[iwlwifi] Initial commit of iwlwifi driver sources

Change-Id: I8e1b5b9452e292622a79c58a6f90c66849f43261
Reviewed-on: https://fuchsia-review.googlesource.com/c/drivers/wlan/intel/iwlwifi/+/633161
Reviewed-by: Sean Cuff <seancuff@google.com>
Reviewed-by: Renato Mangini Dias <mangini@google.com>
diff --git a/third_party/iwlwifi/BUILD.bazel b/third_party/iwlwifi/BUILD.bazel
new file mode 100644
index 0000000..a947834
--- /dev/null
+++ b/third_party/iwlwifi/BUILD.bazel
@@ -0,0 +1,47 @@
+package(default_visibility = ["//visibility:public"])
+
+cc_library(
+    name = "core",
+    srcs = [
+        "iwl-drv.c",
+        "iwl-eeprom-parse.c",
+        "iwl-io.c",
+        "iwl-nvm-parse.c",
+        "iwl-phy-db.c",
+       "iwl-trans.c",
+        ],
+    hdrs = [
+       "iwl-agn-hw.h",
+       "iwl-config.h",
+        "iwl-constants.h",
+       "iwl-csr.h",
+        "iwl-dbg-tlv.h",
+        "iwl-debug.h",
+        "iwl-drv.h",
+        "iwl-eeprom-parse.h",
+        "iwl-eeprom-read.h",
+        "iwl-fh.h",
+       "iwl-io.h",
+       "iwl-modparams.h",
+       "iwl-nvm-parse.h",
+       "iwl-op-mode.h",
+       "iwl-phy-db.h",
+       "iwl-prph.h",
+       "iwl-scd.h",
+       "iwl-trans.h",
+       "iwl-vendor-cmd.h",
+       "iwl-context-info-gen3.h",
+       "iwl-context-info.h",
+        ],
+    deps = [
+        "//src/iwlwifi/fw:api",
+#        "//src/iwlwifi/platform:platform",
+#        "@fuchsia_sdk//pkg/ddk",
+#        "//zircon/system/public",
+#        "//zircon/system/ulib/sync",
+#        "//zircon/system/ulib/zircon-internal",
+
+#        "//sdk/banjo/ddk.hw.wlan.wlaninfo:ddk.hw.wlan.wlaninfo_banjo_c",
+#        "//zircon/system/public",
+    ],
+)
\ No newline at end of file
diff --git a/third_party/iwlwifi/BUILD.gn b/third_party/iwlwifi/BUILD.gn
new file mode 100644
index 0000000..9ec51cf
--- /dev/null
+++ b/third_party/iwlwifi/BUILD.gn
@@ -0,0 +1,110 @@
+# Copyright 2021 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import("//build/components.gni")
+import("//build/drivers.gni")
+
+visibility = [ "//src/iwlwifi/*" ]
+
+# Common configuration for builds on Fuchsia.
+config("fuchsia_config") {
+  defines = [
+    "CPTCFG_IWL_TIMEOUT_FACTOR=1",
+    "CPTCFG_IWLMVM=1",
+  ]
+}
+
+# The iwlwifi core sources.
+source_set("core") {
+  sources = [
+    "iwl-drv.c",
+    "iwl-eeprom-parse.c",
+    "iwl-io.c",
+    "iwl-nvm-parse.c",
+    "iwl-phy-db.c",
+    "iwl-trans.c",
+  ]
+  public = [
+    "iwl-agn-hw.h",
+    "iwl-config.h",
+    "iwl-constants.h",
+    "iwl-csr.h",
+    "iwl-dbg-tlv.h",
+    "iwl-debug.h",
+    "iwl-drv.h",
+    "iwl-eeprom-parse.h",
+    "iwl-eeprom-read.h",
+    "iwl-fh.h",
+    "iwl-io.h",
+    "iwl-modparams.h",
+    "iwl-nvm-parse.h",
+    "iwl-op-mode.h",
+    "iwl-phy-db.h",
+    "iwl-prph.h",
+    "iwl-scd.h",
+    "iwl-trans.h",
+    "iwl-vendor-cmd.h",
+  ]
+  deps = [
+    "//src/iwlwifi/fw:api",
+    "//src/lib/ddk",
+    "//zircon/system/public",
+    "//zircon/system/ulib/sync",
+    "//zircon/system/ulib/zircon-internal",
+  ]
+  public_deps = [
+    "//sdk/banjo/ddk.hw.wlan.wlaninfo:ddk.hw.wlan.wlaninfo_banjo_c",
+    "//src/iwlwifi/platform",
+    "//zircon/system/public",
+  ]
+
+  # TODO(https://fxbug.dev/58162): delete the below and fix compiler warnings
+  configs += [ "//build/config:Wno-conversion" ]
+}
+
+fuchsia_driver("iwlwifi_driver-driver") {
+  output_name = "iwlwifi"
+  deps = [ "//src/iwlwifi/platform:fuchsia_device" ]
+}
+
+fuchsia_driver_component("iwlwifi_driver") {
+  component_name = "iwlwifi"
+  deps = [ ":iwlwifi_driver-driver" ]
+  visibility = []
+  visibility = [ "*" ]
+}
+
+all_fw_files = [
+  "iwlwifi-7265D-29.ucode",
+  "iwlwifi-8265-31.ucode",
+  "iwlwifi-9260-th-b0-jf-b0-38.ucode",
+]
+
+foreach(fw_file, all_fw_files) {
+  resource("iwlwifi-firmware-" + fw_file) {
+    sources =
+        [ "//prebuilt/connectivity/wlan/firmware/intel/iwlwifi/" + fw_file ]
+    outputs = [ "lib/firmware/iwlwifi/" + fw_file ]
+  }
+}
+
+fuchsia_system_package("iwlwifi") {
+  deps = [ ":iwlwifi_driver" ]
+  foreach(fw_file, all_fw_files) {
+    deps += [ ":iwlwifi-firmware-" + fw_file ]
+  }
+  allowed_in_extra_deps = true
+  visibility = []
+  visibility = [ "*" ]
+}
+
+group("tests") {
+  testonly = true
+  deps = [
+    "//src/iwlwifi/platform:fuchsia_bind_test",
+    "//src/iwlwifi/test:iwlwifi_test",
+  ]
+  visibility = []
+  visibility = [ "*" ]
+}
diff --git a/third_party/iwlwifi/LICENSE b/third_party/iwlwifi/LICENSE
new file mode 100644
index 0000000..6304ea9
--- /dev/null
+++ b/third_party/iwlwifi/LICENSE
@@ -0,0 +1,27 @@
+Copyright(c) 2003- 2015 Intel Corporation
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+
+* Redistributions of source code must retain the above copyright
+  notice, this list of conditions and the following disclaimer.
+* Redistributions in binary form must reproduce the above copyright
+  notice, this list of conditions and the following disclaimer in
+  the documentation and/or other materials provided with the
+  distribution.
+* Neither the name Intel Corporation nor the names of its
+  contributors may be used to endorse or promote products derived
+  from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/third_party/iwlwifi/OWNERS b/third_party/iwlwifi/OWNERS
new file mode 100644
index 0000000..6c53d1a
--- /dev/null
+++ b/third_party/iwlwifi/OWNERS
@@ -0,0 +1,4 @@
+# COMPONENT:WLAN>iwlwifi
+alexlegg@google.com
+joshconner@google.com
+yjlou@google.com
diff --git a/third_party/iwlwifi/README.fuchsia b/third_party/iwlwifi/README.fuchsia
new file mode 100644
index 0000000..cc16172
--- /dev/null
+++ b/third_party/iwlwifi/README.fuchsia
@@ -0,0 +1,4 @@
+License: BSD
+
+Modifications:
+ - added README.fuchsia and kept BSD license
diff --git a/third_party/iwlwifi/README.md b/third_party/iwlwifi/README.md
new file mode 100644
index 0000000..f1d3ea2
--- /dev/null
+++ b/third_party/iwlwifi/README.md
@@ -0,0 +1,100 @@
+# Intel WiFi driver (iwlwifi)
+
+## What is This?
+
+The modern Intel chipset integrates an on-chip WiFi feature in order to reduce
+the board size and power consumption. It can be accessed via the PCIe bus.
+
+There are some hardware variants on the different chipsets. Also there are
+different firmware variants. The iwlwifi driver is the one driver to rule
+them all. However, currently we only focus on the MVM firmware on the 7265D
+module (the one on the Eve).
+
+Note that on some Intel chipsets, the WiFi feature is co-existing with
+Bluetooth feature. But this driver will not handle the Bluetooth. Instead,
+the Bluetooth driver will handle it.
+
+## Terminology
+
+- firmware (ucode): a piece of software code running inside the hardware.
+  This gives the hardware some flexibility to extend features or
+  fix/workaround bugs. So far we can tell from the driver source
+  code, the firmware variants include:
+
+  - MVM: a softmac implemention. This is used by the 7265D device.
+  - XVT: a firmware used on virtualization environment.
+  - FMAC: a fullmac implemention.
+  - DVM:
+  - TEST: a special firmware to debug the firmware and hardware.
+
+- opmode: each opmode is mapped to a firmware. For example, the MVM firmware
+  is an opmode. The opmode layer provides a unified interface for upper layer
+  (MLME) to call so that the upper layer doesn't need to know what exact the
+  firmware is.
+
+- MLME: a user of this softmac driver. It handles the all management packets,
+  for example, the scan, associate, and authenticate protocols.
+
+- mvm/mac80211.c: provides softmac functions like: add interface, scan, start
+  AP and tx packet.
+
+## The Driver Architecture
+
+Below is the brief illustration of how we map the iwlwifi driver onto Fuchsia:
+
+```
+                 MLME
+                  |
+           --------------- wlanphy_impl_protocol_ops_t / wlanmac_protocol_ops_t
+                  |
+     ^            |
+     |     +-------------+         +--------------+
+     |     |  opmodes[]  | <------ | iwl_drv      |
+     |     +-------------+         | calls opmode |
+     |            |                | to interact  |
+     |            |                | with mvm/.   |
+     |            |                +--------------+
+     |      +-----+-----+
+     |      |     |     |    opmode provides iwl_op_mode_ops callbacks for
+     |     xvt/  mvm/  FMAC  underlying layer to pass notifications from
+     |      |     |     |    firmware.
+iwl  |      +-----+-----+
+wifi |            |
+     |    ----------------- iwl_trans.h: the transportation layer provides
+drv  |            |         the upper layer the unified interface to access
+     |            |         the firmware/hardware.
+     |            |
+     |      +------------------+
+     |      |                  |          ^
+     |    PCIe            trans-sim.cc    | the
+     |    trans                |          | simulated
+     |      |             fake firmware   | environment
+     |      |                  |          | for
+     |      |              simulated      | testing
+     |      |             environment     v
+     v      |
+            |
+        --------- PCIe bus
+            |
+   real firmware/hardware
+```
+
+## The Testing Architecture
+
+In order to unittest the driver code, the first thing we do is fake the PCIe
+transportation layer so that the driver code can talk to the simulated
+transportation layer, the fake firmware and the simulated environment.
+
+The simulated environment is a library that the WLAN driver team creates to
+simulate the real-world WiFi environment. For example, a fake AP so that our
+driver can associate with it. The fake firmware can co-operate with it to
+return proper result back to the driver. An example is a scan command, the fake
+firmware can query how many APs are around in the simulated environment and
+return the scan result back to the driver.
+
+With mocking up the hardware, a test case now can test the driver behavior with
+meaningful environment setup.
+
+## Resources
+
+- https://wiki.gentoo.org/wiki/Iwlwifi
\ No newline at end of file
diff --git a/third_party/iwlwifi/cfg/22000.c b/third_party/iwlwifi/cfg/22000.c
new file mode 100644
index 0000000..6a8c28e
--- /dev/null
+++ b/third_party/iwlwifi/cfg/22000.c
@@ -0,0 +1,358 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2015-2017 Intel Deutschland GmbH
+ * Copyright (C) 2018 Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+
+#include <linux/module.h>
+#include <linux/stringify.h>
+
+#include "iwl-config.h"
+
+/* Highest firmware API version supported */
+#define IWL_22000_UCODE_API_MAX 44
+
+/* Lowest firmware API version supported */
+#define IWL_22000_UCODE_API_MIN 39
+
+/* NVM versions */
+#define IWL_22000_NVM_VERSION 0x0a1d
+
+/* Memory offsets and lengths */
+#define IWL_22000_DCCM_OFFSET 0x800000 /* LMAC1 */
+#define IWL_22000_DCCM_LEN 0x10000     /* LMAC1 */
+#define IWL_22000_DCCM2_OFFSET 0x880000
+#define IWL_22000_DCCM2_LEN 0x8000
+#define IWL_22000_SMEM_OFFSET 0x400000
+#define IWL_22000_SMEM_LEN 0xD0000
+
+#define IWL_22000_JF_FW_PRE "iwlwifi-Qu-a0-jf-b0-"
+#define IWL_22000_HR_FW_PRE "iwlwifi-Qu-a0-hr-a0-"
+#define IWL_22000_HR_CDB_FW_PRE "iwlwifi-QuIcp-z0-hrcdb-a0-"
+#define IWL_22000_HR_A_F0_FW_PRE "iwlwifi-QuQnj-f0-hr-a0-"
+#define IWL_22000_HR_B_F0_FW_PRE "iwlwifi-Qu-b0-hr-b0-"
+#define IWL_22000_QU_B_HR_B_FW_PRE "iwlwifi-Qu-b0-hr-b0-"
+#define IWL_22000_HR_B_FW_PRE "iwlwifi-QuQnj-b0-hr-b0-"
+#define IWL_22000_JF_B0_FW_PRE "iwlwifi-QuQnj-a0-jf-b0-"
+#define IWL_22000_HR_A0_FW_PRE "iwlwifi-QuQnj-a0-hr-a0-"
+#define IWL_22000_SU_Z0_FW_PRE "iwlwifi-su-z0-"
+#define IWL_QU_B_JF_B_FW_PRE "iwlwifi-Qu-b0-jf-b0-"
+#define IWL_CC_A_FW_PRE "iwlwifi-cc-a0-"
+
+#define IWL_22000_HR_MODULE_FIRMWARE(api) IWL_22000_HR_FW_PRE __stringify(api) ".ucode"
+#define IWL_22000_JF_MODULE_FIRMWARE(api) IWL_22000_JF_FW_PRE __stringify(api) ".ucode"
+#define IWL_22000_HR_A_F0_QNJ_MODULE_FIRMWARE(api) \
+  IWL_22000_HR_A_F0_FW_PRE __stringify(api) ".ucode"
+#define IWL_22000_HR_B_F0_QNJ_MODULE_FIRMWARE(api) \
+  IWL_22000_HR_B_F0_FW_PRE __stringify(api) ".ucode"
+#define IWL_22000_QU_B_HR_B_MODULE_FIRMWARE(api) \
+  IWL_22000_QU_B_HR_B_FW_PRE __stringify(api) ".ucode"
+#define IWL_22000_HR_B_QNJ_MODULE_FIRMWARE(api) IWL_22000_HR_B_FW_PRE __stringify(api) ".ucode"
+#define IWL_22000_JF_B0_QNJ_MODULE_FIRMWARE(api) IWL_22000_JF_B0_FW_PRE __stringify(api) ".ucode"
+#define IWL_22000_HR_A0_QNJ_MODULE_FIRMWARE(api) IWL_22000_HR_A0_FW_PRE __stringify(api) ".ucode"
+#define IWL_22000_SU_Z0_MODULE_FIRMWARE(api) IWL_22000_SU_Z0_FW_PRE __stringify(api) ".ucode"
+#define IWL_QU_B_JF_B_MODULE_FIRMWARE(api) IWL_QU_B_JF_B_FW_PRE __stringify(api) ".ucode"
+#define IWL_CC_A_MODULE_FIRMWARE(api) IWL_CC_A_FW_PRE __stringify(api) ".ucode"
+
+static const struct iwl_base_params iwl_22000_base_params = {
+    .eeprom_size = OTP_LOW_IMAGE_SIZE_32K,
+    .num_of_queues = 512,
+    .max_tfd_queue_size = 256,
+    .shadow_ram_support = true,
+    .led_compensation = 57,
+    .wd_timeout = IWL_LONG_WD_TIMEOUT,
+    .max_event_log_size = 512,
+    .shadow_reg_enable = true,
+    .pcie_l1_allowed = true,
+};
+
+static const struct iwl_base_params iwl_22560_base_params = {
+    .eeprom_size = OTP_LOW_IMAGE_SIZE_32K,
+    .num_of_queues = 512,
+    .max_tfd_queue_size = 65536,
+    .shadow_ram_support = true,
+    .led_compensation = 57,
+    .wd_timeout = IWL_LONG_WD_TIMEOUT,
+    .max_event_log_size = 512,
+    .shadow_reg_enable = true,
+    .pcie_l1_allowed = true,
+};
+
+static const struct iwl_ht_params iwl_22000_ht_params = {
+    .stbc = true,
+    .ldpc = true,
+    .ht40_bands = BIT(NL80211_BAND_2GHZ) | BIT(NL80211_BAND_5GHZ),
+};
+
+#define IWL_DEVICE_22000_COMMON                                                        \
+  .ucode_api_max = IWL_22000_UCODE_API_MAX, .ucode_api_min = IWL_22000_UCODE_API_MIN,  \
+  .led_mode = IWL_LED_RF_STATE, .nvm_hw_section_num = 10, .non_shared_ant = ANT_B,     \
+  .dccm_offset = IWL_22000_DCCM_OFFSET, .dccm_len = IWL_22000_DCCM_LEN,                \
+  .dccm2_offset = IWL_22000_DCCM2_OFFSET, .dccm2_len = IWL_22000_DCCM2_LEN,            \
+  .smem_offset = IWL_22000_SMEM_OFFSET, .smem_len = IWL_22000_SMEM_LEN,                \
+  .features = IWL_TX_CSUM_NETIF_FLAGS | NETIF_F_RXCSUM, .apmg_not_supported = true,    \
+  .mq_rx_supported = true, .vht_mu_mimo_supported = true, .mac_addr_from_csr = true,   \
+  .ht_params = &iwl_22000_ht_params, .nvm_ver = IWL_22000_NVM_VERSION,                 \
+  .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K, .use_tfh = true, .rf_id = true, \
+  .gen2 = true, .nvm_type = IWL_NVM_EXT, .dbgc_supported = true,                       \
+  .min_umac_error_event_table = 0x400000, .d3_debug_data_base_addr = 0x401000,         \
+  .d3_debug_data_length = 60 * 1024
+
+#define IWL_DEVICE_22500                                             \
+  IWL_DEVICE_22000_COMMON, .device_family = IWL_DEVICE_FAMILY_22000, \
+                           .base_params = &iwl_22000_base_params, .csr = &iwl_csr_v1
+
+#define IWL_DEVICE_22560                                             \
+  IWL_DEVICE_22000_COMMON, .device_family = IWL_DEVICE_FAMILY_22560, \
+                           .base_params = &iwl_22560_base_params, .csr = &iwl_csr_v2
+
+const struct iwl_cfg iwl22000_2ac_cfg_hr = {
+    .name = "Intel(R) Dual Band Wireless AC 22000",
+    .fw_name_pre = IWL_22000_HR_FW_PRE,
+    IWL_DEVICE_22500,
+};
+
+const struct iwl_cfg iwl22000_2ac_cfg_hr_cdb = {
+    .name = "Intel(R) Dual Band Wireless AC 22000",
+    .fw_name_pre = IWL_22000_HR_CDB_FW_PRE,
+    IWL_DEVICE_22500,
+    .cdb = true,
+};
+
+const struct iwl_cfg iwl22000_2ac_cfg_jf = {
+    .name = "Intel(R) Dual Band Wireless AC 22000",
+    .fw_name_pre = IWL_22000_JF_FW_PRE,
+    IWL_DEVICE_22500,
+};
+
+const struct iwl_cfg iwl22560_2ax_cfg_hr = {
+    .name = "Intel(R) Wireless-AX 22560",
+    .fw_name_pre = IWL_22000_QU_B_HR_B_FW_PRE,
+    IWL_DEVICE_22500,
+    /*
+     * This device doesn't support receiving BlockAck with a large bitmap
+     * so we need to restrict the size of transmitted aggregation to the
+     * HT size; mac80211 would otherwise pick the HE max (256) by default.
