Merge da911f79d360210fb551ba9da9006317473e557f on remote branch

Change-Id: I8b48104e470c38769e3b5f994d74cc854e6e921d

9 files changed, 667 insertions, 65 deletions

diff --git a/fw/a_usb_defs.h b/fw/a_usb_defs.h
index 90a847f4e143..2657d56b6950 100644
--- a/fw/a_usb_defs.h
+++ b/fw/a_usb_defs.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012, 2018 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -25,13 +25,7 @@
  * to the Linux Foundation.
  */
 
-/*
- *  Shared USB definitions
- *
- *
- *
- *
- */
+/* USB definitions shared between host and target */
 
 #ifndef __A_USB_DEFS_H__
 #define __A_USB_DEFS_H__
@@ -41,19 +35,32 @@
 #endif
 
 /* USB endpoint definitions */
+#ifdef PLATFORM_GENOA
+
+#define USB_EP_ADDR_APP_CTRL_IN          0x88
+#define USB_EP_ADDR_APP_DATA_IN          0x89
+#define USB_EP_ADDR_APP_QMI_IN           0x8A
+#define USB_EP_ADDR_APP_DIAG_IN          0x8B
+
+#define USB_EP_ADDR_APP_CTRL_OUT         0x08
+#define USB_EP_ADDR_APP_DATA_OUT         0x09
+#define USB_EP_ADDR_APP_QMI_OUT          0x0A
+#define USB_EP_ADDR_APP_DIAG_OUT         0x0B
+
+#else /* PLATFORM_GENOA */
 
 #define USB_EP_ADDR_APP_CTRL_IN          0x81
 #define USB_EP_ADDR_APP_DATA_IN          0x82
 #define USB_EP_ADDR_APP_DATA2_IN         0x83
 #define USB_EP_ADDR_APP_INT_IN           0x84
 
-
-
 #define USB_EP_ADDR_APP_CTRL_OUT         0x01
 #define USB_EP_ADDR_APP_DATA_LP_OUT      0x02
 #define USB_EP_ADDR_APP_DATA_MP_OUT      0x03
 #define USB_EP_ADDR_APP_DATA_HP_OUT      0x04
 
+#endif /* PLATFORM_GENOA */
+
 #define USB_CONTROL_REQ_SEND_BMI_CMD        1
 #define USB_CONTROL_REQ_RECV_BMI_RESP       2
 #define USB_CONTROL_REQ_DIAG_CMD            3
diff --git a/fw/htt.h b/fw/htt.h
index 31c49fe17256..64d1391aaed2 100644
--- a/fw/htt.h
+++ b/fw/htt.h
@@ -171,9 +171,11 @@
  * 3.54 Define mcast and mcast_valid flags within htt_tx_wbm_transmit_status
  * 3.55 Add initiator / responder flags to RX_DELBA indication
  * 3.56 Fix HTT_RX_RING_SELECTION_CFG_PKT_TYPE_ENABLE bit-mask defs
+ * 3.57 Add support for in-band data within HTT_T2H_MSG_TYPE_CFR_DUMP_COMPL_IND
+ * 3.58 Add optional MSDU ack RSSI array to end of HTT_T2H TX_COMPL_IND msg
  */
 #define HTT_CURRENT_VERSION_MAJOR 3
-#define HTT_CURRENT_VERSION_MINOR 56
+#define HTT_CURRENT_VERSION_MINOR 58
 
 #define HTT_NUM_TX_FRAG_DESC  1024
 
@@ -8066,22 +8068,27 @@ PREPACK struct htt_txq_group {
  * The following diagram shows the format of the TX completion indication sent
  * from the target to the host
  *
- *          |31   27|26|25|24|23        16| 15 |14 11|10   8|7          0|
- *          |------------------------------------------------------------|
- * header:  |  rsvd |TP|A1|A0|     num    | t_i| tid |status|  msg_type  |
- *          |------------------------------------------------------------|
- * payload: |           MSDU1 ID          |         MSDU0 ID             |
- *          |------------------------------------------------------------|
- *          :           MSDU3 ID          :         MSDU2 ID             :
- *          |------------------------------------------------------------|
- *          |         struct htt_tx_compl_ind_append_retries             |
- *          |- - - - -  - - - - - - - - - - - - - - - - - - - - - - - - -|
- *          |         struct htt_tx_compl_ind_append_tx_tstamp           |
- *          |- - - - -  - - - - - - - - - - - - - - - - - - - - - - - - -|
+ *          |31 28|27|26|25|24|23        16| 15 |14 11|10   8|7          0|
+ *          |-------------------------------------------------------------|
+ * header:  |rsvd |A2|TP|A1|A0|     num    | t_i| tid |status|  msg_type  |
+ *          |-------------------------------------------------------------|
+ * payload: |            MSDU1 ID          |         MSDU0 ID             |
+ *          |-------------------------------------------------------------|
+ *          :            MSDU3 ID          :         MSDU2 ID             :
+ *          |-------------------------------------------------------------|
+ *          |          struct htt_tx_compl_ind_append_retries             |
+ *          |- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -|
+ *          |          struct htt_tx_compl_ind_append_tx_tstamp           |
+ *          |- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -|
+ *          |           MSDU1 ACK RSSI     |        MSDU0 ACK RSSI        |
+ *          |-------------------------------------------------------------|
+ *          :           MSDU3 ACK RSSI     :        MSDU2 ACK RSSI        :
+ *          |- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -|
  * Where:
  *     A0 = append (a.k.a. append0)
  *     A1 = append1
  *     TP = MSDU tx power presence
+ *     A2 = append2
  *
  * The following field definitions describe the format of the TX completion
  * indication sent from the target to the host
@@ -8135,6 +8142,19 @@ PREPACK struct htt_txq_group {
  *            which MSDU ID.
  *   Value: 0 indicates MSDU tx power reports are not appended,
  *          1 indicates MSDU tx power reports are appended
+ * - append2
+ *   Bits 27:27
+ *   Purpose: Indicate whether data ACK RSSI is appended for each MSDU in
+ *            TX_COMP_IND message.  The order of the per-MSDU ACK RSSI report
+ *            matches the order of the MSDU IDs.  Although the ACK RSSI is the
+ *            same for all MSDUs witin a single PPDU, the RSSI is duplicated
+ *            for each MSDU, for convenience.
+ *            The ACK RSSI values are valid when status is COMPLETE_OK (and
+ *            this append2 bit is set).
+ *            The ACK RSSI values are SNR in dB, i.e. are the RSSI in units of
+ *            dB above the noise floor.
+ *   Value: 0 indicates MSDU ACK RSSI values are not appended,
+ *          1 indicates MSDU ACK RSSI values are appended.
  * Payload fields:
  * - hmsdu_id
  *   Bits 15:0
@@ -8156,6 +8176,8 @@ PREPACK struct htt_txq_group {
 #define HTT_TX_COMPL_IND_APPEND1_M     0x02000000
 #define HTT_TX_COMPL_IND_TX_POWER_S    26
 #define HTT_TX_COMPL_IND_TX_POWER_M    0x04000000
+#define HTT_TX_COMPL_IND_APPEND2_S     27
+#define HTT_TX_COMPL_IND_APPEND2_M     0x08000000
 
 #define HTT_TX_COMPL_IND_STATUS_SET(_info, _val)                        \
     do {                                                                \
@@ -8207,6 +8229,14 @@ PREPACK struct htt_txq_group {
     } while (0)
 #define HTT_TX_COMPL_IND_TX_POWER_GET(_info)                             \
     (((_info) & HTT_TX_COMPL_IND_TX_POWER_M) >> HTT_TX_COMPL_IND_TX_POWER_S)
+#define HTT_TX_COMPL_IND_APPEND2_SET(_info, _val)                      \
+    do {                                                               \
+        HTT_CHECK_SET_VAL(HTT_TX_COMPL_IND_APPEND2, _val);             \
+        ((_info) |= ((_val) << HTT_TX_COMPL_IND_APPEND2_S));           \
+    } while (0)
+#define HTT_TX_COMPL_IND_APPEND2_GET(_info)                            \
+    (((_info) & HTT_TX_COMPL_IND_APPEND2_M) >> HTT_TX_COMPL_IND_APPEND2_S)
+
 #define HTT_TX_COMPL_INV_TX_POWER           0xffff
 
 #define HTT_TX_COMPL_CTXT_SZ                sizeof(A_UINT16)
@@ -10756,8 +10786,12 @@ typedef enum {
     /* This message type is currently used for the below purpose:
      *
      * - capture_method = WMI_PEER_CFR_CAPTURE_METHOD_NULL_FRAME in the
-     *   wmi_peer_cfr_capture_cmd. The associated memory region gets allocated
-     *   through WMI_CHANNEL_CAPTURE_HOST_MEM_REQ_ID
+     *   wmi_peer_cfr_capture_cmd.
+     *   If payload_present bit is set to 0 then the associated memory region
+     *   gets allocated through WMI_CHANNEL_CAPTURE_HOST_MEM_REQ_ID.
+     *   If payload_present bit is set to 1 then CFR dump is part of the HTT
+     *   message; the CFR dump will be present at the end of the message,
+     *   after the chan_phy_mode.
      */
     HTT_PEER_CFR_CAPTURE_MSG_TYPE_1  = 0x1,
 
