTID,

+    /** WMI event in response to TPC STATS command */
+    WMI_PDEV_GET_TPC_STATS_EVENTID,
+
+
    /* VDEV specific events */
    /** VDEV started event in response to VDEV_START request */
    WMI_VDEV_START_RESP_EVENTID = WMI_EVT_GRP_START_ID(WMI_GRP_VDEV),
@@ -1510,6 +1516,8 @@ typedef enum {
    WMI_VDEV_SEND_BIG_DATA_EVENTID,
    /** send BIG DATA stats to host phase 2 */
    WMI_VDEV_SEND_BIG_DATA_P2_EVENTID,
+    /** Latency related information received from beacon IE */
+    WMI_VDEV_BCN_LATENCY_EVENTID,


    /* peer specific events */
@@ -3657,6 +3665,7 @@ typedef struct {
     * (maximum number of beacons after which VAP profiles repeat)
     * for any EMA VAP on any pdev.
     */
+
    A_UINT32 ema_max_profile_period;
    /** @brief max_ndp_sessions
     * This is the max ndp sessions sent by the host which is the minimum
@@ -3665,6 +3674,12 @@ typedef struct {
     * SERVICE_READY_EXT2_EVENT message).
     */
    A_UINT32 max_ndp_sessions;
+
+    /** @brief max_ndi_supported
+     * This is the max ndi interfaces sent by the host based on the value
+     * specified by the host's ini configuration.
+     */
+    A_UINT32 max_ndi_interfaces;
 } wmi_resource_config;

 #define WMI_MSDU_FLOW_AST_ENABLE_GET(msdu_flow_config0, ast_x) \
@@ -6793,6 +6808,16 @@ typedef enum {
    /* Parameter used to enable/disable SR prohibit feature */
    WMI_PDEV_PARAM_ENABLE_SR_PROHIBIT,

+    /*
+     * Parameter used to enable/disable UL OFDMA mBSSID support for
+     * trigger frames. It is disabled by default.
+     * bit | config_mode
+     * -----------------
+     *  0  | Enable/Disable mBSSID trigger support for basic triggers.
+     *  1  | Enable/Disable mBSSID trigger support for BSR triggers.
+     */
+    WMI_PDEV_PARAM_ENABLE_MBSSID_CTRL_FRAME,
+
 } WMI_PDEV_PARAM;

 #define WMI_PDEV_ONLY_BSR_TRIG_IS_ENABLED(trig_type) WMI_GET_BITS(trig_type, 0, 1)
@@ -6930,6 +6955,151 @@ typedef struct {
    wmi_mac_addr macaddr;
 } wmi_pdev_div_get_rssi_antid_fixed_param;

+typedef enum {
+    WMI_TPC_STATS_EVENT_SEND_REG          = 0x00000001,
+    WMI_TPC_STATS_EVENT_SEND_RATE         = 0x00000002,
+    WMI_TPC_STATS_EVENT_SEND_CTL          = 0x00000004,
+    WMI_TPC_STATS_EVENT_SEND_REG_RATE_CTL = 0x00000007, /* REG | RATE | CTL */
+} WMI_PDEV_TPC_STATS_PARAMS;
+
+typedef struct {
+    A_UINT32 tlv_header; /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_get_tpc_stats_cmd_fixed_param */
+    /** pdev_id for identifying the MAC
+     * See macros starting with WMI_PDEV_ID_ for values.
+     */
+    A_UINT32 pdev_id;
+    /** parameter -
+     * This is to specify whether we want only the target power
+     * information (rates array) or the CTL power or the regulatory
+     * power information. At present, we send all of them.
+     */
+    A_UINT32 param; /* Currently expect WMI_TPC_STATS_EVENT_SEND_REG_RATE_CTL
+                     * as a host specification that rates array, regulatory
+                     * power array, and ctl power array are all to be sent.
+                     * See WMI_PDEV_TPC_STATS_PARAMS.
+                     */
+} wmi_pdev_get_tpc_stats_cmd_fixed_param;
+
+typedef struct {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_get_tpc_stats_event_fixed_param */
+    A_UINT32 pdev_id; /* pdev_id for identifying the MAC. See macros starting with WMI_PDEV_ID_ for values */
+    A_UINT32 end_of_event; /* The total response to the WMI command will be split into multiple event chunks to fit into the WMI svc msg size limit: 0 indicates more events to follow: 1 indicates end of event  */
+    A_UINT32 event_count; /* Incremented for every event chunk for Host to know the sequence */
+    /* wmi_tpc_configs TLV to optionally follow */
+    /* wmi_max_reg_power_allowed TLVs to optionally follow */
+    /* wmi_tpc_rates_array TLVs to optionally follow */
+    /* wmi_tpc_ctl_pwr_table TLVs to optionally follow */
+} wmi_pdev_get_tpc_stats_event_fixed_param;
+
+typedef struct {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_tpc_configs */
+    A_UINT32 regDomain;
+    A_UINT32 chanFreq; /* current channel in MHz */
+    A_UINT32 phyMode;  /* current phy mode - See WLAN_PHY_MODE for the different phy modes */
+    A_UINT32 maxAntennaGain; /* Maximum antenna gain for the current regulatory in 0.25 dBm steps */
+    A_UINT32 twiceMaxRDPower; /* Maximum transmit power allowed in the regulatory domain in 0.25 dBm steps */
+    A_INT32 userAntennaGain; /* User specified antenna gain in 0.25 dBm steps */
+    A_UINT32 powerLimit; /* The overall power limit in 0.25 dBm steps */
+    A_UINT32 rateMax; /* The total number of rates supported */
+    A_UINT32 numTxChain; /* The total number of active chains */
+    A_UINT32 ctl; /* See CONFORMANCE_TEST_LIMITS enumeration */
+    A_UINT32 flags; /* See WMI_TPC_CONFIG_EVENT_FLAG */
+} wmi_tpc_configs;
+
+typedef struct {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_max_reg_power_allowed */
+    A_UINT32 reg_power_type; /* 0: maxRegAllowedPower (1D array),
+                              * 1: maxRegAllowedPowerAGCDD (2D array),
+                              * 2: maxRegAllowedPowerAGSTBC (2D array),
+                              * 3: maxRegAllowedPowerAGTXBF (2D array)
+                              */
+    A_UINT32 reg_power_array_len; /* Length of the regulatory power array being sent in bytes */
+    A_UINT32 d1;  /* the length of 1st (innermost) dimension array */
+    A_UINT32 d2;  /* the length of 2nd dimension array */
+    A_UINT32 d3;  /* the length of 3rd dimension array (for future use) */
+    A_UINT32 d4;  /* the length of 4th dimension array (for future use) */
+    /*
+     * This TLV is followed by an A_INT16 TLV-array that will carry
+     * one of the four types of regulatory power arrays.
+     *
+     * The multi-dimensional regulatory power array will be communicated
+     * as a flat array: Host to stitch it back as 2D array.
+     * For an array[a][b][c][d], d1 = d, d2 = c, d3 = b, d4 = a
+     * For a 2D array, array[a][b], d1 = b, d2 = a, d3 = 1, d4 = 1
+     * The possible types of following A_INT16 TLV arrays are
+     * 1. A_INT16  maxRegAllowedPower[WHAL_TPC_TX_NUM_CHAIN];
+     * 2. A_INT16  maxRegAllowedPowerAGCDD[WHAL_TPC_TX_NUM_CHAIN - 1][WHAL_TPC_TX_NUM_CHAIN - 1];
+     * 3. A_INT16  maxRegAllowedPowerAGSTBC[WHAL_TPC_TX_NUM_CHAIN - 1][WHAL_TPC_TX_NUM_CHAIN - 1];
+     * 4. A_INT16  maxRegAllowedPowerAGTXBF[WHAL_TPC_TX_NUM_CHAIN - 1][WHAL_TPC_TX_NUM_CHAIN - 1];
+     * where WHAL_TPC_TX_NUM_CHAIN=2 for CYP and 8 for HK.
+     */
+} wmi_max_reg_power_allowed;
+
+typedef struct {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_tpc_rates_array */
+    A_UINT32 rate_array_type; /* 0: ratesArray,
+                               * 1: ratesArray2 (for chain > 4),
+                               * 2: dl_ofdma rate array
+                               */
+    A_UINT32 rate_array_len;
+    /* This TLV will be followed by an A_UINT16 TLV array that will
+     * carry one of the types of TPC rate arrays.
+     * All the rates arrays are 1D arrays.
+     * The possible types of following A_UINT16 TLV arrays are
+     * 1. A_UINT16 ratesArray[WHAL_TPC_RATE_MAX];
+     *    This array has to be referred when number of active chains is < 4
+     * 2. A_UINT16 ratesArray2[WHAL_TPC_RATE_MAX];
+     *    This array has to be referred when number of active chains is > 4
+     * 3. A_UINT16 ratesArray_DL_OFDMA[72];
+     * WHAL_TPC_RATE_MAX is 748 for HK (considering PHY A0 8x8)
+     * WHAL_TPC_RATE_MAX is 188 for CYP (considering PHY A0 2x2)
+     * Each 16 bit value in the rates array carries both SU and MU
+     * target power information.
+     * Bits 0:7 contained the SU target power (signed value, 0.25 dBm units),
+     * bits 8:15 denote the MU target power (signed value, 0.25 dBm units).
+     */
+} wmi_tpc_rates_array;
+
+typedef struct {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_tpc_ctl_pwr_table */
+    A_UINT32 ctl_array_type; /* 0: ctl_array,
+                              * 1: ctl_160 array,
+                              * 2: ctl_dlOfdma array,
+                              * 3: ctl_ulOfdma array
+                              */
+    A_UINT32 ctl_array_len; /* Length of the CTL array being sent in bytes */
+    A_UINT32 end_of_ctl_pwr; /* Message MAY be split into smaller chunks
+                              * to fit in the WMI svc msg size limit:
+                              * 0 indicates more chunks of CTL info to follow,
+                              * 1 indicates end of CTL info.
+                              */
+    A_UINT32 ctl_pwr_count; /* Incremented for every CTL info chunk
+                             * for Host to know the sequence.
+                             */
+    A_UINT32 d1;  /* the length of 1st (innermost) dimension array */
+    A_UINT32 d2;  /* the length of 2nd dimension array */
+    A_UINT32 d3;  /* the length of 3rd dimension array */
+    A_UINT32 d4;  /* the length of 4th dimension array */
+    /* This TLV will be followed by an A_INT8 TLV-array that will
+     * carry one the types of CTL power arrays.
+     * The CTL array will be multi-dimensional, but will be communicated as
+     * a flat array; the host has to stitch it back into a 4D array.
+     * The possible types of following A_INT8 arrays are
+     * 1. A_INT8 ctlEdgePwrBF[WHAL_MAX_NUM_CHAINS][2][10][8];
+     * 2. A_INT8 ctlEdgePwr160[WHAL_MAX_NUM_CHAINS/2][2][2][4];
+     * 3. A_INT8 ctlEdgePwrBF_dlOFDMA[WHAL_MAX_NUM_CHAINS][2][3][8];
+     * For e.g., in ctlEdgePwrBF
+     * D4 = WHAL_MAX_NUM_CHAINS = 8 for HK, 2 for CYP, 4 for Pine
+     * D3 = BF on/off = 2
+     * D2 = 10 which the number of different tx modes,
+     *      like cck, legacy, HT20, HT40, VHT80, etc.
+     * D1 = NSS = 8, number of spatial streams
+     * Total number of elements = D4*D3*D2*D1
+     * The same will apply for ctl_dlOfdma array, except that the values
+     * of d1,d2,d3,d4 will be different.
+     */
+} wmi_tpc_ctl_pwr_table;
+
 typedef struct {
    A_UINT32 tlv_header; /* WMITLV_TAG_STRUC_wmi_pdev_bss_chan_info_request_fixed_param */
    A_UINT32 param;   /* 1 = read only, 2= read and clear */
@@ -14340,6 +14510,20 @@ typedef enum
    (((roam_reason) & WMI_ROAM_REQUEST_HOST_HW_MODE_CHANGE_MASK) >> \
     WMI_ROAM_REQUEST_HOST_HW_MODE_CHANGE_SHIFT)

+/* Bits  0-3: stores 4 LSbs of trigger reason.
+ *            Old host will get trigger reasons <= 15 from this bitfield.
+ * Bit 7 will be 1 always to indicate that bits 8-15 are valid.
+ * Bits 8-15: full trigger_reason, including values > 15.
+ *            New host will gett full trigger_reason from this bitfield.
+ *            Bits 8-11 and bits 0-3 store matching values.
+ */
+#define WMI_SET_ROAM_EXT_TRIGGER_REASON(roam_reason, trigger_reason) \
+    do { \
+        (roam_reason) |= (trigger_reason & 0xf); \
+        (roam_reason) |= 0x80; \
+        (roam_reason) |= ((trigger_reason & 0xff) << 8); \
+    } while (0)
+
 /* roaming notification */
 #define WMI_ROAM_NOTIF_INVALID           0x0 /** invalid notification. Do not interpret notif field  */
 #define WMI_ROAM_NOTIF_ROAM_START        0x1 /** indicate that roaming is started. sent only in non WOW state */
@@ -19927,10 +20111,13 @@ typedef struct {
    /** auth_status: connected or authorized */
    A_UINT32 auth_status;
    /** roam_reason:
-     * bits 0-3 for roam reason   see WMI_ROAM_REASON_XXX
-     * bits 4-5 for subnet status see WMI_ROAM_SUBNET_CHANGE_STATUS_XXX.
-     * bit  6   for HW mode status, set 1 to indicate host to schedule
-     *          HW mode change, see WMI_ROAM_REQUEST_HOST_HW_MODE_CHANGE.
+     * bits 0-3  roam trigger reason LSbs - see WMI_ROAM_TRIGGER_REASON_XXX
+     * bits 4-5  subnet status - see WMI_ROAM_SUBNET_CHANGE_STATUS_XXX.
+     * bit  6    HW mode status, set 1 to indicate host to schedule
+     *           HW mode change, see WMI_ROAM_REQUEST_HOST_HW_MODE_CHANGE.
+     * bit  7    0x1 to show bits 8-15 are valid
+     * bits 8-15 full WMI_ROAM_TRIGGER_REASON_ID/WMI_ROAM_TRIGGER_EXT_REASON_ID
+     *           since 4 bits are not enough.
     */
    A_UINT32 roam_reason;
    /** associated AP's rssi calculated by FW when reason code is WMI_ROAM_REASON_LOW_RSSI. not valid if roam_reason is BMISS */
@@ -21434,6 +21621,29 @@ typedef struct  {
    A_UINT32 bss_color_bitmap_bit32to63;    /* Bit set indicating BSS color present */
 } wmi_obss_color_collision_evt_fixed_param;

+/*
+ * WMI event to notify host if latency_flags/latency_level got changed
+ * or if latency got enabled/disabled.
+ * When latency disable is received in the beacon vendor IE and wlm
+ * parameters are restored, latency_enable will be zero.
+ * latency level and latency flags will be those of wlm params.
+ * Lay out of latency flags is as follows. The field is same as flags
+ * in wmi_wlm_config_cmd_fixed_param.
+ *
+ * |31 19|  18 | 17|16 14| 13 | 12| 11 | 10 |  9  |  8 |7  6|5  4|3  2| 1 | 0 |
+ * +-----+-----+---+-----+----+---+----+----+-----+----+----+----+----+---+---+
+ * | RSVD|SRATE|RTS| NSS |EDCA|TRY|SSLP|CSLP|DBMPS|RSVD|Roam|RSVD|DWLT|DFS|SUP|
+ * +------------------------------+---------------+---------+-----------------+
+ * |              WAL             |    PS         |  Roam   |     Scan        |
+ */
+typedef struct  {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_vdev_bcn_latency_fixed_param */
+    A_UINT32 vdev_id;
+    A_UINT32 latency_enable;
+    A_UINT32 latency_level;
+    A_UINT32 latency_flags;
+} wmi_vdev_bcn_latency_fixed_param;
+
 /**
 * OCB DCC types and structures.
 */
@@ -26314,6 +26524,7 @@ static INLINE A_UINT8 *wmi_id_to_name(A_UINT32 wmi_command)
        WMI_RETURN_STRING(WMI_SIMULATION_TEST_CMDID);
        WMI_RETURN_STRING(WMI_AUDIO_AGGR_SET_RTSCTS_CONFIG_CMDID);
        WMI_RETURN_STRING(WMI_REQUEST_CTRL_PATH_STATS_CMDID);
+        WMI_RETURN_STRING(WMI_PDEV_GET_TPC_STATS_CMDID);
    }

    return "Invalid WMI cmd";
--- a/drivers/staging/fw-api/fw/wmi_version.h
+++ b/drivers/staging/fw-api/fw/wmi_version.h
@@ -36,7 +36,7 @@
 #define __WMI_VER_MINOR_    0
 /** WMI revision number has to be incremented when there is a
 *  change that may or may not break compatibility. */
-#define __WMI_REVISION_ 843
+#define __WMI_REVISION_ 848

 /** The Version Namespace should not be normally changed. Only
 *  host and firmware of the same WMI namespace will work
--- a/drivers/staging/fw-api/hw/qca5018/HALcomdef.h
+++ b/drivers/staging/fw-api/hw/qca5018/HALcomdef.h
@@ -0,0 +1,131 @@
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef HAL_COMDEF_H
+#define HAL_COMDEF_H
+/*
+==============================================================================
+
+FILE:         HALcomdef.h
+
+DESCRIPTION:
+
+==============================================================================
+
+                             Edit History
+
+$Header: //depot/prj/qca/lithium3/wcss/maple_verif/native/register/include/HALcomdef.h#1 $
+
+when       who     what, where, why
+--------   ---     -----------------------------------------------------------
+06/17/10   sc      Included com_dtypes.h and cleaned up typedefs
+05/15/08   gfr     Added HAL_ENUM_32BITS macro.
+02/14/08   gfr     Added bool32 type.
+11/13/07   gfr     Removed dependency on comdef.h
+01/08/07   hxw     Created
+
+==============================================================================
+*/
+
+
+/*
+ * Assembly wrapper
+ */
+#ifndef _ARM_ASM_
+
+/*
+ * C++ wrapper
+ */
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include "com_dtypes.h"
+
+/* -----------------------------------------------------------------------
+** Types
+** ----------------------------------------------------------------------- */
+
+/*
+ * Standard integer types.
+ *
+ * bool32  - boolean, 32 bit (TRUE or FALSE)
+ */
+#ifndef _BOOL32_DEFINED
+typedef  unsigned long int  bool32;
+#define _BOOL32_DEFINED
+#endif
+
+/*
+ * Macro to allow forcing an enum to 32 bits.  The argument should be
+ * an identifier in the namespace of the enumeration in question, i.e.
+ * for the clk HAL we might use HAL_ENUM_32BITS(CLK_xxx).
+ */
+#define HAL_ENUM_32BITS(x) HAL_##x##_FORCE32BITS = 0x7FFFFFFF
+
+/*===========================================================================
+
+FUNCTION inp, outp, inpw, outpw, inpdw, outpdw
+
+DESCRIPTION
+  IN/OUT port macros for byte and word ports, typically inlined by compilers
+  which support these routines
+
+PARAMETERS
+  inp(   xx_addr )
+  inpw(  xx_addr )
+  inpdw( xx_addr )
+  outp(   xx_addr, xx_byte_val  )
+  outpw(  xx_addr, xx_word_val  )
+  outpdw( xx_addr, xx_dword_val )
+      xx_addr      - Address of port to read or write (may be memory mapped)
+      xx_byte_val  - 8 bit value to write
+      xx_word_val  - 16 bit value to write
+      xx_dword_val - 32 bit value to write
+
+DEPENDENCIES
+  None
+
+RETURN VALUE
+  inp/inpw/inpdw: the byte, word or dword read from the given address
+  outp/outpw/outpdw: the byte, word or dword written to the given address
+
+SIDE EFFECTS
+  None.
+
+===========================================================================*/
+
+  /* ARM based targets use memory mapped i/o, so the inp/outp calls are
+  ** macroized to access memory directly
+  */
+
+#if defined(VV_FEATURE_COMPILING_64BIT)
+  #define inp(port)         (*((volatile dword *) (port)))
+  #define inpw(port)        (*((volatile word *) (port)))
+  #define inpdw(port)       (*((volatile dword *)(port)))
+
+  #define outp(port, val)   (*((volatile dword *) (port)) = ((dword) (val)))
+  #define outpw(port, val)  (*((volatile word *) (port)) = ((word) (val)))
+  #define outpdw(port, val) (*((volatile dword *) (port)) = ((dword) (val)))
+#endif
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* !_ARM_ASM_ */
+
+#endif /* HAL_COMDEF_H */
+
--- a/drivers/staging/fw-api/hw/qca5018/HALhwio.h
+++ b/drivers/staging/fw-api/hw/qca5018/HALhwio.h
@@ -0,0 +1,490 @@
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef HAL_HWIO_H
+#define HAL_HWIO_H
+/*
+===========================================================================
+*/
+/**
+  @file HALhwio.h 
+  
+  Public interface include file for accessing the HWIO HAL definitions.
+  
+  The HALhwio.h file is the public API interface to the HW I/O (HWIO)
+  register access definitions.
+*/
+
+/*=========================================================================
+      Include Files
+==========================================================================*/
+
+
+/*
+ * Common types.
+ */
+#include "HALcomdef.h"
+
+
+
+/* -----------------------------------------------------------------------
+** Macros
+** ----------------------------------------------------------------------- */
+
+#define SEQ_WCSS_WCMN_OFFSET     SEQ_WCSS_TOP_CMN_OFFSET
+#define SEQ_WCSS_PMM_OFFSET      SEQ_WCSS_PMM_TOP_OFFSET
+/** 
+  @addtogroup macros
+  @{ 
+*/ 
+
+/**
+ * Map a base name to the pointer to access the base.
+ *
+ * This macro maps a base name to the pointer to access the base.
+ * This is generally just used internally.
+ *
+ */
+#define HWIO_BASE_PTR(base) base##_BASE_PTR
+
+
+/**
+ * Declare a HWIO base pointer.
+ *
+ * This macro will declare a HWIO base pointer data structure.  The pointer
+ * will always be declared as a weak symbol so multiple declarations will
+ * resolve correctly to the same data at link-time.
+ */
+#ifdef __ARMCC_VERSION
+  #define DECLARE_HWIO_BASE_PTR(base) __weak uint8 *HWIO_BASE_PTR(base)
+#else
+  #define DECLARE_HWIO_BASE_PTR(base) uint8 *HWIO_BASE_PTR(base)
+#endif
+
+/**
+  @}
+*/
+
+
+/** 
+  @addtogroup hwio_macros
+  @{ 
+*/ 
+
+/**
+ * @name Address Macros
+ *
+ * Macros for getting register addresses.
+ * These macros are used for retrieving the address of a register.
+ * HWIO_ADDR* will return the directly accessible address (virtual or physical based
+ * on environment), HWIO_PHYS* will always return the physical address.
+ * The offset from the base region can be retrieved using HWIO_OFFS*.
+ * The "X" extension is used for explicit addressing where the base address of
+ * the module in question is provided as an argument to the macro.
+ *
+ * @{
+ */
+#define HWIO_ADDR(hwiosym)                               __msmhwio_addr(hwiosym)
+#define HWIO_ADDRI(hwiosym, index)                       __msmhwio_addri(hwiosym, index)
+#define HWIO_ADDRI2(hwiosym, index1, index2)             __msmhwio_addri2(hwiosym, index1, index2)
+#define HWIO_ADDRI3(hwiosym, index1, index2, index3)     __msmhwio_addri3(hwiosym, index1, index2, index3)
+
+#define HWIO_ADDRX(base, hwiosym)                           __msmhwio_addrx(base, hwiosym)
+#define HWIO_ADDRXI(base, hwiosym, index)                   __msmhwio_addrxi(base, hwiosym, index)
+#define HWIO_ADDRXI2(base, hwiosym, index1, index2)         __msmhwio_addrxi2(base, hwiosym, index1, index2)
+#define HWIO_ADDRXI3(base, hwiosym, index1, index2, index3) __msmhwio_addrxi3(base, hwiosym, index1, index2, index3)
+
+#define HWIO_PHYS(hwiosym)                               __msmhwio_phys(hwiosym)
+#define HWIO_PHYSI(hwiosym, index)                       __msmhwio_physi(hwiosym, index)
+#define HWIO_PHYSI2(hwiosym, index1, index2)             __msmhwio_physi2(hwiosym, index1, index2)
+#define HWIO_PHYSI3(hwiosym, index1, index2, index3)     __msmhwio_physi3(hwiosym, index1, index2, index3)
+
+#define HWIO_PHYSX(base, hwiosym)                           __msmhwio_physx(base, hwiosym)
+#define HWIO_PHYSXI(base, hwiosym, index)                   __msmhwio_physxi(base, hwiosym, index)
+#define HWIO_PHYSXI2(base, hwiosym, index1, index2)         __msmhwio_physxi2(base, hwiosym, index1, index2)
+#define HWIO_PHYSXI3(base, hwiosym, index1, index2, index3) __msmhwio_physxi3(base, hwiosym, index1, index2, index3)
+
+#define HWIO_OFFS(hwiosym)                               __msmhwio_offs(hwiosym)
+#define HWIO_OFFSI(hwiosym, index)                       __msmhwio_offsi(hwiosym, index)
+#define HWIO_OFFSI2(hwiosym, index1, index2)             __msmhwio_offsi2(hwiosym, index1, index2)
+#define HWIO_OFFSI3(hwiosym, index1, index2, index3)     __msmhwio_offsi3(hwiosym, index1, index2, index3)
+/** @} */
+
+/**
+ * @name Input Macros
+ *
+ * These macros are used for reading from a named hardware register.  Register
+ * arrays ("indexed") use the macros with the "I" suffix.  The "M" suffix
+ * indicates that the input will be masked with the supplied mask.  The HWIO_INF*
+ * macros take a field name and will do the appropriate masking and shifting
+ * to return just the value of that field.
+ * The "X" extension is used for explicit addressing where the base address of
+ * the module in question is provided as an argument to the macro.
+ *
+ * Generally you want to use either HWIO_IN or HWIO_INF (with required indexing).
+ *
+ * @{
+ */
+#define HWIO_IN(hwiosym)                                         __msmhwio_in(hwiosym)
+#define HWIO_INI(hwiosym, index)                                 __msmhwio_ini(hwiosym, index)
+#define HWIO_INI2(hwiosym, index1, index2)                       __msmhwio_ini2(hwiosym, index1, index2)
+#define HWIO_INI3(hwiosym, index1, index2, index3)               __msmhwio_ini3(hwiosym, index1, index2, index3)
+
+#define HWIO_INM(hwiosym, mask)                                  __msmhwio_inm(hwiosym, mask)
+#define HWIO_INMI(hwiosym, index, mask)                          __msmhwio_inmi(hwiosym, index, mask)
+#define HWIO_INMI2(hwiosym, index1, index2, mask)                __msmhwio_inmi2(hwiosym, index1, index2, mask)
+#define HWIO_INMI3(hwiosym, index1, index2, index3, mask)        __msmhwio_inmi3(hwiosym, index1, index2, index3, mask)
+
+#define HWIO_INF(io, field)                                      (HWIO_INM(io, HWIO_FMSK(io, field)) >> HWIO_SHFT(io, field))
+#define HWIO_INFI(io, index, field)                              (HWIO_INMI(io, index, HWIO_FMSK(io, field)) >> HWIO_SHFT(io, field))
+#define HWIO_INFI2(io, index1, index2, field)                    (HWIO_INMI2(io, index1, index2, HWIO_FMSK(io, field)) >> HWIO_SHFT(io, field))
+#define HWIO_INFI3(io, index1, index2, index3, field)            (HWIO_INMI3(io, index1, index2, index3, HWIO_FMSK(io, field)) >> HWIO_SHFT(io, field))
+
+#define HWIO_INX(base, hwiosym)                                  __msmhwio_inx(base, hwiosym)
+#define HWIO_INXI(base, hwiosym, index)                          __msmhwio_inxi(base, hwiosym, index)
+#define HWIO_INXI2(base, hwiosym, index1, index2)                __msmhwio_inxi2(base, hwiosym, index1, index2)
+#define HWIO_INXI3(base, hwiosym, index1, index2, index3)        __msmhwio_inxi3(base, hwiosym, index1, index2, index3)
+
+#define HWIO_INXM(base, hwiosym, mask)                           __msmhwio_inxm(base, hwiosym, mask)
+#define HWIO_INXMI(base, hwiosym, index, mask)                   __msmhwio_inxmi(base, hwiosym, index, mask)
+#define HWIO_INXMI2(base, hwiosym, index1, index2, mask)         __msmhwio_inxmi2(base, hwiosym, index1, index2, mask)
+#define HWIO_INXMI3(base, hwiosym, index1, index2, index3, mask) __msmhwio_inxmi3(base, hwiosym, index1, index2, index3, mask)
+
+#define HWIO_INXF(base, io, field)                               (HWIO_INXM(base, io, HWIO_FMSK(io, field)) >> HWIO_SHFT(io, field))
+#define HWIO_INXFI(base, io, index, field)                       (HWIO_INXMI(base, io, index, HWIO_FMSK(io, field)) >> HWIO_SHFT(io, field))
+#define HWIO_INXFI2(base, io, index1, index2, field)             (HWIO_INXMI2(base, io, index1, index2, HWIO_FMSK(io, field)) >> HWIO_SHFT(io, field))
+#define HWIO_INXFI3(base, io, index1, index2, index3, field)     (HWIO_INXMI3(base, io, index1, index2, index3, HWIO_FMSK(io, field)) >> HWIO_SHFT(io, field))
+/** @} */
+
+/**
+ * @name Output Macros
+ *
+ * These macros are used for writing to a named hardware register.  Register
+ * arrays ("indexed") use the macros with the "I" suffix.  The "M" suffix
+ * indicates that the output will be masked with the supplied mask (meaning these
+ * macros do a read first, mask in the supplied data, then write it back).
+ * The "X" extension is used for explicit addressing where the base address of
+ * the module in question is provided as an argument to the macro.
+ * The HWIO_OUTF* macros take a field name and will do the appropriate masking
+ * and shifting to output just the value of that field.
+ * HWIO_OUTV* registers take a named value instead of a numeric value and
+ * do the same masking/shifting as HWIO_OUTF.
+ *
+ * Generally you want to use either HWIO_OUT or HWIO_OUTF (with required indexing).
+ *
+ * @{
+ */
+#define HWIO_OUT(hwiosym, val)                                   __msmhwio_out(hwiosym, val)
+#define HWIO_OUTI(hwiosym, index, val)                           __msmhwio_outi(hwiosym, index, val)
+#define HWIO_OUTI2(hwiosym, index1, index2, val)                 __msmhwio_outi2(hwiosym, index1, index2, val)
+#define HWIO_OUTI3(hwiosym, index1, index2, index3, val)         __msmhwio_outi3(hwiosym, index1, index2, index3, val)
+
+#define HWIO_OUTM(hwiosym, mask, val)                            __msmhwio_outm(hwiosym, mask, val)
+#define HWIO_OUTMI(hwiosym, index, mask, val)                    __msmhwio_outmi(hwiosym, index, mask, val)
+#define HWIO_OUTMI2(hwiosym, index1, index2, mask, val)          __msmhwio_outmi2(hwiosym, index1, index2, mask, val)
+#define HWIO_OUTMI3(hwiosym, index1, index2, index3, mask, val)  __msmhwio_outmi3(hwiosym, index1, index2, index3, mask, val)
+
+#define HWIO_OUTF(io, field, val)                                HWIO_OUTM(io, HWIO_FMSK(io, field), (uint32)(val) << HWIO_SHFT(io, field))
+#define HWIO_OUTFI(io, index, field, val)                        HWIO_OUTMI(io, index, HWIO_FMSK(io, field), (uint32)(val) << HWIO_SHFT(io, field))
+#define HWIO_OUTFI2(io, index1, index2, field, val)              HWIO_OUTMI2(io, index1, index2, HWIO_FMSK(io, field), (uint32)(val) << HWIO_SHFT(io, field))
+#define HWIO_OUTFI3(io, index1, index2, index3, field, val)      HWIO_OUTMI3(io, index1, index2, index3, HWIO_FMSK(io, field), (uint32)(val) << HWIO_SHFT(io, field))
+
+#define HWIO_OUTV(io, field, val)                                HWIO_OUTM(io, HWIO_FMSK(io, field), (uint32)(HWIO_VAL(io, field, val)) << HWIO_SHFT(io, field))
+#define HWIO_OUTVI(io, index, field, val)                        HWIO_OUTMI(io, index, HWIO_FMSK(io, field), (uint32)(HWIO_VAL(io, field, val)) << HWIO_SHFT(io, field))
+#define HWIO_OUTVI2(io, index1, index2, field, val)              HWIO_OUTMI2(io, index1, index2, HWIO_FMSK(io, field), (uint32)(HWIO_VAL(io, field, val)) << HWIO_SHFT(io, field))
+#define HWIO_OUTVI3(io, index1, index2, index3, field, val)      HWIO_OUTMI3(io, index1, index2, index3, HWIO_FMSK(io, field), (uint32)(HWIO_VAL(io, field, val)) << HWIO_SHFT(io, field))
+
+#define HWIO_OUTX(base, hwiosym, val)                                   __msmhwio_outx(base, hwiosym, val)
+#define HWIO_OUTXI(base, hwiosym, index, val)                           __msmhwio_outxi(base, hwiosym, index, val)
+#define HWIO_OUTXI2(base, hwiosym, index1, index2, val)                 __msmhwio_outxi2(base, hwiosym, index1, index2, val)
+#define HWIO_OUTXI3(base, hwiosym, index1, index2, index3, val)         __msmhwio_outxi3(base, hwiosym, index1, index2, index3, val)
+
+#define HWIO_OUTXM(base, hwiosym, mask, val)                            __msmhwio_outxm(base, hwiosym, mask, val)
+#define HWIO_OUTXM2(base, hwiosym, mask1, mask2, val1, val2)  __msmhwio_outxm2(base, hwiosym, mask1, mask2, val1, val2)
+#define HWIO_OUTXM3(base, hwiosym, mask1, mask2, mask3, val1, val2, val3) __msmhwio_outxm3(base, hwiosym, mask1, mask2, mask3, val1, val2, val3)
+#define HWIO_OUTXM4(base, hwiosym, mask1, mask2, mask3, mask4, val1, val2, val3, val4) __msmhwio_outxm4(base, hwiosym, mask1, mask2, mask3, mask4, val1, val2, val3, val4)
+#define HWIO_OUTXMI(base, hwiosym, index, mask, val)                    __msmhwio_outxmi(base, hwiosym, index, mask, val)
+#define HWIO_OUTXMI2(base, hwiosym, index1, index2, mask, val)          __msmhwio_outxmi2(base, hwiosym, index1, index2, mask, val)
+#define HWIO_OUTXMI3(base, hwiosym, index1, index2, index3, mask, val)  __msmhwio_outxmi3(base, hwiosym, index1, index2, index3, mask, val)
+
+#define HWIO_OUTXF(base, io, field, val)                                HWIO_OUTXM(base, io, HWIO_FMSK(io, field), (uint32)(val) << HWIO_SHFT(io, field))
+#define HWIO_OUTX2F(base, io, field1, field2, val1, val2)                                HWIO_OUTXM2(base, io, HWIO_FMSK(io, field1),  HWIO_FMSK(io, field2), (uint32)(val1) << HWIO_SHFT(io, field1), (uint32)(val2) << HWIO_SHFT(io, field2))
+#define HWIO_OUTX3F(base, io, field1, field2, field3, val1, val2, val3)                                HWIO_OUTXM3(base, io, HWIO_FMSK(io, field1),  HWIO_FMSK(io, field2),  HWIO_FMSK(io, field3),(uint32)(val1) << HWIO_SHFT(io, field1), (uint32)(val2) << HWIO_SHFT(io, field2), (uint32)(val3) << HWIO_SHFT(io, field3) )
+#define HWIO_OUTX4F(base, io, field1, field2, field3, field4, val1, val2, val3, val4)                                HWIO_OUTXM4(base, io, HWIO_FMSK(io, field1),  HWIO_FMSK(io, field2),  HWIO_FMSK(io, field3),  HWIO_FMSK(io, field4), (uint32)(val1) << HWIO_SHFT(io, field1) , (uint32)(val2) << HWIO_SHFT(io, field2), (uint32)(val3) << HWIO_SHFT(io, field3), (uint32)(val4) << HWIO_SHFT(io, field4) )
+
+#define HWIO_OUTXFI(base, io, index, field, val)                        HWIO_OUTXMI(base, io, index, HWIO_FMSK(io, field), (uint32)(val) << HWIO_SHFT(io, field))
+#define HWIO_OUTXFI2(base, io, index1, index2, field, val)              HWIO_OUTXMI2(base, io, index1, index2, HWIO_FMSK(io, field), (uint32)(val) << HWIO_SHFT(io, field))
+#define HWIO_OUTXFI3(base, io, index1, index2, index3, field, val)      HWIO_OUTXMI3(base, io, index1, index2, index3, HWIO_FMSK(io, field), (uint32)(val) << HWIO_SHFT(io, field))
+
+#define HWIO_OUTXV(base, io, field, val)                                HWIO_OUTXM(base, io, HWIO_FMSK(io, field), (uint32)(HWIO_VAL(io, field, val)) << HWIO_SHFT(io, field))
+#define HWIO_OUTXVI(base, io, index, field, val)                        HWIO_OUTXMI(base, io, index, HWIO_FMSK(io, field), (uint32)(HWIO_VAL(io, field, val)) << HWIO_SHFT(io, field))
+#define HWIO_OUTXVI2(base, io, index1, index2, field, val)              HWIO_OUTXMI2(base, io, index1, index2, HWIO_FMSK(io, field), (uint32)(HWIO_VAL(io, field, val)) << HWIO_SHFT(io, field))
+#define HWIO_OUTXVI3(base, io, index1, index2, index3, field, val)      HWIO_OUTXMI3(base, io, index1, index2, index3, HWIO_FMSK(io, field), (uint32)(HWIO_VAL(io, field, val)) << HWIO_SHFT(io, field))
+/** @} */
+
+/**
+ * @name Shift and Mask Macros
+ *
+ * Macros for getting shift and mask values for fields and registers.