+     */
+    .max_tx_agg_size = IEEE80211_MAX_AMPDU_BUF_HT,
+};
+
+const struct iwl_cfg iwl22260_2ax_cfg = {
+    .name = "Intel(R) Wireless-AX 22260",
+    .fw_name_pre = IWL_CC_A_FW_PRE,
+    IWL_DEVICE_22500,
+    /*
+     * This device doesn't support receiving BlockAck with a large bitmap
+     * so we need to restrict the size of transmitted aggregation to the
+     * HT size; mac80211 would otherwise pick the HE max (256) by default.
+     */
+    .max_tx_agg_size = IEEE80211_MAX_AMPDU_BUF_HT,
+};
+
+const struct iwl_cfg killer1650x_2ax_cfg = {
+    .name = "Killer(R) Wireless-AX 1650x Wireless Network Adapter (22260NGW)",
+    .fw_name_pre = IWL_CC_A_FW_PRE,
+    IWL_DEVICE_22500,
+    /*
+     * This device doesn't support receiving BlockAck with a large bitmap
+     * so we need to restrict the size of transmitted aggregation to the
+     * HT size; mac80211 would otherwise pick the HE max (256) by default.
+     */
+    .max_tx_agg_size = IEEE80211_MAX_AMPDU_BUF_HT,
+};
+
+const struct iwl_cfg killer1650w_2ax_cfg = {
+    .name = "Killer(R) Wireless-AX 1650w Wireless Network Adapter (22260D2W)",
+    .fw_name_pre = IWL_CC_A_FW_PRE,
+    IWL_DEVICE_22500,
+    /*
+     * This device doesn't support receiving BlockAck with a large bitmap
+     * so we need to restrict the size of transmitted aggregation to the
+     * HT size; mac80211 would otherwise pick the HE max (256) by default.
+     */
+    .max_tx_agg_size = IEEE80211_MAX_AMPDU_BUF_HT,
+};
+
+/*
+ * All JF radio modules are part of the 9000 series, but the MAC part
+ * looks more like 22000.  That's why this device is here, but called
+ * 9560 nevertheless.
+ */
+const struct iwl_cfg iwl9461_2ac_cfg_qu_b0_jf_b0 = {
+    .name = "Intel(R) Wireless-AC 9461",
+    .fw_name_pre = IWL_QU_B_JF_B_FW_PRE,
+    IWL_DEVICE_22500,
+};
+
+const struct iwl_cfg iwl9462_2ac_cfg_qu_b0_jf_b0 = {
+    .name = "Intel(R) Wireless-AC 9462",
+    .fw_name_pre = IWL_QU_B_JF_B_FW_PRE,
+    IWL_DEVICE_22500,
+};
+
+const struct iwl_cfg iwl9560_2ac_cfg_qu_b0_jf_b0 = {
+    .name = "Intel(R) Wireless-AC 9560",
+    .fw_name_pre = IWL_QU_B_JF_B_FW_PRE,
+    IWL_DEVICE_22500,
+};
+
+const struct iwl_cfg killer1550i_2ac_cfg_qu_b0_jf_b0 = {
+    .name = "Killer (R) Wireless-AC 1550i Wireless Network Adapter (9560NGW)",
+    .fw_name_pre = IWL_QU_B_JF_B_FW_PRE,
+    IWL_DEVICE_22500,
+};
+
+const struct iwl_cfg killer1550s_2ac_cfg_qu_b0_jf_b0 = {
+    .name = "Killer (R) Wireless-AC 1550s Wireless Network Adapter (9560NGW)",
+    .fw_name_pre = IWL_QU_B_JF_B_FW_PRE,
+    IWL_DEVICE_22500,
+};
+
+const struct iwl_cfg killer1650s_2ax_cfg_qu_b0_hr_b0 = {
+    .name = "Killer(R) Wireless-AX 1650i Wireless Network Adapter (22560NGW)",
+    .fw_name_pre = IWL_22000_QU_B_HR_B_FW_PRE,
+    IWL_DEVICE_22500,
+    /*
+     * This device doesn't support receiving BlockAck with a large bitmap
+     * so we need to restrict the size of transmitted aggregation to the
+     * HT size; mac80211 would otherwise pick the HE max (256) by default.
+     */
+    .max_tx_agg_size = IEEE80211_MAX_AMPDU_BUF_HT,
+};
+
+const struct iwl_cfg killer1650i_2ax_cfg_qu_b0_hr_b0 = {
+    .name = "Killer(R) Wireless-AX 1650s Wireless Network Adapter (22560D2W)",
+    .fw_name_pre = IWL_22000_QU_B_HR_B_FW_PRE,
+    IWL_DEVICE_22500,
+    /*
+     * This device doesn't support receiving BlockAck with a large bitmap
+     * so we need to restrict the size of transmitted aggregation to the
+     * HT size; mac80211 would otherwise pick the HE max (256) by default.
+     */
+    .max_tx_agg_size = IEEE80211_MAX_AMPDU_BUF_HT,
+};
+
+const struct iwl_cfg iwl22000_2ax_cfg_jf = {
+    .name = "Intel(R) Dual Band Wireless AX 22000",
+    .fw_name_pre = IWL_QU_B_JF_B_FW_PRE,
+    IWL_DEVICE_22500,
+    /*
+     * This device doesn't support receiving BlockAck with a large bitmap
+     * so we need to restrict the size of transmitted aggregation to the
+     * HT size; mac80211 would otherwise pick the HE max (256) by default.
+     */
+    .max_tx_agg_size = IEEE80211_MAX_AMPDU_BUF_HT,
+};
+
+const struct iwl_cfg iwl22000_2ax_cfg_qnj_hr_a0_f0 = {
+    .name = "Intel(R) Dual Band Wireless AX 22000",
+    .fw_name_pre = IWL_22000_HR_A_F0_FW_PRE,
+    IWL_DEVICE_22500,
+    /*
+     * This device doesn't support receiving BlockAck with a large bitmap
+     * so we need to restrict the size of transmitted aggregation to the
+     * HT size; mac80211 would otherwise pick the HE max (256) by default.
+     */
+    .max_tx_agg_size = IEEE80211_MAX_AMPDU_BUF_HT,
+};
+
+const struct iwl_cfg iwl22000_2ax_cfg_qnj_hr_b0_f0 = {
+    .name = "Intel(R) Dual Band Wireless AX 22000",
+    .fw_name_pre = IWL_22000_HR_B_F0_FW_PRE,
+    IWL_DEVICE_22500,
+    /*
+     * This device doesn't support receiving BlockAck with a large bitmap
+     * so we need to restrict the size of transmitted aggregation to the
+     * HT size; mac80211 would otherwise pick the HE max (256) by default.
+     */
+    .max_tx_agg_size = IEEE80211_MAX_AMPDU_BUF_HT,
+};
+
+const struct iwl_cfg iwl22000_2ax_cfg_qnj_hr_b0 = {
+    .name = "Intel(R) Dual Band Wireless AX 22000",
+    .fw_name_pre = IWL_22000_HR_B_FW_PRE,
+    IWL_DEVICE_22500,
+    /*
+     * This device doesn't support receiving BlockAck with a large bitmap
+     * so we need to restrict the size of transmitted aggregation to the
+     * HT size; mac80211 would otherwise pick the HE max (256) by default.
+     */
+    .max_tx_agg_size = IEEE80211_MAX_AMPDU_BUF_HT,
+};
+
+const struct iwl_cfg iwl22000_2ax_cfg_qnj_jf_b0 = {
+    .name = "Intel(R) Dual Band Wireless AX 22000",
+    .fw_name_pre = IWL_22000_JF_B0_FW_PRE,
+    IWL_DEVICE_22500,
+    /*
+     * This device doesn't support receiving BlockAck with a large bitmap
+     * so we need to restrict the size of transmitted aggregation to the
+     * HT size; mac80211 would otherwise pick the HE max (256) by default.
+     */
+    .max_tx_agg_size = IEEE80211_MAX_AMPDU_BUF_HT,
+};
+
+const struct iwl_cfg iwl22000_2ax_cfg_qnj_hr_a0 = {
+    .name = "Intel(R) Dual Band Wireless AX 22000",
+    .fw_name_pre = IWL_22000_HR_A0_FW_PRE,
+    IWL_DEVICE_22500,
+    /*
+     * This device doesn't support receiving BlockAck with a large bitmap
+     * so we need to restrict the size of transmitted aggregation to the
+     * HT size; mac80211 would otherwise pick the HE max (256) by default.
+     */
+    .max_tx_agg_size = IEEE80211_MAX_AMPDU_BUF_HT,
+};
+
+const struct iwl_cfg iwl22560_2ax_cfg_su_cdb = {
+    .name = "Intel(R) Dual Band Wireless AX 22560",
+    .fw_name_pre = IWL_22000_SU_Z0_FW_PRE,
+    IWL_DEVICE_22560,
+    .cdb = true,
+    /*
+     * This device doesn't support receiving BlockAck with a large bitmap
+     * so we need to restrict the size of transmitted aggregation to the
+     * HT size; mac80211 would otherwise pick the HE max (256) by default.
+     */
+    .max_tx_agg_size = IEEE80211_MAX_AMPDU_BUF_HT,
+};
+
+MODULE_FIRMWARE(IWL_22000_HR_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+MODULE_FIRMWARE(IWL_22000_JF_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+MODULE_FIRMWARE(IWL_22000_HR_A_F0_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+MODULE_FIRMWARE(IWL_22000_HR_B_F0_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+MODULE_FIRMWARE(IWL_22000_QU_B_HR_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+MODULE_FIRMWARE(IWL_22000_HR_B_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+MODULE_FIRMWARE(IWL_22000_JF_B0_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+MODULE_FIRMWARE(IWL_22000_HR_A0_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+MODULE_FIRMWARE(IWL_22000_SU_Z0_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+MODULE_FIRMWARE(IWL_QU_B_JF_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+MODULE_FIRMWARE(IWL_CC_A_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
diff --git a/third_party/iwlwifi/cfg/7000.c b/third_party/iwlwifi/cfg/7000.c
new file mode 100644
index 0000000..b39f2ba
--- /dev/null
+++ b/third_party/iwlwifi/cfg/7000.c
@@ -0,0 +1,311 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
+ * Copyright(c) 2015        Intel Deutschland GmbH
+ * Copyright(c) 2018        Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+
+#include "src/iwlwifi/iwl-config.h"
+
+/* Highest firmware API version supported */
+#define IWL7260_UCODE_API_MAX 17
+#define IWL7265_UCODE_API_MAX 17
+#define IWL7265D_UCODE_API_MAX 29
+#define IWL3168_UCODE_API_MAX 29
+
+/* Lowest firmware API version supported */
+#define IWL7260_UCODE_API_MIN 17
+#define IWL7265_UCODE_API_MIN 17
+#define IWL7265D_UCODE_API_MIN 22
+#define IWL3168_UCODE_API_MIN 22
+
+/* NVM versions */
+#define IWL7260_NVM_VERSION 0x0a1d
+#define IWL3160_NVM_VERSION 0x709
+#define IWL3165_NVM_VERSION 0x709
+#define IWL3168_NVM_VERSION 0xd01
+#define IWL7265_NVM_VERSION 0x0a1d
+#define IWL7265D_NVM_VERSION 0x0c11
+
+/* DCCM offsets and lengths */
+#define IWL7000_DCCM_OFFSET 0x800000
+#define IWL7260_DCCM_LEN 0x14000
+#define IWL3160_DCCM_LEN 0x10000
+#define IWL7265_DCCM_LEN 0x17A00
+
+#define IWL7260_FW_PRE "iwlwifi-7260-"
+#define IWL7260_MODULE_FIRMWARE(api) IWL7260_FW_PRE __stringify(api) ".ucode"
+
+#define IWL3160_FW_PRE "iwlwifi-3160-"
+#define IWL3160_MODULE_FIRMWARE(api) IWL3160_FW_PRE __stringify(api) ".ucode"
+
+#define IWL3168_FW_PRE "iwlwifi-3168-"
+#define IWL3168_MODULE_FIRMWARE(api) IWL3168_FW_PRE __stringify(api) ".ucode"
+
+#define IWL7265_FW_PRE "iwlwifi-7265-"
+#define IWL7265_MODULE_FIRMWARE(api) IWL7265_FW_PRE __stringify(api) ".ucode"
+
+#define IWL7265D_FW_PRE "iwlwifi-7265D-"
+#define IWL7265D_MODULE_FIRMWARE(api) IWL7265D_FW_PRE __stringify(api) ".ucode"
+
+static const struct iwl_base_params iwl7000_base_params = {
+    .eeprom_size = OTP_LOW_IMAGE_SIZE_16K,
+    .num_of_queues = 31,
+    .max_tfd_queue_size = 256,
+    .shadow_ram_support = true,
+    .led_compensation = 57,
+    .wd_timeout = IWL_LONG_WD_TIMEOUT,
+    .max_event_log_size = 512,
+    .shadow_reg_enable = true,
+    .pcie_l1_allowed = true,
+    .apmg_wake_up_wa = true,
+};
+
+static const struct iwl_tt_params iwl7000_high_temp_tt_params = {
+    .ct_kill_entry = 118,
+    .ct_kill_exit = 96,
+    .ct_kill_duration = 5,
+    .dynamic_smps_entry = 114,
+    .dynamic_smps_exit = 110,
+    .tx_protection_entry = 114,
+    .tx_protection_exit = 108,
+    .tx_backoff =
+        {
+            {.temperature = 112, .backoff = 300},
+            {.temperature = 113, .backoff = 800},
+            {.temperature = 114, .backoff = 1500},
+            {.temperature = 115, .backoff = 3000},
+            {.temperature = 116, .backoff = 5000},
+            {.temperature = 117, .backoff = 10000},
+        },
+    .support_ct_kill = true,
+    .support_dynamic_smps = true,
+    .support_tx_protection = true,
+    .support_tx_backoff = true,
+};
+
+static const struct iwl_ht_params iwl7000_ht_params = {
+    .stbc = true,
+    .ht40_bands = BIT(WLAN_INFO_BAND_2GHZ) | BIT(WLAN_INFO_BAND_5GHZ),
+};
+
+#define IWL_DEVICE_7000_COMMON                                                             \
+  .device_family = IWL_DEVICE_FAMILY_7000, .base_params = &iwl7000_base_params,            \
+  .led_mode = IWL_LED_RF_STATE, .nvm_hw_section_num = 0, .non_shared_ant = ANT_A,          \
+  .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K, .dccm_offset = IWL7000_DCCM_OFFSET, \
+  .csr = &iwl_csr_v1
+
+#define IWL_DEVICE_7000                                           \
+  IWL_DEVICE_7000_COMMON, .ucode_api_max = IWL7260_UCODE_API_MAX, \
+                          .ucode_api_min = IWL7260_UCODE_API_MIN
+
+#define IWL_DEVICE_7005                                           \
+  IWL_DEVICE_7000_COMMON, .ucode_api_max = IWL7265_UCODE_API_MAX, \
+                          .ucode_api_min = IWL7265_UCODE_API_MIN
+
+#define IWL_DEVICE_3008                                           \
+  IWL_DEVICE_7000_COMMON, .ucode_api_max = IWL3168_UCODE_API_MAX, \
+                          .ucode_api_min = IWL3168_UCODE_API_MIN
+
+#define IWL_DEVICE_7005D                                           \
+  IWL_DEVICE_7000_COMMON, .ucode_api_max = IWL7265D_UCODE_API_MAX, \
+                          .ucode_api_min = IWL7265D_UCODE_API_MIN
+
+const struct iwl_cfg iwl7260_2ac_cfg = {
+    .name = "Intel(R) Dual Band Wireless AC 7260",
+    .fw_name_pre = IWL7260_FW_PRE,
+    IWL_DEVICE_7000,
+    .ht_params = &iwl7000_ht_params,
+    .nvm_ver = IWL7260_NVM_VERSION,
+    .host_interrupt_operation_mode = true,
+    .lp_xtal_workaround = true,
+    .dccm_len = IWL7260_DCCM_LEN,
+};
+
+const struct iwl_cfg iwl7260_2ac_cfg_high_temp = {
+    .name = "Intel(R) Dual Band Wireless AC 7260",
+    .fw_name_pre = IWL7260_FW_PRE,
+    IWL_DEVICE_7000,
+    .ht_params = &iwl7000_ht_params,
+    .nvm_ver = IWL7260_NVM_VERSION,
+    .high_temp = true,
+    .host_interrupt_operation_mode = true,
+    .lp_xtal_workaround = true,
+    .dccm_len = IWL7260_DCCM_LEN,
+    .thermal_params = &iwl7000_high_temp_tt_params,
+};
+
+const struct iwl_cfg iwl7260_2n_cfg = {
+    .name = "Intel(R) Dual Band Wireless N 7260",
+    .fw_name_pre = IWL7260_FW_PRE,
+    IWL_DEVICE_7000,
+    .ht_params = &iwl7000_ht_params,
+    .nvm_ver = IWL7260_NVM_VERSION,
+    .host_interrupt_operation_mode = true,
+    .lp_xtal_workaround = true,
+    .dccm_len = IWL7260_DCCM_LEN,
+};
+
+const struct iwl_cfg iwl7260_n_cfg = {
+    .name = "Intel(R) Wireless N 7260",
+    .fw_name_pre = IWL7260_FW_PRE,
+    IWL_DEVICE_7000,
+    .ht_params = &iwl7000_ht_params,
+    .nvm_ver = IWL7260_NVM_VERSION,
+    .host_interrupt_operation_mode = true,
+    .lp_xtal_workaround = true,
+    .dccm_len = IWL7260_DCCM_LEN,
+};
+
+const struct iwl_cfg iwl3160_2ac_cfg = {
+    .name = "Intel(R) Dual Band Wireless AC 3160",
+    .fw_name_pre = IWL3160_FW_PRE,
+    IWL_DEVICE_7000,
+    .ht_params = &iwl7000_ht_params,
+    .nvm_ver = IWL3160_NVM_VERSION,
+    .host_interrupt_operation_mode = true,
+    .dccm_len = IWL3160_DCCM_LEN,
+};
+
+const struct iwl_cfg iwl3160_2n_cfg = {
+    .name = "Intel(R) Dual Band Wireless N 3160",
+    .fw_name_pre = IWL3160_FW_PRE,
+    IWL_DEVICE_7000,
+    .ht_params = &iwl7000_ht_params,
+    .nvm_ver = IWL3160_NVM_VERSION,
+    .host_interrupt_operation_mode = true,
+    .dccm_len = IWL3160_DCCM_LEN,
+};
+
+const struct iwl_cfg iwl3160_n_cfg = {
+    .name = "Intel(R) Wireless N 3160",
+    .fw_name_pre = IWL3160_FW_PRE,
+    IWL_DEVICE_7000,
+    .ht_params = &iwl7000_ht_params,
+    .nvm_ver = IWL3160_NVM_VERSION,
+    .host_interrupt_operation_mode = true,
+    .dccm_len = IWL3160_DCCM_LEN,
+};
+
+static const struct iwl_pwr_tx_backoff iwl7265_pwr_tx_backoffs[] = {
+    {.pwr = 1600, .backoff = 0},   {.pwr = 1300, .backoff = 467},
+    {.pwr = 900, .backoff = 1900}, {.pwr = 800, .backoff = 2630},
+    {.pwr = 700, .backoff = 3720}, {.pwr = 600, .backoff = 5550},
+    {.pwr = 500, .backoff = 9350}, {0},
+};
+
+static const struct iwl_ht_params iwl7265_ht_params = {
+    .stbc = true,
+    .ldpc = true,
+    .ht40_bands = BIT(WLAN_INFO_BAND_2GHZ) | BIT(WLAN_INFO_BAND_5GHZ),
+};
+
+const struct iwl_cfg iwl3165_2ac_cfg = {
+    .name = "Intel(R) Dual Band Wireless AC 3165",
+    .fw_name_pre = IWL7265D_FW_PRE,
+    IWL_DEVICE_7005D,
+    .ht_params = &iwl7000_ht_params,
+    .nvm_ver = IWL3165_NVM_VERSION,
+    .pwr_tx_backoffs = iwl7265_pwr_tx_backoffs,
+    .dccm_len = IWL7265_DCCM_LEN,
+};
+
+const struct iwl_cfg iwl3168_2ac_cfg = {
+    .name = "Intel(R) Dual Band Wireless AC 3168",
+    .fw_name_pre = IWL3168_FW_PRE,
+    IWL_DEVICE_3008,
+    .ht_params = &iwl7000_ht_params,
+    .nvm_ver = IWL3168_NVM_VERSION,
+    .pwr_tx_backoffs = iwl7265_pwr_tx_backoffs,
+    .dccm_len = IWL7265_DCCM_LEN,
+    .nvm_type = IWL_NVM_SDP,
+};
+
+const struct iwl_cfg iwl7265_2ac_cfg = {
+    .name = "Intel(R) Dual Band Wireless AC 7265",
+    .fw_name_pre = IWL7265_FW_PRE,
+    IWL_DEVICE_7005,
+    .ht_params = &iwl7265_ht_params,
+    .nvm_ver = IWL7265_NVM_VERSION,
+    .pwr_tx_backoffs = iwl7265_pwr_tx_backoffs,
+    .dccm_len = IWL7265_DCCM_LEN,
+};
+
+const struct iwl_cfg iwl7265_2n_cfg = {
+    .name = "Intel(R) Dual Band Wireless N 7265",
+    .fw_name_pre = IWL7265_FW_PRE,
+    IWL_DEVICE_7005,
+    .ht_params = &iwl7265_ht_params,
+    .nvm_ver = IWL7265_NVM_VERSION,
+    .pwr_tx_backoffs = iwl7265_pwr_tx_backoffs,
+    .dccm_len = IWL7265_DCCM_LEN,
+};
+
+const struct iwl_cfg iwl7265_n_cfg = {
+    .name = "Intel(R) Wireless N 7265",
+    .fw_name_pre = IWL7265_FW_PRE,
+    IWL_DEVICE_7005,
+    .ht_params = &iwl7265_ht_params,
+    .nvm_ver = IWL7265_NVM_VERSION,
+    .pwr_tx_backoffs = iwl7265_pwr_tx_backoffs,
+    .dccm_len = IWL7265_DCCM_LEN,
+};
+
+const struct iwl_cfg iwl7265d_2ac_cfg = {