@@ -10781,10 +10815,10 @@ typedef enum {
  *
  * **************************************************************************
  *
- *          |31                           16|15                   |7        0|
+ *          |31                           16|15                 |8|7        0|
  *          |----------------------------------------------------------------|
- * header:  |                           reserved                  | msg_type |
- * word 0   |                                                     |          |
+ * header:  |                           reserved                |P| msg_type |
+ * word 0   |                                                   | |          |
  *          |----------------------------------------------------------------|
  * payload: |                      cfr_capture_msg_type                      |
  * word 1   |                                                                |
@@ -10823,6 +10857,7 @@ typedef enum {
  * word 12  |                                                                |
  *          |----------------------------------------------------------------|
  * where,
+ * P       - payload present bit (payload_present explained below)
  * req_id  - memory request id (mem_req_id explained below)
  * S       - status field (status explained below)
  * capbw   - capture bandwidth (capture_bw explained below)
@@ -10841,8 +10876,15 @@ typedef enum {
  *   Bits 7:0
  *   Purpose: Identifies this as CFR TX completion indication
  *   Value: HTT_T2H_MSG_TYPE_CFR_DUMP_COMPL_IND
+ * - payload_present
+ *   Bit 8
+ *   Purpose: Identifies how CFR data is sent to host
+ *   Value: 0 - If CFR Payload is written to host memory
+ *          1 - If CFR Payload is sent as part of HTT message
+ *              (This is the requirement for SDIO/USB where it is
+ *               not possible to write CFR data to host memory)
  * - reserved
- *   Bits 31:8
+ *   Bits 31:9
  *   Purpose: Reserved
  *   Value: 0
  *
@@ -10861,7 +10903,8 @@ typedef enum {
  *   Bits 6:0
  *   Purpose: Contain the mem request id of the region where the CFR capture
  *       has been stored - of type WMI_HOST_MEM_REQ_ID
- *   Value: WMI_CHANNEL_CAPTURE_HOST_MEM_REQ_ID
+ *   Value: WMI_CHANNEL_CAPTURE_HOST_MEM_REQ_ID (if payload_present is 1,
+            this value is invalid)
  * - status
  *   Bit 7
  *   Purpose: Boolean value carrying the status of the CFR capture of the peer
@@ -10991,6 +11034,22 @@ PREPACK struct htt_cfr_dump_compl_ind {
 } POSTPACK;
 
 /*
+ * Get / set macros for the bit fields within WORD-1 of htt_cfr_dump_compl_ind,
+ * msg_type = HTT_PEER_CFR_CAPTURE_MSG_TYPE_1
+ */
+#define HTT_T2H_CFR_DUMP_PAYLOAD_PRESENT_ID_M      0x00000100
+#define HTT_T2H_CFR_DUMP_PAYLOAD_PRESENT_ID_S      8
+
+#define HTT_T2H_CFR_DUMP_PAYLOAD_PRESENT_ID_SET(word, value) \
+  do { \
+         HTT_CHECK_SET_VAL(HTT_T2H_CFR_DUMP_PAYLOAD_PRESENT_ID, value); \
+         (word)  |= (value) << HTT_T2H_CFR_DUMP_PAYLOAD_PRESENT_ID_S;   \
+     } while(0)
+#define HTT_T2H_CFR_DUMP_PAYLOAD_PRESENT_ID_GET(word) \
+       (((word) & HTT_T2H_CFR_DUMP_PAYLOAD_PRESENT_ID_M) >> \
+           HTT_T2H_CFR_DUMP_PAYLOAD_PRESENT_ID_S)
+
+/*
  * Get / set macros for the bit fields within WORD-2 of htt_cfr_dump_compl_ind,
  * msg_type = HTT_PEER_CFR_CAPTURE_MSG_TYPE_1
  */
diff --git a/fw/htt_ppdu_stats.h b/fw/htt_ppdu_stats.h
index d2f2f49c99fd..e88fcc3abeef 100644
--- a/fw/htt_ppdu_stats.h
+++ b/fw/htt_ppdu_stats.h
@@ -296,8 +296,11 @@ enum HTT_STATS_FTYPE {
     HTT_STATS_FTYPE_SGEN_MU_RTS,
     HTT_STATS_FTYPE_SGEN_MU_BSR,
     HTT_STATS_FTYPE_SGEN_UL_BSR,
+    HTT_STATS_FTYPE_SGEN_UL_BSR_TRIGGER = HTT_STATS_FTYPE_SGEN_UL_BSR, /*alias*/
     HTT_STATS_FTYPE_TIDQ_DATA_SU,
     HTT_STATS_FTYPE_TIDQ_DATA_MU,
+    HTT_STATS_FTYPE_SGEN_UL_BSR_RESP,
+    HTT_STATS_FTYPE_SGEN_QOS_NULL,
     HTT_STATS_FTYPE_MAX,
 };
 typedef enum HTT_STATS_FTYPE HTT_STATS_FTYPE;
diff --git a/fw/htt_stats.h b/fw/htt_stats.h
index 1da4a55e849b..97957fd83c0f 100644
--- a/fw/htt_stats.h
+++ b/fw/htt_stats.h
@@ -1007,6 +1007,7 @@ typedef struct {
     /* Total ppdu transmitted bytes for peer: includes MAC header overhead */
     A_UINT32 ppdu_transmitted_bytes_low;
     A_UINT32 ppdu_transmitted_bytes_high;
+    A_UINT32 peer_ttl_removed_count;
 } htt_peer_stats_cmn_tlv;
 
 typedef struct {
diff --git a/fw/wlan_defs.h b/fw/wlan_defs.h
index 4dd6292a7bfa..f1841e6416f9 100755
--- a/fw/wlan_defs.h
+++ b/fw/wlan_defs.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2016, 2018 The Linux Foundation. All rights reserved.*
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -597,7 +597,61 @@ typedef enum {
  * so that it is easy to handle the statistics in BE host.
  */
 
