Initial patchset on top of the qwx(4) to adjust for ath12k. Still not

working yet, but it's better to continue polishing this in-tree.

3 files changed, 2223 insertions, 1933 deletions

diff --git a/sys/dev/ic/qwz.c b/sys/dev/ic/qwz.c
index 9d4f5fcb632..04f4ac5f673 100644
--- a/sys/dev/ic/qwz.c
+++ b/sys/dev/ic/qwz.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: qwz.c,v 1.1 2024/08/14 14:40:46 patrick Exp $	*/
+/*	$OpenBSD: qwz.c,v 1.2 2024/08/15 22:01:37 patrick Exp $	*/
 
 /*
  * Copyright 2023 Stefan Sperling <stsp@openbsd.org>
@@ -594,7 +594,7 @@ qwz_delete_key(struct ieee80211com *ic, struct ieee80211_node *ni,
 		/* Keys removed implicitly when firmware station is removed. */
 		return;
 	}
-	
+
 	/*
 	 * net80211 calls us with a NULL node when deleting group keys,
 	 * but firmware expects a MAC address in the command.
@@ -1008,110 +1008,7 @@ qwz_init_wmi_config_qca6390(struct qwz_softc *sc,
 }
 
 void
-qwz_hw_ipq8074_reo_setup(struct qwz_softc *sc)
-{
-	uint32_t reo_base = HAL_SEQ_WCSS_UMAC_REO_REG;
-	uint32_t val;
-	/* Each hash entry uses three bits to map to a particular ring. */
-	uint32_t ring_hash_map = HAL_HASH_ROUTING_RING_SW1 << 0 |
-	    HAL_HASH_ROUTING_RING_SW2 << 3 |
-	    HAL_HASH_ROUTING_RING_SW3 << 6 |
-	    HAL_HASH_ROUTING_RING_SW4 << 9 |
-	    HAL_HASH_ROUTING_RING_SW1 << 12 |
-	    HAL_HASH_ROUTING_RING_SW2 << 15 |
-	    HAL_HASH_ROUTING_RING_SW3 << 18 |
-	    HAL_HASH_ROUTING_RING_SW4 << 21;
-
-	val = sc->ops.read32(sc, reo_base + HAL_REO1_GEN_ENABLE);
-
-	val &= ~HAL_REO1_GEN_ENABLE_FRAG_DST_RING;
-	val |= FIELD_PREP(HAL_REO1_GEN_ENABLE_FRAG_DST_RING,
-	    HAL_SRNG_RING_ID_REO2SW1) |
-	    FIELD_PREP(HAL_REO1_GEN_ENABLE_AGING_LIST_ENABLE, 1) |
-	    FIELD_PREP(HAL_REO1_GEN_ENABLE_AGING_FLUSH_ENABLE, 1);
-	sc->ops.write32(sc, reo_base + HAL_REO1_GEN_ENABLE, val);
-
-	sc->ops.write32(sc, reo_base + HAL_REO1_AGING_THRESH_IX_0(sc),
-	    HAL_DEFAULT_REO_TIMEOUT_USEC);
-	sc->ops.write32(sc, reo_base + HAL_REO1_AGING_THRESH_IX_1(sc),
-	    HAL_DEFAULT_REO_TIMEOUT_USEC);
-	sc->ops.write32(sc, reo_base + HAL_REO1_AGING_THRESH_IX_2(sc),
-	    HAL_DEFAULT_REO_TIMEOUT_USEC);
-	sc->ops.write32(sc, reo_base + HAL_REO1_AGING_THRESH_IX_3(sc),
-	    HAL_DEFAULT_REO_TIMEOUT_USEC);
-
-	sc->ops.write32(sc, reo_base + HAL_REO1_DEST_RING_CTRL_IX_0,
-	    FIELD_PREP(HAL_REO_DEST_RING_CTRL_HASH_RING_MAP, ring_hash_map));
-	sc->ops.write32(sc, reo_base + HAL_REO1_DEST_RING_CTRL_IX_1,
-	    FIELD_PREP(HAL_REO_DEST_RING_CTRL_HASH_RING_MAP, ring_hash_map));
-	sc->ops.write32(sc, reo_base + HAL_REO1_DEST_RING_CTRL_IX_2,
-	    FIELD_PREP(HAL_REO_DEST_RING_CTRL_HASH_RING_MAP, ring_hash_map));
-	sc->ops.write32(sc, reo_base + HAL_REO1_DEST_RING_CTRL_IX_3,
-	    FIELD_PREP(HAL_REO_DEST_RING_CTRL_HASH_RING_MAP, ring_hash_map));
-}
-
-void
-qwz_init_wmi_config_ipq8074(struct qwz_softc *sc,
-    struct target_resource_config *config)
-{
-	config->num_vdevs = sc->num_radios * TARGET_NUM_VDEVS(sc);
-
-	if (sc->num_radios == 2) {
-		config->num_peers = TARGET_NUM_PEERS(sc, DBS);
-		config->num_tids = TARGET_NUM_TIDS(sc, DBS);
-	} else if (sc->num_radios == 3) {
-		config->num_peers = TARGET_NUM_PEERS(sc, DBS_SBS);
-		config->num_tids = TARGET_NUM_TIDS(sc, DBS_SBS);
-	} else {
-		/* Control should not reach here */
-		config->num_peers = TARGET_NUM_PEERS(sc, SINGLE);
-		config->num_tids = TARGET_NUM_TIDS(sc, SINGLE);
-	}
-	config->num_offload_peers = TARGET_NUM_OFFLD_PEERS;
-	config->num_offload_reorder_buffs = TARGET_NUM_OFFLD_REORDER_BUFFS;
-	config->num_peer_keys = TARGET_NUM_PEER_KEYS;
-	config->ast_skid_limit = TARGET_AST_SKID_LIMIT;
-	config->tx_chain_mask = (1 << sc->target_caps.num_rf_chains) - 1;
-	config->rx_chain_mask = (1 << sc->target_caps.num_rf_chains) - 1;
-	config->rx_timeout_pri[0] = TARGET_RX_TIMEOUT_LO_PRI;
-	config->rx_timeout_pri[1] = TARGET_RX_TIMEOUT_LO_PRI;
-	config->rx_timeout_pri[2] = TARGET_RX_TIMEOUT_LO_PRI;
-	config->rx_timeout_pri[3] = TARGET_RX_TIMEOUT_HI_PRI;
-
-	if (test_bit(ATH12K_FLAG_RAW_MODE, sc->sc_flags))
-		config->rx_decap_mode = TARGET_DECAP_MODE_RAW;
-	else
-		config->rx_decap_mode = TARGET_DECAP_MODE_NATIVE_WIFI;
-
-	config->scan_max_pending_req = TARGET_SCAN_MAX_PENDING_REQS;
-	config->bmiss_offload_max_vdev = TARGET_BMISS_OFFLOAD_MAX_VDEV;
-	config->roam_offload_max_vdev = TARGET_ROAM_OFFLOAD_MAX_VDEV;
-	config->roam_offload_max_ap_profiles = TARGET_ROAM_OFFLOAD_MAX_AP_PROFILES;
-	config->num_mcast_groups = TARGET_NUM_MCAST_GROUPS;
-	config->num_mcast_table_elems = TARGET_NUM_MCAST_TABLE_ELEMS;
-	config->mcast2ucast_mode = TARGET_MCAST2UCAST_MODE;
-	config->tx_dbg_log_size = TARGET_TX_DBG_LOG_SIZE;
-	config->num_wds_entries = TARGET_NUM_WDS_ENTRIES;
-	config->dma_burst_size = TARGET_DMA_BURST_SIZE;
-	config->rx_skip_defrag_timeout_dup_detection_check =
-		TARGET_RX_SKIP_DEFRAG_TIMEOUT_DUP_DETECTION_CHECK;
-	config->vow_config = TARGET_VOW_CONFIG;
-	config->gtk_offload_max_vdev = TARGET_GTK_OFFLOAD_MAX_VDEV;
-	config->num_msdu_desc = TARGET_NUM_MSDU_DESC;
-	config->beacon_tx_offload_max_vdev = sc->num_radios * TARGET_MAX_BCN_OFFLD;
-	config->rx_batchmode = TARGET_RX_BATCHMODE;
-	config->peer_map_unmap_v2_support = 1;
-	config->twt_ap_pdev_count = sc->num_radios;
-	config->twt_ap_sta_count = 1000;
-	config->flag1 |= WMI_RSRC_CFG_FLAG1_BSS_CHANNEL_INFO_64;
-	config->flag1 |= WMI_RSRC_CFG_FLAG1_ACK_RSSI;
-	config->ema_max_vap_cnt = sc->num_radios;
-	config->ema_max_profile_period = TARGET_EMA_MAX_PROFILE_PERIOD;
-	config->beacon_tx_offload_max_vdev += config->ema_max_vap_cnt;
-}
-
-void
-qwz_hw_wcn6855_reo_setup(struct qwz_softc *sc)
+qwz_hw_wcn7850_reo_setup(struct qwz_softc *sc)
 {
 	uint32_t reo_base = HAL_SEQ_WCSS_UMAC_REO_REG;
 	uint32_t val;
@@ -1132,8 +1029,11 @@ qwz_hw_wcn6855_reo_setup(struct qwz_softc *sc)
 
 	val = sc->ops.read32(sc, reo_base + HAL_REO1_MISC_CTL(sc));
 	val &= ~HAL_REO1_MISC_CTL_FRAGMENT_DST_RING;
+	val &= ~HAL_REO1_MISC_CTL_BAR_DST_RING;
 	val |= FIELD_PREP(HAL_REO1_MISC_CTL_FRAGMENT_DST_RING,
-	    HAL_SRNG_RING_ID_REO2SW1);
+	    HAL_SRNG_RING_ID_REO2SW0);
+	val |= FIELD_PREP(HAL_REO1_MISC_CTL_BAR_DST_RING,
+	    HAL_SRNG_RING_ID_REO2SW0);
 	sc->ops.write32(sc, reo_base + HAL_REO1_MISC_CTL(sc), val);
 
 	sc->ops.write32(sc, reo_base + HAL_REO1_AGING_THRESH_IX_0(sc),
@@ -1143,7 +1043,7 @@ qwz_hw_wcn6855_reo_setup(struct qwz_softc *sc)
 	sc->ops.write32(sc, reo_base + HAL_REO1_AGING_THRESH_IX_2(sc),
 	    HAL_DEFAULT_REO_TIMEOUT_USEC);
 	sc->ops.write32(sc, reo_base + HAL_REO1_AGING_THRESH_IX_3(sc),
-	    HAL_DEFAULT_REO_TIMEOUT_USEC);
+	    ATH12K_HAL_DEFAULT_BE_BK_VI_REO_TIMEOUT_USEC);
 
 	sc->ops.write32(sc, reo_base + HAL_REO1_DEST_RING_CTRL_IX_2,
 	    ring_hash_map);
@@ -1151,50 +1051,6 @@ qwz_hw_wcn6855_reo_setup(struct qwz_softc *sc)
 	    ring_hash_map);
 }
 
-void
-qwz_hw_ipq5018_reo_setup(struct qwz_softc *sc)
-{
-	uint32_t reo_base = HAL_SEQ_WCSS_UMAC_REO_REG;
-	uint32_t val;
-
-	/* Each hash entry uses three bits to map to a particular ring. */
-	uint32_t ring_hash_map = HAL_HASH_ROUTING_RING_SW1 << 0 |
-	    HAL_HASH_ROUTING_RING_SW2 << 4 |
-	    HAL_HASH_ROUTING_RING_SW3 << 8 |
-	    HAL_HASH_ROUTING_RING_SW4 << 12 |
-	    HAL_HASH_ROUTING_RING_SW1 << 16 |
-	    HAL_HASH_ROUTING_RING_SW2 << 20 |
-	    HAL_HASH_ROUTING_RING_SW3 << 24 |
-	    HAL_HASH_ROUTING_RING_SW4 << 28;
-
-	val = sc->ops.read32(sc, reo_base + HAL_REO1_GEN_ENABLE);
-
-	val &= ~HAL_REO1_GEN_ENABLE_FRAG_DST_RING;
-	val |= FIELD_PREP(HAL_REO1_GEN_ENABLE_FRAG_DST_RING,
-	    HAL_SRNG_RING_ID_REO2SW1) |
-	    FIELD_PREP(HAL_REO1_GEN_ENABLE_AGING_LIST_ENABLE, 1) |
-	    FIELD_PREP(HAL_REO1_GEN_ENABLE_AGING_FLUSH_ENABLE, 1);
-	sc->ops.write32(sc, reo_base + HAL_REO1_GEN_ENABLE, val);
-
-	sc->ops.write32(sc, reo_base + HAL_REO1_AGING_THRESH_IX_0(sc),
-	    HAL_DEFAULT_REO_TIMEOUT_USEC);
-	sc->ops.write32(sc, reo_base + HAL_REO1_AGING_THRESH_IX_1(sc),
-	    HAL_DEFAULT_REO_TIMEOUT_USEC);
-	sc->ops.write32(sc, reo_base + HAL_REO1_AGING_THRESH_IX_2(sc),
-	    HAL_DEFAULT_REO_TIMEOUT_USEC);
-	sc->ops.write32(sc, reo_base + HAL_REO1_AGING_THRESH_IX_3(sc),
-	    HAL_DEFAULT_REO_TIMEOUT_USEC);
-
-	sc->ops.write32(sc, reo_base + HAL_REO1_DEST_RING_CTRL_IX_0,
-	    ring_hash_map);
-	sc->ops.write32(sc, reo_base + HAL_REO1_DEST_RING_CTRL_IX_1,
-	    ring_hash_map);
-	sc->ops.write32(sc, reo_base + HAL_REO1_DEST_RING_CTRL_IX_2,
-	    ring_hash_map);
-	sc->ops.write32(sc, reo_base + HAL_REO1_DEST_RING_CTRL_IX_3,
-	    ring_hash_map);
-}
-
 int
 qwz_hw_mac_id_to_pdev_id_ipq8074(struct ath12k_hw_params *hw, int mac_id)
 {
@@ -1857,328 +1713,11 @@ qwz_hw_get_mac_from_pdev_id(struct qwz_softc *sc, int pdev_idx)
 	return 0;
 }
 
-const struct ath12k_hw_ops ipq8074_ops = {
-	.get_hw_mac_from_pdev_id = qwz_hw_ipq8074_mac_from_pdev_id,
-	.wmi_init_config = qwz_init_wmi_config_ipq8074,
-	.mac_id_to_pdev_id = qwz_hw_mac_id_to_pdev_id_ipq8074,
-	.mac_id_to_srng_id = qwz_hw_mac_id_to_srng_id_ipq8074,
-#if notyet
-	.tx_mesh_enable = ath12k_hw_ipq8074_tx_mesh_enable,
-#endif
-	.rx_desc_get_first_msdu = qwz_hw_ipq8074_rx_desc_get_first_msdu,
-#if notyet
-	.rx_desc_get_last_msdu = ath12k_hw_ipq8074_rx_desc_get_last_msdu,
-#endif
-	.rx_desc_get_l3_pad_bytes = qwz_hw_ipq8074_rx_desc_get_l3_pad_bytes,
-	.rx_desc_get_hdr_status = qwz_hw_ipq8074_rx_desc_get_hdr_status,
-	.rx_desc_encrypt_valid = qwz_hw_ipq8074_rx_desc_encrypt_valid,
-	.rx_desc_get_encrypt_type = qwz_hw_ipq8074_rx_desc_get_encrypt_type,
-	.rx_desc_get_decap_type = qwz_hw_ipq8074_rx_desc_get_decap_type,
-#ifdef notyet
-	.rx_desc_get_mesh_ctl = ath12k_hw_ipq8074_rx_desc_get_mesh_ctl,
-	.rx_desc_get_ldpc_support = ath12k_hw_ipq8074_rx_desc_get_ldpc_support,
-	.rx_desc_get_mpdu_seq_ctl_vld = ath12k_hw_ipq8074_rx_desc_get_mpdu_seq_ctl_vld,
-	.rx_desc_get_mpdu_fc_valid = ath12k_hw_ipq8074_rx_desc_get_mpdu_fc_valid,
-	.rx_desc_get_mpdu_start_seq_no = ath12k_hw_ipq8074_rx_desc_get_mpdu_start_seq_no,
-#endif
-	.rx_desc_get_msdu_len = qwz_hw_ipq8074_rx_desc_get_msdu_len,
-#ifdef notyet
-	.rx_desc_get_msdu_sgi = ath12k_hw_ipq8074_rx_desc_get_msdu_sgi,
-	.rx_desc_get_msdu_rate_mcs = ath12k_hw_ipq8074_rx_desc_get_msdu_rate_mcs,
-	.rx_desc_get_msdu_rx_bw = ath12k_hw_ipq8074_rx_desc_get_msdu_rx_bw,
-#endif
-	.rx_desc_get_msdu_freq = qwz_hw_ipq8074_rx_desc_get_msdu_freq,
-#ifdef notyet
-	.rx_desc_get_msdu_pkt_type = ath12k_hw_ipq8074_rx_desc_get_msdu_pkt_type,
-	.rx_desc_get_msdu_nss = ath12k_hw_ipq8074_rx_desc_get_msdu_nss,
-	.rx_desc_get_mpdu_tid = ath12k_hw_ipq8074_rx_desc_get_mpdu_tid,
-	.rx_desc_get_mpdu_peer_id = ath12k_hw_ipq8074_rx_desc_get_mpdu_peer_id,
-	.rx_desc_copy_attn_end_tlv = ath12k_hw_ipq8074_rx_desc_copy_attn_end,
-	.rx_desc_get_mpdu_start_tag = ath12k_hw_ipq8074_rx_desc_get_mpdu_start_tag,
-	.rx_desc_get_mpdu_ppdu_id = ath12k_hw_ipq8074_rx_desc_get_mpdu_ppdu_id,
-	.rx_desc_set_msdu_len = ath12k_hw_ipq8074_rx_desc_set_msdu_len,
-#endif
-	.rx_desc_get_attention = qwz_hw_ipq8074_rx_desc_get_attention,
-#ifdef notyet
-	.rx_desc_get_msdu_payload = ath12k_hw_ipq8074_rx_desc_get_msdu_payload,
-#endif
-	.reo_setup = qwz_hw_ipq8074_reo_setup,
-#ifdef notyet
-	.mpdu_info_get_peerid = ath12k_hw_ipq8074_mpdu_info_get_peerid,
-	.rx_desc_mac_addr2_valid = ath12k_hw_ipq8074_rx_desc_mac_addr2_valid,
-	.rx_desc_mpdu_start_addr2 = ath12k_hw_ipq8074_rx_desc_mpdu_start_addr2,
-	.get_ring_selector = ath12k_hw_ipq8074_get_tcl_ring_selector,
-#endif
-};
-
-const struct ath12k_hw_ops ipq6018_ops = {
+const struct ath12k_hw_ops wcn7850_ops = {
 	.get_hw_mac_from_pdev_id = qwz_hw_ipq6018_mac_from_pdev_id,
-	.wmi_init_config = qwz_init_wmi_config_ipq8074,
-	.mac_id_to_pdev_id = qwz_hw_mac_id_to_pdev_id_ipq8074,
-	.mac_id_to_srng_id = qwz_hw_mac_id_to_srng_id_ipq8074,
-#if notyet
-	.tx_mesh_enable = ath12k_hw_ipq8074_tx_mesh_enable,
-#endif
-	.rx_desc_get_first_msdu = qwz_hw_ipq8074_rx_desc_get_first_msdu,
-#if notyet
-	.rx_desc_get_last_msdu = ath12k_hw_ipq8074_rx_desc_get_last_msdu,
-#endif
-	.rx_desc_get_l3_pad_bytes = qwz_hw_ipq8074_rx_desc_get_l3_pad_bytes,
-	.rx_desc_get_hdr_status = qwz_hw_ipq8074_rx_desc_get_hdr_status,
-	.rx_desc_encrypt_valid = qwz_hw_ipq8074_rx_desc_encrypt_valid,
-	.rx_desc_get_encrypt_type = qwz_hw_ipq8074_rx_desc_get_encrypt_type,
-	.rx_desc_get_decap_type = qwz_hw_ipq8074_rx_desc_get_decap_type,
-#ifdef notyet
-	.rx_desc_get_mesh_ctl = ath12k_hw_ipq8074_rx_desc_get_mesh_ctl,
-	.rx_desc_get_ldpc_support = ath12k_hw_ipq8074_rx_desc_get_ldpc_support,
-	.rx_desc_get_mpdu_seq_ctl_vld = ath12k_hw_ipq8074_rx_desc_get_mpdu_seq_ctl_vld,
-	.rx_desc_get_mpdu_fc_valid = ath12k_hw_ipq8074_rx_desc_get_mpdu_fc_valid,
-	.rx_desc_get_mpdu_start_seq_no = ath12k_hw_ipq8074_rx_desc_get_mpdu_start_seq_no,
-#endif
-	.rx_desc_get_msdu_len = qwz_hw_ipq8074_rx_desc_get_msdu_len,
-#ifdef notyet
-	.rx_desc_get_msdu_sgi = ath12k_hw_ipq8074_rx_desc_get_msdu_sgi,
-	.rx_desc_get_msdu_rate_mcs = ath12k_hw_ipq8074_rx_desc_get_msdu_rate_mcs,
-	.rx_desc_get_msdu_rx_bw = ath12k_hw_ipq8074_rx_desc_get_msdu_rx_bw,
-#endif
-	.rx_desc_get_msdu_freq = qwz_hw_ipq8074_rx_desc_get_msdu_freq,
-#ifdef notyet
-	.rx_desc_get_msdu_pkt_type = ath12k_hw_ipq8074_rx_desc_get_msdu_pkt_type,
-	.rx_desc_get_msdu_nss = ath12k_hw_ipq8074_rx_desc_get_msdu_nss,
-	.rx_desc_get_mpdu_tid = ath12k_hw_ipq8074_rx_desc_get_mpdu_tid,
-	.rx_desc_get_mpdu_peer_id = ath12k_hw_ipq8074_rx_desc_get_mpdu_peer_id,
-	.rx_desc_copy_attn_end_tlv = ath12k_hw_ipq8074_rx_desc_copy_attn_end,
-	.rx_desc_get_mpdu_start_tag = ath12k_hw_ipq8074_rx_desc_get_mpdu_start_tag,
-	.rx_desc_get_mpdu_ppdu_id = ath12k_hw_ipq8074_rx_desc_get_mpdu_ppdu_id,
-	.rx_desc_set_msdu_len = ath12k_hw_ipq8074_rx_desc_set_msdu_len,
-#endif
-	.rx_desc_get_attention = qwz_hw_ipq8074_rx_desc_get_attention,
-#ifdef notyet
-	.rx_desc_get_msdu_payload = ath12k_hw_ipq8074_rx_desc_get_msdu_payload,
-#endif
-	.reo_setup = qwz_hw_ipq8074_reo_setup,
-#ifdef notyet
-	.mpdu_info_get_peerid = ath12k_hw_ipq8074_mpdu_info_get_peerid,
-	.rx_desc_mac_addr2_valid = ath12k_hw_ipq8074_rx_desc_mac_addr2_valid,
-	.rx_desc_mpdu_start_addr2 = ath12k_hw_ipq8074_rx_desc_mpdu_start_addr2,
-	.get_ring_selector = ath12k_hw_ipq8074_get_tcl_ring_selector,
-#endif
-};
-
-const struct ath12k_hw_ops qca6390_ops = {
-	.get_hw_mac_from_pdev_id = qwz_hw_ipq8074_mac_from_pdev_id,
-	.wmi_init_config = qwz_init_wmi_config_qca6390,
 	.mac_id_to_pdev_id = qwz_hw_mac_id_to_pdev_id_qca6390,
 	.mac_id_to_srng_id = qwz_hw_mac_id_to_srng_id_qca6390,
-#if notyet
-	.tx_mesh_enable = ath12k_hw_ipq8074_tx_mesh_enable,
-#endif
-	.rx_desc_get_first_msdu = qwz_hw_ipq8074_rx_desc_get_first_msdu,
-#if notyet
-	.rx_desc_get_last_msdu = ath12k_hw_ipq8074_rx_desc_get_last_msdu,
-#endif
-	.rx_desc_get_l3_pad_bytes = qwz_hw_ipq8074_rx_desc_get_l3_pad_bytes,
-	.rx_desc_get_hdr_status = qwz_hw_ipq8074_rx_desc_get_hdr_status,
-	.rx_desc_encrypt_valid = qwz_hw_ipq8074_rx_desc_encrypt_valid,
-	.rx_desc_get_encrypt_type = qwz_hw_ipq8074_rx_desc_get_encrypt_type,
-	.rx_desc_get_decap_type = qwz_hw_ipq8074_rx_desc_get_decap_type,
-#ifdef notyet
-	.rx_desc_get_mesh_ctl = ath12k_hw_ipq8074_rx_desc_get_mesh_ctl,
-	.rx_desc_get_ldpc_support = ath12k_hw_ipq8074_rx_desc_get_ldpc_support,
-	.rx_desc_get_mpdu_seq_ctl_vld = ath12k_hw_ipq8074_rx_desc_get_mpdu_seq_ctl_vld,
-	.rx_desc_get_mpdu_fc_valid = ath12k_hw_ipq8074_rx_desc_get_mpdu_fc_valid,
-	.rx_desc_get_mpdu_start_seq_no = ath12k_hw_ipq8074_rx_desc_get_mpdu_start_seq_no,
-#endif
-	.rx_desc_get_msdu_len = qwz_hw_ipq8074_rx_desc_get_msdu_len,
-#ifdef notyet
-	.rx_desc_get_msdu_sgi = ath12k_hw_ipq8074_rx_desc_get_msdu_sgi,
-	.rx_desc_get_msdu_rate_mcs = ath12k_hw_ipq8074_rx_desc_get_msdu_rate_mcs,
-	.rx_desc_get_msdu_rx_bw = ath12k_hw_ipq8074_rx_desc_get_msdu_rx_bw,
-#endif
-	.rx_desc_get_msdu_freq = qwz_hw_ipq8074_rx_desc_get_msdu_freq,
-#ifdef notyet
-	.rx_desc_get_msdu_pkt_type = ath12k_hw_ipq8074_rx_desc_get_msdu_pkt_type,
-	.rx_desc_get_msdu_nss = ath12k_hw_ipq8074_rx_desc_get_msdu_nss,
-	.rx_desc_get_mpdu_tid = ath12k_hw_ipq8074_rx_desc_get_mpdu_tid,
-	.rx_desc_get_mpdu_peer_id = ath12k_hw_ipq8074_rx_desc_get_mpdu_peer_id,
-	.rx_desc_copy_attn_end_tlv = ath12k_hw_ipq8074_rx_desc_copy_attn_end,
-	.rx_desc_get_mpdu_start_tag = ath12k_hw_ipq8074_rx_desc_get_mpdu_start_tag,
-	.rx_desc_get_mpdu_ppdu_id = ath12k_hw_ipq8074_rx_desc_get_mpdu_ppdu_id,
-	.rx_desc_set_msdu_len = ath12k_hw_ipq8074_rx_desc_set_msdu_len,
-#endif
-	.rx_desc_get_attention = qwz_hw_ipq8074_rx_desc_get_attention,
-#ifdef notyet
-	.rx_desc_get_msdu_payload = ath12k_hw_ipq8074_rx_desc_get_msdu_payload,
-#endif
-	.reo_setup = qwz_hw_ipq8074_reo_setup,
-#ifdef notyet
-	.mpdu_info_get_peerid = ath12k_hw_ipq8074_mpdu_info_get_peerid,
-	.rx_desc_mac_addr2_valid = ath12k_hw_ipq8074_rx_desc_mac_addr2_valid,
-	.rx_desc_mpdu_start_addr2 = ath12k_hw_ipq8074_rx_desc_mpdu_start_addr2,
-	.get_ring_selector = ath12k_hw_ipq8074_get_tcl_ring_selector,
-#endif
-};
-
-const struct ath12k_hw_ops qcn9074_ops = {
-	.get_hw_mac_from_pdev_id = qwz_hw_ipq6018_mac_from_pdev_id,
-	.wmi_init_config = qwz_init_wmi_config_ipq8074,
-	.mac_id_to_pdev_id = qwz_hw_mac_id_to_pdev_id_ipq8074,
-	.mac_id_to_srng_id = qwz_hw_mac_id_to_srng_id_ipq8074,
-#if notyet
-	.tx_mesh_enable = ath12k_hw_qcn9074_tx_mesh_enable,
-#endif
-	.rx_desc_get_first_msdu = qwz_hw_qcn9074_rx_desc_get_first_msdu,
-#if notyet
-	.rx_desc_get_last_msdu = ath12k_hw_qcn9074_rx_desc_get_last_msdu,
-#endif
-	.rx_desc_get_l3_pad_bytes = qwz_hw_qcn9074_rx_desc_get_l3_pad_bytes,
-	.rx_desc_get_hdr_status = qwz_hw_qcn9074_rx_desc_get_hdr_status,
-	.rx_desc_encrypt_valid = qwz_hw_qcn9074_rx_desc_encrypt_valid,
-	.rx_desc_get_encrypt_type = qwz_hw_qcn9074_rx_desc_get_encrypt_type,
-	.rx_desc_get_decap_type = qwz_hw_qcn9074_rx_desc_get_decap_type,
-#ifdef notyet
-	.rx_desc_get_mesh_ctl = ath12k_hw_qcn9074_rx_desc_get_mesh_ctl,
-	.rx_desc_get_ldpc_support = ath12k_hw_qcn9074_rx_desc_get_ldpc_support,
-	.rx_desc_get_mpdu_seq_ctl_vld = ath12k_hw_qcn9074_rx_desc_get_mpdu_seq_ctl_vld,
-	.rx_desc_get_mpdu_fc_valid = ath12k_hw_qcn9074_rx_desc_get_mpdu_fc_valid,
-	.rx_desc_get_mpdu_start_seq_no = ath12k_hw_qcn9074_rx_desc_get_mpdu_start_seq_no,
-#endif
-	.rx_desc_get_msdu_len = qwz_hw_qcn9074_rx_desc_get_msdu_len,
-#ifdef notyet
-	.rx_desc_get_msdu_sgi = ath12k_hw_qcn9074_rx_desc_get_msdu_sgi,
-	.rx_desc_get_msdu_rate_mcs = ath12k_hw_qcn9074_rx_desc_get_msdu_rate_mcs,
-	.rx_desc_get_msdu_rx_bw = ath12k_hw_qcn9074_rx_desc_get_msdu_rx_bw,
-#endif
-	.rx_desc_get_msdu_freq = qwz_hw_qcn9074_rx_desc_get_msdu_freq,
-#ifdef notyet
-	.rx_desc_get_msdu_pkt_type = ath12k_hw_qcn9074_rx_desc_get_msdu_pkt_type,
-	.rx_desc_get_msdu_nss = ath12k_hw_qcn9074_rx_desc_get_msdu_nss,
-	.rx_desc_get_mpdu_tid = ath12k_hw_qcn9074_rx_desc_get_mpdu_tid,
-	.rx_desc_get_mpdu_peer_id = ath12k_hw_qcn9074_rx_desc_get_mpdu_peer_id,
-	.rx_desc_copy_attn_end_tlv = ath12k_hw_qcn9074_rx_desc_copy_attn_end,
-	.rx_desc_get_mpdu_start_tag = ath12k_hw_qcn9074_rx_desc_get_mpdu_start_tag,
-	.rx_desc_get_mpdu_ppdu_id = ath12k_hw_qcn9074_rx_desc_get_mpdu_ppdu_id,
-	.rx_desc_set_msdu_len = ath12k_hw_qcn9074_rx_desc_set_msdu_len,
-#endif
-	.rx_desc_get_attention = qwz_hw_qcn9074_rx_desc_get_attention,
-#ifdef notyet
-	.rx_desc_get_msdu_payload = ath12k_hw_qcn9074_rx_desc_get_msdu_payload,
-#endif
-	.reo_setup = qwz_hw_ipq8074_reo_setup,
-#ifdef notyet
-	.mpdu_info_get_peerid = ath12k_hw_ipq8074_mpdu_info_get_peerid,
-	.rx_desc_mac_addr2_valid = ath12k_hw_ipq9074_rx_desc_mac_addr2_valid,
-	.rx_desc_mpdu_start_addr2 = ath12k_hw_ipq9074_rx_desc_mpdu_start_addr2,
-	.get_ring_selector = ath12k_hw_ipq8074_get_tcl_ring_selector,
-#endif
-};
-
-const struct ath12k_hw_ops wcn6855_ops = {
-	.get_hw_mac_from_pdev_id = qwz_hw_ipq8074_mac_from_pdev_id,
-	.wmi_init_config = qwz_init_wmi_config_qca6390,
-	.mac_id_to_pdev_id = qwz_hw_mac_id_to_pdev_id_qca6390,
-	.mac_id_to_srng_id = qwz_hw_mac_id_to_srng_id_qca6390,
-#if notyet
-	.tx_mesh_enable = ath12k_hw_wcn6855_tx_mesh_enable,
-#endif
-	.rx_desc_get_first_msdu = qwz_hw_wcn6855_rx_desc_get_first_msdu,
-#if notyet
-	.rx_desc_get_last_msdu = ath12k_hw_wcn6855_rx_desc_get_last_msdu,
-#endif
-	.rx_desc_get_l3_pad_bytes = qwz_hw_wcn6855_rx_desc_get_l3_pad_bytes,
-	.rx_desc_get_hdr_status = qwz_hw_wcn6855_rx_desc_get_hdr_status,
-	.rx_desc_encrypt_valid = qwz_hw_wcn6855_rx_desc_encrypt_valid,
-	.rx_desc_get_encrypt_type = qwz_hw_wcn6855_rx_desc_get_encrypt_type,
-	.rx_desc_get_decap_type = qwz_hw_wcn6855_rx_desc_get_decap_type,
-#ifdef notyet
-	.rx_desc_get_mesh_ctl = ath12k_hw_wcn6855_rx_desc_get_mesh_ctl,
-	.rx_desc_get_ldpc_support = ath12k_hw_wcn6855_rx_desc_get_ldpc_support,
-	.rx_desc_get_mpdu_seq_ctl_vld = ath12k_hw_wcn6855_rx_desc_get_mpdu_seq_ctl_vld,
-	.rx_desc_get_mpdu_fc_valid = ath12k_hw_wcn6855_rx_desc_get_mpdu_fc_valid,
-	.rx_desc_get_mpdu_start_seq_no = ath12k_hw_wcn6855_rx_desc_get_mpdu_start_seq_no,
-#endif
-	.rx_desc_get_msdu_len = qwz_hw_wcn6855_rx_desc_get_msdu_len,
-#ifdef notyet
-	.rx_desc_get_msdu_sgi = ath12k_hw_wcn6855_rx_desc_get_msdu_sgi,
-	.rx_desc_get_msdu_rate_mcs = ath12k_hw_wcn6855_rx_desc_get_msdu_rate_mcs,
-	.rx_desc_get_msdu_rx_bw = ath12k_hw_wcn6855_rx_desc_get_msdu_rx_bw,
-#endif
-	.rx_desc_get_msdu_freq = qwz_hw_wcn6855_rx_desc_get_msdu_freq,
-#ifdef notyet
-	.rx_desc_get_msdu_pkt_type = ath12k_hw_wcn6855_rx_desc_get_msdu_pkt_type,
-	.rx_desc_get_msdu_nss = ath12k_hw_wcn6855_rx_desc_get_msdu_nss,
-	.rx_desc_get_mpdu_tid = ath12k_hw_wcn6855_rx_desc_get_mpdu_tid,
-	.rx_desc_get_mpdu_peer_id = ath12k_hw_wcn6855_rx_desc_get_mpdu_peer_id,
-	.rx_desc_copy_attn_end_tlv = ath12k_hw_wcn6855_rx_desc_copy_attn_end,
-	.rx_desc_get_mpdu_start_tag = ath12k_hw_wcn6855_rx_desc_get_mpdu_start_tag,
-	.rx_desc_get_mpdu_ppdu_id = ath12k_hw_wcn6855_rx_desc_get_mpdu_ppdu_id,
-	.rx_desc_set_msdu_len = ath12k_hw_wcn6855_rx_desc_set_msdu_len,
-#endif
-	.rx_desc_get_attention = qwz_hw_wcn6855_rx_desc_get_attention,
-#ifdef notyet
-	.rx_desc_get_msdu_payload = ath12k_hw_wcn6855_rx_desc_get_msdu_payload,
-#endif
-	.reo_setup = qwz_hw_wcn6855_reo_setup,
-#ifdef notyet
-	.mpdu_info_get_peerid = ath12k_hw_wcn6855_mpdu_info_get_peerid,
-	.rx_desc_mac_addr2_valid = ath12k_hw_wcn6855_rx_desc_mac_addr2_valid,
-	.rx_desc_mpdu_start_addr2 = ath12k_hw_wcn6855_rx_desc_mpdu_start_addr2,
-	.get_ring_selector = ath12k_hw_ipq8074_get_tcl_ring_selector,
-#endif
-};
-
-const struct ath12k_hw_ops wcn6750_ops = {
-	.get_hw_mac_from_pdev_id = qwz_hw_ipq8074_mac_from_pdev_id,
-	.wmi_init_config = qwz_init_wmi_config_qca6390,
-	.mac_id_to_pdev_id = qwz_hw_mac_id_to_pdev_id_qca6390,
-	.mac_id_to_srng_id = qwz_hw_mac_id_to_srng_id_qca6390,
-#if notyet
-	.tx_mesh_enable = ath12k_hw_qcn9074_tx_mesh_enable,
-#endif
-	.rx_desc_get_first_msdu = qwz_hw_qcn9074_rx_desc_get_first_msdu,
-#if notyet
-	.rx_desc_get_last_msdu = ath12k_hw_qcn9074_rx_desc_get_last_msdu,
-#endif
-	.rx_desc_get_l3_pad_bytes = qwz_hw_qcn9074_rx_desc_get_l3_pad_bytes,
-	.rx_desc_get_hdr_status = qwz_hw_qcn9074_rx_desc_get_hdr_status,
-	.rx_desc_encrypt_valid = qwz_hw_qcn9074_rx_desc_encrypt_valid,
-	.rx_desc_get_encrypt_type = qwz_hw_qcn9074_rx_desc_get_encrypt_type,
-	.rx_desc_get_decap_type = qwz_hw_qcn9074_rx_desc_get_decap_type,
-#ifdef notyet
-	.rx_desc_get_mesh_ctl = ath12k_hw_qcn9074_rx_desc_get_mesh_ctl,
-	.rx_desc_get_ldpc_support = ath12k_hw_qcn9074_rx_desc_get_ldpc_support,
-	.rx_desc_get_mpdu_seq_ctl_vld = ath12k_hw_qcn9074_rx_desc_get_mpdu_seq_ctl_vld,
-	.rx_desc_get_mpdu_fc_valid = ath12k_hw_qcn9074_rx_desc_get_mpdu_fc_valid,
-	.rx_desc_get_mpdu_start_seq_no = ath12k_hw_qcn9074_rx_desc_get_mpdu_start_seq_no,
-#endif
-	.rx_desc_get_msdu_len = qwz_hw_qcn9074_rx_desc_get_msdu_len,
-#ifdef notyet
-	.rx_desc_get_msdu_sgi = ath12k_hw_qcn9074_rx_desc_get_msdu_sgi,
-	.rx_desc_get_msdu_rate_mcs = ath12k_hw_qcn9074_rx_desc_get_msdu_rate_mcs,
-	.rx_desc_get_msdu_rx_bw = ath12k_hw_qcn9074_rx_desc_get_msdu_rx_bw,
-#endif
-	.rx_desc_get_msdu_freq = qwz_hw_qcn9074_rx_desc_get_msdu_freq,
-#ifdef notyet
-	.rx_desc_get_msdu_pkt_type = ath12k_hw_qcn9074_rx_desc_get_msdu_pkt_type,
-	.rx_desc_get_msdu_nss = ath12k_hw_qcn9074_rx_desc_get_msdu_nss,
-	.rx_desc_get_mpdu_tid = ath12k_hw_qcn9074_rx_desc_get_mpdu_tid,
-	.rx_desc_get_mpdu_peer_id = ath12k_hw_qcn9074_rx_desc_get_mpdu_peer_id,
-	.rx_desc_copy_attn_end_tlv = ath12k_hw_qcn9074_rx_desc_copy_attn_end,
-	.rx_desc_get_mpdu_start_tag = ath12k_hw_qcn9074_rx_desc_get_mpdu_start_tag,
-	.rx_desc_get_mpdu_ppdu_id = ath12k_hw_qcn9074_rx_desc_get_mpdu_ppdu_id,
-	.rx_desc_set_msdu_len = ath12k_hw_qcn9074_rx_desc_set_msdu_len,
-#endif
-	.rx_desc_get_attention = qwz_hw_qcn9074_rx_desc_get_attention,
-#ifdef notyet
-	.rx_desc_get_msdu_payload = ath12k_hw_qcn9074_rx_desc_get_msdu_payload,
-#endif
-	.reo_setup = qwz_hw_wcn6855_reo_setup,
-#ifdef notyet
-	.mpdu_info_get_peerid = ath12k_hw_ipq8074_mpdu_info_get_peerid,
-	.rx_desc_mac_addr2_valid = ath12k_hw_ipq9074_rx_desc_mac_addr2_valid,
-	.rx_desc_mpdu_start_addr2 = ath12k_hw_ipq9074_rx_desc_mpdu_start_addr2,
-	.get_ring_selector = ath12k_hw_wcn6750_get_tcl_ring_selector,
-#endif
+	.reo_setup = qwz_hw_wcn7850_reo_setup,
 };
 