+    .name = "Intel(R) Dual Band Wireless AC 7265",
+    .fw_name_pre = IWL7265D_FW_PRE,
+    IWL_DEVICE_7005D,
+    .ht_params = &iwl7265_ht_params,
+    .nvm_ver = IWL7265D_NVM_VERSION,
+    .pwr_tx_backoffs = iwl7265_pwr_tx_backoffs,
+    .dccm_len = IWL7265_DCCM_LEN,
+};
+
+const struct iwl_cfg iwl7265d_2n_cfg = {
+    .name = "Intel(R) Dual Band Wireless N 7265",
+    .fw_name_pre = IWL7265D_FW_PRE,
+    IWL_DEVICE_7005D,
+    .ht_params = &iwl7265_ht_params,
+    .nvm_ver = IWL7265D_NVM_VERSION,
+    .pwr_tx_backoffs = iwl7265_pwr_tx_backoffs,
+    .dccm_len = IWL7265_DCCM_LEN,
+};
+
+const struct iwl_cfg iwl7265d_n_cfg = {
+    .name = "Intel(R) Wireless N 7265",
+    .fw_name_pre = IWL7265D_FW_PRE,
+    IWL_DEVICE_7005D,
+    .ht_params = &iwl7265_ht_params,
+    .nvm_ver = IWL7265D_NVM_VERSION,
+    .pwr_tx_backoffs = iwl7265_pwr_tx_backoffs,
+    .dccm_len = IWL7265_DCCM_LEN,
+};
diff --git a/third_party/iwlwifi/cfg/8000.c b/third_party/iwlwifi/cfg/8000.c
new file mode 100644
index 0000000..10fb9ed
--- /dev/null
+++ b/third_party/iwlwifi/cfg/8000.c
@@ -0,0 +1,173 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2014 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2018        Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+
+#include "src/iwlwifi/iwl-config.h"
+
+/* Highest firmware API version supported */
+#define IWL8000_UCODE_API_MAX 36
+#define IWL8265_UCODE_API_MAX 36
+
+/* Lowest firmware API version supported */
+#define IWL8000_UCODE_API_MIN 22
+#define IWL8265_UCODE_API_MIN 22
+
+/* NVM versions */
+#define IWL8000_NVM_VERSION 0x0a1d
+
+/* Memory offsets and lengths */
+#define IWL8260_DCCM_OFFSET 0x800000
+#define IWL8260_DCCM_LEN 0x18000
+#define IWL8260_DCCM2_OFFSET 0x880000
+#define IWL8260_DCCM2_LEN 0x8000
+#define IWL8260_SMEM_OFFSET 0x400000
+#define IWL8260_SMEM_LEN 0x68000
+
+#define IWL8000_FW_PRE "iwlwifi-8000C-"
+#define IWL8000_MODULE_FIRMWARE(api) IWL8000_FW_PRE __stringify(api) ".ucode"
+
+#define IWL8265_FW_PRE "iwlwifi-8265-"
+#define IWL8265_MODULE_FIRMWARE(api) IWL8265_FW_PRE __stringify(api) ".ucode"
+
+#define DEFAULT_NVM_FILE_FAMILY_8000C "nvmData-8000C"
+
+static const struct iwl_base_params iwl8000_base_params = {
+    .eeprom_size = OTP_LOW_IMAGE_SIZE_32K,
+    .num_of_queues = 31,
+    .max_tfd_queue_size = 256,
+    .shadow_ram_support = true,
+    .led_compensation = 57,
+    .wd_timeout = IWL_LONG_WD_TIMEOUT,
+    .max_event_log_size = 512,
+    .shadow_reg_enable = true,
+    .pcie_l1_allowed = true,
+};
+
+static const struct iwl_ht_params iwl8000_ht_params = {
+    .stbc = true,
+    .ldpc = true,
+    .ht40_bands = BIT(WLAN_INFO_BAND_2GHZ) | BIT(WLAN_INFO_BAND_5GHZ),
+};
+
+static const struct iwl_tt_params iwl8000_tt_params = {
+    .ct_kill_entry = 115,
+    .ct_kill_exit = 93,
+    .ct_kill_duration = 5,
+    .dynamic_smps_entry = 111,
+    .dynamic_smps_exit = 107,
+    .tx_protection_entry = 112,
+    .tx_protection_exit = 105,
+    .tx_backoff =
+        {
+            {.temperature = 110, .backoff = 200},
+            {.temperature = 111, .backoff = 600},
+            {.temperature = 112, .backoff = 1200},
+            {.temperature = 113, .backoff = 2000},
+            {.temperature = 114, .backoff = 4000},
+        },
+    .support_ct_kill = true,
+    .support_dynamic_smps = true,
+    .support_tx_protection = true,
+    .support_tx_backoff = true,
+};
+
+// TODO(fxbug.dev/61069): We temporarily removed .features = NETIF_F_RXCSUM. Add it back when the
+//                        WLAN driver supports it.
+#define IWL_DEVICE_8000_COMMON                                                                    \
+  .device_family = IWL_DEVICE_FAMILY_8000, .base_params = &iwl8000_base_params,                   \
+  .led_mode = IWL_LED_RF_STATE, .nvm_hw_section_num = 10, .features = 0, .non_shared_ant = ANT_A, \
+  .dccm_offset = IWL8260_DCCM_OFFSET, .dccm_len = IWL8260_DCCM_LEN,                               \
+  .dccm2_offset = IWL8260_DCCM2_OFFSET, .dccm2_len = IWL8260_DCCM2_LEN,                           \
+  .smem_offset = IWL8260_SMEM_OFFSET, .smem_len = IWL8260_SMEM_LEN,                               \
+  .default_nvm_file_C_step = DEFAULT_NVM_FILE_FAMILY_8000C, .thermal_params = &iwl8000_tt_params, \
+  .apmg_not_supported = true, .nvm_type = IWL_NVM_EXT, .dbgc_supported = true,                    \
+  .min_umac_error_event_table = 0x800000, .csr = &iwl_csr_v1
+
+#define IWL_DEVICE_8000                                           \
+  IWL_DEVICE_8000_COMMON, .ucode_api_max = IWL8000_UCODE_API_MAX, \
+                          .ucode_api_min = IWL8000_UCODE_API_MIN
+
+#define IWL_DEVICE_8260                                           \
+  IWL_DEVICE_8000_COMMON, .ucode_api_max = IWL8000_UCODE_API_MAX, \
+                          .ucode_api_min = IWL8000_UCODE_API_MIN
+
+#define IWL_DEVICE_8265                                           \
+  IWL_DEVICE_8000_COMMON, .ucode_api_max = IWL8265_UCODE_API_MAX, \
+                          .ucode_api_min = IWL8265_UCODE_API_MIN
+
+const struct iwl_cfg iwl8260_2n_cfg = {
+    .name = "Intel(R) Dual Band Wireless N 8260",
+    .fw_name_pre = IWL8000_FW_PRE,
+    IWL_DEVICE_8260,
+    .ht_params = &iwl8000_ht_params,
+    .nvm_ver = IWL8000_NVM_VERSION,
+};
+
+const struct iwl_cfg iwl8260_2ac_cfg = {
+    .name = "Intel(R) Dual Band Wireless AC 8260",
+    .fw_name_pre = IWL8000_FW_PRE,
+    IWL_DEVICE_8260,
+    .ht_params = &iwl8000_ht_params,
+    .nvm_ver = IWL8000_NVM_VERSION,
+    .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
+};
+
+const struct iwl_cfg iwl8265_2ac_cfg = {
+    .name = "Intel(R) Dual Band Wireless AC 8265",
+    .fw_name_pre = IWL8265_FW_PRE,
+    IWL_DEVICE_8265,
+    .ht_params = &iwl8000_ht_params,
+    .nvm_ver = IWL8000_NVM_VERSION,
+    .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
+    .vht_mu_mimo_supported = true,
+};
+
+const struct iwl_cfg iwl8275_2ac_cfg = {
+    .name = "Intel(R) Dual Band Wireless AC 8275",
+    .fw_name_pre = IWL8265_FW_PRE,
+    IWL_DEVICE_8265,
+    .ht_params = &iwl8000_ht_params,
+    .nvm_ver = IWL8000_NVM_VERSION,
+    .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
+    .vht_mu_mimo_supported = true,
+};
+
+const struct iwl_cfg iwl4165_2ac_cfg = {
+    .name = "Intel(R) Dual Band Wireless AC 4165",
+    .fw_name_pre = IWL8000_FW_PRE,
+    IWL_DEVICE_8000,
+    .ht_params = &iwl8000_ht_params,
+    .nvm_ver = IWL8000_NVM_VERSION,
+    .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
+};
diff --git a/third_party/iwlwifi/cfg/9000.c b/third_party/iwlwifi/cfg/9000.c
new file mode 100644
index 0000000..38226b8
--- /dev/null
+++ b/third_party/iwlwifi/cfg/9000.c
@@ -0,0 +1,241 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2015-2017 Intel Deutschland GmbH
+ * Copyright (C) 2018 Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+
+#include "src/iwlwifi/fw/file.h"
+#include "src/iwlwifi/iwl-config.h"
+
+/* Highest firmware API version supported */
+#define IWL9000_UCODE_API_MAX 44
+
+/* Lowest firmware API version supported */
+#define IWL9000_UCODE_API_MIN 30
+
+/* NVM versions */
+#define IWL9000_NVM_VERSION 0x0a1d
+
+/* Memory offsets and lengths */
+#define IWL9000_DCCM_OFFSET 0x800000
+#define IWL9000_DCCM_LEN 0x18000
+#define IWL9000_DCCM2_OFFSET 0x880000
+#define IWL9000_DCCM2_LEN 0x8000
+#define IWL9000_SMEM_OFFSET 0x400000
+#define IWL9000_SMEM_LEN 0x68000
+
+#define IWL9000_FW_PRE "iwlwifi-9000-pu-b0-jf-b0-"
+#define IWL9260_FW_PRE "iwlwifi-9260-th-b0-jf-b0-"
+#define IWL9000_MODULE_FIRMWARE(api) IWL9000_FW_PRE __stringify(api) ".ucode"
+#define IWL9260_MODULE_FIRMWARE(api) IWL9260_FW_PRE __stringify(api) ".ucode"
+
+static const struct iwl_base_params iwl9000_base_params = {
+    .eeprom_size = OTP_LOW_IMAGE_SIZE_32K,
+    .num_of_queues = 31,
+    .max_tfd_queue_size = 256,
+    .shadow_ram_support = true,
+    .led_compensation = 57,
+    .wd_timeout = IWL_LONG_WD_TIMEOUT,
+    .max_event_log_size = 512,
+    .shadow_reg_enable = true,
+    .pcie_l1_allowed = true,
+};
+
+static const struct iwl_ht_params iwl9000_ht_params = {
+    .stbc = true,
+    .ldpc = true,
+    .ht40_bands = BIT(WLAN_INFO_BAND_2GHZ) | BIT(WLAN_INFO_BAND_5GHZ),
+};
+
+static const struct iwl_tt_params iwl9000_tt_params = {
+    .ct_kill_entry = 115,
+    .ct_kill_exit = 93,
+    .ct_kill_duration = 5,
+    .dynamic_smps_entry = 111,
+    .dynamic_smps_exit = 107,
+    .tx_protection_entry = 112,
+    .tx_protection_exit = 105,
+    .tx_backoff =
+        {
+            {.temperature = 110, .backoff = 200},
+            {.temperature = 111, .backoff = 600},
+            {.temperature = 112, .backoff = 1200},
+            {.temperature = 113, .backoff = 2000},
+            {.temperature = 114, .backoff = 4000},
+        },
+    .support_ct_kill = true,
+    .support_dynamic_smps = true,
+    .support_tx_protection = true,
+    .support_tx_backoff = true,
+};
+
+// TODO(fxbug.com/79135): add back .features flags.
+#define IWL_DEVICE_9000                                                                       \
+  .ucode_api_max = IWL9000_UCODE_API_MAX, .ucode_api_min = IWL9000_UCODE_API_MIN,             \
+  .device_family = IWL_DEVICE_FAMILY_9000, .base_params = &iwl9000_base_params,               \
+  .led_mode = IWL_LED_RF_STATE, .nvm_hw_section_num = 10, .non_shared_ant = ANT_B,            \
+  .dccm_offset = IWL9000_DCCM_OFFSET, .dccm_len = IWL9000_DCCM_LEN,                           \
+  .dccm2_offset = IWL9000_DCCM2_OFFSET, .dccm2_len = IWL9000_DCCM2_LEN,                       \
+  .smem_offset = IWL9000_SMEM_OFFSET, .smem_len = IWL9000_SMEM_LEN, .features = 0,            \
+  .thermal_params = &iwl9000_tt_params, .apmg_not_supported = true, .mq_rx_supported = true,  \
+  .vht_mu_mimo_supported = true, .mac_addr_from_csr = true, .rf_id = true,                    \
+  .nvm_type = IWL_NVM_EXT, .dbgc_supported = true, .min_umac_error_event_table = 0x800000,    \
+  .csr = &iwl_csr_v1, .d3_debug_data_base_addr = 0x401000, .d3_debug_data_length = 92 * 1024, \
+  .ht_params = &iwl9000_ht_params, .nvm_ver = IWL9000_NVM_VERSION,                            \
+  .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+
+const struct iwl_cfg iwl9160_2ac_cfg = {
+    .name = "Intel(R) Dual Band Wireless AC 9160",
+    .fw_name_pre = IWL9260_FW_PRE,
+    IWL_DEVICE_9000,
+};
+
+const struct iwl_cfg iwl9260_2ac_cfg = {
+    .name = "Intel(R) Dual Band Wireless AC 9260",
+    .fw_name_pre = IWL9260_FW_PRE,
+    IWL_DEVICE_9000,
+};
+
+const struct iwl_cfg iwl9260_killer_2ac_cfg = {
+    .name = "Killer (R) Wireless-AC 1550 Wireless Network Adapter (9260NGW)",
+    .fw_name_pre = IWL9260_FW_PRE,
+    IWL_DEVICE_9000,
+};
+
+const struct iwl_cfg iwl9270_2ac_cfg = {
+    .name = "Intel(R) Dual Band Wireless AC 9270",
+    .fw_name_pre = IWL9260_FW_PRE,
+    IWL_DEVICE_9000,
+};
+
+const struct iwl_cfg iwl9460_2ac_cfg = {
+    .name = "Intel(R) Dual Band Wireless AC 9460",
+    .fw_name_pre = IWL9260_FW_PRE,
+    IWL_DEVICE_9000,
+};
+
+const struct iwl_cfg iwl9460_2ac_cfg_soc = {
+    .name = "Intel(R) Dual Band Wireless AC 9460",
+    .fw_name_pre = IWL9000_FW_PRE,
+    IWL_DEVICE_9000,
+    .integrated = true,
+    .soc_latency = 5000,
+};
+
+const struct iwl_cfg iwl9461_2ac_cfg_soc = {
+    .name = "Intel(R) Dual Band Wireless AC 9461",
+    .fw_name_pre = IWL9000_FW_PRE,
+    IWL_DEVICE_9000,
+    .integrated = true,
+    .soc_latency = 5000,
+};
+
+const struct iwl_cfg iwl9462_2ac_cfg_soc = {
+    .name = "Intel(R) Dual Band Wireless AC 9462",
+    .fw_name_pre = IWL9000_FW_PRE,
+    IWL_DEVICE_9000,
+    .integrated = true,
+    .soc_latency = 5000,
+};
+
+const struct iwl_cfg iwl9560_2ac_cfg = {
+    .name = "Intel(R) Dual Band Wireless AC 9560",
+    .fw_name_pre = IWL9260_FW_PRE,
+    IWL_DEVICE_9000,
+};
+
+const struct iwl_cfg iwl9560_2ac_cfg_soc = {
+    .name = "Intel(R) Dual Band Wireless AC 9560",
+    .fw_name_pre = IWL9000_FW_PRE,
+    IWL_DEVICE_9000,
+    .integrated = true,
+    .soc_latency = 5000,
+};
+
+const struct iwl_cfg iwl9560_killer_2ac_cfg_soc = {
+    .name = "Killer (R) Wireless-AC 1550i Wireless Network Adapter (9560NGW)",
+    .fw_name_pre = IWL9000_FW_PRE,
+    IWL_DEVICE_9000,
+    .integrated = true,
+    .soc_latency = 5000,
+};
+
+const struct iwl_cfg iwl9560_killer_s_2ac_cfg_soc = {
+    .name = "Killer (R) Wireless-AC 1550s Wireless Network Adapter (9560NGW)",
+    .fw_name_pre = IWL9000_FW_PRE,
+    IWL_DEVICE_9000,
+    .integrated = true,
+    .soc_latency = 5000,
+};
+
+const struct iwl_cfg iwl9460_2ac_cfg_shared_clk = {.name = "Intel(R) Dual Band Wireless AC 9460",
+                                                   .fw_name_pre = IWL9000_FW_PRE,
+                                                   IWL_DEVICE_9000,
+                                                   .integrated = true,
+                                                   .soc_latency = 5000,
+                                                   .extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK};
+
+const struct iwl_cfg iwl9461_2ac_cfg_shared_clk = {.name = "Intel(R) Dual Band Wireless AC 9461",
+                                                   .fw_name_pre = IWL9000_FW_PRE,
+                                                   IWL_DEVICE_9000,
+                                                   .integrated = true,
+                                                   .soc_latency = 5000,
+                                                   .extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK};
+
+const struct iwl_cfg iwl9462_2ac_cfg_shared_clk = {.name = "Intel(R) Dual Band Wireless AC 9462",
+                                                   .fw_name_pre = IWL9000_FW_PRE,
+                                                   IWL_DEVICE_9000,
+                                                   .integrated = true,
+                                                   .soc_latency = 5000,
+                                                   .extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK};
+
+const struct iwl_cfg iwl9560_2ac_cfg_shared_clk = {.name = "Intel(R) Dual Band Wireless AC 9560",
+                                                   .fw_name_pre = IWL9000_FW_PRE,
+                                                   IWL_DEVICE_9000,
+                                                   .integrated = true,
+                                                   .soc_latency = 5000,
+                                                   .extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK};
+
+const struct iwl_cfg iwl9560_killer_2ac_cfg_shared_clk = {
+    .name = "Killer (R) Wireless-AC 1550i Wireless Network Adapter (9560NGW)",
+    .fw_name_pre = IWL9000_FW_PRE,
+    IWL_DEVICE_9000,
+    .integrated = true,
+    .soc_latency = 5000,
+    .extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK};
+
+const struct iwl_cfg iwl9560_killer_s_2ac_cfg_shared_clk = {
+    .name = "Killer (R) Wireless-AC 1550s Wireless Network Adapter (9560NGW)",
+    .fw_name_pre = IWL9000_FW_PRE,
+    IWL_DEVICE_9000,
+    .integrated = true,
+    .soc_latency = 5000,
+    .extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK};
diff --git a/third_party/iwlwifi/cfg/BUILD.bazel b/third_party/iwlwifi/cfg/BUILD.bazel
new file mode 100644
index 0000000..43bb569
--- /dev/null
+++ b/third_party/iwlwifi/cfg/BUILD.bazel
@@ -0,0 +1,18 @@
+# Copyright 2021 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+package(default_visibility = ["//visibility:public"])
+
+cc_library(
+  name = "cfg",
+    srcs = [
+        "7000.c",
+        "8000.c",
+        "9000.c",
+  ],
+  deps = [
+    "//src/iwlwifi:core",
+    "//src/iwlwifi/fw:api",
+  ],
+)
\ No newline at end of file
diff --git a/third_party/iwlwifi/cfg/BUILD.gn b/third_party/iwlwifi/cfg/BUILD.gn
new file mode 100644
index 0000000..10ad30a
--- /dev/null
+++ b/third_party/iwlwifi/cfg/BUILD.gn
@@ -0,0 +1,17 @@
+# Copyright 2021 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+visibility = [ "//src/iwlwifi/*" ]
+
+source_set("cfg") {
+  sources = [
+    "7000.c",
+    "8000.c",
+    "9000.c",
+  ]
+  deps = [
+    "//src/iwlwifi:core",
+    "//src/iwlwifi/fw:api",
+  ]
+}
diff --git a/third_party/iwlwifi/fw/BUILD.bazel b/third_party/iwlwifi/fw/BUILD.bazel
new file mode 100644
index 0000000..2202c3d
--- /dev/null
+++ b/third_party/iwlwifi/fw/BUILD.bazel
@@ -0,0 +1,81 @@
+# Copyright 2021 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+package(default_visibility = ["//visibility:public"])
+
+# These are the headers for the firmware API.  To avoid circular dependencies, these do not depend
+# on anything in iwlwifi other than platform/.