-struct wlan_dbg_tx_stats {
+/*
+ * wlan_dbg_tx_stats_v1, _v2:
+ * differing versions of the wlan_dbg_tx_stats struct used by different
+ * targets
+ */
+struct wlan_dbg_tx_stats_v1 {
+    /* Num HTT cookies queued to dispatch list */
+    A_INT32 comp_queued;
+    /* Num HTT cookies dispatched */
+    A_INT32 comp_delivered;
+    /* Num MSDU queued to WAL */
+    A_INT32 msdu_enqued;
+    /* Num MPDU queue to WAL */
+    A_INT32 mpdu_enqued;
+    /* Num MSDUs dropped by WMM limit */
+    A_INT32 wmm_drop;
+    /* Num Local frames queued */
+    A_INT32 local_enqued;
+    /* Num Local frames done */
+    A_INT32 local_freed;
+    /* Num queued to HW */
+    A_INT32 hw_queued;
+    /* Num PPDU reaped from HW */
+    A_INT32 hw_reaped;
+    /* Num underruns */
+    A_INT32 underrun;
+    /* Num PPDUs cleaned up in TX abort */
+    A_INT32 tx_abort;
+    /* Num MPDUs requed by SW */
+    A_INT32 mpdus_requed;
+    /* excessive retries */
+    A_UINT32 tx_ko;
+    /* data hw rate code */
+    A_UINT32 data_rc;
+    /* Scheduler self triggers */
+    A_UINT32 self_triggers;
+    /* frames dropped due to excessive sw retries */
+    A_UINT32 sw_retry_failure;
+    /* illegal rate phy errors  */
+    A_UINT32 illgl_rate_phy_err;
+    /* wal pdev continous xretry */
+    A_UINT32 pdev_cont_xretry;
+    /* wal pdev continous xretry */
+    A_UINT32 pdev_tx_timeout;
+    /* wal pdev resets  */
+    A_UINT32 pdev_resets;
+    /* frames dropped due to non-availability of stateless TIDs */
+    A_UINT32 stateless_tid_alloc_failure;
+    /* PhY/BB underrun */
+    A_UINT32 phy_underrun;
+    /* MPDU is more than txop limit */
+    A_UINT32 txop_ovf;
+};
+
+struct wlan_dbg_tx_stats_v2 {
     /* Num HTT cookies queued to dispatch list */
     A_INT32 comp_queued;
     /* Num HTT cookies dispatched */
@@ -618,19 +672,15 @@ struct wlan_dbg_tx_stats {
     A_INT32 hw_reaped;
     /* Num underruns */
     A_INT32 underrun;
-#if defined(AR900B)
     /* HW Paused. */
     A_UINT32 hw_paused;
-#endif
     /* Num PPDUs cleaned up in TX abort */
     A_INT32 tx_abort;
     /* Num MPDUs requed by SW */
     A_INT32 mpdus_requed;
     /* excessive retries */
     A_UINT32 tx_ko;
-#if defined(AR900B)
     A_UINT32 tx_xretry;
-#endif
     /* data hw rate code */
     A_UINT32 data_rc;
     /* Scheduler self triggers */
@@ -651,7 +701,6 @@ struct wlan_dbg_tx_stats {
     A_UINT32 phy_underrun;
     /* MPDU is more than txop limit */
     A_UINT32 txop_ovf;
-#if defined(AR900B)
     /* Number of Sequences posted */
     A_UINT32 seq_posted;
     /* Number of Sequences failed queueing */
@@ -672,10 +721,46 @@ struct wlan_dbg_tx_stats {
     A_INT32 mpdus_ack_failed;
     /* Num MPDUs that was dropped du to expiry. */
     A_INT32 mpdus_expired;
+};
+
+#if defined(AR900B)
+#define wlan_dbg_tx_stats wlan_dbg_tx_stats_v2
+#else
+#define wlan_dbg_tx_stats wlan_dbg_tx_stats_v1
 #endif
+
+/*
+ * wlan_dbg_rx_stats_v1, _v2:
+ * differing versions of the wlan_dbg_rx_stats struct used by different
+ * targets
+ */
+struct wlan_dbg_rx_stats_v1 {
+    /* Cnts any change in ring routing mid-ppdu */
+    A_INT32 mid_ppdu_route_change;
+    /* Total number of statuses processed */
+    A_INT32 status_rcvd;
+    /* Extra frags on rings 0-3 */
+    A_INT32 r0_frags;
+    A_INT32 r1_frags;
+    A_INT32 r2_frags;
+    A_INT32 r3_frags;
+    /* MSDUs / MPDUs delivered to HTT */
+    A_INT32 htt_msdus;
+    A_INT32 htt_mpdus;
+    /* MSDUs / MPDUs delivered to local stack */
+    A_INT32 loc_msdus;
+    A_INT32 loc_mpdus;
+    /* AMSDUs that have more MSDUs than the status ring size */
+    A_INT32 oversize_amsdu;
+    /* Number of PHY errors */
+    A_INT32 phy_errs;
+    /* Number of PHY errors drops */
+    A_INT32 phy_err_drop;
+    /* Number of mpdu errors - FCS, MIC, ENC etc. */
+    A_INT32 mpdu_errs;
 };
 
-struct wlan_dbg_rx_stats {
+struct wlan_dbg_rx_stats_v2 {
     /* Cnts any change in ring routing mid-ppdu */
     A_INT32 mid_ppdu_route_change;
     /* Total number of statuses processed */
@@ -699,12 +784,15 @@ struct wlan_dbg_rx_stats {
     A_INT32 phy_err_drop;
     /* Number of mpdu errors - FCS, MIC, ENC etc. */
     A_INT32 mpdu_errs;
-#if defined(AR900B)
     /* Number of rx overflow errors. */
     A_INT32 rx_ovfl_errs;
-#endif
 };
 
+#if defined(AR900B)
+#define wlan_dbg_rx_stats wlan_dbg_rx_stats_v2
+#else
+#define wlan_dbg_rx_stats wlan_dbg_rx_stats_v1
+#endif
 
 struct wlan_dbg_mem_stats {
     A_UINT32 iram_free_size;
@@ -716,6 +804,28 @@ struct wlan_dbg_peer_stats {
 	A_INT32 dummy; /* REMOVE THIS ONCE REAL PEER STAT COUNTERS ARE ADDED */
 };
 
+/*
+ * wlan_dbg_rx_rate_info_v1a_t, _v1b_t:
+ * differing versions of the wlan_dbg_rx_rate_info struct used by different
+ * targets
+ */
+typedef struct {
+    A_UINT32 mcs[10];
+    A_UINT32 sgi[10];
+    A_UINT32 nss[4];
+    A_UINT32 nsts;
+    A_UINT32 stbc[10];
+    A_UINT32 bw[3];
+    A_UINT32 pream[6];
+    A_UINT32 ldpc;
+    A_UINT32 txbf;
+    A_UINT32 mgmt_rssi;
+    A_UINT32 data_rssi;
+    A_UINT32 rssi_chain0;
+    A_UINT32 rssi_chain1;
+    A_UINT32 rssi_chain2;
+} wlan_dbg_rx_rate_info_v1a_t;
+
 typedef struct {
     A_UINT32 mcs[10];
     A_UINT32 sgi[10];
@@ -734,12 +844,15 @@ typedef struct {
 /*
  * TEMPORARY: leave rssi_chain3 in place for AR900B builds until code using
  * rssi_chain3 has been converted to use wlan_dbg_rx_rate_info_v2_t.
- * At that time, this rssi_chain3 field will be deleted.
  */
-#if defined(AR900B)
 	A_UINT32 rssi_chain3;
+} wlan_dbg_rx_rate_info_v1b_t;
+
+#if defined(AR900B)
+#define wlan_dbg_rx_rate_info_t wlan_dbg_rx_rate_info_v1b_t
+#else
+#define wlan_dbg_rx_rate_info_t wlan_dbg_rx_rate_info_v1a_t
 #endif
-} wlan_dbg_rx_rate_info_t ;
 
 typedef struct {
     A_UINT32 mcs[10];
@@ -930,25 +1043,56 @@ typedef struct wlan_dbg_stats_wifi2 {
     wlan_dgb_sifs_resp_stats_t sifs_resp_info;
 } wlan_dbg_wifi2_stats_t;
 
+/*
+ * wlan_dbg_rx_rate_info_v1a, _v1b:
+ * differing versions of the wlan_dbg_rx_rate_info struct used by different
+ * targets
+ */
 typedef struct {
-    wlan_dbg_rx_rate_info_t rx_phy_info;
+    wlan_dbg_rx_rate_info_v1a_t rx_phy_info;
     wlan_dbg_tx_rate_info_t tx_rate_info;
-} wlan_dbg_rate_info_t;
+} wlan_dbg_rate_info_v1a_t;
+
+typedef struct {
+    wlan_dbg_rx_rate_info_v1b_t rx_phy_info;
+    wlan_dbg_tx_rate_info_t tx_rate_info;
+} wlan_dbg_rate_info_v1b_t;
+
+#if defined(AR900B)
+#define wlan_dbg_rate_info_t wlan_dbg_rate_info_v1b_t
+#else
+#define wlan_dbg_rate_info_t wlan_dbg_rate_info_v1a_t
+#endif
 
 typedef struct {
     wlan_dbg_rx_rate_info_v2_t rx_phy_info;
     wlan_dbg_tx_rate_info_v2_t tx_rate_info;
 } wlan_dbg_rate_info_v2_t;
 
-struct wlan_dbg_stats {
-    struct wlan_dbg_tx_stats tx;
-    struct wlan_dbg_rx_stats rx;
-#if defined(AR900B)
+/*
+ * wlan_dbg_stats_v1, _v2:
+ * differing versions of the wlan_dbg_stats struct used by different
+ * targets
+ */
+struct wlan_dbg_stats_v1 {
+    struct wlan_dbg_tx_stats_v1 tx;
+    struct wlan_dbg_rx_stats_v1 rx;
+    struct wlan_dbg_peer_stats peer;
+};
+
+struct wlan_dbg_stats_v2 {
+    struct wlan_dbg_tx_stats_v2 tx;
+    struct wlan_dbg_rx_stats_v2 rx;
     struct wlan_dbg_mem_stats mem;
-#endif
     struct wlan_dbg_peer_stats peer;
 };
 
+#if defined(AR900B)
+#define wlan_dbg_stats wlan_dbg_stats_v2
+#else
+#define wlan_dbg_stats wlan_dbg_stats_v1
+#endif
+
 #define DBG_STATS_MAX_HWQ_NUM 10
 #define DBG_STATS_MAX_TID_NUM 20
 #define DBG_STATS_MAX_CONG_NUM 16
diff --git a/fw/wmi_services.h b/fw/wmi_services.h
index a67dada36748..cf6b14d27544 100755
--- a/fw/wmi_services.h
+++ b/fw/wmi_services.h
@@ -263,6 +263,11 @@ typedef  enum  {
     WMI_SERVICE_NDI_SAP_SUPPORT=167, /* Support SAP Concurrency for NAN Data interface */
     WMI_SERVICE_CFR_CAPTURE_SUPPORT=168, /* Support to capture uncompressed Channel Frequency Response (CFR) */
     WMI_SERVICE_CFR_CAPTURE_IND_MSG_TYPE_1=169, /* Message type HTT_PEER_CFR_CAPTURE_MSG_TYPE_1 in HTT_T2H_MSG_TYPE_CFR_DUMP_COMPL_IND */
+    WMI_SERVICE_ESP_SUPPORT=170, /* Support for Estimated Service Params IE */
+    WMI_SERVICE_PEER_CHWIDTH_CHANGE = 171, /* Support for host to update/re-intersect the node capability */
+    WMI_SERVICE_WLAN_HPCS_PULSE=172, /* Support for High Precision Clock Synchronization feature */
+    WMI_SERVICE_PER_VDEV_CHAINMASK_CONFIG_SUPPORT=173, /* Support for configuring chainmask per VDEV */
+    WMI_SERVICE_TX_DATA_MGMT_ACK_RSSI=174, /* ACK RSSI indication to host for host TX data and mgmt frame */
 