+ *  HWIO_RMSK: The mask value for accessing an entire register.  For example:
+ *             @code
+ *             HWIO_RMSK(REG) -> 0xFFFFFFFF
+ *             @endcode
+ *  HWIO_RSHFT: The right-shift value for an entire register (rarely necessary).\n
+ *  HWIO_SHFT: The right-shift value for accessing a field in a register.  For example:
+ *             @code
+ *             HWIO_SHFT(REG, FLD) -> 8
+ *             @endcode
+ *  HWIO_FMSK: The mask value for accessing a field in a register.  For example:
+ *             @code
+ *             HWIO_FMSK(REG, FLD) -> 0xFF00
+ *             @endcode
+ *  HWIO_VAL:  The value for a field in a register.  For example:
+ *             @code
+ *             HWIO_VAL(REG, FLD, ON) -> 0x1
+ *             @endcode
+ *  HWIO_FVAL: This macro takes a numerical value and will shift and mask it into
+ *             the given field position.  For example:
+ *             @code
+ *             HWIO_FVAL(REG, FLD, 0x1) -> 0x100
+ *             @endcode
+ *  HWIO_FVALV: This macro takes a logical (named) value and will shift and mask it
+ *              into the given field position.  For example:
+ *              @code
+ *              HWIO_FVALV(REG, FLD, ON) -> 0x100
+ *              @endcode
+ *
+ * @{
+ */
+#define HWIO_RMSK(hwiosym)                               __msmhwio_rmsk(hwiosym)
+#define HWIO_RMSKI(hwiosym, index)                       __msmhwio_rmski(hwiosym, index)
+#define HWIO_RSHFT(hwiosym)                              __msmhwio_rshft(hwiosym)
+#define HWIO_SHFT(hwio_regsym, hwio_fldsym)              __msmhwio_shft(hwio_regsym, hwio_fldsym)
+#define HWIO_FMSK(hwio_regsym, hwio_fldsym)              __msmhwio_fmsk(hwio_regsym, hwio_fldsym)
+#define HWIO_VAL(io, field, val)                         __msmhwio_val(io, field, val)
+#define HWIO_FVAL(io, field, val)                        (((uint32)(val) << HWIO_SHFT(io, field)) & HWIO_FMSK(io, field))
+#define HWIO_FVALV(io, field, val)                       (((uint32)(HWIO_VAL(io, field, val)) << HWIO_SHFT(io, field)) & HWIO_FMSK(io, field))
+/** @} */
+
+/**
+ * @name Shadow Register Macros
+ *
+ * These macros are used for directly reading the value stored in a 
+ * shadow register.
+ * Shadow registers are defined for write-only registers.  Generally these
+ * macros should not be necessary as HWIO_OUTM* macros will automatically use
+ * the shadow values internally.
+ *
+ * @{
+ */
+#define HWIO_SHDW(hwiosym)                               __msmhwio_shdw(hwiosym)
+#define HWIO_SHDWI(hwiosym, index)                       __msmhwio_shdwi(hwiosym, index)
+/** @} */
+
+/** 
+  @}
+*/ /* end_group */
+
+
+/** @cond */
+
+/*
+ * Map to final symbols.  This remapping is done to allow register 
+ * redefinitions.  If we just define HWIO_IN(xreg) as HWIO_##xreg##_IN
+ * then remappings like "#define xreg xregnew" do not work as expected.
+ */
+#define __msmhwio_in(hwiosym)                                   HWIO_##hwiosym##_IN
+#define __msmhwio_ini(hwiosym, index)                           HWIO_##hwiosym##_INI(index)
+#define __msmhwio_ini2(hwiosym, index1, index2)                 HWIO_##hwiosym##_INI2(index1, index2)
+#define __msmhwio_ini3(hwiosym, index1, index2, index3)         HWIO_##hwiosym##_INI3(index1, index2, index3)
+#define __msmhwio_inm(hwiosym, mask)                            HWIO_##hwiosym##_INM(mask)
+#define __msmhwio_inmi(hwiosym, index, mask)                    HWIO_##hwiosym##_INMI(index, mask)
+#define __msmhwio_inmi2(hwiosym, index1, index2, mask)          HWIO_##hwiosym##_INMI2(index1, index2, mask)
+#define __msmhwio_inmi3(hwiosym, index1, index2, index3, mask)  HWIO_##hwiosym##_INMI3(index1, index2, index3, mask)
+#define __msmhwio_out(hwiosym, val)                             HWIO_##hwiosym##_OUT(val)
+#define __msmhwio_outi(hwiosym, index, val)                     HWIO_##hwiosym##_OUTI(index,val)
+#define __msmhwio_outi2(hwiosym, index1, index2, val)           HWIO_##hwiosym##_OUTI2(index1, index2, val)
+#define __msmhwio_outi3(hwiosym, index1, index2, index3, val)   HWIO_##hwiosym##_OUTI2(index1, index2, index3, val)
+#define __msmhwio_outm(hwiosym, mask, val)                      HWIO_##hwiosym##_OUTM(mask, val)
+#define __msmhwio_outmi(hwiosym, index, mask, val)              HWIO_##hwiosym##_OUTMI(index, mask, val)
+#define __msmhwio_outmi2(hwiosym, idx1, idx2, mask, val)        HWIO_##hwiosym##_OUTMI2(idx1, idx2, mask, val)
+#define __msmhwio_outmi3(hwiosym, idx1, idx2, idx3, mask, val)  HWIO_##hwiosym##_OUTMI3(idx1, idx2, idx3, mask, val)
+#define __msmhwio_addr(hwiosym)                                 HWIO_##hwiosym##_ADDR
+#define __msmhwio_addri(hwiosym, index)                         HWIO_##hwiosym##_ADDR(index)
+#define __msmhwio_addri2(hwiosym, idx1, idx2)                   HWIO_##hwiosym##_ADDR(idx1, idx2)
+#define __msmhwio_addri3(hwiosym, idx1, idx2, idx3)             HWIO_##hwiosym##_ADDR(idx1, idx2, idx3)
+#define __msmhwio_phys(hwiosym)                                 HWIO_##hwiosym##_PHYS
+#define __msmhwio_physi(hwiosym, index)                         HWIO_##hwiosym##_PHYS(index)
+#define __msmhwio_physi2(hwiosym, idx1, idx2)                   HWIO_##hwiosym##_PHYS(idx1, idx2)
+#define __msmhwio_physi3(hwiosym, idx1, idx2, idx3)             HWIO_##hwiosym##_PHYS(idx1, idx2, idx3)
+#define __msmhwio_offs(hwiosym)                                 HWIO_##hwiosym##_OFFS 
+#define __msmhwio_offsi(hwiosym, index)                         HWIO_##hwiosym##_OFFS(index)
+#define __msmhwio_offsi2(hwiosym, idx1, idx2)                   HWIO_##hwiosym##_OFFS(idx1, idx2)
+#define __msmhwio_offsi3(hwiosym, idx1, idx2, idx3)             HWIO_##hwiosym##_OFFS(idx1, idx2, idx3)
+#define __msmhwio_rmsk(hwiosym)                                 HWIO_##hwiosym##_RMSK
+#define __msmhwio_rmski(hwiosym, index)                         HWIO_##hwiosym##_RMSK(index)
+#define __msmhwio_fmsk(hwiosym, hwiofldsym)                     HWIO_##hwiosym##_##hwiofldsym##_BMSK
+#define __msmhwio_rshft(hwiosym)                                HWIO_##hwiosym##_SHFT
+#define __msmhwio_shft(hwiosym, hwiofldsym)                     HWIO_##hwiosym##_##hwiofldsym##_SHFT
+#define __msmhwio_shdw(hwiosym)                                 HWIO_##hwiosym##_shadow
+#define __msmhwio_shdwi(hwiosym, index)                         HWIO_##hwiosym##_SHDW(index)
+#define __msmhwio_val(hwiosym, hwiofld, hwioval)                HWIO_##hwiosym##_##hwiofld##_##hwioval##_FVAL
+
+#define __msmhwio_inx(base, hwiosym)                                  HWIO_##hwiosym##_IN(base)
+#define __msmhwio_inxi(base, hwiosym, index)                          HWIO_##hwiosym##_INI(base, index)
+#define __msmhwio_inxi2(base, hwiosym, index1, index2)                HWIO_##hwiosym##_INI2(base, index1, index2)
+#define __msmhwio_inxi3(base, hwiosym, index1, index2, index3)        HWIO_##hwiosym##_INI3(base, index1, index2, index3)
+#define __msmhwio_inxm(base, hwiosym, mask)                           HWIO_##hwiosym##_INM(base, mask)
+#define __msmhwio_inxmi(base, hwiosym, index, mask)                   HWIO_##hwiosym##_INMI(base, index, mask)
+#define __msmhwio_inxmi2(base, hwiosym, index1, index2, mask)         HWIO_##hwiosym##_INMI2(base, index1, index2, mask)
+#define __msmhwio_inxmi3(base, hwiosym, index1, index2, index3, mask) HWIO_##hwiosym##_INMI3(base, index1, index2, index3, mask)
+#define __msmhwio_outx(base, hwiosym, val)                            HWIO_##hwiosym##_OUT(base, val)
+#define __msmhwio_outxi(base, hwiosym, index, val)                    HWIO_##hwiosym##_OUTI(base, index,val)
+#define __msmhwio_outxi2(base, hwiosym, index1, index2, val)          HWIO_##hwiosym##_OUTI2(base, index1, index2, val)
+#define __msmhwio_outxi3(base, hwiosym, index1, index2, index3, val)  HWIO_##hwiosym##_OUTI2(base, index1, index2, index3, val)
+#define __msmhwio_outxm(base, hwiosym, mask, val)                     HWIO_##hwiosym##_OUTM(base, mask, val)
+#define __msmhwio_outxm2(base, hwiosym, mask1, mask2, val1, val2)  {	\
+                                                                                HWIO_##hwiosym##_OUTM(base, mask1, val1); \
+                                                                                HWIO_##hwiosym##_OUTM(base, mask2, val2); \
+                                                                               }
+#define __msmhwio_outxm3(base, hwiosym, mask1, mask2, mask3,  val1, val2, val3) { \
+                                                                                HWIO_##hwiosym##_OUTM(base, mask1, val1); \
+                                                                                HWIO_##hwiosym##_OUTM(base, mask2, val2); \
+                                                                                HWIO_##hwiosym##_OUTM(base, mask3, val3); \
+                                                                               }  
+#define __msmhwio_outxm4(base, hwiosym, mask1, mask2, mask3, mask4, val1, val2, val3, val4) { \
+                                                                                HWIO_##hwiosym##_OUTM(base, mask1, val1); \
+                                                                                HWIO_##hwiosym##_OUTM(base, mask2, val2); \
+                                                                                HWIO_##hwiosym##_OUTM(base, mask3, val3); \
+                                                                                HWIO_##hwiosym##_OUTM(base, mask4, val4); \
+                                                                               } 
+
+
+#define __msmhwio_outxmi(base, hwiosym, index, mask, val)             HWIO_##hwiosym##_OUTMI(base, index, mask, val)
+#define __msmhwio_outxmi2(base, hwiosym, idx1, idx2, mask, val)       HWIO_##hwiosym##_OUTMI2(base, idx1, idx2, mask, val)
+#define __msmhwio_outxmi3(base, hwiosym, idx1, idx2, idx3, mask, val) HWIO_##hwiosym##_OUTMI3(base, idx1, idx2, idx3, mask, val)
+#define __msmhwio_addrx(base, hwiosym)                                HWIO_##hwiosym##_ADDR(base)
+#define __msmhwio_addrxi(base, hwiosym, index)                        HWIO_##hwiosym##_ADDR(base, index)
+#define __msmhwio_addrxi2(base, hwiosym, idx1, idx2)                  HWIO_##hwiosym##_ADDR(base, idx1, idx2)
+#define __msmhwio_addrxi3(base, hwiosym, idx1, idx2, idx3)            HWIO_##hwiosym##_ADDR(base, idx1, idx2, idx3)
+#define __msmhwio_physx(base, hwiosym)                                HWIO_##hwiosym##_PHYS(base)
+#define __msmhwio_physxi(base, hwiosym, index)                        HWIO_##hwiosym##_PHYS(base, index)
+#define __msmhwio_physxi2(base, hwiosym, idx1, idx2)                  HWIO_##hwiosym##_PHYS(base, idx1, idx2)
+#define __msmhwio_physxi3(base, hwiosym, idx1, idx2, idx3)            HWIO_##hwiosym##_PHYS(base, idx1, idx2, idx3)
+
+
+/*
+ * HWIO_INTLOCK
+ *
+ * Macro used by autogenerated code for mutual exclusion around
+ * read-mask-write operations.  This is not supported in HAL
+ * code but can be overridden by non-HAL code.
+ */
+#define HWIO_INTLOCK()
+#define HWIO_INTFREE()
+
+
+/*
+ * Input/output port macros for memory mapped IO.
+ */
+#define __inp(port)         (*((volatile uint8 *) (port)))
+#define __inpw(port)        (*((volatile uint16 *) (port)))
+#define __inpdw(port)       (*((volatile uint32 *) (port)))
+#define __outp(port, val)   (*((volatile uint8 *) (port)) = ((uint8) (val)))
+#define __outpw(port, val)  (*((volatile uint16 *) (port)) = ((uint16) (val)))
+#define __outpdw(port, val) (*((volatile uint32 *) (port)) = ((uint32) (val)))
+
+
+#ifdef HAL_HWIO_EXTERNAL
+
+/*
+ * Replace macros with externally supplied functions.
+ */
+#undef  __inp
+#undef  __inpw
+#undef  __inpdw
+#undef  __outp
+#undef  __outpw
+#undef  __outpdw
+
+#define  __inp(port)          __inp_extern(port)         
+#define  __inpw(port)         __inpw_extern(port)
+#define  __inpdw(port)        __inpdw_extern(port)
+#define  __outp(port, val)    __outp_extern(port, val)
+#define  __outpw(port, val)   __outpw_extern(port, val)
+#define  __outpdw(port, val)  __outpdw_extern(port, val)
+
+extern uint8   __inp_extern      ( uint32 nAddr );
+extern uint16  __inpw_extern     ( uint32 nAddr );
+extern uint32  __inpdw_extern    ( uint32 nAddr );
+extern void    __outp_extern     ( uint32 nAddr, uint8  nData );
+extern void    __outpw_extern    ( uint32 nAddr, uint16 nData );
+extern void    __outpdw_extern   ( uint32 nAddr, uint32 nData );
+
+#endif /* HAL_HWIO_EXTERNAL */
+
+
+/*
+ * Base 8-bit byte accessing macros.
+ */
+#define in_byte(addr)               (__inp(addr))
+#define in_byte_masked(addr, mask)  (__inp(addr) & (mask)) 
+#define out_byte(addr, val)         __outp(addr,val)
+#define out_byte_masked(io, mask, val, shadow)  \
+  HWIO_INTLOCK();    \
+  out_byte( io, shadow); \
+  shadow = (shadow & (uint16)(~(mask))) | ((uint16)((val) & (mask))); \
+  HWIO_INTFREE()
+#define out_byte_masked_ns(io, mask, val, current_reg_content)  \
+  out_byte( io, ((current_reg_content & (uint16)(~(mask))) | \
+                ((uint16)((val) & (mask)))) )
+
+
+/*
+ * Base 16-bit word accessing macros.
+ */
+#define in_word(addr)              (__inpw(addr))
+#define in_word_masked(addr, mask) (__inpw(addr) & (mask))
+#define out_word(addr, val)        __outpw(addr,val)
+#define out_word_masked(io, mask, val, shadow)  \
+  HWIO_INTLOCK( ); \
+  shadow = (shadow & (uint16)(~(mask))) |  ((uint16)((val) & (mask))); \
+  out_word( io, shadow); \
+  HWIO_INTFREE( )
+#define out_word_masked_ns(io, mask, val, current_reg_content)  \
+  out_word( io, ((current_reg_content & (uint16)(~(mask))) | \
+                ((uint16)((val) & (mask)))) )
+
+
+/*
+ * Base 32-bit double-word accessing macros.
+ */
+#define in_dword(addr)              (__inpdw(addr))
+#define in_dword_masked(addr, mask) (__inpdw(addr) & (mask))
+#define out_dword(addr, val)        __outpdw(addr,val)
+#define out_dword_masked(io, mask, val, shadow)  \
+   HWIO_INTLOCK(); \
+   shadow = (shadow & (uint32)(~(mask))) | ((uint32)((val) & (mask))); \
+   out_dword( io, shadow); \
+   HWIO_INTFREE()
+#define out_dword_masked_ns(io, mask, val, current_reg_content) \
+  out_dword( io, ((current_reg_content & (uint32)(~(mask))) | \
+                 ((uint32)((val) & (mask)))) )
+
+/** @endcond */
+
+#endif /* HAL_HWIO_H */
+
--- a/drivers/staging/fw-api/hw/qca5018/buffer_addr_info.h
+++ b/drivers/staging/fw-api/hw/qca5018/buffer_addr_info.h
@@ -0,0 +1,385 @@
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _BUFFER_ADDR_INFO_H_
+#define _BUFFER_ADDR_INFO_H_
+#if !defined(__ASSEMBLER__)
+#endif
+
+
+// ################ START SUMMARY #################
+//
+//	Dword	Fields
+//	0	buffer_addr_31_0[31:0]
+//	1	buffer_addr_39_32[7:0], return_buffer_manager[10:8], sw_buffer_cookie[31:11]
+//
+// ################ END SUMMARY #################
+
+#define NUM_OF_DWORDS_BUFFER_ADDR_INFO 2
+
+struct buffer_addr_info {
+             uint32_t buffer_addr_31_0                : 32; //[31:0]
+             uint32_t buffer_addr_39_32               :  8, //[7:0]
+                      return_buffer_manager           :  3, //[10:8]
+                      sw_buffer_cookie                : 21; //[31:11]
+};
+
+/*
+
+buffer_addr_31_0
+			
+			Address (lower 32 bits) of the MSDU buffer OR
+			MSDU_EXTENSION descriptor OR Link Descriptor
+			
+			
+			
+			In case of 'NULL' pointer, this field is set to 0
+			
+			<legal all>
+
+buffer_addr_39_32
+			
+			Address (upper 8 bits) of the MSDU buffer OR
+			MSDU_EXTENSION descriptor OR Link Descriptor
+			
+			
+			
+			In case of 'NULL' pointer, this field is set to 0
+			
+			<legal all>
+
+return_buffer_manager
+			
+			Consumer: WBM
+			
+			Producer: SW/FW
+			
+			
+			
+			In case of 'NULL' pointer, this field is set to 0
+			
+			
+			
+			Indicates to which buffer manager the buffer OR
+			MSDU_EXTENSION descriptor OR link descriptor that is being
+			pointed to shall be returned after the frame has been
+			processed. It is used by WBM for routing purposes.
+			
+			
+			
+			<enum 0 WBM_IDLE_BUF_LIST> This buffer shall be returned
+			to the WMB buffer idle list
+			
+			<enum 1 WBM_IDLE_DESC_LIST> This buffer shall be
+			returned to the WMB idle link descriptor idle list
+			
+			<enum 2 FW_BM> This buffer shall be returned to the FW
+			
+			<enum 3 SW0_BM> This buffer shall be returned to the SW,
+			ring 0
+			
+			<enum 4 SW1_BM> This buffer shall be returned to the SW,
+			ring 1
+			
+			<enum 5 SW2_BM> This buffer shall be returned to the SW,
+			ring 2
+			
+			<enum 6 SW3_BM> This buffer shall be returned to the SW,
+			ring 3
+			
+			<enum 7 SW4_BM> This buffer shall be returned to the SW,
+			ring 4
+			
+			
+			
+			<legal all>
+
+sw_buffer_cookie
+			
+			Cookie field exclusively used by SW. 
+			
+			
+			
+			In case of 'NULL' pointer, this field is set to 0
+			
+			
+			
+			HW ignores the contents, accept that it passes the
+			programmed value on to other descriptors together with the
+			physical address 
+			
+			
+			
+			Field can be used by SW to for example associate the
+			buffers physical address with the virtual address
+			
+			The bit definitions as used by SW are within SW HLD
+			specification
+			
+			
+			
+			NOTE1:
+			
+			The three most significant bits can have a special
+			meaning in case this struct is embedded in a TX_MPDU_DETAILS
+			STRUCT, and field transmit_bw_restriction is set
+			
+			
+			
+			In case of NON punctured transmission:
+			
+			Sw_buffer_cookie[20:19] = 2'b00: 20 MHz TX only
+			
+			Sw_buffer_cookie[20:19] = 2'b01: 40 MHz TX only
+			
+			Sw_buffer_cookie[20:19] = 2'b10: 80 MHz TX only
+			
+			Sw_buffer_cookie[20:19] = 2'b11: 160 MHz TX only
+			
+			
+			
+			In case of punctured transmission:
+			
+			Sw_buffer_cookie[20:18] = 3'b000: pattern 0 only
+			
+			Sw_buffer_cookie[20:18] = 3'b001: pattern 1 only
+			
+			Sw_buffer_cookie[20:18] = 3'b010: pattern 2 only
+			
+			Sw_buffer_cookie[20:18] = 3'b011: pattern 3 only
+			
+			Sw_buffer_cookie[20:18] = 3'b100: pattern 4 only
+			
+			Sw_buffer_cookie[20:18] = 3'b101: pattern 5 only
+			
+			Sw_buffer_cookie[20:18] = 3'b110: pattern 6 only
+			
+			Sw_buffer_cookie[20:18] = 3'b111: pattern 7 only
+			
+			
+			
+			Note: a punctured transmission is indicated by the
+			presence of TLV TX_PUNCTURE_SETUP embedded in the scheduler
+			TLV
+			
+			
+			
+			NOTE 2:The five most significant bits can have a special
+			meaning in case this struct is embedded in an
+			RX_MSDU_DETAILS STRUCT, and Maple/Spruce Rx DMA is
+			configured for passing on the additional info
+			from 'RX_MPDU_INFO' structure in 'RX_MPDU_START' TLV
+			(FR56821). This is not supported in HastingsPrime, Pine or
+			Moselle. 
+			
+			
+			
+			Sw_buffer_cookie[20:17]: Tid: The TID field in the QoS
+			control field
+			
+			
+			
+			Sw_buffer_cookie[16]: Mpdu_qos_control_valid: This field
+			indicates MPDUs with a QoS control field.
+			
+			
+			
+			
+			
+			<legal all>
+*/
+
+
+/* Description		BUFFER_ADDR_INFO_0_BUFFER_ADDR_31_0
+			
+			Address (lower 32 bits) of the MSDU buffer OR
+			MSDU_EXTENSION descriptor OR Link Descriptor
+			
+			
+			
+			In case of 'NULL' pointer, this field is set to 0
+			
+			<legal all>
+*/
+#define BUFFER_ADDR_INFO_0_BUFFER_ADDR_31_0_OFFSET                   0x00000000
+#define BUFFER_ADDR_INFO_0_BUFFER_ADDR_31_0_LSB                      0
+#define BUFFER_ADDR_INFO_0_BUFFER_ADDR_31_0_MASK                     0xffffffff
+
+/* Description		BUFFER_ADDR_INFO_1_BUFFER_ADDR_39_32
+			
+			Address (upper 8 bits) of the MSDU buffer OR
+			MSDU_EXTENSION descriptor OR Link Descriptor
+			
+			
+			
+			In case of 'NULL' pointer, this field is set to 0
+			
+			<legal all>
+*/
+#define BUFFER_ADDR_INFO_1_BUFFER_ADDR_39_32_OFFSET                  0x00000004
+#define BUFFER_ADDR_INFO_1_BUFFER_ADDR_39_32_LSB                     0
+#define BUFFER_ADDR_INFO_1_BUFFER_ADDR_39_32_MASK                    0x000000ff
+
+/* Description		BUFFER_ADDR_INFO_1_RETURN_BUFFER_MANAGER
+			
+			Consumer: WBM
+			
+			Producer: SW/FW
+			
+			
+			
+			In case of 'NULL' pointer, this field is set to 0
+			
+			
+			
+			Indicates to which buffer manager the buffer OR
+			MSDU_EXTENSION descriptor OR link descriptor that is being
+			pointed to shall be returned after the frame has been
+			processed. It is used by WBM for routing purposes.
+			
+			
+			
+			<enum 0 WBM_IDLE_BUF_LIST> This buffer shall be returned
+			to the WMB buffer idle list
+			
+			<enum 1 WBM_IDLE_DESC_LIST> This buffer shall be
+			returned to the WMB idle link descriptor idle list
+			
+			<enum 2 FW_BM> This buffer shall be returned to the FW
+			
+			<enum 3 SW0_BM> This buffer shall be returned to the SW,
+			ring 0
+			
+			<enum 4 SW1_BM> This buffer shall be returned to the SW,
+			ring 1
+			
+			<enum 5 SW2_BM> This buffer shall be returned to the SW,
+			ring 2
+			
+			<enum 6 SW3_BM> This buffer shall be returned to the SW,
+			ring 3
+			
+			<enum 7 SW4_BM> This buffer shall be returned to the SW,
+			ring 4
+			
+			
+			
+			<legal all>
+*/
+#define BUFFER_ADDR_INFO_1_RETURN_BUFFER_MANAGER_OFFSET              0x00000004
+#define BUFFER_ADDR_INFO_1_RETURN_BUFFER_MANAGER_LSB                 8
+#define BUFFER_ADDR_INFO_1_RETURN_BUFFER_MANAGER_MASK                0x00000700
+
+/* Description		BUFFER_ADDR_INFO_1_SW_BUFFER_COOKIE
+			
+			Cookie field exclusively used by SW. 
+			
+			
+			
+			In case of 'NULL' pointer, this field is set to 0
+			
+			
+			
+			HW ignores the contents, accept that it passes the
+			programmed value on to other descriptors together with the
+			physical address 
+			
+			
+			
+			Field can be used by SW to for example associate the
+			buffers physical address with the virtual address
+			
+			The bit definitions as used by SW are within SW HLD
+			specification
+			
+			
+			
+			NOTE1:
+			
+			The three most significant bits can have a special
+			meaning in case this struct is embedded in a TX_MPDU_DETAILS
+			STRUCT, and field transmit_bw_restriction is set
+			
+			
+			
+			In case of NON punctured transmission:
+			
+			Sw_buffer_cookie[20:19] = 2'b00: 20 MHz TX only
+			
+			Sw_buffer_cookie[20:19] = 2'b01: 40 MHz TX only
+			
+			Sw_buffer_cookie[20:19] = 2'b10: 80 MHz TX only
+			
+			Sw_buffer_cookie[20:19] = 2'b11: 160 MHz TX only
+			
+			
+			
+			In case of punctured transmission:
+			
+			Sw_buffer_cookie[20:18] = 3'b000: pattern 0 only
+			
+			Sw_buffer_cookie[20:18] = 3'b001: pattern 1 only
+			
+			Sw_buffer_cookie[20:18] = 3'b010: pattern 2 only
+			
+			Sw_buffer_cookie[20:18] = 3'b011: pattern 3 only
+			
+			Sw_buffer_cookie[20:18] = 3'b100: pattern 4 only
+			
+			Sw_buffer_cookie[20:18] = 3'b101: pattern 5 only
+			
+			Sw_buffer_cookie[20:18] = 3'b110: pattern 6 only
+			
+			Sw_buffer_cookie[20:18] = 3'b111: pattern 7 only
+			
+			
+			
+			Note: a punctured transmission is indicated by the
+			presence of TLV TX_PUNCTURE_SETUP embedded in the scheduler
+			TLV
+			
+			
+			
+			NOTE 2:The five most significant bits can have a special
+			meaning in case this struct is embedded in an
+			RX_MSDU_DETAILS STRUCT, and Maple/Spruce Rx DMA is
+			configured for passing on the additional info
+			from 'RX_MPDU_INFO' structure in 'RX_MPDU_START' TLV
+			(FR56821). This is not supported in HastingsPrime, Pine or
+			Moselle. 
+			
+			
+			
+			Sw_buffer_cookie[20:17]: Tid: The TID field in the QoS
+			control field
+			
+			
+			
+			Sw_buffer_cookie[16]: Mpdu_qos_control_valid: This field
+			indicates MPDUs with a QoS control field.
+			
+			
+			
+			
+			
+			<legal all>
+*/
+#define BUFFER_ADDR_INFO_1_SW_BUFFER_COOKIE_OFFSET                   0x00000004
+#define BUFFER_ADDR_INFO_1_SW_BUFFER_COOKIE_LSB                      11
+#define BUFFER_ADDR_INFO_1_SW_BUFFER_COOKIE_MASK                     0xfffff800
+
+
+#endif // _BUFFER_ADDR_INFO_H_
--- a/drivers/staging/fw-api/hw/qca5018/ce_src_desc.h
+++ b/drivers/staging/fw-api/hw/qca5018/ce_src_desc.h
@@ -0,0 +1,352 @@
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _CE_SRC_DESC_H_
+#define _CE_SRC_DESC_H_
+#if !defined(__ASSEMBLER__)
+#endif
+
+
+// ################ START SUMMARY #################
+//
+//	Dword	Fields
+//	0	src_buffer_low[31:0]
+//	1	src_buffer_high[7:0], toeplitz_en[8], src_swap[9], dest_swap[10], gather[11], ce_res_0[15:12], length[31:16]
+//	2	fw_metadata[15:0], ce_res_1[31:16]
+//	3	ce_res_2[19:0], ring_id[27:20], looping_count[31:28]
+//
+// ################ END SUMMARY #################
+
+#define NUM_OF_DWORDS_CE_SRC_DESC 4
+
+struct ce_src_desc {
+             uint32_t src_buffer_low                  : 32; //[31:0]
+             uint32_t src_buffer_high                 :  8, //[7:0]
+                      toeplitz_en                     :  1, //[8]
+                      src_swap                        :  1, //[9]
+                      dest_swap                       :  1, //[10]
+                      gather                          :  1, //[11]
+                      ce_res_0                        :  4, //[15:12]
+                      length                          : 16; //[31:16]
+             uint32_t fw_metadata                     : 16, //[15:0]
+                      ce_res_1                        : 16; //[31:16]
+             uint32_t ce_res_2                        : 20, //[19:0]
+                      ring_id                         :  8, //[27:20]
+                      looping_count                   :  4; //[31:28]
+};
+
+/*
+
+src_buffer_low
+			
+			LSB 32 bits of the 40 Bit Pointer to the source buffer
+			
+			<legal all>
+
+src_buffer_high
+			
+			MSB 8 bits of the 40 Bit Pointer to the source buffer
+			
+			<legal all>
+
+toeplitz_en
+			
+			Enable generation of 32-bit Toeplitz-LFSR hash for the
+			data transfer
+			
+			In case of gather field in first source ring entry of
+			the gather copy cycle in taken into account.
+			
+			<legal all>
+
+src_swap
+			
+			Treats source memory organization as big-endian. For
+			each dword read (4 bytes), the byte 0 is swapped with byte 3
+			and byte 1 is swapped with byte 2.
+			
+			In case of gather field in first source ring entry of
+			the gather copy cycle in taken into account.
+			
+			<legal all>
+
+dest_swap
+			
+			Treats destination memory organization as big-endian.
+			For each dword write (4 bytes), the byte 0 is swapped with
+			byte 3 and byte 1 is swapped with byte 2.
+			
+			In case of gather field in first source ring entry of
+			the gather copy cycle in taken into account.
+			
+			<legal all>
+
+gather
+			
+			Enables gather of multiple copy engine source
+			descriptors to one destination.
+			
+			<legal all>
+
+ce_res_0
+			
+			Reserved
+			
+			<legal all>
+
+length
+			
+			Length of the buffer in units of octets of the current
+			descriptor
+			
+			<legal all>
+
+fw_metadata
+			
+			Meta data used by FW
+			
+			In case of gather field in first source ring entry of
+			the gather copy cycle in taken into account.
+			
+			<legal all>
+
+ce_res_1
+			
+			Reserved
+			
+			<legal all>
+
+ce_res_2
+			
+			Reserved 
+			
+			<legal all>
+
+ring_id
+			
+			The buffer pointer ring ID.
+			
+			0 refers to the IDLE ring
+			
+			1 - N refers to other rings
+			
+			
+			
+			Helps with debugging when dumping ring contents.
+			
+			<legal all>
+
+looping_count
+			
+			A count value that indicates the number of times the
+			producer of entries into the Ring has looped around the
+			ring.
+			
+			At initialization time, this value is set to 0. On the
+			first loop, this value is set to 1. After the max value is
+			reached allowed by the number of bits for this field, the
+			count value continues with 0 again.
+			
+			In case SW is the consumer of the ring entries, it can
+			use this field to figure out up to where the producer of
+			entries has created new entries. This eliminates the need to
+			check where the head pointer' of the ring is located once
+			the SW starts processing an interrupt indicating that new
+			entries have been put into this ring...
+			
+			Also note that SW if it wants only needs to look at the
+			LSB bit of this count value.