+cc_library(
+    name = "api",
+    hdrs = [
+        "acpi.h",
+        "api/alive.h",
+        "api/binding.h",
+        "api/cmdhdr.h",
+        "api/coex.h",
+        "api/commands.h",
+        "api/config.h",
+        "api/context.h",
+        "api/d3.h",
+        "api/datapath.h",
+        "api/dbg-tlv.h",
+        "api/debug.h",
+        "api/filter.h",
+        "api/led.h",
+        "api/mac-cfg.h",
+        "api/mac.h",
+        "api/nan.h",
+        "api/nvm-reg.h",
+        "api/offload.h",
+        "api/paging.h",
+        "api/phy-ctxt.h",
+        "api/phy.h",
+        "api/power.h",
+        "api/rs.h",
+        "api/rx.h",
+        "api/scan.h",
+        "api/sf.h",
+        "api/soc.h",
+        "api/sta.h",
+        "api/stats.h",
+        "api/tdls.h",
+        "api/testing.h",
+        "api/time-event.h",
+        "api/tof.h",
+        "api/tx.h",
+        "api/txq.h",
+        "error-dump.h",
+        "file.h",
+        "img.h",
+        ],
+    deps = [
+        "//src/iwlwifi/platform:platform",
+        "@fuchsia_sdk//pkg/ddk",
+        "@fuchsia_sdk//fidl/fuchsia_wlan_ieee80211:fuchsia_wlan_ieee80211_banjo_cc",
+        ],
+)
+
+cc_library(
+    name = "fw",
+    srcs = [
+        "dbg.c",
+        "init.c",
+        "notif-wait.c",
+        "paging.c",
+        "smem.c",
+        ],
+    hdrs = [
+        "dbg.h",
+        "notif-wait.h",
+        "runtime.h",
+        "debugfs.h",
+        ],
+    deps = [
+        ":api",
+        "//src/iwlwifi:core",
+        "//src/iwlwifi/platform:platform",
+#    "//zircon/system/public",
+#    "//zircon/system/ulib/sync",
+        ],
+)
\ No newline at end of file
diff --git a/third_party/iwlwifi/fw/BUILD.gn b/third_party/iwlwifi/fw/BUILD.gn
new file mode 100644
index 0000000..f7035c9
--- /dev/null
+++ b/third_party/iwlwifi/fw/BUILD.gn
@@ -0,0 +1,78 @@
+# Copyright 2021 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+visibility = [ "//src/iwlwifi/*" ]
+
+# These are the headers for the firmware API.  To avoid circular dependencies, these do not depend
+# on anything in iwlwifi other than platform/.
+source_set("api") {
+  public = [
+    "acpi.h",
+    "api/alive.h",
+    "api/binding.h",
+    "api/cmdhdr.h",
+    "api/coex.h",
+    "api/commands.h",
+    "api/config.h",
+    "api/context.h",
+    "api/d3.h",
+    "api/datapath.h",
+    "api/dbg-tlv.h",
+    "api/debug.h",
+    "api/filter.h",
+    "api/led.h",
+    "api/mac-cfg.h",
+    "api/mac.h",
+    "api/nan.h",
+    "api/nvm-reg.h",
+    "api/offload.h",
+    "api/paging.h",
+    "api/phy-ctxt.h",
+    "api/phy.h",
+    "api/power.h",
+    "api/rs.h",
+    "api/rx.h",
+    "api/scan.h",
+    "api/sf.h",
+    "api/soc.h",
+    "api/sta.h",
+    "api/stats.h",
+    "api/tdls.h",
+    "api/testing.h",
+    "api/time-event.h",
+    "api/tof.h",
+    "api/tx.h",
+    "api/txq.h",
+    "error-dump.h",
+    "file.h",
+    "img.h",
+  ]
+  public_deps = [
+    "//sdk/fidl/fuchsia.wlan.ieee80211:fuchsia.wlan.ieee80211_c",
+    "//src/iwlwifi/platform",
+    "//src/lib/ddk",
+  ]
+}
+
+source_set("fw") {
+  sources = [
+    "dbg.c",
+    "init.c",
+    "notif-wait.c",
+    "paging.c",
+    "smem.c",
+  ]
+  public = [
+    "dbg.h",
+    "notif-wait.h",
+    "runtime.h",
+  ]
+  public_deps = [
+    ":api",
+    "//src/iwlwifi:core",
+    "//src/iwlwifi/platform",
+    "//zircon/system/public",
+    "//zircon/system/ulib/sync",
+  ]
+}
diff --git a/third_party/iwlwifi/fw/acpi.c b/third_party/iwlwifi/fw/acpi.c
new file mode 100644
index 0000000..a52d3c9
--- /dev/null
+++ b/third_party/iwlwifi/fw/acpi.c
@@ -0,0 +1,175 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2017        Intel Deutschland GmbH
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+
+#include "acpi.h"
+
+#include "iwl-debug.h"
+#include "iwl-drv.h"
+
+void* iwl_acpi_get_object(struct device* dev, acpi_string method) {
+  acpi_handle root_handle;
+  acpi_handle handle;
+  struct acpi_buffer buf = {ACPI_ALLOCATE_BUFFER, NULL};
+  acpi_status status;
+
+  root_handle = ACPI_HANDLE(dev);
+  if (!root_handle) {
+    IWL_DEBUG_DEV_RADIO(dev, "Could not retrieve root port ACPI handle\n");
+    return ERR_PTR(-ENOENT);
+  }
+
+  /* Get the method's handle */
+  status = acpi_get_handle(root_handle, method, &handle);
+  if (ACPI_FAILURE(status)) {
+    IWL_DEBUG_DEV_RADIO(dev, "%s method not found\n", method);
+    return ERR_PTR(-ENOENT);
+  }
+
+  /* Call the method with no arguments */
+  status = acpi_evaluate_object(handle, NULL, NULL, &buf);
+  if (ACPI_FAILURE(status)) {
+    IWL_DEBUG_DEV_RADIO(dev, "%s invocation failed (0x%x)\n", method, status);
+    return ERR_PTR(-ENOENT);
+  }
+
+  return buf.pointer;
+}
+IWL_EXPORT_SYMBOL(iwl_acpi_get_object);
+
+union acpi_object* iwl_acpi_get_wifi_pkg(struct device* dev, union acpi_object* data,
+                                         int data_size) {
+  int i;
+  union acpi_object* wifi_pkg;
+
+  /*
+   * We need at least one entry in the wifi package that
+   * describes the domain, and one more entry, otherwise there's
+   * no point in reading it.
+   */
+  if (WARN_ON_ONCE(data_size < 2)) {
+    return ERR_PTR(-EINVAL);
+  }
+
+  /*
+   * We need at least two packages, one for the revision and one
+   * for the data itself.  Also check that the revision is valid
+   * (i.e. it is an integer set to 0).
+   */
+  if (data->type != ACPI_TYPE_PACKAGE || data->package.count < 2 ||
+      data->package.elements[0].type != ACPI_TYPE_INTEGER ||
+      data->package.elements[0].integer.value != 0) {
+    IWL_DEBUG_DEV_RADIO(dev, "Unsupported packages structure\n");
+    return ERR_PTR(-EINVAL);
+  }
+
+  /* loop through all the packages to find the one for WiFi */
+  for (i = 1; i < data->package.count; i++) {
+    union acpi_object* domain;
+
+    wifi_pkg = &data->package.elements[i];
+
+    /* skip entries that are not a package with the right size */
+    if (wifi_pkg->type != ACPI_TYPE_PACKAGE || wifi_pkg->package.count != data_size) {
+      continue;
+    }
+
+    domain = &wifi_pkg->package.elements[0];
+    if (domain->type == ACPI_TYPE_INTEGER && domain->integer.value == ACPI_WIFI_DOMAIN) {
+      goto found;
+    }
+  }
+
+  return ERR_PTR(-ENOENT);
+
+found:
+  return wifi_pkg;
+}
+IWL_EXPORT_SYMBOL(iwl_acpi_get_wifi_pkg);
+
+int iwl_acpi_get_mcc(struct device* dev, char* mcc) {
+  union acpi_object *wifi_pkg, *data;
+  uint32_t mcc_val;
+  int ret;
+
+  data = iwl_acpi_get_object(dev, ACPI_WRDD_METHOD);
+  if (IS_ERR(data)) {
+    return PTR_ERR(data);
+  }
+
+  wifi_pkg = iwl_acpi_get_wifi_pkg(dev, data, ACPI_WRDD_WIFI_DATA_SIZE);
+  if (IS_ERR(wifi_pkg)) {
+    ret = PTR_ERR(wifi_pkg);
+    goto out_free;
+  }
+
+  if (wifi_pkg->package.elements[1].type != ACPI_TYPE_INTEGER) {
+    ret = -EINVAL;
+    goto out_free;
+  }
+
+  mcc_val = wifi_pkg->package.elements[1].integer.value;
+
+  mcc[0] = (mcc_val >> 8) & 0xff;
+  mcc[1] = mcc_val & 0xff;
+  mcc[2] = '\0';
+
+  ret = 0;
+out_free:
+  kfree(data);
+  return ret;
+}
+IWL_EXPORT_SYMBOL(iwl_acpi_get_mcc);
+
+uint64_t iwl_acpi_get_pwr_limit(struct device* dev) {
+  union acpi_object *data, *wifi_pkg;
+  uint64_t dflt_pwr_limit;
+
+  data = iwl_acpi_get_object(dev, ACPI_SPLC_METHOD);
+  if (IS_ERR(data)) {
+    dflt_pwr_limit = 0;
+    goto out;
+  }
+
+  wifi_pkg = iwl_acpi_get_wifi_pkg(dev, data, ACPI_SPLC_WIFI_DATA_SIZE);
+  if (IS_ERR(wifi_pkg) || wifi_pkg->package.elements[1].integer.value != ACPI_TYPE_INTEGER) {
+    dflt_pwr_limit = 0;
+    goto out_free;
+  }
+
+  dflt_pwr_limit = wifi_pkg->package.elements[1].integer.value;
+out_free:
+  kfree(data);
+out:
+  return dflt_pwr_limit;
+}
+IWL_EXPORT_SYMBOL(iwl_acpi_get_pwr_limit);
diff --git a/third_party/iwlwifi/fw/acpi.h b/third_party/iwlwifi/fw/acpi.h
new file mode 100644
index 0000000..71faf51
--- /dev/null
+++ b/third_party/iwlwifi/fw/acpi.h
@@ -0,0 +1,107 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2017        Intel Deutschland GmbH
+ * Copyright(c) 2018        Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+#ifndef SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_ACPI_H_
+#define SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_ACPI_H_
+
+#include <stddef.h>
+#include <zircon/types.h>
+
+#include "src/iwlwifi/platform/kernel.h"
+
+#define ACPI_WRDS_METHOD "WRDS"
+#define ACPI_EWRD_METHOD "EWRD"
+#define ACPI_WGDS_METHOD "WGDS"
+#define ACPI_WRDD_METHOD "WRDD"
+#define ACPI_SPLC_METHOD "SPLC"
+
+#define ACPI_WIFI_DOMAIN (0x07)
+
+#define ACPI_SAR_TABLE_SIZE 10
+#define ACPI_SAR_PROFILE_NUM 4
+
+#define ACPI_GEO_TABLE_SIZE 6
+#define ACPI_NUM_GEO_PROFILES 3
+#define ACPI_GEO_PER_CHAIN_SIZE 3
+
+#define ACPI_SAR_NUM_CHAIN_LIMITS 2
+#define ACPI_SAR_NUM_SUB_BANDS 5
+
+#define ACPI_WRDS_WIFI_DATA_SIZE (ACPI_SAR_TABLE_SIZE + 2)
+#define ACPI_EWRD_WIFI_DATA_SIZE ((ACPI_SAR_PROFILE_NUM - 1) * ACPI_SAR_TABLE_SIZE + 3)
+#define ACPI_WGDS_WIFI_DATA_SIZE 19
+#define ACPI_WRDD_WIFI_DATA_SIZE 2
+#define ACPI_SPLC_WIFI_DATA_SIZE 2
+
+#define ACPI_WGDS_NUM_BANDS 2
+#define ACPI_WGDS_TABLE_SIZE 3
+
+#ifdef CONFIG_ACPI
+
+void* iwl_acpi_get_object(struct device* dev, acpi_string method);
+union acpi_object* iwl_acpi_get_wifi_pkg(struct device* dev, union acpi_object* data,
+                                         int data_size);
+
+/**
+ * iwl_acpi_get_mcc - read MCC from ACPI, if available
+ *
+ * @dev: the struct device
+ * @mcc: output buffer (3 bytes) that will get the MCC
+ *
+ * This function tries to read the current MCC from ACPI if available.