     /******* ADD NEW SERVICES HERE *******/
 
diff --git a/fw/wmi_tlv_defs.h b/fw/wmi_tlv_defs.h
index 96c2b9176c7b..d2236b8d0d17 100755
--- a/fw/wmi_tlv_defs.h
+++ b/fw/wmi_tlv_defs.h
@@ -930,6 +930,13 @@ typedef enum {
     WMITLV_TAG_STRUC_wmi_peer_cfr_capture_cmd_fixed_param,
     WMITLV_TAG_STRUC_wmi_peer_chan_width_switch_cmd_fixed_param,
     WMITLV_TAG_STRUC_wmi_chan_width_peer_list,
+    WMITLV_TAG_STRUC_wmi_obss_spatial_reuse_set_def_obss_thresh_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_pdev_he_tb_action_frm_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_peer_extd2_stats,
+    WMITLV_TAG_STRUC_wmi_hpcs_pulse_start_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_pdev_ctl_failsafe_check_fixed_param,
+    WMITLV_TAG_STRUC_wmi_vdev_chainmask_config_cmd_fixed_param,
+    WMITLV_TAG_STRUC_wmi_vdev_bcn_offload_quiet_config_cmd_fixed_param,
 } WMITLV_TAG_ID;
 
 /*
@@ -1310,6 +1317,11 @@ typedef enum {
     OP(WMI_PDEV_OBSS_PD_SPATIAL_REUSE_CMDID) \
     OP(WMI_PEER_CFR_CAPTURE_CMDID) \
     OP(WMI_PEER_CHAN_WIDTH_SWITCH_CMDID) \
+    OP(WMI_PDEV_OBSS_PD_SPATIAL_REUSE_SET_DEF_OBSS_THRESH_CMDID) \
+    OP(WMI_PDEV_HE_TB_ACTION_FRM_CMDID) \
+    OP(WMI_HPCS_PULSE_START_CMDID) \
+    OP(WMI_VDEV_CHAINMASK_CONFIG_CMDID) \
+    OP(WMI_VDEV_BCN_OFFLOAD_QUIET_CONFIG_CMDID) \
     /* add new CMD_LIST elements above this line */
 
 
@@ -1520,6 +1532,7 @@ typedef enum {
     OP(WMI_MOTION_DET_HOST_EVENTID) \
     OP(WMI_MOTION_DET_BASE_LINE_HOST_EVENTID) \
     OP(WMI_ESP_ESTIMATE_EVENTID) \
+    OP(WMI_PDEV_CTL_FAILSAFE_CHECK_EVENTID) \
     /* add new EVT_LIST elements above this line */
 
 
@@ -2426,6 +2439,11 @@ WMITLV_CREATE_PARAM_STRUC(WMI_VDEV_LIMIT_OFFCHAN_CMDID);
 
 WMITLV_CREATE_PARAM_STRUC(WMI_VDEV_SET_CUSTOM_SW_RETRY_TH_CMDID);
 
+#define WMITLV_TABLE_WMI_VDEV_CHAINMASK_CONFIG_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_vdev_chainmask_config_cmd_fixed_param, wmi_vdev_chainmask_config_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+
+WMITLV_CREATE_PARAM_STRUC(WMI_VDEV_CHAINMASK_CONFIG_CMDID);
+
 /* PDEV Set Base Mac Address Cmd */
 #define WMITLV_TABLE_WMI_PDEV_SET_BASE_MACADDR_CMDID(id,op,buf,len) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_set_base_macaddr_cmd_fixed_param, wmi_pdev_set_base_macaddr_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
@@ -2600,6 +2618,12 @@ WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_SET_QUIET_MODE_CMDID);
 
 WMITLV_CREATE_PARAM_STRUC(WMI_VDEV_SET_QUIET_MODE_CMDID);
 
+/* vdev set offload quiet Cmd */
+#define WMITLV_TABLE_WMI_VDEV_BCN_OFFLOAD_QUIET_CONFIG_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_vdev_bcn_offload_quiet_config_cmd_fixed_param, wmi_vdev_bcn_offload_quiet_config_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+
+WMITLV_CREATE_PARAM_STRUC(WMI_VDEV_BCN_OFFLOAD_QUIET_CONFIG_CMDID);
+
 /* Setting custom aggregation size using command */
 #define WMITLV_TABLE_WMI_VDEV_SET_CUSTOM_AGGR_SIZE_CMDID(id,op,buf,len) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_vdev_set_custom_aggr_size_cmd_fixed_param, wmi_vdev_set_custom_aggr_size_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
@@ -3774,6 +3798,22 @@ WMITLV_CREATE_PARAM_STRUC(WMI_PEER_CFR_CAPTURE_CMDID);
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_chan_width_peer_list, peer_info, WMITLV_SIZE_VAR)
 WMITLV_CREATE_PARAM_STRUC(WMI_PEER_CHAN_WIDTH_SWITCH_CMDID);
 
+/* OBSS_PD Spatial_Reuse Set Default OBSS Thresholds */
+#define WMITLV_TABLE_WMI_PDEV_OBSS_PD_SPATIAL_REUSE_SET_DEF_OBSS_THRESH_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_obss_spatial_reuse_set_def_obss_thresh_cmd_fixed_param, wmi_obss_spatial_reuse_set_def_obss_thresh_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_OBSS_PD_SPATIAL_REUSE_SET_DEF_OBSS_THRESH_CMDID);
+
+/* HE TB Action frame enable/disable */
+#define WMITLV_TABLE_WMI_PDEV_HE_TB_ACTION_FRM_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_he_tb_action_frm_cmd_fixed_param, \
+        wmi_pdev_he_tb_action_frm_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)  \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, data, WMITLV_SIZE_VAR)
+WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_HE_TB_ACTION_FRM_CMDID);
+
+/* HPCS Pulse cmd */
+#define WMITLV_TABLE_WMI_HPCS_PULSE_START_CMDID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_hpcs_pulse_start_cmd_fixed_param, wmi_hpcs_pulse_start_cmd_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_HPCS_PULSE_START_CMDID);
 
 /************************** TLV definitions of WMI events *******************************/
 
@@ -3941,7 +3981,8 @@ WMITLV_CREATE_PARAM_STRUC(WMI_OFFCHAN_DATA_TX_COMPLETION_EVENTID);
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_mgmt_tx_compl_bundle_event_fixed_param, wmi_mgmt_tx_compl_bundle_event_fixed_param, fixed_param, WMITLV_SIZE_FIX) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_UINT32, A_UINT32, desc_ids, WMITLV_SIZE_VAR) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_UINT32, A_UINT32, status, WMITLV_SIZE_VAR) \
-    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_UINT32, A_UINT32, ppdu_id, WMITLV_SIZE_VAR)
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_UINT32, A_UINT32, ppdu_id, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_UINT32, A_UINT32, ack_rssi, WMITLV_SIZE_VAR)
 WMITLV_CREATE_PARAM_STRUC(WMI_MGMT_TX_BUNDLE_COMPLETION_EVENTID);
 
 /* VDEV Start response Event */
@@ -4222,7 +4263,8 @@ WMITLV_CREATE_PARAM_STRUC(WMI_HOST_SWFDA_EVENTID);
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_BYTE, A_UINT8, data, WMITLV_SIZE_VAR) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_per_chain_rssi_stats, wmi_per_chain_rssi_stats, chain_stats, WMITLV_SIZE_FIX) \
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_rssi_stats, rssi_stats, WMITLV_SIZE_VAR) \
-    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_congestion_stats, congestion_stats, WMITLV_SIZE_VAR)
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_congestion_stats, congestion_stats, WMITLV_SIZE_VAR) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_peer_extd2_stats, peer_extd2_stats, WMITLV_SIZE_VAR)
 WMITLV_CREATE_PARAM_STRUC(WMI_UPDATE_STATS_EVENTID);
 
 /* For vdev based ht/vht info upload*/
@@ -5010,6 +5052,10 @@ WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_DMA_RING_CFG_RSP_EVENTID);
     WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_ARRAY_STRUC, wmi_dma_buf_release_spectral_meta_data, meta_data, WMITLV_SIZE_VAR)
 WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_DMA_RING_BUF_RELEASE_EVENTID);
 