 #define ATH12K_TX_RING_MASK_0 BIT(0)
@@ -2248,6 +1787,8 @@ const struct ath12k_hw_ring_mask ath12k_hw_ring_mask_ipq8074 = {
 		ATH12K_HOST2RXDMA_RING_MASK_1,
 		ATH12K_HOST2RXDMA_RING_MASK_2,
 	},
+	.tx_mon_dest = {
+	},
 };
 
 const struct ath12k_hw_ring_mask ath12k_hw_ring_mask_qca6390 = {
@@ -2283,6 +1824,8 @@ const struct ath12k_hw_ring_mask ath12k_hw_ring_mask_qca6390 = {
 	},
 	.host2rxdma = {
 	},
+	.tx_mon_dest = {
+	},
 };
 
 const struct ath12k_hw_ring_mask ath12k_hw_ring_mask_qcn9074 = {
@@ -2324,6 +1867,8 @@ const struct ath12k_hw_ring_mask ath12k_hw_ring_mask_qcn9074 = {
 		0, 0, 0,
 		ATH12K_HOST2RXDMA_RING_MASK_0,
 	},
+	.tx_mon_dest = {
+	},
 };
 
 const struct ath12k_hw_ring_mask ath12k_hw_ring_mask_wcn6750 = {
@@ -2361,6 +1906,40 @@ const struct ath12k_hw_ring_mask ath12k_hw_ring_mask_wcn6750 = {
 	},
 	.host2rxdma = {
 	},
+	.tx_mon_dest = {
+	},
+};
+
+const struct ath12k_hw_ring_mask ath12k_hw_ring_mask_wcn7850 = {
+	.tx  = {
+		ATH12K_TX_RING_MASK_0,
+		ATH12K_TX_RING_MASK_2,
+		ATH12K_TX_RING_MASK_4,
+	},
+	.rx_mon_status = {
+	},
+	.rx = {
+		0, 0, 0,
+		ATH12K_RX_RING_MASK_0,
+		ATH12K_RX_RING_MASK_1,
+		ATH12K_RX_RING_MASK_2,
+		ATH12K_RX_RING_MASK_3,
+	},
+	.rx_err = {
+		ATH12K_RX_ERR_RING_MASK_0,
+	},
+	.rx_wbm_rel = {
+		ATH12K_RX_WBM_REL_RING_MASK_0,
+	},
+	.reo_status = {
+		ATH12K_REO_STATUS_RING_MASK_0,
+	},
+	.rxdma2host = {
+	},
+	.host2rxdma = {
+	},
+	.tx_mon_dest = {
+	},
 };
 
 /* Target firmware's Copy Engine configuration. */
@@ -3078,7 +2657,6 @@ const struct ce_attr qwz_host_ce_config_ipq8074[QWZ_CE_COUNT_IPQ8074] = {
 		.src_nentries = 16,
 		.src_sz_max = 2048,
 		.dest_nentries = 0,
-		.send_cb = qwz_htc_tx_completion_handler,
 	},
 
 	/* CE1: target->host HTT + HTC control */
@@ -3105,7 +2683,6 @@ const struct ce_attr qwz_host_ce_config_ipq8074[QWZ_CE_COUNT_IPQ8074] = {
 		.src_nentries = 32,
 		.src_sz_max = 2048,
 		.dest_nentries = 0,
-		.send_cb = qwz_htc_tx_completion_handler,
 	},
 
 	/* CE4: host->target HTT */
@@ -3139,7 +2716,6 @@ const struct ce_attr qwz_host_ce_config_ipq8074[QWZ_CE_COUNT_IPQ8074] = {
 		.src_nentries = 32,
 		.src_sz_max = 2048,
 		.dest_nentries = 0,
-		.send_cb = qwz_htc_tx_completion_handler,
 	},
 
 	/* CE8: target autonomous hif_memcpy */
@@ -3156,7 +2732,6 @@ const struct ce_attr qwz_host_ce_config_ipq8074[QWZ_CE_COUNT_IPQ8074] = {
 		.src_nentries = 32,
 		.src_sz_max = 2048,
 		.dest_nentries = 0,
-		.send_cb = qwz_htc_tx_completion_handler,
 	},
 
 	/* CE10: target->host HTT */
@@ -3212,7 +2787,6 @@ const struct ce_attr qwz_host_ce_config_qca6390[QWZ_CE_COUNT_QCA6390] = {
 		.src_nentries = 32,
 		.src_sz_max = 2048,
 		.dest_nentries = 0,
-		.send_cb = qwz_htc_tx_completion_handler,
 	},
 
 	/* CE4: host->target HTT */
@@ -3246,7 +2820,6 @@ const struct ce_attr qwz_host_ce_config_qca6390[QWZ_CE_COUNT_QCA6390] = {
 		.src_nentries = 32,
 		.src_sz_max = 2048,
 		.dest_nentries = 0,
-		.send_cb = qwz_htc_tx_completion_handler,
 	},
 
 	/* CE8: target autonomous hif_memcpy */
@@ -3294,7 +2867,6 @@ const struct ce_attr qwz_host_ce_config_qcn9074[QWZ_CE_COUNT_QCN9074] = {
 		.src_nentries = 32,
 		.src_sz_max = 2048,
 		.dest_nentries = 0,
-		.send_cb = qwz_htc_tx_completion_handler,
 	},
 
 	/* CE4: host->target HTT */
@@ -3315,25 +2887,83 @@ const struct ce_attr qwz_host_ce_config_qcn9074[QWZ_CE_COUNT_QCN9074] = {
 	},
 };
 
-static const struct ath12k_hw_tcl2wbm_rbm_map ath12k_hw_tcl2wbm_rbm_map_ipq8074[] = {
+const struct ce_attr qwz_host_ce_config_wcn7850[QWZ_CE_COUNT_QCA6390] = {
+	/* CE0: host->target HTC control and raw streams */
 	{
-		.tcl_ring_num = 0,
-		.wbm_ring_num = 0,
-		.rbm_id = HAL_RX_BUF_RBM_SW0_BM,
+		.flags = CE_ATTR_FLAGS,
+		.src_nentries = 16,
+		.src_sz_max = 2048,
+		.dest_nentries = 0,
 	},
+
+	/* CE1: target->host HTT + HTC control */
 	{
-		.tcl_ring_num = 1,
-		.wbm_ring_num = 1,
-		.rbm_id = HAL_RX_BUF_RBM_SW1_BM,
+		.flags = CE_ATTR_FLAGS,
+		.src_nentries = 0,
+		.src_sz_max = 2048,
+		.dest_nentries = 512,
+		.recv_cb = qwz_htc_rx_completion_handler,
 	},
+
+	/* CE2: target->host WMI */
 	{
-		.tcl_ring_num = 2,
-		.wbm_ring_num = 2,
-		.rbm_id = HAL_RX_BUF_RBM_SW2_BM,
+		.flags = CE_ATTR_FLAGS,
+		.src_nentries = 0,
+		.src_sz_max = 2048,
+		.dest_nentries = 64,
+		.recv_cb = qwz_htc_rx_completion_handler,
+	},
+
+	/* CE3: host->target WMI (mac0) */
+	{
+		.flags = CE_ATTR_FLAGS,
+		.src_nentries = 32,
+		.src_sz_max = 2048,
+		.dest_nentries = 0,
+	},
+
+	/* CE4: host->target HTT */
+	{
+		.flags = CE_ATTR_FLAGS | CE_ATTR_DIS_INTR,
+		.src_nentries = 2048,
+		.src_sz_max = 256,
+		.dest_nentries = 0,
+	},
+
+	/* CE5: target->host pktlog */
+	{
+		.flags = CE_ATTR_FLAGS,
+		.src_nentries = 0,
+		.src_sz_max = 0,
+		.dest_nentries = 0,
+	},
+
+	/* CE6: target autonomous hif_memcpy */
+	{
+		.flags = CE_ATTR_FLAGS | CE_ATTR_DIS_INTR,
+		.src_nentries = 0,
+		.src_sz_max = 0,
+		.dest_nentries = 0,
+	},
+
+	/* CE7: host->target WMI (mac1) */
+	{
+		.flags = CE_ATTR_FLAGS | CE_ATTR_DIS_INTR,
+		.src_nentries = 0,
+		.src_sz_max = 2048,
+		.dest_nentries = 0,
+	},
+
+	/* CE8: target autonomous hif_memcpy */
+	{
+		.flags = CE_ATTR_FLAGS | CE_ATTR_DIS_INTR,
+		.src_nentries = 0,
+		.src_sz_max = 0,
+		.dest_nentries = 0,
 	},
 };
 
-static const struct ath12k_hw_tcl2wbm_rbm_map ath12k_hw_tcl2wbm_rbm_map_wcn6750[] = {
+static const struct ath12k_hw_tcl2wbm_rbm_map ath12k_hw_tcl2wbm_rbm_map_wcn7850[] = {
 	{
 		.tcl_ring_num = 0,
 		.wbm_ring_num = 0,
@@ -3341,1098 +2971,170 @@ static const struct ath12k_hw_tcl2wbm_rbm_map ath12k_hw_tcl2wbm_rbm_map_wcn6750[
 	},
 	{
 		.tcl_ring_num = 1,
-		.wbm_ring_num = 4,
-		.rbm_id = HAL_RX_BUF_RBM_SW4_BM,
+		.wbm_ring_num = 2,
+		.rbm_id = HAL_RX_BUF_RBM_SW2_BM,
 	},
 	{
 		.tcl_ring_num = 2,
-		.wbm_ring_num = 2,
-		.rbm_id = HAL_RX_BUF_RBM_SW2_BM,
+		.wbm_ring_num = 4,
+		.rbm_id = HAL_RX_BUF_RBM_SW4_BM,
 	},
 };
 
-
-static const struct ath12k_hw_hal_params ath12k_hw_hal_params_ipq8074 = {
-	.rx_buf_rbm = HAL_RX_BUF_RBM_SW3_BM,
-	.tcl2wbm_rbm_map = ath12k_hw_tcl2wbm_rbm_map_ipq8074,
-};
-
-static const struct ath12k_hw_hal_params ath12k_hw_hal_params_qca6390 = {
-	.rx_buf_rbm = HAL_RX_BUF_RBM_SW1_BM,
-	.tcl2wbm_rbm_map = ath12k_hw_tcl2wbm_rbm_map_ipq8074,
-};
-
-static const struct ath12k_hw_hal_params ath12k_hw_hal_params_wcn6750 = {
+static const struct ath12k_hw_hal_params ath12k_hw_hal_params_wcn7850 = {
 	.rx_buf_rbm = HAL_RX_BUF_RBM_SW1_BM,
-	.tcl2wbm_rbm_map = ath12k_hw_tcl2wbm_rbm_map_wcn6750,
+	.tcl2wbm_rbm_map = ath12k_hw_tcl2wbm_rbm_map_wcn7850,
+	.wbm2sw_cc_enable = HAL_WBM_SW_COOKIE_CONV_CFG_WBM2SW0_EN |
+			    HAL_WBM_SW_COOKIE_CONV_CFG_WBM2SW2_EN |
+			    HAL_WBM_SW_COOKIE_CONV_CFG_WBM2SW3_EN |
+                            HAL_WBM_SW_COOKIE_CONV_CFG_WBM2SW4_EN,
 };
 
 static const struct ath12k_hw_params ath12k_hw_params[] = {
 	{
-		.hw_rev = ATH12K_HW_IPQ8074,
-		.name = "ipq8074 hw2.0",
+		.name = "wcn7850 hw2.0",
+		.hw_rev = ATH12K_HW_WCN7850_HW20,
 		.fw = {
-			.dir = "ipq8074-hw2.0",
+			.dir = "wcn7850-hw2.0",
 			.board_size = 256 * 1024,
-			.cal_offset = 128 * 1024,
+			.cal_offset = 256 * 1024,
 		},
-		.max_radios = 3,
-		.bdf_addr = 0x4B0C0000,
-		.hw_ops = &ipq8074_ops,
-		.ring_mask = &ath12k_hw_ring_mask_ipq8074,
-		.internal_sleep_clock = false,
-		.regs = &ipq8074_regs,
-		.qmi_service_ins_id = ATH12K_QMI_WLFW_SERVICE_INS_ID_V01_IPQ8074,
-		.host_ce_config = qwz_host_ce_config_ipq8074,
-		.ce_count = QWZ_CE_COUNT_IPQ8074,
-		.target_ce_config = ath12k_target_ce_config_wlan_ipq8074,
-		.target_ce_count = 11,
-		.svc_to_ce_map = ath12k_target_service_to_ce_map_wlan_ipq8074,
-		.svc_to_ce_map_len = 21,
-		.single_pdev_only = false,
-		.rxdma1_enable = true,
-		.num_rxmda_per_pdev = 1,
-		.rx_mac_buf_ring = false,
-		.vdev_start_delay = false,
-		.htt_peer_map_v2 = true,
-#if notyet
-		.spectral = {
-			.fft_sz = 2,
-			/* HW bug, expected BIN size is 2 bytes but HW report as 4 bytes.
-			 * so added pad size as 2 bytes to compensate the BIN size
-			 */
-			.fft_pad_sz = 2,
-			.summary_pad_sz = 0,
-			.fft_hdr_len = 16,
-			.max_fft_bins = 512,
-			.fragment_160mhz = true,
-		},
-
-		.interface_modes = BIT(NL80211_IFTYPE_STATION) |
-					BIT(NL80211_IFTYPE_AP) |
-					BIT(NL80211_IFTYPE_MESH_POINT),
-		.supports_monitor = true,
-		.full_monitor_mode = false,
-#endif
-		.supports_shadow_regs = false,
-		.idle_ps = false,
-		.supports_sta_ps = false,
-		.cold_boot_calib = true,
-		.cbcal_restart_fw = true,
-		.fw_mem_mode = 0,
-		.num_vdevs = 16 + 1,
-		.num_peers = 512,
-		.supports_suspend = false,
-		.hal_desc_sz = sizeof(struct hal_rx_desc_ipq8074),
-		.supports_regdb = false,
-		.fix_l1ss = true,
-		.credit_flow = false,
-		.max_tx_ring = DP_TCL_NUM_RING_MAX,
-		.hal_params = &ath12k_hw_hal_params_ipq8074,
-#if notyet
-		.supports_dynamic_smps_6ghz = false,
-		.alloc_cacheable_memory = true,
-		.supports_rssi_stats = false,
-#endif
-		.fw_wmi_diag_event = false,
-		.current_cc_support = false,
-		.dbr_debug_support = true,
-		.global_reset = false,
-#ifdef notyet
-		.bios_sar_capa = NULL,
-#endif
-		.m3_fw_support = false,
-		.fixed_bdf_addr = true,
-		.fixed_mem_region = true,
-		.static_window_map = false,
-#if notyet
-		.hybrid_bus_type = false,
-		.fixed_fw_mem = false,
-		.support_off_channel_tx = false,
-		.supports_multi_bssid = false,
-
-		.sram_dump = {},
-
-		.tcl_ring_retry = true,
-#endif
-		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
-#ifdef notyet
-		.smp2p_wow_exit = false,
-#endif
-	},
-	{
-		.hw_rev = ATH12K_HW_IPQ6018_HW10,
-		.name = "ipq6018 hw1.0",
-		.fw = {
-			.dir = "ipq6018-hw1.0",
-			.board_size = 256 * 1024,
-			.cal_offset = 128 * 1024,
-		},
-		.max_radios = 2,
-		.bdf_addr = 0x4ABC0000,
-		.hw_ops = &ipq6018_ops,
-		.ring_mask = &ath12k_hw_ring_mask_ipq8074,
-		.internal_sleep_clock = false,
-		.regs = &ipq8074_regs,
-		.qmi_service_ins_id = ATH12K_QMI_WLFW_SERVICE_INS_ID_V01_IPQ8074,
-		.host_ce_config = qwz_host_ce_config_ipq8074,
-		.ce_count = QWZ_CE_COUNT_IPQ8074,
-		.target_ce_config = ath12k_target_ce_config_wlan_ipq8074,
-		.target_ce_count = 11,
-		.svc_to_ce_map = ath12k_target_service_to_ce_map_wlan_ipq6018,
-		.svc_to_ce_map_len = 19,
-		.single_pdev_only = false,
-		.rxdma1_enable = true,
-		.num_rxmda_per_pdev = 1,
-		.rx_mac_buf_ring = false,
-		.vdev_start_delay = false,
-		.htt_peer_map_v2 = true,
-#if notyet
-		.spectral = {
-			.fft_sz = 4,
-			.fft_pad_sz = 0,
-			.summary_pad_sz = 0,
-			.fft_hdr_len = 16,
-			.max_fft_bins = 512,
-			.fragment_160mhz = true,
-		},
-
-		.interface_modes = BIT(NL80211_IFTYPE_STATION) |
-					BIT(NL80211_IFTYPE_AP) |
-					BIT(NL80211_IFTYPE_MESH_POINT),
-		.supports_monitor = true,
-		.full_monitor_mode = false,
-#endif
-		.supports_shadow_regs = false,
-		.idle_ps = false,
-		.supports_sta_ps = false,
-		.cold_boot_calib = true,
-		.cbcal_restart_fw = true,
-		.fw_mem_mode = 0,
-		.num_vdevs = 16 + 1,
-		.num_peers = 512,
-		.supports_suspend = false,
-		.hal_desc_sz = sizeof(struct hal_rx_desc_ipq8074),
-		.supports_regdb = false,
-		.fix_l1ss = true,
-		.credit_flow = false,
-		.max_tx_ring = DP_TCL_NUM_RING_MAX,
-		.hal_params = &ath12k_hw_hal_params_ipq8074,
-#if notyet
-		.supports_dynamic_smps_6ghz = false,
-		.alloc_cacheable_memory = true,
-		.supports_rssi_stats = false,
-#endif
-		.fw_wmi_diag_event = false,
-		.current_cc_support = false,
-		.dbr_debug_support = true,
-		.global_reset = false,
-#ifdef notyet
-		.bios_sar_capa = NULL,
-#endif
-		.m3_fw_support = false,
-		.fixed_bdf_addr = true,
-		.fixed_mem_region = true,
-		.static_window_map = false,
-		.hybrid_bus_type = false,
-		.fixed_fw_mem = false,
-#if notyet
-		.support_off_channel_tx = false,
-		.supports_multi_bssid = false,
-
-		.sram_dump = {},
-
-		.tcl_ring_retry = true,
-#endif
-		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
-#ifdef notyet
-		.smp2p_wow_exit = false,
-#endif
-	},
-	{
-		.name = "qca6390 hw2.0",
-		.hw_rev = ATH12K_HW_QCA6390_HW20,
-		.fw = {
-			.dir = "qca6390-hw2.0",
-			.board_size = 256 * 1024,
-			.cal_offset = 128 * 1024,
-		},
-		.max_radios = 3,
-		.bdf_addr = 0x4B0C0000,
-		.hw_ops = &qca6390_ops,
-		.ring_mask = &ath12k_hw_ring_mask_qca6390,
+		.max_radios = 1,
 		.internal_sleep_clock = true,
-		.regs = &qca6390_regs,
+		.hw_ops = &wcn7850_ops,
+		.ring_mask = &ath12k_hw_ring_mask_wcn7850,
+		.regs = &wcn7850_regs,
 		.qmi_service_ins_id = ATH12K_QMI_WLFW_SERVICE_INS_ID_V01_QCA6390,
-		.host_ce_config = qwz_host_ce_config_qca6390,
+		.host_ce_config = qwz_host_ce_config_wcn7850,
 		.ce_count = QWZ_CE_COUNT_QCA6390,
 		.target_ce_config = ath12k_target_ce_config_wlan_qca6390,
 		.target_ce_count = 9,
 		.svc_to_ce_map = ath12k_target_service_to_ce_map_wlan_qca6390,
 		.svc_to_ce_map_len = 14,
-		.single_pdev_only = true,
 		.rxdma1_enable = false,
 		.num_rxmda_per_pdev = 2,
-		.rx_mac_buf_ring = true,
-		.vdev_start_delay = true,
-		.htt_peer_map_v2 = false,
-#if notyet
-		.spectral = {
-			.fft_sz = 0,
-			.fft_pad_sz = 0,
-			.summary_pad_sz = 0,
-			.fft_hdr_len = 0,
-			.max_fft_bins = 0,
-			.fragment_160mhz = false,
-		},
-
-		.interface_modes = BIT(NL80211_IFTYPE_STATION) |
-					BIT(NL80211_IFTYPE_AP),
-		.supports_monitor = false,
-		.full_monitor_mode = false,
-#endif
-		.supports_shadow_regs = true,
-		.idle_ps = true,
-		.supports_sta_ps = true,
-		.cold_boot_calib = false,
-		.cbcal_restart_fw = false,
-		.fw_mem_mode = 0,
-		.num_vdevs = 16 + 1,
-		.num_peers = 512,
-		.supports_suspend = true,
-		.hal_desc_sz = sizeof(struct hal_rx_desc_ipq8074),
-		.supports_regdb = false,
-		.fix_l1ss = true,
+		.num_rxdma_dst_ring = 1,
 		.credit_flow = true,
-		.max_tx_ring = DP_TCL_NUM_RING_MAX_QCA6390,
-		.hal_params = &ath12k_hw_hal_params_qca6390,
-#if notyet
-		.supports_dynamic_smps_6ghz = false,
-		.alloc_cacheable_memory = false,
-		.supports_rssi_stats = true,
-#endif
-		.fw_wmi_diag_event = true,
-		.current_cc_support = true,
-		.dbr_debug_support = false,
-		.global_reset = true,
-#ifdef notyet
-		.bios_sar_capa = NULL,
-#endif
-		.m3_fw_support = true,
-		.fixed_bdf_addr = false,
-		.fixed_mem_region = false,
-		.static_window_map = false,
-		.hybrid_bus_type = false,
-		.fixed_fw_mem = false,
-#if notyet
-		.support_off_channel_tx = true,
-		.supports_multi_bssid = true,
-
-		.sram_dump = {
-			.start = 0x01400000,
-			.end = 0x0171ffff,
-		},
-
-		.tcl_ring_retry = true,
-#endif
-		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
-#ifdef notyet
-		.smp2p_wow_exit = false,
-#endif
-	},
-	{
-		.name = "qcn9074 hw1.0",
-		.hw_rev = ATH12K_HW_QCN9074_HW10,
-		.fw = {
-			.dir = "qcn9074-hw1.0",
-			.board_size = 256 * 1024,
-			.cal_offset = 128 * 1024,
-		},
-		.max_radios = 1,
-#if notyet
-		.single_pdev_only = false,
-		.qmi_service_ins_id = ATH12K_QMI_WLFW_SERVICE_INS_ID_V01_QCN9074,
-#endif
-		.hw_ops = &qcn9074_ops,
-		.ring_mask = &ath12k_hw_ring_mask_qcn9074,
-		.internal_sleep_clock = false,
-		.regs = &qcn9074_regs,
-		.host_ce_config = qwz_host_ce_config_qcn9074,
-		.ce_count = QWZ_CE_COUNT_QCN9074,
-		.target_ce_config = ath12k_target_ce_config_wlan_qcn9074,
-		.target_ce_count = 9,
-		.svc_to_ce_map = ath12k_target_service_to_ce_map_wlan_qcn9074,
-		.svc_to_ce_map_len = 18,
-		.rxdma1_enable = true,
-		.num_rxmda_per_pdev = 1,
-		.rx_mac_buf_ring = false,
-		.vdev_start_delay = false,
-		.htt_peer_map_v2 = true,
-#if notyet
-		.spectral = {
-			.fft_sz = 2,
-			.fft_pad_sz = 0,
-			.summary_pad_sz = 16,
-			.fft_hdr_len = 24,
-			.max_fft_bins = 1024,
-			.fragment_160mhz = false,
-		},
-
-		.interface_modes = BIT(NL80211_IFTYPE_STATION) |
-					BIT(NL80211_IFTYPE_AP) |
-					BIT(NL80211_IFTYPE_MESH_POINT),
-		.supports_monitor = true,
-		.full_monitor_mode = true,
-#endif
-		.supports_shadow_regs = false,
-		.idle_ps = false,
-		.supports_sta_ps = false,
-		.cold_boot_calib = false,
-		.cbcal_restart_fw = false,
-		.fw_mem_mode = 2,
-		.num_vdevs = 8,
-		.num_peers = 128,
-		.supports_suspend = false,
-		.hal_desc_sz = sizeof(struct hal_rx_desc_qcn9074),
-		.supports_regdb = false,
-		.fix_l1ss = true,
-		.credit_flow = false,
 		.max_tx_ring = DP_TCL_NUM_RING_MAX,
-		.hal_params = &ath12k_hw_hal_params_ipq8074,
-#if notyet
-		.supports_dynamic_smps_6ghz = true,
-		.alloc_cacheable_memory = true,
-		.supports_rssi_stats = false,
-#endif
-		.fw_wmi_diag_event = false,
-		.current_cc_support = false,
-		.dbr_debug_support = true,
-		.global_reset = false,
-#ifdef notyet
-		.bios_sar_capa = NULL,
-#endif
-		.m3_fw_support = true,
-		.fixed_bdf_addr = false,
-		.fixed_mem_region = false,
-		.static_window_map = true,
-		.hybrid_bus_type = false,
-		.fixed_fw_mem = false,
-#if notyet
-		.support_off_channel_tx = false,
-		.supports_multi_bssid = false,
-
-		.sram_dump = {},
-
-		.tcl_ring_retry = true,
-#endif
-		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
-#ifdef notyet
-		.smp2p_wow_exit = false,
-#endif
-	},
-	{
-		.name = "wcn6855 hw2.0",
-		.hw_rev = ATH12K_HW_WCN6855_HW20,
-		.fw = {
-			.dir = "wcn6855-hw2.0",
-			.board_size = 256 * 1024,
-			.cal_offset = 128 * 1024,
-		},
-		.max_radios = 3,
-		.bdf_addr = 0x4B0C0000,
-		.hw_ops = &wcn6855_ops,
-		.ring_mask = &ath12k_hw_ring_mask_qca6390,
-		.internal_sleep_clock = true,
-		.regs = &wcn6855_regs,
-		.qmi_service_ins_id = ATH12K_QMI_WLFW_SERVICE_INS_ID_V01_QCA6390,
-		.host_ce_config = qwz_host_ce_config_qca6390,
-		.ce_count = QWZ_CE_COUNT_QCA6390,
-		.target_ce_config = ath12k_target_ce_config_wlan_qca6390,
-		.target_ce_count = 9,
-		.svc_to_ce_map = ath12k_target_service_to_ce_map_wlan_qca6390,
-		.svc_to_ce_map_len = 14,
-		.single_pdev_only = true,
-		.rxdma1_enable = false,
-		.num_rxmda_per_pdev = 2,
-		.rx_mac_buf_ring = true,
-		.vdev_start_delay = true,
-		.htt_peer_map_v2 = false,
-#if notyet
-		.spectral = {
-			.fft_sz = 0,
-			.fft_pad_sz = 0,
-			.summary_pad_sz = 0,
-			.fft_hdr_len = 0,
-			.max_fft_bins = 0,
-			.fragment_160mhz = false,
-		},
-
-		.interface_modes = BIT(NL80211_IFTYPE_STATION) |
-					BIT(NL80211_IFTYPE_AP),
-		.supports_monitor = false,
-		.full_monitor_mode = false,
-#endif
-		.supports_shadow_regs = true,
-		.idle_ps = true,
-		.supports_sta_ps = true,
 		.cold_boot_calib = false,
-		.cbcal_restart_fw = false,
-		.fw_mem_mode = 0,
-		.num_vdevs = 16 + 1,
-		.num_peers = 512,
-		.supports_suspend = true,
-		.hal_desc_sz = sizeof(struct hal_rx_desc_wcn6855),
-		.supports_regdb = true,
-		.fix_l1ss = false,
-		.credit_flow = true,
-		.max_tx_ring = DP_TCL_NUM_RING_MAX_QCA6390,
-		.hal_params = &ath12k_hw_hal_params_qca6390,
-#if notyet
-		.supports_dynamic_smps_6ghz = false,
-		.alloc_cacheable_memory = false,
-		.supports_rssi_stats = true,
-#endif
-		.fw_wmi_diag_event = true,
-		.current_cc_support = true,
-		.dbr_debug_support = false,
-		.global_reset = true,
-#ifdef notyet
-		.bios_sar_capa = &ath12k_hw_sar_capa_wcn6855,
-#endif
-		.m3_fw_support = true,
-		.fixed_bdf_addr = false,
-		.fixed_mem_region = false,
-		.static_window_map = false,
-		.hybrid_bus_type = false,
-		.fixed_fw_mem = false,
-#if notyet
-		.support_off_channel_tx = true,
-		.supports_multi_bssid = true,
-
-		.sram_dump = {
-			.start = 0x01400000,
-			.end = 0x0177ffff,
-		},
-
-		.tcl_ring_retry = true,
-#endif
-		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
-#ifdef notyet
-		.smp2p_wow_exit = false,
-#endif
-	},
-	{
-		.name = "wcn6855 hw2.1",
-		.hw_rev = ATH12K_HW_WCN6855_HW21,
-		.fw = {
-			.dir = "wcn6855-hw2.1",
-			.board_size = 256 * 1024,
-			.cal_offset = 128 * 1024,
-		},
-		.max_radios = 3,
-		.bdf_addr = 0x4B0C0000,
-		.hw_ops = &wcn6855_ops,
-		.ring_mask = &ath12k_hw_ring_mask_qca6390,
-		.internal_sleep_clock = true,
-		.regs = &wcn6855_regs,
-		.qmi_service_ins_id = ATH12K_QMI_WLFW_SERVICE_INS_ID_V01_QCA6390,
-		.host_ce_config = qwz_host_ce_config_qca6390,
-		.ce_count = QWZ_CE_COUNT_QCA6390,
-		.target_ce_config = ath12k_target_ce_config_wlan_qca6390,
-		.target_ce_count = 9,
-		.svc_to_ce_map = ath12k_target_service_to_ce_map_wlan_qca6390,
-		.svc_to_ce_map_len = 14,
-		.single_pdev_only = true,
-		.rxdma1_enable = false,
-		.num_rxmda_per_pdev = 2,
-		.rx_mac_buf_ring = true,
-		.vdev_start_delay = true,
 		.htt_peer_map_v2 = false,
-#if notyet
-		.spectral = {
-			.fft_sz = 0,
-			.fft_pad_sz = 0,
-			.summary_pad_sz = 0,
-			.fft_hdr_len = 0,
-			.max_fft_bins = 0,
-			.fragment_160mhz = false,
-		},
-
-		.interface_modes = BIT(NL80211_IFTYPE_STATION) |
-					BIT(NL80211_IFTYPE_AP),
-		.supports_monitor = false,
-#endif
 		.supports_shadow_regs = true,
-		.idle_ps = true,
-		.supports_sta_ps = true,
-		.cold_boot_calib = false,
-		.cbcal_restart_fw = false,
 		.fw_mem_mode = 0,
-		.num_vdevs = 16 + 1,
-		.num_peers = 512,
-		.supports_suspend = true,
-		.hal_desc_sz = sizeof(struct hal_rx_desc_wcn6855),
-		.supports_regdb = true,
 		.fix_l1ss = false,
-		.credit_flow = true,
-		.max_tx_ring = DP_TCL_NUM_RING_MAX_QCA6390,
-		.hal_params = &ath12k_hw_hal_params_qca6390,
-#if notyet
-		.supports_dynamic_smps_6ghz = false,
-		.alloc_cacheable_memory = false,
-		.supports_rssi_stats = true,
-#endif
-		.fw_wmi_diag_event = true,
-		.current_cc_support = true,
-		.dbr_debug_support = false,
+		.hal_params = &ath12k_hw_hal_params_wcn7850,
+		.qmi_cnss_feature_bitmap = BIT(CNSS_QDSS_CFG_MISS_V01) |
+					   BIT(CNSS_PCIE_PERST_NO_PULL_V01),
+		.fixed_fw_mem = false,
 		.global_reset = true,
-#ifdef notyet
-		.bios_sar_capa = &ath12k_hw_sar_capa_wcn6855,
-#endif
 		.m3_fw_support = true,
-		.fixed_bdf_addr = false,
-		.fixed_mem_region = false,
-		.static_window_map = false,
-		.hybrid_bus_type = false,
-		.fixed_fw_mem = false,
-#if notyet
-		.support_off_channel_tx = true,
-		.supports_multi_bssid = true,
-
-		.sram_dump = {
-			.start = 0x01400000,
-			.end = 0x0177ffff,
-		},
-
-		.tcl_ring_retry = true,
-#endif
 		.tx_ring_size = DP_TCL_DATA_RING_SIZE,
-#ifdef notyet
-		.smp2p_wow_exit = false,
-#endif
-	},
-	{
-		.name = "wcn6750 hw1.0",
-		.hw_rev = ATH12K_HW_WCN6750_HW10,
-		.fw = {
-			.dir = "wcn6750-hw1.0",
-			.board_size = 256 * 1024,
-			.cal_offset = 128 * 1024,
-		},
-		.max_radios = 1,
-		.bdf_addr = 0x4B0C0000,
-		.hw_ops = &wcn6750_ops,
-		.ring_mask = &ath12k_hw_ring_mask_wcn6750,
-		.internal_sleep_clock = false,
-		.regs = &wcn6750_regs,
-		.qmi_service_ins_id = ATH12K_QMI_WLFW_SERVICE_INS_ID_V01_WCN6750,
-		.host_ce_config = qwz_host_ce_config_qca6390,
-		.ce_count = QWZ_CE_COUNT_QCA6390,
-		.target_ce_config = ath12k_target_ce_config_wlan_qca6390,
-		.target_ce_count = 9,
-		.svc_to_ce_map = ath12k_target_service_to_ce_map_wlan_qca6390,
-		.svc_to_ce_map_len = 14,
-		.single_pdev_only = true,
-		.rxdma1_enable = false,
-		.num_rxmda_per_pdev = 1,
-		.rx_mac_buf_ring = true,
-		.vdev_start_delay = true,
-		.htt_peer_map_v2 = false,
-#if notyet
-		.spectral = {
-			.fft_sz = 0,
-			.fft_pad_sz = 0,
-			.summary_pad_sz = 0,
-			.fft_hdr_len = 0,
-			.max_fft_bins = 0,
-			.fragment_160mhz = false,
-		},
-
-		.interface_modes = BIT(NL80211_IFTYPE_STATION) |
-					BIT(NL80211_IFTYPE_AP),
-		.supports_monitor = false,
-#endif
-		.supports_shadow_regs = true,
-		.idle_ps = true,
-		.supports_sta_ps = true,
-		.cold_boot_calib = true,
-		.cbcal_restart_fw = false,
-		.fw_mem_mode = 0,
-		.num_vdevs = 16 + 1,
-		.num_peers = 512,
-		.supports_suspend = false,
-		.hal_desc_sz = sizeof(struct hal_rx_desc_qcn9074),
-		.supports_regdb = true,
-		.fix_l1ss = false,
-		.credit_flow = true,
-		.max_tx_ring = DP_TCL_NUM_RING_MAX,
-		.hal_params = &ath12k_hw_hal_params_wcn6750,
-#if notyet
-		.supports_dynamic_smps_6ghz = false,
-		.alloc_cacheable_memory = false,
-		.supports_rssi_stats = true,
-#endif
-		.fw_wmi_diag_event = false,
-		.current_cc_support = true,
-		.dbr_debug_support = false,
-		.global_reset = false,
-#ifdef notyet
-		.bios_sar_capa = NULL,
-#endif
-		.m3_fw_support = false,
-		.fixed_bdf_addr = false,
-		.fixed_mem_region = false,
-		.static_window_map = true,
-		.hybrid_bus_type = true,
-		.fixed_fw_mem = true,
-#if notyet
-		.support_off_channel_tx = true,
-		.supports_multi_bssid = true,
-
-		.sram_dump = {},
-
-		.tcl_ring_retry = false,
-#endif
-		.tx_ring_size = DP_TCL_DATA_RING_SIZE_WCN6750,
-#ifdef notyet
-		.smp2p_wow_exit = true,
-#endif
 	},
 };
 