+ */
+int iwl_acpi_get_mcc(struct device* dev, char* mcc);
+
+uint64_t iwl_acpi_get_pwr_limit(struct device* dev);
+
+#else /* CONFIG_ACPI */
+
+static inline void* iwl_acpi_get_object(struct device* dev, acpi_string method) {
+  // NEEDS_PORTING return ERR_PTR(-ENOENT);
+  return NULL;
+}
+
+static inline union acpi_object* iwl_acpi_get_wifi_pkg(struct device* dev, union acpi_object* data,
+                                                       int data_size) {
+  // NEEDS_PORTING return ERR_PTR(-ENOENT);
+  return NULL;
+}
+
+static inline zx_status_t iwl_acpi_get_mcc(struct device* dev, char* mcc) {
+  return ZX_ERR_NOT_FOUND;
+}
+
+static inline uint64_t iwl_acpi_get_pwr_limit(struct device* dev) { return 0; }
+
+#endif  /* CONFIG_ACPI */
+#endif  // SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_ACPI_H_
diff --git a/third_party/iwlwifi/fw/api/alive.h b/third_party/iwlwifi/fw/api/alive.h
new file mode 100644
index 0000000..f2980c8
--- /dev/null
+++ b/third_party/iwlwifi/fw/api/alive.h
@@ -0,0 +1,166 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * Copyright (C) 2018 Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+
+#ifndef SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_ALIVE_H_
+#define SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_ALIVE_H_
+
+#include "src/iwlwifi/platform/compiler.h"
+
+/* alive response is_valid values */
+#define ALIVE_RESP_UCODE_OK BIT(0)
+#define ALIVE_RESP_RFKILL BIT(1)
+
+/* alive response ver_type values */
+enum {
+  FW_TYPE_HW = 0,
+  FW_TYPE_PROT = 1,
+  FW_TYPE_AP = 2,
+  FW_TYPE_WOWLAN = 3,
+  FW_TYPE_TIMING = 4,
+  FW_TYPE_WIPAN = 5
+};
+
+/* alive response ver_subtype values */
+enum {
+  FW_SUBTYPE_FULL_FEATURE = 0,
+  FW_SUBTYPE_BOOTSRAP = 1, /* Not valid */
+  FW_SUBTYPE_REDUCED = 2,
+  FW_SUBTYPE_ALIVE_ONLY = 3,
+  FW_SUBTYPE_WOWLAN = 4,
+  FW_SUBTYPE_AP_SUBTYPE = 5,
+  FW_SUBTYPE_WIPAN = 6,
+  FW_SUBTYPE_INITIALIZE = 9
+};
+
+#define IWL_ALIVE_STATUS_ERR 0xDEAD
+#define IWL_ALIVE_STATUS_OK 0xCAFE
+
+#define IWL_ALIVE_FLG_RFKILL BIT(0)
+
+struct iwl_lmac_alive {
+  __le32 ucode_major;
+  __le32 ucode_minor;
+  uint8_t ver_subtype;
+  uint8_t ver_type;
+  uint8_t mac;
+  uint8_t opt;
+  __le32 timestamp;
+  __le32 error_event_table_ptr; /* SRAM address for error log */
+  __le32 log_event_table_ptr;   /* SRAM address for LMAC event log */
+  __le32 cpu_register_ptr;
+  __le32 dbgm_config_ptr;
+  __le32 alive_counter_ptr;
+  __le32 scd_base_ptr; /* SRAM address for SCD */
+  __le32 st_fwrd_addr; /* pointer to Store and forward */
+  __le32 st_fwrd_size;
+} __packed; /* UCODE_ALIVE_NTFY_API_S_VER_3 */
+
+struct iwl_umac_alive {
+  __le32 umac_major;      /* UMAC version: major */
+  __le32 umac_minor;      /* UMAC version: minor */
+  __le32 error_info_addr; /* SRAM address for UMAC error log */
+  __le32 dbg_print_buff_addr;
+} __packed; /* UMAC_ALIVE_DATA_API_S_VER_2 */
+
+struct mvm_alive_resp_v3 {
+  __le16 status;
+  __le16 flags;
+  struct iwl_lmac_alive lmac_data;
+  struct iwl_umac_alive umac_data;
+} __packed; /* ALIVE_RES_API_S_VER_3 */
+
+struct mvm_alive_resp {
+  __le16 status;
+  __le16 flags;
+  struct iwl_lmac_alive lmac_data[2];
+  struct iwl_umac_alive umac_data;
+} __packed; /* ALIVE_RES_API_S_VER_4 */
+
+/**
+ * enum iwl_extended_cfg_flag - commands driver may send before
+ *  finishing init flow
+ * @IWL_INIT_DEBUG_CFG: driver is going to send debug config command
+ * @IWL_INIT_NVM: driver is going to send NVM_ACCESS commands
+ * @IWL_INIT_PHY: driver is going to send PHY_DB commands
+ */
+enum iwl_extended_cfg_flags {
+  IWL_INIT_DEBUG_CFG,
+  IWL_INIT_NVM,
+  IWL_INIT_PHY,
+};
+
+/**
+ * struct iwl_extended_cfg_cmd - mark what commands ucode should wait for
+ * before finishing init flows
+ * @init_flags: values from iwl_extended_cfg_flags
+ */
+struct iwl_init_extended_cfg_cmd {
+  __le32 init_flags;
+} __packed; /* INIT_EXTENDED_CFG_CMD_API_S_VER_1 */
+
+/**
+ * struct iwl_radio_version_notif - information on the radio version
+ * ( RADIO_VERSION_NOTIFICATION = 0x68 )
+ * @radio_flavor: radio flavor
+ * @radio_step: radio version step
+ * @radio_dash: radio version dash
+ */
+struct iwl_radio_version_notif {
+  __le32 radio_flavor;
+  __le32 radio_step;
+  __le32 radio_dash;
+} __packed; /* RADIO_VERSION_NOTOFICATION_S_VER_1 */
+
+enum iwl_card_state_flags {
+  CARD_ENABLED = 0x00,
+  HW_CARD_DISABLED = 0x01,
+  SW_CARD_DISABLED = 0x02,
+  CT_KILL_CARD_DISABLED = 0x04,
+  HALT_CARD_DISABLED = 0x08,
+  CARD_DISABLED_MSK = 0x0f,
+  CARD_IS_RX_ON = 0x10,
+};
+
+/**
+ * struct iwl_radio_version_notif - information on the card state
+ * ( CARD_STATE_NOTIFICATION = 0xa1 )
+ * @flags: &enum iwl_card_state_flags
+ */
+struct iwl_card_state_notif {
+  __le32 flags;
+} __packed; /* CARD_STATE_NTFY_API_S_VER_1 */
+
+#endif  // SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_ALIVE_H_
diff --git a/third_party/iwlwifi/fw/api/ax-softap-testmode.h b/third_party/iwlwifi/fw/api/ax-softap-testmode.h
new file mode 100644
index 0000000..09997f0
--- /dev/null
+++ b/third_party/iwlwifi/fw/api/ax-softap-testmode.h
@@ -0,0 +1,339 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2017 Intel Deutschland GmbH
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *****************************************************************************/
+
+#ifndef SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_AX_SOFTAP_TESTMODE_H_
+#define SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_AX_SOFTAP_TESTMODE_H_
+
+#include "mac.h"
+
+/**
+ * struct trig_frame_common_softap_testmode
+ *
+ * all the configurable common trigger frame fields that can be set
+ * for this mode.
+ *
+ * @cmn_lsig_len: L-SIG Length
+ * @cmn_cascade_indication: Cascade Indication
+ * @cmn_carrier_sense_req: CS Required
+ * @cmn_gi_ltf: GI And LTF
+ * @cmn_mu_mimo_ltf: MU-MIMO LTF Mode
+ * @cmn_he_ltf_num: Number Of HE-LTF Symbols
+ * @cmn_ldpc_ext_sym: LDPC Extra Symbol Segment
+ * @cmn_packet_extension: Packet Extension
+ * @cmn_spatial_reuse: Spatial Reuse
+ * @cmn_doppler: Doppler
+ * @cmn_res_he_sig_a: HE-SIG-A Reserved
+ * @reserved: reserved for DW alignment
+ */
+struct trig_frame_common_softap_testmode {
+  __le16 cmn_lsig_len;
+  uint8_t cmn_cascade_indication;
+  uint8_t cmn_carrier_sense_req;
+  uint8_t cmn_gi_ltf;
+  uint8_t cmn_mu_mimo_ltf;
+  uint8_t cmn_he_ltf_num;
+  uint8_t cmn_ldpc_ext_sym;
+  uint8_t cmn_packet_extension;
+  __le16 cmn_spatial_reuse;
+  uint8_t cmn_doppler;
+  __le16 cmn_res_he_sig_a;
+  __le16 reserved;
+} __packed; /* TRIG_FRAME_COMMON_SOFTAP_TESTMODE_API_S_VER_1 */
+
+/**
+ * struct trig_frame_user_softap_testmode
+ *
+ * The struct contains all the common configurable per user trigger frame
+ * fields that can be set for this mode.
+ *
+ * @usr_assoc_id: AID12
+ * @usr_rsrc_unit_alloc: RU Allocation
+ * @usr_coding_type: Coding Type
+ * @usr_mcs: MCS
+ * @usr_dcm: DCM
+ * @usr_ss_allocation: SS Allocation
+ * @usr_target_rssi: Target RSSI
+ */
+struct trig_frame_user_softap_testmode {
+  __le16 usr_assoc_id;
+  uint8_t usr_rsrc_unit_alloc;
+  uint8_t usr_coding_type;
+  uint8_t usr_mcs;
+  uint8_t usr_dcm;
+  uint8_t usr_ss_allocation;
+  uint8_t usr_target_rssi;
+} __packed; /* TRIG_FRAME_USER_SOFTAP_TESTMODE_API_S_VER_1 */
+
+/**
+ * struct trig_frame_user_basic_softap_testmode
+ *
+ * he struct contains all the basic configurable per user trigger frame
+ * fields that can be set for this mode.
+ *
+ * @usr_space_factor: MPDU MU Spacing Factor
+ * @tid_agg_limit: TID Aggregation Limit
+ * @preferred_ac_enabled: AC Preference Level
+ * @preferred_ac: Preferred AC
+ */
+struct trig_frame_user_basic_softap_testmode {
+  uint8_t usr_space_factor;
+  uint8_t tid_agg_limit;
+  uint8_t preferred_ac_enabled;
+  uint8_t preferred_ac;
+} __packed; /* TRIG_FRAME_USER_BASIC_SOFTAP_TESTMODE_API_S_VER_1 */
+
+/**
+ * struct trig_frame_softap_testmode
+ *
+ * The struct contains all the common configurable trigger frame params that
+ * can be set for this mode.
+ *
+ * @pad_byte_count: the number of bytes to add in padding for the trigger frame
+ * @per_user_count: the number of per user sections in the configured trig frame
+ * @reserved: reserved for DW alignment
+ * @addr1: addr1 of the mh of the configured trig frame
+ * @reserved_for_addr1: addr data type in FW is aligned to 8 bytes
+ * @addr2: addr2 of the mh of the configured trig frame
+ * @reserved_for_addr2: addr data type in FW is aligned to 8 bytes
+ */
+struct trig_frame_softap_testmode {
+  __le16 pad_byte_count;
+  uint8_t per_user_count;
+  uint8_t reserved;
+  uint8_t addr1[6];
+  __le16 reserved_for_addr1;
+  uint8_t addr2[6];
+  __le16 reserved_for_addr2;
+} __packed; /* TRIG_FRAME_SOFTAP_TESTMODE_API_S_VER_1 */
+
+/**
+ * struct trig_frame_ax_softap_dl_basic
+ *
+ * command to configure the 11ax softap testmode for basic DL. In this mode
+ * the AP prepends 0-3 trigger frames to each aggregation so that the client
+ * is triggered to send a BA to the aggregation. This mode requires to enable
+ * the softap and connect an AX client to it which has been modified to send
+ * the triggered responses in HE_SU instead of HE_TRIG so that the softap
+ * hardware could receive it.
+ *
+ * @frame_params: general trigger frame params
+ * @common: content of the common trigger frame fields
+ * @per_user: content of the per user trigger frame fields - up to 3 per user
+ *        sections can be configured in this mode for each trigger frame
+ * @per_user_basic: content of the basic type per user trigger frame fields -
+ *          up to 3 per user sections can be configured in this mode
+ *          for each trigger frame
+ */
+struct trig_frame_ax_softap_dl_basic {
+  struct trig_frame_softap_testmode frame_params;
+  struct trig_frame_common_softap_testmode common;
+  struct trig_frame_user_softap_testmode per_user[3];
+  struct trig_frame_user_basic_softap_testmode per_user_basic[3];
+} __packed; /* TRIG_FRAME_SOFTAP_TESTMODE_DL_BASIC_API_S_VER_1 */
+
+/**
+ * struct ax_softap_testmode_dl_basic_cmd
+ *
+ * @enable: enable or disable this test mode
+ * @txop_duration_disable: bool to disable the txop duration in the HE PLCP of
+ *             the agg carrying the trigger frames for this
+ *             test mode
+ * @configured_frames_count: number of trigger frames configured for the
+ *               test mode - max 3 trigger frames
+ * @reserved: reserved for DW alignment
+ * @frames: the trigger frames content - up to 3 trigger frames can
+ *      be configured
+ */
+struct ax_softap_testmode_dl_basic_cmd {
+  uint8_t enable;
+  uint8_t txop_duration_disable;
+  uint8_t configured_frames_count;
+  uint8_t reserved;
+  struct trig_frame_ax_softap_dl_basic frames[3];
+} __packed; /* AX_SOFTAP_TESTMODE_DL_BASIC_API_S_VER_1 */
+
+/**
+ * struct trig_frame_bar_tid_ax_softap_testmode_dl_mu_bar
+ *
+ * The struct contains all the configurable bar per tid trigger frame
+ * fields that can be set for this mode.
+ *
+ * @association_id: AID
+ * @ba_ssn_bitmap_size: Fragment Number subfield (bits 1-2)
+ * @reserved: reserved for DW alignment
+ */
+struct trig_frame_bar_tid_ax_softap_testmode_dl_mu_bar {
+  __le16 association_id;
+  uint8_t ba_ssn_bitmap_size;
+  uint8_t reserved;
+} __packed; /* TRIG_FRAME_BAR_TID_SOFTAP_TESTMODE_DL_MU_BAR_API_S_VER_1 */
+
+/**
+ * struct trig_frame_bar_ax_softap_testmode_dl_mu_bar
+ *
+ * The struct contains all the configurable bar trigger frame fields that
+ * can be set for this mode.
+ *
+ * @block_ack_policy: BA Ack Policy
+ * @block_ack_type: BA Type
+ * @tid_count: the number of TIDs configured in this mu bar trigger frame
+ *         per user section
+ * @reserved: reserved for DW alignment
+ * @per_tid: MU-BAR trigger frame configuration per TID
+ */
+struct trig_frame_bar_ax_softap_testmode_dl_mu_bar {
+  uint8_t block_ack_policy;
+  uint8_t block_ack_type;
+  uint8_t tid_count;
+  uint8_t reserved;
+  struct trig_frame_bar_tid_ax_softap_testmode_dl_mu_bar per_tid[3];
+} __packed; /* TRIG_FRAME_BAR_SOFTAP_TESTMODE_DL_MU_BAR_API_S_VER_1 */
+
+/**
+ * struct trig_frame_ax_softap_dl_mu_bar
+ *
+ * command to configure the 11ax softap testmode for MU Bar DL. In this mode
+ * the AP sends a trigger frame after each aggregation so that the client is
+ * triggered to send a BA to the aggregation.
+ * This mode requires to enable the softap and connect an AX client to it
+ * which has been modified to send the triggered responses in HE_SU
+ * instead of HE_TRIG so that the softap hardware could receive it.
+ *
+ * @frame_params: general trigger frame params
+ * @common: content of the common trigger frame fields
+ * @per_user: content of the per user trigger frame fields - up to 3 per user
+ *        sections can be configured in this mode for each trigger frame
+ * @bar: content of the mu bar type per user trigger frame fields  - up to 3
+ *   per user sections can be configured in this mode for each trigger frame
+ */
+struct trig_frame_ax_softap_dl_mu_bar {
+  struct trig_frame_softap_testmode frame_params;
+  struct trig_frame_common_softap_testmode common;
+  struct trig_frame_user_softap_testmode per_user[3];
+  struct trig_frame_bar_ax_softap_testmode_dl_mu_bar bar[3];
+} __packed; /* TRIG_FRAME_SOFTAP_TESTMODE_DL_MU_BAR_API_S_VER_1 */
+
+/**
+ * struct ax_softap_testmode_dl_mu_bar_cmd
+ *
+ * @enable: enable or disable this test mode
+ * @reserved1: reserved for DW alignment
+ * @reserved2: reserved for DW alignment
+ * @rate_n_flags: rate for TX operation of the trigger frame
+ * @frame: the trigger frame content
+ */
+struct ax_softap_testmode_dl_mu_bar_cmd {
+  uint8_t enable;
+  __le16 reserved1;
+  uint8_t reserved2;
+  __le32 rate_n_flags;
+  struct trig_frame_ax_softap_dl_mu_bar frame;
+} __packed; /* AX_SOFTAP_TESTMODE_DL_MU_BAR_API_S_VER_1 */
+
+/**
+ * struct per_trig_params_ax_softap_ul
+ *
+ * @assoc_id: assoc id of the configured trig frame per user section
+ *        override (only for the first per user section in the frame
+ *        if more than 1 exist)
+ * @duration: duration of the mh of the configured trig frame
+ * @addr1: addr1 of the mh of the configured trig frame override
+ * @reserved_for_addr1: reserved for DW alignment
+ * @rate_n_flags: rate for TX operation of the configured trigger frame
+ */
+struct per_trig_params_ax_softap_ul {
+  __le16 assoc_id;
+  __le16 duration;
+  uint8_t addr1[6];
+  __le16 reserved_for_addr1;
+  __le32 rate_n_flags;
+} __packed; /* PER_TRIG_PARAMS_SOFTAP_TESTMODE_UL_API_S_VER_1 */
+
+/**
+ * struct trig_frame_ax_softap_ul
+ *
+ * command to configure the 11ax softap testmode for UL In this mode the
+ * AP sends a trigger frame periodically with a timer so that the client
+ * is triggered to send QOS data to the AP.
+ * This mode requires to enable the softap and connect an AX client to it
+ * which has been modified to send the triggered responses in HE_SU
+ * instead of HE_TRIG so that the softap hardware could receive it.
+ *
+ * @frame_params: general trigger frame params
+ * @common: content of the common trigger frame fields
+ * @per_user: content of the per user trigger frame fields  - up to 3 per user
+ *        sections can be configured in this mode for each trigger frame
+ * @per_user_basic: content of the basic type per user trigger frame fields
+ *          - up to 3 per user sections can be configured in this
+ *          mode for each trigger frame
+ */
+struct trig_frame_ax_softap_ul {
+  struct trig_frame_softap_testmode frame_params;
+  struct trig_frame_common_softap_testmode common;
+  struct trig_frame_user_softap_testmode per_user[3];
+  struct trig_frame_user_basic_softap_testmode per_user_basic[3];
+} __packed; /* TRIG_FRAME_SOFTAP_TESTMODE_UL_API_S_VER_1 */
+
+/**
+ * struct ax_softap_testmode_ul_cmd
+ *
+ * @enable: enable or disable this test mode
+ * @trig_frame_periodic_msec: the time timer interval in msecs for sending the
+ *                trigger frames
+ * @reserved: reserved for DW alignment
+ * @frame: the trigger frame content
+ * @number_of_triggers_in_sequence: the number of triggers to send after period
+ * @per_trigger: params to override config for each trigger in a sequence
+ */
+struct ax_softap_testmode_ul_cmd {
+  uint8_t enable;
+  uint8_t trig_frame_periodic_msec;
+  __le16 reserved;
+  struct trig_frame_ax_softap_ul frame;
+  __le32 number_of_triggers_in_sequence;
+  struct per_trig_params_ax_softap_ul per_trigger[4];
+} __packed; /* AX_SOFTAP_TESTMODE_UL_API_S_VER_2 */
+
+/**
+ * struct ax_softap_client_testmode_cmd
+ *
+ * @enable: enable or disable this test mode
+ * @reserved1: reserved for DW alignment
+ * @reserved2: reserved for DW alignment
+ */
+struct ax_softap_client_testmode_cmd {
+  uint8_t enable;
+  uint8_t reserved1;
+  __le16 reserved2;
+} __packed; /* AX_SOFTAP_CLIENT_TESTMODE_API_S_VER_1 */
+
+#endif  // SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_AX_SOFTAP_TESTMODE_H_
diff --git a/third_party/iwlwifi/fw/api/binding.h b/third_party/iwlwifi/fw/api/binding.h
new file mode 100644
index 0000000..c9923fb
--- /dev/null
+++ b/third_party/iwlwifi/fw/api/binding.h
@@ -0,0 +1,153 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+
+#ifndef SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_BINDING_H_
+#define SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_BINDING_H_
+
+#include "src/iwlwifi/platform/compiler.h"
+
+#define MAX_MACS_IN_BINDING (3)
+#define MAX_BINDINGS (4)
+
+/**
+ * struct iwl_binding_cmd_v1 - configuring bindings
+ * ( BINDING_CONTEXT_CMD = 0x2b )
+ * @id_and_color: ID and color of the relevant Binding,
+ *  &enum iwl_ctxt_id_and_color
+ * @action: action to perform, one of FW_CTXT_ACTION_*
+ * @macs: array of MAC id and colors which belong to the binding,
+ *  &enum iwl_ctxt_id_and_color
+ * @phy: PHY id and color which belongs to the binding,
+ *  &enum iwl_ctxt_id_and_color
+ */
+struct iwl_binding_cmd_v1 {
+  /* COMMON_INDEX_HDR_API_S_VER_1 */
+  __le32 id_and_color;
+  __le32 action;
+  /* BINDING_DATA_API_S_VER_1 */
+  __le32 macs[MAX_MACS_IN_BINDING];
+  __le32 phy;
+} __packed; /* BINDING_CMD_API_S_VER_1 */
+
+/**
+ * struct iwl_binding_cmd - configuring bindings
+ * ( BINDING_CONTEXT_CMD = 0x2b )
+ * @id_and_color: ID and color of the relevant Binding,
+ *  &enum iwl_ctxt_id_and_color
+ * @action: action to perform, one of FW_CTXT_ACTION_*
+ * @macs: array of MAC id and colors which belong to the binding
+ *  &enum iwl_ctxt_id_and_color
+ * @phy: PHY id and color which belongs to the binding
+ *  &enum iwl_ctxt_id_and_color
+ * @lmac_id: the lmac id the binding belongs to
+ */
+struct iwl_binding_cmd {
+  /* COMMON_INDEX_HDR_API_S_VER_1 */
+  __le32 id_and_color;
+  __le32 action;
+  /* BINDING_DATA_API_S_VER_1 */
+  __le32 macs[MAX_MACS_IN_BINDING];
+  __le32 phy;
+  __le32 lmac_id;
+} __packed; /* BINDING_CMD_API_S_VER_2 */
+
+#define IWL_BINDING_CMD_SIZE_V1 sizeof(struct iwl_binding_cmd_v1)
+#define IWL_LMAC_24G_INDEX 0
+#define IWL_LMAC_5G_INDEX 1
+
+/* The maximal number of fragments in the FW's schedule session */
+#define IWL_MVM_MAX_QUOTA 128
+
+/**
+ * struct iwl_time_quota_data_v1 - configuration of time quota per binding
+ * @id_and_color: ID and color of the relevant Binding,
+ *  &enum iwl_ctxt_id_and_color
+ * @quota: absolute time quota in TU. The scheduler will try to divide the
+ *  remainig quota (after Time Events) according to this quota.