+/* ctl failsafe check event */
+#define WMITLV_TABLE_WMI_PDEV_CTL_FAILSAFE_CHECK_EVENTID(id,op,buf,len) \
+    WMITLV_ELEM(id,op,buf,len, WMITLV_TAG_STRUC_wmi_pdev_ctl_failsafe_check_fixed_param, wmi_pdev_ctl_failsafe_check_fixed_param, fixed_param, WMITLV_SIZE_FIX)
+WMITLV_CREATE_PARAM_STRUC(WMI_PDEV_CTL_FAILSAFE_CHECK_EVENTID);
 
 /* UNIT-TEST Event */
 #define WMITLV_TABLE_WMI_UNIT_TEST_EVENTID(id,op,buf,len) \
diff --git a/fw/wmi_unified.h b/fw/wmi_unified.h
index 17d5a0791cfa..0a5e6d445fd9 100755
--- a/fw/wmi_unified.h
+++ b/fw/wmi_unified.h
@@ -256,6 +256,7 @@ typedef enum {
     WMI_GRP_MOTION_DET,     /* 0x3f */
     WMI_GRP_SPATIAL_REUSE,  /* 0x40 */
     WMI_GRP_ESP,            /* 0x41 Estimate Service Parameters (802.11mc) */
+    WMI_GRP_HPCS_PULSE,     /* 0x42 */
 } WMI_GRP_ID;
 
 #define WMI_CMD_GRP_START_ID(grp_id) (((grp_id) << 12) | 0x1)
@@ -400,6 +401,8 @@ typedef enum {
     WMI_PDEV_SET_RX_FILTER_PROMISCUOUS_CMDID,
     /* set a generic direct DMA ring config */
     WMI_PDEV_DMA_RING_CFG_REQ_CMDID,
+    /* enable/disable Action frame response as HE TB PPDU */
+    WMI_PDEV_HE_TB_ACTION_FRM_CMDID,
 
     /* VDEV (virtual device) specific commands */
     /** vdev create */
@@ -465,6 +468,8 @@ typedef enum {
     WMI_VDEV_LIMIT_OFFCHAN_CMDID,
     /** To set custom software retries per-AC for vdev */
     WMI_VDEV_SET_CUSTOM_SW_RETRY_TH_CMDID,
+    /** To set chainmask configuration for vdev */
+    WMI_VDEV_CHAINMASK_CONFIG_CMDID,
 
     /* peer specific commands */
 
@@ -575,6 +580,8 @@ typedef enum {
     WMI_BCN_OFFLOAD_CTRL_CMDID,
     /** Cmd to enable FW handling BSS color change notification from AP. */
     WMI_BSS_COLOR_CHANGE_ENABLE_CMDID,
+    /** To configure Beacon offload quiet-ie params */
+    WMI_VDEV_BCN_OFFLOAD_QUIET_CONFIG_CMDID,
 
     /** commands to directly control ba negotiation directly from host. only used in test mode */
 
@@ -1163,6 +1170,10 @@ typedef enum {
 
     /** WMI commands related to OBSS PD Spatial Reuse **/
     WMI_PDEV_OBSS_PD_SPATIAL_REUSE_CMDID = WMI_CMD_GRP_START_ID(WMI_GRP_SPATIAL_REUSE),
+    WMI_PDEV_OBSS_PD_SPATIAL_REUSE_SET_DEF_OBSS_THRESH_CMDID,
+
+    /** WMI commands related to High Precision Clock Synchronization feature **/
+    WMI_HPCS_PULSE_START_CMDID = WMI_CMD_GRP_START_ID(WMI_GRP_HPCS_PULSE),
 } WMI_CMD_ID;
 
 typedef enum {
@@ -1254,6 +1265,9 @@ typedef enum {
 
     WMI_PDEV_DMA_RING_BUF_RELEASE_EVENTID,
 
+    /** WMI Event to deliver CTL Failsafe application */
+    WMI_PDEV_CTL_FAILSAFE_CHECK_EVENTID,
+
 
     /* VDEV specific events */
     /** VDEV started event in response to VDEV_START request */
@@ -1936,6 +1950,9 @@ typedef enum {
 /* Interested readers refer to Rx/Tx MCS Map definition as defined in
  802.11ac
  */
+#define WMI_VHT_MAX_MCS_EXT_SS_GET(vht_mcs_map, index) WMI_GET_BITS(vht_mcs_map, 16 + index, 1)
+#define WMI_VHT_MAX_MCS_EXT_SS_SET(vht_mcs_map, index, value) WMI_SET_BITS(vht_mcs_map, 16 + index, 1, value)
+
 #define WMI_VHT_MAX_MCS_4_SS_MASK(r,ss)      ((3 & (r)) << (((ss) - 1) << 1))
 #define WMI_VHT_MAX_SUPP_RATE_MASK           0x1fff0000
 #define WMI_VHT_MAX_SUPP_RATE_MASK_SHIFT     16
@@ -1947,6 +1964,25 @@ typedef enum {
 #define WMI_HE_FRAG_SUPPORT_MASK          0x00000018
 #define WMI_HE_FRAG_SUPPORT_SHIFT         3
 
+#define WMI_HE_CAP_1X_LTF_400NS_GI_SUPPORT      0x00000001
+#define WMI_HE_CAP_2X_LTF_400NS_GI_SUPPORT      0x00000002
+#define WMI_HE_CAP_2X_LTF_160_80_80_SUPPORT     0x00000004
+
+#define WMI_HE_CAP_1X_LTF_400NS_GI_SUPPORT_GET(he_cap_info_dword1) \
+    WMI_GET_BITS(he_cap_info_dword1, 0, 1)
+#define WMI_HE_CAP_1X_LTF_400NS_GI_SUPPORT_SET(he_cap_info_dword1, value) \
+    WMI_SET_BITS(he_cap_info_dword1, 0, 1, value)
+
+#define WMI_HE_CAP_2X_LTF_400NS_GI_SUPPORT_GET(he_cap_info_dword1) \
+    WMI_GET_BITS(he_cap_info_dword1, 1, 1)
+#define WMI_HE_CAP_2X_LTF_400NS_GI_SUPPORT_SET(he_cap_info_dword1, value) \
+    WMI_SET_BITS(he_cap_info_dword1, 1, 1, value)
+
+#define WMI_HE_CAP_2X_LTF_160_80_80_SUPPORT_GET(he_cap_info_dword1) \
+    WMI_GET_BITS(he_cap_info_dword1, 2, 1)
+#define WMI_HE_CAP_2X_LTF_160_80_80_SUPPORT_SET(he_cap_info_dword1, value) \
+    WMI_SET_BITS(he_cap_info_dword1, 2, 1, value)
+
 /* Interested readers refer to Rx/Tx MCS Map definition as defined in 802.11ax
  */
 #define WMI_HE_MAX_MCS_4_SS_MASK(r,ss)      ((3 & (r)) << (((ss) - 1) << 1))
@@ -2809,6 +2845,15 @@ typedef struct {
     #define WMI_RSRC_CFG_FLAG_EAPOL_AC_OVERRIDE_S 16
     #define WMI_RSRC_CFG_FLAG_EAPOL_AC_OVERRIDE_M 0x30000
 
+    /*
+     * If TX_ACK_RSSI is set, then the target should populate the ack_rssi
+     * field within the WMI_MGMT_TX_COMPLETION_EVENT message, the ack_rssi
+     * TLV within the WMI_MGMT_TX_BUNDLE_COMPLETION_EVENT message, and the
+     * "MSDU ACK RSSI" array within the HTT_T2H TX_COMPL_IND message.
+     */
+    #define WMI_RSRC_CFG_FLAG_TX_ACK_RSSI_S 18
+    #define WMI_RSRC_CFG_FLAG_TX_ACK_RSSI_M 0x40000
+
     A_UINT32 flag1;
 
     /** @brief smart_ant_cap - Smart Antenna capabilities information
@@ -3037,6 +3082,12 @@ typedef struct {
 #define WMI_RSRC_CFG_FLAG_EAPOL_AC_OVERRIDE_GET(word32) \
     WMI_RSRC_CFG_FLAG_GET((word32), EAPOL_AC_OVERRIDE)
 
+#define WMI_RSRC_CFG_FLAG_TX_ACK_RSSI_SET(word32, value) \
+    WMI_RSRC_CFG_FLAG_SET((word32), TX_ACK_RSSI, (value))
+#define WMI_RSRC_CFG_FLAG_TX_ACK_RSSI_GET(word32) \
+    WMI_RSRC_CFG_FLAG_GET((word32), TX_ACK_RSSI)
+
+
 typedef struct {
     A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_init_cmd_fixed_param */
 