-const struct ath12k_hw_regs ipq8074_regs = {
-	/* SW2TCL(x) R0 ring configuration address */
-	.hal_tcl1_ring_base_lsb = 0x00000510,
-	.hal_tcl1_ring_base_msb = 0x00000514,
-	.hal_tcl1_ring_id = 0x00000518,
-	.hal_tcl1_ring_misc = 0x00000520,
-	.hal_tcl1_ring_tp_addr_lsb = 0x0000052c,
-	.hal_tcl1_ring_tp_addr_msb = 0x00000530,
-	.hal_tcl1_ring_consumer_int_setup_ix0 = 0x00000540,
-	.hal_tcl1_ring_consumer_int_setup_ix1 = 0x00000544,
-	.hal_tcl1_ring_msi1_base_lsb = 0x00000558,
-	.hal_tcl1_ring_msi1_base_msb = 0x0000055c,
-	.hal_tcl1_ring_msi1_data = 0x00000560,
-	.hal_tcl2_ring_base_lsb = 0x00000568,
-	.hal_tcl_ring_base_lsb = 0x00000618,
-
-	/* TCL STATUS ring address */
-	.hal_tcl_status_ring_base_lsb = 0x00000720,
-
-	/* REO2SW(x) R0 ring configuration address */
-	.hal_reo1_ring_base_lsb = 0x0000029c,
-	.hal_reo1_ring_base_msb = 0x000002a0,
-	.hal_reo1_ring_id = 0x000002a4,
-	.hal_reo1_ring_misc = 0x000002ac,
-	.hal_reo1_ring_hp_addr_lsb = 0x000002b0,
-	.hal_reo1_ring_hp_addr_msb = 0x000002b4,
-	.hal_reo1_ring_producer_int_setup = 0x000002c0,
-	.hal_reo1_ring_msi1_base_lsb = 0x000002e4,
-	.hal_reo1_ring_msi1_base_msb = 0x000002e8,
-	.hal_reo1_ring_msi1_data = 0x000002ec,
-	.hal_reo2_ring_base_lsb = 0x000002f4,
-	.hal_reo1_aging_thresh_ix_0 = 0x00000564,
-	.hal_reo1_aging_thresh_ix_1 = 0x00000568,
-	.hal_reo1_aging_thresh_ix_2 = 0x0000056c,
-	.hal_reo1_aging_thresh_ix_3 = 0x00000570,
-
-	/* REO2SW(x) R2 ring pointers (head/tail) address */
-	.hal_reo1_ring_hp = 0x00003038,
-	.hal_reo1_ring_tp = 0x0000303c,
-	.hal_reo2_ring_hp = 0x00003040,
-
-	/* REO2TCL R0 ring configuration address */
-	.hal_reo_tcl_ring_base_lsb = 0x000003fc,
-	.hal_reo_tcl_ring_hp = 0x00003058,
-
-	/* REO CMD ring address */
-	.hal_reo_cmd_ring_base_lsb = 0x00000194,
-	.hal_reo_cmd_ring_hp = 0x00003020,
-
-	/* REO status address */
-	.hal_reo_status_ring_base_lsb = 0x00000504,
-	.hal_reo_status_hp = 0x00003070,
-
-	/* SW2REO ring address */
-	.hal_sw2reo_ring_base_lsb = 0x000001ec,
-	.hal_sw2reo_ring_hp = 0x00003028,
-
-	/* WCSS relative address */
-	.hal_seq_wcss_umac_ce0_src_reg = 0x00a00000,
-	.hal_seq_wcss_umac_ce0_dst_reg = 0x00a01000,
-	.hal_seq_wcss_umac_ce1_src_reg = 0x00a02000,
-	.hal_seq_wcss_umac_ce1_dst_reg = 0x00a03000,
-
-	/* WBM Idle address */
-	.hal_wbm_idle_link_ring_base_lsb = 0x00000860,
-	.hal_wbm_idle_link_ring_misc = 0x00000870,
-
-	/* SW2WBM release address */
-	.hal_wbm_release_ring_base_lsb = 0x000001d8,
-
-	/* WBM2SW release address */
-	.hal_wbm0_release_ring_base_lsb = 0x00000910,
-	.hal_wbm1_release_ring_base_lsb = 0x00000968,
-
-	/* PCIe base address */
-	.pcie_qserdes_sysclk_en_sel = 0x0,
-	.pcie_pcs_osc_dtct_config_base = 0x0,
-
-	/* Shadow register area */
-	.hal_shadow_base_addr = 0x0,
-
-	/* REO misc control register, not used in IPQ8074 */
-	.hal_reo1_misc_ctl = 0x0,
-};
-
-const struct ath12k_hw_regs qca6390_regs = {
-	/* SW2TCL(x) R0 ring configuration address */
-	.hal_tcl1_ring_base_lsb = 0x00000684,
-	.hal_tcl1_ring_base_msb = 0x00000688,
-	.hal_tcl1_ring_id = 0x0000068c,
-	.hal_tcl1_ring_misc = 0x00000694,
-	.hal_tcl1_ring_tp_addr_lsb = 0x000006a0,
-	.hal_tcl1_ring_tp_addr_msb = 0x000006a4,
-	.hal_tcl1_ring_consumer_int_setup_ix0 = 0x000006b4,
-	.hal_tcl1_ring_consumer_int_setup_ix1 = 0x000006b8,
-	.hal_tcl1_ring_msi1_base_lsb = 0x000006cc,
-	.hal_tcl1_ring_msi1_base_msb = 0x000006d0,
-	.hal_tcl1_ring_msi1_data = 0x000006d4,
-	.hal_tcl2_ring_base_lsb = 0x000006dc,
-	.hal_tcl_ring_base_lsb = 0x0000078c,
-
-	/* TCL STATUS ring address */
-	.hal_tcl_status_ring_base_lsb = 0x00000894,
-
-	/* REO2SW(x) R0 ring configuration address */
-	.hal_reo1_ring_base_lsb = 0x00000244,
-	.hal_reo1_ring_base_msb = 0x00000248,
-	.hal_reo1_ring_id = 0x0000024c,
-	.hal_reo1_ring_misc = 0x00000254,
-	.hal_reo1_ring_hp_addr_lsb = 0x00000258,
-	.hal_reo1_ring_hp_addr_msb = 0x0000025c,
-	.hal_reo1_ring_producer_int_setup = 0x00000268,
-	.hal_reo1_ring_msi1_base_lsb = 0x0000028c,
-	.hal_reo1_ring_msi1_base_msb = 0x00000290,
-	.hal_reo1_ring_msi1_data = 0x00000294,
-	.hal_reo2_ring_base_lsb = 0x0000029c,
-	.hal_reo1_aging_thresh_ix_0 = 0x0000050c,
-	.hal_reo1_aging_thresh_ix_1 = 0x00000510,
-	.hal_reo1_aging_thresh_ix_2 = 0x00000514,
-	.hal_reo1_aging_thresh_ix_3 = 0x00000518,
-
-	/* REO2SW(x) R2 ring pointers (head/tail) address */
-	.hal_reo1_ring_hp = 0x00003030,
-	.hal_reo1_ring_tp = 0x00003034,
-	.hal_reo2_ring_hp = 0x00003038,
-
-	/* REO2TCL R0 ring configuration address */
-	.hal_reo_tcl_ring_base_lsb = 0x000003a4,
-	.hal_reo_tcl_ring_hp = 0x00003050,
-
-	/* REO CMD ring address */
-	.hal_reo_cmd_ring_base_lsb = 0x00000194,
-	.hal_reo_cmd_ring_hp = 0x00003020,
-
-	/* REO status address */
-	.hal_reo_status_ring_base_lsb = 0x000004ac,
-	.hal_reo_status_hp = 0x00003068,
-
-	/* SW2REO ring address */
-	.hal_sw2reo_ring_base_lsb = 0x000001ec,
-	.hal_sw2reo_ring_hp = 0x00003028,
-
-	/* WCSS relative address */
-	.hal_seq_wcss_umac_ce0_src_reg = 0x00a00000,
-	.hal_seq_wcss_umac_ce0_dst_reg = 0x00a01000,
-	.hal_seq_wcss_umac_ce1_src_reg = 0x00a02000,
-	.hal_seq_wcss_umac_ce1_dst_reg = 0x00a03000,
-
-	/* WBM Idle address */
-	.hal_wbm_idle_link_ring_base_lsb = 0x00000860,
-	.hal_wbm_idle_link_ring_misc = 0x00000870,
-
-	/* SW2WBM release address */
-	.hal_wbm_release_ring_base_lsb = 0x000001d8,
-
-	/* WBM2SW release address */
-	.hal_wbm0_release_ring_base_lsb = 0x00000910,
-	.hal_wbm1_release_ring_base_lsb = 0x00000968,
-
-	/* PCIe base address */
-	.pcie_qserdes_sysclk_en_sel = 0x01e0c0ac,
-	.pcie_pcs_osc_dtct_config_base = 0x01e0c628,
-
-	/* Shadow register area */
-	.hal_shadow_base_addr = 0x000008fc,
-
-	/* REO misc control register, not used in QCA6390 */
-	.hal_reo1_misc_ctl = 0x0,
-};
-
-const struct ath12k_hw_regs qcn9074_regs = {
+const struct ath12k_hw_regs wcn7850_regs = {
 	/* SW2TCL(x) R0 ring configuration address */
-	.hal_tcl1_ring_base_lsb = 0x000004f0,
-	.hal_tcl1_ring_base_msb = 0x000004f4,
-	.hal_tcl1_ring_id = 0x000004f8,
-	.hal_tcl1_ring_misc = 0x00000500,
-	.hal_tcl1_ring_tp_addr_lsb = 0x0000050c,
-	.hal_tcl1_ring_tp_addr_msb = 0x00000510,
-	.hal_tcl1_ring_consumer_int_setup_ix0 = 0x00000520,
-	.hal_tcl1_ring_consumer_int_setup_ix1 = 0x00000524,
-	.hal_tcl1_ring_msi1_base_lsb = 0x00000538,
-	.hal_tcl1_ring_msi1_base_msb = 0x0000053c,
-	.hal_tcl1_ring_msi1_data = 0x00000540,
-	.hal_tcl2_ring_base_lsb = 0x00000548,
-	.hal_tcl_ring_base_lsb = 0x000005f8,
+	.hal_tcl1_ring_cmn_ctrl_reg = 0x00000020,
+	.hal_tcl1_ring_dscp_tid_map = 0x00000240,
+	.hal_tcl1_ring_base_lsb = 0x00000900,
+	.hal_tcl1_ring_id = 0x00000908,
+	.hal_tcl1_ring_misc = 0x00000910,
+	.hal_tcl1_ring_tp_addr_lsb = 0x0000091c,
+	.hal_tcl1_ring_tp_addr_msb = 0x00000920,
+	.hal_tcl1_ring_consumer_int_setup_ix0 = 0x00000930,
+	.hal_tcl1_ring_consumer_int_setup_ix1 = 0x00000934,
+	.hal_tcl1_ring_msi1_base_lsb = 0x00000948,
+	.hal_tcl1_ring_msi1_base_msb = 0x0000094c,
+	.hal_tcl1_ring_msi1_data = 0x00000950,
+	.hal_tcl2_ring_base_lsb = 0x00000978,
+	.hal_tcl_ring_base_lsb = 0x00000b58,
+	.hal_tcl_ring_hp = 0x00002028,
 
 	/* TCL STATUS ring address */
-	.hal_tcl_status_ring_base_lsb = 0x00000700,
-
-	/* REO2SW(x) R0 ring configuration address */
-	.hal_reo1_ring_base_lsb = 0x0000029c,
-	.hal_reo1_ring_base_msb = 0x000002a0,
-	.hal_reo1_ring_id = 0x000002a4,
-	.hal_reo1_ring_misc = 0x000002ac,
-	.hal_reo1_ring_hp_addr_lsb = 0x000002b0,
-	.hal_reo1_ring_hp_addr_msb = 0x000002b4,
-	.hal_reo1_ring_producer_int_setup = 0x000002c0,
-	.hal_reo1_ring_msi1_base_lsb = 0x000002e4,
-	.hal_reo1_ring_msi1_base_msb = 0x000002e8,
-	.hal_reo1_ring_msi1_data = 0x000002ec,
-	.hal_reo2_ring_base_lsb = 0x000002f4,
-	.hal_reo1_aging_thresh_ix_0 = 0x00000564,
-	.hal_reo1_aging_thresh_ix_1 = 0x00000568,
-	.hal_reo1_aging_thresh_ix_2 = 0x0000056c,
-	.hal_reo1_aging_thresh_ix_3 = 0x00000570,
-
-	/* REO2SW(x) R2 ring pointers (head/tail) address */
-	.hal_reo1_ring_hp = 0x00003038,
-	.hal_reo1_ring_tp = 0x0000303c,
-	.hal_reo2_ring_hp = 0x00003040,
-
-	/* REO2TCL R0 ring configuration address */
-	.hal_reo_tcl_ring_base_lsb = 0x000003fc,
-	.hal_reo_tcl_ring_hp = 0x00003058,
-
-	/* REO CMD ring address */
-	.hal_reo_cmd_ring_base_lsb = 0x00000194,
-	.hal_reo_cmd_ring_hp = 0x00003020,
-
-	/* REO status address */
-	.hal_reo_status_ring_base_lsb = 0x00000504,
-	.hal_reo_status_hp = 0x00003070,
-
-	/* SW2REO ring address */
-	.hal_sw2reo_ring_base_lsb = 0x000001ec,
-	.hal_sw2reo_ring_hp = 0x00003028,
-
-	/* WCSS relative address */
-	.hal_seq_wcss_umac_ce0_src_reg = 0x01b80000,
-	.hal_seq_wcss_umac_ce0_dst_reg = 0x01b81000,
-	.hal_seq_wcss_umac_ce1_src_reg = 0x01b82000,
-	.hal_seq_wcss_umac_ce1_dst_reg = 0x01b83000,
-
-	/* WBM Idle address */
-	.hal_wbm_idle_link_ring_base_lsb = 0x00000874,
-	.hal_wbm_idle_link_ring_misc = 0x00000884,
-
-	/* SW2WBM release address */
-	.hal_wbm_release_ring_base_lsb = 0x000001ec,
-
-	/* WBM2SW release address */
-	.hal_wbm0_release_ring_base_lsb = 0x00000924,
-	.hal_wbm1_release_ring_base_lsb = 0x0000097c,
+	.hal_tcl_status_ring_base_lsb = 0x00000d38,
+	.hal_tcl_status_ring_hp = 0x00002048,
+
+	.hal_wbm_idle_link_ring_base_lsb = 0x00000d3c,
+	.hal_wbm_idle_link_ring_misc = 0x00000d4c,
+	.hal_wbm_r0_idle_list_cntl_addr = 0x00000240,
+	.hal_wbm_r0_idle_list_size_addr = 0x00000244,
+	.hal_wbm_scattered_ring_base_lsb = 0x00000250,
+	.hal_wbm_scattered_ring_base_msb = 0x00000254,
+	.hal_wbm_scattered_desc_head_info_ix0 = 0x00000260,
+	.hal_wbm_scattered_desc_head_info_ix1 = 0x00000264,
+	.hal_wbm_scattered_desc_tail_info_ix0 = 0x00000270,
+	.hal_wbm_scattered_desc_tail_info_ix1 = 0x00000274,
+	.hal_wbm_scattered_desc_ptr_hp_addr = 0x00000027c,
+
+	.hal_wbm_release_ring_base_lsb = 0x0000037c,
+	.hal_wbm_release_ring_hp = 0x00003010,
+	.hal_wbm_sw1_release_ring_base_lsb = 0x00000284,
+	.hal_wbm0_release_ring_base_lsb = 0x00000e08,
+	.hal_wbm0_release_ring_hp = 0x000030c8,
+	.hal_wbm1_release_ring_base_lsb = 0x00000e80,
+	.hal_wbm1_release_ring_hp = 0x000030d0,
 
 	/* PCIe base address */
 	.pcie_qserdes_sysclk_en_sel = 0x01e0e0a8,
 	.pcie_pcs_osc_dtct_config_base = 0x01e0f45c,
 
-	/* Shadow register area */
-	.hal_shadow_base_addr = 0x0,
-
-	/* REO misc control register, not used in QCN9074 */
-	.hal_reo1_misc_ctl = 0x0,
-};
-
-const struct ath12k_hw_regs wcn6855_regs = {
-	/* SW2TCL(x) R0 ring configuration address */
-	.hal_tcl1_ring_base_lsb = 0x00000690,
-	.hal_tcl1_ring_base_msb = 0x00000694,
-	.hal_tcl1_ring_id = 0x00000698,
-	.hal_tcl1_ring_misc = 0x000006a0,
-	.hal_tcl1_ring_tp_addr_lsb = 0x000006ac,
-	.hal_tcl1_ring_tp_addr_msb = 0x000006b0,
-	.hal_tcl1_ring_consumer_int_setup_ix0 = 0x000006c0,
-	.hal_tcl1_ring_consumer_int_setup_ix1 = 0x000006c4,
-	.hal_tcl1_ring_msi1_base_lsb = 0x000006d8,
-	.hal_tcl1_ring_msi1_base_msb = 0x000006dc,
-	.hal_tcl1_ring_msi1_data = 0x000006e0,
-	.hal_tcl2_ring_base_lsb = 0x000006e8,
-	.hal_tcl_ring_base_lsb = 0x00000798,
-
-	/* TCL STATUS ring address */
-	.hal_tcl_status_ring_base_lsb = 0x000008a0,
-
-	/* REO2SW(x) R0 ring configuration address */
-	.hal_reo1_ring_base_lsb = 0x00000244,
-	.hal_reo1_ring_base_msb = 0x00000248,
-	.hal_reo1_ring_id = 0x0000024c,
-	.hal_reo1_ring_misc = 0x00000254,
-	.hal_reo1_ring_hp_addr_lsb = 0x00000258,
-	.hal_reo1_ring_hp_addr_msb = 0x0000025c,
-	.hal_reo1_ring_producer_int_setup = 0x00000268,
-	.hal_reo1_ring_msi1_base_lsb = 0x0000028c,
-	.hal_reo1_ring_msi1_base_msb = 0x00000290,
-	.hal_reo1_ring_msi1_data = 0x00000294,
-	.hal_reo2_ring_base_lsb = 0x0000029c,
-	.hal_reo1_aging_thresh_ix_0 = 0x000005bc,
-	.hal_reo1_aging_thresh_ix_1 = 0x000005c0,
-	.hal_reo1_aging_thresh_ix_2 = 0x000005c4,
-	.hal_reo1_aging_thresh_ix_3 = 0x000005c8,
-
-	/* REO2SW(x) R2 ring pointers (head/tail) address */
-	.hal_reo1_ring_hp = 0x00003030,
-	.hal_reo1_ring_tp = 0x00003034,
-	.hal_reo2_ring_hp = 0x00003038,
-
-	/* REO2TCL R0 ring configuration address */
-	.hal_reo_tcl_ring_base_lsb = 0x00000454,
-	.hal_reo_tcl_ring_hp = 0x00003060,
-
-	/* REO CMD ring address */
-	.hal_reo_cmd_ring_base_lsb = 0x00000194,
-	.hal_reo_cmd_ring_hp = 0x00003020,
-
-	/* REO status address */
-	.hal_reo_status_ring_base_lsb = 0x0000055c,
-	.hal_reo_status_hp = 0x00003078,
-
-	/* SW2REO ring address */
-	.hal_sw2reo_ring_base_lsb = 0x000001ec,
+	/* PPE release ring address */
+	.hal_ppe_rel_ring_base = 0x0000043c,
+
+	/* REO DEST ring address */
+	.hal_reo2_ring_base_lsb = 0x0000055c,
+	.hal_reo1_misc_ctl = 0x00000b7c,
+	.hal_reo1_sw_cookie_cfg0 = 0x00000050,
+	.hal_reo1_sw_cookie_cfg1 = 0x00000054,
+	.hal_reo1_qdesc_lut_base0 = 0x00000058,
+	.hal_reo1_qdesc_lut_base1 = 0x0000005c,
+	.hal_reo1_ring_base_lsb = 0x000004e4,
+	.hal_reo1_ring_base_msb = 0x000004e8,
+	.hal_reo1_ring_id = 0x000004ec,
+	.hal_reo1_ring_misc = 0x000004f4,
+	.hal_reo1_ring_hp_addr_lsb = 0x000004f8,
+	.hal_reo1_ring_hp_addr_msb = 0x000004fc,
+	.hal_reo1_ring_producer_int_setup = 0x00000508,
+	.hal_reo1_ring_msi1_base_lsb = 0x0000052C,
+	.hal_reo1_ring_msi1_base_msb = 0x00000530,
+	.hal_reo1_ring_msi1_data = 0x00000534,
+	.hal_reo1_aging_thres_ix0 = 0x00000b08,
+	.hal_reo1_aging_thres_ix1 = 0x00000b0c,
+	.hal_reo1_aging_thres_ix2 = 0x00000b10,
+	.hal_reo1_aging_thres_ix3 = 0x00000b14,
+
+	/* REO Exception ring address */
+	.hal_reo2_sw0_ring_base = 0x000008a4,
+
+	/* REO Reinject ring address */
+	.hal_sw2reo_ring_base_lsb = 0x00000304,
 	.hal_sw2reo_ring_hp = 0x00003028,
+	.hal_sw2reo1_ring_base = 0x0000037c,
 
-	/* WCSS relative address */
-	.hal_seq_wcss_umac_ce0_src_reg = 0x1b80000,
-	.hal_seq_wcss_umac_ce0_dst_reg = 0x1b81000,
-	.hal_seq_wcss_umac_ce1_src_reg = 0x1b82000,
-	.hal_seq_wcss_umac_ce1_dst_reg = 0x1b83000,
-
-	/* WBM Idle address */
-	.hal_wbm_idle_link_ring_base_lsb = 0x00000870,
-	.hal_wbm_idle_link_ring_misc = 0x00000880,
-
-	/* SW2WBM release address */
-	.hal_wbm_release_ring_base_lsb = 0x000001e8,
-
-	/* WBM2SW release address */
-	.hal_wbm0_release_ring_base_lsb = 0x00000920,
-	.hal_wbm1_release_ring_base_lsb = 0x00000978,
-
-	/* PCIe base address */
-	.pcie_qserdes_sysclk_en_sel = 0x01e0c0ac,
-	.pcie_pcs_osc_dtct_config_base = 0x01e0c628,
-
-	/* Shadow register area */
-	.hal_shadow_base_addr = 0x000008fc,
-
-	/* REO misc control register, used for fragment
-	 * destination ring config in WCN6855.
-	 */
-	.hal_reo1_misc_ctl = 0x00000630,
-};
+	/* REO cmd ring address */
+	.hal_reo_cmd_ring_base_lsb = 0x0000028c,
+	.hal_reo_cmd_ring_hp = 0x00003020,
 
-const struct ath12k_hw_regs wcn6750_regs = {
-	/* SW2TCL(x) R0 ring configuration address */
-	.hal_tcl1_ring_base_lsb = 0x00000694,
-	.hal_tcl1_ring_base_msb = 0x00000698,
-	.hal_tcl1_ring_id = 0x0000069c,
-	.hal_tcl1_ring_misc = 0x000006a4,
-	.hal_tcl1_ring_tp_addr_lsb = 0x000006b0,
-	.hal_tcl1_ring_tp_addr_msb = 0x000006b4,
-	.hal_tcl1_ring_consumer_int_setup_ix0 = 0x000006c4,
-	.hal_tcl1_ring_consumer_int_setup_ix1 = 0x000006c8,
-	.hal_tcl1_ring_msi1_base_lsb = 0x000006dc,
-	.hal_tcl1_ring_msi1_base_msb = 0x000006e0,
-	.hal_tcl1_ring_msi1_data = 0x000006e4,
-	.hal_tcl2_ring_base_lsb = 0x000006ec,
-	.hal_tcl_ring_base_lsb = 0x0000079c,
-
-	/* TCL STATUS ring address */
-	.hal_tcl_status_ring_base_lsb = 0x000008a4,
-
-	/* REO2SW(x) R0 ring configuration address */
-	.hal_reo1_ring_base_lsb = 0x000001ec,
-	.hal_reo1_ring_base_msb = 0x000001f0,
-	.hal_reo1_ring_id = 0x000001f4,
-	.hal_reo1_ring_misc = 0x000001fc,
-	.hal_reo1_ring_hp_addr_lsb = 0x00000200,
-	.hal_reo1_ring_hp_addr_msb = 0x00000204,
-	.hal_reo1_ring_producer_int_setup = 0x00000210,
-	.hal_reo1_ring_msi1_base_lsb = 0x00000234,
-	.hal_reo1_ring_msi1_base_msb = 0x00000238,
-	.hal_reo1_ring_msi1_data = 0x0000023c,
-	.hal_reo2_ring_base_lsb = 0x00000244,
-	.hal_reo1_aging_thresh_ix_0 = 0x00000564,
-	.hal_reo1_aging_thresh_ix_1 = 0x00000568,
-	.hal_reo1_aging_thresh_ix_2 = 0x0000056c,
-	.hal_reo1_aging_thresh_ix_3 = 0x00000570,
+	/* REO status ring address */
+	.hal_reo_status_ring_base_lsb = 0x00000a84,
+	.hal_reo_status_hp = 0x000030a8,
 
 	/* REO2SW(x) R2 ring pointers (head/tail) address */
-	.hal_reo1_ring_hp = 0x00003028,
-	.hal_reo1_ring_tp = 0x0000302c,
-	.hal_reo2_ring_hp = 0x00003030,
-
-	/* REO2TCL R0 ring configuration address */
-	.hal_reo_tcl_ring_base_lsb = 0x000003fc,
-	.hal_reo_tcl_ring_hp = 0x00003058,
-
-	/* REO CMD ring address */
-	.hal_reo_cmd_ring_base_lsb = 0x000000e4,
-	.hal_reo_cmd_ring_hp = 0x00003010,
-
-	/* REO status address */
-	.hal_reo_status_ring_base_lsb = 0x00000504,
-	.hal_reo_status_hp = 0x00003070,
-
-	/* SW2REO ring address */
-	.hal_sw2reo_ring_base_lsb = 0x0000013c,
-	.hal_sw2reo_ring_hp = 0x00003018,
+	.hal_reo1_ring_hp = 0x00003048,
+	.hal_reo1_ring_tp = 0x0000304c,
+	.hal_reo2_ring_hp = 0x00003050,
 
 	/* WCSS relative address */
-	.hal_seq_wcss_umac_ce0_src_reg = 0x01b80000,
 	.hal_seq_wcss_umac_ce0_dst_reg = 0x01b81000,
 	.hal_seq_wcss_umac_ce1_src_reg = 0x01b82000,
 	.hal_seq_wcss_umac_ce1_dst_reg = 0x01b83000,
 
-	/* WBM Idle address */
-	.hal_wbm_idle_link_ring_base_lsb = 0x00000874,
-	.hal_wbm_idle_link_ring_misc = 0x00000884,
-
-	/* SW2WBM release address */
-	.hal_wbm_release_ring_base_lsb = 0x000001ec,
-
-	/* WBM2SW release address */
-	.hal_wbm0_release_ring_base_lsb = 0x00000924,
-	.hal_wbm1_release_ring_base_lsb = 0x0000097c,
-
-	/* PCIe base address */
-	.pcie_qserdes_sysclk_en_sel = 0x0,
-	.pcie_pcs_osc_dtct_config_base = 0x0,
-
 	/* Shadow register area */
-	.hal_shadow_base_addr = 0x00000504,
-
-	/* REO misc control register, used for fragment
-	 * destination ring config in WCN6750.
-	 */
-	.hal_reo1_misc_ctl = 0x000005d8,
+	.hal_shadow_base_addr = 0x000008fc,
 };
 
 #define QWZ_SLEEP_CLOCK_SELECT_INTERNAL_BIT	0x02
 #define QWZ_HOST_CSTATE_BIT			0x04
 #define QWZ_PLATFORM_CAP_PCIE_GLOBAL_RESET	0x08
-#define QWZ_PLATFORM_CAP_PCIE_PME_D3COLD	0x10
 
 static const struct qmi_elem_info qmi_response_type_v01_ei[] = {
 	{
@@ -4725,6 +3427,50 @@ static const struct qmi_elem_info qmi_wlanfw_ind_register_resp_msg_v01_ei[] = {
 	},
 };
 
+static const struct qmi_elem_info wlfw_host_mlo_chip_info_s_v01_ei[] = {
+	{
+		.data_type      = QMI_UNSIGNED_1_BYTE,
+		.elem_len       = 1,
+		.elem_size      = sizeof(uint8_t),
+		.array_type	= NO_ARRAY,
+		.tlv_type       = 0,
+		.offset         = offsetof(struct wlfw_host_mlo_chip_info_s_v01,
+					   chip_id),
+	},
+	{
+		.data_type      = QMI_UNSIGNED_1_BYTE,
+		.elem_len       = 1,
+		.elem_size      = sizeof(uint8_t),
+		.array_type	= NO_ARRAY,
+		.tlv_type       = 0,
+		.offset         = offsetof(struct wlfw_host_mlo_chip_info_s_v01,
+					   num_local_links),
+	},
+	{
+		.data_type      = QMI_UNSIGNED_1_BYTE,
+		.elem_len       = QMI_WLFW_MAX_NUM_MLO_LINKS_PER_CHIP_V01,
+		.elem_size      = sizeof(uint8_t),
+		.array_type     = STATIC_ARRAY,
+		.tlv_type       = 0,
+		.offset         = offsetof(struct wlfw_host_mlo_chip_info_s_v01,
+					   hw_link_id),
+	},
+	{
+		.data_type      = QMI_UNSIGNED_1_BYTE,
+		.elem_len       = QMI_WLFW_MAX_NUM_MLO_LINKS_PER_CHIP_V01,
+		.elem_size      = sizeof(uint8_t),
+		.array_type     = STATIC_ARRAY,
+		.tlv_type       = 0,
+		.offset         = offsetof(struct wlfw_host_mlo_chip_info_s_v01,
+					   valid_mlo_link_id),
+	},
+	{
+		.data_type      = QMI_EOTI,
+		.array_type	= NO_ARRAY,
+		.tlv_type       = QMI_COMMON_TLV_TYPE,
+	},
+};
+
 static const struct qmi_elem_info qmi_wlanfw_host_cap_req_msg_v01_ei[] = {
 	{
 		.data_type	= QMI_OPT_FLAG,
@@ -4970,6 +3716,205 @@ static const struct qmi_elem_info qmi_wlanfw_host_cap_req_msg_v01_ei[] = {
 					   mem_cfg_mode),
 	},
 	{
+		.data_type	= QMI_OPT_FLAG,
+		.elem_len	= 1,
+		.elem_size	= sizeof(uint8_t),
+		.array_type	= NO_ARRAY,
+		.tlv_type	= 0x1D,
+		.offset		= offsetof(struct qmi_wlanfw_host_cap_req_msg_v01,
+					   cal_duration_valid),
+	},
+	{
+		.data_type	= QMI_UNSIGNED_2_BYTE,
+		.elem_len	= 1,
+		.elem_size	= sizeof(uint16_t),
+		.array_type	= NO_ARRAY,
+		.tlv_type	= 0x1D,
+		.offset		= offsetof(struct qmi_wlanfw_host_cap_req_msg_v01,
+					   cal_duraiton),
+	},
+	{
+		.data_type	= QMI_OPT_FLAG,
+		.elem_len	= 1,
+		.elem_size	= sizeof(uint8_t),
+		.array_type	= NO_ARRAY,
+		.tlv_type	= 0x1E,
+		.offset		= offsetof(struct qmi_wlanfw_host_cap_req_msg_v01,
+					   platform_name_valid),
+	},
+	{
+		.data_type	= QMI_STRING,
+		.elem_len	= QMI_WLANFW_MAX_PLATFORM_NAME_LEN_V01 + 1,
+		.elem_size	= sizeof(char),
+		.array_type	= NO_ARRAY,
+		.tlv_type	= 0x1E,
+		.offset		= offsetof(struct qmi_wlanfw_host_cap_req_msg_v01,
+					   platform_name),
+	},
+	{
+		.data_type	= QMI_OPT_FLAG,
+		.elem_len	= 1,
+		.elem_size	= sizeof(uint8_t),
+		.array_type	= NO_ARRAY,
+		.tlv_type	= 0x1F,
+		.offset		= offsetof(struct qmi_wlanfw_host_cap_req_msg_v01,
+					   ddr_range_valid),
+	},
+	{
+		.data_type	= QMI_STRUCT,
+		.elem_len	= QMI_WLANFW_MAX_HOST_DDR_RANGE_SIZE_V01,
+		.elem_size	= sizeof(struct qmi_wlanfw_host_ddr_range),
+		.array_type	= STATIC_ARRAY,
+		.tlv_type	= 0x1F,
+		.offset		= offsetof(struct qmi_wlanfw_host_cap_req_msg_v01,
+					   ddr_range),
+	},
+	{
+		.data_type	= QMI_OPT_FLAG,
+		.elem_len	= 1,
+		.elem_size	= sizeof(uint8_t),
+		.array_type	= NO_ARRAY,
+		.tlv_type	= 0x20,
+		.offset		= offsetof(struct qmi_wlanfw_host_cap_req_msg_v01,
+					   host_build_type_valid),
+	},
+	{
+		.data_type	= QMI_SIGNED_4_BYTE_ENUM,
+		.elem_len	= 1,
+		.elem_size	= sizeof(enum qmi_wlanfw_host_build_type),
+		.array_type	= NO_ARRAY,
+		.tlv_type	= 0x20,
+		.offset		= offsetof(struct qmi_wlanfw_host_cap_req_msg_v01,
+					   host_build_type),
+	},
+	{
+		.data_type	= QMI_OPT_FLAG,
+		.elem_len	= 1,
+		.elem_size	= sizeof(uint8_t),
+		.array_type	= NO_ARRAY,
+		.tlv_type	= 0x21,
+		.offset		= offsetof(struct qmi_wlanfw_host_cap_req_msg_v01,
+					   mlo_capable_valid),
+	},
+	{
+		.data_type	= QMI_UNSIGNED_1_BYTE,
+		.elem_len	= 1,
+		.elem_size	= sizeof(uint8_t),
+		.array_type	= NO_ARRAY,
+		.tlv_type	= 0x21,
+		.offset		= offsetof(struct qmi_wlanfw_host_cap_req_msg_v01,
+					   mlo_capable),
+	},
+	{
+		.data_type	= QMI_OPT_FLAG,
+		.elem_len	= 1,
+		.elem_size	= sizeof(uint8_t),
+		.array_type	= NO_ARRAY,
+		.tlv_type	= 0x22,
+		.offset		= offsetof(struct qmi_wlanfw_host_cap_req_msg_v01,
+					   mlo_chip_id_valid),
+	},
+	{
+		.data_type	= QMI_UNSIGNED_2_BYTE,
+		.elem_len	= 1,
+		.elem_size	= sizeof(uint16_t),
+		.array_type	= NO_ARRAY,
+		.tlv_type	= 0x22,
+		.offset		= offsetof(struct qmi_wlanfw_host_cap_req_msg_v01,
+					   mlo_chip_id),
+	},
+	{
+		.data_type	= QMI_OPT_FLAG,
+		.elem_len	= 1,
+		.elem_size	= sizeof(uint8_t),
+		.array_type	= NO_ARRAY,
+		.tlv_type	= 0x23,
+		.offset		= offsetof(struct qmi_wlanfw_host_cap_req_msg_v01,
+					   mlo_group_id_valid),
+	},
+	{
+		.data_type	= QMI_UNSIGNED_1_BYTE,
+		.elem_len	= 1,
+		.elem_size	= sizeof(uint8_t),
+		.array_type	= NO_ARRAY,
+		.tlv_type	= 0x23,
+		.offset		= offsetof(struct qmi_wlanfw_host_cap_req_msg_v01,
+					   mlo_group_id),
+	},
+	{
+		.data_type	= QMI_OPT_FLAG,
+		.elem_len	= 1,
+		.elem_size	= sizeof(uint8_t),
+		.array_type	= NO_ARRAY,
+		.tlv_type	= 0x24,
+		.offset		= offsetof(struct qmi_wlanfw_host_cap_req_msg_v01,
+					   max_mlo_peer_valid),
+	},
+	{
+		.data_type	= QMI_UNSIGNED_2_BYTE,
+		.elem_len	= 1,
+		.elem_size	= sizeof(uint8_t),
+		.array_type	= NO_ARRAY,
+		.tlv_type	= 0x24,
+		.offset		= offsetof(struct qmi_wlanfw_host_cap_req_msg_v01,
+					   max_mlo_peer),
+	},
+	{
+		.data_type	= QMI_OPT_FLAG,
+		.elem_len	= 1,
+		.elem_size	= sizeof(uint8_t),
+		.array_type	= NO_ARRAY,
+		.tlv_type	= 0x25,
+		.offset		= offsetof(struct qmi_wlanfw_host_cap_req_msg_v01,
+					   mlo_num_chips_valid),
+	},
+	{
+		.data_type	= QMI_UNSIGNED_1_BYTE,
+		.elem_len	= 1,
+		.elem_size	= sizeof(uint8_t),
+		.array_type	= NO_ARRAY,
+		.tlv_type	= 0x25,
+		.offset		= offsetof(struct qmi_wlanfw_host_cap_req_msg_v01,
+					   mlo_num_chips),
+	},
+	{
+		.data_type	= QMI_OPT_FLAG,
+		.elem_len	= 1,
+		.elem_size	= sizeof(uint8_t),
+		.array_type	= NO_ARRAY,
+		.tlv_type	= 0x26,
+		.offset		= offsetof(struct qmi_wlanfw_host_cap_req_msg_v01,
+					   mlo_chip_info_valid),
+	},
+	{
+		.data_type	= QMI_STRUCT,
+		.elem_len	= QMI_WLFW_MAX_NUM_MLO_CHIPS_V01,
+		.elem_size	= sizeof(struct wlfw_host_mlo_chip_info_s_v01),
+		.array_type	= STATIC_ARRAY,
+		.tlv_type	= 0x26,
+		.offset		= offsetof(struct qmi_wlanfw_host_cap_req_msg_v01,
+					   mlo_chip_info),
+		.ei_array	= wlfw_host_mlo_chip_info_s_v01_ei,
+	},
+	{
+		.data_type	= QMI_OPT_FLAG,
+		.elem_len	= 1,
+		.elem_size	= sizeof(uint8_t),
+		.array_type	= NO_ARRAY,
+		.tlv_type	= 0x27,
+		.offset		= offsetof(struct qmi_wlanfw_host_cap_req_msg_v01,
+					   feature_list_valid),
+	},
+	{
+		.data_type	= QMI_UNSIGNED_8_BYTE,
+		.elem_len	= 1,
+		.elem_size	= sizeof(uint64_t),
+		.array_type	= NO_ARRAY,
+		.tlv_type	= 0x27,
+		.offset		= offsetof(struct qmi_wlanfw_host_cap_req_msg_v01,
+					   feature_list),
+	},
+	{
 		.data_type	= QMI_EOTI,
 		.array_type	= NO_ARRAY,
 		.tlv_type	= QMI_COMMON_TLV_TYPE,
@@ -4993,6 +3938,85 @@ static const struct qmi_elem_info qmi_wlanfw_host_cap_resp_msg_v01_ei[] = {
 	},
 };
 