+ * @max_duration: max uninterrupted context duration in TU
+ */
+struct iwl_time_quota_data_v1 {
+  __le32 id_and_color;
+  __le32 quota;
+  __le32 max_duration;
+} __packed; /* TIME_QUOTA_DATA_API_S_VER_1 */
+
+/**
+ * struct iwl_time_quota_cmd - configuration of time quota between bindings
+ * ( TIME_QUOTA_CMD = 0x2c )
+ * @quotas: allocations per binding
+ * Note: on non-CDB the fourth one is the auxilary mac and is
+ *  essentially zero.
+ *  On CDB the fourth one is a regular binding.
+ */
+struct iwl_time_quota_cmd_v1 {
+  struct iwl_time_quota_data_v1 quotas[MAX_BINDINGS];
+} __packed; /* TIME_QUOTA_ALLOCATION_CMD_API_S_VER_1 */
+
+enum iwl_quota_low_latency {
+  IWL_QUOTA_LOW_LATENCY_NONE = 0,
+  IWL_QUOTA_LOW_LATENCY_TX = BIT(0),
+  IWL_QUOTA_LOW_LATENCY_RX = BIT(1),
+  IWL_QUOTA_LOW_LATENCY_TX_RX = IWL_QUOTA_LOW_LATENCY_TX | IWL_QUOTA_LOW_LATENCY_RX,
+};
+
+/**
+ * struct iwl_time_quota_data - configuration of time quota per binding
+ * @id_and_color: ID and color of the relevant Binding.
+ * @quota: absolute time quota in TU. The scheduler will try to divide the
+ *  remainig quota (after Time Events) according to this quota.
+ * @max_duration: max uninterrupted context duration in TU
+ * @low_latency: low latency status, &enum iwl_quota_low_latency
+ */
+struct iwl_time_quota_data {
+  __le32 id_and_color;
+  __le32 quota;
+  __le32 max_duration;
+  __le32 low_latency;
+} __packed; /* TIME_QUOTA_DATA_API_S_VER_2 */
+
+/**
+ * struct iwl_time_quota_cmd - configuration of time quota between bindings
+ * ( TIME_QUOTA_CMD = 0x2c )
+ * Note: on non-CDB the fourth one is the auxilary mac and is essentially zero.
+ * On CDB the fourth one is a regular binding.
+ *
+ * @quotas: allocations per binding
+ */
+struct iwl_time_quota_cmd {
+  struct iwl_time_quota_data quotas[MAX_BINDINGS];
+} __packed; /* TIME_QUOTA_ALLOCATION_CMD_API_S_VER_2 */
+
+#endif  // SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_BINDING_H_
diff --git a/third_party/iwlwifi/fw/api/cmdhdr.h b/third_party/iwlwifi/fw/api/cmdhdr.h
new file mode 100644
index 0000000..f90920f
--- /dev/null
+++ b/third_party/iwlwifi/fw/api/cmdhdr.h
@@ -0,0 +1,178 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+#ifndef SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_CMDHDR_H_
+#define SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_CMDHDR_H_
+
+#include <stdint.h>
+
+#include "src/iwlwifi/platform/compiler.h"
+
+/**
+ * DOC: Host command section
+ *
+ * A host command is a command issued by the upper layer to the fw. There are
+ * several versions of fw that have several APIs. The transport layer is
+ * completely agnostic to these differences.
+ * The transport does provide helper functionality (i.e. SYNC / ASYNC mode),
+ */
+#define SEQ_TO_QUEUE(s) (((s) >> 8) & 0x1f)
+#define QUEUE_TO_SEQ(q) (((q)&0x1f) << 8)
+#define SEQ_TO_INDEX(s) ((s)&0xff)
+#define INDEX_TO_SEQ(i) ((i)&0xff)
+#define SEQ_RX_FRAME cpu_to_le16(0x8000)
+
+/*
+ * those functions retrieve specific information from
+ * the id field in the iwl_host_cmd struct which contains
+ * the command id, the group id and the version of the command
+ * and vice versa
+ */
+static inline uint8_t iwl_cmd_opcode(uint32_t cmdid) { return cmdid & 0xFF; }
+
+static inline uint8_t iwl_cmd_groupid(uint32_t cmdid) { return ((cmdid & 0xFF00) >> 8); }
+
+static inline uint8_t iwl_cmd_version(uint32_t cmdid) { return ((cmdid & 0xFF0000) >> 16); }
+
+static inline uint32_t iwl_cmd_id(uint8_t opcode, uint8_t groupid, uint8_t version) {
+  return opcode + (groupid << 8) + (version << 16);
+}
+
+/* make uint16_t wide id out of uint8_t group and opcode */
+#define WIDE_ID(grp, opcode) ((uint16_t)(((grp) << 8) | (opcode)))
+#define DEF_ID(opcode) ((uint16_t)((1 << 8) | (opcode)))
+
+/* due to the conversion, this group is special; new groups
+ * should be defined in the appropriate fw-api header files
+ */
+#define IWL_ALWAYS_LONG_GROUP 1
+
+/**
+ * struct iwl_cmd_header - (short) command header format
+ *
+ * This header format appears in the beginning of each command sent from the
+ * driver, and each response/notification received from uCode.
+ */
+struct iwl_cmd_header {
+  /**
+   * @cmd: Command ID: REPLY_RXON, etc.
+   */
+  uint8_t cmd;
+  /**
+   * @group_id: group ID, for commands with groups
+   */
+  uint8_t group_id;
+  /**
+   * @sequence:
+   * Sequence number for the command.
+   *
+   * The driver sets up the sequence number to values of its choosing.
+   * uCode does not use this value, but passes it back to the driver
+   * when sending the response to each driver-originated command, so
+   * the driver can match the response to the command.  Since the values
+   * don't get used by uCode, the driver may set up an arbitrary format.
+   *
+   * There is one exception:  uCode sets bit 15 when it originates
+   * the response/notification, i.e. when the response/notification
+   * is not a direct response to a command sent by the driver.  For
+   * example, uCode issues REPLY_RX when it sends a received frame
+   * to the driver; it is not a direct response to any driver command.
+   *
+   * The Linux driver uses the following format:
+   *
+   *  0:7     tfd index - position within TX queue
+   *  8:12    TX queue id
+   *  13:14   reserved
+   *  15      unsolicited RX or uCode-originated notification
+   */
+  __le16 sequence;
+} __packed;
+
+/**
+ * struct iwl_cmd_header_wide
+ *
+ * This header format appears in the beginning of each command sent from the
+ * driver, and each response/notification received from uCode.
+ * this is the wide version that contains more information about the command
+ * like length, version and command type
+ *
+ * @cmd: command ID, like in &struct iwl_cmd_header
+ * @group_id: group ID, like in &struct iwl_cmd_header
+ * @sequence: sequence, like in &struct iwl_cmd_header
+ * @length: length of the command
+ * @reserved: reserved
+ * @version: command version
+ */
+struct iwl_cmd_header_wide {
+  uint8_t cmd;
+  uint8_t group_id;
+  __le16 sequence;
+  __le16 length;
+  uint8_t reserved;
+  uint8_t version;
+} __packed;
+
+/**
+ * struct iwl_calib_res_notif_phy_db - Receive phy db chunk after calibrations
+ * @type: type of the result - mostly ignored
+ * @length: length of the data
+ * @data: data, length in @length
+ */
+struct iwl_calib_res_notif_phy_db {
+  __le16 type;
+  __le16 length;
+  uint8_t data[0];
+} __packed;
+
+/**
+ * struct iwl_phy_db_cmd - configure operational ucode
+ * @type: type of the data
+ * @length: length of the data
+ * @data: data, length in @length
+ */
+struct iwl_phy_db_cmd {
+  __le16 type;
+  __le16 length;
+  uint8_t data[];
+} __packed;
+
+/**
+ * struct iwl_cmd_response - generic response struct for most commands
+ * @status: status of the command asked, changes for each one
+ */
+struct iwl_cmd_response {
+  __le32 status;
+};
+
+#endif  // SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_CMDHDR_H_
diff --git a/third_party/iwlwifi/fw/api/coex.h b/third_party/iwlwifi/fw/api/coex.h
new file mode 100644
index 0000000..cae6160
--- /dev/null
+++ b/third_party/iwlwifi/fw/api/coex.h
@@ -0,0 +1,333 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2013 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
+ * Copyright(c) 2017        Intel Deutschland GmbH
+ * Copyright(c) 2018        Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *****************************************************************************/
+
+#ifndef SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_COEX_H_
+#define SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_COEX_H_
+
+#include "src/iwlwifi/platform/compiler.h"
+
+#define BITS(nb) (BIT(nb) - 1)
+
+enum iwl_bt_coex_lut_type {
+  BT_COEX_TIGHT_LUT = 0,
+  BT_COEX_LOOSE_LUT,
+  BT_COEX_TX_DIS_LUT,
+
+  BT_COEX_MAX_LUT,
+  BT_COEX_INVALID_LUT = 0xff,
+}; /* BT_COEX_DECISION_LUT_INDEX_API_E_VER_1 */
+
+#define BT_REDUCED_TX_POWER_BIT BIT(7)
+
+enum iwl_bt_coex_mode {
+  BT_COEX_DISABLE = 0x0,
+  BT_COEX_NW = 0x1,
+  BT_COEX_BT = 0x2,
+  BT_COEX_WIFI = 0x3,
+}; /* BT_COEX_MODES_E */
+
+enum iwl_bt_coex_enabled_modules {
+  BT_COEX_MPLUT_ENABLED = BIT(0),
+  BT_COEX_MPLUT_BOOST_ENABLED = BIT(1),
+  BT_COEX_SYNC2SCO_ENABLED = BIT(2),
+  BT_COEX_CORUN_ENABLED = BIT(3),
+  BT_COEX_HIGH_BAND_RET = BIT(4),
+}; /* BT_COEX_MODULES_ENABLE_E_VER_1 */
+
+/**
+ * struct iwl_bt_coex_cmd - bt coex configuration command
+ * @mode: &enum iwl_bt_coex_mode
+ * @enabled_modules: &enum iwl_bt_coex_enabled_modules
+ *
+ * The structure is used for the BT_COEX command.
+ */
+struct iwl_bt_coex_cmd {
+  __le32 mode;
+  __le32 enabled_modules;
+} __packed; /* BT_COEX_CMD_API_S_VER_6 */
+
+/**
+ * struct iwl_bt_coex_reduced_txp_update_cmd
+ * @reduced_txp: bit BT_REDUCED_TX_POWER_BIT to enable / disable, rest of the
+ *  bits are the sta_id (value)
+ */
+struct iwl_bt_coex_reduced_txp_update_cmd {
+  __le32 reduced_txp;
+} __packed; /* BT_COEX_UPDATE_REDUCED_TX_POWER_API_S_VER_1 */
+
+/**
+ * struct iwl_bt_coex_ci_cmd - bt coex channel inhibition command
+ * @bt_primary_ci: primary channel inhibition bitmap
+ * @primary_ch_phy_id: primary channel PHY ID
+ * @bt_secondary_ci: secondary channel inhibition bitmap
+ * @secondary_ch_phy_id: secondary channel PHY ID
+ *
+ * Used for BT_COEX_CI command
+ */
+struct iwl_bt_coex_ci_cmd {
+  __le64 bt_primary_ci;
+  __le32 primary_ch_phy_id;
+
+  __le64 bt_secondary_ci;
+  __le32 secondary_ch_phy_id;
+} __packed; /* BT_CI_MSG_API_S_VER_2 */
+
+#define BT_MBOX(n_dw, _msg, _pos, _nbits)                                      \
+  BT_MBOX##n_dw##_##_msg##_POS = (_pos), BT_MBOX##n_dw##_##_msg = BITS(_nbits) \
+                                                                  << BT_MBOX##n_dw##_##_msg##_POS
+
+enum iwl_bt_mxbox_dw0 {
+  BT_MBOX(0, LE_SLAVE_LAT, 0, 3),
+  BT_MBOX(0, LE_PROF1, 3, 1),
+  BT_MBOX(0, LE_PROF2, 4, 1),
+  BT_MBOX(0, LE_PROF_OTHER, 5, 1),
+  BT_MBOX(0, CHL_SEQ_N, 8, 4),
+  BT_MBOX(0, INBAND_S, 13, 1),
+  BT_MBOX(0, LE_MIN_RSSI, 16, 4),
+  BT_MBOX(0, LE_SCAN, 20, 1),
+  BT_MBOX(0, LE_ADV, 21, 1),
+  BT_MBOX(0, LE_MAX_TX_POWER, 24, 4),
+  BT_MBOX(0, OPEN_CON_1, 28, 2),
+};
+
+enum iwl_bt_mxbox_dw1 {
+  BT_MBOX(1, BR_MAX_TX_POWER, 0, 4),
+  BT_MBOX(1, IP_SR, 4, 1),
+  BT_MBOX(1, LE_MSTR, 5, 1),
+  BT_MBOX(1, AGGR_TRFC_LD, 8, 6),
+  BT_MBOX(1, MSG_TYPE, 16, 3),
+  BT_MBOX(1, SSN, 19, 2),
+};
+
+enum iwl_bt_mxbox_dw2 {
+  BT_MBOX(2, SNIFF_ACT, 0, 3),
+  BT_MBOX(2, PAG, 3, 1),
+  BT_MBOX(2, INQUIRY, 4, 1),
+  BT_MBOX(2, CONN, 5, 1),
+  BT_MBOX(2, SNIFF_INTERVAL, 8, 5),
+  BT_MBOX(2, DISC, 13, 1),
+  BT_MBOX(2, SCO_TX_ACT, 16, 2),
+  BT_MBOX(2, SCO_RX_ACT, 18, 2),
+  BT_MBOX(2, ESCO_RE_TX, 20, 2),
+  BT_MBOX(2, SCO_DURATION, 24, 6),
+};
+
+enum iwl_bt_mxbox_dw3 {
+  BT_MBOX(3, SCO_STATE, 0, 1),
+  BT_MBOX(3, SNIFF_STATE, 1, 1),
+  BT_MBOX(3, A2DP_STATE, 2, 1),
+  BT_MBOX(3, ACL_STATE, 3, 1),
+  BT_MBOX(3, MSTR_STATE, 4, 1),
+  BT_MBOX(3, OBX_STATE, 5, 1),
+  BT_MBOX(3, A2DP_SRC, 6, 1),
+  BT_MBOX(3, OPEN_CON_2, 8, 2),
+  BT_MBOX(3, TRAFFIC_LOAD, 10, 2),
+  BT_MBOX(3, CHL_SEQN_LSB, 12, 1),
+  BT_MBOX(3, INBAND_P, 13, 1),
+  BT_MBOX(3, MSG_TYPE_2, 16, 3),
+  BT_MBOX(3, SSN_2, 19, 2),
+  BT_MBOX(3, UPDATE_REQUEST, 21, 1),
+};
+
+#define BT_MBOX_MSG(_notif, _num, _field)                                  \
+  ((le32_to_cpu((_notif)->mbox_msg[(_num)]) & BT_MBOX##_num##_##_field) >> \
+   BT_MBOX##_num##_##_field##_POS)
+
+#define BT_MBOX_PRINT(_num, _field, _end)                         \
+  pos += scnprintf(buf + pos, bufsz - pos, "\t%s: %d%s", #_field, \
+                   BT_MBOX_MSG(notif, _num, _field), true ? "\n" : ", ");
+enum iwl_bt_activity_grading {
+  BT_OFF = 0,
+  BT_ON_NO_CONNECTION = 1,
+  BT_LOW_TRAFFIC = 2,
+  BT_HIGH_TRAFFIC = 3,
+  BT_VERY_HIGH_TRAFFIC = 4,
+
+  BT_MAX_AG,
+}; /* BT_COEX_BT_ACTIVITY_GRADING_API_E_VER_1 */
+
+enum iwl_bt_ci_compliance {
+  BT_CI_COMPLIANCE_NONE = 0,
+  BT_CI_COMPLIANCE_PRIMARY = 1,
+  BT_CI_COMPLIANCE_SECONDARY = 2,
+  BT_CI_COMPLIANCE_BOTH = 3,
+}; /* BT_COEX_CI_COMPLIENCE_E_VER_1 */
+
+/**
+ * struct iwl_bt_coex_profile_notif - notification about BT coex
+ * @mbox_msg: message from BT to WiFi
+ * @msg_idx: the index of the message
+ * @bt_ci_compliance: enum %iwl_bt_ci_compliance
+ * @primary_ch_lut: LUT used for primary channel &enum iwl_bt_coex_lut_type
+ * @secondary_ch_lut: LUT used for secondary channel &enum iwl_bt_coex_lut_type
+ * @bt_activity_grading: the activity of BT &enum iwl_bt_activity_grading
+ * @ttc_status: is TTC enabled - one bit per PHY
+ * @rrc_status: is RRC enabled - one bit per PHY
+ * @reserved: reserved
+ */
+struct iwl_bt_coex_profile_notif {
+  __le32 mbox_msg[4];
+  __le32 msg_idx;
+  __le32 bt_ci_compliance;
+
+  __le32 primary_ch_lut;
+  __le32 secondary_ch_lut;
+  __le32 bt_activity_grading;
+  uint8_t ttc_status;
+  uint8_t rrc_status;
+  __le16 reserved;
+} __packed; /* BT_COEX_PROFILE_NTFY_API_S_VER_4 */
+
+#ifdef CPTCFG_IWLWIFI_FRQ_MGR
+/*
+ * struct iwl_config_2g_coex_cmd - 2G Coex configuration command
+ * (CONFIG_2G_COEX_CMD = 0x71)
+ * @enabled: 2g coex is enabled/disabled
+ */
+struct iwl_config_2g_coex_cmd {
+  __le32 enabled;
+} __packed; /* CONFIG_2G_COEX_CMD_API_S_VER_1 */
+#endif
+
+#ifdef CPTCFG_IWLWIFI_LTE_COEX
+
+#define WIFI_BAND_24_NUM_CHANNELS 14
+#define LTE_COEX_MFUART_CONFIG_LENGTH 12
+#define LTE_COEX_FRAME_STRUCTURE_LENGTH 2
+
+/**
+ * struct iwl_lte_coex_config_cmd - LTE Coex configuration command
+ * @lte_state: lte modem state
+ * @lte_band: lte operating band
+ * @lte_chan: lte operating channel
+ * @lte_frame_structure: ?