+			
+			<legal all>
+*/
+
+
+/* Description		CE_SRC_DESC_0_SRC_BUFFER_LOW
+			
+			LSB 32 bits of the 40 Bit Pointer to the source buffer
+			
+			<legal all>
+*/
+#define CE_SRC_DESC_0_SRC_BUFFER_LOW_OFFSET                          0x00000000
+#define CE_SRC_DESC_0_SRC_BUFFER_LOW_LSB                             0
+#define CE_SRC_DESC_0_SRC_BUFFER_LOW_MASK                            0xffffffff
+
+/* Description		CE_SRC_DESC_1_SRC_BUFFER_HIGH
+			
+			MSB 8 bits of the 40 Bit Pointer to the source buffer
+			
+			<legal all>
+*/
+#define CE_SRC_DESC_1_SRC_BUFFER_HIGH_OFFSET                         0x00000004
+#define CE_SRC_DESC_1_SRC_BUFFER_HIGH_LSB                            0
+#define CE_SRC_DESC_1_SRC_BUFFER_HIGH_MASK                           0x000000ff
+
+/* Description		CE_SRC_DESC_1_TOEPLITZ_EN
+			
+			Enable generation of 32-bit Toeplitz-LFSR hash for the
+			data transfer
+			
+			In case of gather field in first source ring entry of
+			the gather copy cycle in taken into account.
+			
+			<legal all>
+*/
+#define CE_SRC_DESC_1_TOEPLITZ_EN_OFFSET                             0x00000004
+#define CE_SRC_DESC_1_TOEPLITZ_EN_LSB                                8
+#define CE_SRC_DESC_1_TOEPLITZ_EN_MASK                               0x00000100
+
+/* Description		CE_SRC_DESC_1_SRC_SWAP
+			
+			Treats source memory organization as big-endian. For
+			each dword read (4 bytes), the byte 0 is swapped with byte 3
+			and byte 1 is swapped with byte 2.
+			
+			In case of gather field in first source ring entry of
+			the gather copy cycle in taken into account.
+			
+			<legal all>
+*/
+#define CE_SRC_DESC_1_SRC_SWAP_OFFSET                                0x00000004
+#define CE_SRC_DESC_1_SRC_SWAP_LSB                                   9
+#define CE_SRC_DESC_1_SRC_SWAP_MASK                                  0x00000200
+
+/* Description		CE_SRC_DESC_1_DEST_SWAP
+			
+			Treats destination memory organization as big-endian.
+			For each dword write (4 bytes), the byte 0 is swapped with
+			byte 3 and byte 1 is swapped with byte 2.
+			
+			In case of gather field in first source ring entry of
+			the gather copy cycle in taken into account.
+			
+			<legal all>
+*/
+#define CE_SRC_DESC_1_DEST_SWAP_OFFSET                               0x00000004
+#define CE_SRC_DESC_1_DEST_SWAP_LSB                                  10
+#define CE_SRC_DESC_1_DEST_SWAP_MASK                                 0x00000400
+
+/* Description		CE_SRC_DESC_1_GATHER
+			
+			Enables gather of multiple copy engine source
+			descriptors to one destination.
+			
+			<legal all>
+*/
+#define CE_SRC_DESC_1_GATHER_OFFSET                                  0x00000004
+#define CE_SRC_DESC_1_GATHER_LSB                                     11
+#define CE_SRC_DESC_1_GATHER_MASK                                    0x00000800
+
+/* Description		CE_SRC_DESC_1_CE_RES_0
+			
+			Reserved
+			
+			<legal all>
+*/
+#define CE_SRC_DESC_1_CE_RES_0_OFFSET                                0x00000004
+#define CE_SRC_DESC_1_CE_RES_0_LSB                                   12
+#define CE_SRC_DESC_1_CE_RES_0_MASK                                  0x0000f000
+
+/* Description		CE_SRC_DESC_1_LENGTH
+			
+			Length of the buffer in units of octets of the current
+			descriptor
+			
+			<legal all>
+*/
+#define CE_SRC_DESC_1_LENGTH_OFFSET                                  0x00000004
+#define CE_SRC_DESC_1_LENGTH_LSB                                     16
+#define CE_SRC_DESC_1_LENGTH_MASK                                    0xffff0000
+
+/* Description		CE_SRC_DESC_2_FW_METADATA
+			
+			Meta data used by FW
+			
+			In case of gather field in first source ring entry of
+			the gather copy cycle in taken into account.
+			
+			<legal all>
+*/
+#define CE_SRC_DESC_2_FW_METADATA_OFFSET                             0x00000008
+#define CE_SRC_DESC_2_FW_METADATA_LSB                                0
+#define CE_SRC_DESC_2_FW_METADATA_MASK                               0x0000ffff
+
+/* Description		CE_SRC_DESC_2_CE_RES_1
+			
+			Reserved
+			
+			<legal all>
+*/
+#define CE_SRC_DESC_2_CE_RES_1_OFFSET                                0x00000008
+#define CE_SRC_DESC_2_CE_RES_1_LSB                                   16
+#define CE_SRC_DESC_2_CE_RES_1_MASK                                  0xffff0000
+
+/* Description		CE_SRC_DESC_3_CE_RES_2
+			
+			Reserved 
+			
+			<legal all>
+*/
+#define CE_SRC_DESC_3_CE_RES_2_OFFSET                                0x0000000c
+#define CE_SRC_DESC_3_CE_RES_2_LSB                                   0
+#define CE_SRC_DESC_3_CE_RES_2_MASK                                  0x000fffff
+
+/* Description		CE_SRC_DESC_3_RING_ID
+			
+			The buffer pointer ring ID.
+			
+			0 refers to the IDLE ring
+			
+			1 - N refers to other rings
+			
+			
+			
+			Helps with debugging when dumping ring contents.
+			
+			<legal all>
+*/
+#define CE_SRC_DESC_3_RING_ID_OFFSET                                 0x0000000c
+#define CE_SRC_DESC_3_RING_ID_LSB                                    20
+#define CE_SRC_DESC_3_RING_ID_MASK                                   0x0ff00000
+
+/* Description		CE_SRC_DESC_3_LOOPING_COUNT
+			
+			A count value that indicates the number of times the
+			producer of entries into the Ring has looped around the
+			ring.
+			
+			At initialization time, this value is set to 0. On the
+			first loop, this value is set to 1. After the max value is
+			reached allowed by the number of bits for this field, the
+			count value continues with 0 again.
+			
+			In case SW is the consumer of the ring entries, it can
+			use this field to figure out up to where the producer of
+			entries has created new entries. This eliminates the need to
+			check where the head pointer' of the ring is located once
+			the SW starts processing an interrupt indicating that new
+			entries have been put into this ring...
+			
+			Also note that SW if it wants only needs to look at the
+			LSB bit of this count value.
+			
+			<legal all>
+*/
+#define CE_SRC_DESC_3_LOOPING_COUNT_OFFSET                           0x0000000c
+#define CE_SRC_DESC_3_LOOPING_COUNT_LSB                              28
+#define CE_SRC_DESC_3_LOOPING_COUNT_MASK                             0xf0000000
+
+
+#endif // _CE_SRC_DESC_H_
--- a/drivers/staging/fw-api/hw/qca5018/ce_stat_desc.h
+++ b/drivers/staging/fw-api/hw/qca5018/ce_stat_desc.h
@@ -0,0 +1,322 @@
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _CE_STAT_DESC_H_
+#define _CE_STAT_DESC_H_
+#if !defined(__ASSEMBLER__)
+#endif
+
+
+// ################ START SUMMARY #################
+//
+//	Dword	Fields
+//	0	ce_res_5[7:0], toeplitz_en[8], src_swap[9], dest_swap[10], gather[11], ce_res_6[15:12], length[31:16]
+//	1	toeplitz_hash_0[31:0]
+//	2	toeplitz_hash_1[31:0]
+//	3	fw_metadata[15:0], ce_res_7[19:16], ring_id[27:20], looping_count[31:28]
+//
+// ################ END SUMMARY #################
+
+#define NUM_OF_DWORDS_CE_STAT_DESC 4
+
+struct ce_stat_desc {
+             uint32_t ce_res_5                        :  8, //[7:0]
+                      toeplitz_en                     :  1, //[8]
+                      src_swap                        :  1, //[9]
+                      dest_swap                       :  1, //[10]
+                      gather                          :  1, //[11]
+                      ce_res_6                        :  4, //[15:12]
+                      length                          : 16; //[31:16]
+             uint32_t toeplitz_hash_0                 : 32; //[31:0]
+             uint32_t toeplitz_hash_1                 : 32; //[31:0]
+             uint32_t fw_metadata                     : 16, //[15:0]
+                      ce_res_7                        :  4, //[19:16]
+                      ring_id                         :  8, //[27:20]
+                      looping_count                   :  4; //[31:28]
+};
+
+/*
+
+ce_res_5
+			
+			Reserved
+			
+			<legal all>
+
+toeplitz_en
+			
+			
+			<legal all>
+
+src_swap
+			
+			Source memory buffer swapped
+			
+			<legal all>
+
+dest_swap
+			
+			Destination  memory buffer swapped
+			
+			<legal all>
+
+gather
+			
+			Gather of multiple copy engine source descriptors to one
+			destination enabled
+			
+			<legal all>
+
+ce_res_6
+			
+			Reserved
+			
+			<legal all>
+
+length
+			
+			Sum of all the Lengths of the source descriptor in the
+			gather chain
+			
+			<legal all>
+
+toeplitz_hash_0
+			
+			32 LS bits of 64 bit Toeplitz LFSR hash result
+			
+			<legal all>
+
+toeplitz_hash_1
+			
+			32 MS bits of 64 bit Toeplitz LFSR hash result
+			
+			<legal all>
+
+fw_metadata
+			
+			Meta data used by FW
+			
+			In case of gather field in first source ring entry of
+			the gather copy cycle in taken into account.
+			
+			<legal all>
+
+ce_res_7
+			
+			Reserved 
+			
+			<legal all>
+
+ring_id
+			
+			The buffer pointer ring ID.
+			
+			0 refers to the IDLE ring
+			
+			1 - N refers to other rings
+			
+			
+			
+			Helps with debugging when dumping ring contents.
+			
+			<legal all>
+
+looping_count
+			
+			A count value that indicates the number of times the
+			producer of entries into the Ring has looped around the
+			ring.
+			
+			At initialization time, this value is set to 0. On the
+			first loop, this value is set to 1. After the max value is
+			reached allowed by the number of bits for this field, the
+			count value continues with 0 again.
+			
+			In case SW is the consumer of the ring entries, it can
+			use this field to figure out up to where the producer of
+			entries has created new entries. This eliminates the need to
+			check where the head pointer' of the ring is located once
+			the SW starts processing an interrupt indicating that new
+			entries have been put into this ring...
+			
+			Also note that SW if it wants only needs to look at the
+			LSB bit of this count value.
+			
+			<legal all>
+*/
+
+
+/* Description		CE_STAT_DESC_0_CE_RES_5
+			
+			Reserved
+			
+			<legal all>
+*/
+#define CE_STAT_DESC_0_CE_RES_5_OFFSET                               0x00000000
+#define CE_STAT_DESC_0_CE_RES_5_LSB                                  0
+#define CE_STAT_DESC_0_CE_RES_5_MASK                                 0x000000ff
+
+/* Description		CE_STAT_DESC_0_TOEPLITZ_EN
+			
+			
+			<legal all>
+*/
+#define CE_STAT_DESC_0_TOEPLITZ_EN_OFFSET                            0x00000000
+#define CE_STAT_DESC_0_TOEPLITZ_EN_LSB                               8
+#define CE_STAT_DESC_0_TOEPLITZ_EN_MASK                              0x00000100
+
+/* Description		CE_STAT_DESC_0_SRC_SWAP
+			
+			Source memory buffer swapped
+			
+			<legal all>
+*/
+#define CE_STAT_DESC_0_SRC_SWAP_OFFSET                               0x00000000
+#define CE_STAT_DESC_0_SRC_SWAP_LSB                                  9
+#define CE_STAT_DESC_0_SRC_SWAP_MASK                                 0x00000200
+
+/* Description		CE_STAT_DESC_0_DEST_SWAP
+			
+			Destination  memory buffer swapped
+			
+			<legal all>
+*/
+#define CE_STAT_DESC_0_DEST_SWAP_OFFSET                              0x00000000
+#define CE_STAT_DESC_0_DEST_SWAP_LSB                                 10
+#define CE_STAT_DESC_0_DEST_SWAP_MASK                                0x00000400
+
+/* Description		CE_STAT_DESC_0_GATHER
+			
+			Gather of multiple copy engine source descriptors to one
+			destination enabled
+			
+			<legal all>
+*/
+#define CE_STAT_DESC_0_GATHER_OFFSET                                 0x00000000
+#define CE_STAT_DESC_0_GATHER_LSB                                    11
+#define CE_STAT_DESC_0_GATHER_MASK                                   0x00000800
+
+/* Description		CE_STAT_DESC_0_CE_RES_6
+			
+			Reserved
+			
+			<legal all>
+*/
+#define CE_STAT_DESC_0_CE_RES_6_OFFSET                               0x00000000
+#define CE_STAT_DESC_0_CE_RES_6_LSB                                  12
+#define CE_STAT_DESC_0_CE_RES_6_MASK                                 0x0000f000
+
+/* Description		CE_STAT_DESC_0_LENGTH
+			
+			Sum of all the Lengths of the source descriptor in the
+			gather chain
+			
+			<legal all>
+*/
+#define CE_STAT_DESC_0_LENGTH_OFFSET                                 0x00000000
+#define CE_STAT_DESC_0_LENGTH_LSB                                    16
+#define CE_STAT_DESC_0_LENGTH_MASK                                   0xffff0000
+
+/* Description		CE_STAT_DESC_1_TOEPLITZ_HASH_0
+			
+			32 LS bits of 64 bit Toeplitz LFSR hash result
+			
+			<legal all>
+*/
+#define CE_STAT_DESC_1_TOEPLITZ_HASH_0_OFFSET                        0x00000004
+#define CE_STAT_DESC_1_TOEPLITZ_HASH_0_LSB                           0
+#define CE_STAT_DESC_1_TOEPLITZ_HASH_0_MASK                          0xffffffff
+
+/* Description		CE_STAT_DESC_2_TOEPLITZ_HASH_1
+			
+			32 MS bits of 64 bit Toeplitz LFSR hash result
+			
+			<legal all>
+*/
+#define CE_STAT_DESC_2_TOEPLITZ_HASH_1_OFFSET                        0x00000008
+#define CE_STAT_DESC_2_TOEPLITZ_HASH_1_LSB                           0
+#define CE_STAT_DESC_2_TOEPLITZ_HASH_1_MASK                          0xffffffff
+
+/* Description		CE_STAT_DESC_3_FW_METADATA
+			
+			Meta data used by FW
+			
+			In case of gather field in first source ring entry of
+			the gather copy cycle in taken into account.
+			
+			<legal all>
+*/
+#define CE_STAT_DESC_3_FW_METADATA_OFFSET                            0x0000000c
+#define CE_STAT_DESC_3_FW_METADATA_LSB                               0
+#define CE_STAT_DESC_3_FW_METADATA_MASK                              0x0000ffff
+
+/* Description		CE_STAT_DESC_3_CE_RES_7
+			
+			Reserved 
+			
+			<legal all>
+*/
+#define CE_STAT_DESC_3_CE_RES_7_OFFSET                               0x0000000c
+#define CE_STAT_DESC_3_CE_RES_7_LSB                                  16
+#define CE_STAT_DESC_3_CE_RES_7_MASK                                 0x000f0000
+
+/* Description		CE_STAT_DESC_3_RING_ID
+			
+			The buffer pointer ring ID.
+			
+			0 refers to the IDLE ring
+			
+			1 - N refers to other rings
+			
+			
+			
+			Helps with debugging when dumping ring contents.
+			
+			<legal all>
+*/
+#define CE_STAT_DESC_3_RING_ID_OFFSET                                0x0000000c
+#define CE_STAT_DESC_3_RING_ID_LSB                                   20
+#define CE_STAT_DESC_3_RING_ID_MASK                                  0x0ff00000
+
+/* Description		CE_STAT_DESC_3_LOOPING_COUNT
+			
+			A count value that indicates the number of times the
+			producer of entries into the Ring has looped around the
+			ring.
+			
+			At initialization time, this value is set to 0. On the
+			first loop, this value is set to 1. After the max value is
+			reached allowed by the number of bits for this field, the
+			count value continues with 0 again.
+			
+			In case SW is the consumer of the ring entries, it can
+			use this field to figure out up to where the producer of
+			entries has created new entries. This eliminates the need to
+			check where the head pointer' of the ring is located once
+			the SW starts processing an interrupt indicating that new
+			entries have been put into this ring...
+			
+			Also note that SW if it wants only needs to look at the
+			LSB bit of this count value.
+			
+			<legal all>
+*/
+#define CE_STAT_DESC_3_LOOPING_COUNT_OFFSET                          0x0000000c
+#define CE_STAT_DESC_3_LOOPING_COUNT_LSB                             28
+#define CE_STAT_DESC_3_LOOPING_COUNT_MASK                            0xf0000000
+
+
+#endif // _CE_STAT_DESC_H_
--- a/drivers/staging/fw-api/hw/qca5018/com_dtypes.h
+++ b/drivers/staging/fw-api/hw/qca5018/com_dtypes.h
@@ -0,0 +1,300 @@
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for
+ * any purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all
+ * copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL
+ * WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+ * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+
+#ifndef COM_DTYPES_H
+#define COM_DTYPES_H
+
+/**
+  @file com_dtypes.h
+  @brief This header file contains general data types that are of use to all 
+  modules.  
+
+*/
+/*===========================================================================
+NOTE: The @brief description and any detailed descriptions above do not appear 
+      in the PDF. 
+
+      The Utility_Services_API_mainpage.dox file contains all file/group 
+      descriptions that are in the output PDF generated using Doxygen and 
+      Latex. To edit or update any of the file/group text in the PDF, edit 
+      the Utility_Services_API_mainpage.dox file or contact Tech Pubs.
+
+      The above description for this file is part of the "utils_services" 
+	  group description in the Utility_Services_API_mainpage.dox file. 
+===========================================================================*/
+/*===========================================================================
+
+                   S T A N D A R D    D E C L A R A T I O N S
+
+DESCRIPTION
+  This header file contains general data types that are of use to all modules.  
+  The values or definitions are dependent on the specified
+  target.  T_WINNT specifies Windows NT based targets, otherwise the
+  default is for ARM targets.
+
+  T_WINNT  Software is hosted on an NT platforn, triggers macro and
+           type definitions, unlike definition above which triggers
+           actual OS calls
+===========================================================================*/
+
+
+/*===========================================================================
+
+                      EDIT HISTORY FOR FILE
+
+This section contains comments describing changes made to this file.
+Notice that changes are listed in reverse chronological order.
+
+$Header: //depot/prj/qca/lithium3/wcss/maple_verif/native/register/include/com_dtypes.h#1 $
+
+when       who     what, where, why
+--------   ---     ----------------------------------------------------------
+03/21/11   llg     (Tech Pubs) Edited/added Doxygen comments and markup.
+11/09/10   EBR     Doxygenated file.
+09/15/09   pc      Created file.
+===========================================================================*/
+
+
+/*===========================================================================
+
+                            Data Declarations
+
+===========================================================================*/
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* For NT apps we want to use the Win32 definitions and/or those
+ supplied by the Win32 compiler for things like NULL, MAX, MIN
+ abs, labs, etc.
+*/
+#ifdef T_WINNT
+   #ifndef WIN32
+      #define WIN32
+   #endif
+   #include <stdlib.h>
+#endif
+
+/* ------------------------------------------------------------------------
+** Constants
+** ------------------------------------------------------------------------ */
+
+#ifdef TRUE
+#undef TRUE
+#endif
+
+#ifdef FALSE
+#undef FALSE
+#endif
+
+/** @addtogroup utils_services
+@{ */
+
+/** @name Macros for Common Data Types
+@{ */
+#define TRUE   1   /**< Boolean TRUE value. */
+#define FALSE  0   /**< Boolean FALSE value. */
+
+#define  ON   1    /**< ON value. */
+#define  OFF  0    /**< OFF value. */
+
+#ifndef NULL
+  #define NULL  0  /**< NULL value. */  
+#endif
+/** @} */ /* end_name_group Macros for Common Data Types */
+
+/* -----------------------------------------------------------------------
+** Standard Types
+** ----------------------------------------------------------------------- */
+
+/** @} */ /* end_addtogroup utils_services */
+
+/* The following definitions are the same across platforms.  This first
+ group are the sanctioned types.
+*/
+#ifndef _ARM_ASM_
+#ifndef _BOOLEAN_DEFINED
+
+/** @addtogroup utils_services
+@{ */
+/** Boolean value type. 
+*/
+typedef  unsigned char      boolean;     
+#define _BOOLEAN_DEFINED
+#endif
+
+/** @cond 
+*/
+#if defined(DALSTDDEF_H) /* guards against a known re-definer */
+#define _BOOLEAN_DEFINED
+#define _UINT32_DEFINED
+#define _UINT16_DEFINED
+#define _UINT8_DEFINED
+#define _INT32_DEFINED
+#define _INT16_DEFINED
+#define _INT8_DEFINED
+#define _UINT64_DEFINED
+#define _INT64_DEFINED
+#define _BYTE_DEFINED
+#endif /* #if !defined(DALSTDDEF_H) */
+/** @endcond */
+
+#ifndef _UINT32_DEFINED
+/** Unsigned 32-bit value.
+*/
+typedef  unsigned long int  uint32;      
+#define _UINT32_DEFINED
+#endif
+
+#ifndef _UINT16_DEFINED
+/** Unsigned 16-bit value.
+*/
+typedef  unsigned short     uint16;      
+#define _UINT16_DEFINED
+#endif
+
+#ifndef _UINT8_DEFINED
+/** Unsigned 8-bit value. 
+*/
+typedef  unsigned char      uint8;       
+#define _UINT8_DEFINED
+#endif
+
+#ifndef _INT32_DEFINED
+/** Signed 32-bit value.
+*/
+typedef  signed long int    int32;
+#define _INT32_DEFINED
+#endif
+
+#ifndef _INT16_DEFINED
+/** Signed 16-bit value.
+*/
+typedef  signed short       int16;
+#define _INT16_DEFINED
+#endif
+
+#ifndef _INT8_DEFINED
+/** Signed 8-bit value.
+*/
+typedef  signed char        int8;        
+#define _INT8_DEFINED
+#endif
+
+/** @cond
+*/
+/* This group are the deprecated types.  Their use should be
+** discontinued and new code should use the types above
+*/
+#ifndef _BYTE_DEFINED
+/** DEPRECATED: Unsigned 8  bit value type.
+*/
+typedef  unsigned char      byte;         
+#define  _BYTE_DEFINED
+#endif
+
+/** DEPRECATED: Unsinged 16 bit value type.
+*/
+typedef  unsigned short     word;
+/** DEPRECATED: Unsigned 32 bit value type.
+*/
+typedef  unsigned long      dword;        
+
+/** DEPRECATED: Unsigned 8  bit value type.
+*/
+typedef  unsigned char      uint1;
+/** DEPRECATED: Unsigned 16 bit value type.
+*/
+typedef  unsigned short     uint2;
+/** DEPRECATED: Unsigned 32 bit value type.
+*/
+typedef  unsigned long      uint4;        
+
+/** DEPRECATED: Signed 8  bit value type. 
+*/
+typedef  signed char        int1;
+/** DEPRECATED: Signed 16 bit value type.
+*/         
+typedef  signed short       int2;
+/** DEPRECATED: Signed 32 bit value type. 
+*/     
+typedef  long int           int4;         
+
+/** DEPRECATED: Signed 32 bit value.
+*/
+typedef  signed long        sint31;
+/** DEPRECATED: Signed 16 bit value. 
+*/       
+typedef  signed short       sint15;
+/** DEPRECATED: Signed 8  bit value.
+*/       
+typedef  signed char        sint7; 
+
+typedef uint16 UWord16 ;
+typedef uint32 UWord32 ;
+typedef int32  Word32 ;
+typedef int16  Word16 ;
+typedef uint8  UWord8 ;
+typedef int8   Word8 ;
+typedef int32  Vect32 ;
+/** @endcond */
+
+#if (! defined T_WINNT) && (! defined __GNUC__)
+  /* Non WinNT Targets */
+  #ifndef _INT64_DEFINED
+    /** Signed 64-bit value.
+	*/
+    typedef long long     int64;       
+    #define _INT64_DEFINED
+  #endif
+  #ifndef _UINT64_DEFINED
+    /** Unsigned 64-bit value.
+	*/
+    typedef  unsigned long long  uint64;      
+    #define _UINT64_DEFINED
+  #endif
+#else /* T_WINNT || TARGET_OS_SOLARIS || __GNUC__ */
+  /* WINNT or SOLARIS based targets */
+  #if (defined __GNUC__) 
+    #ifndef _INT64_DEFINED
+      typedef long long           int64;
+      #define _INT64_DEFINED
+    #endif
+    #ifndef _UINT64_DEFINED
+      typedef unsigned long long  uint64;
+      #define _UINT64_DEFINED
+    #endif
+  #else
+    typedef  __int64              int64;       /* Signed 64-bit value */
+    #ifndef _UINT64_DEFINED
+      typedef  unsigned __int64   uint64;      /* Unsigned 64-bit value */
+      #define _UINT64_DEFINED
+    #endif
+  #endif
+#endif /* T_WINNT */
+
+#endif /* _ARM_ASM_ */
+
+#ifdef __cplusplus
+}
+#endif
+
+/** @} */ /* end_addtogroup utils_services */
+#endif  /* COM_DTYPES_H */
--- a/drivers/staging/fw-api/hw/qca5018/he_sig_a_mu_dl_info.h
+++ b/drivers/staging/fw-api/hw/qca5018/he_sig_a_mu_dl_info.h
@@ -0,0 +1,686 @@
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _HE_SIG_A_MU_DL_INFO_H_
+#define _HE_SIG_A_MU_DL_INFO_H_
+#if !defined(__ASSEMBLER__)
+#endif
+
+
+// ################ START SUMMARY #################
+//
+//	Dword	Fields
+//	0	dl_ul_flag[0], mcs_of_sig_b[3:1], dcm_of_sig_b[4], bss_color_id[10:5], spatial_reuse[14:11], transmit_bw[17:15], num_sig_b_symbols[21:18], comp_mode_sig_b[22], cp_ltf_size[24:23], doppler_indication[25], reserved_0a[31:26]
+//	1	txop_duration[6:0], reserved_1a[7], num_ltf_symbols[10:8], ldpc_extra_symbol[11], stbc[12], packet_extension_a_factor[14:13], packet_extension_pe_disambiguity[15], crc[19:16], tail[25:20], reserved_1b[31:26]
+//
+// ################ END SUMMARY #################
+
+#define NUM_OF_DWORDS_HE_SIG_A_MU_DL_INFO 2
+
+struct he_sig_a_mu_dl_info {
+             uint32_t dl_ul_flag                      :  1, //[0]
+                      mcs_of_sig_b                    :  3, //[3:1]
+                      dcm_of_sig_b                    :  1, //[4]
+                      bss_color_id                    :  6, //[10:5]
+                      spatial_reuse                   :  4, //[14:11]
+                      transmit_bw                     :  3, //[17:15]
+                      num_sig_b_symbols               :  4, //[21:18]
+                      comp_mode_sig_b                 :  1, //[22]
+                      cp_ltf_size                     :  2, //[24:23]
+                      doppler_indication              :  1, //[25]
+                      reserved_0a                     :  6; //[31:26]
+             uint32_t txop_duration                   :  7, //[6:0]
+                      reserved_1a                     :  1, //[7]
+                      num_ltf_symbols                 :  3, //[10:8]
+                      ldpc_extra_symbol               :  1, //[11]
+                      stbc                            :  1, //[12]
+                      packet_extension_a_factor       :  2, //[14:13]
+                      packet_extension_pe_disambiguity:  1, //[15]
+                      crc                             :  4, //[19:16]
+                      tail                            :  6, //[25:20]
+                      reserved_1b                     :  6; //[31:26]
+};
+
+/*
+
+dl_ul_flag
+			
+			Differentiates between DL and UL transmission 
+			
+			
+			
+			<enum 0 DL_UL_FLAG_IS_DL_OR_TDLS>
+			
+			<enum 1 DL_UL_FLAG_IS_UL>
+			
+			NOTE: This is unsupported for HE MU format (including
+			MU_SU) Tx in Napier and Hastings80.
+			
+			<legal all>
+
+mcs_of_sig_b
+			
+			Indicates the MCS of HE-SIG-B
+			
+			<legal 0-5>
+
+dcm_of_sig_b
+			
+			Indicates whether dual sub-carrier modulation is applied
+			to HE-SIG-B 
+			
+			
+			
+			0: No DCM for HE_SIG_B
+			
+			1: DCM for HE_SIG_B
+			
+			<legal all>
+
+bss_color_id
+			
+			BSS color ID 
+			
+			
+			
+			Field Used by MAC HW
+			
+			<legal all>
+
+spatial_reuse
+			
+			Spatial reuse
+			
+			
+			
+			For 20MHz one SR field corresponding to entire 20MHz
+			(other 3 fields indicate identical values)
+			
+			For 40MHz two SR fields for each 20MHz (other 2 fields
+			indicate identical values)
+			
+			For 80MHz four SR fields for each 20MHz
+			
+			For 160MHz four SR fields for each 40MHz
+			
+			<legal all>
+
+transmit_bw
+			
+			Bandwidth of the PPDU.
+			
+			
+			
+			<enum 0 HE_SIG_A_MU_DL_BW20> 20 Mhz 
+			
+			<enum 1 HE_SIG_A_MU_DL_BW40> 40 Mhz 
+			
+			<enum 2 HE_SIG_A_MU_DL_BW80> 80 MHz non-preamble
+			puncturing mode
+			
+			<enum 3 HE_SIG_A_MU_DL_BW160> 160 MHz and 80+80 MHz
+			non-preamble puncturing mode
+			
+			<enum 4 HE_SIG_A_MU_DL_BW80_SEC_20_PUNC> for preamble
+			puncturing in 80 MHz, where in the preamble only the
+			secondary 20 MHz is punctured
+			
+			<enum 5 HE_SIG_A_MU_DL_BW80_20_PUNC_IN_SEC_40> for
+			preamble puncturing in 80 MHz, where in the preamble only
+			one of the two 20 MHz sub-channels in secondary 40 MHz is
+			punctured.
+			
+			<enum 6 HE_SIG_A_MU_DL_BW160_SEC_20_PUNC> for preamble
+			puncturing in 160 MHz or 80+80 MHz, where in the primary 80
+			MHz of the preamble only the secondary 20 MHz is punctured.
+			
+			<enum 7 HE_SIG_A_MU_DL_BW160_SEC_40_80_PUNC> for
+			preamble puncturing in 160 MHz or 80+80 MHz, where in the
+			primary 80 MHz of the preamble the primary 40 MHz is
+			present.
+			
+			
+			
+			On RX side, Field Used by MAC HW
+			
+			<legal 0-7>
+
+num_sig_b_symbols
+			
+			Number of symbols
+			
+			
+			
+			For OFDMA, the actual number of symbols is 1 larger then
+			indicated in this field.
+			
+			
+			
+			For MU-MIMO this is equal to the number of users - 1:
+			the following encoding is used:
+			
+			1 => 2 users
+			
+			2 => 3 users
+			
+			Etc.
+			
+			
+			
+			<legal all>
+
+comp_mode_sig_b
+			
+			Indicates the compression mode of HE-SIG-B
+			
+			
+			
+			0: Regular [uncomp mode]
+			
+			1: compressed mode (full-BW MU-MIMO only) 
+			
+			<legal all>
+
+cp_ltf_size
+			
+			Indicates the CP and HE-LTF type 
+			
+			
+			
+			<enum 0 MU_FourX_LTF_0_8CP> 4xLTF + 0.8 us CP
+			
+			<enum 1 MU_TwoX_LTF_0_8CP> 2x LTF + 0.8 µs CP
+			
+			<enum 2 MU_TwoX_LTF_1_6CP> 2x LTF + 1.6 µs CP
+			
+			<enum 3 MU_FourX_LTF_3_2CP> 4x LTF + 3.2 µs CP 
+			
+			
+			
+			
+			
+			<legal all>
+
+doppler_indication
+			
+			0: No Doppler support
+			
+			1: Doppler support
+			
+			<legal all>
+
+reserved_0a
+			
+			<legal 0>
+
+txop_duration
+			
+			Indicates the remaining time in the current TXOP
+			
+			
+			
+			Field Used by MAC HW
+			
+			 <legal all>
+
+reserved_1a
+			
+			Note: spec indicates this shall be set to 1
+			
+			<legal 1>
+
+num_ltf_symbols
+			
+			Indicates the number of HE-LTF symbols
+			
+			
+			
+			0: 1 LTF
+			
+			1: 2 LTFs
+			
+			2: 4 LTFs
+			
+			3: 6 LTFs
+			
+			4: 8 LTFs
+			
+			
+			
+			<legal all>
+
+ldpc_extra_symbol
+			
+			If LDPC, 
+			
+			  0: LDPC extra symbol not present
+			
+			  1: LDPC extra symbol present
+			
+			Else 
+			
+			  Set to 1
+			
+			<legal all>
+
+stbc
+			
+			Indicates whether STBC is applied
+			
+			0: No STBC
+			
+			1: STBC
+			
+			<legal all>
+
+packet_extension_a_factor
+			
+			the packet extension duration of the trigger-based PPDU
+			response with these two bits indicating the a-factor 
+			
+			
+			
+			<enum 0 a_factor_4>
+			
+			<enum 1 a_factor_1>
+			
+			<enum 2 a_factor_2>
+			
+			<enum 3 a_factor_3>
+			
+			
+			
+			<legal all>
+
+packet_extension_pe_disambiguity
+			
+			the packet extension duration of the trigger-based PPDU
+			response with this bit indicating the PE-Disambiguity 
+			
+			<legal all>
+
+crc
+			
+			CRC for HE-SIG-A contents.
+			
+			<legal all>
+
+tail
+			
+			<legal 0>
+
+reserved_1b
+			
+			<legal 0>
+*/
+
+
+/* Description		HE_SIG_A_MU_DL_INFO_0_DL_UL_FLAG
+			
+			Differentiates between DL and UL transmission 
+			
+			
+			
+			<enum 0 DL_UL_FLAG_IS_DL_OR_TDLS>
+			
+			<enum 1 DL_UL_FLAG_IS_UL>
+			
+			NOTE: This is unsupported for HE MU format (including
+			MU_SU) Tx in Napier and Hastings80.