+static const struct qmi_elem_info qmi_wlanfw_phy_cap_req_msg_v01_ei[] = {
+	{
+		.data_type	= QMI_EOTI,
+		.array_type	= NO_ARRAY,
+		.tlv_type	= QMI_COMMON_TLV_TYPE,
+	},
+};
+
+static const struct qmi_elem_info qmi_wlanfw_phy_cap_resp_msg_v01_ei[] = {
+	{
+		.data_type	= QMI_STRUCT,
+		.elem_len	= 1,
+		.elem_size	= sizeof(struct qmi_response_type_v01),
+		.array_type	= NO_ARRAY,
+		.tlv_type	= 0x02,
+		.offset		= offsetof(struct qmi_wlanfw_phy_cap_resp_msg_v01, resp),
+		.ei_array	= qmi_response_type_v01_ei,
+	},
+	{
+		.data_type	= QMI_OPT_FLAG,
+		.elem_len	= 1,
+		.elem_size	= sizeof(uint8_t),
+		.array_type	= NO_ARRAY,
+		.tlv_type	= 0x10,
+		.offset		= offsetof(struct qmi_wlanfw_phy_cap_resp_msg_v01,
+					   num_phy_valid),
+	},
+	{
+		.data_type	= QMI_UNSIGNED_1_BYTE,
+		.elem_len	= 1,
+		.elem_size	= sizeof(uint8_t),
+		.array_type	= NO_ARRAY,
+		.tlv_type	= 0x10,
+		.offset		= offsetof(struct qmi_wlanfw_phy_cap_resp_msg_v01,
+					   num_phy),
+	},
+	{
+		.data_type	= QMI_OPT_FLAG,
+		.elem_len	= 1,
+		.elem_size	= sizeof(uint8_t),
+		.array_type	= NO_ARRAY,
+		.tlv_type	= 0x11,
+		.offset		= offsetof(struct qmi_wlanfw_phy_cap_resp_msg_v01,
+					   board_id_valid),
+	},
+	{
+		.data_type	= QMI_UNSIGNED_4_BYTE,
+		.elem_len	= 1,
+		.elem_size	= sizeof(uint32_t),
+		.array_type	= NO_ARRAY,
+		.tlv_type	= 0x11,
+		.offset		= offsetof(struct qmi_wlanfw_phy_cap_resp_msg_v01,
+					   board_id),
+	},
+	{
+		.data_type	= QMI_OPT_FLAG,
+		.elem_len	= 1,
+		.elem_size	= sizeof(uint8_t),
+		.array_type	= NO_ARRAY,
+		.tlv_type	= 0x13,
+		.offset		= offsetof(struct qmi_wlanfw_phy_cap_resp_msg_v01,
+					   single_chip_mlo_support_valid),
+	},
+	{
+		.data_type	= QMI_UNSIGNED_1_BYTE,
+		.elem_len	= 1,
+		.elem_size	= sizeof(uint8_t),
+		.array_type	= NO_ARRAY,
+		.tlv_type	= 0x13,
+		.offset		 = offsetof(struct qmi_wlanfw_phy_cap_resp_msg_v01,
+					    single_chip_mlo_support),
+	},
+	{
+		.data_type	= QMI_EOTI,
+		.array_type	= NO_ARRAY,
+		.tlv_type	= QMI_COMMON_TLV_TYPE,
+	},
+};
+
 static const struct qmi_elem_info qmi_wlanfw_mem_cfg_s_v01_ei[] = {
 	{
 		.data_type	= QMI_UNSIGNED_8_BYTE,
@@ -5246,6 +4270,32 @@ static const struct qmi_elem_info qmi_wlanfw_soc_info_s_v01_ei[] = {
 	},
 };
 
+static const struct qmi_elem_info qmi_wlanfw_dev_mem_info_s_v01_ei[] = {
+	{
+		.data_type	= QMI_UNSIGNED_8_BYTE,
+		.elem_len	= 1,
+		.elem_size	= sizeof(uint64_t),
+		.array_type	= NO_ARRAY,
+		.tlv_type	= 0,
+		.offset		= offsetof(struct qmi_wlanfw_dev_mem_info_s_v01,
+					   start),
+	},
+	{
+		.data_type	= QMI_UNSIGNED_8_BYTE,
+		.elem_len	= 1,
+		.elem_size	= sizeof(uint64_t),
+		.array_type	= NO_ARRAY,
+		.tlv_type	= 0,
+		.offset		= offsetof(struct qmi_wlanfw_dev_mem_info_s_v01,
+					   size),
+	},
+	{
+		.data_type	= QMI_EOTI,
+		.array_type	= NO_ARRAY,
+		.tlv_type	= QMI_COMMON_TLV_TYPE,
+	},
+};
+
 static const struct qmi_elem_info qmi_wlanfw_fw_version_info_s_v01_ei[] = {
 	{
 		.data_type	= QMI_UNSIGNED_4_BYTE,
@@ -5467,6 +4517,59 @@ static const struct qmi_elem_info qmi_wlanfw_cap_resp_msg_v01_ei[] = {
 					   eeprom_read_timeout),
 	},
 	{
+		.data_type	= QMI_OPT_FLAG,
+		.elem_len	= 1,
+		.elem_size	= sizeof(uint8_t),
+		.array_type	= NO_ARRAY,
+		.tlv_type	= 0x1A,
+		.offset		= offsetof(struct qmi_wlanfw_cap_resp_msg_v01,
+					   fw_caps_valid),
+	},
+	{
+		.data_type	= QMI_UNSIGNED_8_BYTE,
+		.elem_len	= 1,
+		.elem_size	= sizeof(uint64_t),
+		.array_type	= NO_ARRAY,
+		.tlv_type	= 0x1A,
+		.offset		= offsetof(struct qmi_wlanfw_cap_resp_msg_v01, fw_caps),
+	},
+	{
+		.data_type	= QMI_OPT_FLAG,
+		.elem_len	= 1,
+		.elem_size	= sizeof(uint8_t),
+		.array_type	= NO_ARRAY,
+		.tlv_type	= 0x1B,
+		.offset		= offsetof(struct qmi_wlanfw_cap_resp_msg_v01,
+					   rd_card_chain_cap_valid),
+	},
+	{
+		.data_type	= QMI_UNSIGNED_4_BYTE,
+		.elem_len	= 1,
+		.elem_size	= sizeof(uint32_t),
+		.array_type	= NO_ARRAY,
+		.tlv_type	= 0x1B,
+		.offset		= offsetof(struct qmi_wlanfw_cap_resp_msg_v01,
+					   rd_card_chain_cap),
+	},
+	{
+		.data_type	= QMI_OPT_FLAG,
+		.elem_len	= 1,
+		.elem_size	= sizeof(uint8_t),
+		.array_type	= NO_ARRAY,
+		.tlv_type	= 0x1C,
+		.offset		= offsetof(struct qmi_wlanfw_cap_resp_msg_v01,
+					   dev_mem_info_valid),
+	},
+	{
+		.data_type	= QMI_STRUCT,
+		.elem_len	= ATH12K_QMI_WLFW_MAX_DEV_MEM_NUM_V01,
+		.elem_size	= sizeof(struct qmi_wlanfw_dev_mem_info_s_v01),
+		.array_type	= STATIC_ARRAY,
+		.tlv_type	= 0x1C,
+		.offset		= offsetof(struct qmi_wlanfw_cap_resp_msg_v01, dev_mem),
+		.ei_array	= qmi_wlanfw_dev_mem_info_s_v01_ei,
+	},
+	{
 		.data_type	= QMI_EOTI,
 		.array_type	= NO_ARRAY,
 		.tlv_type	= QMI_COMMON_TLV_TYPE,
@@ -5823,14 +4926,14 @@ static const struct qmi_elem_info qmi_wlanfw_shadow_reg_cfg_s_v01_ei[] = {
 	},
 };
 
-static const struct qmi_elem_info qmi_wlanfw_shadow_reg_v2_cfg_s_v01_ei[] = {
+static const struct qmi_elem_info qmi_wlanfw_shadow_reg_v3_cfg_s_v01_ei[] = {
 	{
 		.data_type	= QMI_UNSIGNED_4_BYTE,
 		.elem_len	= 1,
 		.elem_size	= sizeof(uint32_t),
 		.array_type	= NO_ARRAY,
 		.tlv_type	= 0,
-		.offset		= offsetof(struct qmi_wlanfw_shadow_reg_v2_cfg_s_v01,
+		.offset		= offsetof(struct qmi_wlanfw_shadow_reg_v3_cfg_s_v01,
 					   addr),
 	},
 	{
@@ -6002,28 +5105,28 @@ static const struct qmi_elem_info qmi_wlanfw_wlan_cfg_req_msg_v01_ei[] = {
 		.elem_len	= 1,
 		.elem_size	= sizeof(uint8_t),
 		.array_type	= NO_ARRAY,
-		.tlv_type	= 0x14,
+		.tlv_type	= 0x17,
 		.offset		= offsetof(struct qmi_wlanfw_wlan_cfg_req_msg_v01,
-					   shadow_reg_v2_valid),
+					   shadow_reg_v3_valid),
 	},
 	{
 		.data_type	= QMI_DATA_LEN,
 		.elem_len	= 1,
 		.elem_size	= sizeof(uint8_t),
 		.array_type	= NO_ARRAY,
-		.tlv_type	= 0x14,
+		.tlv_type	= 0x17,
 		.offset		= offsetof(struct qmi_wlanfw_wlan_cfg_req_msg_v01,
-					   shadow_reg_v2_len),
+					   shadow_reg_v3_len),
 	},
 	{
 		.data_type	= QMI_STRUCT,
-		.elem_len	= QMI_WLANFW_MAX_NUM_SHADOW_REG_V2_V01,
-		.elem_size	= sizeof(struct qmi_wlanfw_shadow_reg_v2_cfg_s_v01),
+		.elem_len	= QMI_WLANFW_MAX_NUM_SHADOW_REG_V3_V01,
+		.elem_size	= sizeof(struct qmi_wlanfw_shadow_reg_v3_cfg_s_v01),
 		.array_type	= VAR_LEN_ARRAY,
-		.tlv_type	= 0x14,
+		.tlv_type	= 0x17,
 		.offset		= offsetof(struct qmi_wlanfw_wlan_cfg_req_msg_v01,
-					   shadow_reg_v2),
-		.ei_array	= qmi_wlanfw_shadow_reg_v2_cfg_s_v01_ei,
+					   shadow_reg_v3),
+		.ei_array	= qmi_wlanfw_shadow_reg_v3_cfg_s_v01_ei,
 	},
 	{
 		.data_type	= QMI_EOTI,
@@ -6375,7 +5478,7 @@ qwz_qmi_decode_datalen(struct qwz_softc *sc, size_t *used, uint32_t *datalen,
 		printf("%s: bad datalen element size %u\n",
 		    sc->sc_dev.dv_xname, ei->elem_size);
 		return -1;
-		
+
 	}
 	*used = ei->elem_size;
 
@@ -6866,6 +5969,42 @@ qwz_qmi_decode_msg(struct qwz_softc *sc, void *output, size_t output_len,
 }
 
 void
+qwz_qmi_recv_wlanfw_phy_cap_req_v1(struct qwz_softc *sc, struct mbuf *m,
+    uint16_t txn_id, uint16_t msg_len)
+{
+	struct qmi_wlanfw_phy_cap_resp_msg_v01 resp;
+	const struct qmi_elem_info *ei;
+	uint8_t *msg = mtod(m, uint8_t *);
+
+	DNPRINTF(QWZ_D_QMI, "%s\n", __func__);
+
+	ei = qmi_wlanfw_phy_cap_resp_msg_v01_ei;
+	if (qwz_qmi_decode_msg(sc, &resp, sizeof(resp), ei, msg, msg_len))
+		return;
+
+	DNPRINTF(QWZ_D_QMI, "%s: resp.resp.result=0x%x\n",
+	    __func__, le16toh(resp.resp.result));
+	DNPRINTF(QWZ_D_QMI, "%s: resp.resp.error=0x%x\n",
+	    __func__, le16toh(resp.resp.error));
+	DNPRINTF(QWZ_D_QMI, "%s: resp.num_phy_valid=0x%x\n",
+	   __func__, resp.num_phy_valid);
+	DNPRINTF(QWZ_D_QMI, "%s: resp.num_phy=0x%x\n",
+	   __func__, resp.num_phy);
+	DNPRINTF(QWZ_D_QMI, "%s: resp.board_id_valid=0x%x\n",
+	   __func__, resp.board_id_valid);
+	DNPRINTF(QWZ_D_QMI, "%s: resp.board_id=0x%x\n",
+	   __func__, le32toh(resp.board_id));
+	DNPRINTF(QWZ_D_QMI, "%s: resp.single_chip_mlo_support_valid=0x%x\n",
+	   __func__, resp.single_chip_mlo_support_valid);
+	DNPRINTF(QWZ_D_QMI, "%s: resp.single_chip_mlo_support=0x%x\n",
+	   __func__, resp.single_chip_mlo_support);
+
+	sc->qmi_resp.result = le16toh(resp.resp.result);
+	sc->qmi_resp.error = le16toh(resp.resp.error);
+	wakeup(&sc->qmi_resp);
+}
+
+void
 qwz_qmi_recv_wlanfw_ind_register_req_v1(struct qwz_softc *sc, struct mbuf *m,
     uint16_t txn_id, uint16_t msg_len)
 {
@@ -6946,6 +6085,7 @@ qwz_qmi_recv_wlanfw_cap_resp_v1(struct qwz_softc *sc, struct mbuf *m,
 	struct qmi_wlanfw_cap_resp_msg_v01 resp;
 	const struct qmi_elem_info *ei;
 	uint8_t *msg = mtod(m, uint8_t *);
+	int i;
 
 	DNPRINTF(QWZ_D_QMI, "%s\n", __func__);
 
@@ -6979,6 +6119,20 @@ qwz_qmi_recv_wlanfw_cap_resp_v1(struct qwz_softc *sc, struct mbuf *m,
 		strlcpy(sc->qmi_target.fw_build_id, resp.fw_build_id,
 			sizeof(sc->qmi_target.fw_build_id));
 
+	if (resp.dev_mem_info_valid) {
+		for (i = 0; i < ATH12K_QMI_WLFW_MAX_DEV_MEM_NUM_V01; i++) {
+			sc->qmi_dev_mem[i].start =
+				resp.dev_mem[i].start;
+			sc->qmi_dev_mem[i].size =
+				resp.dev_mem[i].size;
+			DNPRINTF(QWZ_D_QMI,
+				   "%s: devmem [%d] start 0x%llx size %llu\n",
+				   sc->sc_dev.dv_xname, i,
+				   sc->qmi_dev_mem[i].start,
+				   sc->qmi_dev_mem[i].size);
+		}
+	}
+
 	if (resp.eeprom_read_timeout_valid) {
 		sc->qmi_target.eeprom_caldata = resp.eeprom_read_timeout;
 		DNPRINTF(QWZ_D_QMI,
@@ -7130,6 +6284,9 @@ qwz_qmi_recv_response(struct qwz_softc *sc, struct mbuf *m,
     uint16_t txn_id, uint16_t msg_id, uint16_t msg_len)
 {
 	switch (msg_id) {
+	case QMI_WLANFW_PHY_CAP_REQ_V01:
+		qwz_qmi_recv_wlanfw_phy_cap_req_v1(sc, m, txn_id, msg_len);
+		break;
 	case QMI_WLANFW_IND_REGISTER_REQ_V01:
 		qwz_qmi_recv_wlanfw_ind_register_req_v1(sc, m, txn_id, msg_len);
 		break;
@@ -7931,7 +7088,7 @@ qwz_qmi_send_request(struct qwz_softc *sc, uint16_t msg_id, size_t msg_len,
 	hdr.src_port_id = htole32(0x4000); /* TODO make human-readable */
 	hdr.dst_node_id = htole32(0x07); /* TODO make human-readable */
 	hdr.dst_port_id = htole32(0x01); /* TODO make human-readable */
-	hdr.size = htole32(encoded_len); 
+	hdr.size = htole32(encoded_len);
 
 	err = m_copyback(m, 0, sizeof(hdr), &hdr, M_NOWAIT);
 	if (err)
@@ -7958,6 +7115,40 @@ done:
 }
 
 int
+qwz_qmi_phy_cap_send(struct qwz_softc *sc)
+{
+	struct qmi_wlanfw_phy_cap_req_msg_v01 req;
+	int ret;
+
+	memset(&req, 0, sizeof(req));
+
+	DNPRINTF(QWZ_D_QMI, "%s: qmi phy cap request\n", __func__);
+
+	ret = qwz_qmi_send_request(sc, QMI_WLANFW_PHY_CAP_REQ_V01,
+			       QMI_WLANFW_PHY_CAP_REQ_MSG_V01_MAX_LEN,
+			       qmi_wlanfw_phy_cap_req_msg_v01_ei,
+			       &req, sizeof(req));
+	if (ret) {
+		printf("%s: failed to send phy cap request: %d\n",
+		    sc->sc_dev.dv_xname, ret);
+		return -1;
+	}
+
+	sc->qmi_resp.result = QMI_RESULT_FAILURE_V01;
+	while (sc->qmi_resp.result != QMI_RESULT_SUCCESS_V01) {
+		ret = tsleep_nsec(&sc->qmi_resp, 0, "qwzphycap",
+		    SEC_TO_NSEC(1));
+		if (ret) {
+			printf("%s: fw phy cap request timeout\n",
+			    sc->sc_dev.dv_xname);
+			return ret;
+		}
+	}
+
+	return 0;
+}
+
+int
 qwz_qmi_fw_ind_register_send(struct qwz_softc *sc)
 {
 	struct qmi_wlanfw_ind_register_req_msg_v01 req;
@@ -8000,7 +7191,7 @@ qwz_qmi_fw_ind_register_send(struct qwz_softc *sc)
 		return -1;
 	}
 
-	sc->qmi_resp.result = QMI_RESULT_FAILURE_V01; 
+	sc->qmi_resp.result = QMI_RESULT_FAILURE_V01;
 	while (sc->qmi_resp.result != QMI_RESULT_SUCCESS_V01) {
 		ret = tsleep_nsec(&sc->qmi_resp, 0, "qwzfwind",
 		    SEC_TO_NSEC(1));
@@ -8043,6 +7234,11 @@ qwz_qmi_host_cap_send(struct qwz_softc *sc)
 	req.cal_done_valid = 1;
 	req.cal_done = sc->qmi_cal_done;
 
+	if (sc->hw_params.qmi_cnss_feature_bitmap) {
+		req.feature_list_valid = 1;
+		req.feature_list = sc->hw_params.qmi_cnss_feature_bitmap;
+	}
+
 	if (sc->hw_params.internal_sleep_clock) {
 		req.nm_modem_valid = 1;
 
@@ -8060,8 +7256,6 @@ qwz_qmi_host_cap_send(struct qwz_softc *sc)
 	if (sc->hw_params.global_reset)
 		req.nm_modem |= QWZ_PLATFORM_CAP_PCIE_GLOBAL_RESET;
 
-	req.nm_modem |= QWZ_PLATFORM_CAP_PCIE_PME_D3COLD;
-
 	DNPRINTF(QWZ_D_QMI, "%s: qmi host cap request\n", __func__);
 
 	ret = qwz_qmi_send_request(sc, QMI_WLANFW_HOST_CAP_REQ_V01,
@@ -8074,7 +7268,7 @@ qwz_qmi_host_cap_send(struct qwz_softc *sc)
 		return -1;
 	}
 
-	sc->qmi_resp.result = QMI_RESULT_FAILURE_V01; 
+	sc->qmi_resp.result = QMI_RESULT_FAILURE_V01;
 	while (sc->qmi_resp.result != QMI_RESULT_SUCCESS_V01) {
 		ret = tsleep_nsec(&sc->qmi_resp, 0, "qwzfwhcap",
 		    SEC_TO_NSEC(1));
@@ -8151,7 +7345,7 @@ qwz_qmi_mem_seg_send(struct qwz_softc *sc)
 		    sc->sc_dev.dv_xname);
 		mem_seg_len = 0;
 	} else if (sc->fwmem == NULL || QWZ_DMA_LEN(sc->fwmem) < total_size) {
-		if (sc->fwmem != NULL) 
+		if (sc->fwmem != NULL)
 			qwz_dmamem_free(sc->sc_dmat, sc->fwmem);
 		sc->fwmem = qwz_dmamem_alloc(sc->sc_dmat, total_size, 65536);
 		if (sc->fwmem == NULL) {
@@ -8202,7 +7396,7 @@ qwz_qmi_mem_seg_send(struct qwz_softc *sc)
 		sc->qmi_resp.result = QMI_RESULT_SUCCESS_V01;
 	} else {
 		expected_result = QMI_RESULT_SUCCESS_V01;
-		sc->qmi_resp.result = QMI_RESULT_FAILURE_V01; 
+		sc->qmi_resp.result = QMI_RESULT_FAILURE_V01;
 	}
 	while (sc->qmi_resp.result != expected_result) {
 		ret = tsleep_nsec(&sc->qmi_resp, 0, "qwzfwrespmem",
@@ -8246,7 +7440,7 @@ qwz_core_check_dt(struct qwz_softc *sc)
 #ifdef __HAVE_FDT
 	if (sc->sc_node == 0)
 		return 0;
-	
+
 	OF_getprop(sc->sc_node, "qcom,ath12k-calibration-variant",
 	    sc->qmi_target.bdf_ext, sizeof(sc->qmi_target.bdf_ext) - 1);
 #endif
@@ -8274,7 +7468,7 @@ qwz_qmi_request_target_cap(struct qwz_softc *sc)
 		goto out;
 	}
 
-	sc->qmi_resp.result = QMI_RESULT_FAILURE_V01; 
+	sc->qmi_resp.result = QMI_RESULT_FAILURE_V01;
 	while (sc->qmi_resp.result != QMI_RESULT_SUCCESS_V01) {
 		ret = tsleep_nsec(&sc->qmi_resp, 0, "qwzfwcap",
 		    SEC_TO_NSEC(1));
@@ -8703,7 +7897,7 @@ qwz_qmi_load_file_target_mem(struct qwz_softc *sc, const u_char *data,
 			goto err_iounmap;
 		}
 
-		sc->qmi_resp.result = QMI_RESULT_FAILURE_V01; 
+		sc->qmi_resp.result = QMI_RESULT_FAILURE_V01;
 		while (sc->qmi_resp.result != QMI_RESULT_SUCCESS_V01) {
 			ret = tsleep_nsec(&sc->qmi_resp, 0, "qwzbdf",
 			    SEC_TO_NSEC(1));
@@ -8961,7 +8155,7 @@ qwz_qmi_wlanfw_m3_info_send(struct qwz_softc *sc)
 		return ret;
 	}
 
-	sc->qmi_resp.result = QMI_RESULT_FAILURE_V01; 
+	sc->qmi_resp.result = QMI_RESULT_FAILURE_V01;
 	while (sc->qmi_resp.result != QMI_RESULT_SUCCESS_V01) {
 		ret = tsleep_nsec(&sc->qmi_resp, 0, "qwzfwm3",
 		    SEC_TO_NSEC(1));
@@ -9017,7 +8211,7 @@ qwz_hal_srng_dst_get_next_entry(struct qwz_softc *sc, struct hal_srng *srng)
 
 	srng->u.dst_ring.tp += srng->entry_size;
 
-	/* wrap around to start of ring*/
+	/* wrap around to start of ring */
 	if (srng->u.dst_ring.tp == srng->ring_size)
 		srng->u.dst_ring.tp = 0;
 #ifdef notyet
@@ -9132,6 +8326,9 @@ qwz_dp_srng_calculate_msi_group(struct qwz_softc *sc, enum hal_ring_type type,
 	case HAL_RXDMA_MONITOR_DST:
 		grp_mask = &sc->hw_params.ring_mask->rx_mon_status[0];
 		break;
+	case HAL_TX_MONITOR_DST:
+		grp_mask = &sc->hw_params.ring_mask->tx_mon_dest[0];
+		break;
 	case HAL_RXDMA_DST:
 		grp_mask = &sc->hw_params.ring_mask->rxdma2host[0];
 		break;
@@ -9260,6 +8457,12 @@ qwz_dp_srng_setup(struct qwz_softc *sc, struct dp_srng *ring,
 		params.intr_batch_cntr_thres_entries = 0;
 		params.intr_timer_thres_us = HAL_SRNG_INT_TIMER_THRESHOLD_RX;
 		break;
+	case HAL_TX_MONITOR_DST:
+		params.low_threshold = DP_TX_MONITOR_BUF_SIZE_MAX >> 3;
+		params.flags |= HAL_SRNG_FLAGS_LOW_THRESH_INTR_EN;
+		params.intr_batch_cntr_thres_entries = 0;
+		params.intr_timer_thres_us = HAL_SRNG_INT_TIMER_THRESHOLD_RX;
+		break;
 	case HAL_WBM2SW_RELEASE:
 		if (ring_num < 3) {
 			params.intr_batch_cntr_thres_entries =
@@ -9456,6 +8659,7 @@ qwz_hal_setup_link_idle_list(struct qwz_softc *sc,
 	struct ath12k_buffer_addr *link_addr;
 	int i;
 	uint32_t reg_scatter_buf_sz = HAL_WBM_IDLE_SCATTER_BUF_SIZE / 64;
+	uint32_t val;
 
 	link_addr = (void *)sbuf[0].vaddr + HAL_WBM_IDLE_SCATTER_BUF_SIZE;
 
@@ -9519,9 +8723,11 @@ qwz_hal_setup_link_idle_list(struct qwz_softc *sc,
 	    2 * tot_link_desc);
 
 	/* Enable the SRNG */
+	val = HAL_WBM_IDLE_LINK_RING_MISC_SRNG_ENABLE;
+	val |= HAL_WBM_IDLE_LINK_RING_MISC_RIND_ID_DISABLE;
 	sc->ops.write32(sc,
 	    HAL_SEQ_WCSS_UMAC_WBM_REG + HAL_WBM_IDLE_LINK_RING_MISC_ADDR(sc),
-	    0x40);
+	    val);
 }
 
 void
@@ -9570,6 +8776,7 @@ qwz_dp_scatter_idle_link_desc_setup(struct qwz_softc *sc, int size,
 	int i;
 	int ret = 0;
 	uint32_t end_offset;
+	uint32_t cookie;
 
 	n_entries_per_buf = HAL_WBM_IDLE_SCATTER_BUF_SIZE /
 	    qwz_hal_srng_get_entrysize(sc, HAL_WBM_IDLE_LINK);
@@ -9598,7 +8805,8 @@ qwz_dp_scatter_idle_link_desc_setup(struct qwz_softc *sc, int size,
 		n_entries = DP_LINK_DESC_ALLOC_SIZE_THRESH / HAL_LINK_DESC_SIZE;
 		paddr = link_desc_banks[i].paddr;
 		while (n_entries) {
-			qwz_hal_set_link_desc_addr(scatter_buf, i, paddr);
+			cookie = DP_LINK_DESC_COOKIE_SET(n_entries, i);
+			qwz_hal_set_link_desc_addr(scatter_buf, cookie, paddr);
 			n_entries--;
 			paddr += HAL_LINK_DESC_SIZE;
 			if (rem_entries) {
@@ -9825,7 +9033,7 @@ qwz_dp_shadow_timer_handler(void *arg)
 #endif
 	s = splnet();
 
-	/* 
+	/*
 	 * Update HP if there were no TX operations during the timeout interval,
 	 * and stop the timer. Timer will be restarted if more TX happens.
 	 */
@@ -9859,7 +9067,6 @@ qwz_dp_srng_common_cleanup(struct qwz_softc *sc)
 	struct qwz_dp *dp = &sc->dp;
 	int i;
 
-	qwz_dp_stop_shadow_timers(sc);
 	qwz_dp_srng_cleanup(sc, &dp->wbm_desc_rel_ring);
 	qwz_dp_srng_cleanup(sc, &dp->tcl_cmd_ring);
 	qwz_dp_srng_cleanup(sc, &dp->tcl_status_ring);
@@ -10272,7 +9479,6 @@ qwz_hal_reo_cmd_send(struct qwz_softc *sc, struct hal_srng *srng,
 		break;
 	}
 
-	qwz_dp_shadow_start_timer(sc, srng, &sc->dp.reo_cmd_timer);
 out:
 	qwz_hal_srng_access_end(sc, srng);
 #ifdef notyet
@@ -10337,10 +9543,6 @@ qwz_dp_srng_common_setup(struct qwz_softc *sc)
 
 		srng = &sc->hal.srng_list[dp->tx_ring[i].tcl_data_ring.ring_id];
 		qwz_hal_tx_init_data_ring(sc, srng);
-
-		qwz_dp_shadow_init_timer(sc, &dp->tx_ring_timer[i],
-		    ATH12K_SHADOW_DP_TIMER_INTERVAL,
-		    dp->tx_ring[i].tcl_data_ring.ring_id);
 	}
 
 	ret = qwz_dp_srng_setup(sc, &dp->reo_reinject_ring, HAL_REO_REINJECT,
@@ -10378,9 +9580,6 @@ qwz_dp_srng_common_setup(struct qwz_softc *sc)
 	srng = &sc->hal.srng_list[dp->reo_cmd_ring.ring_id];
 	qwz_hal_reo_init_cmd_ring(sc, srng);
 
-	qwz_dp_shadow_init_timer(sc, &dp->reo_cmd_timer,
-	     ATH12K_SHADOW_CTRL_TIMER_INTERVAL, dp->reo_cmd_ring.ring_id);
-
 	ret = qwz_dp_srng_setup(sc, &dp->reo_status_ring, HAL_REO_STATUS,
 	    0, 0, DP_REO_STATUS_RING_SIZE);
 	if (ret) {
@@ -10460,6 +9659,313 @@ qwz_dp_tx_ring_alloc_tx_data(struct qwz_softc *sc, struct dp_tx_ring *tx_ring)
 	return 0;
 }
 