@@ -3503,6 +3554,7 @@ enum wmi_scan_completion_reason {
     WMI_SCAN_REASON_TIMEDOUT = 3,
     WMI_SCAN_REASON_INTERNAL_FAILURE = 4, /* This reason indication failures when performaing scan */
     WMI_SCAN_REASON_SUSPENDED = 5,
+    WMI_SCAN_REASON_DFS_VIOLATION = 6, /* Failure when tried to SCAN channel in NOL list */
     WMI_SCAN_REASON_MAX,
 };
 
@@ -4375,6 +4427,27 @@ typedef struct {
     A_UINT32 enabled;    /* enable/disable */
 } wmi_vdev_set_quiet_cmd_fixed_param;
 
+/*
+ * START_STOP flag value: 1 - Start, 0 - Stop
+ */
+#define WMI_OFFLOAD_QUIET_FLAG_START_STOP   0x00000001
+/*
+ * ONE_SHOT flag value: 1 - One shot, 0 - Repeat
+ * This flag is only relevant if the START_STOP flag == 1 (start).
+ */
+#define WMI_OFFLOAD_QUIET_FLAG_ONE_SHOT     0x00000002
+
+typedef struct {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_vdev_bcn_offload_quiet_config_cmd_fixed_param */
+    A_UINT32 vdev_id;    /* Virtual interface ID */
+    A_UINT32 period;     /* period in TUs */
+    A_UINT32 duration;   /* duration in TUs */
+    A_UINT32 next_start; /* offset in TUs from beacon */
+    A_UINT32 flags;      /* STOP or START (and single vs. repeated) Quiet IE
+                          * See WMI_OFFLOAD_QUIET_FLAG_xxx defs.
+                          */
+} wmi_vdev_bcn_offload_quiet_config_cmd_fixed_param;
+
 typedef struct {
     A_UINT32 tlv_header;   /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_vdev_set_custom_aggr_size_cmd_fixed_param */
     A_UINT32 vdev_id;      /* vdev id indicating to which the vdev custom aggregation size will be applied. */
@@ -4466,6 +4539,35 @@ typedef struct {
     A_UINT32 sw_retry_th;   /* max retry count per AC base on ac_type for the vdev mentioned in vdev id*/
 } wmi_vdev_set_custom_sw_retry_th_cmd_fixed_param;
 
+typedef struct {
+    /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_vdev_chainmask_config_cmd_fixed_param */
+    A_UINT32 tlv_header;
+    /* vdev id indicating to which the vdev, this chainmask configuration will be applied. */
+    A_UINT32 vdev_id;
+    /* number of chains to use for transmissions in 2.4 GHz band */
+    A_UINT32 num_tx_chains_2g;
+    /* number of chains to use for reception in 2.4 GHz band */
+    A_UINT32 num_rx_chains_2g;
+    /* nss to use for transmissions in 2.4 GHz band */
+    A_UINT32 tx_nss_2g;
+    /* nss to use for reception in 2.4 GHz band */
+    A_UINT32 rx_nss_2g;
+    /* number of chains to use for 11b transmissions. Valid only in 2.4 GHz */
+    A_UINT32 num_tx_chains_b;
+    /* number of chains to use for 11g transmissions. Valid only in 2.4 GHz */
+    A_UINT32 num_tx_chains_g;
+    /* number of chains to use for transmissions in 5 GHz band */
+    A_UINT32 num_tx_chains_5g;
+    /* number of chains to use for reception in 5 GHz band */
+    A_UINT32 num_rx_chains_5g;
+    /* nss to use for transmissions in 5 GHz band */
+    A_UINT32 tx_nss_5g;
+    /* nss to use for reception in 5 GHz band */
+    A_UINT32 rx_nss_5g;
+    /* number of chains to use for 11a transmissions. Valid only in 5 GHz */
+    A_UINT32 num_tx_chains_a;
+} wmi_vdev_chainmask_config_cmd_fixed_param;
+
 /*
  * Command to enable/disable Green AP Power Save.
  * This helps conserve power during AP operation. When the AP has no
@@ -5200,6 +5302,43 @@ typedef enum {
      * Value 0: Disable this feature
      */
     WMI_PDEV_PARAM_ENABLE_OPTIMIZED_PERIODIC_CFR_TIMER,
+
+    /*
+     * Configures a portion of the Estimated Service Params indication
+     * (802.11mc) settings, which together specify estimated throughput.
+     * The accompanying A_UINT32 parameter is the ESP BA WINDOW size advertised
+     * Value 0: Disable this feature
+     * Non zero Value: ESP BA WINDOW size
+     */
+    WMI_PDEV_PARAM_ESP_BA_WINDOW,
+
+    /*
+     * Configures a portion of the Estimated Service Params indication
+     * (802.11mc) settings, which together specify estimated throughput.
+     * The accompanying A_UINT32 parameter is the air time fraction to be
+     * advertised in the ESP IE
+     * Value 0: Disable this feature
+     * Non zero Value: Air time fraction in percentage
+     */
+    WMI_PDEV_PARAM_ESP_AIRTIME_FRACTION,
+
+    /*
+     * Configures a portion of the Estimated Service Params indication
+     * (802.11mc) settings, which together specify estimated throughput.
+     * The accompanying A_UINT32 parameter specifies PPDU duration in units
+     * of milliseconds.
+     * Value 0: Disable this feature
+     * Non zero Value: PPDU duration in milliseconds
+     */
+    WMI_PDEV_PARAM_ESP_PPDU_DURATION,
+
+    /*
+     * Enable/Disable NOL(Non Occupancy list) in firmware
+     *   1- Use NOL in firmware
+     *   0- Don't use NOL in firmware
+     */
+    WMI_PDEV_PARAM_USE_NOL,
+
 } WMI_PDEV_PARAM;
 
 typedef struct {
@@ -5423,6 +5562,13 @@ typedef struct {
      * A ppdu_id value of 0x0 is invalid, and should be ignored.
      */
     A_UINT32    ppdu_id;
+    /* ack_rssi
+     * TX mgmt ack RSSI report to host.
+     * Only valid when status == COMPLETE_OK and the ACK_RSSI report is enabled
+     * ACK RSSI is reported as SNR dB, i.e. how many dB the RSSI is above
+     * the noise floor.
+     */
+    A_UINT32    ack_rssi;
 } wmi_mgmt_tx_compl_event_fixed_param;
 
 typedef struct {
@@ -5447,6 +5593,8 @@ typedef struct {
      * A_UINT32 desc_ids[num_reports]; <- from tx_send_cmd
      * A_UINT32 status[num_reports];   <- WMI_MGMT_TX_COMP_STATUS_TYPE
      * A_UINT32 ppdu_id[num_reports];  <- list of PPDU IDs
+     * A_UINT32 ack_rssi[num_reports]; <- list of ack RSSI
+     *                                    RSSI units = dB w.r.t. noise floor
      */
 } wmi_mgmt_tx_compl_bundle_event_fixed_param;
 
@@ -5811,6 +5959,7 @@ typedef enum {
     WMI_REQUEST_PEER_EXTD_STAT      = 0x0400,
     WMI_REQUEST_BCN_STAT            = 0x0800,
     WMI_REQUEST_BCN_STAT_RESET      = 0x1000,
+    WMI_REQUEST_PEER_EXTD2_STAT     = 0x2000,
 } wmi_stats_id;
 
 /*
@@ -6428,6 +6577,8 @@ typedef struct {
     A_UINT32 num_bcn_stats;
     /** number of extended peer stats event structures (wmi_peer_extd_stats) */
     A_UINT32 num_peer_extd_stats;
+    /** number of extd2 peer stats event structures (wmi_peer_extd2_stats) */
+    A_UINT32 num_peer_extd2_stats;
 
 /* This TLV is followed by another TLV of array of bytes
  *   A_UINT8 data[];
@@ -7014,8 +7165,23 @@ typedef struct {
 
 /**
  *  PDEV statistics
- *  @todo
- *  add all PDEV stats here
+ *
+ *  This struct incorporates the wlan_dbg_stats struct, which is
+ *  conditionally defined, based on the AR900B flag.
+ *  The below _v1 struct variant is the unconditional definition
+ *  that matches what would be conditionally defined by builds that
+ *  don't use the AR900B flag.  The _v2 struct variant is the
+ *  unconditional definition that matches what would be conditionally
+ *  defined by builds that use the AR900B flag.
+ *  The _v2 struct def can be used within host or target builds
+ *  that don't use the AR900B flag, but needs to interoperate with a
+ *  target or host build that does use the AR900B flag.
+ *  Similarly, the _v1 struct def can be used by a host or target build
+ *  that does use the AR900B flag, but needs to interoperate with a
+ *  target or host build that doesn't use the AR900B flag.
+ *
+ *  For backwards compatibility, wmi_pdev_stats is still (conditionally)
+ *  defined, as an alias for either the _v1 or _v2 variant.
  */
 typedef struct {
     /** Channel noise floor */
@@ -7033,9 +7199,33 @@ typedef struct {
     /** Channel Tx Power */
     A_UINT32 chan_tx_pwr;
     /** WAL dbg stats */
-    struct wlan_dbg_stats pdev_stats;
+    struct wlan_dbg_stats_v1 pdev_stats;
+} wmi_pdev_stats_v1;
 