+			
+			<legal all>
+*/
+#define HE_SIG_A_MU_DL_INFO_0_DL_UL_FLAG_OFFSET                      0x00000000
+#define HE_SIG_A_MU_DL_INFO_0_DL_UL_FLAG_LSB                         0
+#define HE_SIG_A_MU_DL_INFO_0_DL_UL_FLAG_MASK                        0x00000001
+
+/* Description		HE_SIG_A_MU_DL_INFO_0_MCS_OF_SIG_B
+			
+			Indicates the MCS of HE-SIG-B
+			
+			<legal 0-5>
+*/
+#define HE_SIG_A_MU_DL_INFO_0_MCS_OF_SIG_B_OFFSET                    0x00000000
+#define HE_SIG_A_MU_DL_INFO_0_MCS_OF_SIG_B_LSB                       1
+#define HE_SIG_A_MU_DL_INFO_0_MCS_OF_SIG_B_MASK                      0x0000000e
+
+/* Description		HE_SIG_A_MU_DL_INFO_0_DCM_OF_SIG_B
+			
+			Indicates whether dual sub-carrier modulation is applied
+			to HE-SIG-B 
+			
+			
+			
+			0: No DCM for HE_SIG_B
+			
+			1: DCM for HE_SIG_B
+			
+			<legal all>
+*/
+#define HE_SIG_A_MU_DL_INFO_0_DCM_OF_SIG_B_OFFSET                    0x00000000
+#define HE_SIG_A_MU_DL_INFO_0_DCM_OF_SIG_B_LSB                       4
+#define HE_SIG_A_MU_DL_INFO_0_DCM_OF_SIG_B_MASK                      0x00000010
+
+/* Description		HE_SIG_A_MU_DL_INFO_0_BSS_COLOR_ID
+			
+			BSS color ID 
+			
+			
+			
+			Field Used by MAC HW
+			
+			<legal all>
+*/
+#define HE_SIG_A_MU_DL_INFO_0_BSS_COLOR_ID_OFFSET                    0x00000000
+#define HE_SIG_A_MU_DL_INFO_0_BSS_COLOR_ID_LSB                       5
+#define HE_SIG_A_MU_DL_INFO_0_BSS_COLOR_ID_MASK                      0x000007e0
+
+/* Description		HE_SIG_A_MU_DL_INFO_0_SPATIAL_REUSE
+			
+			Spatial reuse
+			
+			
+			
+			For 20MHz one SR field corresponding to entire 20MHz
+			(other 3 fields indicate identical values)
+			
+			For 40MHz two SR fields for each 20MHz (other 2 fields
+			indicate identical values)
+			
+			For 80MHz four SR fields for each 20MHz
+			
+			For 160MHz four SR fields for each 40MHz
+			
+			<legal all>
+*/
+#define HE_SIG_A_MU_DL_INFO_0_SPATIAL_REUSE_OFFSET                   0x00000000
+#define HE_SIG_A_MU_DL_INFO_0_SPATIAL_REUSE_LSB                      11
+#define HE_SIG_A_MU_DL_INFO_0_SPATIAL_REUSE_MASK                     0x00007800
+
+/* Description		HE_SIG_A_MU_DL_INFO_0_TRANSMIT_BW
+			
+			Bandwidth of the PPDU.
+			
+			
+			
+			<enum 0 HE_SIG_A_MU_DL_BW20> 20 Mhz 
+			
+			<enum 1 HE_SIG_A_MU_DL_BW40> 40 Mhz 
+			
+			<enum 2 HE_SIG_A_MU_DL_BW80> 80 MHz non-preamble
+			puncturing mode
+			
+			<enum 3 HE_SIG_A_MU_DL_BW160> 160 MHz and 80+80 MHz
+			non-preamble puncturing mode
+			
+			<enum 4 HE_SIG_A_MU_DL_BW80_SEC_20_PUNC> for preamble
+			puncturing in 80 MHz, where in the preamble only the
+			secondary 20 MHz is punctured
+			
+			<enum 5 HE_SIG_A_MU_DL_BW80_20_PUNC_IN_SEC_40> for
+			preamble puncturing in 80 MHz, where in the preamble only
+			one of the two 20 MHz sub-channels in secondary 40 MHz is
+			punctured.
+			
+			<enum 6 HE_SIG_A_MU_DL_BW160_SEC_20_PUNC> for preamble
+			puncturing in 160 MHz or 80+80 MHz, where in the primary 80
+			MHz of the preamble only the secondary 20 MHz is punctured.
+			
+			<enum 7 HE_SIG_A_MU_DL_BW160_SEC_40_80_PUNC> for
+			preamble puncturing in 160 MHz or 80+80 MHz, where in the
+			primary 80 MHz of the preamble the primary 40 MHz is
+			present.
+			
+			
+			
+			On RX side, Field Used by MAC HW
+			
+			<legal 0-7>
+*/
+#define HE_SIG_A_MU_DL_INFO_0_TRANSMIT_BW_OFFSET                     0x00000000
+#define HE_SIG_A_MU_DL_INFO_0_TRANSMIT_BW_LSB                        15
+#define HE_SIG_A_MU_DL_INFO_0_TRANSMIT_BW_MASK                       0x00038000
+
+/* Description		HE_SIG_A_MU_DL_INFO_0_NUM_SIG_B_SYMBOLS
+			
+			Number of symbols
+			
+			
+			
+			For OFDMA, the actual number of symbols is 1 larger then
+			indicated in this field.
+			
+			
+			
+			For MU-MIMO this is equal to the number of users - 1:
+			the following encoding is used:
+			
+			1 => 2 users
+			
+			2 => 3 users
+			
+			Etc.
+			
+			
+			
+			<legal all>
+*/
+#define HE_SIG_A_MU_DL_INFO_0_NUM_SIG_B_SYMBOLS_OFFSET               0x00000000
+#define HE_SIG_A_MU_DL_INFO_0_NUM_SIG_B_SYMBOLS_LSB                  18
+#define HE_SIG_A_MU_DL_INFO_0_NUM_SIG_B_SYMBOLS_MASK                 0x003c0000
+
+/* Description		HE_SIG_A_MU_DL_INFO_0_COMP_MODE_SIG_B
+			
+			Indicates the compression mode of HE-SIG-B
+			
+			
+			
+			0: Regular [uncomp mode]
+			
+			1: compressed mode (full-BW MU-MIMO only) 
+			
+			<legal all>
+*/
+#define HE_SIG_A_MU_DL_INFO_0_COMP_MODE_SIG_B_OFFSET                 0x00000000
+#define HE_SIG_A_MU_DL_INFO_0_COMP_MODE_SIG_B_LSB                    22
+#define HE_SIG_A_MU_DL_INFO_0_COMP_MODE_SIG_B_MASK                   0x00400000
+
+/* Description		HE_SIG_A_MU_DL_INFO_0_CP_LTF_SIZE
+			
+			Indicates the CP and HE-LTF type 
+			
+			
+			
+			<enum 0 MU_FourX_LTF_0_8CP> 4xLTF + 0.8 us CP
+			
+			<enum 1 MU_TwoX_LTF_0_8CP> 2x LTF + 0.8 µs CP
+			
+			<enum 2 MU_TwoX_LTF_1_6CP> 2x LTF + 1.6 µs CP
+			
+			<enum 3 MU_FourX_LTF_3_2CP> 4x LTF + 3.2 µs CP 
+			
+			
+			
+			
+			
+			<legal all>
+*/
+#define HE_SIG_A_MU_DL_INFO_0_CP_LTF_SIZE_OFFSET                     0x00000000
+#define HE_SIG_A_MU_DL_INFO_0_CP_LTF_SIZE_LSB                        23
+#define HE_SIG_A_MU_DL_INFO_0_CP_LTF_SIZE_MASK                       0x01800000
+
+/* Description		HE_SIG_A_MU_DL_INFO_0_DOPPLER_INDICATION
+			
+			0: No Doppler support
+			
+			1: Doppler support
+			
+			<legal all>
+*/
+#define HE_SIG_A_MU_DL_INFO_0_DOPPLER_INDICATION_OFFSET              0x00000000
+#define HE_SIG_A_MU_DL_INFO_0_DOPPLER_INDICATION_LSB                 25
+#define HE_SIG_A_MU_DL_INFO_0_DOPPLER_INDICATION_MASK                0x02000000
+
+/* Description		HE_SIG_A_MU_DL_INFO_0_RESERVED_0A
+			
+			<legal 0>
+*/
+#define HE_SIG_A_MU_DL_INFO_0_RESERVED_0A_OFFSET                     0x00000000
+#define HE_SIG_A_MU_DL_INFO_0_RESERVED_0A_LSB                        26
+#define HE_SIG_A_MU_DL_INFO_0_RESERVED_0A_MASK                       0xfc000000
+
+/* Description		HE_SIG_A_MU_DL_INFO_1_TXOP_DURATION
+			
+			Indicates the remaining time in the current TXOP
+			
+			
+			
+			Field Used by MAC HW
+			
+			 <legal all>
+*/
+#define HE_SIG_A_MU_DL_INFO_1_TXOP_DURATION_OFFSET                   0x00000004
+#define HE_SIG_A_MU_DL_INFO_1_TXOP_DURATION_LSB                      0
+#define HE_SIG_A_MU_DL_INFO_1_TXOP_DURATION_MASK                     0x0000007f
+
+/* Description		HE_SIG_A_MU_DL_INFO_1_RESERVED_1A
+			
+			Note: spec indicates this shall be set to 1
+			
+			<legal 1>
+*/
+#define HE_SIG_A_MU_DL_INFO_1_RESERVED_1A_OFFSET                     0x00000004
+#define HE_SIG_A_MU_DL_INFO_1_RESERVED_1A_LSB                        7
+#define HE_SIG_A_MU_DL_INFO_1_RESERVED_1A_MASK                       0x00000080
+
+/* Description		HE_SIG_A_MU_DL_INFO_1_NUM_LTF_SYMBOLS
+			
+			Indicates the number of HE-LTF symbols
+			
+			
+			
+			0: 1 LTF
+			
+			1: 2 LTFs
+			
+			2: 4 LTFs
+			
+			3: 6 LTFs
+			
+			4: 8 LTFs
+			
+			
+			
+			<legal all>
+*/
+#define HE_SIG_A_MU_DL_INFO_1_NUM_LTF_SYMBOLS_OFFSET                 0x00000004
+#define HE_SIG_A_MU_DL_INFO_1_NUM_LTF_SYMBOLS_LSB                    8
+#define HE_SIG_A_MU_DL_INFO_1_NUM_LTF_SYMBOLS_MASK                   0x00000700
+
+/* Description		HE_SIG_A_MU_DL_INFO_1_LDPC_EXTRA_SYMBOL
+			
+			If LDPC, 
+			
+			  0: LDPC extra symbol not present
+			
+			  1: LDPC extra symbol present
+			
+			Else 
+			
+			  Set to 1
+			
+			<legal all>
+*/
+#define HE_SIG_A_MU_DL_INFO_1_LDPC_EXTRA_SYMBOL_OFFSET               0x00000004
+#define HE_SIG_A_MU_DL_INFO_1_LDPC_EXTRA_SYMBOL_LSB                  11
+#define HE_SIG_A_MU_DL_INFO_1_LDPC_EXTRA_SYMBOL_MASK                 0x00000800
+
+/* Description		HE_SIG_A_MU_DL_INFO_1_STBC
+			
+			Indicates whether STBC is applied
+			
+			0: No STBC
+			
+			1: STBC
+			
+			<legal all>
+*/
+#define HE_SIG_A_MU_DL_INFO_1_STBC_OFFSET                            0x00000004
+#define HE_SIG_A_MU_DL_INFO_1_STBC_LSB                               12
+#define HE_SIG_A_MU_DL_INFO_1_STBC_MASK                              0x00001000
+
+/* Description		HE_SIG_A_MU_DL_INFO_1_PACKET_EXTENSION_A_FACTOR
+			
+			the packet extension duration of the trigger-based PPDU
+			response with these two bits indicating the a-factor 
+			
+			
+			
+			<enum 0 a_factor_4>
+			
+			<enum 1 a_factor_1>
+			
+			<enum 2 a_factor_2>
+			
+			<enum 3 a_factor_3>
+			
+			
+			
+			<legal all>
+*/
+#define HE_SIG_A_MU_DL_INFO_1_PACKET_EXTENSION_A_FACTOR_OFFSET       0x00000004
+#define HE_SIG_A_MU_DL_INFO_1_PACKET_EXTENSION_A_FACTOR_LSB          13
+#define HE_SIG_A_MU_DL_INFO_1_PACKET_EXTENSION_A_FACTOR_MASK         0x00006000
+
+/* Description		HE_SIG_A_MU_DL_INFO_1_PACKET_EXTENSION_PE_DISAMBIGUITY
+			
+			the packet extension duration of the trigger-based PPDU
+			response with this bit indicating the PE-Disambiguity 
+			
+			<legal all>
+*/
+#define HE_SIG_A_MU_DL_INFO_1_PACKET_EXTENSION_PE_DISAMBIGUITY_OFFSET 0x00000004
+#define HE_SIG_A_MU_DL_INFO_1_PACKET_EXTENSION_PE_DISAMBIGUITY_LSB   15
+#define HE_SIG_A_MU_DL_INFO_1_PACKET_EXTENSION_PE_DISAMBIGUITY_MASK  0x00008000
+
+/* Description		HE_SIG_A_MU_DL_INFO_1_CRC
+			
+			CRC for HE-SIG-A contents.
+			
+			<legal all>
+*/
+#define HE_SIG_A_MU_DL_INFO_1_CRC_OFFSET                             0x00000004
+#define HE_SIG_A_MU_DL_INFO_1_CRC_LSB                                16
+#define HE_SIG_A_MU_DL_INFO_1_CRC_MASK                               0x000f0000
+
+/* Description		HE_SIG_A_MU_DL_INFO_1_TAIL
+			
+			<legal 0>
+*/
+#define HE_SIG_A_MU_DL_INFO_1_TAIL_OFFSET                            0x00000004
+#define HE_SIG_A_MU_DL_INFO_1_TAIL_LSB                               20
+#define HE_SIG_A_MU_DL_INFO_1_TAIL_MASK                              0x03f00000
+
+/* Description		HE_SIG_A_MU_DL_INFO_1_RESERVED_1B
+			
+			<legal 0>
+*/
+#define HE_SIG_A_MU_DL_INFO_1_RESERVED_1B_OFFSET                     0x00000004
+#define HE_SIG_A_MU_DL_INFO_1_RESERVED_1B_LSB                        26
+#define HE_SIG_A_MU_DL_INFO_1_RESERVED_1B_MASK                       0xfc000000
+
+
+#endif // _HE_SIG_A_MU_DL_INFO_H_
--- a/drivers/staging/fw-api/hw/qca5018/he_sig_a_mu_ul_info.h
+++ b/drivers/staging/fw-api/hw/qca5018/he_sig_a_mu_ul_info.h
@@ -0,0 +1,266 @@
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _HE_SIG_A_MU_UL_INFO_H_
+#define _HE_SIG_A_MU_UL_INFO_H_
+#if !defined(__ASSEMBLER__)
+#endif
+
+
+// ################ START SUMMARY #################
+//
+//	Dword	Fields
+//	0	format_indication[0], bss_color_id[6:1], spatial_reuse[22:7], reserved_0a[23], transmit_bw[25:24], reserved_0b[31:26]
+//	1	txop_duration[6:0], reserved_1a[15:7], crc[19:16], tail[25:20], reserved_1b[31:26]
+//
+// ################ END SUMMARY #################
+
+#define NUM_OF_DWORDS_HE_SIG_A_MU_UL_INFO 2
+
+struct he_sig_a_mu_ul_info {
+             uint32_t format_indication               :  1, //[0]
+                      bss_color_id                    :  6, //[6:1]
+                      spatial_reuse                   : 16, //[22:7]
+                      reserved_0a                     :  1, //[23]
+                      transmit_bw                     :  2, //[25:24]
+                      reserved_0b                     :  6; //[31:26]
+             uint32_t txop_duration                   :  7, //[6:0]
+                      reserved_1a                     :  9, //[15:7]
+                      crc                             :  4, //[19:16]
+                      tail                            :  6, //[25:20]
+                      reserved_1b                     :  6; //[31:26]
+};
+
+/*
+
+format_indication
+			
+			Indicates whether the transmission is SU PPDU or a
+			trigger based UL MU PDDU
+			
+			<enum 0 HE_SIGA_FORMAT_HE_TRIG>
+			
+			<enum 1 HE_SIGA_FORMAT_SU_OR_EXT_SU>
+			
+			<legal all>
+
+bss_color_id
+			
+			BSS color ID 
+			
+			<legal all>
+
+spatial_reuse
+			
+			Spatial reuse
+			
+			
+			
+			<legal all>
+
+reserved_0a
+			
+			Note: spec indicates this shall be set to 1
+			
+			<legal 1>
+
+transmit_bw
+			
+			Bandwidth of the PPDU.
+			
+			
+			
+			<enum 0 HE_SIG_A_MU_UL_BW20> 20 Mhz 
+			
+			<enum 1 HE_SIG_A_MU_UL_BW40> 40 Mhz 
+			
+			<enum 2 HE_SIG_A_MU_UL_BW80> 80 Mhz 
+			
+			<enum 3 HE_SIG_A_MU_UL_BW160> 160 MHz or 80+80 MHz
+			
+			
+			
+			On RX side, Field Used by MAC HW
+			
+			<legal 0-3>
+
+reserved_0b
+			
+			<legal 0>
+
+txop_duration
+			
+			Indicates the remaining time in the current TXOP <legal
+			all>
+
+reserved_1a
+			
+			Set to value indicated in the trigger frame
+			
+			<legal 255>
+
+crc
+			
+			CRC for HE-SIG-A contents.
+			
+			This CRC may also cover some fields of L-SIG (TBD)
+			
+			<legal all>
+
+tail
+			
+			BCC encoding (similar to VHT-SIG-A) with 6 tail bits is
+			used
+			
+			<legal 0>
+
+reserved_1b
+			
+			<legal 0>
+*/
+
+
+/* Description		HE_SIG_A_MU_UL_INFO_0_FORMAT_INDICATION
+			
+			Indicates whether the transmission is SU PPDU or a
+			trigger based UL MU PDDU
+			
+			<enum 0 HE_SIGA_FORMAT_HE_TRIG>
+			
+			<enum 1 HE_SIGA_FORMAT_SU_OR_EXT_SU>
+			
+			<legal all>
+*/
+#define HE_SIG_A_MU_UL_INFO_0_FORMAT_INDICATION_OFFSET               0x00000000
+#define HE_SIG_A_MU_UL_INFO_0_FORMAT_INDICATION_LSB                  0
+#define HE_SIG_A_MU_UL_INFO_0_FORMAT_INDICATION_MASK                 0x00000001
+
+/* Description		HE_SIG_A_MU_UL_INFO_0_BSS_COLOR_ID
+			
+			BSS color ID 
+			
+			<legal all>
+*/
+#define HE_SIG_A_MU_UL_INFO_0_BSS_COLOR_ID_OFFSET                    0x00000000
+#define HE_SIG_A_MU_UL_INFO_0_BSS_COLOR_ID_LSB                       1
+#define HE_SIG_A_MU_UL_INFO_0_BSS_COLOR_ID_MASK                      0x0000007e
+
+/* Description		HE_SIG_A_MU_UL_INFO_0_SPATIAL_REUSE
+			
+			Spatial reuse
+			
+			
+			
+			<legal all>
+*/
+#define HE_SIG_A_MU_UL_INFO_0_SPATIAL_REUSE_OFFSET                   0x00000000
+#define HE_SIG_A_MU_UL_INFO_0_SPATIAL_REUSE_LSB                      7
+#define HE_SIG_A_MU_UL_INFO_0_SPATIAL_REUSE_MASK                     0x007fff80
+
+/* Description		HE_SIG_A_MU_UL_INFO_0_RESERVED_0A
+			
+			Note: spec indicates this shall be set to 1
+			
+			<legal 1>
+*/
+#define HE_SIG_A_MU_UL_INFO_0_RESERVED_0A_OFFSET                     0x00000000
+#define HE_SIG_A_MU_UL_INFO_0_RESERVED_0A_LSB                        23
+#define HE_SIG_A_MU_UL_INFO_0_RESERVED_0A_MASK                       0x00800000
+
+/* Description		HE_SIG_A_MU_UL_INFO_0_TRANSMIT_BW
+			
+			Bandwidth of the PPDU.
+			
+			
+			
+			<enum 0 HE_SIG_A_MU_UL_BW20> 20 Mhz 
+			
+			<enum 1 HE_SIG_A_MU_UL_BW40> 40 Mhz 
+			
+			<enum 2 HE_SIG_A_MU_UL_BW80> 80 Mhz 
+			
+			<enum 3 HE_SIG_A_MU_UL_BW160> 160 MHz or 80+80 MHz
+			
+			
+			
+			On RX side, Field Used by MAC HW
+			
+			<legal 0-3>
+*/
+#define HE_SIG_A_MU_UL_INFO_0_TRANSMIT_BW_OFFSET                     0x00000000
+#define HE_SIG_A_MU_UL_INFO_0_TRANSMIT_BW_LSB                        24
+#define HE_SIG_A_MU_UL_INFO_0_TRANSMIT_BW_MASK                       0x03000000
+
+/* Description		HE_SIG_A_MU_UL_INFO_0_RESERVED_0B
+			
+			<legal 0>
+*/
+#define HE_SIG_A_MU_UL_INFO_0_RESERVED_0B_OFFSET                     0x00000000
+#define HE_SIG_A_MU_UL_INFO_0_RESERVED_0B_LSB                        26
+#define HE_SIG_A_MU_UL_INFO_0_RESERVED_0B_MASK                       0xfc000000
+
+/* Description		HE_SIG_A_MU_UL_INFO_1_TXOP_DURATION
+			
+			Indicates the remaining time in the current TXOP <legal
+			all>
+*/
+#define HE_SIG_A_MU_UL_INFO_1_TXOP_DURATION_OFFSET                   0x00000004
+#define HE_SIG_A_MU_UL_INFO_1_TXOP_DURATION_LSB                      0
+#define HE_SIG_A_MU_UL_INFO_1_TXOP_DURATION_MASK                     0x0000007f
+
+/* Description		HE_SIG_A_MU_UL_INFO_1_RESERVED_1A
+			
+			Set to value indicated in the trigger frame
+			
+			<legal 255>
+*/
+#define HE_SIG_A_MU_UL_INFO_1_RESERVED_1A_OFFSET                     0x00000004
+#define HE_SIG_A_MU_UL_INFO_1_RESERVED_1A_LSB                        7
+#define HE_SIG_A_MU_UL_INFO_1_RESERVED_1A_MASK                       0x0000ff80
+
+/* Description		HE_SIG_A_MU_UL_INFO_1_CRC
+			
+			CRC for HE-SIG-A contents.
+			
+			This CRC may also cover some fields of L-SIG (TBD)
+			
+			<legal all>
+*/
+#define HE_SIG_A_MU_UL_INFO_1_CRC_OFFSET                             0x00000004
+#define HE_SIG_A_MU_UL_INFO_1_CRC_LSB                                16
+#define HE_SIG_A_MU_UL_INFO_1_CRC_MASK                               0x000f0000
+
+/* Description		HE_SIG_A_MU_UL_INFO_1_TAIL
+			
+			BCC encoding (similar to VHT-SIG-A) with 6 tail bits is
+			used
+			
+			<legal 0>
+*/
+#define HE_SIG_A_MU_UL_INFO_1_TAIL_OFFSET                            0x00000004
+#define HE_SIG_A_MU_UL_INFO_1_TAIL_LSB                               20
+#define HE_SIG_A_MU_UL_INFO_1_TAIL_MASK                              0x03f00000
+
+/* Description		HE_SIG_A_MU_UL_INFO_1_RESERVED_1B
+			
+			<legal 0>
+*/
+#define HE_SIG_A_MU_UL_INFO_1_RESERVED_1B_OFFSET                     0x00000004
+#define HE_SIG_A_MU_UL_INFO_1_RESERVED_1B_LSB                        26
+#define HE_SIG_A_MU_UL_INFO_1_RESERVED_1B_MASK                       0xfc000000
+
+
+#endif // _HE_SIG_A_MU_UL_INFO_H_
--- a/drivers/staging/fw-api/hw/qca5018/he_sig_a_su_info.h
+++ b/drivers/staging/fw-api/hw/qca5018/he_sig_a_su_info.h
@@ -0,0 +1,832 @@
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _HE_SIG_A_SU_INFO_H_
+#define _HE_SIG_A_SU_INFO_H_
+#if !defined(__ASSEMBLER__)
+#endif
+
+
+// ################ START SUMMARY #################
+//
+//	Dword	Fields
+//	0	format_indication[0], beam_change[1], dl_ul_flag[2], transmit_mcs[6:3], dcm[7], bss_color_id[13:8], reserved_0a[14], spatial_reuse[18:15], transmit_bw[20:19], cp_ltf_size[22:21], nsts[25:23], reserved_0b[31:26]
+//	1	txop_duration[6:0], coding[7], ldpc_extra_symbol[8], stbc[9], txbf[10], packet_extension_a_factor[12:11], packet_extension_pe_disambiguity[13], reserved_1a[14], doppler_indication[15], crc[19:16], tail[25:20], dot11ax_su_extended[26], dot11ax_ext_ru_size[30:27], rx_ndp[31]
+//
+// ################ END SUMMARY #################
+
+#define NUM_OF_DWORDS_HE_SIG_A_SU_INFO 2
+
+struct he_sig_a_su_info {
+             uint32_t format_indication               :  1, //[0]
+                      beam_change                     :  1, //[1]
+                      dl_ul_flag                      :  1, //[2]
+                      transmit_mcs                    :  4, //[6:3]
+                      dcm                             :  1, //[7]
+                      bss_color_id                    :  6, //[13:8]
+                      reserved_0a                     :  1, //[14]
+                      spatial_reuse                   :  4, //[18:15]
+                      transmit_bw                     :  2, //[20:19]
+                      cp_ltf_size                     :  2, //[22:21]
+                      nsts                            :  3, //[25:23]
+                      reserved_0b                     :  6; //[31:26]
+             uint32_t txop_duration                   :  7, //[6:0]
+                      coding                          :  1, //[7]
+                      ldpc_extra_symbol               :  1, //[8]
+                      stbc                            :  1, //[9]
+                      txbf                            :  1, //[10]
+                      packet_extension_a_factor       :  2, //[12:11]
+                      packet_extension_pe_disambiguity:  1, //[13]
+                      reserved_1a                     :  1, //[14]
+                      doppler_indication              :  1, //[15]
+                      crc                             :  4, //[19:16]
+                      tail                            :  6, //[25:20]
+                      dot11ax_su_extended             :  1, //[26]
+                      dot11ax_ext_ru_size             :  4, //[30:27]
+                      rx_ndp                          :  1; //[31]
+};
+
+/*
+
+format_indication
+			
+			<enum 0 HE_SIGA_FORMAT_HE_TRIG>
+			
+			<enum 1 HE_SIGA_FORMAT_SU_OR_EXT_SU>
+			
+			<legal all>
+
+beam_change
+			
+			Indicates whether spatial mapping is changed between
+			legacy and HE portion of preamble. If not, channel
+			estimation can include legacy preamble to improve accuracy
+			
+			<legal all>
+
+dl_ul_flag
+			
+			Differentiates between DL and UL transmission 
+			
+			
+			
+			<enum 0 DL_UL_FLAG_IS_DL_OR_TDLS>
+			
+			<enum 1 DL_UL_FLAG_IS_UL>
+			
+			<legal all>
+
+transmit_mcs
+			
+			Indicates the data MCS
+			
+			
+			
+			Field Used by MAC HW
+			
+			<legal all>
+
+dcm
+			
+			
+			0: No DCM
+			
+			1:DCM
+			
+			<legal all>
+
+bss_color_id
+			
+			BSS color ID 
+			
+			
+			
+			Field Used by MAC HW
+			
+			<legal all>
+
+reserved_0a
+			
+			Note: spec indicates this shall be set to 1
+			
+			<legal 1>
+
+spatial_reuse
+			
+			Spatial reuse
+			
+			
+			
+			For 20MHz one SR field corresponding to entire 20MHz
+			(other 3 fields indicate identical values)
+			
+			For 40MHz two SR fields for each 20MHz (other 2 fields
+			indicate identical values)
+			
+			For 80MHz four SR fields for each 20MHz
+			
+			For 160MHz four SR fields for each 40MHz
+			
+			<legal all>
+
+transmit_bw
+			
+			Bandwidth of the PPDU.
+			
+			
+			
+			For HE SU PPDU                                          
+			                                                           
+			
+			<enum 0 HE_SIG_A_BW20> 20 Mhz 
+			
+			<enum 1 HE_SIG_A_BW40> 40 Mhz 
+			
+			<enum 2 HE_SIG_A_BW80> 80 Mhz 
+			
+			<enum 3 HE_SIG_A_BW160> 160 MHz or 80+80 MHz
+			
+			
+			
+			For HE Extended Range SU PPDU
+			
+			Set to 0 for 242-tone RU                                
+			 Set to 1 for right 106-tone RU within the primary 20 MHz  
+			
+			
+			
+			On RX side, Field Used by MAC HW
+			
+			<legal all>
+
+cp_ltf_size
+			
+			Indicates the CP and HE-LTF type 
+			
+			
+			
+			
+			
+			<enum 3 FourX_LTF_0_8CP_3_2CP>
+			
+			When DCM == 0 OR STBC == 0: 4x LTF + 3.2 µs CP 
+			
+			When DCM == 1 AND STBC == 1: 4x LTF + 0.8 µs CP. Note:
+			In this scenario, Neither DCM nor STBC is applied to HE data
+			field.
+			
+			
+			NOTE:
+			
+			
+			If ( DCM == 1 ) and ( MCS > 0 ) and (STBC == 0) 
+			
+			0      = 1xLTF + 0.4 usec
+			
+			1      = 2xLTF + 0.4 usec
+			
+			2~3 = Reserved
+			
+			
+			
+			<legal all>
+
+nsts
+			
+			
+			
+			
+			For HE SU PPDU                                          
+			
+			
+			
+			For HE Extended Range PPDU                              
+			
+			<legal all>
+
+reserved_0b
+			
+			<legal 0>
+
+txop_duration
+			
+			Indicates the remaining time in the current TXOP
+			
+			
+			
+			Field Used by MAC HW
+			
+			 <legal all>
+
+coding
+			
+			Distinguishes between BCC and LDPC coding. 
+			
+			
+			
+			0: BCC
+			
+			1: LDPC
+			
+			<legal all>
+
+ldpc_extra_symbol
+			
+			If LDPC, 
+			
+			  0: LDPC extra symbol not present
+			
+			  1: LDPC extra symbol present
+			
+			Else 
+			
+			  Set to 1
+			
+			<legal all>
+
+stbc
+			
+			Indicates whether STBC is applied
+			
+			0: No STBC
+			
+			1: STBC
+			
+			<legal all>
+
+txbf
+			
+			Indicates whether beamforming is applied
+			
+			0: No beamforming
+			
+			1: beamforming
+			
+			<legal all>
+
+packet_extension_a_factor
+			
+			Common trigger info
+			
+			
+			
+			the packet extension duration of the trigger-based PPDU
+			response with these two bits indicating the a-factor 
+			
+			
+			
+			<enum 0 a_factor_4>
+			
+			<enum 1 a_factor_1>
+			
+			<enum 2 a_factor_2>
+			
+			<enum 3 a_factor_3>
+			
+			
+			
+			<legal all>
+
+packet_extension_pe_disambiguity
+			
+			Common trigger info
+			
+			
+			
+			the packet extension duration of the trigger-based PPDU
+			response with this bit indicating the PE-Disambiguity 
+			
+			<legal all>
+
+reserved_1a
+			
+			Note: per standard, set to 1
+			
+			<legal 1>
+
+doppler_indication
+			
+			0: No Doppler support
+			
+			1: Doppler support
+			
+			<legal all>
+
+crc
+			
+			CRC for HE-SIG-A contents.
+			
+			<legal all>
+
+tail
+			
+			<legal 0>
+
+dot11ax_su_extended
+			
+			TX side:
+			
+			Set to 0
+			
+			
+			
+			RX side:
+			
+			On RX side, evaluated by MAC HW. This is the only way
+			for MAC RX to know that this was an HE_SIG_A_SU received in
+			'extended' format
+			
+			
+			
+			
+			<legal all>
+
+dot11ax_ext_ru_size
+			
+			TX side:
+			
+			Set to 0
+			
+			
+			
+			RX side:
+			
+			Field only contains valid info when dot11ax_su_extended
+			is set.
+			
+			
+			
+			On RX side, evaluated by MAC HW. This is the only way
+			for MAC RX to know what the number of based RUs was in this
+			extended range reception. It is used by the MAC to determine
+			the RU size for the response...
+			
+			<legal all>
+
+rx_ndp
+			
+			TX side:
+			
+			Set to 0
+			
+			
+			
+			RX side:Valid on RX side only, and looked at by MAC HW
+			
+			
+			
+			When set, PHY has received (expected) NDP frame
+			
+			<legal all>
+*/
+
+
+/* Description		HE_SIG_A_SU_INFO_0_FORMAT_INDICATION
+			
+			<enum 0 HE_SIGA_FORMAT_HE_TRIG>
+			
+			<enum 1 HE_SIGA_FORMAT_SU_OR_EXT_SU>
+			
+			<legal all>
+*/
+#define HE_SIG_A_SU_INFO_0_FORMAT_INDICATION_OFFSET                  0x00000000
+#define HE_SIG_A_SU_INFO_0_FORMAT_INDICATION_LSB                     0
+#define HE_SIG_A_SU_INFO_0_FORMAT_INDICATION_MASK                    0x00000001
+
+/* Description		HE_SIG_A_SU_INFO_0_BEAM_CHANGE
+			
+			Indicates whether spatial mapping is changed between
+			legacy and HE portion of preamble. If not, channel
+			estimation can include legacy preamble to improve accuracy
+			
+			<legal all>
+*/
+#define HE_SIG_A_SU_INFO_0_BEAM_CHANGE_OFFSET                        0x00000000
+#define HE_SIG_A_SU_INFO_0_BEAM_CHANGE_LSB                           1
+#define HE_SIG_A_SU_INFO_0_BEAM_CHANGE_MASK                          0x00000002
+
+/* Description		HE_SIG_A_SU_INFO_0_DL_UL_FLAG
+			
+			Differentiates between DL and UL transmission 
+			
+			
+			
+			<enum 0 DL_UL_FLAG_IS_DL_OR_TDLS>
+			
+			<enum 1 DL_UL_FLAG_IS_UL>
+			
+			<legal all>
+*/
+#define HE_SIG_A_SU_INFO_0_DL_UL_FLAG_OFFSET                         0x00000000
+#define HE_SIG_A_SU_INFO_0_DL_UL_FLAG_LSB                            2
+#define HE_SIG_A_SU_INFO_0_DL_UL_FLAG_MASK                           0x00000004
+
+/* Description		HE_SIG_A_SU_INFO_0_TRANSMIT_MCS
+			
+			Indicates the data MCS
+			
+			
+			
+			Field Used by MAC HW
+			
+			<legal all>
+*/
+#define HE_SIG_A_SU_INFO_0_TRANSMIT_MCS_OFFSET                       0x00000000
+#define HE_SIG_A_SU_INFO_0_TRANSMIT_MCS_LSB                          3
+#define HE_SIG_A_SU_INFO_0_TRANSMIT_MCS_MASK                         0x00000078
+
+/* Description		HE_SIG_A_SU_INFO_0_DCM
+			
+			
+			0: No DCM
+			
+			1:DCM
+			
+			<legal all>
+*/
+#define HE_SIG_A_SU_INFO_0_DCM_OFFSET                                0x00000000
+#define HE_SIG_A_SU_INFO_0_DCM_LSB                                   7
+#define HE_SIG_A_SU_INFO_0_DCM_MASK                                  0x00000080
+
+/* Description		HE_SIG_A_SU_INFO_0_BSS_COLOR_ID
+			
+			BSS color ID 
+			
+			
+			
+			Field Used by MAC HW
+			
+			<legal all>
+*/
+#define HE_SIG_A_SU_INFO_0_BSS_COLOR_ID_OFFSET                       0x00000000
+#define HE_SIG_A_SU_INFO_0_BSS_COLOR_ID_LSB                          8
+#define HE_SIG_A_SU_INFO_0_BSS_COLOR_ID_MASK                         0x00003f00
+
+/* Description		HE_SIG_A_SU_INFO_0_RESERVED_0A
+			
+			Note: spec indicates this shall be set to 1
+			
+			<legal 1>
+*/
+#define HE_SIG_A_SU_INFO_0_RESERVED_0A_OFFSET                        0x00000000
+#define HE_SIG_A_SU_INFO_0_RESERVED_0A_LSB                           14
+#define HE_SIG_A_SU_INFO_0_RESERVED_0A_MASK                          0x00004000
+
+/* Description		HE_SIG_A_SU_INFO_0_SPATIAL_REUSE
+			
+			Spatial reuse
+			
+			
+			
+			For 20MHz one SR field corresponding to entire 20MHz
+			(other 3 fields indicate identical values)
+			
+			For 40MHz two SR fields for each 20MHz (other 2 fields
+			indicate identical values)
+			
+			For 80MHz four SR fields for each 20MHz
+			
+			For 160MHz four SR fields for each 40MHz
+			
+			<legal all>
+*/
+#define HE_SIG_A_SU_INFO_0_SPATIAL_REUSE_OFFSET                      0x00000000
+#define HE_SIG_A_SU_INFO_0_SPATIAL_REUSE_LSB                         15
+#define HE_SIG_A_SU_INFO_0_SPATIAL_REUSE_MASK                        0x00078000
+
+/* Description		HE_SIG_A_SU_INFO_0_TRANSMIT_BW
+			
+			Bandwidth of the PPDU.