+ * @tx_safe_freq_min: ?
+ * @tx_safe_freq_max: ?
+ * @rx_safe_freq_min: ?
+ * @rx_safe_freq_max: ?
+ * @max_tx_power: wifi static max tx output power per channel
+ *
+ * Used for LTE_COEX_CONFIG_CMD command
+ */
+struct iwl_lte_coex_config_cmd {
+  __le32 lte_state;
+  __le32 lte_band;
+  __le32 lte_chan;
+  __le32 lte_frame_structure[LTE_COEX_FRAME_STRUCTURE_LENGTH];
+  __le32 tx_safe_freq_min;
+  __le32 tx_safe_freq_max;
+  __le32 rx_safe_freq_min;
+  __le32 rx_safe_freq_max;
+  uint8_t max_tx_power[WIFI_BAND_24_NUM_CHANNELS];
+} __packed; /* LTE_COEX_CONFIG_CMD_API_S_VER_1 */
+
+/**
+ * struct iwl_lte_coex_static_params_cmd - LTE Coex static params configuration
+ * command
+ * @mfu_config: MFUART config and RT signals assert/de-assert timing
+ * @tx_power_in_dbm: Wifi safe power table
+ *
+ * Used for LTE_COEX_STATIC_PARAMS_CMD command
+ */
+struct iwl_lte_coex_static_params_cmd {
+  __le32 mfu_config[LTE_COEX_MFUART_CONFIG_LENGTH];
+  int8_t tx_power_in_dbm[32];
+} __packed; /* LTE_COEX_STATIC_PARAMS_CMD_API_S_VER_1 */
+
+/**
+ * struct iwl_lte_coex_wifi_reported_channel_cmd - LTE Coex reported channels
+ * configuration command
+ * @channel: channel number (1-14)
+ * @bandwidth: bandwidth (0-3)
+ *
+ * Used for LTE_COEX_WIFI_REPORTED_CHANNEL_CMD command
+ */
+struct iwl_lte_coex_wifi_reported_channel_cmd {
+  __le32 channel;
+  __le32 bandwidth;
+} __packed; /* LTE_COEX_WIFI_REPORTED_CHANNEL_CMD_API_S_VER_1 */
+
+/**
+ * struct iwl_lte_coex_sps_cmd - LTE Coex semi persistent info command
+ *
+ * @lte_semi_persistent_info:
+ *
+ * Used for LTE_COEX_SPS_CMD command
+ */
+struct iwl_lte_coex_sps_cmd {
+  __le32 lte_semi_persistent_info;
+} __packed; /* LTE_COEX_WIFI_SPS_CMD_API_S_VER_1 */
+
+/**
+ * struct iwl_lte_coex_fine_tuning_params_cmd - LTE Coex fine tuning parameters
+ * @rx_protection_assert_timing: 802_RX_PRI request advance time
+ * @tx_protection_assert_timing: 802_TX_ON request advance time
+ * @rx_protection_timeout: Cancel Rx Protection request due to no Rx threshold
+ * @min_tx_power: Min-Tx-Power threshold for Data/Management frames
+ * @lte_ul_load_uapsd_threshold: 'LTE UL Load' counter thresholds
+ *  for recommending Power-Manager to enter to UAPSD
+ * @rx_failure_during_ul_uapsd_threshold: 'Rx Failure due to UL' counter
+ *  thresholds for recommending Power-Manager to enter to UAPSD
+ * @rx_failure_during_ul_sc_threshold: 'Rx Failure due to UL'
+ *  counter threshold for recommending Scan-Manager to apply compensation
+ * @rx_duration_for_ack_protection_us: Tx Ack size for Tx Protection
+ * @beacon_failure_during_ul_counter: Failed Rx Beacon threshold
+ * @dtim_failure_during_ul_counter: Failed Rx DTIM threshold
+ *
+ * Used for LTE_COEX_FINE_TUNING_PARAMS_CMD command
+ */
+struct iwl_lte_coex_fine_tuning_params_cmd {
+  __le32 rx_protection_assert_timing;
+  __le32 tx_protection_assert_timing;
+  __le32 rx_protection_timeout;
+  __le32 min_tx_power;
+  __le32 lte_ul_load_uapsd_threshold;
+  __le32 rx_failure_during_ul_uapsd_threshold;
+  __le32 rx_failure_during_ul_sc_threshold;
+  __le32 rx_duration_for_ack_protection_us;
+  __le32 beacon_failure_during_ul_counter;
+  __le32 dtim_failure_during_ul_counter;
+} __packed; /* LTE_COEX_FINE_TUNING_PARAMS_CMD_API_S_VER_1 */
+
+/**
+ * struct iwl_lte_coex_statistic_ntfy - LTE Coex statistics notification
+ * @statistic_placeholder: placeholder
+ */
+struct iwl_lte_coex_statistic_ntfy {
+  __le32 statistic_placeholder;
+} __packed; /* LTE_COEX_STATISTIC_NTFY_API_S_VER_1 */
+#endif      /* CPTCFG_IWLWIFI_LTE_COEX */
+
+#endif  // SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_COEX_H_
diff --git a/third_party/iwlwifi/fw/api/commands.h b/third_party/iwlwifi/fw/api/commands.h
new file mode 100644
index 0000000..7a2e78c
--- /dev/null
+++ b/third_party/iwlwifi/fw/api/commands.h
@@ -0,0 +1,695 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018        Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+
+#ifndef SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_COMMANDS_H_
+#define SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_COMMANDS_H_
+
+/**
+ * enum iwl_mvm_command_groups - command groups for the firmware
+ * @LEGACY_GROUP: legacy group, uses command IDs from &enum iwl_legacy_cmds
+ * @LONG_GROUP: legacy group with long header, also uses command IDs
+ *  from &enum iwl_legacy_cmds
+ * @SYSTEM_GROUP: system group, uses command IDs from
+ *  &enum iwl_system_subcmd_ids
+ * @MAC_CONF_GROUP: MAC configuration group, uses command IDs from
+ *  &enum iwl_mac_conf_subcmd_ids
+ * @PHY_OPS_GROUP: PHY operations group, uses command IDs from
+ *  &enum iwl_phy_ops_subcmd_ids
+ * @DATA_PATH_GROUP: data path group, uses command IDs from
+ *  &enum iwl_data_path_subcmd_ids
+ * @NAN_GROUP: NAN group, uses command IDs from &enum iwl_nan_subcmd_ids
+ * @TOF_GROUP: TOF group, uses command IDs from &enum iwl_tof_subcmd_ids
+ * @PROT_OFFLOAD_GROUP: protocol offload group, uses command IDs from
+ *  &enum iwl_prot_offload_subcmd_ids
+ * @REGULATORY_AND_NVM_GROUP: regulatory/NVM group, uses command IDs from
+ *  &enum iwl_regulatory_and_nvm_subcmd_ids
+ * @XVT_GROUP: XVT group, uses command IDs from &enum iwl_xvt_subcmd_ids
+ * @DEBUG_GROUP: Debug group, uses command IDs from &enum iwl_debug_cmds
+ */
+enum iwl_mvm_command_groups {
+  LEGACY_GROUP = 0x0,
+  LONG_GROUP = 0x1,
+  SYSTEM_GROUP = 0x2,
+  MAC_CONF_GROUP = 0x3,
+  PHY_OPS_GROUP = 0x4,
+  DATA_PATH_GROUP = 0x5,
+  NAN_GROUP = 0x7,
+  TOF_GROUP = 0x8,
+  PROT_OFFLOAD_GROUP = 0xb,
+  REGULATORY_AND_NVM_GROUP = 0xc,
+  XVT_GROUP = 0xe,
+  DEBUG_GROUP = 0xf,
+};
+
+/**
+ * enum iwl_legacy_cmds - legacy group command IDs
+ */
+enum iwl_legacy_cmds {
+  /**
+   * @MVM_ALIVE:
+   * Alive data from the firmware, as described in
+   * &struct mvm_alive_resp_v3 or &struct mvm_alive_resp.
+   */
+  MVM_ALIVE = 0x1,
+
+  /**
+   * @REPLY_ERROR: Cause an error in the firmware, for testing purposes.
+   */
+  REPLY_ERROR = 0x2,
+
+  /**
+   * @ECHO_CMD: Send data to the device to have it returned immediately.
+   */
+  ECHO_CMD = 0x3,
+
+  /**
+   * @INIT_COMPLETE_NOTIF: Notification that initialization is complete.
+   */
+  INIT_COMPLETE_NOTIF = 0x4,
+
+  /**
+   * @PHY_CONTEXT_CMD:
+   * Add/modify/remove a PHY context, using &struct iwl_phy_context_cmd.
+   */
+  PHY_CONTEXT_CMD = 0x8,
+
+  /**
+   * @DBG_CFG: Debug configuration command.
+   */
+  DBG_CFG = 0x9,
+
+  /**
+   * @SCAN_ITERATION_COMPLETE_UMAC:
+   * Firmware indicates a scan iteration completed, using
+   * &struct iwl_umac_scan_iter_complete_notif.
+   */
+  SCAN_ITERATION_COMPLETE_UMAC = 0xb5,
+
+  /**
+   * @SCAN_CFG_CMD:
+   * uses &struct iwl_scan_config_v1 or &struct iwl_scan_config
+   */
+  SCAN_CFG_CMD = 0xc,
+
+  /**
+   * @SCAN_REQ_UMAC: uses &struct iwl_scan_req_umac
+   */
+  SCAN_REQ_UMAC = 0xd,
+
+  /**
+   * @SCAN_ABORT_UMAC: uses &struct iwl_umac_scan_abort
+   */
+  SCAN_ABORT_UMAC = 0xe,
+
+  /**
+   * @SCAN_COMPLETE_UMAC: uses &struct iwl_umac_scan_complete
+   */
+  SCAN_COMPLETE_UMAC = 0xf,
+
+  /**
+   * @BA_WINDOW_STATUS_NOTIFICATION_ID:
+   * uses &struct iwl_ba_window_status_notif
+   */
+  BA_WINDOW_STATUS_NOTIFICATION_ID = 0x13,
+
+  /**
+   * @ADD_STA_KEY:
+   * &struct iwl_mvm_add_sta_key_cmd_v1 or
+   * &struct iwl_mvm_add_sta_key_cmd.
+   */
+  ADD_STA_KEY = 0x17,
+
+  /**
+   * @ADD_STA:
+   * &struct iwl_mvm_add_sta_cmd or &struct iwl_mvm_add_sta_cmd_v7.
+   */
+  ADD_STA = 0x18,
+
+  /**
+   * @REMOVE_STA: &struct iwl_mvm_rm_sta_cmd
+   */
+  REMOVE_STA = 0x19,
+
+  /**
+   * @FW_GET_ITEM_CMD: uses &struct iwl_fw_get_item_cmd
+   */
+  FW_GET_ITEM_CMD = 0x1a,
+
+  /**
+   * @TX_CMD: uses &struct iwl_tx_cmd or &struct iwl_tx_cmd_gen2 or
+   *  &struct iwl_tx_cmd_gen3,
+   *  response in &struct iwl_mvm_tx_resp or
+   *  &struct iwl_mvm_tx_resp_v3
+   */
+  TX_CMD = 0x1c,
+
+  /**
+   * @TXPATH_FLUSH: &struct iwl_tx_path_flush_cmd
+   */
+  TXPATH_FLUSH = 0x1e,
+
+  /**
+   * @MGMT_MCAST_KEY:
+   * &struct iwl_mvm_mgmt_mcast_key_cmd or
+   * &struct iwl_mvm_mgmt_mcast_key_cmd_v1
+   */
+  MGMT_MCAST_KEY = 0x1f,
+
+  /* scheduler config */
+  /**
+   * @SCD_QUEUE_CFG: &struct iwl_scd_txq_cfg_cmd for older hardware,
+   *  &struct iwl_tx_queue_cfg_cmd with &struct iwl_tx_queue_cfg_rsp
+   *  for newer (22000) hardware.
+   */
+  SCD_QUEUE_CFG = 0x1d,
+
+  /**
+   * @WEP_KEY: uses &struct iwl_mvm_wep_key_cmd
+   */
+  WEP_KEY = 0x20,
+
+  /**
+   * @SHARED_MEM_CFG:
+   * retrieve shared memory configuration - response in
+   * &struct iwl_shared_mem_cfg
+   */
+  SHARED_MEM_CFG = 0x25,
+
+  /**
+   * @TDLS_CHANNEL_SWITCH_CMD: uses &struct iwl_tdls_channel_switch_cmd
+   */
+  TDLS_CHANNEL_SWITCH_CMD = 0x27,
+
+  /**
+   * @TDLS_CHANNEL_SWITCH_NOTIFICATION:
+   * uses &struct iwl_tdls_channel_switch_notif
+   */
+  TDLS_CHANNEL_SWITCH_NOTIFICATION = 0xaa,
+
+  /**
+   * @TDLS_CONFIG_CMD:
+   * &struct iwl_tdls_config_cmd, response in &struct iwl_tdls_config_res
+   */
+  TDLS_CONFIG_CMD = 0xa7,
+
+  /**
+   * @MAC_CONTEXT_CMD: &struct iwl_mac_ctx_cmd
+   */
+  MAC_CONTEXT_CMD = 0x28,
+
+  /**
+   * @TIME_EVENT_CMD:
+   * &struct iwl_time_event_cmd, response in &struct iwl_time_event_resp
+   */
+  TIME_EVENT_CMD = 0x29, /* both CMD and response */
+
+  /**
+   * @TIME_EVENT_NOTIFICATION: &struct iwl_time_event_notif
+   */
+  TIME_EVENT_NOTIFICATION = 0x2a,
+
+  /**
+   * @BINDING_CONTEXT_CMD:
+   * &struct iwl_binding_cmd or &struct iwl_binding_cmd_v1
+   */
+  BINDING_CONTEXT_CMD = 0x2b,
+
+  /**
+   * @TIME_QUOTA_CMD: &struct iwl_time_quota_cmd
+   */
+  TIME_QUOTA_CMD = 0x2c,
+
+  /**
+   * @NON_QOS_TX_COUNTER_CMD:
+   * command is &struct iwl_nonqos_seq_query_cmd
+   */
+  NON_QOS_TX_COUNTER_CMD = 0x2d,
+
+  /**
+   * @FIPS_TEST_VECTOR_CMD: command is &struct iwl_fips_test_cmd
+   */
+  FIPS_TEST_VECTOR_CMD = 0x3b,
+
+  /**
+   * @LEDS_CMD: command is &struct iwl_led_cmd
+   */
+  LEDS_CMD = 0x48,
+
+  /**
+   * @LQ_CMD: using &struct iwl_lq_cmd
+   */
+  LQ_CMD = 0x4e,
+
+  /**
+   * @FW_PAGING_BLOCK_CMD:
+   * &struct iwl_fw_paging_cmd
+   */
+  FW_PAGING_BLOCK_CMD = 0x4f,
+
+  /**
+   * @SCAN_OFFLOAD_REQUEST_CMD: uses &struct iwl_scan_req_lmac
+   */
+  SCAN_OFFLOAD_REQUEST_CMD = 0x51,
+
+  /**
+   * @SCAN_OFFLOAD_ABORT_CMD: abort the scan - no further contents
+   */
+  SCAN_OFFLOAD_ABORT_CMD = 0x52,
+
+  /**
+   * @HOT_SPOT_CMD: uses &struct iwl_hs20_roc_req
+   */
+  HOT_SPOT_CMD = 0x53,
+
+  /**
+   * @SCAN_OFFLOAD_COMPLETE:
+   * notification, &struct iwl_periodic_scan_complete
+   */
+  SCAN_OFFLOAD_COMPLETE = 0x6D,
+
+  /**
+   * @SCAN_OFFLOAD_UPDATE_PROFILES_CMD:
+   * update scan offload (scheduled scan) profiles/blacklist/etc.
+   */
+  SCAN_OFFLOAD_UPDATE_PROFILES_CMD = 0x6E,
+
+  /**
+   * @MATCH_FOUND_NOTIFICATION: scan match found
+   */
+  MATCH_FOUND_NOTIFICATION = 0xd9,
+
+  /**
+   * @SCAN_ITERATION_COMPLETE:
+   * uses &struct iwl_lmac_scan_complete_notif
+   */
+  SCAN_ITERATION_COMPLETE = 0xe7,
+
+  /* Phy */
+  /**
+   * @PHY_CONFIGURATION_CMD: &struct iwl_phy_cfg_cmd
+   */
+  PHY_CONFIGURATION_CMD = 0x6a,
+
+  /**
+   * @CALIB_RES_NOTIF_PHY_DB: &struct iwl_calib_res_notif_phy_db
+   */
+  CALIB_RES_NOTIF_PHY_DB = 0x6b,
+
+  /**
+   * @PHY_DB_CMD: &struct iwl_phy_db_cmd
+   */
+  PHY_DB_CMD = 0x6c,
+
+  /**
+   * @TOF_CMD: &struct iwl_tof_config_cmd
+   */
+  TOF_CMD = 0x10,
+
+  /**
+   * @TOF_NOTIFICATION: &struct iwl_tof_gen_resp_cmd
+   */
+  TOF_NOTIFICATION = 0x11,
+
+  /**
+   * @CONFIG_2G_COEX_CMD: &struct iwl_config_2g_coex_cmd
+   */
+  CONFIG_2G_COEX_CMD = 0x71,
+
+  /**
+   * @POWER_TABLE_CMD: &struct iwl_device_power_cmd
+   */
+  POWER_TABLE_CMD = 0x77,
+
+  /**
+   * @PSM_UAPSD_AP_MISBEHAVING_NOTIFICATION:
+   * &struct iwl_uapsd_misbehaving_ap_notif
+   */
+  PSM_UAPSD_AP_MISBEHAVING_NOTIFICATION = 0x78,
+
+  /**
+   * @LTR_CONFIG: &struct iwl_ltr_config_cmd
+   */
+  LTR_CONFIG = 0xee,
+
+  /**
+   * @REPLY_THERMAL_MNG_BACKOFF:
+   * Thermal throttling command
+   */
+  REPLY_THERMAL_MNG_BACKOFF = 0x7e,
+
+  /**
+   * @DC2DC_CONFIG_CMD:
+   * Set/Get DC2DC frequency tune
+   * Command is &struct iwl_dc2dc_config_cmd,
+   * response is &struct iwl_dc2dc_config_resp
+   */
+  DC2DC_CONFIG_CMD = 0x83,
+
+  /**
+   * @NVM_ACCESS_CMD: using &struct iwl_nvm_access_cmd
+   */
+  NVM_ACCESS_CMD = 0x88,
+
+  /**
+   * @BEACON_NOTIFICATION: &struct iwl_extended_beacon_notif
+   */
+  BEACON_NOTIFICATION = 0x90,
+
+  /**
+   * @BEACON_TEMPLATE_CMD:
+   *  Uses one of &struct iwl_mac_beacon_cmd_v6,
+   *  &struct iwl_mac_beacon_cmd_v7 or &struct iwl_mac_beacon_cmd
+   *  depending on the device version.