-} wmi_pdev_stats;
+typedef struct {
+    /** Channel noise floor */
+    A_INT32 chan_nf;
+    /** TX frame count */
+    A_UINT32 tx_frame_count;
+    /** RX frame count */
+    A_UINT32 rx_frame_count;
+    /** rx clear count */
+    A_UINT32 rx_clear_count;
+    /** cycle count */
+    A_UINT32 cycle_count;
+    /** Phy error count */
+    A_UINT32 phy_err_count;
+    /** Channel Tx Power */
+    A_UINT32 chan_tx_pwr;
+    /** WAL dbg stats */
+    struct wlan_dbg_stats_v2 pdev_stats;
+} wmi_pdev_stats_v2;
+
+#if defined(AR900B)
+#define wmi_pdev_stats wmi_pdev_stats_v2
+#else
+#define wmi_pdev_stats wmi_pdev_stats_v1
+#endif
 
 /**
  *  VDEV statistics
@@ -7114,6 +7304,26 @@ typedef struct {
 } wmi_peer_extd_stats;
 
 typedef struct {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_peer_extd2_stats */
+    /** peer MAC address */
+    wmi_mac_addr peer_macaddr;
+    /*
+     * The following rx_bytes field (lower/upper pair) counts only the
+     * MSDU bytes (after 802.11 decap, if applicable), and thus doesn't
+     * count the 802.11 header, unlike the wmi_peer_extd_stats.peer_rx_bytes
+     * and wmi_peer_stats_info.rx_bytes fields.
+     */
+    /** Lower 32 bits of the rx_bytes (size of MSDUs) excluding dot11 header from this peer */
+    A_UINT32 rx_bytes_l32;
+    /** Upper 32 bits of the rx_bytes (size of MSDUs) excluding dot11 header from this peer */
+    A_UINT32 rx_bytes_u32;
+    /** Number of MPDUS received with FCS error from this peer */
+    A_UINT32 rx_fcs_err;
+    /** Number of MPDUs(both data and non data) received from this peer */
+    A_UINT32 rx_mpdus;
+} wmi_peer_extd2_stats;
+
+typedef struct {
     /** Primary channel freq of the channel for which stats are sent */
     A_UINT32 chan_mhz;
     /** Time spent on the channel */
@@ -9075,6 +9285,7 @@ typedef struct {
 #define WMI_VDEV_START_RESPONSE_STATUS_SUCCESS 0x0  /** VDEV succesfully started */
 #define WMI_VDEV_START_RESPONSE_INVALID_VDEVID  0x1  /** requested VDEV not found */
 #define WMI_VDEV_START_RESPONSE_NOT_SUPPORTED  0x2  /** unsupported VDEV combination */
+#define WMI_VDEV_START_RESPONSE_DFS_VIOLATION  0x3  /** DFS_VIOLATION since channel in the NOL is selected */
 
 /** Beacon processing related command and event structures */
 typedef struct {
@@ -10153,6 +10364,11 @@ typedef struct {
  * This parameter controls the UL OFDMA and UL MU-MIMO peer fixed rate.
  */
 #define WMI_PEER_PARAM_UL_FIXED_RATE                    0x1b
+/** send specific OMI to peer via QoS-null frame
+ * param_value = follow 11ax spec definition
+ *               bit0:VHT(1), bit1:HE(1), bit2-31:A-Control
+ */
+#define WMI_PEER_RARAM_XMIT_OMI                         0x1c
 
 /** mimo ps values for the parameter WMI_PEER_MIMO_PS_STATE  */
 #define WMI_PEER_MIMO_PS_NONE                          0x0
@@ -10420,6 +10636,15 @@ typedef struct {
     /* 2nd DWORD of 11ax MAC Capabilities */
     A_UINT32 peer_he_cap_info_ext;
 
+    /*
+     * bit 0     : Indicated support for RX 1xLTF + 0.4us
+     * bit 1     : Indicates support for RX 2xLTF + 0.4us
+     * bit 2     : Indicates support for 2xLTF in 160/80+80 MHz HE PPDU
+     * bit[31:3] : Reserved
+     * Refer to WMI_HE_CAP_xx_LTF_xxx_SUPPORT_GET/SET macros
+     */
+    A_UINT32 peer_he_cap_info_internal;
+
 /* Following this struct are the TLV's:
  *     A_UINT8 peer_legacy_rates[];
  *     A_UINT8 peer_ht_rates[];
@@ -11481,6 +11706,10 @@ typedef struct {
     A_UINT32 rssi;
     /** roam notification */
     A_UINT32 notif;
+    /** roam notification param
+     *  Refer to WMI_ROAM_NOTIF_ defs to interpret the notif_params value.
+     */
+    A_UINT32 notif_params;
 } wmi_roam_event_fixed_param;
 
 
@@ -11552,6 +11781,7 @@ typedef enum
 #define WMI_ROAM_NOTIF_SCAN_MODE_FAIL    0x5 /** indicate that roaming scan mode is failed due to internal roaming state */
 #define WMI_ROAM_NOTIF_DISCONNECT        0x6 /** indicate that roaming not allowed due BTM req */
 #define WMI_ROAM_NOTIF_SUBNET_CHANGED    0x7 /** indicate that subnet has changed */
+#define WMI_ROAM_NOTIF_SCAN_START        0x8 /** indicate roam scan start, notif_params to be sent as WMI_ROAM_TRIGGER_REASON_ID */
 
 /**whenever RIC request information change, host driver should pass all ric related information to firmware (now only support tsepc)
 * Once, 11r roaming happens, firmware can generate RIC request in reassoc request based on these informations
@@ -20073,6 +20303,12 @@ typedef struct {
      * byte 40
      */
     A_UINT32 toeplitz_hash_ipv6_40;
+
+    /**
+     * @brief pdev_id - identifies the MAC
+     * See macros starting with WMI_PDEV_ID_ for values.
+     */
+    A_UINT32 pdev_id;
 } wmi_lro_info_cmd_fixed_param;
 
 typedef struct {
@@ -20898,6 +21134,11 @@ typedef enum wmi_coex_config_type {
                                                  arg4 medium - upper limit
                                                  arg5 high - lower limit
                                                  arg6 high - upper limit */
+    WMI_COEX_CONFIG_WLAN_OVER_ZBLOW        = 28, /* config to boost WiFi traffic over 15.4 Low prio traffic */
+    WMI_COEX_CONFIG_WLAN_MGMT_OVER_BT_A2DP = 29, /* config to raise WLAN priority higher than BT in coex scenario of SAP + BT or 15.4 */
+    WMI_COEX_CONFIG_WLAN_CONN_OVER_LE      = 30, /* config to elevate Wifi priority over BLE during WLAN association */
+    WMI_COEX_CONFIG_LE_OVER_WLAN_TRAFFIC   = 31, /* config to elevate BLE traffic over WiFi traffic */
+    WMI_COEX_CONFIG_THREE_WAY_COEX_RESET   = 32, /* config to reset the weights to default  */
 } WMI_COEX_CONFIG_TYPE;
 