+			
+			
+			
+			For HE SU PPDU                                          
+			                                                           
+			
+			<enum 0 HE_SIG_A_BW20> 20 Mhz 
+			
+			<enum 1 HE_SIG_A_BW40> 40 Mhz 
+			
+			<enum 2 HE_SIG_A_BW80> 80 Mhz 
+			
+			<enum 3 HE_SIG_A_BW160> 160 MHz or 80+80 MHz
+			
+			
+			
+			For HE Extended Range SU PPDU
+			
+			Set to 0 for 242-tone RU                                
+			 Set to 1 for right 106-tone RU within the primary 20 MHz  
+			
+			
+			
+			On RX side, Field Used by MAC HW
+			
+			<legal all>
+*/
+#define HE_SIG_A_SU_INFO_0_TRANSMIT_BW_OFFSET                        0x00000000
+#define HE_SIG_A_SU_INFO_0_TRANSMIT_BW_LSB                           19
+#define HE_SIG_A_SU_INFO_0_TRANSMIT_BW_MASK                          0x00180000
+
+/* Description		HE_SIG_A_SU_INFO_0_CP_LTF_SIZE
+			
+			Indicates the CP and HE-LTF type 
+			
+			
+			
+			
+			<enum 3 FourX_LTF_0_8CP_3_2CP>
+			
+			When DCM == 0 OR STBC == 0: 4x LTF + 3.2 µs CP 
+			
+			When DCM == 1 AND STBC == 1: 4x LTF + 0.8 µs CP. Note:
+			In this scenario, Neither DCM nor STBC is applied to HE data
+			field.
+			
+			
+			NOTE:
+			
+			
+			If ( DCM == 1 ) and ( MCS > 0 ) and (STBC == 0) 
+			
+			0      = 1xLTF + 0.4 usec
+			
+			1      = 2xLTF + 0.4 usec
+			
+			2~3 = Reserved
+			
+			
+			
+			<legal all>
+*/
+#define HE_SIG_A_SU_INFO_0_CP_LTF_SIZE_OFFSET                        0x00000000
+#define HE_SIG_A_SU_INFO_0_CP_LTF_SIZE_LSB                           21
+#define HE_SIG_A_SU_INFO_0_CP_LTF_SIZE_MASK                          0x00600000
+
+/* Description		HE_SIG_A_SU_INFO_0_NSTS
+			
+			
+			
+			
+			For HE SU PPDU                                          
+			
+			
+			
+			For HE Extended Range PPDU                              
+			
+			<legal all>
+*/
+#define HE_SIG_A_SU_INFO_0_NSTS_OFFSET                               0x00000000
+#define HE_SIG_A_SU_INFO_0_NSTS_LSB                                  23
+#define HE_SIG_A_SU_INFO_0_NSTS_MASK                                 0x03800000
+
+/* Description		HE_SIG_A_SU_INFO_0_RESERVED_0B
+			
+			<legal 0>
+*/
+#define HE_SIG_A_SU_INFO_0_RESERVED_0B_OFFSET                        0x00000000
+#define HE_SIG_A_SU_INFO_0_RESERVED_0B_LSB                           26
+#define HE_SIG_A_SU_INFO_0_RESERVED_0B_MASK                          0xfc000000
+
+/* Description		HE_SIG_A_SU_INFO_1_TXOP_DURATION
+			
+			Indicates the remaining time in the current TXOP
+			
+			
+			
+			Field Used by MAC HW
+			
+			 <legal all>
+*/
+#define HE_SIG_A_SU_INFO_1_TXOP_DURATION_OFFSET                      0x00000004
+#define HE_SIG_A_SU_INFO_1_TXOP_DURATION_LSB                         0
+#define HE_SIG_A_SU_INFO_1_TXOP_DURATION_MASK                        0x0000007f
+
+/* Description		HE_SIG_A_SU_INFO_1_CODING
+			
+			Distinguishes between BCC and LDPC coding. 
+			
+			
+			
+			0: BCC
+			
+			1: LDPC
+			
+			<legal all>
+*/
+#define HE_SIG_A_SU_INFO_1_CODING_OFFSET                             0x00000004
+#define HE_SIG_A_SU_INFO_1_CODING_LSB                                7
+#define HE_SIG_A_SU_INFO_1_CODING_MASK                               0x00000080
+
+/* Description		HE_SIG_A_SU_INFO_1_LDPC_EXTRA_SYMBOL
+			
+			If LDPC, 
+			
+			  0: LDPC extra symbol not present
+			
+			  1: LDPC extra symbol present
+			
+			Else 
+			
+			  Set to 1
+			
+			<legal all>
+*/
+#define HE_SIG_A_SU_INFO_1_LDPC_EXTRA_SYMBOL_OFFSET                  0x00000004
+#define HE_SIG_A_SU_INFO_1_LDPC_EXTRA_SYMBOL_LSB                     8
+#define HE_SIG_A_SU_INFO_1_LDPC_EXTRA_SYMBOL_MASK                    0x00000100
+
+/* Description		HE_SIG_A_SU_INFO_1_STBC
+			
+			Indicates whether STBC is applied
+			
+			0: No STBC
+			
+			1: STBC
+			
+			<legal all>
+*/
+#define HE_SIG_A_SU_INFO_1_STBC_OFFSET                               0x00000004
+#define HE_SIG_A_SU_INFO_1_STBC_LSB                                  9
+#define HE_SIG_A_SU_INFO_1_STBC_MASK                                 0x00000200
+
+/* Description		HE_SIG_A_SU_INFO_1_TXBF
+			
+			Indicates whether beamforming is applied
+			
+			0: No beamforming
+			
+			1: beamforming
+			
+			<legal all>
+*/
+#define HE_SIG_A_SU_INFO_1_TXBF_OFFSET                               0x00000004
+#define HE_SIG_A_SU_INFO_1_TXBF_LSB                                  10
+#define HE_SIG_A_SU_INFO_1_TXBF_MASK                                 0x00000400
+
+/* Description		HE_SIG_A_SU_INFO_1_PACKET_EXTENSION_A_FACTOR
+			
+			Common trigger info
+			
+			
+			
+			the packet extension duration of the trigger-based PPDU
+			response with these two bits indicating the a-factor 
+			
+			
+			
+			<enum 0 a_factor_4>
+			
+			<enum 1 a_factor_1>
+			
+			<enum 2 a_factor_2>
+			
+			<enum 3 a_factor_3>
+			
+			
+			
+			<legal all>
+*/
+#define HE_SIG_A_SU_INFO_1_PACKET_EXTENSION_A_FACTOR_OFFSET          0x00000004
+#define HE_SIG_A_SU_INFO_1_PACKET_EXTENSION_A_FACTOR_LSB             11
+#define HE_SIG_A_SU_INFO_1_PACKET_EXTENSION_A_FACTOR_MASK            0x00001800
+
+/* Description		HE_SIG_A_SU_INFO_1_PACKET_EXTENSION_PE_DISAMBIGUITY
+			
+			Common trigger info
+			
+			
+			
+			the packet extension duration of the trigger-based PPDU
+			response with this bit indicating the PE-Disambiguity 
+			
+			<legal all>
+*/
+#define HE_SIG_A_SU_INFO_1_PACKET_EXTENSION_PE_DISAMBIGUITY_OFFSET   0x00000004
+#define HE_SIG_A_SU_INFO_1_PACKET_EXTENSION_PE_DISAMBIGUITY_LSB      13
+#define HE_SIG_A_SU_INFO_1_PACKET_EXTENSION_PE_DISAMBIGUITY_MASK     0x00002000
+
+/* Description		HE_SIG_A_SU_INFO_1_RESERVED_1A
+			
+			Note: per standard, set to 1
+			
+			<legal 1>
+*/
+#define HE_SIG_A_SU_INFO_1_RESERVED_1A_OFFSET                        0x00000004
+#define HE_SIG_A_SU_INFO_1_RESERVED_1A_LSB                           14
+#define HE_SIG_A_SU_INFO_1_RESERVED_1A_MASK                          0x00004000
+
+/* Description		HE_SIG_A_SU_INFO_1_DOPPLER_INDICATION
+			
+			0: No Doppler support
+			
+			1: Doppler support
+			
+			<legal all>
+*/
+#define HE_SIG_A_SU_INFO_1_DOPPLER_INDICATION_OFFSET                 0x00000004
+#define HE_SIG_A_SU_INFO_1_DOPPLER_INDICATION_LSB                    15
+#define HE_SIG_A_SU_INFO_1_DOPPLER_INDICATION_MASK                   0x00008000
+
+/* Description		HE_SIG_A_SU_INFO_1_CRC
+			
+			CRC for HE-SIG-A contents.
+			
+			<legal all>
+*/
+#define HE_SIG_A_SU_INFO_1_CRC_OFFSET                                0x00000004
+#define HE_SIG_A_SU_INFO_1_CRC_LSB                                   16
+#define HE_SIG_A_SU_INFO_1_CRC_MASK                                  0x000f0000
+
+/* Description		HE_SIG_A_SU_INFO_1_TAIL
+			
+			<legal 0>
+*/
+#define HE_SIG_A_SU_INFO_1_TAIL_OFFSET                               0x00000004
+#define HE_SIG_A_SU_INFO_1_TAIL_LSB                                  20
+#define HE_SIG_A_SU_INFO_1_TAIL_MASK                                 0x03f00000
+
+/* Description		HE_SIG_A_SU_INFO_1_DOT11AX_SU_EXTENDED
+			
+			TX side:
+			
+			Set to 0
+			
+			
+			
+			RX side:
+			
+			On RX side, evaluated by MAC HW. This is the only way
+			for MAC RX to know that this was an HE_SIG_A_SU received in
+			'extended' format
+			
+			
+			
+			
+			<legal all>
+*/
+#define HE_SIG_A_SU_INFO_1_DOT11AX_SU_EXTENDED_OFFSET                0x00000004
+#define HE_SIG_A_SU_INFO_1_DOT11AX_SU_EXTENDED_LSB                   26
+#define HE_SIG_A_SU_INFO_1_DOT11AX_SU_EXTENDED_MASK                  0x04000000
+
+/* Description		HE_SIG_A_SU_INFO_1_DOT11AX_EXT_RU_SIZE
+			
+			TX side:
+			
+			Set to 0
+			
+			
+			
+			RX side:
+			
+			Field only contains valid info when dot11ax_su_extended
+			is set.
+			
+			
+			
+			On RX side, evaluated by MAC HW. This is the only way
+			for MAC RX to know what the number of based RUs was in this
+			extended range reception. It is used by the MAC to determine
+			the RU size for the response...
+			
+			<legal all>
+*/
+#define HE_SIG_A_SU_INFO_1_DOT11AX_EXT_RU_SIZE_OFFSET                0x00000004
+#define HE_SIG_A_SU_INFO_1_DOT11AX_EXT_RU_SIZE_LSB                   27
+#define HE_SIG_A_SU_INFO_1_DOT11AX_EXT_RU_SIZE_MASK                  0x78000000
+
+/* Description		HE_SIG_A_SU_INFO_1_RX_NDP
+			
+			TX side:
+			
+			Set to 0
+			
+			
+			
+			RX side:Valid on RX side only, and looked at by MAC HW
+			
+			
+			
+			When set, PHY has received (expected) NDP frame
+			
+			<legal all>
+*/
+#define HE_SIG_A_SU_INFO_1_RX_NDP_OFFSET                             0x00000004
+#define HE_SIG_A_SU_INFO_1_RX_NDP_LSB                                31
+#define HE_SIG_A_SU_INFO_1_RX_NDP_MASK                               0x80000000
+
+
+#endif // _HE_SIG_A_SU_INFO_H_
--- a/drivers/staging/fw-api/hw/qca5018/he_sig_b1_mu_info.h
+++ b/drivers/staging/fw-api/hw/qca5018/he_sig_b1_mu_info.h
@@ -0,0 +1,80 @@
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _HE_SIG_B1_MU_INFO_H_
+#define _HE_SIG_B1_MU_INFO_H_
+#if !defined(__ASSEMBLER__)
+#endif
+
+
+// ################ START SUMMARY #################
+//
+//	Dword	Fields
+//	0	ru_allocation[7:0], reserved_0[31:8]
+//
+// ################ END SUMMARY #################
+
+#define NUM_OF_DWORDS_HE_SIG_B1_MU_INFO 1
+
+struct he_sig_b1_mu_info {
+             uint32_t ru_allocation                   :  8, //[7:0]
+                      reserved_0                      : 24; //[31:8]
+};
+
+/*
+
+ru_allocation
+			
+			RU allocation for the user(s) following this common
+			portion of the SIG
+			
+			
+			
+			For details, refer to  RU_TYPE description
+			
+			<legal all>
+
+reserved_0
+			
+			<legal 0>
+*/
+
+
+/* Description		HE_SIG_B1_MU_INFO_0_RU_ALLOCATION
+			
+			RU allocation for the user(s) following this common
+			portion of the SIG
+			
+			
+			
+			For details, refer to  RU_TYPE description
+			
+			<legal all>
+*/
+#define HE_SIG_B1_MU_INFO_0_RU_ALLOCATION_OFFSET                     0x00000000
+#define HE_SIG_B1_MU_INFO_0_RU_ALLOCATION_LSB                        0
+#define HE_SIG_B1_MU_INFO_0_RU_ALLOCATION_MASK                       0x000000ff
+
+/* Description		HE_SIG_B1_MU_INFO_0_RESERVED_0
+			
+			<legal 0>
+*/
+#define HE_SIG_B1_MU_INFO_0_RESERVED_0_OFFSET                        0x00000000
+#define HE_SIG_B1_MU_INFO_0_RESERVED_0_LSB                           8
+#define HE_SIG_B1_MU_INFO_0_RESERVED_0_MASK                          0xffffff00
+
+
+#endif // _HE_SIG_B1_MU_INFO_H_
--- a/drivers/staging/fw-api/hw/qca5018/he_sig_b2_mu_info.h
+++ b/drivers/staging/fw-api/hw/qca5018/he_sig_b2_mu_info.h
@@ -0,0 +1,207 @@
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _HE_SIG_B2_MU_INFO_H_
+#define _HE_SIG_B2_MU_INFO_H_
+#if !defined(__ASSEMBLER__)
+#endif
+
+
+// ################ START SUMMARY #################
+//
+//	Dword	Fields
+//	0	sta_id[10:0], sta_spatial_config[14:11], sta_mcs[18:15], reserved_set_to_1[19], sta_coding[20], reserved_0a[28:21], nsts[31:29]
+//
+// ################ END SUMMARY #################
+
+#define NUM_OF_DWORDS_HE_SIG_B2_MU_INFO 1
+
+struct he_sig_b2_mu_info {
+             uint32_t sta_id                          : 11, //[10:0]
+                      sta_spatial_config              :  4, //[14:11]
+                      sta_mcs                         :  4, //[18:15]
+                      reserved_set_to_1               :  1, //[19]
+                      sta_coding                      :  1, //[20]
+                      reserved_0a                     :  8, //[28:21]
+                      nsts                            :  3; //[31:29]
+};
+
+/*
+
+sta_id
+			
+			Identifies the STA that is addressed. Details of STA ID
+			are TBD
+
+sta_spatial_config
+			
+			Number of assigned spatial streams and their
+			corresponding index. 
+			
+			Total number of spatial streams assigned for the MU-MIMO
+			allocation is also signaled. 
+
+sta_mcs
+			
+			Indicates the data MCS
+
+reserved_set_to_1
+			
+			<legal 1>
+
+sta_coding
+			
+			Distinguishes between BCC/LDPC
+			
+			
+			
+			0: BCC
+			
+			1: LDPC
+			
+			<legal all>
+
+reserved_0a
+			
+			<legal 0>
+
+nsts
+			
+			MAC RX side usage only:
+			
+			Needed by RXPCU. Provided by PHY so that RXPCU does not
+			need to have the RU number decoding logic.
+			
+			
+			
+			Number of spatial streams for this user
+			
+			
+			
+			<enum 0 1_spatial_stream>Single spatial stream
+			
+			<enum 1 2_spatial_streams>2 spatial streams
+			
+			<enum 2 3_spatial_streams>3 spatial streams
+			
+			<enum 3 4_spatial_streams>4 spatial streams
+			
+			<enum 4 5_spatial_streams>5 spatial streams
+			
+			<enum 5 6_spatial_streams>6 spatial streams
+			
+			<enum 6 7_spatial_streams>7 spatial streams
+			
+			<enum 7 8_spatial_streams>8 spatial streams
+*/
+
+
+/* Description		HE_SIG_B2_MU_INFO_0_STA_ID
+			
+			Identifies the STA that is addressed. Details of STA ID
+			are TBD
+*/
+#define HE_SIG_B2_MU_INFO_0_STA_ID_OFFSET                            0x00000000
+#define HE_SIG_B2_MU_INFO_0_STA_ID_LSB                               0
+#define HE_SIG_B2_MU_INFO_0_STA_ID_MASK                              0x000007ff
+
+/* Description		HE_SIG_B2_MU_INFO_0_STA_SPATIAL_CONFIG
+			
+			Number of assigned spatial streams and their
+			corresponding index. 
+			
+			Total number of spatial streams assigned for the MU-MIMO
+			allocation is also signaled. 
+*/
+#define HE_SIG_B2_MU_INFO_0_STA_SPATIAL_CONFIG_OFFSET                0x00000000
+#define HE_SIG_B2_MU_INFO_0_STA_SPATIAL_CONFIG_LSB                   11
+#define HE_SIG_B2_MU_INFO_0_STA_SPATIAL_CONFIG_MASK                  0x00007800
+
+/* Description		HE_SIG_B2_MU_INFO_0_STA_MCS
+			
+			Indicates the data MCS
+*/
+#define HE_SIG_B2_MU_INFO_0_STA_MCS_OFFSET                           0x00000000
+#define HE_SIG_B2_MU_INFO_0_STA_MCS_LSB                              15
+#define HE_SIG_B2_MU_INFO_0_STA_MCS_MASK                             0x00078000
+
+/* Description		HE_SIG_B2_MU_INFO_0_RESERVED_SET_TO_1
+			
+			<legal 1>
+*/
+#define HE_SIG_B2_MU_INFO_0_RESERVED_SET_TO_1_OFFSET                 0x00000000
+#define HE_SIG_B2_MU_INFO_0_RESERVED_SET_TO_1_LSB                    19
+#define HE_SIG_B2_MU_INFO_0_RESERVED_SET_TO_1_MASK                   0x00080000
+
+/* Description		HE_SIG_B2_MU_INFO_0_STA_CODING
+			
+			Distinguishes between BCC/LDPC
+			
+			
+			
+			0: BCC
+			
+			1: LDPC
+			
+			<legal all>
+*/
+#define HE_SIG_B2_MU_INFO_0_STA_CODING_OFFSET                        0x00000000
+#define HE_SIG_B2_MU_INFO_0_STA_CODING_LSB                           20
+#define HE_SIG_B2_MU_INFO_0_STA_CODING_MASK                          0x00100000
+
+/* Description		HE_SIG_B2_MU_INFO_0_RESERVED_0A
+			
+			<legal 0>
+*/
+#define HE_SIG_B2_MU_INFO_0_RESERVED_0A_OFFSET                       0x00000000
+#define HE_SIG_B2_MU_INFO_0_RESERVED_0A_LSB                          21
+#define HE_SIG_B2_MU_INFO_0_RESERVED_0A_MASK                         0x1fe00000
+
+/* Description		HE_SIG_B2_MU_INFO_0_NSTS
+			
+			MAC RX side usage only:
+			
+			Needed by RXPCU. Provided by PHY so that RXPCU does not
+			need to have the RU number decoding logic.
+			
+			
+			
+			Number of spatial streams for this user
+			
+			
+			
+			<enum 0 1_spatial_stream>Single spatial stream
+			
+			<enum 1 2_spatial_streams>2 spatial streams
+			
+			<enum 2 3_spatial_streams>3 spatial streams
+			
+			<enum 3 4_spatial_streams>4 spatial streams
+			
+			<enum 4 5_spatial_streams>5 spatial streams
+			
+			<enum 5 6_spatial_streams>6 spatial streams
+			
+			<enum 6 7_spatial_streams>7 spatial streams
+			
+			<enum 7 8_spatial_streams>8 spatial streams
+*/
+#define HE_SIG_B2_MU_INFO_0_NSTS_OFFSET                              0x00000000
+#define HE_SIG_B2_MU_INFO_0_NSTS_LSB                                 29
+#define HE_SIG_B2_MU_INFO_0_NSTS_MASK                                0xe0000000
+
+
+#endif // _HE_SIG_B2_MU_INFO_H_
--- a/drivers/staging/fw-api/hw/qca5018/he_sig_b2_ofdma_info.h
+++ b/drivers/staging/fw-api/hw/qca5018/he_sig_b2_ofdma_info.h
@@ -0,0 +1,215 @@
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _HE_SIG_B2_OFDMA_INFO_H_
+#define _HE_SIG_B2_OFDMA_INFO_H_
+#if !defined(__ASSEMBLER__)
+#endif
+
+
+// ################ START SUMMARY #################
+//
+//	Dword	Fields
+//	0	sta_id[10:0], nsts[13:11], txbf[14], sta_mcs[18:15], sta_dcm[19], sta_coding[20], reserved_0[31:21]
+//
+// ################ END SUMMARY #################
+
+#define NUM_OF_DWORDS_HE_SIG_B2_OFDMA_INFO 1
+
+struct he_sig_b2_ofdma_info {
+             uint32_t sta_id                          : 11, //[10:0]
+                      nsts                            :  3, //[13:11]
+                      txbf                            :  1, //[14]
+                      sta_mcs                         :  4, //[18:15]
+                      sta_dcm                         :  1, //[19]
+                      sta_coding                      :  1, //[20]
+                      reserved_0                      : 11; //[31:21]
+};
+
+/*
+
+sta_id
+			
+			Identifies the STA that is addressed. Details of STA ID
+			are TBD
+
+nsts
+			
+			MAC RX side usage only:
+			
+			
+			
+			Number of spatial streams for this user
+			
+			
+			
+			<enum 0 1_spatial_stream>Single spatial stream
+			
+			<enum 1 2_spatial_streams>2 spatial streams
+			
+			<enum 2 3_spatial_streams>3 spatial streams
+			
+			<enum 3 4_spatial_streams>4 spatial streams
+			
+			<enum 4 5_spatial_streams>5 spatial streams
+			
+			<enum 5 6_spatial_streams>6 spatial streams
+			
+			<enum 6 7_spatial_streams>7 spatial streams
+			
+			<enum 7 8_spatial_streams>8 spatial streams
+
+txbf
+			
+			Indicates whether beamforming is applied
+			
+			0: No beamforming
+			
+			1: beamforming
+			
+			<legal all>
+
+sta_mcs
+			
+			Indicates the data MCS
+
+sta_dcm
+			
+			
+			0: No DCM
+			
+			1:DCM
+			
+			<legal all>
+
+sta_coding
+			
+			Distinguishes between BCC/LDPC
+			
+			
+			
+			0: BCC
+			
+			1: LDPC
+			
+			<legal all>
+
+reserved_0
+			
+			<legal 0>
+*/
+
+
+/* Description		HE_SIG_B2_OFDMA_INFO_0_STA_ID
+			
+			Identifies the STA that is addressed. Details of STA ID
+			are TBD
+*/
+#define HE_SIG_B2_OFDMA_INFO_0_STA_ID_OFFSET                         0x00000000
+#define HE_SIG_B2_OFDMA_INFO_0_STA_ID_LSB                            0
+#define HE_SIG_B2_OFDMA_INFO_0_STA_ID_MASK                           0x000007ff
+
+/* Description		HE_SIG_B2_OFDMA_INFO_0_NSTS
+			
+			MAC RX side usage only:
+			
+			
+			
+			Number of spatial streams for this user
+			
+			
+			
+			<enum 0 1_spatial_stream>Single spatial stream
+			
+			<enum 1 2_spatial_streams>2 spatial streams
+			
+			<enum 2 3_spatial_streams>3 spatial streams
+			
+			<enum 3 4_spatial_streams>4 spatial streams
+			
+			<enum 4 5_spatial_streams>5 spatial streams
+			
+			<enum 5 6_spatial_streams>6 spatial streams
+			
+			<enum 6 7_spatial_streams>7 spatial streams
+			
+			<enum 7 8_spatial_streams>8 spatial streams
+*/
+#define HE_SIG_B2_OFDMA_INFO_0_NSTS_OFFSET                           0x00000000
+#define HE_SIG_B2_OFDMA_INFO_0_NSTS_LSB                              11
+#define HE_SIG_B2_OFDMA_INFO_0_NSTS_MASK                             0x00003800
+
+/* Description		HE_SIG_B2_OFDMA_INFO_0_TXBF
+			
+			Indicates whether beamforming is applied
+			
+			0: No beamforming
+			
+			1: beamforming
+			
+			<legal all>
+*/
+#define HE_SIG_B2_OFDMA_INFO_0_TXBF_OFFSET                           0x00000000
+#define HE_SIG_B2_OFDMA_INFO_0_TXBF_LSB                              14
+#define HE_SIG_B2_OFDMA_INFO_0_TXBF_MASK                             0x00004000
+
+/* Description		HE_SIG_B2_OFDMA_INFO_0_STA_MCS
+			
+			Indicates the data MCS
+*/
+#define HE_SIG_B2_OFDMA_INFO_0_STA_MCS_OFFSET                        0x00000000
+#define HE_SIG_B2_OFDMA_INFO_0_STA_MCS_LSB                           15
+#define HE_SIG_B2_OFDMA_INFO_0_STA_MCS_MASK                          0x00078000
+
+/* Description		HE_SIG_B2_OFDMA_INFO_0_STA_DCM
+			
+			
+			0: No DCM
+			
+			1:DCM
+			
+			<legal all>
+*/
+#define HE_SIG_B2_OFDMA_INFO_0_STA_DCM_OFFSET                        0x00000000
+#define HE_SIG_B2_OFDMA_INFO_0_STA_DCM_LSB                           19
+#define HE_SIG_B2_OFDMA_INFO_0_STA_DCM_MASK                          0x00080000
+
+/* Description		HE_SIG_B2_OFDMA_INFO_0_STA_CODING
+			
+			Distinguishes between BCC/LDPC
+			
+			
+			
+			0: BCC
+			
+			1: LDPC
+			
+			<legal all>
+*/
+#define HE_SIG_B2_OFDMA_INFO_0_STA_CODING_OFFSET                     0x00000000
+#define HE_SIG_B2_OFDMA_INFO_0_STA_CODING_LSB                        20
+#define HE_SIG_B2_OFDMA_INFO_0_STA_CODING_MASK                       0x00100000
+
+/* Description		HE_SIG_B2_OFDMA_INFO_0_RESERVED_0
+			
+			<legal 0>
+*/
+#define HE_SIG_B2_OFDMA_INFO_0_RESERVED_0_OFFSET                     0x00000000
+#define HE_SIG_B2_OFDMA_INFO_0_RESERVED_0_LSB                        21
+#define HE_SIG_B2_OFDMA_INFO_0_RESERVED_0_MASK                       0xffe00000
+
+
+#endif // _HE_SIG_B2_OFDMA_INFO_H_
--- a/drivers/staging/fw-api/hw/qca5018/ht_sig_info.h
+++ b/drivers/staging/fw-api/hw/qca5018/ht_sig_info.h
@@ -0,0 +1,388 @@
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _HT_SIG_INFO_H_
+#define _HT_SIG_INFO_H_
+#if !defined(__ASSEMBLER__)
+#endif
+
+
+// ################ START SUMMARY #################
+//
+//	Dword	Fields
+//	0	mcs[6:0], cbw[7], length[23:8], reserved_0[31:24]
+//	1	smoothing[0], not_sounding[1], ht_reserved[2], aggregation[3], stbc[5:4], fec_coding[6], short_gi[7], num_ext_sp_str[9:8], crc[17:10], signal_tail[23:18], reserved_1[31:24]
+//
+// ################ END SUMMARY #################
+
+#define NUM_OF_DWORDS_HT_SIG_INFO 2
+
+struct ht_sig_info {
+             uint32_t mcs                             :  7, //[6:0]
+                      cbw                             :  1, //[7]
+                      length                          : 16, //[23:8]
+                      reserved_0                      :  8; //[31:24]
+             uint32_t smoothing                       :  1, //[0]
+                      not_sounding                    :  1, //[1]
+                      ht_reserved                     :  1, //[2]
+                      aggregation                     :  1, //[3]
+                      stbc                            :  2, //[5:4]
+                      fec_coding                      :  1, //[6]
+                      short_gi                        :  1, //[7]
+                      num_ext_sp_str                  :  2, //[9:8]
+                      crc                             :  8, //[17:10]
+                      signal_tail                     :  6, //[23:18]
+                      reserved_1                      :  8; //[31:24]
+};
+
+/*
+
+mcs
+			
+			Modulation Coding Scheme:
+			
+			0-7 are used for single stream
+			
+			8-15 are used for 2 streams
+			
+			16-23 are used for 3 streams
+			
+			24-31 are used for 4 streams
+			
+			32 is used for duplicate HT20 (unsupported)
+			
+			33-76 is used for unequal modulation (unsupported)
+			
+			77-127 is reserved.
+			
+			<legal 0-31>
+
+cbw
+			
+			Packet bandwidth:
+			
+			<enum 0     ht_20_mhz>
+			
+			<enum 1     ht_40_mhz>
+			
+			<legal 0-1>
+
+length
+			
+			This is the MPDU or A-MPDU length in octets of the PPDU
+			
+			<legal all>
+
+reserved_0
+			
+			This field is not part of HT-SIG
+			
+			Reserved: Should be set to 0 by the MAC and ignored by
+			the PHY <legal 0>
+
+smoothing
+			
+			Field indicates if smoothing is needed
+			
+			E_num 0     do_smoothing Unsupported setting: indicates
+			smoothing is often used for beamforming 
+			
+			
+			<legal 1>
+
+not_sounding
+			
+			E_num 0     sounding Unsupported setting: indicates
+			sounding is used
+			
+			<enum 1     no_sounding>  Indicates no sounding is used
+			
+			<legal 1>
+
+ht_reserved
+			
+			Reserved: Should be set to 1 by the MAC and ignored by
+			the PHY 
+			
+			<legal 1>
+
+aggregation
+			
+			<enum 0     mpdu> Indicates MPDU format
+			
+			<enum 1     a_mpdu> Indicates A-MPDU format
+			
+			<legal 0-1>
+
+stbc
+			
+			<enum 0     no_stbc> Indicates no STBC
+			
+			<enum 1     1_str_stbc> Indicates 1 stream STBC
+			
+			E_num 2     2_str_stbc Indicates 2 stream STBC
+			(Unsupported)
+			
+			<legal 0-1>
+
+fec_coding
+			
+			<enum 0     ht_bcc>  Indicates BCC coding
+			
+			<enum 1     ht_ldpc>  Indicates LDPC coding
+			
+			<legal 0-1>
+
+short_gi
+			
+			<enum 0     ht_normal_gi>  Indicates normal guard
+			interval
+			
+			
+			<legal 0-1>
+
+num_ext_sp_str
+			
+			Number of extension spatial streams: (Used for TxBF)
+			
+			<enum 0     0_ext_sp_str>  No extension spatial streams
+			
+			E_num 1     1_ext_sp_str  Not supported: 1 extension
+			spatial streams
+			
+			E_num 2     2_ext_sp_str  Not supported:  2 extension
+			spatial streams
+			
+			<legal 0>
+
+crc
+			
+			The CRC protects the HT-SIG (HT-SIG[0][23:0] and
+			HT-SIG[1][9:0]. The generator polynomial is G(D) = D8 + D2 +
+			D + 1.  <legal all>
+
+signal_tail
+			
+			The 6 bits of tail is always set to 0 is used to flush
+			the BCC encoder and decoder.  <legal 0>
+
+reserved_1
+			
+			This field is not part of HT-SIG:
+			
+			Reserved: Should be set to 0 by the MAC and ignored by
+			the PHY.  <legal 0>
+*/
+
+
+/* Description		HT_SIG_INFO_0_MCS
+			
+			Modulation Coding Scheme:
+			
+			0-7 are used for single stream
+			
+			8-15 are used for 2 streams
+			
+			16-23 are used for 3 streams
+			
+			24-31 are used for 4 streams
+			
+			32 is used for duplicate HT20 (unsupported)
+			
+			33-76 is used for unequal modulation (unsupported)
+			
+			77-127 is reserved.