+enum ath12k_dp_desc_type {
+	ATH12K_DP_TX_DESC,
+	ATH12K_DP_RX_DESC,
+};
+
+int
+qwz_dp_cmem_init(struct qwz_softc *sc, struct qwz_dp *dp,
+    enum ath12k_dp_desc_type type)
+{
+	uint32_t cmem_base;
+	int i, start, end;
+
+	cmem_base = sc->qmi_dev_mem[ATH12K_QMI_DEVMEM_CMEM_INDEX].start;
+
+	switch (type) {
+	case ATH12K_DP_TX_DESC:
+		start = ATH12K_TX_SPT_PAGE_OFFSET;
+		end = start + ATH12K_NUM_TX_SPT_PAGES;
+		break;
+	case ATH12K_DP_RX_DESC:
+		start = ATH12K_RX_SPT_PAGE_OFFSET;
+		end = start + ATH12K_NUM_RX_SPT_PAGES;
+		break;
+	default:
+		printf("%s: invalid descriptor type %d in cmem init\n",
+		    sc->sc_dev.dv_xname, type);
+		return EINVAL;
+	}
+
+	/* Write to PPT in CMEM */
+	for (i = start; i < end; i++)
+		sc->ops.write32(sc, cmem_base + ATH12K_PPT_ADDR_OFFSET(i),
+		    QWZ_DMA_DVA(dp->spt_info[i].mem) >> ATH12K_SPT_4K_ALIGN_OFFSET);
+
+	return 0;
+}
+
+uint32_t qwz_dp_cc_cookie_gen(uint16_t ppt_idx, uint16_t spt_idx)
+{
+	return (uint32_t)ppt_idx << ATH12K_CC_PPT_SHIFT | spt_idx;
+}
+
+void *ath12k_dp_cc_get_desc_addr_ptr(struct qwz_softc *sc,
+    uint16_t ppt_idx, uint16_t spt_idx)
+{
+	struct qwz_dp *dp = &sc->dp;
+
+	return QWZ_DMA_KVA(dp->spt_info[ppt_idx].mem) + spt_idx;
+}
+
+int
+qwz_dp_cc_desc_init(struct qwz_softc *sc)
+{
+	struct qwz_dp *dp = &sc->dp;
+	struct ath12k_rx_desc_info *rx_descs, **rx_desc_addr;
+	struct ath12k_tx_desc_info *tx_descs, **tx_desc_addr;
+	uint32_t i, j, pool_id, tx_spt_page;
+	uint32_t ppt_idx;
+
+#ifdef notyet
+	spin_lock_bh(&dp->rx_desc_lock);
+#endif
+
+	/* First ATH12K_NUM_RX_SPT_PAGES of allocated SPT pages are used for RX */
+	for (i = 0; i < ATH12K_NUM_RX_SPT_PAGES; i++) {
+		rx_descs = mallocarray(ATH12K_MAX_SPT_ENTRIES, sizeof(*rx_descs),
+		    M_DEVBUF, M_NOWAIT | M_ZERO);
+
+		if (!rx_descs) {
+#ifdef notyet
+			spin_unlock_bh(&dp->rx_desc_lock);
+#endif
+			return ENOMEM;
+		}
+
+		ppt_idx = ATH12K_RX_SPT_PAGE_OFFSET + i;
+		dp->spt_info->rxbaddr[i] = &rx_descs[0];
+
+		for (j = 0; j < ATH12K_MAX_SPT_ENTRIES; j++) {
+			rx_descs[j].cookie = qwz_dp_cc_cookie_gen(ppt_idx, j);
+			rx_descs[j].magic = ATH12K_DP_RX_DESC_MAGIC;
+			TAILQ_INSERT_TAIL(&dp->rx_desc_free_list,
+			    &rx_descs[j], entry);
+
+			/* Update descriptor VA in SPT */
+			rx_desc_addr = ath12k_dp_cc_get_desc_addr_ptr(sc, ppt_idx, j);
+			*rx_desc_addr = &rx_descs[j];
+		}
+	}
+
+#ifdef notyet
+	spin_unlock_bh(&dp->rx_desc_lock);
+#endif
+
+	for (pool_id = 0; pool_id < ATH12K_HW_MAX_QUEUES; pool_id++) {
+#ifdef notyet
+		spin_lock_bh(&dp->tx_desc_lock[pool_id]);
+#endif
+		for (i = 0; i < ATH12K_TX_SPT_PAGES_PER_POOL; i++) {
+			tx_descs = mallocarray(ATH12K_MAX_SPT_ENTRIES, sizeof(*tx_descs),
+			    M_DEVBUF, M_NOWAIT | M_ZERO);
+
+			if (!tx_descs) {
+#ifdef notyet
+				spin_unlock_bh(&dp->tx_desc_lock[pool_id]);
+#endif
+				/* Caller takes care of TX pending and RX desc cleanup */
+				return ENOMEM;
+			}
+
+			tx_spt_page = i + pool_id * ATH12K_TX_SPT_PAGES_PER_POOL;
+			ppt_idx = ATH12K_TX_SPT_PAGE_OFFSET + tx_spt_page;
+
+			dp->spt_info->txbaddr[tx_spt_page] = &tx_descs[0];
+
+			for (j = 0; j < ATH12K_MAX_SPT_ENTRIES; j++) {
+				tx_descs[j].desc_id = qwz_dp_cc_cookie_gen(ppt_idx, j);
+				tx_descs[j].pool_id = pool_id;
+				TAILQ_INSERT_TAIL(&dp->tx_desc_free_list[pool_id],
+				    &tx_descs[j], entry);
+
+				/* Update descriptor VA in SPT */
+				tx_desc_addr =
+					ath12k_dp_cc_get_desc_addr_ptr(sc, ppt_idx, j);
+				*tx_desc_addr = &tx_descs[j];
+			}
+		}
+#ifdef notyet
+		spin_unlock_bh(&dp->tx_desc_lock[pool_id]);
+#endif
+	}
+	return 0;
+}
+
+void
+qwz_dp_cc_cleanup(struct qwz_softc *sc)
+{
+	// FIXME
+}
+
+int
+qwz_dp_cc_init(struct qwz_softc *sc)
+{
+	struct qwz_dp *dp = &sc->dp;
+	int i, ret = 0;
+
+	TAILQ_INIT(&dp->rx_desc_free_list);
+#ifdef notyet
+	spin_lock_init(&dp->rx_desc_lock);
+#endif
+
+	for (i = 0; i < ATH12K_HW_MAX_QUEUES; i++) {
+		TAILQ_INIT(&dp->tx_desc_free_list[i]);
+		TAILQ_INIT(&dp->tx_desc_used_list[i]);
+#ifdef notyet
+		spin_lock_init(&dp->tx_desc_lock[i]);
+#endif
+	}
+
+	dp->num_spt_pages = ATH12K_NUM_SPT_PAGES;
+	if (dp->num_spt_pages > ATH12K_MAX_PPT_ENTRIES)
+		dp->num_spt_pages = ATH12K_MAX_PPT_ENTRIES;
+
+	dp->spt_info = mallocarray(dp->num_spt_pages,
+	    sizeof(struct ath12k_spt_info),
+	    M_DEVBUF, M_NOWAIT | M_ZERO);
+	if (!dp->spt_info) {
+		printf("%s: SPT page allocation failure\n",
+		    sc->sc_dev.dv_xname);
+		return ENOMEM;
+	}
+
+	for (i = 0; i < dp->num_spt_pages; i++) {
+		dp->spt_info[i].mem = qwz_dmamem_alloc(sc->sc_dmat,
+		    ATH12K_PAGE_SIZE, PAGE_SIZE);
+		if (!dp->spt_info[i].mem) {
+			ret = ENOMEM;
+			goto free;
+		}
+
+		if (QWZ_DMA_DVA(dp->spt_info[i].mem) & ATH12K_SPT_4K_ALIGN_CHECK) {
+			printf("%s: SPT allocated memory is not 4K aligned\n",
+			    sc->sc_dev.dv_xname);
+			ret = EINVAL;
+			goto free;
+		}
+	}
+
+	ret = qwz_dp_cmem_init(sc, dp, ATH12K_DP_TX_DESC);
+	if (ret) {
+		printf("%s: HW CC Tx cmem init failed: %d\n",
+		    sc->sc_dev.dv_xname, ret);
+		goto free;
+	}
+
+	ret = qwz_dp_cmem_init(sc, dp, ATH12K_DP_RX_DESC);
+	if (ret) {
+		printf("%s: HW CC Rx cmem init failed: %d\n",
+		    sc->sc_dev.dv_xname, ret);
+		goto free;
+	}
+
+	ret = qwz_dp_cc_desc_init(sc);
+	if (ret) {
+		printf("%s: HW CC desc init failed: %d\n",
+		    sc->sc_dev.dv_xname, ret);
+		goto free;
+	}
+
+	return 0;
+free:
+	qwz_dp_cc_cleanup(sc);
+	return ret;
+}
+
+int
+qwz_dp_init_bank_profiles(struct qwz_softc *sc)
+{
+	return 0;
+}
+
+void
+qwz_dp_deinit_bank_profiles(struct qwz_softc *sc)
+{
+	// FIXME
+}
+
+int qwz_dp_rxdma_ring_buf_setup(struct qwz_softc *, struct dp_rxdma_ring *, uint32_t);
+
+int
+qwz_dp_rxdma_buf_setup(struct qwz_softc *sc)
+{
+	struct qwz_pdev_dp *dp = &sc->pdev_dp;
+	struct dp_rxdma_ring *rx_ring;
+	int ret;
+
+	rx_ring = &dp->rx_refill_buf_ring;
+	ret = qwz_dp_rxdma_ring_buf_setup(sc, rx_ring, HAL_RXDMA_BUF);
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+int
+qwz_dp_rx_alloc(struct qwz_softc *sc)
+{
+	struct qwz_pdev_dp *dp = &sc->pdev_dp;
+	int i, ret;
+
+#if notyet
+	idr_init(&dp->rxdma_mon_buf_ring.bufs_idr);
+	spin_lock_init(&dp->rxdma_mon_buf_ring.idr_lock);
+
+	idr_init(&dp->tx_mon_buf_ring.bufs_idr);
+	spin_lock_init(&dp->tx_mon_buf_ring.idr_lock);
+#endif
+
+	ret = qwz_dp_srng_setup(sc, &dp->rx_refill_buf_ring.refill_buf_ring,
+	    HAL_RXDMA_BUF, 0, dp->mac_id, DP_RXDMA_BUF_RING_SIZE);
+	if (ret) {
+		printf("%s: failed to setup rx_refill_buf_ring\n",
+		    sc->sc_dev.dv_xname);
+		return ret;
+	}
+
+	if (sc->hw_params.rx_mac_buf_ring) {
+		for (i = 0; i < sc->hw_params.num_rxmda_per_pdev; i++) {
+			ret = qwz_dp_srng_setup(sc, &dp->rx_mac_buf_ring[i],
+			    HAL_RXDMA_BUF, 1, dp->mac_id + i, 2048);
+			if (ret) {
+				printf("%s: failed to setup "
+				    "rx_mac_buf_ring %d\n",
+				    sc->sc_dev.dv_xname, i);
+				return ret;
+			}
+		}
+	}
+
+	for (i = 0; i < sc->hw_params.num_rxdma_dst_ring; i++) {
+		ret = qwz_dp_srng_setup(sc, &dp->rxdma_err_dst_ring[i],
+		    HAL_RXDMA_BUF, 0, dp->mac_id + i,
+		    DP_RXDMA_ERR_DST_RING_SIZE);
+		if (ret) {
+			printf("%s: failed to setup "
+			    "rxdma_err_dst_Ring %d\n",
+			    sc->sc_dev.dv_xname, i);
+			return ret;
+		}
+	}
+
+	ret = qwz_dp_rxdma_buf_setup(sc);
+	if (ret) {
+		printf("%s: failed to setup rxdma ring\n",
+		    sc->sc_dev.dv_xname);
+		return ret;
+	}
+
+	return 0;
+}
+
+void
+qwz_dp_rx_free(struct qwz_softc *sc)
+{
+	/* FIXME */
+}
+
 int
 qwz_dp_alloc(struct qwz_softc *sc)
 {
@@ -10498,10 +10004,18 @@ qwz_dp_alloc(struct qwz_softc *sc)
 		return ret;
 	}
 
-	ret = qwz_dp_srng_common_setup(sc);
+	ret = qwz_dp_cc_init(sc);
 	if (ret)
 		goto fail_link_desc_cleanup;
 
+	ret = qwz_dp_init_bank_profiles(sc);
+	if (ret)
+		goto fail_hw_cc_cleanup;
+
+	ret = qwz_dp_srng_common_setup(sc);
+	if (ret)
+		goto fail_dp_bank_profiles_cleanup;
+
 	size = sizeof(struct hal_wbm_release_ring) * DP_TX_COMP_RING_SIZE;
 
 	for (i = 0; i < sc->hw_params.max_tx_ring; i++) {
@@ -10529,11 +10043,21 @@ qwz_dp_alloc(struct qwz_softc *sc)
 	for (i = 0; i < HAL_DSCP_TID_MAP_TBL_NUM_ENTRIES_MAX; i++)
 		qwz_hal_tx_set_dscp_tid_map(sc, i);
 
+	ret = qwz_dp_rx_alloc(sc);
+	if (ret)
+		goto fail_dp_rx_free;
+
 	/* Init any SOC level resource for DP */
 
 	return 0;
+fail_dp_rx_free:
+	qwz_dp_rx_free(sc);
 fail_cmn_srng_cleanup:
 	qwz_dp_srng_common_cleanup(sc);
+fail_dp_bank_profiles_cleanup:
+	qwz_dp_deinit_bank_profiles(sc);
+fail_hw_cc_cleanup:
+	qwz_dp_cc_cleanup(sc);
 fail_link_desc_cleanup:
 	qwz_dp_link_desc_cleanup(sc, dp->link_desc_banks, HAL_WBM_IDLE_LINK,
 	    &dp->wbm_idle_ring);
@@ -10635,7 +10159,7 @@ qwz_qmi_wlanfw_wlan_ini_send(struct qwz_softc *sc, int enable)
 		return ret;
 	}
 
-	sc->qmi_resp.result = QMI_RESULT_FAILURE_V01; 
+	sc->qmi_resp.result = QMI_RESULT_FAILURE_V01;
 	while (sc->qmi_resp.result != QMI_RESULT_SUCCESS_V01) {
 		ret = tsleep_nsec(&sc->qmi_resp, 0, "qwzini",
 		    SEC_TO_NSEC(1));
@@ -10689,29 +10213,30 @@ qwz_qmi_wlanfw_wlan_cfg_send(struct qwz_softc *sc)
 	}
 	req->shadow_reg_valid = 0;
 
-	/* set shadow v2 configuration */
+	/* set shadow v3 configuration */
 	if (sc->hw_params.supports_shadow_regs) {
-		req->shadow_reg_v2_valid = 1;
-		req->shadow_reg_v2_len = MIN(sc->qmi_ce_cfg.shadow_reg_v2_len,
-		    QMI_WLANFW_MAX_NUM_SHADOW_REG_V2_V01);
-		memcpy(&req->shadow_reg_v2, sc->qmi_ce_cfg.shadow_reg_v2,
-		       sizeof(uint32_t) * req->shadow_reg_v2_len);
+		req->shadow_reg_v3_valid = 1;
+		req->shadow_reg_v3_len = MIN(sc->qmi_ce_cfg.shadow_reg_v3_len,
+		    QMI_WLANFW_MAX_NUM_SHADOW_REG_V3_V01);
+		memcpy(&req->shadow_reg_v3, sc->qmi_ce_cfg.shadow_reg_v3,
+		       sizeof(uint32_t) * req->shadow_reg_v3_len);
 	} else {
-		req->shadow_reg_v2_valid = 0;
+		req->shadow_reg_v3_valid = 0;
 	}
 
 	DNPRINTF(QWZ_D_QMI, "%s: wlan cfg req\n", __func__);
 
 	ret = qwz_qmi_send_request(sc, QMI_WLANFW_WLAN_CFG_REQ_V01,
 	    QMI_WLANFW_WLAN_CFG_REQ_MSG_V01_MAX_LEN,
-	    qmi_wlanfw_wlan_cfg_req_msg_v01_ei, req, sizeof(*req));
+	    qmi_wlanfw_wlan_cfg_req_msg_v01_ei,
+	    req, sizeof(*req));
 	if (ret) {
 		printf("%s: failed to send wlan config request: %d\n",
 		    sc->sc_dev.dv_xname, ret);
 		goto out;
 	}
 
-	sc->qmi_resp.result = QMI_RESULT_FAILURE_V01; 
+	sc->qmi_resp.result = QMI_RESULT_FAILURE_V01;
 	while (sc->qmi_resp.result != QMI_RESULT_SUCCESS_V01) {
 		ret = tsleep_nsec(&sc->qmi_resp, 0, "qwzwlancfg",
 		    SEC_TO_NSEC(1));
@@ -10745,7 +10270,7 @@ qwz_qmi_wlanfw_mode_send(struct qwz_softc *sc, enum ath12k_firmware_mode mode)
 		return ret;
 	}
 
-	sc->qmi_resp.result = QMI_RESULT_FAILURE_V01; 
+	sc->qmi_resp.result = QMI_RESULT_FAILURE_V01;
 	while (sc->qmi_resp.result != QMI_RESULT_SUCCESS_V01) {
 		ret = tsleep_nsec(&sc->qmi_resp, 0, "qwzfwmode",
 		    SEC_TO_NSEC(1));
@@ -10811,8 +10336,8 @@ qwz_core_start_firmware(struct qwz_softc *sc, enum ath12k_firmware_mode mode)
 {
 	int ret;
 
-	qwz_ce_get_shadow_config(sc, &sc->qmi_ce_cfg.shadow_reg_v2,
-	    &sc->qmi_ce_cfg.shadow_reg_v2_len);
+	qwz_ce_get_shadow_config(sc, &sc->qmi_ce_cfg.shadow_reg_v3,
+	    &sc->qmi_ce_cfg.shadow_reg_v3_len);
 
 	ret = qwz_qmi_firmware_start(sc, mode);
 	if (ret) {
@@ -13726,6 +13251,8 @@ qwz_htc_service_name(enum ath12k_htc_svc_id id)
 		return "IPA TX";
 	case ATH12K_HTC_SVC_ID_PKT_LOG:
 		return "PKT LOG";
+	case ATH12K_HTC_SVC_ID_WMI_CONTROL_DIAG:
+		return "WMI DIAG";
 	}
 
 	return "Unknown";
@@ -14236,12 +13763,6 @@ qwz_htc_wait_target(struct qwz_softc *sc)
 		return EINVAL;
 	}
 
-	/* For QCA6390, wmi endpoint uses 1 credit to avoid
-	 * back-to-back write.
-	 */
-	if (sc->hw_params.supports_shadow_regs)
-		htc->total_transmit_credits = 1;
-
 	qwz_htc_setup_target_buffer_assignments(htc);
 
 	return 0;
@@ -14514,43 +14035,32 @@ int
 qwz_dp_rx_pdev_srng_alloc(struct qwz_softc *sc)
 {
 	struct qwz_pdev_dp *dp = &sc->pdev_dp;
-#if 0
 	struct dp_srng *srng = NULL;
-#endif
 	int i;
 	int ret;
 
-	ret = qwz_dp_srng_setup(sc, &dp->rx_refill_buf_ring.refill_buf_ring,
-	    HAL_RXDMA_BUF, 0, dp->mac_id, DP_RXDMA_BUF_RING_SIZE);
-	if (ret) {
-		printf("%s: failed to setup rx_refill_buf_ring\n",
-		    sc->sc_dev.dv_xname);
-		return ret;
-	}
-
-	if (sc->hw_params.rx_mac_buf_ring) {
-		for (i = 0; i < sc->hw_params.num_rxmda_per_pdev; i++) {
-			ret = qwz_dp_srng_setup(sc, &dp->rx_mac_buf_ring[i],
-			    HAL_RXDMA_BUF, 1, dp->mac_id + i, 1024);
-			if (ret) {
-				printf("%s: failed to setup "
-				    "rx_mac_buf_ring %d\n",
-				    sc->sc_dev.dv_xname, i);
-				return ret;
-			}
+	for (i = 0; i < sc->hw_params.num_rxmda_per_pdev; i++) {
+		srng = &dp->rxdma_mon_dst_ring[i];
+		ret = qwz_dp_srng_setup(sc, srng, HAL_RXDMA_MONITOR_DST, 0,
+		    dp->mac_id + i, DP_RXDMA_MONITOR_DST_RING_SIZE);
+		if (ret) {
+			printf("%s: failed to setup "
+			    "rxdma_mon_dst_ring %d\n",
+			    sc->sc_dev.dv_xname, i);
+			return ret;
 		}
-	}
 
-	for (i = 0; i < sc->hw_params.num_rxmda_per_pdev; i++) {
-		ret = qwz_dp_srng_setup(sc, &dp->rxdma_err_dst_ring[i],
-		    HAL_RXDMA_DST, 0, dp->mac_id + i,
-		    DP_RXDMA_ERR_DST_RING_SIZE);
+		srng = &dp->tx_mon_dst_ring[i];
+		ret = qwz_dp_srng_setup(sc, srng, HAL_TX_MONITOR_DST, 0,
+		    dp->mac_id + i, DP_TX_MONITOR_DEST_RING_SIZE);
 		if (ret) {
-			printf("%s: failed to setup rxdma_err_dst_ring %d\n",
-			   sc->sc_dev.dv_xname, i);
+			printf("%s: failed to setup "
+			    "tx_mon_dst_ring %d\n",
+			    sc->sc_dev.dv_xname, i);
 			return ret;
 		}
 	}
+
 #if 0
 	for (i = 0; i < sc->hw_params.num_rxmda_per_pdev; i++) {
 		srng = &dp->rx_mon_status_refill_ring[i].refill_buf_ring;
@@ -14563,7 +14073,6 @@ qwz_dp_rx_pdev_srng_alloc(struct qwz_softc *sc)
 			return ret;
 		}
 	}
-#endif
 	/* if rxdma1_enable is false, then it doesn't need
 	 * to setup rxdam_mon_buf_ring, rxdma_mon_dst_ring
 	 * and rxdma_mon_desc_ring.
@@ -14573,7 +14082,7 @@ qwz_dp_rx_pdev_srng_alloc(struct qwz_softc *sc)
 		timeout_set(&sc->mon_reap_timer, qwz_dp_service_mon_ring, sc);
 		return 0;
 	}
-#if 0
+
 	ret = ath12k_dp_srng_setup(ar->ab,
 				   &dp->rxdma_mon_buf_ring.refill_buf_ring,
 				   HAL_RXDMA_MONITOR_BUF, 0, dp->mac_id,
@@ -14750,7 +14259,7 @@ qwz_dp_rxbufs_replenish(struct qwz_softc *sc, int mac_id,
 			if (ret)
 				goto fail_free_mbuf;
 		}
-		
+
 		ret = bus_dmamap_load_mbuf(sc->sc_dmat, rx_data->map, m,
 		    BUS_DMA_READ | BUS_DMA_NOWAIT);
 		if (ret) {
@@ -14897,25 +14406,19 @@ qwz_dp_tx_get_ring_id_type(struct qwz_softc *sc, int mac_id, uint32_t ring_id,
     enum hal_ring_type ring_type, enum htt_srng_ring_type *htt_ring_type,
     enum htt_srng_ring_id *htt_ring_id)
 {
-	int lmac_ring_id_offset = 0;
-
 	switch (ring_type) {
 	case HAL_RXDMA_BUF:
-		lmac_ring_id_offset = mac_id * HAL_SRNG_RINGS_PER_LMAC;
-
 		/* for QCA6390, host fills rx buffer to fw and fw fills to
 		 * rxbuf ring for each rxdma
 		 */
 		if (!sc->hw_params.rx_mac_buf_ring) {
-			if (!(ring_id == (HAL_SRNG_RING_ID_WMAC1_SW2RXDMA0_BUF +
-			    lmac_ring_id_offset) ||
-			    ring_id == (HAL_SRNG_RING_ID_WMAC1_SW2RXDMA1_BUF +
-			    lmac_ring_id_offset)))
+			if (!(ring_id == HAL_SRNG_SW2RXDMA_BUF0 ||
+			    ring_id == HAL_SRNG_SW2RXDMA_BUF1))
 				return EINVAL;
 			*htt_ring_id = HTT_RXDMA_HOST_BUF_RING;
 			*htt_ring_type = HTT_SW_TO_HW_RING;
 		} else {
-			if (ring_id == HAL_SRNG_RING_ID_WMAC1_SW2RXDMA0_BUF) {
+			if (ring_id == HAL_SRNG_SW2RXDMA_BUF0) {
 				*htt_ring_id = HTT_HOST1_TO_FW_RXBUF_RING;
 				*htt_ring_type = HTT_SW_TO_SW_RING;
 			} else {
@@ -15180,12 +14683,14 @@ qwz_dp_rx_pdev_alloc(struct qwz_softc *sc, int mac_id)
 		return ret;
 	}
 
+#if 0
 	ret = qwz_dp_rxdma_pdev_buf_setup(sc);
 	if (ret) {
 		printf("%s: failed to setup rxdma ring: %d\n",
 		    sc->sc_dev.dv_xname, ret);
 		return ret;
 	}
+#endif
 
 	ring_id = dp->rx_refill_buf_ring.refill_buf_ring.ring_id;
 	ret = qwz_dp_tx_htt_srng_setup(sc, ring_id, mac_id, HAL_RXDMA_BUF);
@@ -15195,20 +14700,6 @@ qwz_dp_rx_pdev_alloc(struct qwz_softc *sc, int mac_id)
 		return ret;
 	}
 
-	if (sc->hw_params.rx_mac_buf_ring) {
-		for (i = 0; i < sc->hw_params.num_rxmda_per_pdev; i++) {
-			ring_id = dp->rx_mac_buf_ring[i].ring_id;
-			ret = qwz_dp_tx_htt_srng_setup(sc, ring_id,
-			    mac_id + i, HAL_RXDMA_BUF);
-			if (ret) {
-				printf("%s: failed to configure "
-				    "rx_mac_buf_ring%d: %d\n",
-				    sc->sc_dev.dv_xname, i, ret);
-				return ret;
-			}
-		}
-	}
-
 	for (i = 0; i < sc->hw_params.num_rxmda_per_pdev; i++) {
 		ring_id = dp->rxdma_err_dst_ring[i].ring_id;
 		ret = qwz_dp_tx_htt_srng_setup(sc, ring_id, mac_id + i,
@@ -15586,7 +15077,7 @@ qwz_dp_tx_complete_msdu(struct qwz_softc *sc, struct dp_tx_ring *tx_ring,
 
 	ieee80211_release_node(ic, tx_data->ni);
 	tx_data->ni = NULL;
-	
+
 	if (tx_ring->queued > 0)
 		tx_ring->queued--;
 }
@@ -15620,8 +15111,8 @@ qwz_dp_tx_completion_handler(struct qwz_softc *sc, int ring_id)
 		    QWZ_TX_COMPL_NEXT(tx_ring->tx_status_head);
 	}
 #if 0
-	if (unlikely((ath12k_hal_srng_dst_peek(ab, status_ring) != NULL) &&
-		     (ATH12K_TX_COMPL_NEXT(tx_ring->tx_status_head) ==
+	if (unlikely((qwz_hal_srng_dst_peek(ab, status_ring) != NULL) &&
+		     (QWZ_TX_COMPL_NEXT(tx_ring->tx_status_head) ==
 		      tx_ring->tx_status_tail))) {
 		/* TODO: Process pending tx_status messages when kfifo_is_full() */
 		ath12k_warn(ab, "Unable to process some of the tx_status ring desc because status_fifo is full\n");
@@ -15920,7 +15411,7 @@ qwz_dp_process_rx_err(struct qwz_softc *sc)
 		    (paddr - link_desc_banks[desc_bank].paddr);
 		qwz_hal_rx_msdu_link_info_get(link_desc_va, &num_msdus,
 		    msdu_cookies, &rbm);
-		if (rbm != HAL_RX_BUF_RBM_WBM_IDLE_DESC_LIST &&
+		if (rbm != HAL_RX_BUF_RBM_WBM_CHIP0_IDLE_DESC_LIST &&
 		    rbm != HAL_RX_BUF_RBM_SW3_BM) {
 #if 0
 			ab->soc_stats.invalid_rbm++;
@@ -16159,7 +15650,7 @@ qwz_dp_rx_process_wbm_err(struct qwz_softc *sc)
 
 		if (mac_id >= MAX_RADIOS)
 			continue;
-	
+
 		rx_ring = &sc->pdev_dp.rx_refill_buf_ring;
 		if (idx >= rx_ring->bufs_max || isset(rx_ring->freemap, idx))
 			continue;
@@ -16865,7 +16356,7 @@ qwz_dp_rx_alloc_mon_status_buf(struct qwz_softc *sc,
 		if (ret)
 			goto fail_free_mbuf;
 	}
-	
+
 	ret = bus_dmamap_load_mbuf(sc->sc_dmat, rx_data->map, m,
 	    BUS_DMA_READ | BUS_DMA_NOWAIT);
 	if (ret) {
@@ -17139,6 +16630,7 @@ qwz_dp_process_rxdma_err(struct qwz_softc *sc, int mac_id)
 	void *desc;
 	int num_buf_freed = 0;
 	uint64_t paddr;
+	uint32_t cookie;
 	uint32_t desc_bank;
 	void *link_desc_va;
 	int num_msdus;
@@ -17156,7 +16648,9 @@ qwz_dp_process_rxdma_err(struct qwz_softc *sc, int mac_id)
 	qwz_hal_srng_access_begin(sc, srng);
 
 	while ((desc = qwz_hal_srng_dst_get_next_entry(sc, srng))) {
-		qwz_hal_rx_reo_ent_paddr_get(sc, desc, &paddr, &desc_bank);
+		qwz_hal_rx_reo_ent_paddr_get(sc, desc, &paddr, &cookie);
+		desc_bank = FIELD_GET(DP_LINK_DESC_BANK_MASK,
+		    cookie);
 
 		entr_ring = (struct hal_reo_entrance_ring *)desc;
 		rxdma_err_code = FIELD_GET(
@@ -19677,7 +19171,7 @@ qwz_core_stop(struct qwz_softc *sc)
 {
 	if (!test_bit(ATH12K_FLAG_CRASH_FLUSH, sc->sc_flags))
 		qwz_qmi_firmware_stop(sc);
-	
+
 	sc->ops.stop(sc);
 	qwz_wmi_detach(sc);
 	qwz_dp_pdev_reo_cleanup(sc);
@@ -19889,6 +19383,14 @@ qwz_qmi_event_server_arrive(struct qwz_softc *sc)
 	sc->fw_init_done = 0;
 	sc->expect_fwmem_req = 1;
 
+	ret = qwz_qmi_phy_cap_send(sc);
+	if (ret < 0) {
+		printf("%s: failed to send qmi phy cap: %d\n",
+		    sc->sc_dev.dv_xname, ret);
+		sc->expect_fwmem_req = 0;
+		return ret;
+	}
+
 	ret = qwz_qmi_fw_ind_register_send(sc);
 	if (ret < 0) {
 		printf("%s: failed to send qmi firmware indication: %d\n",
@@ -19949,13 +19451,17 @@ qwz_core_init(struct qwz_softc *sc)
 
 	error = qwz_qmi_init_service(sc);
 	if (error) {
-		printf("failed to initialize qmi :%d\n", error);
+		printf("%s: failed to initialize qmi :%d\n",
+		    sc->sc_dev.dv_xname, error);
 		return error;
 	}
 
 	error = sc->ops.power_up(sc);
-	if (error)
+	if (error) {
+		printf("%s: failed to power up :%d\n",
+		    sc->sc_dev.dv_xname, error);
 		qwz_qmi_deinit_service(sc);
+	}
 
 	return error;
 }
@@ -19974,7 +19480,7 @@ qwz_init_hw_params(struct qwz_softc *sc)
 	}
 
 	if (i == nitems(ath12k_hw_params)) {
-		printf("%s: Unsupported hardware version: 0x%x\n",
+		printf("%s: unsupported hardware version: 0x%x\n",
 		    sc->sc_dev.dv_xname, sc->sc_hw_rev);
 		return EINVAL;
 	}
@@ -19986,186 +19492,210 @@ qwz_init_hw_params(struct qwz_softc *sc)
 	return 0;
 }
 
-static const struct hal_srng_config hw_srng_config_templ[QWZ_NUM_SRNG_CFG] = {
+static const struct hal_srng_config hw_srng_config_templ[] = {
 	/* TODO: max_rings can populated by querying HW capabilities */
-	{ /* REO_DST */
+	[HAL_REO_DST] = {
 		.start_ring_id = HAL_SRNG_RING_ID_REO2SW1,
-		.max_rings = 4,
-		.entry_size = sizeof(struct hal_reo_dest_ring) >> 2,
-		.lmac_ring = false,
+		.max_rings = 8,
+		.entry_size = sizeof(struct ath12k_hal_reo_dest_ring) >> 2,
+		.mac_type = ATH12K_HAL_SRNG_UMAC,
 		.ring_dir = HAL_SRNG_DIR_DST,
 		.max_size = HAL_REO_REO2SW1_RING_BASE_MSB_RING_SIZE,
 	},
-
-	{ /* REO_EXCEPTION */
-		/* Designating REO2TCL ring as exception ring. This ring is
-		 * similar to other REO2SW rings though it is named as REO2TCL.
+	[HAL_REO_EXCEPTION] = {
+		/* Designating REO2SW0 ring as exception ring.
 		 * Any of theREO2SW rings can be used as exception ring.
 		 */
-		.start_ring_id = HAL_SRNG_RING_ID_REO2TCL,
+		.start_ring_id = HAL_SRNG_RING_ID_REO2SW0,
 		.max_rings = 1,
-		.entry_size = sizeof(struct hal_reo_dest_ring) >> 2,
-		.lmac_ring = false,
+		.entry_size = sizeof(struct ath12k_hal_reo_dest_ring) >> 2,
+		.mac_type = ATH12K_HAL_SRNG_UMAC,
 		.ring_dir = HAL_SRNG_DIR_DST,
-		.max_size = HAL_REO_REO2TCL_RING_BASE_MSB_RING_SIZE,
+		.max_size = HAL_REO_REO2SW0_RING_BASE_MSB_RING_SIZE,
 	},
-	{ /* REO_REINJECT */
+	[HAL_REO_REINJECT] = {
 		.start_ring_id = HAL_SRNG_RING_ID_SW2REO,
-		.max_rings = 1,
+		.max_rings = 4,
 		.entry_size = sizeof(struct hal_reo_entrance_ring) >> 2,
-		.lmac_ring = false,
+		.mac_type = ATH12K_HAL_SRNG_UMAC,
 		.ring_dir = HAL_SRNG_DIR_SRC,
 		.max_size = HAL_REO_SW2REO_RING_BASE_MSB_RING_SIZE,
 	},
-	{ /* REO_CMD */
+	[HAL_REO_CMD] = {
 		.start_ring_id = HAL_SRNG_RING_ID_REO_CMD,
 		.max_rings = 1,
-		.entry_size = (sizeof(struct hal_tlv_hdr) +
-			sizeof(struct hal_reo_get_queue_stats)) >> 2,
-		.lmac_ring = false,
+		.entry_size = (sizeof(struct hal_tlv_64_hdr) +
+		    sizeof(struct ath12k_hal_reo_get_queue_stats)) >> 2,
+		.mac_type = ATH12K_HAL_SRNG_UMAC,
 		.ring_dir = HAL_SRNG_DIR_SRC,
 		.max_size = HAL_REO_CMD_RING_BASE_MSB_RING_SIZE,
 	},
-	{ /* REO_STATUS */
+	[HAL_REO_STATUS] = {
 		.start_ring_id = HAL_SRNG_RING_ID_REO_STATUS,
 		.max_rings = 1,
-		.entry_size = (sizeof(struct hal_tlv_hdr) +
-			sizeof(struct hal_reo_get_queue_stats_status)) >> 2,
-		.lmac_ring = false,
+		.entry_size = (sizeof(struct hal_tlv_64_hdr) +
+		    sizeof(struct hal_reo_get_queue_stats_status)) >> 2,
+		.mac_type = ATH12K_HAL_SRNG_UMAC,
 		.ring_dir = HAL_SRNG_DIR_DST,
 		.max_size = HAL_REO_STATUS_RING_BASE_MSB_RING_SIZE,
 	},
-	{ /* TCL_DATA */
+	[HAL_TCL_DATA] = {
 		.start_ring_id = HAL_SRNG_RING_ID_SW2TCL1,
-		.max_rings = 3,
-		.entry_size = (sizeof(struct hal_tlv_hdr) +
-			     sizeof(struct hal_tcl_data_cmd)) >> 2,
-		.lmac_ring = false,
+		.max_rings = 6,
+		.entry_size = sizeof(struct ath12k_hal_tcl_data_cmd) >> 2,
+		.mac_type = ATH12K_HAL_SRNG_UMAC,
 		.ring_dir = HAL_SRNG_DIR_SRC,
 		.max_size = HAL_SW2TCL1_RING_BASE_MSB_RING_SIZE,
 	},
-	{ /* TCL_CMD */
+	[HAL_TCL_CMD] = {
 		.start_ring_id = HAL_SRNG_RING_ID_SW2TCL_CMD,
 		.max_rings = 1,
-		.entry_size = (sizeof(struct hal_tlv_hdr) +
-			     sizeof(struct hal_tcl_gse_cmd)) >> 2,
-		.lmac_ring =  false,
+		.entry_size = sizeof(struct hal_tcl_gse_cmd) >> 2,
+		.mac_type = ATH12K_HAL_SRNG_UMAC,
 		.ring_dir = HAL_SRNG_DIR_SRC,
 		.max_size = HAL_SW2TCL1_CMD_RING_BASE_MSB_RING_SIZE,
 	},
-	{ /* TCL_STATUS */
+	[HAL_TCL_STATUS] = {
 		.start_ring_id = HAL_SRNG_RING_ID_TCL_STATUS,
 		.max_rings = 1,
 		.entry_size = (sizeof(struct hal_tlv_hdr) +
-			     sizeof(struct hal_tcl_status_ring)) >> 2,
-		.lmac_ring = false,
+		    sizeof(struct hal_tcl_status_ring)) >> 2,
+		.mac_type = ATH12K_HAL_SRNG_UMAC,
 		.ring_dir = HAL_SRNG_DIR_DST,
 		.max_size = HAL_TCL_STATUS_RING_BASE_MSB_RING_SIZE,
 	},
-	{ /* CE_SRC */
+	[HAL_CE_SRC] = {
 		.start_ring_id = HAL_SRNG_RING_ID_CE0_SRC,
-		.max_rings = 12,
+		.max_rings = 16,
 		.entry_size = sizeof(struct hal_ce_srng_src_desc) >> 2,
-		.lmac_ring = false,
+		.mac_type = ATH12K_HAL_SRNG_UMAC,
 		.ring_dir = HAL_SRNG_DIR_SRC,
 		.max_size = HAL_CE_SRC_RING_BASE_MSB_RING_SIZE,
 	},
-	{ /* CE_DST */
+	[HAL_CE_DST] = {
 		.start_ring_id = HAL_SRNG_RING_ID_CE0_DST,
-		.max_rings = 12,
+		.max_rings = 16,
 		.entry_size = sizeof(struct hal_ce_srng_dest_desc) >> 2,
-		.lmac_ring = false,
+		.mac_type = ATH12K_HAL_SRNG_UMAC,
 		.ring_dir = HAL_SRNG_DIR_SRC,
 		.max_size = HAL_CE_DST_RING_BASE_MSB_RING_SIZE,
 	},
-	{ /* CE_DST_STATUS */
+	[HAL_CE_DST_STATUS] = {
 		.start_ring_id = HAL_SRNG_RING_ID_CE0_DST_STATUS,
-		.max_rings = 12,
+		.max_rings = 16,
 		.entry_size = sizeof(struct hal_ce_srng_dst_status_desc) >> 2,
-		.lmac_ring = false,
+		.mac_type = ATH12K_HAL_SRNG_UMAC,
 		.ring_dir = HAL_SRNG_DIR_DST,
 		.max_size = HAL_CE_DST_STATUS_RING_BASE_MSB_RING_SIZE,
 	},
-	{ /* WBM_IDLE_LINK */
+	[HAL_WBM_IDLE_LINK] = {
 		.start_ring_id = HAL_SRNG_RING_ID_WBM_IDLE_LINK,
 		.max_rings = 1,
 		.entry_size = sizeof(struct hal_wbm_link_desc) >> 2,
-		.lmac_ring = false,
+		.mac_type = ATH12K_HAL_SRNG_UMAC,
 		.ring_dir = HAL_SRNG_DIR_SRC,
 		.max_size = HAL_WBM_IDLE_LINK_RING_BASE_MSB_RING_SIZE,
 	},
-	{ /* SW2WBM_RELEASE */
-		.start_ring_id = HAL_SRNG_RING_ID_WBM_SW_RELEASE,
-		.max_rings = 1,
+	[HAL_SW2WBM_RELEASE] = {
+		.start_ring_id = HAL_SRNG_RING_ID_WBM_SW0_RELEASE,
+		.max_rings = 2,
 		.entry_size = sizeof(struct hal_wbm_release_ring) >> 2,
-		.lmac_ring = false,
+		.mac_type = ATH12K_HAL_SRNG_UMAC,
 		.ring_dir = HAL_SRNG_DIR_SRC,
 		.max_size = HAL_SW2WBM_RELEASE_RING_BASE_MSB_RING_SIZE,
 	},
-	{ /* WBM2SW_RELEASE */
+	[HAL_WBM2SW_RELEASE] = {
 		.start_ring_id = HAL_SRNG_RING_ID_WBM2SW0_RELEASE,
-		.max_rings = 5,
+		.max_rings = 8,
 		.entry_size = sizeof(struct hal_wbm_release_ring) >> 2,
-		.lmac_ring = false,
+		.mac_type = ATH12K_HAL_SRNG_UMAC,
 		.ring_dir = HAL_SRNG_DIR_DST,
 		.max_size = HAL_WBM2SW_RELEASE_RING_BASE_MSB_RING_SIZE,
 	},
-	{ /* RXDMA_BUF */
-		.start_ring_id = HAL_SRNG_RING_ID_WMAC1_SW2RXDMA0_BUF,
-		.max_rings = 2,
+	[HAL_RXDMA_BUF] = {
+		.start_ring_id = HAL_SRNG_SW2RXDMA_BUF0,
+		.max_rings = 1,
 		.entry_size = sizeof(struct hal_wbm_buffer_ring) >> 2,
+		.mac_type = ATH12K_HAL_SRNG_DMAC,
 		.lmac_ring = true,
 		.ring_dir = HAL_SRNG_DIR_SRC,
-		.max_size = HAL_RXDMA_RING_MAX_SIZE,
+		.max_size = HAL_RXDMA_RING_MAX_SIZE_BE,
 	},
-	{ /* RXDMA_DST */
+	[HAL_RXDMA_DST] = {
 		.start_ring_id = HAL_SRNG_RING_ID_WMAC1_RXDMA2SW0,
-		.max_rings = 1,
-		.entry_size = sizeof(struct hal_reo_entrance_ring) >> 2,
+		.max_rings = 0,
+		.entry_size = 0,
+		.mac_type = ATH12K_HAL_SRNG_PMAC,
 		.lmac_ring = true,
 		.ring_dir = HAL_SRNG_DIR_DST,
-		.max_size = HAL_RXDMA_RING_MAX_SIZE,
+		.max_size = HAL_RXDMA_RING_MAX_SIZE_BE,
 	},
-	{ /* RXDMA_MONITOR_BUF */
-		.start_ring_id = HAL_SRNG_RING_ID_WMAC1_SW2RXDMA2_BUF,
+	[HAL_RXDMA_MONITOR_BUF] = {
+		.start_ring_id = HAL_SRNG_SW2RXMON_BUF0,
 		.max_rings = 1,
-		.entry_size = sizeof(struct hal_wbm_buffer_ring) >> 2,
+		.entry_size = sizeof(struct hal_mon_buf_ring) >> 2,
+		.mac_type = ATH12K_HAL_SRNG_PMAC,
 		.lmac_ring = true,
 		.ring_dir = HAL_SRNG_DIR_SRC,
-		.max_size = HAL_RXDMA_RING_MAX_SIZE,
+		.max_size = HAL_RXDMA_RING_MAX_SIZE_BE,
 	},
-	{ /* RXDMA_MONITOR_STATUS */
-		.start_ring_id = HAL_SRNG_RING_ID_WMAC1_SW2RXDMA1_STATBUF,
-		.max_rings = 1,
-		.entry_size = sizeof(struct hal_wbm_buffer_ring) >> 2,
+	[HAL_RXDMA_MONITOR_STATUS] = { 0, },
+	[HAL_RXDMA_MONITOR_DESC] = { 0, },
+	[HAL_RXDMA_DIR_BUF] = {
+		.start_ring_id = HAL_SRNG_RING_ID_RXDMA_DIR_BUF,
+		.max_rings = 2,
+		.entry_size = 8 >> 2, /* TODO: Define the struct */
+		.mac_type = ATH12K_HAL_SRNG_PMAC,
 		.lmac_ring = true,
 		.ring_dir = HAL_SRNG_DIR_SRC,
-		.max_size = HAL_RXDMA_RING_MAX_SIZE,
+		.max_size = HAL_RXDMA_RING_MAX_SIZE_BE,
 	},
-	{ /* RXDMA_MONITOR_DST */
-		.start_ring_id = HAL_SRNG_RING_ID_WMAC1_RXDMA2SW1,
+	[HAL_PPE2TCL] = {
+		.start_ring_id = HAL_SRNG_RING_ID_PPE2TCL1,
 		.max_rings = 1,
-		.entry_size = sizeof(struct hal_reo_entrance_ring) >> 2,
+		.entry_size =
+		    sizeof(struct hal_tcl_entrance_from_ppe_ring) >> 2,
+		.mac_type = ATH12K_HAL_SRNG_PMAC,
 		.lmac_ring = true,
-		.ring_dir = HAL_SRNG_DIR_DST,
-		.max_size = HAL_RXDMA_RING_MAX_SIZE,
+		.ring_dir = HAL_SRNG_DIR_SRC,
+		.max_size = HAL_SW2TCL1_RING_BASE_MSB_RING_SIZE,
 	},
-	{ /* RXDMA_MONITOR_DESC */
-		.start_ring_id = HAL_SRNG_RING_ID_WMAC1_SW2RXDMA1_DESC,
+	[HAL_PPE_RELEASE] = {
+		.start_ring_id = HAL_SRNG_RING_ID_WBM_PPE_RELEASE,
 		.max_rings = 1,
-		.entry_size = sizeof(struct hal_wbm_buffer_ring) >> 2,
+		.entry_size = sizeof(struct hal_wbm_release_ring) >> 2,
+		.mac_type = ATH12K_HAL_SRNG_PMAC,
 		.lmac_ring = true,
 		.ring_dir = HAL_SRNG_DIR_SRC,
-		.max_size = HAL_RXDMA_RING_MAX_SIZE,
+		.max_size = HAL_WBM2PPE_RELEASE_RING_BASE_MSB_RING_SIZE,
 	},
-	{ /* RXDMA DIR BUF */
-		.start_ring_id = HAL_SRNG_RING_ID_RXDMA_DIR_BUF,
+	[HAL_TX_MONITOR_BUF] = {
+		.start_ring_id = HAL_SRNG_SW2TXMON_BUF0,
 		.max_rings = 1,
-		.entry_size = 8 >> 2, /* TODO: Define the struct */
+		.entry_size = sizeof(struct hal_mon_buf_ring) >> 2,
+		.mac_type = ATH12K_HAL_SRNG_PMAC,
 		.lmac_ring = true,
 		.ring_dir = HAL_SRNG_DIR_SRC,
-		.max_size = HAL_RXDMA_RING_MAX_SIZE,
+		.max_size = HAL_RXDMA_RING_MAX_SIZE_BE,
+	},
+	[HAL_RXDMA_MONITOR_DST] = {
+		.start_ring_id = HAL_SRNG_RING_ID_WMAC1_SW2RXMON_BUF0,
+		.max_rings = 1,
+		.entry_size = sizeof(struct hal_mon_dest_desc) >> 2,
+		.mac_type = ATH12K_HAL_SRNG_PMAC,
+		.lmac_ring = true,
+		.ring_dir = HAL_SRNG_DIR_DST,
+		.max_size = HAL_RXDMA_RING_MAX_SIZE_BE,
 	},
+	[HAL_TX_MONITOR_DST] = {
+		.start_ring_id = HAL_SRNG_RING_ID_WMAC1_TXMON2SW0_BUF0,
+		.max_rings = 1,
+		.entry_size = sizeof(struct hal_mon_dest_desc) >> 2,
+		.mac_type = ATH12K_HAL_SRNG_PMAC,
+		.lmac_ring = true,
+		.ring_dir = HAL_SRNG_DIR_DST,
+		.max_size = HAL_RXDMA_RING_MAX_SIZE_BE,
+	}
 };
 