 typedef struct {
@@ -21200,7 +21441,17 @@ typedef struct {
      * - 0 indicates support for VHT-MCS 0-7 for n spatial streams
      * - 1 indicates support for VHT-MCS 0-8 for n spatial streams
      * - 2 indicates support for VHT-MCS 0-9 for n spatial streams
-     * - 3 indicates that n spatial streams is not supported */
+     * - 3 indicates that n spatial streams is not supported
+     * - bit [15:0] Each NSS takes 2 bit.
+     * - bit [23:16] Indicates support for VHT-MCS 10 and 11 for
+     *   n spatial streams
+     *       - bit 16 - for NSS 1
+     *       - bit 17 - for NSS 2
+     *       - .
+     *       - .
+     *       - bit 23 - for NSS 8
+     *   Refer to the WMI_VHT_MAX_MCS_EXT_SS_GET/SET macros.
+     */
     A_UINT32 vht_supp_mcs_2G;
     /*HE capability info field of 802.11ax, WMI_HE_CAP defines */
     A_UINT32 he_cap_info_2G;
@@ -21228,11 +21479,21 @@ typedef struct {
     /* VHT capability info field of 802.11ac, WMI_VHT_CAP defines */
     A_UINT32 vht_cap_info_5G;
     /* VHT Supported MCS Set field Rx/Tx same
-    * The max VHT-MCS for n SS subfield (where n = 1,...,8) is encoded as follows
-    * - 0 indicates support for VHT-MCS 0-7 for n spatial streams
-    * - 1 indicates support for VHT-MCS 0-8 for n spatial streams
-    * - 2 indicates support for VHT-MCS 0-9 for n spatial streams
-    * - 3 indicates that n spatial streams is not supported */
+     * The max VHT-MCS for n SS subfield (where n = 1,...,8) is encoded as follows
+     * - 0 indicates support for VHT-MCS 0-7 for n spatial streams
+     * - 1 indicates support for VHT-MCS 0-8 for n spatial streams
+     * - 2 indicates support for VHT-MCS 0-9 for n spatial streams
+     * - 3 indicates that n spatial streams is not supported
+     * - bit [15:0] Each NSS takes 2 bit.
+     * - bit [23:16] Indicates support for VHT-MCS 10 and 11 for
+     *   n spatial streams
+     *       - bit 16 - for NSS 1
+     *       - bit 17 - for NSS 2
+     *       - .
+     *       - .
+     *       - bit 23 - for NSS 8
+     *   Refer to the WMI_VHT_MAX_MCS_EXT_SS_GET/SET macros.
+     */
     A_UINT32 vht_supp_mcs_5G;
     /*HE capability info field of 802.11ax, WMI_HE_CAP defines */
     A_UINT32 he_cap_info_5G;
@@ -21269,6 +21530,14 @@ typedef struct {
     /* 2nd DWORD of HE capability info field of 802.11ax, support Draft 3+ */
     A_UINT32 he_cap_info_2G_ext;
     A_UINT32 he_cap_info_5G_ext;
+    /*
+     * bit 0     : Indicated support for RX 1xLTF + 0.4us
+     * bit 1     : Indicates support for RX 2xLTF + 0.4us
+     * bit 2     : Indicates support for 2xLTF in 160/80+80 MHz HE PPDU
+     * bit[31:3] : Reserved
+     * Refer to WMI_HE_CAP_xx_LTF_xxx_SUPPORT_GET/SET macros
+     */
+    A_UINT32 he_cap_info_internal;
 } WMI_MAC_PHY_CAPABILITIES;
 
 typedef struct {
@@ -22198,6 +22467,11 @@ static INLINE A_UINT8 *wmi_id_to_name(A_UINT32 wmi_command)
         WMI_RETURN_STRING(WMI_SAR_LIMITS_CMDID);
         WMI_RETURN_STRING(WMI_SAR_GET_LIMITS_CMDID);
         WMI_RETURN_STRING(WMI_PEER_CHAN_WIDTH_SWITCH_CMDID);
+        WMI_RETURN_STRING(WMI_PDEV_OBSS_PD_SPATIAL_REUSE_SET_DEF_OBSS_THRESH_CMDID);
+        WMI_RETURN_STRING(WMI_PDEV_HE_TB_ACTION_FRM_CMDID);
+        WMI_RETURN_STRING(WMI_HPCS_PULSE_START_CMDID);
+        WMI_RETURN_STRING(WMI_VDEV_CHAINMASK_CONFIG_CMDID);
+        WMI_RETURN_STRING(WMI_VDEV_BCN_OFFLOAD_QUIET_CONFIG_CMDID);
     }
 
     return "Invalid WMI cmd";
@@ -23128,8 +23402,7 @@ typedef enum {
     AGC_GAIN_RSSI_CORR_BASED = 1,
 } WMI_SPECTRAL_SCALING_FORMULA_ID;
 
-typedef struct
-{
+typedef struct {
     A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_spectral_bin_scaling_params */
     A_UINT32 pdev_id;   /* ID of pdev to which the scaling parameters are to be applied */
     WMI_SPECTRAL_SCALING_FORMULA_ID formula_id; /* Represets the formula to be used */
@@ -23140,6 +23413,12 @@ typedef struct
 } wmi_spectral_bin_scaling_params;
 
 typedef struct {
+    A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_ctl_failsafe_event_params */
+    A_UINT32 pdev_id;   /* ID of pdev to which ctl failsafe status is sent */
+    A_UINT32 ctl_FailsafeStatus; /* To indicate if Failsafe value is imposed on CTL. 0- Success, 1- Failsafe imposed */
+} wmi_pdev_ctl_failsafe_check_fixed_param;
+
+typedef struct {
     A_UINT32 tlv_header;  /* TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_runtime_dpd_recal_cmd_fixed_param  */
     A_UINT32 enable;      /* Enable/disable */
 
@@ -23426,6 +23705,35 @@ typedef struct {
     A_UINT32 vdev_id;
 } wmi_obss_spatial_reuse_set_cmd_fixed_param;
 
+/*
+ * Below structure is related to WMI CMD that configures the default
+ * mimimum (OBSS_MIN) and maximum (OBSS_MAX) Other BSS levels (RSSI in dbm)
+ * for VDEV of a give type (STA or AP). These thresholds are configured
+ * within the Host and passed down to the FW. FW will use these
+ * default OBSS_MIN and OBSS_MAX values during roaming if the assoc response
+ * from the AP does not include spatial reuse parameter set Info Element.
+ */
+typedef struct {
+    /** TLV tag and len; tag equals
+    *   WMITLV_TAG_STRUC_wmi_obss_spatial_reuse_set_def_obss_thresh_cmd_fixed_param
+    */
+    A_UINT32 tlv_header;
+    /*
+     * In the below fields, "OBSS level" refers to the power of the
+     * signals received from "Other BSS".
+     * Spatial reuse will only be permitted if the Other BSS's signal power
+     * is witin the min to max range specified by the below fields.
+     */
+    /** Minimum OBSS level to use */
+    A_INT32 obss_min; /* RSSI in dBm */
+    /** Maximum OBSS level to use */
+    A_INT32 obss_max; /* RSSI in dBm */
+    /** Type of VDEV for which these threshold are applicable.
+     *  vdev_type should be one of WMI_VDEV_TYPE_STA or WMI_VDEV_TYPE_AP
+     */
+    A_UINT32 vdev_type;
+} wmi_obss_spatial_reuse_set_def_obss_thresh_cmd_fixed_param;
+
 typedef struct {
     A_UINT32 tlv_header; /* TLV tag and len; tag equals WMITLV_TAG_STRUCT_wmi_chan_width_peer_list */
     wmi_mac_addr peer_macaddr;
@@ -23441,6 +23749,35 @@ typedef struct {
      */
 } wmi_peer_chan_width_switch_cmd_fixed_param;
 
+typedef struct {
+    /** TLV tag and len; tag equals WMITLV_TAG_STRUC_wmi_pdev_he_tb_action_frm_cmd_fixed_param */
+    A_UINT32 tlv_header;
+    /* enable or disable HE TB Action frame */
+    A_UINT32 enable;
+    /* length of action frame body in bytes */
+    A_UINT32 data_len;
+/* This TLV is followed by another TLV of array of bytes
+ * A_UINT8 data[];
+ * This data array contains the action frame raw data
+ */
+} wmi_pdev_he_tb_action_frm_cmd_fixed_param;
+
+typedef struct {
+    /** TLV tag and len; tag equals
+     *  WMITLV_TAG_STRUC_wmi_hpcs_pulse_start_cmd_fixed_param */
+    A_UINT32 tlv_header;            /** TLV Header */
+    A_UINT32 vdev_id;               /** Vdev ID */
+    A_UINT32 start;                 /** Start/Stop */
+    A_UINT32 sync_time;             /** Lower 32-bit of the TSF at which the
+                                     * pulse should be synced. */
+    A_UINT32 pulse_interval;        /** Periodicity of pulses in micro seconds */
+    A_UINT32 active_sync_period;    /** Number of beacons to sync before generating
+                                     * pulse in units of beacon interval.
+                                     * Valid for clock slaves only. */
+    A_UINT32 gpio_pin;              /** GPIO Pin number to be used */
+    A_UINT32 pulse_width;           /** Duration of pulse in micro seconds */
+} wmi_hpcs_pulse_start_cmd_fixed_param;
+
 /* Default PE Duration subfield indicates the PE duration in units of 4 us */
 #define WMI_HEOPS_DEFPE_GET_D3(he_ops) WMI_GET_BITS(he_ops, 0, 3)
 #define WMI_HEOPS_DEFPE_SET_D3(he_ops, value) WMI_SET_BITS(he_ops, 0, 3, value)
diff --git a/fw/wmi_version.h b/fw/wmi_version.h
index b4d2f04fb35c..f39b6b8a29eb 100755
--- a/fw/wmi_version.h
+++ b/fw/wmi_version.h
@@ -36,7 +36,7 @@
 #define __WMI_VER_MINOR_    0
 /** WMI revision number has to be incremented when there is a
  *  change that may or may not break compatibility. */
-#define __WMI_REVISION_ 570
+#define __WMI_REVISION_ 586
 
 /** The Version Namespace should not be normally changed. Only
  *  host and firmware of the same WMI namespace will work