+			
+			<legal 0-31>
+*/
+#define HT_SIG_INFO_0_MCS_OFFSET                                     0x00000000
+#define HT_SIG_INFO_0_MCS_LSB                                        0
+#define HT_SIG_INFO_0_MCS_MASK                                       0x0000007f
+
+/* Description		HT_SIG_INFO_0_CBW
+			
+			Packet bandwidth:
+			
+			<enum 0     ht_20_mhz>
+			
+			<enum 1     ht_40_mhz>
+			
+			<legal 0-1>
+*/
+#define HT_SIG_INFO_0_CBW_OFFSET                                     0x00000000
+#define HT_SIG_INFO_0_CBW_LSB                                        7
+#define HT_SIG_INFO_0_CBW_MASK                                       0x00000080
+
+/* Description		HT_SIG_INFO_0_LENGTH
+			
+			This is the MPDU or A-MPDU length in octets of the PPDU
+			
+			<legal all>
+*/
+#define HT_SIG_INFO_0_LENGTH_OFFSET                                  0x00000000
+#define HT_SIG_INFO_0_LENGTH_LSB                                     8
+#define HT_SIG_INFO_0_LENGTH_MASK                                    0x00ffff00
+
+/* Description		HT_SIG_INFO_0_RESERVED_0
+			
+			This field is not part of HT-SIG
+			
+			Reserved: Should be set to 0 by the MAC and ignored by
+			the PHY <legal 0>
+*/
+#define HT_SIG_INFO_0_RESERVED_0_OFFSET                              0x00000000
+#define HT_SIG_INFO_0_RESERVED_0_LSB                                 24
+#define HT_SIG_INFO_0_RESERVED_0_MASK                                0xff000000
+
+/* Description		HT_SIG_INFO_1_SMOOTHING
+			
+			Field indicates if smoothing is needed
+			
+			E_num 0     do_smoothing Unsupported setting: indicates
+			smoothing is often used for beamforming 
+			
+			
+			<legal 1>
+*/
+#define HT_SIG_INFO_1_SMOOTHING_OFFSET                               0x00000004
+#define HT_SIG_INFO_1_SMOOTHING_LSB                                  0
+#define HT_SIG_INFO_1_SMOOTHING_MASK                                 0x00000001
+
+/* Description		HT_SIG_INFO_1_NOT_SOUNDING
+			
+			E_num 0     sounding Unsupported setting: indicates
+			sounding is used
+			
+			<enum 1     no_sounding>  Indicates no sounding is used
+			
+			<legal 1>
+*/
+#define HT_SIG_INFO_1_NOT_SOUNDING_OFFSET                            0x00000004
+#define HT_SIG_INFO_1_NOT_SOUNDING_LSB                               1
+#define HT_SIG_INFO_1_NOT_SOUNDING_MASK                              0x00000002
+
+/* Description		HT_SIG_INFO_1_HT_RESERVED
+			
+			Reserved: Should be set to 1 by the MAC and ignored by
+			the PHY 
+			
+			<legal 1>
+*/
+#define HT_SIG_INFO_1_HT_RESERVED_OFFSET                             0x00000004
+#define HT_SIG_INFO_1_HT_RESERVED_LSB                                2
+#define HT_SIG_INFO_1_HT_RESERVED_MASK                               0x00000004
+
+/* Description		HT_SIG_INFO_1_AGGREGATION
+			
+			<enum 0     mpdu> Indicates MPDU format
+			
+			<enum 1     a_mpdu> Indicates A-MPDU format
+			
+			<legal 0-1>
+*/
+#define HT_SIG_INFO_1_AGGREGATION_OFFSET                             0x00000004
+#define HT_SIG_INFO_1_AGGREGATION_LSB                                3
+#define HT_SIG_INFO_1_AGGREGATION_MASK                               0x00000008
+
+/* Description		HT_SIG_INFO_1_STBC
+			
+			<enum 0     no_stbc> Indicates no STBC
+			
+			<enum 1     1_str_stbc> Indicates 1 stream STBC
+			
+			E_num 2     2_str_stbc Indicates 2 stream STBC
+			(Unsupported)
+			
+			<legal 0-1>
+*/
+#define HT_SIG_INFO_1_STBC_OFFSET                                    0x00000004
+#define HT_SIG_INFO_1_STBC_LSB                                       4
+#define HT_SIG_INFO_1_STBC_MASK                                      0x00000030
+
+/* Description		HT_SIG_INFO_1_FEC_CODING
+			
+			<enum 0     ht_bcc>  Indicates BCC coding
+			
+			<enum 1     ht_ldpc>  Indicates LDPC coding
+			
+			<legal 0-1>
+*/
+#define HT_SIG_INFO_1_FEC_CODING_OFFSET                              0x00000004
+#define HT_SIG_INFO_1_FEC_CODING_LSB                                 6
+#define HT_SIG_INFO_1_FEC_CODING_MASK                                0x00000040
+
+/* Description		HT_SIG_INFO_1_SHORT_GI
+			
+			<enum 0     ht_normal_gi>  Indicates normal guard
+			interval
+			
+			
+			<legal 0-1>
+*/
+#define HT_SIG_INFO_1_SHORT_GI_OFFSET                                0x00000004
+#define HT_SIG_INFO_1_SHORT_GI_LSB                                   7
+#define HT_SIG_INFO_1_SHORT_GI_MASK                                  0x00000080
+
+/* Description		HT_SIG_INFO_1_NUM_EXT_SP_STR
+			
+			Number of extension spatial streams: (Used for TxBF)
+			
+			<enum 0     0_ext_sp_str>  No extension spatial streams
+			
+			E_num 1     1_ext_sp_str  Not supported: 1 extension
+			spatial streams
+			
+			E_num 2     2_ext_sp_str  Not supported:  2 extension
+			spatial streams
+			
+			<legal 0>
+*/
+#define HT_SIG_INFO_1_NUM_EXT_SP_STR_OFFSET                          0x00000004
+#define HT_SIG_INFO_1_NUM_EXT_SP_STR_LSB                             8
+#define HT_SIG_INFO_1_NUM_EXT_SP_STR_MASK                            0x00000300
+
+/* Description		HT_SIG_INFO_1_CRC
+			
+			The CRC protects the HT-SIG (HT-SIG[0][23:0] and
+			HT-SIG[1][9:0]. The generator polynomial is G(D) = D8 + D2 +
+			D + 1.  <legal all>
+*/
+#define HT_SIG_INFO_1_CRC_OFFSET                                     0x00000004
+#define HT_SIG_INFO_1_CRC_LSB                                        10
+#define HT_SIG_INFO_1_CRC_MASK                                       0x0003fc00
+
+/* Description		HT_SIG_INFO_1_SIGNAL_TAIL
+			
+			The 6 bits of tail is always set to 0 is used to flush
+			the BCC encoder and decoder.  <legal 0>
+*/
+#define HT_SIG_INFO_1_SIGNAL_TAIL_OFFSET                             0x00000004
+#define HT_SIG_INFO_1_SIGNAL_TAIL_LSB                                18
+#define HT_SIG_INFO_1_SIGNAL_TAIL_MASK                               0x00fc0000
+
+/* Description		HT_SIG_INFO_1_RESERVED_1
+			
+			This field is not part of HT-SIG:
+			
+			Reserved: Should be set to 0 by the MAC and ignored by
+			the PHY.  <legal 0>
+*/
+#define HT_SIG_INFO_1_RESERVED_1_OFFSET                              0x00000004
+#define HT_SIG_INFO_1_RESERVED_1_LSB                                 24
+#define HT_SIG_INFO_1_RESERVED_1_MASK                                0xff000000
+
+
+#endif // _HT_SIG_INFO_H_
--- a/drivers/staging/fw-api/hw/qca5018/l_sig_a_info.h
+++ b/drivers/staging/fw-api/hw/qca5018/l_sig_a_info.h
@@ -0,0 +1,276 @@
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _L_SIG_A_INFO_H_
+#define _L_SIG_A_INFO_H_
+#if !defined(__ASSEMBLER__)
+#endif
+
+
+// ################ START SUMMARY #################
+//
+//	Dword	Fields
+//	0	rate[3:0], lsig_reserved[4], length[16:5], parity[17], tail[23:18], pkt_type[27:24], captured_implicit_sounding[28], reserved[31:29]
+//
+// ################ END SUMMARY #################
+
+#define NUM_OF_DWORDS_L_SIG_A_INFO 1
+
+struct l_sig_a_info {
+             uint32_t rate                            :  4, //[3:0]
+                      lsig_reserved                   :  1, //[4]
+                      length                          : 12, //[16:5]
+                      parity                          :  1, //[17]
+                      tail                            :  6, //[23:18]
+                      pkt_type                        :  4, //[27:24]
+                      captured_implicit_sounding      :  1, //[28]
+                      reserved                        :  3; //[31:29]
+};
+
+/*
+
+rate
+			
+			This format is originally defined for OFDM as a 4 bit
+			field but the 5th bit was added to indicate 11b formatted
+			frames.  In the standard bit [4] is specified as reserved. 
+			For 11b frames this L-SIG is transformed in the PHY into the
+			11b preamble format.  The following are the rates:
+			
+			<enum 8     ofdm_48_mbps> 64-QAM 2/3 (48 Mbps)
+			
+			<enum 9     ofdm_24_mbps> 16-QAM 1/2 (24 Mbps)
+			
+			<enum 10     ofdm_12_mbps> QPSK 1/2 (12 Mbps)
+			
+			<enum 11     ofdm_6_mbps> BPSK 1/2 (6 Mbps)
+			
+			<enum 12     ofdm_54_mbps> 64-QAM 3/4 (54 Mbps)
+			
+			<enum 13     ofdm_36_mbps> 16-QAM 3/4 (36 Mbps)
+			
+			<enum 14     ofdm_18_mbps> QPSK 1/2 (18 Mbps)
+			
+			<enum 15     ofdm_9_mbps> BPSK 3/4 (9 Mbps)
+			
+			<legal 8-15>
+
+lsig_reserved
+			
+			Reserved: Should be set to 0 by the MAC and ignored by
+			the PHY
+			
+			<legal 0>
+
+length
+			
+			The length indicates the number of octets in this MPDU. 
+			Note that when using mixed mode 11n preamble this length
+			provides the spoofed length for the PPDU.  This length
+			provides part of the information to derive the actually PPDU
+			length.  For legacy OFDM and 11B frames the maximum length
+			is 
+			
+			<legal all>
+
+parity
+			
+			11a/n/ac TX: This field provides even parity over the
+			first 18 bits of the signal field which means that the sum
+			of 1s in the signal field will always be even on
+			
+			11a/n/ac RX: this field contains the received parity
+			field from the L-SIG symbol for the current packet.
+			
+			<legal 0-1>
+
+tail
+			
+			The 6 bits of tail is always set to 0 is used to flush
+			the BCC encoder and decoder.  <legal 0>
+
+pkt_type
+			
+			Only used on the RX side.  
+			
+			Note: This is not really part of L-SIG
+			
+			
+			
+			Packet type:
+			
+			<enum 0 dot11a>802.11a PPDU type
+			
+			<enum 1 dot11b>802.11b PPDU type
+			
+			<enum 2 dot11n_mm>802.11n Mixed Mode PPDU type
+			
+			<enum 3 dot11ac>802.11ac PPDU type
+			
+			<enum 4 dot11ax>802.11ax PPDU type
+			
+			<enum 5 dot11ba>802.11ba (WUR) PPDU type
+
+captured_implicit_sounding
+			
+			Only used on the RX side.  
+			
+			Note: This is not really part of L-SIG
+			
+			
+			
+			This indicates that the PHY has captured implicit
+			sounding.
+
+reserved
+			
+			Reserved: Should be set to 0 by the transmitting MAC and
+			ignored by the PHY <legal 0>
+*/
+
+
+/* Description		L_SIG_A_INFO_0_RATE
+			
+			This format is originally defined for OFDM as a 4 bit
+			field but the 5th bit was added to indicate 11b formatted
+			frames.  In the standard bit [4] is specified as reserved. 
+			For 11b frames this L-SIG is transformed in the PHY into the
+			11b preamble format.  The following are the rates:
+			
+			<enum 8     ofdm_48_mbps> 64-QAM 2/3 (48 Mbps)
+			
+			<enum 9     ofdm_24_mbps> 16-QAM 1/2 (24 Mbps)
+			
+			<enum 10     ofdm_12_mbps> QPSK 1/2 (12 Mbps)
+			
+			<enum 11     ofdm_6_mbps> BPSK 1/2 (6 Mbps)
+			
+			<enum 12     ofdm_54_mbps> 64-QAM 3/4 (54 Mbps)
+			
+			<enum 13     ofdm_36_mbps> 16-QAM 3/4 (36 Mbps)
+			
+			<enum 14     ofdm_18_mbps> QPSK 1/2 (18 Mbps)
+			
+			<enum 15     ofdm_9_mbps> BPSK 3/4 (9 Mbps)
+			
+			<legal 8-15>
+*/
+#define L_SIG_A_INFO_0_RATE_OFFSET                                   0x00000000
+#define L_SIG_A_INFO_0_RATE_LSB                                      0
+#define L_SIG_A_INFO_0_RATE_MASK                                     0x0000000f
+
+/* Description		L_SIG_A_INFO_0_LSIG_RESERVED
+			
+			Reserved: Should be set to 0 by the MAC and ignored by
+			the PHY
+			
+			<legal 0>
+*/
+#define L_SIG_A_INFO_0_LSIG_RESERVED_OFFSET                          0x00000000
+#define L_SIG_A_INFO_0_LSIG_RESERVED_LSB                             4
+#define L_SIG_A_INFO_0_LSIG_RESERVED_MASK                            0x00000010
+
+/* Description		L_SIG_A_INFO_0_LENGTH
+			
+			The length indicates the number of octets in this MPDU. 
+			Note that when using mixed mode 11n preamble this length
+			provides the spoofed length for the PPDU.  This length
+			provides part of the information to derive the actually PPDU
+			length.  For legacy OFDM and 11B frames the maximum length
+			is 
+			
+			<legal all>
+*/
+#define L_SIG_A_INFO_0_LENGTH_OFFSET                                 0x00000000
+#define L_SIG_A_INFO_0_LENGTH_LSB                                    5
+#define L_SIG_A_INFO_0_LENGTH_MASK                                   0x0001ffe0
+
+/* Description		L_SIG_A_INFO_0_PARITY
+			
+			11a/n/ac TX: This field provides even parity over the
+			first 18 bits of the signal field which means that the sum
+			of 1s in the signal field will always be even on
+			
+			11a/n/ac RX: this field contains the received parity
+			field from the L-SIG symbol for the current packet.
+			
+			<legal 0-1>
+*/
+#define L_SIG_A_INFO_0_PARITY_OFFSET                                 0x00000000
+#define L_SIG_A_INFO_0_PARITY_LSB                                    17
+#define L_SIG_A_INFO_0_PARITY_MASK                                   0x00020000
+
+/* Description		L_SIG_A_INFO_0_TAIL
+			
+			The 6 bits of tail is always set to 0 is used to flush
+			the BCC encoder and decoder.  <legal 0>
+*/
+#define L_SIG_A_INFO_0_TAIL_OFFSET                                   0x00000000
+#define L_SIG_A_INFO_0_TAIL_LSB                                      18
+#define L_SIG_A_INFO_0_TAIL_MASK                                     0x00fc0000
+
+/* Description		L_SIG_A_INFO_0_PKT_TYPE
+			
+			Only used on the RX side.  
+			
+			Note: This is not really part of L-SIG
+			
+			
+			
+			Packet type:
+			
+			<enum 0 dot11a>802.11a PPDU type
+			
+			<enum 1 dot11b>802.11b PPDU type
+			
+			<enum 2 dot11n_mm>802.11n Mixed Mode PPDU type
+			
+			<enum 3 dot11ac>802.11ac PPDU type
+			
+			<enum 4 dot11ax>802.11ax PPDU type
+			
+			<enum 5 dot11ba>802.11ba (WUR) PPDU type
+*/
+#define L_SIG_A_INFO_0_PKT_TYPE_OFFSET                               0x00000000
+#define L_SIG_A_INFO_0_PKT_TYPE_LSB                                  24
+#define L_SIG_A_INFO_0_PKT_TYPE_MASK                                 0x0f000000
+
+/* Description		L_SIG_A_INFO_0_CAPTURED_IMPLICIT_SOUNDING
+			
+			Only used on the RX side.  
+			
+			Note: This is not really part of L-SIG
+			
+			
+			
+			This indicates that the PHY has captured implicit
+			sounding.
+*/
+#define L_SIG_A_INFO_0_CAPTURED_IMPLICIT_SOUNDING_OFFSET             0x00000000
+#define L_SIG_A_INFO_0_CAPTURED_IMPLICIT_SOUNDING_LSB                28
+#define L_SIG_A_INFO_0_CAPTURED_IMPLICIT_SOUNDING_MASK               0x10000000
+
+/* Description		L_SIG_A_INFO_0_RESERVED
+			
+			Reserved: Should be set to 0 by the transmitting MAC and
+			ignored by the PHY <legal 0>
+*/
+#define L_SIG_A_INFO_0_RESERVED_OFFSET                               0x00000000
+#define L_SIG_A_INFO_0_RESERVED_LSB                                  29
+#define L_SIG_A_INFO_0_RESERVED_MASK                                 0xe0000000
+
+
+#endif // _L_SIG_A_INFO_H_
--- a/drivers/staging/fw-api/hw/qca5018/l_sig_b_info.h
+++ b/drivers/staging/fw-api/hw/qca5018/l_sig_b_info.h
@@ -0,0 +1,113 @@
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _L_SIG_B_INFO_H_
+#define _L_SIG_B_INFO_H_
+#if !defined(__ASSEMBLER__)
+#endif
+
+
+// ################ START SUMMARY #################
+//
+//	Dword	Fields
+//	0	rate[3:0], length[15:4], reserved[31:16]
+//
+// ################ END SUMMARY #################
+
+#define NUM_OF_DWORDS_L_SIG_B_INFO 1
+
+struct l_sig_b_info {
+             uint32_t rate                            :  4, //[3:0]
+                      length                          : 12, //[15:4]
+                      reserved                        : 16; //[31:16]
+};
+
+/*
+
+rate
+			
+			<enum 1    dsss_1_mpbs_long> DSSS 1 Mbps long
+			
+			<enum 2    dsss_2_mbps_long> DSSS 2 Mbps long
+			
+			<enum 3    cck_5_5_mbps_long> CCK 5.5 Mbps long
+			
+			<enum 4    cck_11_mbps_long> CCK 11 Mbps long
+			
+			<enum 5    dsss_2_mbps_short> DSSS 2 Mbps short
+			
+			<enum 6    cck_5_5_mbps_short> CCK 5.5 Mbps short
+			
+			<enum 7    cck_11_mbps_short> CCK 11 Mbps short
+			
+			<legal 1-7>
+
+length
+			
+			The length indicates the number of octets in this MPDU.
+			
+			<legal all>
+
+reserved
+			
+			Reserved: Should be set to 0 by the transmitting MAC and
+			ignored by the PHY <legal 0>
+*/
+
+
+/* Description		L_SIG_B_INFO_0_RATE
+			
+			<enum 1    dsss_1_mpbs_long> DSSS 1 Mbps long
+			
+			<enum 2    dsss_2_mbps_long> DSSS 2 Mbps long
+			
+			<enum 3    cck_5_5_mbps_long> CCK 5.5 Mbps long
+			
+			<enum 4    cck_11_mbps_long> CCK 11 Mbps long
+			
+			<enum 5    dsss_2_mbps_short> DSSS 2 Mbps short
+			
+			<enum 6    cck_5_5_mbps_short> CCK 5.5 Mbps short
+			
+			<enum 7    cck_11_mbps_short> CCK 11 Mbps short
+			
+			<legal 1-7>
+*/
+#define L_SIG_B_INFO_0_RATE_OFFSET                                   0x00000000
+#define L_SIG_B_INFO_0_RATE_LSB                                      0
+#define L_SIG_B_INFO_0_RATE_MASK                                     0x0000000f
+
+/* Description		L_SIG_B_INFO_0_LENGTH
+			
+			The length indicates the number of octets in this MPDU.
+			
+			<legal all>
+*/
+#define L_SIG_B_INFO_0_LENGTH_OFFSET                                 0x00000000
+#define L_SIG_B_INFO_0_LENGTH_LSB                                    4
+#define L_SIG_B_INFO_0_LENGTH_MASK                                   0x0000fff0
+
+/* Description		L_SIG_B_INFO_0_RESERVED
+			
+			Reserved: Should be set to 0 by the transmitting MAC and
+			ignored by the PHY <legal 0>
+*/
+#define L_SIG_B_INFO_0_RESERVED_OFFSET                               0x00000000
+#define L_SIG_B_INFO_0_RESERVED_LSB                                  16
+#define L_SIG_B_INFO_0_RESERVED_MASK                                 0xffff0000
+
+
+#endif // _L_SIG_B_INFO_H_
--- a/drivers/staging/fw-api/hw/qca5018/mac_tcl_reg_seq_hwiobase.h
+++ b/drivers/staging/fw-api/hw/qca5018/mac_tcl_reg_seq_hwiobase.h
@@ -0,0 +1,37 @@
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+///////////////////////////////////////////////////////////////////////////////////////////////
+//
+// mac_tcl_reg_seq_hwiobase.h : automatically generated by Autoseq  3.8 2/21/2020 
+// User Name:c_landav
+//
+// !! WARNING !!  DO NOT MANUALLY EDIT THIS FILE.
+//
+///////////////////////////////////////////////////////////////////////////////////////////////
+
+#ifndef __MAC_TCL_REG_SEQ_BASE_H__
+#define __MAC_TCL_REG_SEQ_BASE_H__
+
+#ifdef SCALE_INCLUDES
+	#include "HALhwio.h"
+#else
+	#include "msmhwio.h"
+#endif
+
+
+#endif
+
--- a/drivers/staging/fw-api/hw/qca5018/mac_tcl_reg_seq_hwioreg.h
+++ b/drivers/staging/fw-api/hw/qca5018/mac_tcl_reg_seq_hwioreg.h
--- a/drivers/staging/fw-api/hw/qca5018/macrx_abort_request_info.h
+++ b/drivers/staging/fw-api/hw/qca5018/macrx_abort_request_info.h
@@ -0,0 +1,112 @@
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _MACRX_ABORT_REQUEST_INFO_H_
+#define _MACRX_ABORT_REQUEST_INFO_H_
+#if !defined(__ASSEMBLER__)
+#endif
+
+
+// ################ START SUMMARY #################
+//
+//	Dword	Fields
+//	0	macrx_abort_reason[7:0], reserved_0[15:8]
+//
+// ################ END SUMMARY #################
+
+#define NUM_OF_WORDS_MACRX_ABORT_REQUEST_INFO 1
+
+struct macrx_abort_request_info {
+             uint16_t macrx_abort_reason              :  8, //[7:0]
+                      reserved_0                      :  8; //[15:8]
+};
+
+/*
+
+macrx_abort_reason
+			
+			<enum 0 macrx_abort_sw_initiated>
+			
+			<enum 1 macrx_abort_obss_reception> Upon receiving this
+			abort reason, PHY should stop reception of the current frame
+			and go back into a search mode
+			
+			<enum 2 macrx_abort_other>
+			
+			<enum 3 macrx_abort_sw_initiated_channel_switch > MAC FW
+			issued an abort for channel switch reasons
+			
+			<enum 4 macrx_abort_sw_initiated_power_save > MAC FW
+			issued an abort power save reasons
+			
+			<enum 5 macrx_abort_too_much_bad_data > RXPCU is
+			terminating the current ongoing reception, as the data that
+			MAC is receiving seems to be all garbage... The PER is too
+			high, or in case of MU UL, Likely the trigger frame never
+			got properly received by any of the targeted MU UL devices.
+			After the abort, PHYRX can resume a normal search mode.
+			
+			
+			
+			<legal 0-5>
+
+reserved_0
+			
+			<legal 0>
+*/
+
+
+/* Description		MACRX_ABORT_REQUEST_INFO_0_MACRX_ABORT_REASON
+			
+			<enum 0 macrx_abort_sw_initiated>
+			
+			<enum 1 macrx_abort_obss_reception> Upon receiving this
+			abort reason, PHY should stop reception of the current frame
+			and go back into a search mode
+			
+			<enum 2 macrx_abort_other>
+			
+			<enum 3 macrx_abort_sw_initiated_channel_switch > MAC FW
+			issued an abort for channel switch reasons
+			
+			<enum 4 macrx_abort_sw_initiated_power_save > MAC FW
+			issued an abort power save reasons
+			
+			<enum 5 macrx_abort_too_much_bad_data > RXPCU is
+			terminating the current ongoing reception, as the data that
+			MAC is receiving seems to be all garbage... The PER is too
+			high, or in case of MU UL, Likely the trigger frame never
+			got properly received by any of the targeted MU UL devices.
+			After the abort, PHYRX can resume a normal search mode.
+			
+			
+			
+			<legal 0-5>
+*/
+#define MACRX_ABORT_REQUEST_INFO_0_MACRX_ABORT_REASON_OFFSET         0x00000000
+#define MACRX_ABORT_REQUEST_INFO_0_MACRX_ABORT_REASON_LSB            0
+#define MACRX_ABORT_REQUEST_INFO_0_MACRX_ABORT_REASON_MASK           0x000000ff
+
+/* Description		MACRX_ABORT_REQUEST_INFO_0_RESERVED_0
+			
+			<legal 0>
+*/
+#define MACRX_ABORT_REQUEST_INFO_0_RESERVED_0_OFFSET                 0x00000000
+#define MACRX_ABORT_REQUEST_INFO_0_RESERVED_0_LSB                    8
+#define MACRX_ABORT_REQUEST_INFO_0_RESERVED_0_MASK                   0x0000ff00
+
+
+#endif // _MACRX_ABORT_REQUEST_INFO_H_
--- a/drivers/staging/fw-api/hw/qca5018/phyrx_abort_request_info.h
+++ b/drivers/staging/fw-api/hw/qca5018/phyrx_abort_request_info.h
@@ -0,0 +1,413 @@
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _PHYRX_ABORT_REQUEST_INFO_H_
+#define _PHYRX_ABORT_REQUEST_INFO_H_
+#if !defined(__ASSEMBLER__)
+#endif
+
+
+// ################ START SUMMARY #################
+//
+//	Dword	Fields
+//	0	phyrx_abort_reason[7:0], phy_enters_nap_state[8], phy_enters_defer_state[9], reserved_0[15:10], receive_duration[31:16]
+//
+// ################ END SUMMARY #################
+
+#define NUM_OF_DWORDS_PHYRX_ABORT_REQUEST_INFO 1
+
+struct phyrx_abort_request_info {
+             uint32_t phyrx_abort_reason              :  8, //[7:0]
+                      phy_enters_nap_state            :  1, //[8]
+                      phy_enters_defer_state          :  1, //[9]
+                      reserved_0                      :  6, //[15:10]
+                      receive_duration                : 16; //[31:16]
+};
+
+/*
+
+phyrx_abort_reason
+			
+			<enum 0 phyrx_err_phy_off> Reception aborted due to
+			receiving a PHY_OFF TLV
+			
+			<enum 1 phyrx_err_synth_off> 
+			
+			<enum 2 phyrx_err_ofdma_timing> 
+			
+			<enum 3 phyrx_err_ofdma_signal_parity> 
+			
+			<enum 4 phyrx_err_ofdma_rate_illegal> 
+			
+			<enum 5 phyrx_err_ofdma_length_illegal> 
+			
+			<enum 6 phyrx_err_ofdma_restart> 
+			
+			<enum 7 phyrx_err_ofdma_service> 
+			
+			<enum 8 phyrx_err_ppdu_ofdma_power_drop> 
+			
+			
+			
+			<enum 9 phyrx_err_cck_blokker> 
+			
+			<enum 10 phyrx_err_cck_timing> 
+			
+			<enum 11 phyrx_err_cck_header_crc> 
+			
+			<enum 12 phyrx_err_cck_rate_illegal> 
+			
+			<enum 13 phyrx_err_cck_length_illegal> 
+			
+			<enum 14 phyrx_err_cck_restart> 
+			
+			<enum 15 phyrx_err_cck_service> 
+			
+			<enum 16 phyrx_err_cck_power_drop> 
+			
+			
+			
+			<enum 17 phyrx_err_ht_crc_err> 
+			
+			<enum 18 phyrx_err_ht_length_illegal> 
+			
+			<enum 19 phyrx_err_ht_rate_illegal> 
+			
+			<enum 20 phyrx_err_ht_zlf> 
+			
+			<enum 21 phyrx_err_false_radar_ext> 
+			
+			
+			
+			<enum 22 phyrx_err_green_field> 
+			
+			
+			
+			<enum 23 phyrx_err_bw_gt_dyn_bw> 
+			
+			<enum 24 phyrx_err_leg_ht_mismatch> 
+			
+			<enum 25 phyrx_err_vht_crc_error> 
+			
+			<enum 26 phyrx_err_vht_siga_unsupported> 
+			
+			<enum 27 phyrx_err_vht_lsig_len_invalid> 
+			
+			<enum 28 phyrx_err_vht_ndp_or_zlf> 
+			
+			<enum 29 phyrx_err_vht_nsym_lt_zero> 
+			
+			<enum 30 phyrx_err_vht_rx_extra_symbol_mismatch> 
+			
+			<enum 31 phyrx_err_vht_rx_skip_group_id0> 
+			
+			<enum 32 phyrx_err_vht_rx_skip_group_id1to62> 
+			
+			<enum 33 phyrx_err_vht_rx_skip_group_id63> 
+			
+			<enum 34 phyrx_err_ofdm_ldpc_decoder_disabled> 
+			
+			<enum 35 phyrx_err_defer_nap> 
+			
+			<enum 36 phyrx_err_fdomain_timeout> 
+			
+			<enum 37 phyrx_err_lsig_rel_check> 
+			
+			<enum 38 phyrx_err_bt_collision> 
+			
+			<enum 39 phyrx_err_unsupported_mu_feedback> 
+			
+			<enum 40 phyrx_err_ppdu_tx_interrupt_rx> 
+			
+			<enum 41 phyrx_err_unsupported_cbf> 
+			
+			
+			
+			<enum 42 phyrx_err_other>  Should not really be used. If
+			needed, ask for documentation update 
+			
+			
+			
+			<enum 43 phyrx_err_he_siga_unsupported > <enum 44
+			phyrx_err_he_crc_error > <enum 45
+			phyrx_err_he_sigb_unsupported > <enum 46
+			phyrx_err_he_mu_mode_unsupported > <enum 47
+			phyrx_err_he_ndp_or_zlf > <enum 48 phyrx_err_he_nsym_lt_zero
+			> <enum 49 phyrx_err_he_ru_params_unsupported > <enum 50
+			phyrx_err_he_num_users_unsupported ><enum 51
+			phyrx_err_he_sounding_params_unsupported >
+			
+			
+			
+			<enum 52 phyrx_err_MU_UL_no_power_detected> 
+			
+			<enum 53 phyrx_err_MU_UL_not_for_me>
+			
+			
+			
+			<legal 0 - 53>
+
+phy_enters_nap_state
+			
+			When set, PHY enters PHY NAP state after sending this
+			abort
+			
+			
+			
+			Note that nap and defer state are mutually exclusive.
+			
+			
+			
+			Field put pro-actively in place....usage still to be
+			agreed upon.
+			
+			<legal all>
+
+phy_enters_defer_state
+			
+			When set, PHY enters PHY defer state after sending this
+			abort
+			
+			
+			
+			Note that nap and defer state are mutually exclusive.
+			
+			
+			
+			Field put pro-actively in place....usage still to be
+			agreed upon.
+			
+			<legal all>
+
+reserved_0
+			
+			<legal 0>
+
+receive_duration
+			
+			The remaining receive duration of this PPDU in the
+			medium (in us). When PHY does not know this duration when
+			this TLV is generated, the field will be set to 0.
+			
+			The timing reference point is the reception by the MAC
+			of this TLV. The value shall be accurate to within 2us.
+			
+			
+			
+			In case Phy_enters_nap_state and/or
+			Phy_enters_defer_state is set, there is a possibility that
+			MAC PMM can also decide to go into a low(er) power state. 
+			
+			<legal all>
+*/
+
+
+/* Description		PHYRX_ABORT_REQUEST_INFO_0_PHYRX_ABORT_REASON
+			
+			<enum 0 phyrx_err_phy_off> Reception aborted due to
+			receiving a PHY_OFF TLV
+			
+			<enum 1 phyrx_err_synth_off> 
+			
+			<enum 2 phyrx_err_ofdma_timing> 
+			
+			<enum 3 phyrx_err_ofdma_signal_parity> 
+			
+			<enum 4 phyrx_err_ofdma_rate_illegal> 
+			
+			<enum 5 phyrx_err_ofdma_length_illegal> 
+			
+			<enum 6 phyrx_err_ofdma_restart> 
+			
+			<enum 7 phyrx_err_ofdma_service> 
+			
+			<enum 8 phyrx_err_ppdu_ofdma_power_drop> 
+			
+			
+			
+			<enum 9 phyrx_err_cck_blokker> 
+			
+			<enum 10 phyrx_err_cck_timing> 
+			
+			<enum 11 phyrx_err_cck_header_crc> 
+			
+			<enum 12 phyrx_err_cck_rate_illegal> 
+			
+			<enum 13 phyrx_err_cck_length_illegal> 
+			
+			<enum 14 phyrx_err_cck_restart> 
+			
+			<enum 15 phyrx_err_cck_service> 
+			
+			<enum 16 phyrx_err_cck_power_drop> 
+			
+			
+			
+			<enum 17 phyrx_err_ht_crc_err> 
+			
+			<enum 18 phyrx_err_ht_length_illegal> 
+			
+			<enum 19 phyrx_err_ht_rate_illegal> 
+			
+			<enum 20 phyrx_err_ht_zlf> 
+			
+			<enum 21 phyrx_err_false_radar_ext> 
+			
+			
+			
+			<enum 22 phyrx_err_green_field> 
+			
+			
+			
+			<enum 23 phyrx_err_bw_gt_dyn_bw> 
+			
+			<enum 24 phyrx_err_leg_ht_mismatch> 
+			
+			<enum 25 phyrx_err_vht_crc_error> 
+			
+			<enum 26 phyrx_err_vht_siga_unsupported> 
+			
+			<enum 27 phyrx_err_vht_lsig_len_invalid> 
+			
+			<enum 28 phyrx_err_vht_ndp_or_zlf> 
+			
+			<enum 29 phyrx_err_vht_nsym_lt_zero> 
+			
+			<enum 30 phyrx_err_vht_rx_extra_symbol_mismatch> 
+			
+			<enum 31 phyrx_err_vht_rx_skip_group_id0> 
+			
+			<enum 32 phyrx_err_vht_rx_skip_group_id1to62> 
+			
+			<enum 33 phyrx_err_vht_rx_skip_group_id63> 
+			
+			<enum 34 phyrx_err_ofdm_ldpc_decoder_disabled> 
+			
+			<enum 35 phyrx_err_defer_nap> 
+			
+			<enum 36 phyrx_err_fdomain_timeout> 
+			
+			<enum 37 phyrx_err_lsig_rel_check> 
+			
+			<enum 38 phyrx_err_bt_collision> 
+			
+			<enum 39 phyrx_err_unsupported_mu_feedback> 
+			
+			<enum 40 phyrx_err_ppdu_tx_interrupt_rx> 
+			
+			<enum 41 phyrx_err_unsupported_cbf> 
+			
+			
+			
+			<enum 42 phyrx_err_other>  Should not really be used. If
+			needed, ask for documentation update 
+			
+			
+			
+			<enum 43 phyrx_err_he_siga_unsupported > <enum 44
+			phyrx_err_he_crc_error > <enum 45
+			phyrx_err_he_sigb_unsupported > <enum 46
+			phyrx_err_he_mu_mode_unsupported > <enum 47
+			phyrx_err_he_ndp_or_zlf > <enum 48 phyrx_err_he_nsym_lt_zero
+			> <enum 49 phyrx_err_he_ru_params_unsupported > <enum 50
+			phyrx_err_he_num_users_unsupported ><enum 51
+			phyrx_err_he_sounding_params_unsupported >
+			
+			
+			
+			<enum 52 phyrx_err_MU_UL_no_power_detected> 
+			
+			<enum 53 phyrx_err_MU_UL_not_for_me>
+			
+			
+			
+			<legal 0 - 53>
+*/
+#define PHYRX_ABORT_REQUEST_INFO_0_PHYRX_ABORT_REASON_OFFSET         0x00000000
+#define PHYRX_ABORT_REQUEST_INFO_0_PHYRX_ABORT_REASON_LSB            0
+#define PHYRX_ABORT_REQUEST_INFO_0_PHYRX_ABORT_REASON_MASK           0x000000ff
+
+/* Description		PHYRX_ABORT_REQUEST_INFO_0_PHY_ENTERS_NAP_STATE
+			
+			When set, PHY enters PHY NAP state after sending this
+			abort
+			
+			
+			
+			Note that nap and defer state are mutually exclusive.
+			
+			
+			
+			Field put pro-actively in place....usage still to be
+			agreed upon.
+			
+			<legal all>
+*/
+#define PHYRX_ABORT_REQUEST_INFO_0_PHY_ENTERS_NAP_STATE_OFFSET       0x00000000
+#define PHYRX_ABORT_REQUEST_INFO_0_PHY_ENTERS_NAP_STATE_LSB          8
+#define PHYRX_ABORT_REQUEST_INFO_0_PHY_ENTERS_NAP_STATE_MASK         0x00000100
+
+/* Description		PHYRX_ABORT_REQUEST_INFO_0_PHY_ENTERS_DEFER_STATE
+			
+			When set, PHY enters PHY defer state after sending this
+			abort
+			
+			
+			
+			Note that nap and defer state are mutually exclusive.
+			
+			
+			
+			Field put pro-actively in place....usage still to be
+			agreed upon.