 int
@@ -20174,89 +19704,153 @@ qwz_hal_srng_create_config(struct qwz_softc *sc)
 	struct ath12k_hal *hal = &sc->hal;
 	struct hal_srng_config *s;
 
+	hal->srng_config = malloc(sizeof(hw_srng_config_templ),
+	    M_DEVBUF, M_NOWAIT | M_ZERO);
+	if (!hal->srng_config)
+		return ENOMEM;
+
 	memcpy(hal->srng_config, hw_srng_config_templ,
-	    sizeof(hal->srng_config));
+	    sizeof(hw_srng_config_templ));
 
 	s = &hal->srng_config[HAL_REO_DST];
-	s->reg_start[0] = HAL_SEQ_WCSS_UMAC_REO_REG + HAL_REO1_RING_BASE_LSB(sc);
+	s->reg_start[0] =
+	    HAL_SEQ_WCSS_UMAC_REO_REG + HAL_REO1_RING_BASE_LSB(sc);
 	s->reg_start[1] = HAL_SEQ_WCSS_UMAC_REO_REG + HAL_REO1_RING_HP(sc);
-	s->reg_size[0] = HAL_REO2_RING_BASE_LSB(sc) - HAL_REO1_RING_BASE_LSB(sc);
+	s->reg_size[0] =
+	    HAL_REO2_RING_BASE_LSB(sc) - HAL_REO1_RING_BASE_LSB(sc);
 	s->reg_size[1] = HAL_REO2_RING_HP(sc) - HAL_REO1_RING_HP(sc);
 
 	s = &hal->srng_config[HAL_REO_EXCEPTION];
-	s->reg_start[0] = HAL_SEQ_WCSS_UMAC_REO_REG + HAL_REO_TCL_RING_BASE_LSB(sc);
-	s->reg_start[1] = HAL_SEQ_WCSS_UMAC_REO_REG + HAL_REO_TCL_RING_HP(sc);
+	s->reg_start[0] =
+	    HAL_SEQ_WCSS_UMAC_REO_REG + HAL_REO_SW0_RING_BASE_LSB(sc);
+	s->reg_start[1] = HAL_SEQ_WCSS_UMAC_REO_REG + HAL_REO_SW0_RING_HP;
 
 	s = &hal->srng_config[HAL_REO_REINJECT];
-	s->reg_start[0] = HAL_SEQ_WCSS_UMAC_REO_REG + HAL_SW2REO_RING_BASE_LSB(sc);
+	s->max_rings = 1;
+	s->reg_start[0] =
+	    HAL_SEQ_WCSS_UMAC_REO_REG + HAL_SW2REO_RING_BASE_LSB(sc);
 	s->reg_start[1] = HAL_SEQ_WCSS_UMAC_REO_REG + HAL_SW2REO_RING_HP(sc);
 
 	s = &hal->srng_config[HAL_REO_CMD];
-	s->reg_start[0] = HAL_SEQ_WCSS_UMAC_REO_REG + HAL_REO_CMD_RING_BASE_LSB(sc);
+	s->reg_start[0] =
+	    HAL_SEQ_WCSS_UMAC_REO_REG + HAL_REO_CMD_RING_BASE_LSB(sc);
 	s->reg_start[1] = HAL_SEQ_WCSS_UMAC_REO_REG + HAL_REO_CMD_HP(sc);
 
 	s = &hal->srng_config[HAL_REO_STATUS];
-	s->reg_start[0] = HAL_SEQ_WCSS_UMAC_REO_REG + HAL_REO_STATUS_RING_BASE_LSB(sc);
+	s->reg_start[0] =
+	    HAL_SEQ_WCSS_UMAC_REO_REG + HAL_REO_STATUS_RING_BASE_LSB(sc);
 	s->reg_start[1] = HAL_SEQ_WCSS_UMAC_REO_REG + HAL_REO_STATUS_HP(sc);
 
 	s = &hal->srng_config[HAL_TCL_DATA];
-	s->reg_start[0] = HAL_SEQ_WCSS_UMAC_TCL_REG + HAL_TCL1_RING_BASE_LSB(sc);
+	s->max_rings = 5;
+	s->reg_start[0] =
+	    HAL_SEQ_WCSS_UMAC_TCL_REG + HAL_TCL1_RING_BASE_LSB(sc);
 	s->reg_start[1] = HAL_SEQ_WCSS_UMAC_TCL_REG + HAL_TCL1_RING_HP;
-	s->reg_size[0] = HAL_TCL2_RING_BASE_LSB(sc) - HAL_TCL1_RING_BASE_LSB(sc);
+	s->reg_size[0] =
+	    HAL_TCL2_RING_BASE_LSB(sc) - HAL_TCL1_RING_BASE_LSB(sc);
 	s->reg_size[1] = HAL_TCL2_RING_HP - HAL_TCL1_RING_HP;
 
 	s = &hal->srng_config[HAL_TCL_CMD];
 	s->reg_start[0] = HAL_SEQ_WCSS_UMAC_TCL_REG + HAL_TCL_RING_BASE_LSB(sc);
-	s->reg_start[1] = HAL_SEQ_WCSS_UMAC_TCL_REG + HAL_TCL_RING_HP;
+	s->reg_start[1] = HAL_SEQ_WCSS_UMAC_TCL_REG + HAL_TCL_RING_HP(sc);
 
 	s = &hal->srng_config[HAL_TCL_STATUS];
-	s->reg_start[0] = HAL_SEQ_WCSS_UMAC_TCL_REG + HAL_TCL_STATUS_RING_BASE_LSB(sc);
-	s->reg_start[1] = HAL_SEQ_WCSS_UMAC_TCL_REG + HAL_TCL_STATUS_RING_HP;
+	s->reg_start[0] =
+	    HAL_SEQ_WCSS_UMAC_TCL_REG + HAL_TCL_STATUS_RING_BASE_LSB(sc);
+	s->reg_start[1] =
+	    HAL_SEQ_WCSS_UMAC_TCL_REG + HAL_TCL_STATUS_RING_HP(sc);
 
 	s = &hal->srng_config[HAL_CE_SRC];
-	s->reg_start[0] = HAL_SEQ_WCSS_UMAC_CE0_SRC_REG(sc) + HAL_CE_DST_RING_BASE_LSB +
-		ATH12K_CE_OFFSET(sc);
-	s->reg_start[1] = HAL_SEQ_WCSS_UMAC_CE0_SRC_REG(sc) + HAL_CE_DST_RING_HP +
-		ATH12K_CE_OFFSET(sc);
-	s->reg_size[0] = HAL_SEQ_WCSS_UMAC_CE1_SRC_REG(sc) -
-		HAL_SEQ_WCSS_UMAC_CE0_SRC_REG(sc);
-	s->reg_size[1] = HAL_SEQ_WCSS_UMAC_CE1_SRC_REG(sc) -
-		HAL_SEQ_WCSS_UMAC_CE0_SRC_REG(sc);
+	s->max_rings = 12;
+	s->reg_start[0] =
+	    HAL_SEQ_WCSS_UMAC_CE0_SRC_REG(sc) + HAL_CE_DST_RING_BASE_LSB;
+	s->reg_start[1] =
+	    HAL_SEQ_WCSS_UMAC_CE0_SRC_REG(sc) + HAL_CE_DST_RING_HP;
+	s->reg_size[0] =
+	    HAL_SEQ_WCSS_UMAC_CE1_SRC_REG(sc) -
+	    HAL_SEQ_WCSS_UMAC_CE0_SRC_REG(sc);
+	s->reg_size[1] =
+	    HAL_SEQ_WCSS_UMAC_CE1_SRC_REG(sc) -
+	    HAL_SEQ_WCSS_UMAC_CE0_SRC_REG(sc);
 
 	s = &hal->srng_config[HAL_CE_DST];
-	s->reg_start[0] = HAL_SEQ_WCSS_UMAC_CE0_DST_REG(sc) + HAL_CE_DST_RING_BASE_LSB +
-		ATH12K_CE_OFFSET(sc);
-	s->reg_start[1] = HAL_SEQ_WCSS_UMAC_CE0_DST_REG(sc) + HAL_CE_DST_RING_HP +
-		ATH12K_CE_OFFSET(sc);
-	s->reg_size[0] = HAL_SEQ_WCSS_UMAC_CE1_DST_REG(sc) -
-		HAL_SEQ_WCSS_UMAC_CE0_DST_REG(sc);
-	s->reg_size[1] = HAL_SEQ_WCSS_UMAC_CE1_DST_REG(sc) -
-		HAL_SEQ_WCSS_UMAC_CE0_DST_REG(sc);
+	s->max_rings = 12;
+	s->reg_start[0] =
+	    HAL_SEQ_WCSS_UMAC_CE0_DST_REG(sc) + HAL_CE_DST_RING_BASE_LSB;
+	s->reg_start[1] =
+	    HAL_SEQ_WCSS_UMAC_CE0_DST_REG(sc) + HAL_CE_DST_RING_HP;
+	s->reg_size[0] =
+	    HAL_SEQ_WCSS_UMAC_CE1_DST_REG(sc) -
+	    HAL_SEQ_WCSS_UMAC_CE0_DST_REG(sc);
+	s->reg_size[1] =
+	    HAL_SEQ_WCSS_UMAC_CE1_DST_REG(sc) -
+	    HAL_SEQ_WCSS_UMAC_CE0_DST_REG(sc);
 
 	s = &hal->srng_config[HAL_CE_DST_STATUS];
-	s->reg_start[0] = HAL_SEQ_WCSS_UMAC_CE0_DST_REG(sc) +
-		HAL_CE_DST_STATUS_RING_BASE_LSB + ATH12K_CE_OFFSET(sc);
-	s->reg_start[1] = HAL_SEQ_WCSS_UMAC_CE0_DST_REG(sc) + HAL_CE_DST_STATUS_RING_HP +
-		ATH12K_CE_OFFSET(sc);
-	s->reg_size[0] = HAL_SEQ_WCSS_UMAC_CE1_DST_REG(sc) -
-		HAL_SEQ_WCSS_UMAC_CE0_DST_REG(sc);
-	s->reg_size[1] = HAL_SEQ_WCSS_UMAC_CE1_DST_REG(sc) -
-		HAL_SEQ_WCSS_UMAC_CE0_DST_REG(sc);
+	s->max_rings = 12;
+	s->reg_start[0] =
+	    HAL_SEQ_WCSS_UMAC_CE0_DST_REG(sc) + HAL_CE_DST_STATUS_RING_BASE_LSB;
+	s->reg_start[1] =
+	    HAL_SEQ_WCSS_UMAC_CE0_DST_REG(sc) + HAL_CE_DST_STATUS_RING_HP;
+	s->reg_size[0] =
+	    HAL_SEQ_WCSS_UMAC_CE1_DST_REG(sc) -
+	    HAL_SEQ_WCSS_UMAC_CE0_DST_REG(sc);
+	s->reg_size[1] =
+	    HAL_SEQ_WCSS_UMAC_CE1_DST_REG(sc) -
+	    HAL_SEQ_WCSS_UMAC_CE0_DST_REG(sc);
 
 	s = &hal->srng_config[HAL_WBM_IDLE_LINK];
-	s->reg_start[0] = HAL_SEQ_WCSS_UMAC_WBM_REG + HAL_WBM_IDLE_LINK_RING_BASE_LSB(sc);
-	s->reg_start[1] = HAL_SEQ_WCSS_UMAC_WBM_REG + HAL_WBM_IDLE_LINK_RING_HP;
+	s->reg_start[0] =
+	    HAL_SEQ_WCSS_UMAC_WBM_REG + HAL_WBM_IDLE_LINK_RING_BASE_LSB(sc);
+	s->reg_start[1] =
+	    HAL_SEQ_WCSS_UMAC_WBM_REG + HAL_WBM_IDLE_LINK_RING_HP(sc);
 
 	s = &hal->srng_config[HAL_SW2WBM_RELEASE];
-	s->reg_start[0] = HAL_SEQ_WCSS_UMAC_WBM_REG + HAL_WBM_RELEASE_RING_BASE_LSB(sc);
-	s->reg_start[1] = HAL_SEQ_WCSS_UMAC_WBM_REG + HAL_WBM_RELEASE_RING_HP;
+	s->max_rings = 1;
+	s->reg_start[0] =
+	    HAL_SEQ_WCSS_UMAC_WBM_REG + HAL_WBM_RELEASE_RING_BASE_LSB(sc);
+	s->reg_start[1] =
+	    HAL_SEQ_WCSS_UMAC_WBM_REG + HAL_WBM_RELEASE_RING_HP(sc);
 
 	s = &hal->srng_config[HAL_WBM2SW_RELEASE];
-	s->reg_start[0] = HAL_SEQ_WCSS_UMAC_WBM_REG + HAL_WBM0_RELEASE_RING_BASE_LSB(sc);
-	s->reg_start[1] = HAL_SEQ_WCSS_UMAC_WBM_REG + HAL_WBM0_RELEASE_RING_HP;
-	s->reg_size[0] = HAL_WBM1_RELEASE_RING_BASE_LSB(sc) -
-		HAL_WBM0_RELEASE_RING_BASE_LSB(sc);
-	s->reg_size[1] = HAL_WBM1_RELEASE_RING_HP - HAL_WBM0_RELEASE_RING_HP;
+	s->reg_start[0] =
+	    HAL_SEQ_WCSS_UMAC_WBM_REG + HAL_WBM0_RELEASE_RING_BASE_LSB(sc);
+	s->reg_start[1] =
+	    HAL_SEQ_WCSS_UMAC_WBM_REG + HAL_WBM0_RELEASE_RING_HP(sc);
+	s->reg_size[0] =
+	    HAL_WBM1_RELEASE_RING_BASE_LSB(sc) -
+	    HAL_WBM0_RELEASE_RING_BASE_LSB(sc);
+	s->reg_size[1] =
+	    HAL_WBM1_RELEASE_RING_HP(sc) -
+	    HAL_WBM0_RELEASE_RING_HP(sc);
+
+	s = &hal->srng_config[HAL_RXDMA_BUF];
+	s->max_rings = 2;
+	s->mac_type = ATH12K_HAL_SRNG_PMAC;
+	s->lmac_ring = true;
+
+	s = &hal->srng_config[HAL_RXDMA_DST];
+	s->max_rings = 1;
+	s->entry_size = sizeof(struct hal_reo_entrance_ring) >> 2;
+
+	/* below rings are not used */
+	s = &hal->srng_config[HAL_RXDMA_DIR_BUF];
+	s->max_rings = 0;
+
+	s = &hal->srng_config[HAL_PPE2TCL];
+	s->max_rings = 0;
+
+	s = &hal->srng_config[HAL_PPE_RELEASE];
+	s->max_rings = 0;
+
+	s = &hal->srng_config[HAL_TX_MONITOR_BUF];
+	s->max_rings = 0;
+
+	s = &hal->srng_config[HAL_TX_MONITOR_DST];
+	s->max_rings = 0;
+
+	s = &hal->srng_config[HAL_PPE2TCL];
+	s->max_rings = 0;
 
 	return 0;
 }
@@ -20274,8 +19868,8 @@ qwz_hal_srng_get_ring_id(struct qwz_softc *sc,
 	}
 
 	ring_id = srng_config->start_ring_id + ring_num;
-	if (srng_config->lmac_ring)
-		ring_id += mac_id * HAL_SRNG_RINGS_PER_LMAC;
+	if (srng_config->mac_type == ATH12K_HAL_SRNG_PMAC)
+		ring_id += mac_id * HAL_SRNG_RINGS_PER_PMAC;
 
 	if (ring_id >= HAL_SRNG_RING_ID_MAX) {
 		printf("%s: invalid ring ID :%d\n", __func__, ring_id);
@@ -20373,7 +19967,8 @@ qwz_hal_srng_shadow_config(struct qwz_softc *sc)
 			ring_type == HAL_CE_DST_STATUS)
 			continue;
 
-		if (cfg->lmac_ring)
+		if (cfg->mac_type == ATH12K_HAL_SRNG_DMAC ||
+		    cfg->mac_type == ATH12K_HAL_SRNG_PMAC)
 			continue;
 
 		for (ring_num = 0; ring_num < cfg->max_rings; ring_num++) {
@@ -20432,7 +20027,8 @@ int
 qwz_hal_alloc_cont_wrp(struct qwz_softc *sc)
 {
 	struct ath12k_hal *hal = &sc->hal;
-	size_t size = sizeof(uint32_t) * HAL_SRNG_NUM_LMAC_RINGS;
+	size_t size = sizeof(uint32_t) *
+	    (HAL_SRNG_NUM_PMAC_RINGS + HAL_SRNG_NUM_DMAC_RINGS);
 
 	if (hal->wrpmem == NULL) {
 		hal->wrpmem = qwz_dmamem_alloc(sc->sc_dmat, size, PAGE_SIZE);
@@ -20492,6 +20088,8 @@ err_free_cont_rdp:
 	qwz_hal_free_cont_rdp(sc);
 
 err_hal:
+	if (hal->srng_config)
+		free(hal->srng_config, M_DEVBUF, 0);
 	return ret;
 }
 
@@ -20608,17 +20206,6 @@ qwz_hal_srng_src_hw_init(struct qwz_softc *sc, struct hal_srng *srng)
 	val = FIELD_PREP(HAL_REO1_RING_ID_ENTRY_SIZE, srng->entry_size);
 	sc->ops.write32(sc, reg_base + HAL_TCL1_RING_ID_OFFSET(sc), val);
 
-	if (srng->ring_id == HAL_SRNG_RING_ID_WBM_IDLE_LINK) {
-		sc->ops.write32(sc, reg_base, (uint32_t)srng->ring_base_paddr);
-		val = FIELD_PREP(HAL_TCL1_RING_BASE_MSB_RING_BASE_ADDR_MSB,
-		    ((uint64_t)srng->ring_base_paddr >>
-		    HAL_ADDR_MSB_REG_SHIFT)) |
-		    FIELD_PREP(HAL_TCL1_RING_BASE_MSB_RING_SIZE,
-		    (srng->entry_size * srng->num_entries));
-		sc->ops.write32(sc,
-		    reg_base + HAL_TCL1_RING_BASE_MSB_OFFSET(sc), val);
-	}
-
 	/* interrupt setup */
 	/* NOTE: IPQ8074 v2 requires the interrupt timer threshold in the
 	 * unit of 8 usecs instead of 1 usec (as required by v1).
@@ -20672,6 +20259,10 @@ qwz_hal_srng_src_hw_init(struct qwz_softc *sc, struct hal_srng *srng)
 
 	val |= HAL_TCL1_RING_MISC_SRNG_ENABLE;
 
+	if (srng->ring_id == HAL_SRNG_RING_ID_WBM_IDLE_LINK) {
+		val |= ATH12K_HAL_TCL1_RING_MISC_MSI_RING_ID_DISABLE;
+	}
+
 	sc->ops.write32(sc, reg_base + HAL_TCL1_RING_MISC_OFFSET(sc), val);
 }
 
@@ -20738,7 +20329,7 @@ qwz_hal_ce_dst_status_get_length(void *buf)
 	uint32_t len;
 
 	len = FIELD_GET(HAL_CE_DST_STATUS_DESC_FLAGS_LEN, desc->flags);
-	desc->flags &= ~HAL_CE_DST_STATUS_DESC_FLAGS_LEN;
+	desc->flags &= ~htole32(HAL_CE_DST_STATUS_DESC_FLAGS_LEN);
 
 	return len;
 }
@@ -20805,7 +20396,7 @@ qwz_hal_srng_setup(struct qwz_softc *sc, enum hal_ring_type type,
 		srng->u.src_ring.low_threshold = params->low_threshold *
 		    srng->entry_size;
 		if (srng_config->lmac_ring) {
-			lmac_idx = ring_id - HAL_SRNG_RING_ID_LMAC1_ID_START;
+			lmac_idx = ring_id - HAL_SRNG_RING_ID_DMAC_CMN_ID_START;
 			srng->u.src_ring.hp_addr = (void *)(hal->wrp.vaddr +
 			    lmac_idx);
 			srng->flags |= HAL_SRNG_FLAGS_LMAC_RING;
@@ -20838,7 +20429,7 @@ qwz_hal_srng_setup(struct qwz_softc *sc, enum hal_ring_type type,
 			/* For LMAC rings, tail pointer updates will be done
 			 * through FW by writing to a shared memory location
 			 */
-			lmac_idx = ring_id - HAL_SRNG_RING_ID_LMAC1_ID_START;
+			lmac_idx = ring_id - HAL_SRNG_RING_ID_DMAC_CMN_ID_START;
 			srng->u.dst_ring.tp_addr = (void *)(hal->wrp.vaddr +
 			    lmac_idx);
 			srng->flags |= HAL_SRNG_FLAGS_LMAC_RING;
@@ -20887,12 +20478,6 @@ qwz_hal_ce_get_desc_size(enum hal_ce_desc type)
 	return 0;
 }
 
-void
-qwz_htc_tx_completion_handler(struct qwz_softc *sc, struct mbuf *m)
-{
-	printf("%s: not implemented\n", __func__);
-}
-
 struct qwz_tx_data *
 qwz_ce_completed_send_next(struct qwz_ce_pipe *pipe)
 {
@@ -20935,34 +20520,19 @@ err_unlock:
 }
 
 int
-qwz_ce_tx_process_cb(struct qwz_ce_pipe *pipe)
+qwz_ce_send_done_cb(struct qwz_ce_pipe *pipe)
 {
 	struct qwz_softc *sc = pipe->sc;
 	struct qwz_tx_data *tx_data;
-	struct mbuf *m;
-	struct mbuf_list ml = MBUF_LIST_INITIALIZER();
 	int ret = 0;
 
 	while ((tx_data = qwz_ce_completed_send_next(pipe)) != NULL) {
 		bus_dmamap_unload(sc->sc_dmat, tx_data->map);
-		m = tx_data->m;
+		m_freem(tx_data->m);
 		tx_data->m = NULL;
-
-		if ((!pipe->send_cb) || sc->hw_params.credit_flow) {
-			m_freem(m);
-			continue;
-		}
-
-		ml_enqueue(&ml, m);
 		ret = 1;
 	}
 
-	while ((m = ml_dequeue(&ml))) {
-		DNPRINTF(QWZ_D_CE, "%s: tx ce pipe %d len %d\n", __func__,
-		    pipe->pipe_num, m->m_len);
-		pipe->send_cb(sc, m);
-	}
-
 	return ret;
 }
 
@@ -20970,10 +20540,9 @@ void
 qwz_ce_poll_send_completed(struct qwz_softc *sc, uint8_t pipe_id)
 {
 	struct qwz_ce_pipe *pipe = &sc->ce.ce_pipe[pipe_id];
-	const struct ce_attr *attr =  &sc->hw_params.host_ce_config[pipe_id];
 
-	if ((pipe->attr_flags & CE_ATTR_DIS_INTR) && attr->src_nentries)
-		qwz_ce_tx_process_cb(pipe);
+	if ((pipe->attr_flags & CE_ATTR_DIS_INTR) && pipe->send_cb)
+		pipe->send_cb(pipe);
 }
 
 void
@@ -21241,7 +20810,7 @@ qwz_ce_free_ring(struct qwz_softc *sc, struct qwz_ce_ring *ring)
 {
 	bus_size_t dsize;
 	size_t size;
-	
+
 	if (ring == NULL)
 		return;
 
@@ -21287,8 +20856,6 @@ qwz_ce_free_pipes(struct qwz_softc *sc)
 
 	for (i = 0; i < sc->hw_params.ce_count; i++) {
 		pipe = &sc->ce.ce_pipe[i];
-		if (qwz_ce_need_shadow_fix(i))
-			qwz_dp_shadow_stop_timer(sc, &sc->ce.hp_timer[i]);
 		if (pipe->src_ring) {
 			qwz_ce_free_ring(sc, pipe->src_ring);
 			pipe->src_ring = NULL;
@@ -21437,7 +21004,7 @@ qwz_ce_alloc_pipe(struct qwz_softc *sc, int ce_id)
 	pipe->attr_flags = attr->flags;
 
 	if (attr->src_nentries) {
-		pipe->send_cb = attr->send_cb;
+		pipe->send_cb = qwz_ce_send_done_cb;
 		nentries = qwz_roundup_pow_of_two(attr->src_nentries);
 		desc_sz = qwz_hal_ce_get_desc_size(HAL_CE_DESC_SRC);
 		ring = qwz_ce_alloc_ring(sc, nentries, desc_sz);
@@ -21543,8 +21110,6 @@ qwz_ce_cleanup_pipes(struct qwz_softc *sc)
 	struct qwz_ce_pipe *pipe;
 	int pipe_num;
 
-	qwz_ce_stop_shadow_timers(sc);
-
 	for (pipe_num = 0; pipe_num < sc->hw_params.ce_count; pipe_num++) {
 		pipe = &sc->ce.ce_pipe[pipe_num];
 		qwz_ce_rx_pipe_cleanup(pipe);
@@ -22005,11 +21570,10 @@ int
 qwz_ce_per_engine_service(struct qwz_softc *sc, uint16_t ce_id)
 {
 	struct qwz_ce_pipe *pipe = &sc->ce.ce_pipe[ce_id];
-	const struct ce_attr *attr = &sc->hw_params.host_ce_config[ce_id];
 	int ret = 0;
 
-	if (attr->src_nentries) {
-		if (qwz_ce_tx_process_cb(pipe))
+	if (pipe->send_cb) {
+		if (pipe->send_cb(pipe))
 			ret = 1;
 	}
 
@@ -22103,9 +21667,6 @@ qwz_ce_send(struct qwz_softc *sc, struct mbuf *m, uint8_t pipe_id,
 
 	qwz_hal_srng_access_end(sc, srng);
 
-	if (qwz_ce_need_shadow_fix(pipe_id))
-		qwz_dp_shadow_start_timer(sc, srng, &sc->ce.hp_timer[pipe_id]);
-
 err_unlock:
 #ifdef notyet
 	spin_unlock_bh(&srng->lock);
@@ -22230,7 +21791,7 @@ qwz_reg_update_chan_list(struct qwz_softc *sc, uint8_t pdev_id)
 		ch->cfreq1 = ch->mhz;
 		ch->minpower = 0;
 		ch->maxpower = 40; /* XXX from Linux debug trace */
-		ch->maxregpower = ch->maxpower; 
+		ch->maxregpower = ch->maxpower;
 		ch->antennamax = 0;
 
 		/* TODO: Use appropriate phymodes */
@@ -22822,7 +22383,7 @@ struct qwz_vif *
 qwz_vif_alloc(struct qwz_softc *sc)
 {
 	struct qwz_vif *arvif;
-	struct qwz_txmgmt_queue *txmgmt; 
+	struct qwz_txmgmt_queue *txmgmt;
 	int i, ret = 0;
 	const bus_size_t size = IEEE80211_MAX_LEN;
 
@@ -24430,7 +23991,6 @@ qwz_dp_tx(struct qwz_softc *sc, struct qwz_vif *arvif, uint8_t pdev_id,
 
 	qwz_hal_srng_access_end(sc, tcl_ring);
 
-	qwz_dp_shadow_start_timer(sc, tcl_ring, &dp->tx_ring_timer[ti.ring_id]);
 #ifdef notyet
 	spin_unlock_bh(&tcl_ring->lock);
 #endif
@@ -24438,7 +23998,7 @@ qwz_dp_tx(struct qwz_softc *sc, struct qwz_vif *arvif, uint8_t pdev_id,
 	tx_ring->cur = (tx_ring->cur + 1) % sc->hw_params.tx_ring_size;
 
 	if (tx_ring->queued >= sc->hw_params.tx_ring_size - 1)
-		sc->qfullmsk |= (1 << ti.ring_id); 
+		sc->qfullmsk |= (1 << ti.ring_id);
 
 	return 0;
 }
@@ -25137,7 +24697,7 @@ qwz_auth(struct qwz_softc *sc)
 
 	qwz_recalculate_mgmt_rate(sc, ni, arvif->vdev_id, pdev->pdev_id);
 	ni->ni_txrate = 0;
-	
+
 	ret = qwz_mac_station_add(sc, arvif, pdev->pdev_id, ni);
 	if (ret)
 		return ret;
diff --git a/sys/dev/ic/qwzreg.h b/sys/dev/ic/qwzreg.h
index e0cf2645d2b..13591e57895 100644
--- a/sys/dev/ic/qwzreg.h
+++ b/sys/dev/ic/qwzreg.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: qwzreg.h,v 1.1 2024/08/14 14:40:46 patrick Exp $	*/
+/*	$OpenBSD: qwzreg.h,v 1.2 2024/08/15 22:01:37 patrick Exp $	*/
 
 /*
  * Copyright (c) 2021-2022, Qualcomm Innovation Center, Inc.
@@ -49,13 +49,9 @@
 #define ATH12K_CONNECTION_LOSS_HZ	(3 * HZ)
 
 enum ath12k_hw_rev {
-	ATH12K_HW_IPQ8074,
-	ATH12K_HW_QCA6390_HW20,
-	ATH12K_HW_IPQ6018_HW10,
-	ATH12K_HW_QCN9074_HW10,
-	ATH12K_HW_WCN6855_HW20,
-	ATH12K_HW_WCN6855_HW21,
-	ATH12K_HW_WCN6750_HW10,
+	ATH12K_HW_QCN9274_HW10,
+	ATH12K_HW_QCN9274_HW20,
+	ATH12K_HW_WCN7850_HW20
 };
 
 enum ath12k_firmware_mode {
@@ -6500,6 +6496,24 @@ struct qmi_response_type_v01 {
 	uint16_t error;
 };
 
+#define QMI_WLANFW_PHY_CAP_REQ_MSG_V01_MAX_LEN			0
+#define QMI_WLANFW_PHY_CAP_REQ_V01				0x0057
+#define QMI_WLANFW_PHY_CAP_RESP_MSG_V01_MAX_LEN			18
+#define QMI_WLANFW_PHY_CAP_RESP_V01				0x0057
+
+struct qmi_wlanfw_phy_cap_req_msg_v01 {
+};
+
+struct qmi_wlanfw_phy_cap_resp_msg_v01 {
+	struct qmi_response_type_v01 resp;
+	uint8_t num_phy_valid;
+	uint8_t num_phy;
+	uint8_t board_id_valid;
+	uint32_t board_id;
+	uint8_t single_chip_mlo_support_valid;
+	uint8_t single_chip_mlo_support;
+};
+
 #define QMI_WLANFW_IND_REGISTER_REQ_MSG_V01_MAX_LEN		54
 #define QMI_WLANFW_IND_REGISTER_REQ_V01				0x0020
 #define QMI_WLANFW_IND_REGISTER_RESP_MSG_V01_MAX_LEN		18
@@ -6544,12 +6558,45 @@ struct qmi_wlanfw_ind_register_resp_msg_v01 {
 #define QMI_WLANFW_HOST_CAP_RESP_MSG_V01_MAX_LEN	7
 #define QMI_WLFW_HOST_CAP_RESP_V01			0x0034
 #define QMI_WLFW_MAX_NUM_GPIO_V01			32
+#define QMI_WLANFW_MAX_PLATFORM_NAME_LEN_V01		64
+#define QMI_WLANFW_MAX_HOST_DDR_RANGE_SIZE_V01		3
 #define QMI_IPQ8074_FW_MEM_MODE				0xFF
 #define HOST_DDR_REGION_TYPE				0x1
 #define BDF_MEM_REGION_TYPE				0x2
 #define M3_DUMP_REGION_TYPE				0x3
 #define CALDB_MEM_REGION_TYPE				0x4
 
+struct qmi_wlanfw_host_ddr_range {
+	uint64_t start;
+	uint64_t size;
+};
+
+enum qmi_wlanfw_host_build_type {
+	WLANFW_HOST_BUILD_TYPE_ENUM_MIN_VAL_V01 = INT_MIN,
+	QMI_WLANFW_HOST_BUILD_TYPE_UNSPECIFIED_V01 = 0,
+	QMI_WLANFW_HOST_BUILD_TYPE_PRIMARY_V01 = 1,
+	QMI_WLANFW_HOST_BUILD_TYPE_SECONDARY_V01 = 2,
+	WLANFW_HOST_BUILD_TYPE_ENUM_MAX_VAL_V01 = INT_MAX,
+};
+
+#define QMI_WLFW_MAX_NUM_MLO_CHIPS_V01 3
+#define QMI_WLFW_MAX_NUM_MLO_LINKS_PER_CHIP_V01 2
+
+struct wlfw_host_mlo_chip_info_s_v01 {
+	uint8_t chip_id;
+	uint8_t num_local_links;
+	uint8_t hw_link_id[QMI_WLFW_MAX_NUM_MLO_LINKS_PER_CHIP_V01];
+	uint8_t valid_mlo_link_id[QMI_WLFW_MAX_NUM_MLO_LINKS_PER_CHIP_V01];
+};
+
+enum ath12k_qmi_cnss_feature {
+	CNSS_FEATURE_MIN_ENUM_VAL_V01 = INT_MIN,
+	CNSS_QDSS_CFG_MISS_V01 = 3,
+	CNSS_PCIE_PERST_NO_PULL_V01 = 4,
+	CNSS_MAX_FEATURE_V01 = 64,
+	CNSS_FEATURE_MAX_ENUM_VAL_V01 = INT_MAX,
+};
+
 struct qmi_wlanfw_host_cap_req_msg_v01 {
 	uint8_t num_clients_valid;
 	uint32_t num_clients;
@@ -6578,6 +6625,28 @@ struct qmi_wlanfw_host_cap_req_msg_v01 {
 	uint32_t mem_bucket;
 	uint8_t mem_cfg_mode_valid;
 	uint8_t mem_cfg_mode;
+	uint8_t cal_duration_valid;
+	uint16_t cal_duraiton;
+	uint8_t platform_name_valid;
+	char platform_name[QMI_WLANFW_MAX_PLATFORM_NAME_LEN_V01 + 1];
+	uint8_t ddr_range_valid;
+	struct qmi_wlanfw_host_ddr_range ddr_range[QMI_WLANFW_MAX_HOST_DDR_RANGE_SIZE_V01];
+	uint8_t host_build_type_valid;
+	enum qmi_wlanfw_host_build_type host_build_type;
+	uint8_t mlo_capable_valid;
+	uint8_t mlo_capable;
+	uint8_t mlo_chip_id_valid;
+	uint16_t mlo_chip_id;
+	uint8_t mlo_group_id_valid;
+	uint8_t mlo_group_id;
+	uint8_t max_mlo_peer_valid;
+	uint16_t max_mlo_peer;
+	uint8_t mlo_num_chips_valid;
+	uint8_t mlo_num_chips;
+	uint8_t mlo_chip_info_valid;
+	struct wlfw_host_mlo_chip_info_s_v01 mlo_chip_info[QMI_WLFW_MAX_NUM_MLO_CHIPS_V01];
+	uint8_t feature_list_valid;
+	uint64_t feature_list;
 };
 
 struct qmi_wlanfw_host_cap_resp_msg_v01 {
@@ -6603,6 +6672,8 @@ struct qmi_wlanfw_host_cap_resp_msg_v01 {
 #define ATH12K_QMI_CALDB_SIZE			0x480000
 #define ATH12K_QMI_BDF_EXT_STR_LENGTH		0x20
 #define ATH12K_QMI_FW_MEM_REQ_SEGMENT_CNT	5
+#define ATH12K_QMI_WLFW_MAX_DEV_MEM_NUM_V01	4
+#define ATH12K_QMI_DEVMEM_CMEM_INDEX		0
 
 #define QMI_WLFW_REQUEST_MEM_IND_V01		0x0035
 #define QMI_WLFW_RESPOND_MEM_RESP_V01		0x0036
@@ -6717,7 +6788,7 @@ struct qmi_wlanfw_shadow_reg_cfg_s_v01 {
 	uint16_t offset;
 };
 
-struct qmi_wlanfw_shadow_reg_v2_cfg_s_v01 {
+struct qmi_wlanfw_shadow_reg_v3_cfg_s_v01 {
 	uint32_t addr;
 };
 
@@ -6745,6 +6816,11 @@ struct qmi_wlanfw_fw_version_info_s_v01 {
 	char fw_build_timestamp[ATH12K_QMI_WLANFW_MAX_TIMESTAMP_LEN_V01 + 1];
 };
 
+struct qmi_wlanfw_dev_mem_info_s_v01 {
+	uint64_t start;
+	uint64_t size;
+};
+
 enum qmi_wlanfw_cal_temp_id_enum_v01 {
 	QMI_WLANFW_CAL_TEMP_IDX_0_V01 = 0,
 	QMI_WLANFW_CAL_TEMP_IDX_1_V01 = 1,
@@ -6754,6 +6830,14 @@ enum qmi_wlanfw_cal_temp_id_enum_v01 {
 	QMI_WLANFW_CAL_TEMP_ID_MAX_V01 = 0xFF,
 };
 
+enum qmi_wlanfw_rd_card_chain_cap_v01 {
+	WLFW_RD_CARD_CHAIN_CAP_MIN_VAL_V01 = INT_MIN,
+	WLFW_RD_CARD_CHAIN_CAP_UNSPECIFIED_V01 = 0,
+	WLFW_RD_CARD_CHAIN_CAP_1x1_V01 = 1,
+	WLFW_RD_CARD_CHAIN_CAP_2x2_V01 = 2,
+	WLFW_RD_CARD_CHAIN_CAP_MAX_VAL_V01 = INT_MAX,
+};
+
 struct qmi_wlanfw_cap_resp_msg_v01 {
 	struct qmi_response_type_v01 resp;
 	uint8_t chip_info_valid;
@@ -6776,6 +6860,12 @@ struct qmi_wlanfw_cap_resp_msg_v01 {
 	uint32_t otp_version;
 	uint8_t eeprom_read_timeout_valid;
 	uint32_t eeprom_read_timeout;
+	uint8_t fw_caps_valid;
+	uint64_t fw_caps;
+	uint8_t rd_card_chain_cap_valid;
+	enum qmi_wlanfw_rd_card_chain_cap_v01 rd_card_chain_cap;
+	uint8_t dev_mem_info_valid;
+	struct qmi_wlanfw_dev_mem_info_s_v01 dev_mem[ATH12K_QMI_WLFW_MAX_DEV_MEM_NUM_V01];
 };
 
 struct qmi_wlanfw_cap_req_msg_v01 {
@@ -6839,7 +6929,7 @@ struct qmi_wlanfw_m3_info_resp_msg_v01 {
 #define QMI_WLANFW_MAX_NUM_CE_V01			12
 #define QMI_WLANFW_MAX_NUM_SVC_V01			24
 #define QMI_WLANFW_MAX_NUM_SHADOW_REG_V01		24
-#define QMI_WLANFW_MAX_NUM_SHADOW_REG_V2_V01		36
+#define QMI_WLANFW_MAX_NUM_SHADOW_REG_V3_V01		60
 
 struct qmi_wlanfw_wlan_mode_req_msg_v01 {
 	uint32_t mode;
@@ -6866,10 +6956,10 @@ struct qmi_wlanfw_wlan_cfg_req_msg_v01 {
 	uint32_t shadow_reg_len;
 	struct qmi_wlanfw_shadow_reg_cfg_s_v01
 	    shadow_reg[QMI_WLANFW_MAX_NUM_SHADOW_REG_V01];
-	uint8_t shadow_reg_v2_valid;
-	uint32_t shadow_reg_v2_len;
-	struct qmi_wlanfw_shadow_reg_v2_cfg_s_v01
-		shadow_reg_v2[QMI_WLANFW_MAX_NUM_SHADOW_REG_V2_V01];
+	uint8_t shadow_reg_v3_valid;
+	uint32_t shadow_reg_v3_len;
+	struct qmi_wlanfw_shadow_reg_v3_cfg_s_v01
+		shadow_reg_v3[QMI_WLANFW_MAX_NUM_SHADOW_REG_V3_V01];
 };
 
 struct qmi_wlanfw_wlan_cfg_resp_msg_v01 {
@@ -6915,38 +7005,52 @@ enum ath12k_qmi_bdf_type {
 #define HAL_WBM_IDLE_SCATTER_BUF_SIZE (HAL_WBM_IDLE_SCATTER_BUF_SIZE_MAX - \
 				       HAL_WBM_IDLE_SCATTER_NEXT_PTR_SIZE)
 
-#define HAL_DSCP_TID_MAP_TBL_NUM_ENTRIES_MAX	48
+#define HAL_DSCP_TID_MAP_TBL_NUM_ENTRIES_MAX	32
 #define HAL_DSCP_TID_TBL_SIZE			24
 
 /* calculate the register address from bar0 of shadow register x */
 #define HAL_SHADOW_BASE_ADDR(sc)		\
 	(sc->hw_params.regs->hal_shadow_base_addr)
-#define HAL_SHADOW_NUM_REGS			36
+#define HAL_SHADOW_NUM_REGS			40
 #define HAL_HP_OFFSET_IN_REG_START		1
 #define HAL_OFFSET_FROM_HP_TO_TP		4
 
 #define HAL_SHADOW_REG(sc, x) (HAL_SHADOW_BASE_ADDR(sc) + (4 * (x)))
 
 enum hal_srng_ring_id {
-	HAL_SRNG_RING_ID_REO2SW1 = 0,
+	HAL_SRNG_RING_ID_REO2SW0 = 0,
+	HAL_SRNG_RING_ID_REO2SW1,
 	HAL_SRNG_RING_ID_REO2SW2,
 	HAL_SRNG_RING_ID_REO2SW3,
 	HAL_SRNG_RING_ID_REO2SW4,
+	HAL_SRNG_RING_ID_REO2SW5,
+	HAL_SRNG_RING_ID_REO2SW6,
+	HAL_SRNG_RING_ID_REO2SW7,
+	HAL_SRNG_RING_ID_REO2SW8,
 	HAL_SRNG_RING_ID_REO2TCL,
-	HAL_SRNG_RING_ID_SW2REO,
+	HAL_SRNG_RING_ID_REO2PPE,
+
+	HAL_SRNG_RING_ID_SW2REO = 16,
+	HAL_SRNG_RING_ID_SW2REO1,
+	HAL_SRNG_RING_ID_SW2REO2,
+	HAL_SRNG_RING_ID_SW2REO3,
 
-	HAL_SRNG_RING_ID_REO_CMD = 8,
+	HAL_SRNG_RING_ID_REO_CMD,
 	HAL_SRNG_RING_ID_REO_STATUS,
 
-	HAL_SRNG_RING_ID_SW2TCL1 = 16,
+	HAL_SRNG_RING_ID_SW2TCL1 = 24,
 	HAL_SRNG_RING_ID_SW2TCL2,
 	HAL_SRNG_RING_ID_SW2TCL3,
 	HAL_SRNG_RING_ID_SW2TCL4,
+	HAL_SRNG_RING_ID_SW2TCL5,
+	HAL_SRNG_RING_ID_SW2TCL6,
+	HAL_SRNG_RING_ID_PPE2TCL1	= 30,
 
-	HAL_SRNG_RING_ID_SW2TCL_CMD = 24,
+	HAL_SRNG_RING_ID_SW2TCL_CMD	= 40,
+	HAL_SRNG_RING_ID_SW2TCL1_CMD,
 	HAL_SRNG_RING_ID_TCL_STATUS,
 
-	HAL_SRNG_RING_ID_CE0_SRC = 32,
+	HAL_SRNG_RING_ID_CE0_SRC = 64,
 	HAL_SRNG_RING_ID_CE1_SRC,
 	HAL_SRNG_RING_ID_CE2_SRC,
 	HAL_SRNG_RING_ID_CE3_SRC,
@@ -6958,8 +7062,12 @@ enum hal_srng_ring_id {
 	HAL_SRNG_RING_ID_CE9_SRC,
 	HAL_SRNG_RING_ID_CE10_SRC,
 	HAL_SRNG_RING_ID_CE11_SRC,
+	HAL_SRNG_RING_ID_CE12_SRC,
+	HAL_SRNG_RING_ID_CE13_SRC,
+	HAL_SRNG_RING_ID_CE14_SRC,
+	HAL_SRNG_RING_ID_CE15_SRC,
 
-	HAL_SRNG_RING_ID_CE0_DST = 56,
+	HAL_SRNG_RING_ID_CE0_DST = 81,
 	HAL_SRNG_RING_ID_CE1_DST,
 	HAL_SRNG_RING_ID_CE2_DST,
 	HAL_SRNG_RING_ID_CE3_DST,
@@ -6971,8 +7079,12 @@ enum hal_srng_ring_id {
 	HAL_SRNG_RING_ID_CE9_DST,
 	HAL_SRNG_RING_ID_CE10_DST,
 	HAL_SRNG_RING_ID_CE11_DST,
+	HAL_SRNG_RING_ID_CE12_DST,
+	HAL_SRNG_RING_ID_CE13_DST,
+	HAL_SRNG_RING_ID_CE14_DST,
+	HAL_SRNG_RING_ID_CE15_DST,
 
-	HAL_SRNG_RING_ID_CE0_DST_STATUS = 80,
+	HAL_SRNG_RING_ID_CE0_DST_STATUS = 100,
 	HAL_SRNG_RING_ID_CE1_DST_STATUS,
 	HAL_SRNG_RING_ID_CE2_DST_STATUS,
 	HAL_SRNG_RING_ID_CE3_DST_STATUS,
@@ -6984,29 +7096,54 @@ enum hal_srng_ring_id {
 	HAL_SRNG_RING_ID_CE9_DST_STATUS,
 	HAL_SRNG_RING_ID_CE10_DST_STATUS,
 	HAL_SRNG_RING_ID_CE11_DST_STATUS,
+	HAL_SRNG_RING_ID_CE12_DST_STATUS,
+	HAL_SRNG_RING_ID_CE13_DST_STATUS,
+	HAL_SRNG_RING_ID_CE14_DST_STATUS,
+	HAL_SRNG_RING_ID_CE15_DST_STATUS,
 
-	HAL_SRNG_RING_ID_WBM_IDLE_LINK = 104,
-	HAL_SRNG_RING_ID_WBM_SW_RELEASE,
-	HAL_SRNG_RING_ID_WBM2SW0_RELEASE,
+	HAL_SRNG_RING_ID_WBM_IDLE_LINK = 120,
+	HAL_SRNG_RING_ID_WBM_SW0_RELEASE,
+	HAL_SRNG_RING_ID_WBM_SW1_RELEASE,
+	HAL_SRNG_RING_ID_WBM_PPE_RELEASE = 123,
+
+	HAL_SRNG_RING_ID_WBM2SW0_RELEASE = 128,
 	HAL_SRNG_RING_ID_WBM2SW1_RELEASE,
 	HAL_SRNG_RING_ID_WBM2SW2_RELEASE,
-	HAL_SRNG_RING_ID_WBM2SW3_RELEASE,
+	HAL_SRNG_RING_ID_WBM2SW3_RELEASE, /* RX ERROR RING */
 	HAL_SRNG_RING_ID_WBM2SW4_RELEASE,
+	HAL_SRNG_RING_ID_WBM2SW5_RELEASE,
+	HAL_SRNG_RING_ID_WBM2SW6_RELEASE,
+	HAL_SRNG_RING_ID_WBM2SW7_RELEASE,
+
+	HAL_SRNG_RING_ID_UMAC_ID_END = 159,
+
+	/* Common DMAC rings shared by all LMACs */
+	HAL_SRNG_RING_ID_DMAC_CMN_ID_START = 160,
+	HAL_SRNG_SW2RXDMA_BUF0 =
+	    HAL_SRNG_RING_ID_DMAC_CMN_ID_START,
+	HAL_SRNG_SW2RXDMA_BUF1 = 161,
+	HAL_SRNG_SW2RXDMA_BUF2 = 162,
+
+	HAL_SRNG_SW2RXMON_BUF0 = 168,
 
-	HAL_SRNG_RING_ID_UMAC_ID_END = 127,
-	HAL_SRNG_RING_ID_LMAC1_ID_START,
+	HAL_SRNG_SW2TXMON_BUF0 = 176,
+
+	HAL_SRNG_RING_ID_DMAC_CMN_ID_END = 183,
+	HAL_SRNG_RING_ID_PMAC1_ID_START = 184,
+
+	HAL_SRNG_RING_ID_WMAC1_SW2RXMON_BUF0 =
+	    HAL_SRNG_RING_ID_PMAC1_ID_START,
 
-	HAL_SRNG_RING_ID_WMAC1_SW2RXDMA0_BUF = HAL_SRNG_RING_ID_LMAC1_ID_START,
-	HAL_SRNG_RING_ID_WMAC1_SW2RXDMA1_BUF,
-	HAL_SRNG_RING_ID_WMAC1_SW2RXDMA2_BUF,
-	HAL_SRNG_RING_ID_WMAC1_SW2RXDMA0_STATBUF,
-	HAL_SRNG_RING_ID_WMAC1_SW2RXDMA1_STATBUF,
 	HAL_SRNG_RING_ID_WMAC1_RXDMA2SW0,
 	HAL_SRNG_RING_ID_WMAC1_RXDMA2SW1,
+	HAL_SRNG_RING_ID_WMAC1_RXMON2SW0 =
+	    HAL_SRNG_RING_ID_WMAC1_RXDMA2SW1,
 	HAL_SRNG_RING_ID_WMAC1_SW2RXDMA1_DESC,
 	HAL_SRNG_RING_ID_RXDMA_DIR_BUF,
+	HAL_SRNG_RING_ID_WMAC1_SW2TXMON_BUF0,
+	HAL_SRNG_RING_ID_WMAC1_TXMON2SW0_BUF0,
 
-	HAL_SRNG_RING_ID_LMAC1_ID_END = 143
+	HAL_SRNG_RING_ID_PMAC1_ID_END,
 };
 
 /* SRNG registers are split into two groups R0 and R2 */
@@ -7019,11 +7156,21 @@ enum hal_srng_ring_id {
 #define HAL_SRNG_RINGS_PER_LMAC (HAL_SRNG_RING_ID_LMAC1_ID_END - \
 				 HAL_SRNG_RING_ID_LMAC1_ID_START)
 #define HAL_SRNG_NUM_LMAC_RINGS (HAL_SRNG_NUM_LMACS * HAL_SRNG_RINGS_PER_LMAC)
-#define HAL_SRNG_RING_ID_MAX    (HAL_SRNG_RING_ID_UMAC_ID_END + \
-				 HAL_SRNG_NUM_LMAC_RINGS)
+
+/* TODO: number of PMACs */
+#define HAL_SRNG_NUM_PMACS	3
+#define HAL_SRNG_NUM_DMAC_RINGS						\
+	(HAL_SRNG_RING_ID_DMAC_CMN_ID_END -			\
+	HAL_SRNG_RING_ID_DMAC_CMN_ID_START)
+#define HAL_SRNG_RINGS_PER_PMAC	(HAL_SRNG_RING_ID_PMAC1_ID_END -	\
+				 HAL_SRNG_RING_ID_PMAC1_ID_START)
+#define HAL_SRNG_NUM_PMAC_RINGS	(HAL_SRNG_NUM_PMACS * HAL_SRNG_RINGS_PER_PMAC)
+#define HAL_SRNG_RING_ID_MAX					\
+	(HAL_SRNG_RING_ID_DMAC_CMN_ID_END + HAL_SRNG_NUM_PMAC_RINGS)
 
 #define HAL_RX_MAX_BA_WINDOW	256
 
+#define ATH12K_HAL_DEFAULT_BE_BK_VI_REO_TIMEOUT_USEC	(100 * 1000)
 #define HAL_DEFAULT_REO_TIMEOUT_USEC		(40 * 1000)
 
 /**
@@ -7078,7 +7225,7 @@ enum hal_reo_cmd_status {
 #define HAL_SEQ_WCSS_UMAC_REO_REG		0x00a38000
 #define HAL_SEQ_WCSS_UMAC_TCL_REG		0x00a44000
 #define HAL_SEQ_WCSS_UMAC_CE0_SRC_REG(sc) \
-	(sc->hw_params.regs->hal_seq_wcss_umac_ce0_src_reg)
+	(sc->hal_seq_wcss_umac_ce0_src_reg)
 #define HAL_SEQ_WCSS_UMAC_CE0_DST_REG(sc) \
 	(sc->hw_params.regs->hal_seq_wcss_umac_ce0_dst_reg)
 #define HAL_SEQ_WCSS_UMAC_CE1_SRC_REG(sc) \
@@ -7091,8 +7238,10 @@ enum hal_reo_cmd_status {
 #define HAL_WLAON_REG_BASE			0x01f80000
 
 /* SW2TCL(x) R0 ring configuration address */
-#define HAL_TCL1_RING_CMN_CTRL_REG		0x00000014
-#define HAL_TCL1_RING_DSCP_TID_MAP		0x0000002c
+#define HAL_TCL1_RING_CMN_CTRL_REG		\
+	(sc->hw_params.regs->hal_tcl1_ring_cmn_ctrl_reg)
+#define HAL_TCL1_RING_DSCP_TID_MAP		\
+	(sc->hw_params.regs->hal_tcl1_ring_dscp_tid_map)
 #define HAL_TCL1_RING_BASE_LSB(sc)		\
 	(sc->hw_params.regs->hal_tcl1_ring_base_lsb)
 #define HAL_TCL1_RING_BASE_MSB(sc)		\
@@ -7146,15 +7295,17 @@ enum hal_reo_cmd_status {
 #define HAL_TCL1_RING_HP			0x00002000
 #define HAL_TCL1_RING_TP			0x00002004
 #define HAL_TCL2_RING_HP			0x00002008
-#define HAL_TCL_RING_HP				0x00002018
+#define HAL_TCL_RING_HP(sc)			\
+	(sc->hw_params.regs->hal_tcl_ring_hp)
 
 #define HAL_TCL1_RING_TP_OFFSET \
 		(HAL_TCL1_RING_TP - HAL_TCL1_RING_HP)
 
 /* TCL STATUS ring address */
-#define HAL_TCL_STATUS_RING_BASE_LSB(sc) \
+#define HAL_TCL_STATUS_RING_BASE_LSB(sc)	\
 	(sc->hw_params.regs->hal_tcl_status_ring_base_lsb)
-#define HAL_TCL_STATUS_RING_HP			0x00002030
+#define HAL_TCL_STATUS_RING_HP(sc)		\
+	(sc->hw_params.regs->hal_tcl_status_ring_hp)
 
 /* REO2SW(x) R0 ring configuration address */
 #define HAL_REO1_GEN_ENABLE			0x00000000
@@ -7226,6 +7377,13 @@ enum hal_reo_cmd_status {
 #define HAL_REO1_RING_TP_OFFSET(sc)	\
 	(HAL_REO1_RING_TP(sc) - HAL_REO1_RING_HP(sc))
 
+/* REO2SW0 ring configuration address */
+#define HAL_REO_SW0_RING_BASE_LSB(sc)		\
+	((sc)->hw_params.regs->hal_reo2_sw0_ring_base)
+
+/* REO2SW0 R2 ring pointer (head/tail) address */
+#define HAL_REO_SW0_RING_HP	0x00003088
+
 /* REO2TCL R0 ring configuration address */
 #define HAL_REO_TCL_RING_BASE_LSB(sc) \
 	(sc->hw_params.regs->hal_reo_tcl_ring_base_lsb)
@@ -7281,29 +7439,42 @@ enum hal_reo_cmd_status {
 #define HAL_WBM_SCATTERED_DESC_PTR_HP_ADDR	 0x00000084
 
 /* WBM Idle R2 address */
-#define HAL_WBM_IDLE_LINK_RING_HP		0x000030b0
+#define HAL_WBM_IDLE_LINK_RING_HP(sc)	\
+	(sc->hw_params.regs->hal_wbm_idle_link_ring_up)
 
 /* SW2WBM R0 release address */
-#define HAL_WBM_RELEASE_RING_BASE_LSB(x) \
-		(sc->hw_params.regs->hal_wbm_release_ring_base_lsb)
+#define HAL_WBM_RELEASE_RING_BASE_LSB(x)	\
+	(sc->hw_params.regs->hal_wbm_release_ring_base_lsb)
 
 /* SW2WBM R2 release address */
-#define HAL_WBM_RELEASE_RING_HP			0x00003018
+#define HAL_WBM_RELEASE_RING_HP(sc)		\
+	(sc->hw_params.regs->hal_wbm_release_ring_hp)
 
 /* WBM2SW R0 release address */
-#define HAL_WBM0_RELEASE_RING_BASE_LSB(x) \
-		(sc->hw_params.regs->hal_wbm0_release_ring_base_lsb)
-#define HAL_WBM1_RELEASE_RING_BASE_LSB(x) \
-		(sc->hw_params.regs->hal_wbm1_release_ring_base_lsb)
+#define HAL_WBM0_RELEASE_RING_BASE_LSB(x)	\
+	(sc->hw_params.regs->hal_wbm0_release_ring_base_lsb)
+#define HAL_WBM1_RELEASE_RING_BASE_LSB(x)	\
+	(sc->hw_params.regs->hal_wbm1_release_ring_base_lsb)
 
 /* WBM2SW R2 release address */
-#define HAL_WBM0_RELEASE_RING_HP		0x000030c0
-#define HAL_WBM1_RELEASE_RING_HP		0x000030c8
+#define HAL_WBM0_RELEASE_RING_HP(sc)		\
+	(sc->hw_params.regs->hal_wbm0_release_ring_hp)
+#define HAL_WBM1_RELEASE_RING_HP(sc)		\
+	(sc->hw_params.regs->hal_wbm1_release_ring_hp)
+
+/* WBM cookie config address and mask */
+#define HAL_WBM_SW_COOKIE_CONV_CFG_WBM2SW0_EN	0x00000002
+#define HAL_WBM_SW_COOKIE_CONV_CFG_WBM2SW1_EN	0x00000004
+#define HAL_WBM_SW_COOKIE_CONV_CFG_WBM2SW2_EN	0x00000008
+#define HAL_WBM_SW_COOKIE_CONV_CFG_WBM2SW3_EN	0x00000010
+#define HAL_WBM_SW_COOKIE_CONV_CFG_WBM2SW4_EN	0x00000020
+#define HAL_WBM_SW_COOKIE_CONV_CFG_GLOBAL_EN	0x00000100
 
 /* TCL ring field mask and offset */
 #define HAL_TCL1_RING_BASE_MSB_RING_SIZE		GENMASK(27, 8)
 #define HAL_TCL1_RING_BASE_MSB_RING_BASE_ADDR_MSB	GENMASK(7, 0)
 #define HAL_TCL1_RING_ID_ENTRY_SIZE			GENMASK(7, 0)
+#define ATH12K_HAL_TCL1_RING_MISC_MSI_RING_ID_DISABLE	BIT(0)
 #define HAL_TCL1_RING_MISC_MSI_LOOPCNT_DISABLE		BIT(1)
 #define HAL_TCL1_RING_MISC_MSI_SWAP			BIT(3)
 #define HAL_TCL1_RING_MISC_HOST_FW_SWAP			BIT(4)
@@ -7314,7 +7485,7 @@ enum hal_reo_cmd_status {
 #define HAL_TCL1_RING_CONSR_INT_SETUP_IX1_LOW_THOLD	GENMASK(15, 0)
 #define HAL_TCL1_RING_MSI1_BASE_MSB_MSI1_ENABLE		BIT(8)
 #define HAL_TCL1_RING_MSI1_BASE_MSB_ADDR		GENMASK(7, 0)
-#define HAL_TCL1_RING_CMN_CTRL_DSCP_TID_MAP_PROG_EN	BIT(17)
+#define HAL_TCL1_RING_CMN_CTRL_DSCP_TID_MAP_PROG_EN	BIT(23)
 #define HAL_TCL1_RING_FIELD_DSCP_TID_MAP		GENMASK(31, 0)
 #define HAL_TCL1_RING_FIELD_DSCP_TID_MAP0		GENMASK(2, 0)
 #define HAL_TCL1_RING_FIELD_DSCP_TID_MAP1		GENMASK(5, 3)
@@ -7342,6 +7513,7 @@ enum hal_reo_cmd_status {
 #define HAL_REO1_GEN_ENABLE_AGING_LIST_ENABLE		BIT(2)
 #define HAL_REO1_GEN_ENABLE_AGING_FLUSH_ENABLE		BIT(3)
 #define HAL_REO1_MISC_CTL_FRAGMENT_DST_RING		GENMASK(20, 17)
+#define HAL_REO1_MISC_CTL_BAR_DST_RING			GENMASK(24, 21)
 
 /* CE ring bit field mask and shift */
 #define HAL_CE_DST_R0_DEST_CTRL_MAX_LEN			GENMASK(15, 0)
@@ -7360,23 +7532,30 @@ enum hal_reo_cmd_status {
 #define HAL_WBM_SCATTERED_DESC_HEAD_P_OFFSET_IX1	GENMASK(20, 8)
 #define HAL_WBM_SCATTERED_DESC_TAIL_P_OFFSET_IX1	GENMASK(20, 8)
 
+#define HAL_WBM_IDLE_LINK_RING_MISC_SRNG_ENABLE		BIT(6)
+#define HAL_WBM_IDLE_LINK_RING_MISC_RIND_ID_DISABLE	BIT(0)
+
 #define BASE_ADDR_MATCH_TAG_VAL 0x5
 
-#define HAL_REO_REO2SW1_RING_BASE_MSB_RING_SIZE		0x000fffff
-#define HAL_REO_REO2TCL_RING_BASE_MSB_RING_SIZE		0x000fffff
-#define HAL_REO_SW2REO_RING_BASE_MSB_RING_SIZE		0x0000ffff
-#define HAL_REO_CMD_RING_BASE_MSB_RING_SIZE		0x0000ffff
-#define HAL_REO_STATUS_RING_BASE_MSB_RING_SIZE		0x0000ffff
-#define HAL_SW2TCL1_RING_BASE_MSB_RING_SIZE		0x000fffff
-#define HAL_SW2TCL1_CMD_RING_BASE_MSB_RING_SIZE		0x000fffff
-#define HAL_TCL_STATUS_RING_BASE_MSB_RING_SIZE		0x0000ffff
-#define HAL_CE_SRC_RING_BASE_MSB_RING_SIZE		0x0000ffff
-#define HAL_CE_DST_RING_BASE_MSB_RING_SIZE		0x0000ffff
-#define HAL_CE_DST_STATUS_RING_BASE_MSB_RING_SIZE	0x0000ffff
-#define HAL_WBM_IDLE_LINK_RING_BASE_MSB_RING_SIZE	0x0000ffff
-#define HAL_SW2WBM_RELEASE_RING_BASE_MSB_RING_SIZE	0x0000ffff
-#define HAL_WBM2SW_RELEASE_RING_BASE_MSB_RING_SIZE	0x000fffff
-#define HAL_RXDMA_RING_MAX_SIZE				0x0000ffff
+#define HAL_REO_REO2SW1_RING_BASE_MSB_RING_SIZE			0x000fffff
+#define HAL_REO_REO2SW0_RING_BASE_MSB_RING_SIZE			0x000fffff
+#define HAL_REO_REO2TCL_RING_BASE_MSB_RING_SIZE			0x000fffff
+#define HAL_REO_SW2REO_RING_BASE_MSB_RING_SIZE			0x0000ffff
+#define HAL_REO_CMD_RING_BASE_MSB_RING_SIZE			0x0000ffff
+#define HAL_REO_STATUS_RING_BASE_MSB_RING_SIZE			0x0000ffff
+#define HAL_SW2TCL1_RING_BASE_MSB_RING_SIZE			0x000fffff
+#define HAL_SW2TCL1_CMD_RING_BASE_MSB_RING_SIZE			0x000fffff
+#define HAL_TCL_STATUS_RING_BASE_MSB_RING_SIZE			0x0000ffff
+#define HAL_CE_SRC_RING_BASE_MSB_RING_SIZE			0x0000ffff
+#define HAL_CE_DST_RING_BASE_MSB_RING_SIZE			0x0000ffff
+#define HAL_CE_DST_STATUS_RING_BASE_MSB_RING_SIZE		0x0000ffff
+#define HAL_WBM_IDLE_LINK_RING_BASE_MSB_RING_SIZE		0x0000ffff
+#define ATH12K_HAL_WBM_IDLE_LINK_RING_BASE_MSB_RING_SIZE	0x000fffff
+#define HAL_SW2WBM_RELEASE_RING_BASE_MSB_RING_SIZE		0x0000ffff
+#define HAL_WBM2SW_RELEASE_RING_BASE_MSB_RING_SIZE		0x000fffff
+#define HAL_RXDMA_RING_MAX_SIZE					0x0000ffff
+#define HAL_RXDMA_RING_MAX_SIZE_BE				0x000fffff
+#define HAL_WBM2PPE_RELEASE_RING_BASE_MSB_RING_SIZE		0x000fffff
 
 /* IPQ5018 ce registers */
 #define HAL_IPQ5018_CE_WFSS_REG_BASE		0x08400000
@@ -7858,6 +8037,14 @@ struct hal_tlv_hdr {
 	uint8_t value[];
 } __packed;
 
+#define HAL_TLV_64_HDR_TAG	GENMASK(9, 1)
+#define HAL_TLV_64_HDR_LEN	GENMASK(21, 10)
+
+struct hal_tlv_64_hdr {
+	uint64_t tl;
+	uint8_t value[];
+} __packed;
+
 #define RX_MPDU_DESC_INFO0_MSDU_COUNT		0xff
 #define RX_MPDU_DESC_INFO0_SEQ_NUM		0xfff00
 #define RX_MPDU_DESC_INFO0_FRAG_FLAG		(1 << 20)
@@ -8021,6 +8208,88 @@ struct rx_msdu_desc {
  *		to the expiration of search timer for this MSDU.
  */
 
+struct ath12k_rx_msdu_desc {
+	uint32_t info0;
+} __packed;
+
+/* rx_msdu_desc
+ *
+ * first_msdu_in_mpdu
+ *		Indicates first msdu in mpdu.
+ *
+ * last_msdu_in_mpdu
+ *		Indicates last msdu in mpdu. This flag can be true only when
+ *		'Msdu_continuation' set to 0. This implies that when an msdu
+ *		is spread out over multiple buffers and thus msdu_continuation
+ *		is set, only for the very last buffer of the msdu, can the
+ *		'last_msdu_in_mpdu' be set.
+ *
+ *		When both first_msdu_in_mpdu and last_msdu_in_mpdu are set,
+ *		the MPDU that this MSDU belongs to only contains a single MSDU.
+ *
+ * msdu_continuation
+ *		When set, this MSDU buffer was not able to hold the entire MSDU.
+ *		The next buffer will therefore contain additional information
+ *		related to this MSDU.
+ *
+ * msdu_length
+ *		Field is only valid in combination with the 'first_msdu_in_mpdu'
+ *		being set. Full MSDU length in bytes after decapsulation. This
+ *		field is still valid for MPDU frames without A-MSDU. It still
+ *		represents MSDU length after decapsulation Or in case of RAW
+ *		MPDUs, it indicates the length of the entire MPDU (without FCS
+ *		field).
+ *
+ * msdu_drop
+ *		Indicates that REO shall drop this MSDU and not forward it to
+ *		any other ring.
+ *
+ * valid_sa
+ *		Indicates OLE found a valid SA entry for this MSDU.
+ *
+ * valid_da
+ *		When set, OLE found a valid DA entry for this MSDU.
+ *
+ * da_mcbc
+ *		Field Only valid if valid_da is set. Indicates the DA address
+ *		is a Multicast or Broadcast address for this MSDU.
+ *
+ * l3_header_padding_msb
+ *		Passed on from 'RX_MSDU_END' TLV (only the MSB is reported as
+ *		the LSB is always zero). Number of bytes padded to make sure
+ *		that the L3 header will always start of a Dword boundary
+ *
+ * tcp_udp_checksum_fail
+ *		Passed on from 'RX_ATTENTION' TLV
+ *		Indicates that the computed checksum did not match the checksum
+ *		in the TCP/UDP header.
+ *
+ * ip_checksum_fail
+ *		Passed on from 'RX_ATTENTION' TLV
+ *		Indicates that the computed checksum did not match the checksum
+ *		in the IP header.
+ *
+ * from_DS
+ *		Set if the 'from DS' bit is set in the frame control.
+ *
+ * to_DS
+ *		Set if the 'to DS' bit is set in the frame control.
+ *
+ * intra_bss
+ *		This packet needs intra-BSS routing by SW as the 'vdev_id'
+ *		for the destination is the same as the 'vdev_id' that this
+ *		MSDU was got in.
+ *
+ * dest_chip_id
+ *		If intra_bss is set, copied by RXOLE/RXDMA from 'ADDR_SEARCH_ENTRY'
+ *		to support intra-BSS routing with multi-chip multi-link operation.
+ *		This indicates into which chip's TCL the packet should be queued.
+ *
+ * decap_format
+ *		Indicates the format after decapsulation:
+ */
+
+
 enum hal_reo_dest_ring_buffer_type {
 	HAL_REO_DEST_RING_BUFFER_TYPE_MSDU,
 	HAL_REO_DEST_RING_BUFFER_TYPE_LINK_DESC,
@@ -8140,6 +8409,87 @@ struct hal_reo_dest_ring {
  *		this ring has looped around the ring.
  */
 