+			
+			<legal all>
+*/
+#define PHYRX_ABORT_REQUEST_INFO_0_PHY_ENTERS_DEFER_STATE_OFFSET     0x00000000
+#define PHYRX_ABORT_REQUEST_INFO_0_PHY_ENTERS_DEFER_STATE_LSB        9
+#define PHYRX_ABORT_REQUEST_INFO_0_PHY_ENTERS_DEFER_STATE_MASK       0x00000200
+
+/* Description		PHYRX_ABORT_REQUEST_INFO_0_RESERVED_0
+			
+			<legal 0>
+*/
+#define PHYRX_ABORT_REQUEST_INFO_0_RESERVED_0_OFFSET                 0x00000000
+#define PHYRX_ABORT_REQUEST_INFO_0_RESERVED_0_LSB                    10
+#define PHYRX_ABORT_REQUEST_INFO_0_RESERVED_0_MASK                   0x0000fc00
+
+/* Description		PHYRX_ABORT_REQUEST_INFO_0_RECEIVE_DURATION
+			
+			The remaining receive duration of this PPDU in the
+			medium (in us). When PHY does not know this duration when
+			this TLV is generated, the field will be set to 0.
+			
+			The timing reference point is the reception by the MAC
+			of this TLV. The value shall be accurate to within 2us.
+			
+			
+			
+			In case Phy_enters_nap_state and/or
+			Phy_enters_defer_state is set, there is a possibility that
+			MAC PMM can also decide to go into a low(er) power state. 
+			
+			<legal all>
+*/
+#define PHYRX_ABORT_REQUEST_INFO_0_RECEIVE_DURATION_OFFSET           0x00000000
+#define PHYRX_ABORT_REQUEST_INFO_0_RECEIVE_DURATION_LSB              16
+#define PHYRX_ABORT_REQUEST_INFO_0_RECEIVE_DURATION_MASK             0xffff0000
+
+
+#endif // _PHYRX_ABORT_REQUEST_INFO_H_
--- a/drivers/staging/fw-api/hw/qca5018/phyrx_he_sig_a_mu_dl.h
+++ b/drivers/staging/fw-api/hw/qca5018/phyrx_he_sig_a_mu_dl.h
@@ -0,0 +1,401 @@
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _PHYRX_HE_SIG_A_MU_DL_H_
+#define _PHYRX_HE_SIG_A_MU_DL_H_
+#if !defined(__ASSEMBLER__)
+#endif
+
+#include "he_sig_a_mu_dl_info.h"
+
+// ################ START SUMMARY #################
+//
+//	Dword	Fields
+//	0-1	struct he_sig_a_mu_dl_info phyrx_he_sig_a_mu_dl_info_details;
+//
+// ################ END SUMMARY #################
+
+#define NUM_OF_DWORDS_PHYRX_HE_SIG_A_MU_DL 2
+
+struct phyrx_he_sig_a_mu_dl {
+    struct            he_sig_a_mu_dl_info                       phyrx_he_sig_a_mu_dl_info_details;
+};
+
+/*
+
+struct he_sig_a_mu_dl_info phyrx_he_sig_a_mu_dl_info_details
+			
+			See detailed description of the STRUCT
+*/
+
+
+ /* EXTERNAL REFERENCE : struct he_sig_a_mu_dl_info phyrx_he_sig_a_mu_dl_info_details */ 
+
+
+/* Description		PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_DL_UL_FLAG
+			
+			Differentiates between DL and UL transmission 
+			
+			
+			
+			<enum 0 DL_UL_FLAG_IS_DL_OR_TDLS>
+			
+			<enum 1 DL_UL_FLAG_IS_UL>
+			
+			NOTE: This is unsupported for HE MU format (including
+			MU_SU) Tx in Napier and Hastings80.
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_DL_UL_FLAG_OFFSET 0x00000000
+#define PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_DL_UL_FLAG_LSB 0
+#define PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_DL_UL_FLAG_MASK 0x00000001
+
+/* Description		PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_MCS_OF_SIG_B
+			
+			Indicates the MCS of HE-SIG-B
+			
+			<legal 0-5>
+*/
+#define PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_MCS_OF_SIG_B_OFFSET 0x00000000
+#define PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_MCS_OF_SIG_B_LSB 1
+#define PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_MCS_OF_SIG_B_MASK 0x0000000e
+
+/* Description		PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_DCM_OF_SIG_B
+			
+			Indicates whether dual sub-carrier modulation is applied
+			to HE-SIG-B 
+			
+			
+			
+			0: No DCM for HE_SIG_B
+			
+			1: DCM for HE_SIG_B
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_DCM_OF_SIG_B_OFFSET 0x00000000
+#define PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_DCM_OF_SIG_B_LSB 4
+#define PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_DCM_OF_SIG_B_MASK 0x00000010
+
+/* Description		PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_BSS_COLOR_ID
+			
+			BSS color ID 
+			
+			
+			
+			Field Used by MAC HW
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_BSS_COLOR_ID_OFFSET 0x00000000
+#define PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_BSS_COLOR_ID_LSB 5
+#define PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_BSS_COLOR_ID_MASK 0x000007e0
+
+/* Description		PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_SPATIAL_REUSE
+			
+			Spatial reuse
+			
+			
+			
+			For 20MHz one SR field corresponding to entire 20MHz
+			(other 3 fields indicate identical values)
+			
+			For 40MHz two SR fields for each 20MHz (other 2 fields
+			indicate identical values)
+			
+			For 80MHz four SR fields for each 20MHz
+			
+			For 160MHz four SR fields for each 40MHz
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_SPATIAL_REUSE_OFFSET 0x00000000
+#define PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_SPATIAL_REUSE_LSB 11
+#define PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_SPATIAL_REUSE_MASK 0x00007800
+
+/* Description		PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_TRANSMIT_BW
+			
+			Bandwidth of the PPDU.
+			
+			
+			
+			<enum 0 HE_SIG_A_MU_DL_BW20> 20 Mhz 
+			
+			<enum 1 HE_SIG_A_MU_DL_BW40> 40 Mhz 
+			
+			<enum 2 HE_SIG_A_MU_DL_BW80> 80 MHz non-preamble
+			puncturing mode
+			
+			<enum 3 HE_SIG_A_MU_DL_BW160> 160 MHz and 80+80 MHz
+			non-preamble puncturing mode
+			
+			<enum 4 HE_SIG_A_MU_DL_BW80_SEC_20_PUNC> for preamble
+			puncturing in 80 MHz, where in the preamble only the
+			secondary 20 MHz is punctured
+			
+			<enum 5 HE_SIG_A_MU_DL_BW80_20_PUNC_IN_SEC_40> for
+			preamble puncturing in 80 MHz, where in the preamble only
+			one of the two 20 MHz sub-channels in secondary 40 MHz is
+			punctured.
+			
+			<enum 6 HE_SIG_A_MU_DL_BW160_SEC_20_PUNC> for preamble
+			puncturing in 160 MHz or 80+80 MHz, where in the primary 80
+			MHz of the preamble only the secondary 20 MHz is punctured.
+			
+			<enum 7 HE_SIG_A_MU_DL_BW160_SEC_40_80_PUNC> for
+			preamble puncturing in 160 MHz or 80+80 MHz, where in the
+			primary 80 MHz of the preamble the primary 40 MHz is
+			present.
+			
+			
+			
+			On RX side, Field Used by MAC HW
+			
+			<legal 0-7>
+*/
+#define PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_TRANSMIT_BW_OFFSET 0x00000000
+#define PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_TRANSMIT_BW_LSB 15
+#define PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_TRANSMIT_BW_MASK 0x00038000
+
+/* Description		PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_NUM_SIG_B_SYMBOLS
+			
+			Number of symbols
+			
+			
+			
+			For OFDMA, the actual number of symbols is 1 larger then
+			indicated in this field.
+			
+			
+			
+			For MU-MIMO this is equal to the number of users - 1:
+			the following encoding is used:
+			
+			1 => 2 users
+			
+			2 => 3 users
+			
+			Etc.
+			
+			
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_NUM_SIG_B_SYMBOLS_OFFSET 0x00000000
+#define PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_NUM_SIG_B_SYMBOLS_LSB 18
+#define PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_NUM_SIG_B_SYMBOLS_MASK 0x003c0000
+
+/* Description		PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_COMP_MODE_SIG_B
+			
+			Indicates the compression mode of HE-SIG-B
+			
+			
+			
+			0: Regular [uncomp mode]
+			
+			1: compressed mode (full-BW MU-MIMO only) 
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_COMP_MODE_SIG_B_OFFSET 0x00000000
+#define PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_COMP_MODE_SIG_B_LSB 22
+#define PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_COMP_MODE_SIG_B_MASK 0x00400000
+
+/* Description		PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_CP_LTF_SIZE
+			
+			Indicates the CP and HE-LTF type 
+			
+			
+			
+			<enum 0 MU_FourX_LTF_0_8CP> 4xLTF + 0.8 us CP
+			
+			<enum 1 MU_TwoX_LTF_0_8CP> 2x LTF + 0.8 µs CP
+			
+			<enum 2 MU_TwoX_LTF_1_6CP> 2x LTF + 1.6 µs CP
+			
+			<enum 3 MU_FourX_LTF_3_2CP> 4x LTF + 3.2 µs CP 
+			
+			
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_CP_LTF_SIZE_OFFSET 0x00000000
+#define PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_CP_LTF_SIZE_LSB 23
+#define PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_CP_LTF_SIZE_MASK 0x01800000
+
+/* Description		PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_DOPPLER_INDICATION
+			
+			0: No Doppler support
+			
+			1: Doppler support
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_DOPPLER_INDICATION_OFFSET 0x00000000
+#define PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_DOPPLER_INDICATION_LSB 25
+#define PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_DOPPLER_INDICATION_MASK 0x02000000
+
+/* Description		PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_RESERVED_0A
+			
+			<legal 0>
+*/
+#define PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_RESERVED_0A_OFFSET 0x00000000
+#define PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_RESERVED_0A_LSB 26
+#define PHYRX_HE_SIG_A_MU_DL_0_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_RESERVED_0A_MASK 0xfc000000
+
+/* Description		PHYRX_HE_SIG_A_MU_DL_1_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_TXOP_DURATION
+			
+			Indicates the remaining time in the current TXOP
+			
+			
+			
+			Field Used by MAC HW
+			
+			 <legal all>
+*/
+#define PHYRX_HE_SIG_A_MU_DL_1_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_TXOP_DURATION_OFFSET 0x00000004
+#define PHYRX_HE_SIG_A_MU_DL_1_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_TXOP_DURATION_LSB 0
+#define PHYRX_HE_SIG_A_MU_DL_1_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_TXOP_DURATION_MASK 0x0000007f
+
+/* Description		PHYRX_HE_SIG_A_MU_DL_1_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_RESERVED_1A
+			
+			Note: spec indicates this shall be set to 1
+			
+			<legal 1>
+*/
+#define PHYRX_HE_SIG_A_MU_DL_1_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_RESERVED_1A_OFFSET 0x00000004
+#define PHYRX_HE_SIG_A_MU_DL_1_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_RESERVED_1A_LSB 7
+#define PHYRX_HE_SIG_A_MU_DL_1_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_RESERVED_1A_MASK 0x00000080
+
+/* Description		PHYRX_HE_SIG_A_MU_DL_1_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_NUM_LTF_SYMBOLS
+			
+			Indicates the number of HE-LTF symbols
+			
+			
+			
+			0: 1 LTF
+			
+			1: 2 LTFs
+			
+			2: 4 LTFs
+			
+			3: 6 LTFs
+			
+			4: 8 LTFs
+			
+			
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_A_MU_DL_1_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_NUM_LTF_SYMBOLS_OFFSET 0x00000004
+#define PHYRX_HE_SIG_A_MU_DL_1_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_NUM_LTF_SYMBOLS_LSB 8
+#define PHYRX_HE_SIG_A_MU_DL_1_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_NUM_LTF_SYMBOLS_MASK 0x00000700
+
+/* Description		PHYRX_HE_SIG_A_MU_DL_1_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_LDPC_EXTRA_SYMBOL
+			
+			If LDPC, 
+			
+			  0: LDPC extra symbol not present
+			
+			  1: LDPC extra symbol present
+			
+			Else 
+			
+			  Set to 1
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_A_MU_DL_1_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_LDPC_EXTRA_SYMBOL_OFFSET 0x00000004
+#define PHYRX_HE_SIG_A_MU_DL_1_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_LDPC_EXTRA_SYMBOL_LSB 11
+#define PHYRX_HE_SIG_A_MU_DL_1_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_LDPC_EXTRA_SYMBOL_MASK 0x00000800
+
+/* Description		PHYRX_HE_SIG_A_MU_DL_1_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_STBC
+			
+			Indicates whether STBC is applied
+			
+			0: No STBC
+			
+			1: STBC
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_A_MU_DL_1_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_STBC_OFFSET 0x00000004
+#define PHYRX_HE_SIG_A_MU_DL_1_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_STBC_LSB 12
+#define PHYRX_HE_SIG_A_MU_DL_1_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_STBC_MASK 0x00001000
+
+/* Description		PHYRX_HE_SIG_A_MU_DL_1_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_PACKET_EXTENSION_A_FACTOR
+			
+			the packet extension duration of the trigger-based PPDU
+			response with these two bits indicating the a-factor 
+			
+			
+			
+			<enum 0 a_factor_4>
+			
+			<enum 1 a_factor_1>
+			
+			<enum 2 a_factor_2>
+			
+			<enum 3 a_factor_3>
+			
+			
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_A_MU_DL_1_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_PACKET_EXTENSION_A_FACTOR_OFFSET 0x00000004
+#define PHYRX_HE_SIG_A_MU_DL_1_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_PACKET_EXTENSION_A_FACTOR_LSB 13
+#define PHYRX_HE_SIG_A_MU_DL_1_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_PACKET_EXTENSION_A_FACTOR_MASK 0x00006000
+
+/* Description		PHYRX_HE_SIG_A_MU_DL_1_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_PACKET_EXTENSION_PE_DISAMBIGUITY
+			
+			the packet extension duration of the trigger-based PPDU
+			response with this bit indicating the PE-Disambiguity 
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_A_MU_DL_1_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_PACKET_EXTENSION_PE_DISAMBIGUITY_OFFSET 0x00000004
+#define PHYRX_HE_SIG_A_MU_DL_1_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_PACKET_EXTENSION_PE_DISAMBIGUITY_LSB 15
+#define PHYRX_HE_SIG_A_MU_DL_1_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_PACKET_EXTENSION_PE_DISAMBIGUITY_MASK 0x00008000
+
+/* Description		PHYRX_HE_SIG_A_MU_DL_1_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_CRC
+			
+			CRC for HE-SIG-A contents.
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_A_MU_DL_1_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_CRC_OFFSET 0x00000004
+#define PHYRX_HE_SIG_A_MU_DL_1_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_CRC_LSB 16
+#define PHYRX_HE_SIG_A_MU_DL_1_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_CRC_MASK 0x000f0000
+
+/* Description		PHYRX_HE_SIG_A_MU_DL_1_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_TAIL
+			
+			<legal 0>
+*/
+#define PHYRX_HE_SIG_A_MU_DL_1_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_TAIL_OFFSET 0x00000004
+#define PHYRX_HE_SIG_A_MU_DL_1_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_TAIL_LSB 20
+#define PHYRX_HE_SIG_A_MU_DL_1_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_TAIL_MASK 0x03f00000
+
+/* Description		PHYRX_HE_SIG_A_MU_DL_1_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_RESERVED_1B
+			
+			<legal 0>
+*/
+#define PHYRX_HE_SIG_A_MU_DL_1_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_RESERVED_1B_OFFSET 0x00000004
+#define PHYRX_HE_SIG_A_MU_DL_1_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_RESERVED_1B_LSB 26
+#define PHYRX_HE_SIG_A_MU_DL_1_PHYRX_HE_SIG_A_MU_DL_INFO_DETAILS_RESERVED_1B_MASK 0xfc000000
+
+
+#endif // _PHYRX_HE_SIG_A_MU_DL_H_
--- a/drivers/staging/fw-api/hw/qca5018/phyrx_he_sig_a_mu_ul.h
+++ b/drivers/staging/fw-api/hw/qca5018/phyrx_he_sig_a_mu_ul.h
@@ -0,0 +1,178 @@
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _PHYRX_HE_SIG_A_MU_UL_H_
+#define _PHYRX_HE_SIG_A_MU_UL_H_
+#if !defined(__ASSEMBLER__)
+#endif
+
+#include "he_sig_a_mu_ul_info.h"
+
+// ################ START SUMMARY #################
+//
+//	Dword	Fields
+//	0-1	struct he_sig_a_mu_ul_info phyrx_he_sig_a_mu_ul_info_details;
+//
+// ################ END SUMMARY #################
+
+#define NUM_OF_DWORDS_PHYRX_HE_SIG_A_MU_UL 2
+
+struct phyrx_he_sig_a_mu_ul {
+    struct            he_sig_a_mu_ul_info                       phyrx_he_sig_a_mu_ul_info_details;
+};
+
+/*
+
+struct he_sig_a_mu_ul_info phyrx_he_sig_a_mu_ul_info_details
+			
+			See detailed description of the STRUCT
+*/
+
+
+ /* EXTERNAL REFERENCE : struct he_sig_a_mu_ul_info phyrx_he_sig_a_mu_ul_info_details */ 
+
+
+/* Description		PHYRX_HE_SIG_A_MU_UL_0_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_FORMAT_INDICATION
+			
+			Indicates whether the transmission is SU PPDU or a
+			trigger based UL MU PDDU
+			
+			<enum 0 HE_SIGA_FORMAT_HE_TRIG>
+			
+			<enum 1 HE_SIGA_FORMAT_SU_OR_EXT_SU>
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_A_MU_UL_0_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_FORMAT_INDICATION_OFFSET 0x00000000
+#define PHYRX_HE_SIG_A_MU_UL_0_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_FORMAT_INDICATION_LSB 0
+#define PHYRX_HE_SIG_A_MU_UL_0_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_FORMAT_INDICATION_MASK 0x00000001
+
+/* Description		PHYRX_HE_SIG_A_MU_UL_0_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_BSS_COLOR_ID
+			
+			BSS color ID 
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_A_MU_UL_0_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_BSS_COLOR_ID_OFFSET 0x00000000
+#define PHYRX_HE_SIG_A_MU_UL_0_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_BSS_COLOR_ID_LSB 1
+#define PHYRX_HE_SIG_A_MU_UL_0_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_BSS_COLOR_ID_MASK 0x0000007e
+
+/* Description		PHYRX_HE_SIG_A_MU_UL_0_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_SPATIAL_REUSE
+			
+			Spatial reuse
+			
+			
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_A_MU_UL_0_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_SPATIAL_REUSE_OFFSET 0x00000000
+#define PHYRX_HE_SIG_A_MU_UL_0_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_SPATIAL_REUSE_LSB 7
+#define PHYRX_HE_SIG_A_MU_UL_0_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_SPATIAL_REUSE_MASK 0x007fff80
+
+/* Description		PHYRX_HE_SIG_A_MU_UL_0_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_RESERVED_0A
+			
+			Note: spec indicates this shall be set to 1
+			
+			<legal 1>
+*/
+#define PHYRX_HE_SIG_A_MU_UL_0_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_RESERVED_0A_OFFSET 0x00000000
+#define PHYRX_HE_SIG_A_MU_UL_0_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_RESERVED_0A_LSB 23
+#define PHYRX_HE_SIG_A_MU_UL_0_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_RESERVED_0A_MASK 0x00800000
+
+/* Description		PHYRX_HE_SIG_A_MU_UL_0_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_TRANSMIT_BW
+			
+			Bandwidth of the PPDU.
+			
+			
+			
+			<enum 0 HE_SIG_A_MU_UL_BW20> 20 Mhz 
+			
+			<enum 1 HE_SIG_A_MU_UL_BW40> 40 Mhz 
+			
+			<enum 2 HE_SIG_A_MU_UL_BW80> 80 Mhz 
+			
+			<enum 3 HE_SIG_A_MU_UL_BW160> 160 MHz or 80+80 MHz
+			
+			
+			
+			On RX side, Field Used by MAC HW
+			
+			<legal 0-3>
+*/
+#define PHYRX_HE_SIG_A_MU_UL_0_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_TRANSMIT_BW_OFFSET 0x00000000
+#define PHYRX_HE_SIG_A_MU_UL_0_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_TRANSMIT_BW_LSB 24
+#define PHYRX_HE_SIG_A_MU_UL_0_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_TRANSMIT_BW_MASK 0x03000000
+
+/* Description		PHYRX_HE_SIG_A_MU_UL_0_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_RESERVED_0B
+			
+			<legal 0>
+*/
+#define PHYRX_HE_SIG_A_MU_UL_0_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_RESERVED_0B_OFFSET 0x00000000
+#define PHYRX_HE_SIG_A_MU_UL_0_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_RESERVED_0B_LSB 26
+#define PHYRX_HE_SIG_A_MU_UL_0_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_RESERVED_0B_MASK 0xfc000000
+
+/* Description		PHYRX_HE_SIG_A_MU_UL_1_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_TXOP_DURATION
+			
+			Indicates the remaining time in the current TXOP <legal
+			all>
+*/
+#define PHYRX_HE_SIG_A_MU_UL_1_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_TXOP_DURATION_OFFSET 0x00000004
+#define PHYRX_HE_SIG_A_MU_UL_1_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_TXOP_DURATION_LSB 0
+#define PHYRX_HE_SIG_A_MU_UL_1_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_TXOP_DURATION_MASK 0x0000007f
+
+/* Description		PHYRX_HE_SIG_A_MU_UL_1_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_RESERVED_1A
+			
+			Set to value indicated in the trigger frame
+			
+			<legal 255>
+*/
+#define PHYRX_HE_SIG_A_MU_UL_1_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_RESERVED_1A_OFFSET 0x00000004
+#define PHYRX_HE_SIG_A_MU_UL_1_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_RESERVED_1A_LSB 7
+#define PHYRX_HE_SIG_A_MU_UL_1_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_RESERVED_1A_MASK 0x0000ff80
+
+/* Description		PHYRX_HE_SIG_A_MU_UL_1_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_CRC
+			
+			CRC for HE-SIG-A contents.
+			
+			This CRC may also cover some fields of L-SIG (TBD)
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_A_MU_UL_1_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_CRC_OFFSET 0x00000004
+#define PHYRX_HE_SIG_A_MU_UL_1_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_CRC_LSB 16
+#define PHYRX_HE_SIG_A_MU_UL_1_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_CRC_MASK 0x000f0000
+
+/* Description		PHYRX_HE_SIG_A_MU_UL_1_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_TAIL
+			
+			BCC encoding (similar to VHT-SIG-A) with 6 tail bits is
+			used
+			
+			<legal 0>
+*/
+#define PHYRX_HE_SIG_A_MU_UL_1_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_TAIL_OFFSET 0x00000004
+#define PHYRX_HE_SIG_A_MU_UL_1_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_TAIL_LSB 20
+#define PHYRX_HE_SIG_A_MU_UL_1_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_TAIL_MASK 0x03f00000
+
+/* Description		PHYRX_HE_SIG_A_MU_UL_1_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_RESERVED_1B
+			
+			<legal 0>
+*/
+#define PHYRX_HE_SIG_A_MU_UL_1_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_RESERVED_1B_OFFSET 0x00000004
+#define PHYRX_HE_SIG_A_MU_UL_1_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_RESERVED_1B_LSB 26
+#define PHYRX_HE_SIG_A_MU_UL_1_PHYRX_HE_SIG_A_MU_UL_INFO_DETAILS_RESERVED_1B_MASK 0xfc000000
+
+
+#endif // _PHYRX_HE_SIG_A_MU_UL_H_
--- a/drivers/staging/fw-api/hw/qca5018/phyrx_he_sig_a_su.h
+++ b/drivers/staging/fw-api/hw/qca5018/phyrx_he_sig_a_su.h
@@ -0,0 +1,483 @@
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _PHYRX_HE_SIG_A_SU_H_
+#define _PHYRX_HE_SIG_A_SU_H_
+#if !defined(__ASSEMBLER__)
+#endif
+
+#include "he_sig_a_su_info.h"
+
+// ################ START SUMMARY #################
+//
+//	Dword	Fields
+//	0-1	struct he_sig_a_su_info phyrx_he_sig_a_su_info_details;
+//
+// ################ END SUMMARY #################
+
+#define NUM_OF_DWORDS_PHYRX_HE_SIG_A_SU 2
+
+struct phyrx_he_sig_a_su {
+    struct            he_sig_a_su_info                       phyrx_he_sig_a_su_info_details;
+};
+
+/*
+
+struct he_sig_a_su_info phyrx_he_sig_a_su_info_details
+			
+			See detailed description of the STRUCT
+*/
+
+
+ /* EXTERNAL REFERENCE : struct he_sig_a_su_info phyrx_he_sig_a_su_info_details */ 
+
+
+/* Description		PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_FORMAT_INDICATION
+			
+			<enum 0 HE_SIGA_FORMAT_HE_TRIG>
+			
+			<enum 1 HE_SIGA_FORMAT_SU_OR_EXT_SU>
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_FORMAT_INDICATION_OFFSET 0x00000000
+#define PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_FORMAT_INDICATION_LSB 0
+#define PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_FORMAT_INDICATION_MASK 0x00000001
+
+/* Description		PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_BEAM_CHANGE
+			
+			Indicates whether spatial mapping is changed between
+			legacy and HE portion of preamble. If not, channel
+			estimation can include legacy preamble to improve accuracy
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_BEAM_CHANGE_OFFSET 0x00000000
+#define PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_BEAM_CHANGE_LSB 1
+#define PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_BEAM_CHANGE_MASK 0x00000002
+
+/* Description		PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_DL_UL_FLAG
+			
+			Differentiates between DL and UL transmission 
+			
+			
+			
+			<enum 0 DL_UL_FLAG_IS_DL_OR_TDLS>
+			
+			<enum 1 DL_UL_FLAG_IS_UL>
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_DL_UL_FLAG_OFFSET 0x00000000
+#define PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_DL_UL_FLAG_LSB 2
+#define PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_DL_UL_FLAG_MASK 0x00000004
+
+/* Description		PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_TRANSMIT_MCS
+			
+			Indicates the data MCS
+			
+			
+			
+			Field Used by MAC HW
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_TRANSMIT_MCS_OFFSET 0x00000000
+#define PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_TRANSMIT_MCS_LSB 3
+#define PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_TRANSMIT_MCS_MASK 0x00000078
+
+/* Description		PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_DCM
+			
+			
+			0: No DCM
+			
+			1:DCM
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_DCM_OFFSET 0x00000000
+#define PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_DCM_LSB   7
+#define PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_DCM_MASK  0x00000080
+
+/* Description		PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_BSS_COLOR_ID
+			
+			BSS color ID 
+			
+			
+			
+			Field Used by MAC HW
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_BSS_COLOR_ID_OFFSET 0x00000000
+#define PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_BSS_COLOR_ID_LSB 8
+#define PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_BSS_COLOR_ID_MASK 0x00003f00
+
+/* Description		PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_RESERVED_0A
+			
+			Note: spec indicates this shall be set to 1
+			
+			<legal 1>
+*/
+#define PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_RESERVED_0A_OFFSET 0x00000000
+#define PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_RESERVED_0A_LSB 14
+#define PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_RESERVED_0A_MASK 0x00004000
+
+/* Description		PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_SPATIAL_REUSE
+			
+			Spatial reuse
+			
+			
+			
+			For 20MHz one SR field corresponding to entire 20MHz
+			(other 3 fields indicate identical values)
+			
+			For 40MHz two SR fields for each 20MHz (other 2 fields
+			indicate identical values)
+			
+			For 80MHz four SR fields for each 20MHz
+			
+			For 160MHz four SR fields for each 40MHz
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_SPATIAL_REUSE_OFFSET 0x00000000
+#define PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_SPATIAL_REUSE_LSB 15
+#define PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_SPATIAL_REUSE_MASK 0x00078000
+
+/* Description		PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_TRANSMIT_BW
+			
+			Bandwidth of the PPDU.
+			
+			
+			
+			For HE SU PPDU                                          
+			                                                           
+			
+			<enum 0 HE_SIG_A_BW20> 20 Mhz 
+			
+			<enum 1 HE_SIG_A_BW40> 40 Mhz 
+			
+			<enum 2 HE_SIG_A_BW80> 80 Mhz 
+			
+			<enum 3 HE_SIG_A_BW160> 160 MHz or 80+80 MHz
+			
+			
+			
+			For HE Extended Range SU PPDU
+			
+			Set to 0 for 242-tone RU                                
+			 Set to 1 for right 106-tone RU within the primary 20 MHz  
+			
+			
+			
+			On RX side, Field Used by MAC HW
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_TRANSMIT_BW_OFFSET 0x00000000
+#define PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_TRANSMIT_BW_LSB 19
+#define PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_TRANSMIT_BW_MASK 0x00180000
+
+/* Description		PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_CP_LTF_SIZE
+			
+			Indicates the CP and HE-LTF type 
+			
+			
+			
+			
+			<enum 3 FourX_LTF_0_8CP_3_2CP>
+			
+			When DCM == 0 OR STBC == 0: 4x LTF + 3.2 µs CP 
+			
+			When DCM == 1 AND STBC == 1: 4x LTF + 0.8 µs CP. Note:
+			In this scenario, Neither DCM nor STBC is applied to HE data
+			field.
+			
+			
+			NOTE:
+			
+			
+			If ( DCM == 1 ) and ( MCS > 0 ) and (STBC == 0) 
+			
+			0      = 1xLTF + 0.4 usec
+			
+			1      = 2xLTF + 0.4 usec
+			
+			2~3 = Reserved
+			
+			
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_CP_LTF_SIZE_OFFSET 0x00000000
+#define PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_CP_LTF_SIZE_LSB 21
+#define PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_CP_LTF_SIZE_MASK 0x00600000
+
+/* Description		PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_NSTS
+			
+			
+			
+			
+			For HE SU PPDU                                          
+			
+			
+			
+			For HE Extended Range PPDU                              
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_NSTS_OFFSET 0x00000000
+#define PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_NSTS_LSB  23
+#define PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_NSTS_MASK 0x03800000
+
+/* Description		PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_RESERVED_0B
+			
+			<legal 0>
+*/
+#define PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_RESERVED_0B_OFFSET 0x00000000
+#define PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_RESERVED_0B_LSB 26
+#define PHYRX_HE_SIG_A_SU_0_PHYRX_HE_SIG_A_SU_INFO_DETAILS_RESERVED_0B_MASK 0xfc000000
+
+/* Description		PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_TXOP_DURATION
+			
+			Indicates the remaining time in the current TXOP
+			
+			
+			
+			Field Used by MAC HW
+			
+			 <legal all>
+*/
+#define PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_TXOP_DURATION_OFFSET 0x00000004
+#define PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_TXOP_DURATION_LSB 0
+#define PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_TXOP_DURATION_MASK 0x0000007f
+
+/* Description		PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_CODING
+			
+			Distinguishes between BCC and LDPC coding. 
+			
+			
+			
+			0: BCC
+			
+			1: LDPC
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_CODING_OFFSET 0x00000004
+#define PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_CODING_LSB 7
+#define PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_CODING_MASK 0x00000080
+
+/* Description		PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_LDPC_EXTRA_SYMBOL
+			
+			If LDPC, 
+			
+			  0: LDPC extra symbol not present
+			
+			  1: LDPC extra symbol present
+			
+			Else 
+			
+			  Set to 1
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_LDPC_EXTRA_SYMBOL_OFFSET 0x00000004
+#define PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_LDPC_EXTRA_SYMBOL_LSB 8
+#define PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_LDPC_EXTRA_SYMBOL_MASK 0x00000100
+
+/* Description		PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_STBC
+			
+			Indicates whether STBC is applied
+			
+			0: No STBC
+			
+			1: STBC
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_STBC_OFFSET 0x00000004
+#define PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_STBC_LSB  9
+#define PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_STBC_MASK 0x00000200
+
+/* Description		PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_TXBF
+			
+			Indicates whether beamforming is applied
+			
+			0: No beamforming
+			
+			1: beamforming
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_TXBF_OFFSET 0x00000004
+#define PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_TXBF_LSB  10
+#define PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_TXBF_MASK 0x00000400
+
+/* Description		PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_PACKET_EXTENSION_A_FACTOR
+			
+			Common trigger info
+			
+			
+			
+			the packet extension duration of the trigger-based PPDU
+			response with these two bits indicating the a-factor 
+			
+			
+			
+			<enum 0 a_factor_4>
+			
+			<enum 1 a_factor_1>
+			
+			<enum 2 a_factor_2>
+			
+			<enum 3 a_factor_3>
+			
+			
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_PACKET_EXTENSION_A_FACTOR_OFFSET 0x00000004
+#define PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_PACKET_EXTENSION_A_FACTOR_LSB 11
+#define PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_PACKET_EXTENSION_A_FACTOR_MASK 0x00001800
+
+/* Description		PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_PACKET_EXTENSION_PE_DISAMBIGUITY
+			
+			Common trigger info
+			
+			
+			
+			the packet extension duration of the trigger-based PPDU
+			response with this bit indicating the PE-Disambiguity 
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_PACKET_EXTENSION_PE_DISAMBIGUITY_OFFSET 0x00000004
+#define PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_PACKET_EXTENSION_PE_DISAMBIGUITY_LSB 13
+#define PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_PACKET_EXTENSION_PE_DISAMBIGUITY_MASK 0x00002000
+
+/* Description		PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_RESERVED_1A
+			
+			Note: per standard, set to 1
+			
+			<legal 1>
+*/
+#define PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_RESERVED_1A_OFFSET 0x00000004
+#define PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_RESERVED_1A_LSB 14
+#define PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_RESERVED_1A_MASK 0x00004000
+
+/* Description		PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_DOPPLER_INDICATION
+			
+			0: No Doppler support
+			
+			1: Doppler support
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_DOPPLER_INDICATION_OFFSET 0x00000004
+#define PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_DOPPLER_INDICATION_LSB 15
+#define PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_DOPPLER_INDICATION_MASK 0x00008000
+
+/* Description		PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_CRC
+			
+			CRC for HE-SIG-A contents.
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_CRC_OFFSET 0x00000004
+#define PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_CRC_LSB   16
+#define PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_CRC_MASK  0x000f0000
+
+/* Description		PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_TAIL
+			
+			<legal 0>
+*/
+#define PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_TAIL_OFFSET 0x00000004
+#define PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_TAIL_LSB  20
+#define PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_TAIL_MASK 0x03f00000
+
+/* Description		PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_DOT11AX_SU_EXTENDED
+			
+			TX side:
+			
+			Set to 0
+			
+			
+			
+			RX side:
+			
+			On RX side, evaluated by MAC HW. This is the only way
+			for MAC RX to know that this was an HE_SIG_A_SU received in
+			'extended' format
+			
+			
+			
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_DOT11AX_SU_EXTENDED_OFFSET 0x00000004
+#define PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_DOT11AX_SU_EXTENDED_LSB 26
+#define PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_DOT11AX_SU_EXTENDED_MASK 0x04000000
+
+/* Description		PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_DOT11AX_EXT_RU_SIZE
+			
+			TX side:
+			
+			Set to 0
+			
+			
+			
+			RX side:
+			
+			Field only contains valid info when dot11ax_su_extended
+			is set.
+			
+			
+			
+			On RX side, evaluated by MAC HW. This is the only way
+			for MAC RX to know what the number of based RUs was in this
+			extended range reception. It is used by the MAC to determine
+			the RU size for the response...