+struct ath12k_hal_reo_dest_ring {
+	struct ath12k_buffer_addr buf_addr_info;
+	struct rx_mpdu_desc rx_mpdu_info;
+	struct ath12k_rx_msdu_desc rx_msdu_info;
+	uint32_t buf_va_lo;
+	uint32_t buf_va_hi;
+	uint32_t info0; /* %HAL_REO_DEST_RING_INFO0_ */
+} __packed;
+
+/* hal_reo_dest_ring
+ *
+ *		Producer: RXDMA
+ *		Consumer: REO/SW/FW
+ *
+ * buf_addr_info
+ *		Details of the physical address of a buffer or MSDU
+ *		link descriptor.
+ *
+ * rx_mpdu_info
+ *		General information related to the MPDU that is passed
+ *		on from REO entrance ring to the REO destination ring.
+ *
+ * rx_msdu_info
+ *		General information related to the MSDU that is passed
+ *		on from RXDMA all the way to the REO destination ring.
+ *
+ * buf_va_lo
+ *		Field only valid if Reo_dest_buffer_type is set to
+ *              MSDU_buf_address.
+ *		Lower 32 bits of the 64-bit virtual address corresponding
+ *		to Buf_or_link_desc_addr_info
+ *
+ * buf_va_hi
+ *		Address (upper 32 bits) of the REO queue descriptor.
+ *		Upper 32 bits of the 64-bit virtual address corresponding
+ *		to Buf_or_link_desc_addr_info
+ *
+ * buffer_type
+ *		Indicates the type of address provided in the buf_addr_info.
+ *		Values are defined in enum %HAL_REO_DEST_RING_BUFFER_TYPE_.
+ *
+ * push_reason
+ *		Reason for pushing this frame to this exit ring. Values are
+ *		defined in enum %HAL_REO_DEST_RING_PUSH_REASON_.
+ *
+ * error_code
+ *		Valid only when 'push_reason' is set. All error codes are
+ *		defined in enum %HAL_REO_DEST_RING_ERROR_CODE_.
+ *
+ * captured_msdu_data_size
+ *		The number of following REO_DESTINATION STRUCTs that have
+ *		been replaced with msdu_data extracted from the msdu_buffer
+ *		and copied into the ring for easy FW/SW access.
+ *
+ * sw_exception
+ *		This field has the same setting as the SW_exception field
+ *		in the corresponding REO_entrance_ring descriptor.
+ *		When set, the REO entrance descriptor is generated by FW,
+ *		and the MPDU was processed in the following way:
+ *		- NO re-order function is needed.
+ *		- MPDU delinking is determined by the setting of Entrance
+ *		  ring field: SW_excection_mpdu_delink
+ *		- Destination ring selection is based on the setting of
+ *		  the Entrance ring field SW_exception_destination _ring_valid
+ *
+ * src_link_id
+ *		Set to the link ID of the PMAC that received the frame
+ *
+ * signature
+ *		Set to value 0x8 when msdu capture mode is enabled for this ring
+ *
+ * ring_id
+ *		The buffer pointer ring id.
+ *		0 - Idle ring
+ *		1 - N refers to other rings.
+ *
+ * looping_count
+ *		Indicates the number of times the producer of entries into
+ *		this ring has looped around the ring.
+ */
+
 enum hal_reo_entr_rxdma_ecode {
 	HAL_REO_ENTR_RING_RXDMA_ECODE_OVERFLOW_ERR,
 	HAL_REO_ENTR_RING_RXDMA_ECODE_MPDU_LEN_ERR,
@@ -8173,7 +8523,6 @@ struct hal_reo_entrance_ring {
 	uint32_t info0; /* %HAL_REO_ENTR_RING_INFO0_ */
 	uint32_t info1; /* %HAL_REO_ENTR_RING_INFO1_ */
 	uint32_t info2; /* %HAL_REO_DEST_RING_INFO2_ */
-
 } __packed;
 
 /* hal_reo_entrance_ring
@@ -8349,6 +8698,11 @@ struct hal_reo_get_queue_stats {
 	uint32_t rsvd0[6];
 } __packed;
 
+struct ath12k_hal_reo_get_queue_stats {
+        struct hal_reo_get_queue_stats stats;
+	uint32_t tlv64_pad;
+} __packed;
+
 /* hal_reo_get_queue_stats
  *		Producer: SW
  *		Consumer: REO
@@ -8625,6 +8979,163 @@ struct hal_tcl_data_cmd {
 
 #define HAL_TCL_DESC_LEN sizeof(struct hal_tcl_data_cmd)
 
+struct ath12k_hal_tcl_data_cmd {
+	struct hal_tcl_data_cmd cmd;
+	uint32_t info5;
+} __packed;
+
+/* ath12k_hal_tcl_data_cmd
+ *
+ * buf_addr_info
+ *		Details of the physical address of a buffer or MSDU
+ *		link descriptor.
+ *
+ * tcl_cmd_type
+ *		used to select the type of TCL Command descriptor
+ *
+ * desc_type
+ *		Indicates the type of address provided in the buf_addr_info.
+ *		Values are defined in enum %HAL_REO_DEST_RING_BUFFER_TYPE_.
+ *
+ * bank_id
+ *		used to select one of the TCL register banks for fields removed
+ *		from 'TCL_DATA_CMD' that do not change often within one virtual
+ *		device or a set of virtual devices:
+ *
+ * tx_notify_frame
+ *		TCL copies this value to 'TQM_ENTRANCE_RING' field FW_tx_notify_frame.
+ *
+ * hdr_length_read_sel
+ *		used to select the per 'encap_type' register set for MSDU header
+ *		read length
+ *
+ * buffer_timestamp
+ * buffer_timestamp_valid
+ *		Frame system entrance timestamp. It shall be filled by first
+ *		module (SW, TCL or TQM) that sees the frames first.
+ *
+ * cmd_num
+ *		This number can be used to match against status.
+ *
+ * data_length
+ *		MSDU length in case of direct descriptor. Length of link
+ *		extension descriptor in case of Link extension descriptor.
+ *
+ * *_checksum_en
+ *		Enable checksum replacement for ipv4, udp_over_ipv4, ipv6,
+ *		udp_over_ipv6, tcp_over_ipv4 and tcp_over_ipv6.
+ *
+ * to_fw
+ *		Forward packet to FW along with classification result. The
+ *		packet will not be forward to TQM when this bit is set.
+ *		1'b0: Use classification result to forward the packet.
+ *		1'b1: Override classification result & forward packet only to fw
+ *
+ * packet_offset
+ *		Packet offset from Metadata in case of direct buffer descriptor.
+ *
+ * hlos_tid_overwrite
+ *
+ *		When set, TCL shall ignore the IP DSCP and VLAN PCP
+ *		fields and use HLOS_TID as the final TID. Otherwise TCL
+ *		shall consider the DSCP and PCP fields as well as HLOS_TID
+ *		and choose a final TID based on the configured priority
+ *
+ * flow_override_enable
+ *		TCL uses this to select the flow pointer from the peer table,
+ *		which can be overridden by SW for pre-encrypted raw WiFi packets
+ *		that cannot be parsed for UDP or for other MLO
+ *		0 - FP_PARSE_IP: Use the flow-pointer based on parsing the IPv4
+ *				 or IPv6 header.
+ *		1 - FP_USE_OVERRIDE: Use the who_classify_info_sel and
+ *				     flow_override fields to select the flow-pointer
+ *
+ * who_classify_info_sel
+ *		Field only valid when flow_override_enable is set to FP_USE_OVERRIDE.
+ *		This field is used to select  one of the 'WHO_CLASSIFY_INFO's in the
+ *		peer table in case more than 2 flows are mapped to a single TID.
+ *		0: To choose Flow 0 and 1 of any TID use this value.
+ *		1: To choose Flow 2 and 3 of any TID use this value.
+ *		2: To choose Flow 4 and 5 of any TID use this value.
+ *		3: To choose Flow 6 and 7 of any TID use this value.
+ *
+ *		If who_classify_info sel is not in sync with the num_tx_classify_info
+ *		field from address search, then TCL will set 'who_classify_info_sel'
+ *		to 0 use flows 0 and 1.
+ *
+ * hlos_tid
+ *		HLOS MSDU priority
+ *		Field is used when HLOS_TID_overwrite is set.
+ *
+ * flow_override
+ *		Field only valid when flow_override_enable is set to FP_USE_OVERRIDE
+ *		TCL uses this to select the flow pointer from the peer table,
+ *		which can be overridden by SW for pre-encrypted raw WiFi packets
+ *		that cannot be parsed for UDP or for other MLO
+ *		0 - FP_USE_NON_UDP: Use the non-UDP flow pointer (flow 0)
+ *		1 - FP_USE_UDP: Use the UDP flow pointer (flow 1)
+ *
+ * pmac_id
+ *		TCL uses this PMAC_ID in address search, i.e, while
+ *		finding matching entry for the packet in AST corresponding
+ *		to given PMAC_ID
+ *
+ *		If PMAC ID is all 1s (=> value 3), it indicates wildcard
+ *		match for any PMAC
+ *
+ * vdev_id
+ *		Virtual device ID to check against the address search entry to
+ *		avoid security issues from transmitting packets from an incorrect
+ *		virtual device
+ *
+ * search_index
+ *		The index that will be used for index based address or
+ *		flow search. The field is valid when 'search_type' is  1 or 2.
+ *
+ * cache_set_num
+ *
+ *		Cache set number that should be used to cache the index
+ *		based search results, for address and flow search. This
+ *		value should be equal to LSB four bits of the hash value of
+ *		match data, in case of search index points to an entry which
+ *		may be used in content based search also. The value can be
+ *		anything when the entry pointed by search index will not be
+ *		used for content based search.
+ *
+ * index_loop_override
+ *		When set, address search and packet routing is forced to use
+ *		'search_index' instead of following the register configuration
+ *		selected by Bank_id.
+ *
+ * ring_id
+ *		The buffer pointer ring ID.
+ *		0 refers to the IDLE ring
+ *		1 - N refers to other rings
+ *
+ * looping_count
+ *
+ *		A count value that indicates the number of times the
+ *		producer of entries into the Ring has looped around the
+ *		ring.
+ *
+ *		At initialization time, this value is set to 0. On the
+ *		first loop, this value is set to 1. After the max value is
+ *		reached allowed by the number of bits for this field, the
+ *		count value continues with 0 again.
+ *
+ *		In case SW is the consumer of the ring entries, it can
+ *		use this field to figure out up to where the producer of
+ *		entries has created new entries. This eliminates the need to
+ *		check where the head pointer' of the ring is located once
+ *		the SW starts processing an interrupt indicating that new
+ *		entries have been put into this ring...
+ *
+ *		Also note that SW if it wants only needs to look at the
+ *		LSB bit of this count value.
+ */
+
+#define ATH12K_HAL_TCL_DESC_LEN sizeof(struct ath12k_hal_tcl_data_cmd)
+
 enum hal_tcl_gse_ctrl {
 	HAL_TCL_GSE_CTRL_RD_STAT,
 	HAL_TCL_GSE_CTRL_SRCH_DIS,
@@ -9952,6 +10463,62 @@ struct hal_reo_desc_thresh_reached_status {
  *		entries into this Ring has looped around the ring.
  */
 
+struct hal_tcl_entrance_from_ppe_ring {
+	uint32_t buffer_addr;
+	uint32_t info0;
+} __packed;
+
+struct hal_mon_buf_ring {
+	uint32_t paddr_lo;
+	uint32_t paddr_hi;
+	uint64_t cookie;
+};
+
+/* hal_mon_buf_ring
+ *	Producer : SW
+ *	Consumer : Monitor
+ *
+ * paddr_lo
+ *	Lower 32-bit physical address of the buffer pointer from the source ring.
+ * paddr_hi
+ *	bit range 7-0 : upper 8 bit of the physical address.
+ *	bit range 31-8 : reserved.
+ * cookie
+ *	Consumer: RxMon/TxMon 64 bit cookie of the buffers.
+ */
+
+struct hal_mon_dest_desc {
+	uint32_t cookie;
+	uint32_t reserved;
+	uint32_t ppdu_id;
+	uint32_t info0;
+};
+
+/* hal_mon_dest_ring
+ *	Producer : TxMon/RxMon
+ *	Consumer : SW
+ * cookie
+ *	bit 0 -17 buf_id to track the skb's vaddr.
+ * ppdu_id
+ *	Phy ppdu_id
+ * end_offset
+ *	The offset into status buffer where DMA ended, ie., offset to the last
+ *	TLV + last TLV size.
+ * flush_detected
+ *	Indicates whether 'tx_flush' or 'rx_flush' occurred.
+ * end_of_ppdu
+ *	Indicates end of ppdu.
+ * pmac_id
+ *	Indicates PMAC that received from frame.
+ * empty_descriptor
+ *	This descriptor is written on flush or end of ppdu or end of status
+ *	buffer.
+ * ring_id
+ *	updated by SRNG.
+ * looping_count
+ *	updated by SRNG.
+ */
+
 #define REO_QUEUE_DESC_MAGIC_DEBUG_PATTERN_0 0xDDBEEF
 #define REO_QUEUE_DESC_MAGIC_DEBUG_PATTERN_1 0xADBEEF
 #define REO_QUEUE_DESC_MAGIC_DEBUG_PATTERN_2 0xBDBEEF
@@ -9963,11 +10530,11 @@ struct hal_reo_desc_thresh_reached_status {
 #define HAL_TX_ADDR_SEARCH_DEFAULT	0
 #define HAL_TX_ADDR_SEARCH_INDEX	1
 
-/* 
+/*
  * Copy Engine
  */
 
-#define CE_COUNT_MAX 12
+#define CE_COUNT_MAX 16
 
 /* Byte swap data words */
 #define CE_ATTR_BYTE_SWAP_DATA 2
@@ -10232,6 +10799,7 @@ enum ath12k_htc_svc_id {
 	ATH12K_HTC_SVC_ID_WMI_DATA_VO	= SVC(ATH12K_HTC_SVC_GRP_WMI, 4),
 	ATH12K_HTC_SVC_ID_WMI_CONTROL_MAC1 = SVC(ATH12K_HTC_SVC_GRP_WMI, 5),
 	ATH12K_HTC_SVC_ID_WMI_CONTROL_MAC2 = SVC(ATH12K_HTC_SVC_GRP_WMI, 6),
+	ATH12K_HTC_SVC_ID_WMI_CONTROL_DIAG = SVC(ATH12K_HTC_SVC_GRP_WMI, 7),
 
 	ATH12K_HTC_SVC_ID_NMI_CONTROL	= SVC(ATH12K_HTC_SVC_GRP_NMI, 0),
 	ATH12K_HTC_SVC_ID_NMI_DATA	= SVC(ATH12K_HTC_SVC_GRP_NMI, 1),
diff --git a/sys/dev/ic/qwzvar.h b/sys/dev/ic/qwzvar.h
index ee27c3f302f..ee91901bf2d 100644
--- a/sys/dev/ic/qwzvar.h
+++ b/sys/dev/ic/qwzvar.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: qwzvar.h,v 1.1 2024/08/14 14:40:46 patrick Exp $	*/
+/*	$OpenBSD: qwzvar.h,v 1.2 2024/08/15 22:01:37 patrick Exp $	*/
 
 /*
  * Copyright (c) 2018-2019 The Linux Foundation.
@@ -64,6 +64,7 @@ struct ath12k_hw_ring_mask {
 	uint8_t reo_status[ATH12K_EXT_IRQ_GRP_NUM_MAX];
 	uint8_t rxdma2host[ATH12K_EXT_IRQ_GRP_NUM_MAX];
 	uint8_t host2rxdma[ATH12K_EXT_IRQ_GRP_NUM_MAX];
+	uint8_t	tx_mon_dest[ATH12K_EXT_IRQ_GRP_NUM_MAX];
 };
 
 #define ATH12K_FW_DIR			"qwz"
@@ -88,29 +89,36 @@ struct ath12k_hw_tcl2wbm_rbm_map {
  * enum hal_rx_buf_return_buf_manager
  *
  * @HAL_RX_BUF_RBM_WBM_IDLE_BUF_LIST: Buffer returned to WBM idle buffer list
- * @HAL_RX_BUF_RBM_WBM_IDLE_DESC_LIST: Descriptor returned to WBM idle
- *	descriptor list.
+ * @HAL_RX_BUF_RBM_WBM_CHIP0_IDLE_DESC_LIST: Descriptor returned to WBM idle
+ * 	descriptor list, where the chip 0 WBM is chosen in case of a
+ *  	multi-chip config
  * @HAL_RX_BUF_RBM_FW_BM: Buffer returned to FW
  * @HAL_RX_BUF_RBM_SW0_BM: For Tx completion -- returned to host
  * @HAL_RX_BUF_RBM_SW1_BM: For Tx completion -- returned to host
  * @HAL_RX_BUF_RBM_SW2_BM: For Tx completion -- returned to host
  * @HAL_RX_BUF_RBM_SW3_BM: For Rx release -- returned to host
+ * @HAL_RX_BUF_RBM_SW4_BM: For Tx completion -- returned to host
+ * @HAL_RX_BUF_RBM_SW5_BM: For ring 5 -- returned to host
+ * @HAL_RX_BUF_RBM_SW6_BM: For ring 6 -- returned to host
  */
 
 enum hal_rx_buf_return_buf_manager {
 	HAL_RX_BUF_RBM_WBM_IDLE_BUF_LIST,
-	HAL_RX_BUF_RBM_WBM_IDLE_DESC_LIST,
+	HAL_RX_BUF_RBM_WBM_CHIP0_IDLE_DESC_LIST,
 	HAL_RX_BUF_RBM_FW_BM,
 	HAL_RX_BUF_RBM_SW0_BM,
 	HAL_RX_BUF_RBM_SW1_BM,
 	HAL_RX_BUF_RBM_SW2_BM,
 	HAL_RX_BUF_RBM_SW3_BM,
 	HAL_RX_BUF_RBM_SW4_BM,
+	HAL_RX_BUF_RBM_SW5_BM,
+	HAL_RX_BUF_RBM_SW6_BM,
 };
 
 struct ath12k_hw_hal_params {
 	enum hal_rx_buf_return_buf_manager rx_buf_rbm;
 	const struct ath12k_hw_tcl2wbm_rbm_map *tcl2wbm_rbm_map;
+	uint32_t wbm2sw_cc_enable;
 };
 
 struct hal_tx_info {
@@ -190,6 +198,7 @@ struct ath12k_hw_params {
 
 	bool rxdma1_enable;
 	int num_rxmda_per_pdev;
+	int num_rxdma_dst_ring;
 	bool rx_mac_buf_ring;
 	bool vdev_start_delay;
 	bool htt_peer_map_v2;
@@ -222,6 +231,7 @@ struct ath12k_hw_params {
 	bool credit_flow;
 	uint8_t max_tx_ring;
 	const struct ath12k_hw_hal_params *hal_params;
+	uint64_t qmi_cnss_feature_bitmap;
 #if notyet
 	bool supports_dynamic_smps_6ghz;
 	bool alloc_cacheable_memory;
@@ -237,7 +247,6 @@ struct ath12k_hw_params {
 	bool m3_fw_support;
 	bool fixed_bdf_addr;
 	bool fixed_mem_region;
-	bool static_window_map;
 	bool hybrid_bus_type;
 	bool fixed_fw_mem;
 #if notyet
@@ -312,19 +321,11 @@ struct ath12k_hw_ops {
 #endif
 };
 
-extern const struct ath12k_hw_ops ipq8074_ops;
-extern const struct ath12k_hw_ops ipq6018_ops;
-extern const struct ath12k_hw_ops qca6390_ops;
-extern const struct ath12k_hw_ops qcn9074_ops;
-extern const struct ath12k_hw_ops wcn6855_ops;
-extern const struct ath12k_hw_ops wcn6750_ops;
-
-extern const struct ath12k_hw_ring_mask ath12k_hw_ring_mask_ipq8074;
-extern const struct ath12k_hw_ring_mask ath12k_hw_ring_mask_qca6390;
-extern const struct ath12k_hw_ring_mask ath12k_hw_ring_mask_qcn9074;
-extern const struct ath12k_hw_ring_mask ath12k_hw_ring_mask_wcn6750;
+extern const struct ath12k_hw_ring_mask ath12k_hw_ring_mask_wcn7850;
 
 struct ath12k_hw_regs {
+	uint32_t hal_tcl1_ring_cmn_ctrl_reg;
+	uint32_t hal_tcl1_ring_dscp_tid_map;
 	uint32_t hal_tcl1_ring_base_lsb;
 	uint32_t hal_tcl1_ring_base_msb;
 	uint32_t hal_tcl1_ring_id;
@@ -338,8 +339,10 @@ struct ath12k_hw_regs {
 	uint32_t hal_tcl1_ring_msi1_data;
 	uint32_t hal_tcl2_ring_base_lsb;
 	uint32_t hal_tcl_ring_base_lsb;
+	uint32_t hal_tcl_ring_hp;
 
 	uint32_t hal_tcl_status_ring_base_lsb;
+	uint32_t hal_tcl_status_ring_hp;
 
 	uint32_t hal_reo1_ring_base_lsb;
 	uint32_t hal_reo1_ring_base_msb;
@@ -373,31 +376,53 @@ struct ath12k_hw_regs {
 	uint32_t hal_sw2reo_ring_base_lsb;
 	uint32_t hal_sw2reo_ring_hp;
 
-	uint32_t hal_seq_wcss_umac_ce0_src_reg;
 	uint32_t hal_seq_wcss_umac_ce0_dst_reg;
 	uint32_t hal_seq_wcss_umac_ce1_src_reg;
 	uint32_t hal_seq_wcss_umac_ce1_dst_reg;
 
 	uint32_t hal_wbm_idle_link_ring_base_lsb;
 	uint32_t hal_wbm_idle_link_ring_misc;
+	uint32_t hal_wbm_idle_link_ring_up;
+	uint32_t hal_wbm_r0_idle_list_cntl_addr;
+	uint32_t hal_wbm_r0_idle_list_size_addr;
+	uint32_t hal_wbm_scattered_ring_base_lsb;
+	uint32_t hal_wbm_scattered_ring_base_msb;
+	uint32_t hal_wbm_scattered_desc_head_info_ix0;
+	uint32_t hal_wbm_scattered_desc_head_info_ix1;
+	uint32_t hal_wbm_scattered_desc_tail_info_ix0;
+	uint32_t hal_wbm_scattered_desc_tail_info_ix1;
+	uint32_t hal_wbm_scattered_desc_ptr_hp_addr;
 
 	uint32_t hal_wbm_release_ring_base_lsb;
+	uint32_t hal_wbm_release_ring_hp;
+	uint32_t hal_wbm_sw1_release_ring_base_lsb;
 
 	uint32_t hal_wbm0_release_ring_base_lsb;
+	uint32_t hal_wbm0_release_ring_hp;
 	uint32_t hal_wbm1_release_ring_base_lsb;
+	uint32_t hal_wbm1_release_ring_hp;
 
 	uint32_t pcie_qserdes_sysclk_en_sel;
 	uint32_t pcie_pcs_osc_dtct_config_base;
 
+	uint32_t hal_ppe_rel_ring_base;
+
 	uint32_t hal_shadow_base_addr;
 	uint32_t hal_reo1_misc_ctl;
+	uint32_t hal_reo1_sw_cookie_cfg0;
+	uint32_t hal_reo1_sw_cookie_cfg1;
+	uint32_t hal_reo1_qdesc_lut_base0;
+	uint32_t hal_reo1_qdesc_lut_base1;
+	uint32_t hal_reo1_aging_thres_ix0;
+	uint32_t hal_reo1_aging_thres_ix1;
+	uint32_t hal_reo1_aging_thres_ix2;
+	uint32_t hal_reo1_aging_thres_ix3;
+
+	uint32_t hal_reo2_sw0_ring_base;
+	uint32_t hal_sw2reo1_ring_base;
 };
 
-extern const struct ath12k_hw_regs ipq8074_regs;
-extern const struct ath12k_hw_regs qca6390_regs;
-extern const struct ath12k_hw_regs qcn9074_regs;
-extern const struct ath12k_hw_regs wcn6855_regs;
-extern const struct ath12k_hw_regs wcn6750_regs;
+extern const struct ath12k_hw_regs wcn7850_regs;
 
 enum ath12k_dev_flags {
 	ATH12K_CAC_RUNNING,
@@ -647,9 +672,19 @@ enum hal_ring_type {
 	HAL_RXDMA_MONITOR_DST,
 	HAL_RXDMA_MONITOR_DESC,
 	HAL_RXDMA_DIR_BUF,
+	HAL_PPE2TCL,
+	HAL_PPE_RELEASE,
+	HAL_TX_MONITOR_BUF,
+	HAL_TX_MONITOR_DST,
 	HAL_MAX_RING_TYPES,
 };
 
+enum hal_srng_mac_type {
+	ATH12K_HAL_SRNG_UMAC,
+	ATH12K_HAL_SRNG_DMAC,
+	ATH12K_HAL_SRNG_PMAC
+};
+
 /* HW SRNG configuration table */
 struct hal_srng_config {
 	int start_ring_id;
@@ -658,6 +693,7 @@ struct hal_srng_config {
 	uint32_t reg_start[HAL_SRNG_NUM_REG_GRP];
 	uint16_t reg_size[HAL_SRNG_NUM_REG_GRP];
 	uint8_t lmac_ring;
+	enum hal_srng_mac_type mac_type;
 	enum hal_srng_dir ring_dir;
 	uint32_t max_size;
 };
@@ -767,7 +803,7 @@ struct ath12k_hal {
 	struct hal_srng srng_list[HAL_SRNG_RING_ID_MAX];
 
 	/* SRNG configuration table */
-	struct hal_srng_config srng_config[QWZ_NUM_SRNG_CFG];
+	struct hal_srng_config *srng_config;
 
 	/* Remote pointer memory for HW/FW updates */
 	struct qwz_dmamem *rdpmem;
@@ -837,7 +873,6 @@ struct ce_attr {
 	unsigned int dest_nentries;
 
 	void (*recv_cb)(struct qwz_softc *, struct mbuf *);
-	void (*send_cb)(struct qwz_softc *, struct mbuf *);
 };
 
 #define CE_DESC_RING_ALIGN 8
@@ -912,7 +947,7 @@ struct qwz_ce_ring {
 	uint32_t hal_ring_id;
 
 	/*
-	 * Per-transfer data. 
+	 * Per-transfer data.
 	 * Size and type of this data depends on how the ring is used.
 	 *
 	 * For transfers using DMA, the context contains pointers to
@@ -982,6 +1017,12 @@ struct qwz_dp_htt_wbm_tx_status {
 #define DP_RXDMA_MONITOR_BUF_RING_SIZE	4096
 #define DP_RXDMA_MONITOR_DST_RING_SIZE	2048
 #define DP_RXDMA_MONITOR_DESC_RING_SIZE	4096
+#define DP_TX_MONITOR_BUF_RING_SIZE	4096
+#define DP_TX_MONITOR_DEST_RING_SIZE	2048
+
+#define DP_TX_MONITOR_BUF_SIZE		2048
+#define DP_TX_MONITOR_BUF_SIZE_MIN	48
+#define DP_TX_MONITOR_BUF_SIZE_MAX	8192
 
 #define DP_RX_RELEASE_RING_NUM	3
 
@@ -999,6 +1040,74 @@ struct qwz_dp_htt_wbm_tx_status {
 #define DP_TX_DESC_ID_MSDU_ID GENMASK(18, 2)
 #define DP_TX_DESC_ID_POOL_ID GENMASK(20, 19)
 
+#define ATH12K_NUM_POOL_TX_DESC	32768
+
+/* TODO: revisit this count during testing */
+#define ATH12K_RX_DESC_COUNT	(12288)
+
+#define ATH12K_PAGE_SIZE	PAGE_SIZE
+
+/* Total 1024 entries in PPT, i.e 4K/4 considering 4K aligned
+ * SPT pages which makes lower 12bits 0
+ */
+#define ATH12K_MAX_PPT_ENTRIES	1024
+
+/* Total 512 entries in a SPT, i.e 4K Page/8 */
+#define ATH12K_MAX_SPT_ENTRIES	512
+
+#define ATH12K_NUM_RX_SPT_PAGES	((ATH12K_RX_DESC_COUNT) / ATH12K_MAX_SPT_ENTRIES)
+
+#define ATH12K_TX_SPT_PAGES_PER_POOL (ATH12K_NUM_POOL_TX_DESC / \
+					  ATH12K_MAX_SPT_ENTRIES)
+#define ATH12K_NUM_TX_SPT_PAGES	(ATH12K_TX_SPT_PAGES_PER_POOL * ATH12K_HW_MAX_QUEUES)
+#define ATH12K_NUM_SPT_PAGES	(ATH12K_NUM_RX_SPT_PAGES + ATH12K_NUM_TX_SPT_PAGES)
+
+#define ATH12K_TX_SPT_PAGE_OFFSET 0
+#define ATH12K_RX_SPT_PAGE_OFFSET ATH12K_NUM_TX_SPT_PAGES
+
+/* The SPT pages are divided for RX and TX, first block for RX
+ * and remaining for TX
+ */
+#define ATH12K_NUM_TX_SPT_PAGE_START ATH12K_NUM_RX_SPT_PAGES
+
+#define ATH12K_DP_RX_DESC_MAGIC	0xBABABABA
+
+/* 4K aligned address have last 12 bits set to 0, this check is done
+ * so that two spt pages address can be stored per 8bytes
+ * of CMEM (PPT)
+ */
+#define ATH12K_SPT_4K_ALIGN_CHECK 0xFFF
+#define ATH12K_SPT_4K_ALIGN_OFFSET 12
+#define ATH12K_PPT_ADDR_OFFSET(ppt_index) (4 * (ppt_index))
+
+/* To indicate HW of CMEM address, b0-31 are cmem base received via QMI */
+#define ATH12K_CMEM_ADDR_MSB 0x10
+
+/* Of 20 bits cookie, b0-b8 is to indicate SPT offset and b9-19 for PPT */
+#define ATH12K_CC_SPT_MSB 8
+#define ATH12K_CC_PPT_MSB 19
+#define ATH12K_CC_PPT_SHIFT 9
+#define ATH12K_DP_CC_COOKIE_SPT	GENMASK(8, 0)
+#define ATH12K_DP_CC_COOKIE_PPT	GENMASK(19, 9)
+
+#define DP_REO_QREF_NUM		GENMASK(31, 16)
+#define DP_MAX_PEER_ID		2047
+
+/* Total size of the LUT is based on 2K peers, each having reference
+ * for 17tids, note each entry is of type ath12k_reo_queue_ref
+ * hence total size is 2048 * 17 * 8 = 278528
+ */
+#define DP_REOQ_LUT_SIZE	278528
+
+/* Invalid TX Bank ID value */
+#define DP_INVALID_BANK_ID -1
+
+struct ath12k_dp_tx_bank_profile {
+	uint8_t is_configured;
+	uint32_t num_users;
+	uint32_t bank_config;
+};
+
 struct qwz_hp_update_timer {
 	struct timeout timer;
 	int started;
@@ -1010,6 +1119,29 @@ struct qwz_hp_update_timer {
 	struct qwz_softc *sc;
 };
 
+struct ath12k_rx_desc_info {
+	TAILQ_ENTRY(ath12k_rx_desc_info) entry;
+//	struct sk_buff *skb;
+	uint32_t cookie;
+	uint32_t magic;
+	uint8_t in_use		: 1,
+	        reserved	: 7;
+};
+
+struct ath12k_tx_desc_info {
+	TAILQ_ENTRY(ath12k_tx_desc_info) entry;
+//	struct sk_buff *skb;
+	uint32_t desc_id; /* Cookie */
+	uint8_t mac_id;
+	uint8_t pool_id;
+};
+
+struct ath12k_spt_info {
+	struct qwz_dmamem *mem;
+	struct ath12k_rx_desc_info *rxbaddr[ATH12K_NUM_RX_SPT_PAGES];
+	struct ath12k_tx_desc_info *txbaddr[ATH12K_NUM_TX_SPT_PAGES];
+};
+
 struct dp_rx_tid {
 	uint8_t tid;
 	struct qwz_dmamem *mem;
@@ -1089,6 +1221,14 @@ struct dp_link_desc_bank {
 #define DP_LINK_DESC_ALLOC_SIZE_THRESH 0x200000
 #define DP_LINK_DESC_BANKS_MAX 8
 
+#define DP_LINK_DESC_START	0x4000
+#define DP_LINK_DESC_SHIFT	3
+
+#define DP_LINK_DESC_COOKIE_SET(id, page) \
+	((((id) + DP_LINK_DESC_START) << DP_LINK_DESC_SHIFT) | (page))
+
+#define DP_LINK_DESC_BANK_MASK	GENMASK(2, 0)
+
 struct hal_wbm_idle_scatter_list {
 	struct qwz_dmamem *mem;
 	bus_addr_t paddr;
@@ -1131,6 +1271,19 @@ struct qwz_dp {
 #endif
 	struct qwz_hp_update_timer reo_cmd_timer;
 	struct qwz_hp_update_timer tx_ring_timer[DP_TCL_NUM_RING_MAX];
+	struct ath12k_spt_info *spt_info;
+	uint32_t num_spt_pages;
+	TAILQ_HEAD(,ath12k_rx_desc_info) rx_desc_free_list;
+#ifdef notyet
+	/* protects the free desc list */
+	spinlock_t rx_desc_lock;
+#endif
+	TAILQ_HEAD(,ath12k_tx_desc_info) tx_desc_free_list[ATH12K_HW_MAX_QUEUES];
+	TAILQ_HEAD(,ath12k_tx_desc_info) tx_desc_used_list[ATH12K_HW_MAX_QUEUES];
+#ifdef notyet
+	/* protects the free and used desc lists */
+	spinlock_t tx_desc_lock[ATH12K_HW_MAX_QUEUES];
+#endif
 };
 
 #define ATH12K_SHADOW_DP_TIMER_INTERVAL 20
@@ -1143,7 +1296,7 @@ struct qwz_ce_pipe {
 	unsigned int buf_sz;
 	unsigned int rx_buf_needed;
 
-	void (*send_cb)(struct qwz_softc *, struct mbuf *);
+	int (*send_cb)(struct qwz_ce_pipe *pipe);
 	void (*recv_cb)(struct qwz_softc *, struct mbuf *);
 
 #ifdef notyet
@@ -1171,8 +1324,8 @@ struct qwz_ce {
 struct qwz_qmi_ce_cfg {
 	const uint8_t *shadow_reg;
 	int shadow_reg_len;
-	uint32_t *shadow_reg_v2;
-	uint32_t shadow_reg_v2_len;
+	uint32_t *shadow_reg_v3;
+	uint32_t shadow_reg_v3_len;
 };
 
 struct qwz_qmi_target_info {
@@ -1187,6 +1340,11 @@ struct qwz_qmi_target_info {
 	char bdf_ext[ATH12K_QMI_BDF_EXT_STR_LENGTH];
 };
 
+struct qwz_qmi_dev_mem_info {
+	uint64_t start;
+	uint64_t size;
+};
+
 enum ath12k_bdf_search {
 	ATH12K_BDF_SEARCH_DEFAULT,
 	ATH12K_BDF_SEARCH_BUS_AND_BOARD,
@@ -1631,7 +1789,8 @@ struct qwz_pdev_dp {
 	struct dp_rxdma_ring rx_refill_buf_ring;
 	struct dp_srng rx_mac_buf_ring[MAX_RXDMA_PER_PDEV];
 	struct dp_srng rxdma_err_dst_ring[MAX_RXDMA_PER_PDEV];
-	struct dp_srng rxdma_mon_dst_ring;
+	struct dp_srng rxdma_mon_dst_ring[MAX_RXDMA_PER_PDEV];
+	struct dp_srng tx_mon_dst_ring[MAX_RXDMA_PER_PDEV];
 	struct dp_srng rxdma_mon_desc_ring;
 	struct dp_rxdma_ring rxdma_mon_buf_ring;
 	struct dp_rxdma_ring rx_mon_status_refill_ring[MAX_RXDMA_PER_PDEV];
@@ -1839,6 +1998,7 @@ struct qwz_softc {
 	int				qmi_cal_done;
 	struct qwz_qmi_ce_cfg		qmi_ce_cfg;
 	struct qwz_qmi_target_info	qmi_target;
+	struct qwz_qmi_dev_mem_info	qmi_dev_mem[ATH12K_QMI_WLFW_MAX_DEV_MEM_NUM_V01];
 	struct ath12k_targ_cap		target_caps;
 	int				num_radios;
 	uint32_t			cc_freq_hz;
@@ -1901,6 +2061,8 @@ struct qwz_softc {
 	struct qwz_ops			ops;
 	bus_dma_tag_t			sc_dmat;
 	enum ath12k_hw_rev		sc_hw_rev;
+	uint32_t			hal_seq_wcss_umac_ce0_src_reg;
+	int				static_window_map;
 	struct qwz_device_id		id;
 	char				sc_bus_str[4]; /* "pci" or "ahb" */
 	int				num_msivec;