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_DOT11AX_EXT_RU_SIZE_OFFSET 0x00000004
+#define PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_DOT11AX_EXT_RU_SIZE_LSB 27
+#define PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_DOT11AX_EXT_RU_SIZE_MASK 0x78000000
+
+/* Description		PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_RX_NDP
+			
+			TX side:
+			
+			Set to 0
+			
+			
+			
+			RX side:Valid on RX side only, and looked at by MAC HW
+			
+			
+			
+			When set, PHY has received (expected) NDP frame
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_RX_NDP_OFFSET 0x00000004
+#define PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_RX_NDP_LSB 31
+#define PHYRX_HE_SIG_A_SU_1_PHYRX_HE_SIG_A_SU_INFO_DETAILS_RX_NDP_MASK 0x80000000
+
+
+#endif // _PHYRX_HE_SIG_A_SU_H_
--- a/drivers/staging/fw-api/hw/qca5018/phyrx_he_sig_b1_mu.h
+++ b/drivers/staging/fw-api/hw/qca5018/phyrx_he_sig_b1_mu.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _PHYRX_HE_SIG_B1_MU_H_
+#define _PHYRX_HE_SIG_B1_MU_H_
+#if !defined(__ASSEMBLER__)
+#endif
+
+#include "he_sig_b1_mu_info.h"
+
+// ################ START SUMMARY #################
+//
+//	Dword	Fields
+//	0	struct he_sig_b1_mu_info phyrx_he_sig_b1_mu_info_details;
+//
+// ################ END SUMMARY #################
+
+#define NUM_OF_DWORDS_PHYRX_HE_SIG_B1_MU 1
+
+struct phyrx_he_sig_b1_mu {
+    struct            he_sig_b1_mu_info                       phyrx_he_sig_b1_mu_info_details;
+};
+
+/*
+
+struct he_sig_b1_mu_info phyrx_he_sig_b1_mu_info_details
+			
+			See detailed description of the STRUCT
+*/
+
+
+ /* EXTERNAL REFERENCE : struct he_sig_b1_mu_info phyrx_he_sig_b1_mu_info_details */ 
+
+
+/* Description		PHYRX_HE_SIG_B1_MU_0_PHYRX_HE_SIG_B1_MU_INFO_DETAILS_RU_ALLOCATION
+			
+			RU allocation for the user(s) following this common
+			portion of the SIG
+			
+			
+			
+			For details, refer to  RU_TYPE description
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_B1_MU_0_PHYRX_HE_SIG_B1_MU_INFO_DETAILS_RU_ALLOCATION_OFFSET 0x00000000
+#define PHYRX_HE_SIG_B1_MU_0_PHYRX_HE_SIG_B1_MU_INFO_DETAILS_RU_ALLOCATION_LSB 0
+#define PHYRX_HE_SIG_B1_MU_0_PHYRX_HE_SIG_B1_MU_INFO_DETAILS_RU_ALLOCATION_MASK 0x000000ff
+
+/* Description		PHYRX_HE_SIG_B1_MU_0_PHYRX_HE_SIG_B1_MU_INFO_DETAILS_RESERVED_0
+			
+			<legal 0>
+*/
+#define PHYRX_HE_SIG_B1_MU_0_PHYRX_HE_SIG_B1_MU_INFO_DETAILS_RESERVED_0_OFFSET 0x00000000
+#define PHYRX_HE_SIG_B1_MU_0_PHYRX_HE_SIG_B1_MU_INFO_DETAILS_RESERVED_0_LSB 8
+#define PHYRX_HE_SIG_B1_MU_0_PHYRX_HE_SIG_B1_MU_INFO_DETAILS_RESERVED_0_MASK 0xffffff00
+
+
+#endif // _PHYRX_HE_SIG_B1_MU_H_
--- a/drivers/staging/fw-api/hw/qca5018/phyrx_he_sig_b2_mu.h
+++ b/drivers/staging/fw-api/hw/qca5018/phyrx_he_sig_b2_mu.h
@@ -0,0 +1,143 @@
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _PHYRX_HE_SIG_B2_MU_H_
+#define _PHYRX_HE_SIG_B2_MU_H_
+#if !defined(__ASSEMBLER__)
+#endif
+
+#include "he_sig_b2_mu_info.h"
+
+// ################ START SUMMARY #################
+//
+//	Dword	Fields
+//	0	struct he_sig_b2_mu_info phyrx_he_sig_b2_mu_info_details;
+//
+// ################ END SUMMARY #################
+
+#define NUM_OF_DWORDS_PHYRX_HE_SIG_B2_MU 1
+
+struct phyrx_he_sig_b2_mu {
+    struct            he_sig_b2_mu_info                       phyrx_he_sig_b2_mu_info_details;
+};
+
+/*
+
+struct he_sig_b2_mu_info phyrx_he_sig_b2_mu_info_details
+			
+			See detailed description of the STRUCT
+*/
+
+
+ /* EXTERNAL REFERENCE : struct he_sig_b2_mu_info phyrx_he_sig_b2_mu_info_details */ 
+
+
+/* Description		PHYRX_HE_SIG_B2_MU_0_PHYRX_HE_SIG_B2_MU_INFO_DETAILS_STA_ID
+			
+			Identifies the STA that is addressed. Details of STA ID
+			are TBD
+*/
+#define PHYRX_HE_SIG_B2_MU_0_PHYRX_HE_SIG_B2_MU_INFO_DETAILS_STA_ID_OFFSET 0x00000000
+#define PHYRX_HE_SIG_B2_MU_0_PHYRX_HE_SIG_B2_MU_INFO_DETAILS_STA_ID_LSB 0
+#define PHYRX_HE_SIG_B2_MU_0_PHYRX_HE_SIG_B2_MU_INFO_DETAILS_STA_ID_MASK 0x000007ff
+
+/* Description		PHYRX_HE_SIG_B2_MU_0_PHYRX_HE_SIG_B2_MU_INFO_DETAILS_STA_SPATIAL_CONFIG
+			
+			Number of assigned spatial streams and their
+			corresponding index. 
+			
+			Total number of spatial streams assigned for the MU-MIMO
+			allocation is also signaled. 
+*/
+#define PHYRX_HE_SIG_B2_MU_0_PHYRX_HE_SIG_B2_MU_INFO_DETAILS_STA_SPATIAL_CONFIG_OFFSET 0x00000000
+#define PHYRX_HE_SIG_B2_MU_0_PHYRX_HE_SIG_B2_MU_INFO_DETAILS_STA_SPATIAL_CONFIG_LSB 11
+#define PHYRX_HE_SIG_B2_MU_0_PHYRX_HE_SIG_B2_MU_INFO_DETAILS_STA_SPATIAL_CONFIG_MASK 0x00007800
+
+/* Description		PHYRX_HE_SIG_B2_MU_0_PHYRX_HE_SIG_B2_MU_INFO_DETAILS_STA_MCS
+			
+			Indicates the data MCS
+*/
+#define PHYRX_HE_SIG_B2_MU_0_PHYRX_HE_SIG_B2_MU_INFO_DETAILS_STA_MCS_OFFSET 0x00000000
+#define PHYRX_HE_SIG_B2_MU_0_PHYRX_HE_SIG_B2_MU_INFO_DETAILS_STA_MCS_LSB 15
+#define PHYRX_HE_SIG_B2_MU_0_PHYRX_HE_SIG_B2_MU_INFO_DETAILS_STA_MCS_MASK 0x00078000
+
+/* Description		PHYRX_HE_SIG_B2_MU_0_PHYRX_HE_SIG_B2_MU_INFO_DETAILS_RESERVED_SET_TO_1
+			
+			<legal 1>
+*/
+#define PHYRX_HE_SIG_B2_MU_0_PHYRX_HE_SIG_B2_MU_INFO_DETAILS_RESERVED_SET_TO_1_OFFSET 0x00000000
+#define PHYRX_HE_SIG_B2_MU_0_PHYRX_HE_SIG_B2_MU_INFO_DETAILS_RESERVED_SET_TO_1_LSB 19
+#define PHYRX_HE_SIG_B2_MU_0_PHYRX_HE_SIG_B2_MU_INFO_DETAILS_RESERVED_SET_TO_1_MASK 0x00080000
+
+/* Description		PHYRX_HE_SIG_B2_MU_0_PHYRX_HE_SIG_B2_MU_INFO_DETAILS_STA_CODING
+			
+			Distinguishes between BCC/LDPC
+			
+			
+			
+			0: BCC
+			
+			1: LDPC
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_B2_MU_0_PHYRX_HE_SIG_B2_MU_INFO_DETAILS_STA_CODING_OFFSET 0x00000000
+#define PHYRX_HE_SIG_B2_MU_0_PHYRX_HE_SIG_B2_MU_INFO_DETAILS_STA_CODING_LSB 20
+#define PHYRX_HE_SIG_B2_MU_0_PHYRX_HE_SIG_B2_MU_INFO_DETAILS_STA_CODING_MASK 0x00100000
+
+/* Description		PHYRX_HE_SIG_B2_MU_0_PHYRX_HE_SIG_B2_MU_INFO_DETAILS_RESERVED_0A
+			
+			<legal 0>
+*/
+#define PHYRX_HE_SIG_B2_MU_0_PHYRX_HE_SIG_B2_MU_INFO_DETAILS_RESERVED_0A_OFFSET 0x00000000
+#define PHYRX_HE_SIG_B2_MU_0_PHYRX_HE_SIG_B2_MU_INFO_DETAILS_RESERVED_0A_LSB 21
+#define PHYRX_HE_SIG_B2_MU_0_PHYRX_HE_SIG_B2_MU_INFO_DETAILS_RESERVED_0A_MASK 0x1fe00000
+
+/* Description		PHYRX_HE_SIG_B2_MU_0_PHYRX_HE_SIG_B2_MU_INFO_DETAILS_NSTS
+			
+			MAC RX side usage only:
+			
+			Needed by RXPCU. Provided by PHY so that RXPCU does not
+			need to have the RU number decoding logic.
+			
+			
+			
+			Number of spatial streams for this user
+			
+			
+			
+			<enum 0 1_spatial_stream>Single spatial stream
+			
+			<enum 1 2_spatial_streams>2 spatial streams
+			
+			<enum 2 3_spatial_streams>3 spatial streams
+			
+			<enum 3 4_spatial_streams>4 spatial streams
+			
+			<enum 4 5_spatial_streams>5 spatial streams
+			
+			<enum 5 6_spatial_streams>6 spatial streams
+			
+			<enum 6 7_spatial_streams>7 spatial streams
+			
+			<enum 7 8_spatial_streams>8 spatial streams
+*/
+#define PHYRX_HE_SIG_B2_MU_0_PHYRX_HE_SIG_B2_MU_INFO_DETAILS_NSTS_OFFSET 0x00000000
+#define PHYRX_HE_SIG_B2_MU_0_PHYRX_HE_SIG_B2_MU_INFO_DETAILS_NSTS_LSB 29
+#define PHYRX_HE_SIG_B2_MU_0_PHYRX_HE_SIG_B2_MU_INFO_DETAILS_NSTS_MASK 0xe0000000
+
+
+#endif // _PHYRX_HE_SIG_B2_MU_H_
--- a/drivers/staging/fw-api/hw/qca5018/phyrx_he_sig_b2_ofdma.h
+++ b/drivers/staging/fw-api/hw/qca5018/phyrx_he_sig_b2_ofdma.h
@@ -0,0 +1,147 @@
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _PHYRX_HE_SIG_B2_OFDMA_H_
+#define _PHYRX_HE_SIG_B2_OFDMA_H_
+#if !defined(__ASSEMBLER__)
+#endif
+
+#include "he_sig_b2_ofdma_info.h"
+
+// ################ START SUMMARY #################
+//
+//	Dword	Fields
+//	0	struct he_sig_b2_ofdma_info phyrx_he_sig_b2_ofdma_info_details;
+//
+// ################ END SUMMARY #################
+
+#define NUM_OF_DWORDS_PHYRX_HE_SIG_B2_OFDMA 1
+
+struct phyrx_he_sig_b2_ofdma {
+    struct            he_sig_b2_ofdma_info                       phyrx_he_sig_b2_ofdma_info_details;
+};
+
+/*
+
+struct he_sig_b2_ofdma_info phyrx_he_sig_b2_ofdma_info_details
+			
+			See detailed description of the STRUCT
+*/
+
+
+ /* EXTERNAL REFERENCE : struct he_sig_b2_ofdma_info phyrx_he_sig_b2_ofdma_info_details */ 
+
+
+/* Description		PHYRX_HE_SIG_B2_OFDMA_0_PHYRX_HE_SIG_B2_OFDMA_INFO_DETAILS_STA_ID
+			
+			Identifies the STA that is addressed. Details of STA ID
+			are TBD
+*/
+#define PHYRX_HE_SIG_B2_OFDMA_0_PHYRX_HE_SIG_B2_OFDMA_INFO_DETAILS_STA_ID_OFFSET 0x00000000
+#define PHYRX_HE_SIG_B2_OFDMA_0_PHYRX_HE_SIG_B2_OFDMA_INFO_DETAILS_STA_ID_LSB 0
+#define PHYRX_HE_SIG_B2_OFDMA_0_PHYRX_HE_SIG_B2_OFDMA_INFO_DETAILS_STA_ID_MASK 0x000007ff
+
+/* Description		PHYRX_HE_SIG_B2_OFDMA_0_PHYRX_HE_SIG_B2_OFDMA_INFO_DETAILS_NSTS
+			
+			MAC RX side usage only:
+			
+			
+			
+			Number of spatial streams for this user
+			
+			
+			
+			<enum 0 1_spatial_stream>Single spatial stream
+			
+			<enum 1 2_spatial_streams>2 spatial streams
+			
+			<enum 2 3_spatial_streams>3 spatial streams
+			
+			<enum 3 4_spatial_streams>4 spatial streams
+			
+			<enum 4 5_spatial_streams>5 spatial streams
+			
+			<enum 5 6_spatial_streams>6 spatial streams
+			
+			<enum 6 7_spatial_streams>7 spatial streams
+			
+			<enum 7 8_spatial_streams>8 spatial streams
+*/
+#define PHYRX_HE_SIG_B2_OFDMA_0_PHYRX_HE_SIG_B2_OFDMA_INFO_DETAILS_NSTS_OFFSET 0x00000000
+#define PHYRX_HE_SIG_B2_OFDMA_0_PHYRX_HE_SIG_B2_OFDMA_INFO_DETAILS_NSTS_LSB 11
+#define PHYRX_HE_SIG_B2_OFDMA_0_PHYRX_HE_SIG_B2_OFDMA_INFO_DETAILS_NSTS_MASK 0x00003800
+
+/* Description		PHYRX_HE_SIG_B2_OFDMA_0_PHYRX_HE_SIG_B2_OFDMA_INFO_DETAILS_TXBF
+			
+			Indicates whether beamforming is applied
+			
+			0: No beamforming
+			
+			1: beamforming
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_B2_OFDMA_0_PHYRX_HE_SIG_B2_OFDMA_INFO_DETAILS_TXBF_OFFSET 0x00000000
+#define PHYRX_HE_SIG_B2_OFDMA_0_PHYRX_HE_SIG_B2_OFDMA_INFO_DETAILS_TXBF_LSB 14
+#define PHYRX_HE_SIG_B2_OFDMA_0_PHYRX_HE_SIG_B2_OFDMA_INFO_DETAILS_TXBF_MASK 0x00004000
+
+/* Description		PHYRX_HE_SIG_B2_OFDMA_0_PHYRX_HE_SIG_B2_OFDMA_INFO_DETAILS_STA_MCS
+			
+			Indicates the data MCS
+*/
+#define PHYRX_HE_SIG_B2_OFDMA_0_PHYRX_HE_SIG_B2_OFDMA_INFO_DETAILS_STA_MCS_OFFSET 0x00000000
+#define PHYRX_HE_SIG_B2_OFDMA_0_PHYRX_HE_SIG_B2_OFDMA_INFO_DETAILS_STA_MCS_LSB 15
+#define PHYRX_HE_SIG_B2_OFDMA_0_PHYRX_HE_SIG_B2_OFDMA_INFO_DETAILS_STA_MCS_MASK 0x00078000
+
+/* Description		PHYRX_HE_SIG_B2_OFDMA_0_PHYRX_HE_SIG_B2_OFDMA_INFO_DETAILS_STA_DCM
+			
+			
+			0: No DCM
+			
+			1:DCM
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_B2_OFDMA_0_PHYRX_HE_SIG_B2_OFDMA_INFO_DETAILS_STA_DCM_OFFSET 0x00000000
+#define PHYRX_HE_SIG_B2_OFDMA_0_PHYRX_HE_SIG_B2_OFDMA_INFO_DETAILS_STA_DCM_LSB 19
+#define PHYRX_HE_SIG_B2_OFDMA_0_PHYRX_HE_SIG_B2_OFDMA_INFO_DETAILS_STA_DCM_MASK 0x00080000
+
+/* Description		PHYRX_HE_SIG_B2_OFDMA_0_PHYRX_HE_SIG_B2_OFDMA_INFO_DETAILS_STA_CODING
+			
+			Distinguishes between BCC/LDPC
+			
+			
+			
+			0: BCC
+			
+			1: LDPC
+			
+			<legal all>
+*/
+#define PHYRX_HE_SIG_B2_OFDMA_0_PHYRX_HE_SIG_B2_OFDMA_INFO_DETAILS_STA_CODING_OFFSET 0x00000000
+#define PHYRX_HE_SIG_B2_OFDMA_0_PHYRX_HE_SIG_B2_OFDMA_INFO_DETAILS_STA_CODING_LSB 20
+#define PHYRX_HE_SIG_B2_OFDMA_0_PHYRX_HE_SIG_B2_OFDMA_INFO_DETAILS_STA_CODING_MASK 0x00100000
+
+/* Description		PHYRX_HE_SIG_B2_OFDMA_0_PHYRX_HE_SIG_B2_OFDMA_INFO_DETAILS_RESERVED_0
+			
+			<legal 0>
+*/
+#define PHYRX_HE_SIG_B2_OFDMA_0_PHYRX_HE_SIG_B2_OFDMA_INFO_DETAILS_RESERVED_0_OFFSET 0x00000000
+#define PHYRX_HE_SIG_B2_OFDMA_0_PHYRX_HE_SIG_B2_OFDMA_INFO_DETAILS_RESERVED_0_LSB 21
+#define PHYRX_HE_SIG_B2_OFDMA_0_PHYRX_HE_SIG_B2_OFDMA_INFO_DETAILS_RESERVED_0_MASK 0xffe00000
+
+
+#endif // _PHYRX_HE_SIG_B2_OFDMA_H_
--- a/drivers/staging/fw-api/hw/qca5018/phyrx_ht_sig.h
+++ b/drivers/staging/fw-api/hw/qca5018/phyrx_ht_sig.h
@@ -0,0 +1,245 @@
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _PHYRX_HT_SIG_H_
+#define _PHYRX_HT_SIG_H_
+#if !defined(__ASSEMBLER__)
+#endif
+
+#include "ht_sig_info.h"
+
+// ################ START SUMMARY #################
+//
+//	Dword	Fields
+//	0-1	struct ht_sig_info phyrx_ht_sig_info_details;
+//
+// ################ END SUMMARY #################
+
+#define NUM_OF_DWORDS_PHYRX_HT_SIG 2
+
+struct phyrx_ht_sig {
+    struct            ht_sig_info                       phyrx_ht_sig_info_details;
+};
+
+/*
+
+struct ht_sig_info phyrx_ht_sig_info_details
+			
+			See detailed description of the STRUCT
+*/
+
+
+ /* EXTERNAL REFERENCE : struct ht_sig_info phyrx_ht_sig_info_details */ 
+
+
+/* Description		PHYRX_HT_SIG_0_PHYRX_HT_SIG_INFO_DETAILS_MCS
+			
+			Modulation Coding Scheme:
+			
+			0-7 are used for single stream
+			
+			8-15 are used for 2 streams
+			
+			16-23 are used for 3 streams
+			
+			24-31 are used for 4 streams
+			
+			32 is used for duplicate HT20 (unsupported)
+			
+			33-76 is used for unequal modulation (unsupported)
+			
+			77-127 is reserved.
+			
+			<legal 0-31>
+*/
+#define PHYRX_HT_SIG_0_PHYRX_HT_SIG_INFO_DETAILS_MCS_OFFSET          0x00000000
+#define PHYRX_HT_SIG_0_PHYRX_HT_SIG_INFO_DETAILS_MCS_LSB             0
+#define PHYRX_HT_SIG_0_PHYRX_HT_SIG_INFO_DETAILS_MCS_MASK            0x0000007f
+
+/* Description		PHYRX_HT_SIG_0_PHYRX_HT_SIG_INFO_DETAILS_CBW
+			
+			Packet bandwidth:
+			
+			<enum 0     ht_20_mhz>
+			
+			<enum 1     ht_40_mhz>
+			
+			<legal 0-1>
+*/
+#define PHYRX_HT_SIG_0_PHYRX_HT_SIG_INFO_DETAILS_CBW_OFFSET          0x00000000
+#define PHYRX_HT_SIG_0_PHYRX_HT_SIG_INFO_DETAILS_CBW_LSB             7
+#define PHYRX_HT_SIG_0_PHYRX_HT_SIG_INFO_DETAILS_CBW_MASK            0x00000080
+
+/* Description		PHYRX_HT_SIG_0_PHYRX_HT_SIG_INFO_DETAILS_LENGTH
+			
+			This is the MPDU or A-MPDU length in octets of the PPDU
+			
+			<legal all>
+*/
+#define PHYRX_HT_SIG_0_PHYRX_HT_SIG_INFO_DETAILS_LENGTH_OFFSET       0x00000000
+#define PHYRX_HT_SIG_0_PHYRX_HT_SIG_INFO_DETAILS_LENGTH_LSB          8
+#define PHYRX_HT_SIG_0_PHYRX_HT_SIG_INFO_DETAILS_LENGTH_MASK         0x00ffff00
+
+/* Description		PHYRX_HT_SIG_0_PHYRX_HT_SIG_INFO_DETAILS_RESERVED_0
+			
+			This field is not part of HT-SIG
+			
+			Reserved: Should be set to 0 by the MAC and ignored by
+			the PHY <legal 0>
+*/
+#define PHYRX_HT_SIG_0_PHYRX_HT_SIG_INFO_DETAILS_RESERVED_0_OFFSET   0x00000000
+#define PHYRX_HT_SIG_0_PHYRX_HT_SIG_INFO_DETAILS_RESERVED_0_LSB      24
+#define PHYRX_HT_SIG_0_PHYRX_HT_SIG_INFO_DETAILS_RESERVED_0_MASK     0xff000000
+
+/* Description		PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_SMOOTHING
+			
+			Field indicates if smoothing is needed
+			
+			E_num 0     do_smoothing Unsupported setting: indicates
+			smoothing is often used for beamforming 
+			
+			
+			<legal 1>
+*/
+#define PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_SMOOTHING_OFFSET    0x00000004
+#define PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_SMOOTHING_LSB       0
+#define PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_SMOOTHING_MASK      0x00000001
+
+/* Description		PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_NOT_SOUNDING
+			
+			E_num 0     sounding Unsupported setting: indicates
+			sounding is used
+			
+			<enum 1     no_sounding>  Indicates no sounding is used
+			
+			<legal 1>
+*/
+#define PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_NOT_SOUNDING_OFFSET 0x00000004
+#define PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_NOT_SOUNDING_LSB    1
+#define PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_NOT_SOUNDING_MASK   0x00000002
+
+/* Description		PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_HT_RESERVED
+			
+			Reserved: Should be set to 1 by the MAC and ignored by
+			the PHY 
+			
+			<legal 1>
+*/
+#define PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_HT_RESERVED_OFFSET  0x00000004
+#define PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_HT_RESERVED_LSB     2
+#define PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_HT_RESERVED_MASK    0x00000004
+
+/* Description		PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_AGGREGATION
+			
+			<enum 0     mpdu> Indicates MPDU format
+			
+			<enum 1     a_mpdu> Indicates A-MPDU format
+			
+			<legal 0-1>
+*/
+#define PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_AGGREGATION_OFFSET  0x00000004
+#define PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_AGGREGATION_LSB     3
+#define PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_AGGREGATION_MASK    0x00000008
+
+/* Description		PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_STBC
+			
+			<enum 0     no_stbc> Indicates no STBC
+			
+			<enum 1     1_str_stbc> Indicates 1 stream STBC
+			
+			E_num 2     2_str_stbc Indicates 2 stream STBC
+			(Unsupported)
+			
+			<legal 0-1>
+*/
+#define PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_STBC_OFFSET         0x00000004
+#define PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_STBC_LSB            4
+#define PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_STBC_MASK           0x00000030
+
+/* Description		PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_FEC_CODING
+			
+			<enum 0     ht_bcc>  Indicates BCC coding
+			
+			<enum 1     ht_ldpc>  Indicates LDPC coding
+			
+			<legal 0-1>
+*/
+#define PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_FEC_CODING_OFFSET   0x00000004
+#define PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_FEC_CODING_LSB      6
+#define PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_FEC_CODING_MASK     0x00000040
+
+/* Description		PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_SHORT_GI
+			
+			<enum 0     ht_normal_gi>  Indicates normal guard
+			interval
+			
+			
+			<legal 0-1>
+*/
+#define PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_SHORT_GI_OFFSET     0x00000004
+#define PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_SHORT_GI_LSB        7
+#define PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_SHORT_GI_MASK       0x00000080
+
+/* Description		PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_NUM_EXT_SP_STR
+			
+			Number of extension spatial streams: (Used for TxBF)
+			
+			<enum 0     0_ext_sp_str>  No extension spatial streams
+			
+			E_num 1     1_ext_sp_str  Not supported: 1 extension
+			spatial streams
+			
+			E_num 2     2_ext_sp_str  Not supported:  2 extension
+			spatial streams
+			
+			<legal 0>
+*/
+#define PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_NUM_EXT_SP_STR_OFFSET 0x00000004
+#define PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_NUM_EXT_SP_STR_LSB  8
+#define PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_NUM_EXT_SP_STR_MASK 0x00000300
+
+/* Description		PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_CRC
+			
+			The CRC protects the HT-SIG (HT-SIG[0][23:0] and
+			HT-SIG[1][9:0]. The generator polynomial is G(D) = D8 + D2 +
+			D + 1.  <legal all>
+*/
+#define PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_CRC_OFFSET          0x00000004
+#define PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_CRC_LSB             10
+#define PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_CRC_MASK            0x0003fc00
+
+/* Description		PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_SIGNAL_TAIL
+			
+			The 6 bits of tail is always set to 0 is used to flush
+			the BCC encoder and decoder.  <legal 0>
+*/
+#define PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_SIGNAL_TAIL_OFFSET  0x00000004
+#define PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_SIGNAL_TAIL_LSB     18
+#define PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_SIGNAL_TAIL_MASK    0x00fc0000
+
+/* Description		PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_RESERVED_1
+			
+			This field is not part of HT-SIG:
+			
+			Reserved: Should be set to 0 by the MAC and ignored by
+			the PHY.  <legal 0>
+*/
+#define PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_RESERVED_1_OFFSET   0x00000004
+#define PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_RESERVED_1_LSB      24
+#define PHYRX_HT_SIG_1_PHYRX_HT_SIG_INFO_DETAILS_RESERVED_1_MASK     0xff000000
+
+
+#endif // _PHYRX_HT_SIG_H_
--- a/drivers/staging/fw-api/hw/qca5018/phyrx_l_sig_a.h
+++ b/drivers/staging/fw-api/hw/qca5018/phyrx_l_sig_a.h
@@ -0,0 +1,179 @@
+/*
+ * Copyright (c) 2020, The Linux Foundation. All rights reserved.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _PHYRX_L_SIG_A_H_
+#define _PHYRX_L_SIG_A_H_
+#if !defined(__ASSEMBLER__)
+#endif
+
+#include "l_sig_a_info.h"
+
+// ################ START SUMMARY #################
+//
+//	Dword	Fields
+//	0	struct l_sig_a_info phyrx_l_sig_a_info_details;
+//
+// ################ END SUMMARY #################
+
+#define NUM_OF_DWORDS_PHYRX_L_SIG_A 1
+
+struct phyrx_l_sig_a {
+    struct            l_sig_a_info                       phyrx_l_sig_a_info_details;
+};
+
+/*
+
+struct l_sig_a_info phyrx_l_sig_a_info_details
+			
+			See detailed description of the STRUCT
+*/
+
+
+ /* EXTERNAL REFERENCE : struct l_sig_a_info phyrx_l_sig_a_info_details */ 
+
+
+/* Description		PHYRX_L_SIG_A_0_PHYRX_L_SIG_A_INFO_DETAILS_RATE
+			
+			This format is originally defined for OFDM as a 4 bit
+			field but the 5th bit was added to indicate 11b formatted
+			frames.  In the standard bit [4] is specified as reserved. 
+			For 11b frames this L-SIG is transformed in the PHY into the
+			11b preamble format.  The following are the rates:
+			
+			<enum 8     ofdm_48_mbps> 64-QAM 2/3 (48 Mbps)
+			
+			<enum 9     ofdm_24_mbps> 16-QAM 1/2 (24 Mbps)
+			
+			<enum 10     ofdm_12_mbps> QPSK 1/2 (12 Mbps)
+			
+			<enum 11     ofdm_6_mbps> BPSK 1/2 (6 Mbps)
+			
+			<enum 12     ofdm_54_mbps> 64-QAM 3/4 (54 Mbps)
+			
+			<enum 13     ofdm_36_mbps> 16-QAM 3/4 (36 Mbps)
+			
+			<enum 14     ofdm_18_mbps> QPSK 1/2 (18 Mbps)
+			
+			<enum 15     ofdm_9_mbps> BPSK 3/4 (9 Mbps)
+			
+			<legal 8-15>
+*/
+#define PHYRX_L_SIG_A_0_PHYRX_L_SIG_A_INFO_DETAILS_RATE_OFFSET       0x00000000
+#define PHYRX_L_SIG_A_0_PHYRX_L_SIG_A_INFO_DETAILS_RATE_LSB          0
+#define PHYRX_L_SIG_A_0_PHYRX_L_SIG_A_INFO_DETAILS_RATE_MASK         0x0000000f
+
+/* Description		PHYRX_L_SIG_A_0_PHYRX_L_SIG_A_INFO_DETAILS_LSIG_RESERVED
+			
+			Reserved: Should be set to 0 by the MAC and ignored by
+			the PHY
+			
+			<legal 0>
+*/
+#define PHYRX_L_SIG_A_0_PHYRX_L_SIG_A_INFO_DETAILS_LSIG_RESERVED_OFFSET 0x00000000
+#define PHYRX_L_SIG_A_0_PHYRX_L_SIG_A_INFO_DETAILS_LSIG_RESERVED_LSB 4
+#define PHYRX_L_SIG_A_0_PHYRX_L_SIG_A_INFO_DETAILS_LSIG_RESERVED_MASK 0x00000010
+
+/* Description		PHYRX_L_SIG_A_0_PHYRX_L_SIG_A_INFO_DETAILS_LENGTH
+			
+			The length indicates the number of octets in this MPDU. 
+			Note that when using mixed mode 11n preamble this length
+			provides the spoofed length for the PPDU.  This length
+			provides part of the information to derive the actually PPDU
+			length.  For legacy OFDM and 11B frames the maximum length
+			is 
+			
+			<legal all>
+*/
+#define PHYRX_L_SIG_A_0_PHYRX_L_SIG_A_INFO_DETAILS_LENGTH_OFFSET     0x00000000
+#define PHYRX_L_SIG_A_0_PHYRX_L_SIG_A_INFO_DETAILS_LENGTH_LSB        5
+#define PHYRX_L_SIG_A_0_PHYRX_L_SIG_A_INFO_DETAILS_LENGTH_MASK       0x0001ffe0
+
+/* Description		PHYRX_L_SIG_A_0_PHYRX_L_SIG_A_INFO_DETAILS_PARITY
+			
+			11a/n/ac TX: This field provides even parity over the
+			first 18 bits of the signal field which means that the sum
+			of 1s in the signal field will always be even on
+			
+			11a/n/ac RX: this field contains the received parity
+			field from the L-SIG symbol for the current packet.
+			
+			<legal 0-1>
+*/
+#define PHYRX_L_SIG_A_0_PHYRX_L_SIG_A_INFO_DETAILS_PARITY_OFFSET     0x00000000
+#define PHYRX_L_SIG_A_0_PHYRX_L_SIG_A_INFO_DETAILS_PARITY_LSB        17
+#define PHYRX_L_SIG_A_0_PHYRX_L_SIG_A_INFO_DETAILS_PARITY_MASK       0x00020000
+
+/* Description		PHYRX_L_SIG_A_0_PHYRX_L_SIG_A_INFO_DETAILS_TAIL
+			
+			The 6 bits of tail is always set to 0 is used to flush
+			the BCC encoder and decoder.  <legal 0>
+*/
+#define PHYRX_L_SIG_A_0_PHYRX_L_SIG_A_INFO_DETAILS_TAIL_OFFSET       0x00000000
+#define PHYRX_L_SIG_A_0_PHYRX_L_SIG_A_INFO_DETAILS_TAIL_LSB          18
+#define PHYRX_L_SIG_A_0_PHYRX_L_SIG_A_INFO_DETAILS_TAIL_MASK         0x00fc0000
+
+/* Description		PHYRX_L_SIG_A_0_PHYRX_L_SIG_A_INFO_DETAILS_PKT_TYPE
+			
+			Only used on the RX side.  
+			
+			Note: This is not really part of L-SIG
+			
+			
+			
+			Packet type:
+			
+			<enum 0 dot11a>802.11a PPDU type
+			
+			<enum 1 dot11b>802.11b PPDU type
+			
+			<enum 2 dot11n_mm>802.11n Mixed Mode PPDU type
+			
+			<enum 3 dot11ac>802.11ac PPDU type
+			
+			<enum 4 dot11ax>802.11ax PPDU type
+			
+			<enum 5 dot11ba>802.11ba (WUR) PPDU type
+*/
+#define PHYRX_L_SIG_A_0_PHYRX_L_SIG_A_INFO_DETAILS_PKT_TYPE_OFFSET   0x00000000
+#define PHYRX_L_SIG_A_0_PHYRX_L_SIG_A_INFO_DETAILS_PKT_TYPE_LSB      24
+#define PHYRX_L_SIG_A_0_PHYRX_L_SIG_A_INFO_DETAILS_PKT_TYPE_MASK     0x0f000000
+
+/* Description		PHYRX_L_SIG_A_0_PHYRX_L_SIG_A_INFO_DETAILS_CAPTURED_IMPLICIT_SOUNDING
+			
+			Only used on the RX side.  
+			
+			Note: This is not really part of L-SIG
+			
+			
+			
+			This indicates that the PHY has captured implicit
+			sounding.
+*/
+#define PHYRX_L_SIG_A_0_PHYRX_L_SIG_A_INFO_DETAILS_CAPTURED_IMPLICIT_SOUNDING_OFFSET 0x00000000
+#define PHYRX_L_SIG_A_0_PHYRX_L_SIG_A_INFO_DETAILS_CAPTURED_IMPLICIT_SOUNDING_LSB 28
+#define PHYRX_L_SIG_A_0_PHYRX_L_SIG_A_INFO_DETAILS_CAPTURED_IMPLICIT_SOUNDING_MASK 0x10000000
+
+/* Description		PHYRX_L_SIG_A_0_PHYRX_L_SIG_A_INFO_DETAILS_RESERVED
+			
+			Reserved: Should be set to 0 by the transmitting MAC and
+			ignored by the PHY <legal 0>
+*/
+#define PHYRX_L_SIG_A_0_PHYRX_L_SIG_A_INFO_DETAILS_RESERVED_OFFSET   0x00000000
+#define PHYRX_L_SIG_A_0_PHYRX_L_SIG_A_INFO_DETAILS_RESERVED_LSB      29
+#define PHYRX_L_SIG_A_0_PHYRX_L_SIG_A_INFO_DETAILS_RESERVED_MASK     0xe0000000
+
+
+#endif // _PHYRX_L_SIG_A_H_
--- a/Show More
+++ b/Show More