+   */
+  BEACON_TEMPLATE_CMD = 0x91,
+  /**
+   * @TX_ANT_CONFIGURATION_CMD: &struct iwl_tx_ant_cfg_cmd
+   */
+  TX_ANT_CONFIGURATION_CMD = 0x98,
+
+  /**
+   * @STATISTICS_CMD:
+   * one of &struct iwl_statistics_cmd,
+   * &struct iwl_notif_statistics_v11,
+   * &struct iwl_notif_statistics_v10,
+   * &struct iwl_notif_statistics
+   */
+  STATISTICS_CMD = 0x9c,
+
+  /**
+   * @STATISTICS_NOTIFICATION:
+   * one of &struct iwl_notif_statistics_v10,
+   * &struct iwl_notif_statistics_v11,
+   * &struct iwl_notif_statistics
+   */
+  STATISTICS_NOTIFICATION = 0x9d,
+
+  /**
+   * @EOSP_NOTIFICATION:
+   * Notify that a service period ended,
+   * &struct iwl_mvm_eosp_notification
+   */
+  EOSP_NOTIFICATION = 0x9e,
+
+  /**
+   * @REDUCE_TX_POWER_CMD:
+   * &struct iwl_dev_tx_power_cmd_v3 or &struct iwl_dev_tx_power_cmd_v4
+   * or &struct iwl_dev_tx_power_cmd
+   */
+  REDUCE_TX_POWER_CMD = 0x9f,
+
+  /**
+   * @CARD_STATE_NOTIFICATION:
+   * Card state (RF/CT kill) notification,
+   * uses &struct iwl_card_state_notif
+   */
+  CARD_STATE_NOTIFICATION = 0xa1,
+
+  /**
+   * @MISSED_BEACONS_NOTIFICATION: &struct iwl_missed_beacons_notif
+   */
+  MISSED_BEACONS_NOTIFICATION = 0xa2,
+
+  /**
+   * @MAC_PM_POWER_TABLE: using &struct iwl_mac_power_cmd
+   */
+  MAC_PM_POWER_TABLE = 0xa9,
+
+  /**
+   * @MFUART_LOAD_NOTIFICATION: &struct iwl_mfuart_load_notif
+   */
+  MFUART_LOAD_NOTIFICATION = 0xb1,
+
+  /**
+   * @RSS_CONFIG_CMD: &struct iwl_rss_config_cmd
+   */
+  RSS_CONFIG_CMD = 0xb3,
+
+  /**
+   * @REPLY_RX_PHY_CMD: &struct iwl_rx_phy_info
+   */
+  REPLY_RX_PHY_CMD = 0xc0,
+
+  /**
+   * @REPLY_RX_MPDU_CMD:
+   * &struct iwl_rx_mpdu_res_start or &struct iwl_rx_mpdu_desc
+   */
+  REPLY_RX_MPDU_CMD = 0xc1,
+
+  /**
+   * @FRAME_RELEASE:
+   * Frame release (reorder helper) notification, uses
+   * &struct iwl_frame_release
+   */
+  FRAME_RELEASE = 0xc3,
+
+  /**
+   * @BA_NOTIF:
+   * BlockAck notification, uses &struct iwl_mvm_compressed_ba_notif
+   * or &struct iwl_mvm_ba_notif depending on the HW
+   */
+  BA_NOTIF = 0xc5,
+
+  /* Location Aware Regulatory */
+  /**
+   * @MCC_UPDATE_CMD: using &struct iwl_mcc_update_cmd
+   */
+  MCC_UPDATE_CMD = 0xc8,
+
+  /**
+   * @MCC_CHUB_UPDATE_CMD: using &struct iwl_mcc_chub_notif
+   */
+  MCC_CHUB_UPDATE_CMD = 0xc9,
+
+  /**
+   * @MARKER_CMD: trace marker command, uses &struct iwl_mvm_marker
+   * with &struct iwl_mvm_marker_rsp
+   */
+  MARKER_CMD = 0xcb,
+
+  /**
+   * @BT_PROFILE_NOTIFICATION: &struct iwl_bt_coex_profile_notif
+   */
+  BT_PROFILE_NOTIFICATION = 0xce,
+
+  /**
+   * @BT_CONFIG: &struct iwl_bt_coex_cmd
+   */
+  BT_CONFIG = 0x9b,
+
+  /**
+   * @BT_COEX_UPDATE_REDUCED_TXP:
+   * &struct iwl_bt_coex_reduced_txp_update_cmd
+   */
+  BT_COEX_UPDATE_REDUCED_TXP = 0x5c,
+
+  /**
+   * @BT_COEX_CI: &struct iwl_bt_coex_ci_cmd
+   */
+  BT_COEX_CI = 0x5d,
+
+#ifdef CPTCFG_IWLWIFI_LTE_COEX
+  /**
+   * @LTE_COEX_CONFIG_CMD: &struct iwl_lte_coex_config_cmd
+   */
+  LTE_COEX_CONFIG_CMD = 0x4a,
+
+  /**
+   * @LTE_COEX_WIFI_REPORTED_CHANNEL_CMD:
+   * &struct iwl_lte_coex_wifi_reported_channel_cmd
+   */
+  LTE_COEX_WIFI_REPORTED_CHANNEL_CMD = 0X4b,
+
+  /**
+   * @LTE_COEX_STATIC_PARAMS_CMD: &struct iwl_lte_coex_static_params_cmd
+   */
+  LTE_COEX_STATIC_PARAMS_CMD = 0x4c,
+
+  /**
+   * @LTE_COEX_SPS_CMD: struct iwl_lte_coex_sps_cmd
+   */
+  LTE_COEX_SPS_CMD = 0x4d,
+
+  /**
+   * @LTE_COEX_FINE_TUNING_PARAMS_CMD:
+   * &struct iwl_lte_coex_fine_tuning_params_cmd
+   */
+  LTE_COEX_FINE_TUNING_PARAMS_CMD = 0x57,
+#endif
+
+  /**
+   * @REPLY_SF_CFG_CMD: &struct iwl_sf_cfg_cmd
+   */
+  REPLY_SF_CFG_CMD = 0xd1,
+  /**
+   * @REPLY_BEACON_FILTERING_CMD: &struct iwl_beacon_filter_cmd
+   */
+  REPLY_BEACON_FILTERING_CMD = 0xd2,
+
+  /**
+   * @DTS_MEASUREMENT_NOTIFICATION:
+   * &struct iwl_dts_measurement_notif_v1 or
+   * &struct iwl_dts_measurement_notif_v2
+   */
+  DTS_MEASUREMENT_NOTIFICATION = 0xdd,
+
+#ifdef CPTCFG_IWLWIFI_DEBUG_HOST_CMD_ENABLED
+  /**
+   * @DEBUG_HOST_COMMAND: &struct iwl_dhc_cmd
+   */
+  DEBUG_HOST_COMMAND = 0xf1,
+#endif
+
+  /**
+   * @LDBG_CONFIG_CMD: configure continuous trace recording
+   */
+  LDBG_CONFIG_CMD = 0xf6,
+
+  /**
+   * @DEBUG_LOG_MSG: Debugging log data from firmware
+   */
+  DEBUG_LOG_MSG = 0xf7,
+
+  /**
+   * @BCAST_FILTER_CMD: &struct iwl_bcast_filter_cmd
+   */
+  BCAST_FILTER_CMD = 0xcf,
+
+  /**
+   * @MCAST_FILTER_CMD: &struct iwl_mcast_filter_cmd
+   */
+  MCAST_FILTER_CMD = 0xd0,
+
+  /**
+   * @D3_CONFIG_CMD: &struct iwl_d3_manager_config
+   */
+  D3_CONFIG_CMD = 0xd3,
+
+  /**
+   * @PROT_OFFLOAD_CONFIG_CMD: Depending on firmware, uses one of
+   * &struct iwl_proto_offload_cmd_v1, &struct iwl_proto_offload_cmd_v2,
+   * &struct iwl_proto_offload_cmd_v3_small,
+   * &struct iwl_proto_offload_cmd_v3_large
+   */
+  PROT_OFFLOAD_CONFIG_CMD = 0xd4,
+
+  /**
+   * @OFFLOADS_QUERY_CMD:
+   * No data in command, response in &struct iwl_wowlan_status
+   */
+  OFFLOADS_QUERY_CMD = 0xd5,
+
+  /**
+   * @REMOTE_WAKE_CONFIG_CMD: &struct iwl_wowlan_remote_wake_config
+   */
+  REMOTE_WAKE_CONFIG_CMD = 0xd6,
+
+  /**
+   * @D0I3_END_CMD: End D0i3/D3 state, no command data
+   */
+  D0I3_END_CMD = 0xed,
+
+  /**
+   * @WOWLAN_PATTERNS: &struct iwl_wowlan_patterns_cmd
+   */
+  WOWLAN_PATTERNS = 0xe0,
+
+  /**
+   * @WOWLAN_CONFIGURATION: &struct iwl_wowlan_config_cmd
+   */
+  WOWLAN_CONFIGURATION = 0xe1,
+
+  /**
+   * @WOWLAN_TSC_RSC_PARAM: &struct iwl_wowlan_rsc_tsc_params_cmd
+   */
+  WOWLAN_TSC_RSC_PARAM = 0xe2,
+
+  /**
+   * @WOWLAN_TKIP_PARAM: &struct iwl_wowlan_tkip_params_cmd
+   */
+  WOWLAN_TKIP_PARAM = 0xe3,
+
+  /**
+   * @WOWLAN_KEK_KCK_MATERIAL: &struct iwl_wowlan_kek_kck_material_cmd
+   */
+  WOWLAN_KEK_KCK_MATERIAL = 0xe4,
+
+  /**
+   * @WOWLAN_GET_STATUSES: response in &struct iwl_wowlan_status
+   */
+  WOWLAN_GET_STATUSES = 0xe5,
+
+  /**
+   * @SCAN_OFFLOAD_PROFILES_QUERY_CMD:
+   * No command data, response is &struct iwl_scan_offload_profiles_query
+   */
+  SCAN_OFFLOAD_PROFILES_QUERY_CMD = 0x56,
+};
+
+/**
+ * enum iwl_system_subcmd_ids - system group command IDs
+ */
+enum iwl_system_subcmd_ids {
+  /**
+   * @SHARED_MEM_CFG_CMD:
+   * response in &struct iwl_shared_mem_cfg or
+   * &struct iwl_shared_mem_cfg_v2
+   */
+  SHARED_MEM_CFG_CMD = 0x0,
+
+  /**
+   * @SOC_CONFIGURATION_CMD: &struct iwl_soc_configuration_cmd
+   */
+  SOC_CONFIGURATION_CMD = 0x01,
+
+  /**
+   * @INIT_EXTENDED_CFG_CMD: &struct iwl_init_extended_cfg_cmd
+   */
+  INIT_EXTENDED_CFG_CMD = 0x03,
+};
+
+/**
+ * enum iwl_xvt_subcmd_ids - XVT group command IDs
+ */
+enum iwl_xvt_subcmd_ids {
+  /**
+   * @IQ_CALIB_CONFIG_NOTIF : Notification about IQ calibration finished
+   * Handled by user space component
+   */
+  IQ_CALIB_CONFIG_NOTIF = 0xFF,
+};
+
+#endif  // SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_COMMANDS_H_
diff --git a/third_party/iwlwifi/fw/api/config.h b/third_party/iwlwifi/fw/api/config.h
new file mode 100644
index 0000000..bb29671
--- /dev/null
+++ b/third_party/iwlwifi/fw/api/config.h
@@ -0,0 +1,149 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * Copyright (C) 2018 Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+
+#ifndef SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_CONFIG_H_
+#define SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_CONFIG_H_
+
+#include "src/iwlwifi/platform/compiler.h"
+
+/*
+ * struct iwl_dqa_enable_cmd
+ * @cmd_queue: the TXQ number of the command queue
+ */
+struct iwl_dqa_enable_cmd {
+  __le32 cmd_queue;
+} __packed; /* DQA_CONTROL_CMD_API_S_VER_1 */
+
+/*
+ * struct iwl_tx_ant_cfg_cmd
+ * @valid: valid antenna configuration
+ */
+struct iwl_tx_ant_cfg_cmd {
+  __le32 valid;
+} __packed;
+
+/**
+ * struct iwl_calib_ctrl - Calibration control struct.
+ * Sent as part of the phy configuration command.
+ * @flow_trigger: bitmap for which calibrations to perform according to
+ *      flow triggers, using &enum iwl_calib_cfg
+ * @event_trigger: bitmap for which calibrations to perform according to
+ *      event triggers, using &enum iwl_calib_cfg
+ */
+struct iwl_calib_ctrl {
+  __le32 flow_trigger;
+  __le32 event_trigger;
+} __packed;
+
+/* This enum defines the bitmap of various calibrations to enable in both
+ * init ucode and runtime ucode through CALIBRATION_CFG_CMD.
+ */
+enum iwl_calib_cfg {
+  IWL_CALIB_CFG_XTAL_IDX = BIT(0),
+  IWL_CALIB_CFG_TEMPERATURE_IDX = BIT(1),
+  IWL_CALIB_CFG_VOLTAGE_READ_IDX = BIT(2),
+  IWL_CALIB_CFG_PAPD_IDX = BIT(3),
+  IWL_CALIB_CFG_TX_PWR_IDX = BIT(4),
+  IWL_CALIB_CFG_DC_IDX = BIT(5),
+  IWL_CALIB_CFG_BB_FILTER_IDX = BIT(6),
+  IWL_CALIB_CFG_LO_LEAKAGE_IDX = BIT(7),
+  IWL_CALIB_CFG_TX_IQ_IDX = BIT(8),
+  IWL_CALIB_CFG_TX_IQ_SKEW_IDX = BIT(9),
+  IWL_CALIB_CFG_RX_IQ_IDX = BIT(10),
+  IWL_CALIB_CFG_RX_IQ_SKEW_IDX = BIT(11),
+  IWL_CALIB_CFG_SENSITIVITY_IDX = BIT(12),
+  IWL_CALIB_CFG_CHAIN_NOISE_IDX = BIT(13),
+  IWL_CALIB_CFG_DISCONNECTED_ANT_IDX = BIT(14),
+  IWL_CALIB_CFG_ANT_COUPLING_IDX = BIT(15),
+  IWL_CALIB_CFG_DAC_IDX = BIT(16),
+  IWL_CALIB_CFG_ABS_IDX = BIT(17),
+  IWL_CALIB_CFG_AGC_IDX = BIT(18),
+};
+
+/**
+ * struct iwl_phy_cfg_cmd - Phy configuration command
+ * @phy_cfg: PHY configuration value, uses &enum iwl_fw_phy_cfg
+ * @calib_control: calibration control data
+ */
+struct iwl_phy_cfg_cmd {
+  __le32 phy_cfg;
+  struct iwl_calib_ctrl calib_control;
+} __packed;
+
+/*
+ * enum iwl_dc2dc_config_id - flag ids
+ *
+ * Ids of dc2dc configuration flags
+ */
+enum iwl_dc2dc_config_id {
+  DCDC_LOW_POWER_MODE_MSK_SET = 0x1, /* not used */
+  DCDC_FREQ_TUNE_SET = 0x2,
+}; /* MARKER_ID_API_E_VER_1 */
+
+/**
+ * struct iwl_dc2dc_config_cmd - configure dc2dc values
+ *
+ * (DC2DC_CONFIG_CMD = 0x83)
+ *
+ * Set/Get & configure dc2dc values.
+ * The command always returns the current dc2dc values.
+ *
+ * @flags: set/get dc2dc
+ * @enable_low_power_mode: not used.
+ * @dc2dc_freq_tune0: frequency divider - digital domain
+ * @dc2dc_freq_tune1: frequency divider - analog domain
+ */
+struct iwl_dc2dc_config_cmd {
+  __le32 flags;
+  __le32 enable_low_power_mode; /* not used */
+  __le32 dc2dc_freq_tune0;
+  __le32 dc2dc_freq_tune1;
+} __packed; /* DC2DC_CONFIG_CMD_API_S_VER_1 */
+
+/**
+ * struct iwl_dc2dc_config_resp - response for iwl_dc2dc_config_cmd
+ *
+ * Current dc2dc values returned by the FW.
+ *
+ * @dc2dc_freq_tune0: frequency divider - digital domain
+ * @dc2dc_freq_tune1: frequency divider - analog domain
+ */
+struct iwl_dc2dc_config_resp {
+  __le32 dc2dc_freq_tune0;
+  __le32 dc2dc_freq_tune1;
+} __packed; /* DC2DC_CONFIG_RESP_API_S_VER_1 */
+
+#endif  // SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_CONFIG_H_
diff --git a/third_party/iwlwifi/fw/api/context.h b/third_party/iwlwifi/fw/api/context.h
new file mode 100644
index 0000000..a737a8b
--- /dev/null
+++ b/third_party/iwlwifi/fw/api/context.h
@@ -0,0 +1,67 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+
+#ifndef SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_CONTEXT_H_
+#define SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_CONTEXT_H_
+
+/**
+ * enum iwl_ctxt_id_and_color - ID and color fields in context dword
+ * @FW_CTXT_ID_POS: position of the ID
+ * @FW_CTXT_ID_MSK: mask of the ID
+ * @FW_CTXT_COLOR_POS: position of the color
+ * @FW_CTXT_COLOR_MSK: mask of the color
+ * @FW_CTXT_INVALID: value used to indicate unused/invalid
+ */
+enum iwl_ctxt_id_and_color {
+  FW_CTXT_ID_POS = 0,
+  FW_CTXT_ID_MSK = 0xff << FW_CTXT_ID_POS,
+  FW_CTXT_COLOR_POS = 8,
+  FW_CTXT_COLOR_MSK = 0xff << FW_CTXT_COLOR_POS,
+  FW_CTXT_INVALID = 0xffffffff,
+};
+
+#define FW_CMD_ID_AND_COLOR(_id, _color) \
+  (((_id) << FW_CTXT_ID_POS) | ((_color) << FW_CTXT_COLOR_POS))
+
+/* Possible actions on PHYs, MACs and Bindings */
+enum iwl_ctxt_action {
+  FW_CTXT_ACTION_STUB = 0,
+  FW_CTXT_ACTION_ADD,
+  FW_CTXT_ACTION_MODIFY,
+  FW_CTXT_ACTION_REMOVE,
+  FW_CTXT_ACTION_NUM
+}; /* COMMON_CONTEXT_ACTION_API_E_VER_1 */
+
+#endif  // SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_CONTEXT_H_
diff --git a/third_party/iwlwifi/fw/api/d3.h b/third_party/iwlwifi/fw/api/d3.h
new file mode 100644
index 0000000..6908f2d
--- /dev/null
+++ b/third_party/iwlwifi/fw/api/d3.h
@@ -0,0 +1,535 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
+ * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018        Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *****************************************************************************/
+
+#ifndef SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_D3_H_
+#define SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_D3_H_
+
+#include <netinet/if_ether.h>
+
+#include "src/iwlwifi/platform/compiler.h"
+
+/**
+ * enum iwl_d3_wakeup_flags - D3 manager wakeup flags
+ * @IWL_WAKEUP_D3_CONFIG_FW_ERROR: wake up on firmware sysassert
+ */
+enum iwl_d3_wakeup_flags {
+  IWL_WAKEUP_D3_CONFIG_FW_ERROR = BIT(0),
+}; /* D3_MANAGER_WAKEUP_CONFIG_API_E_VER_3 */
+
+/**
+ * struct iwl_d3_manager_config - D3 manager configuration command
+ * @min_sleep_time: minimum sleep time (in usec)
+ * @wakeup_flags: wakeup flags, see &enum iwl_d3_wakeup_flags
+ * @wakeup_host_timer: force wakeup after this many seconds
+ *
+ * The structure is used for the D3_CONFIG_CMD command.
+ */
+struct iwl_d3_manager_config {
+  __le32 min_sleep_time;
+  __le32 wakeup_flags;
+  __le32 wakeup_host_timer;
+} __packed; /* D3_MANAGER_CONFIG_CMD_S_VER_4 */
+
+/* TODO: OFFLOADS_QUERY_API_S_VER_1 */
+
+/**
+ * enum iwl_d3_proto_offloads - enabled protocol offloads
+ * @IWL_D3_PROTO_OFFLOAD_ARP: ARP data is enabled
+ * @IWL_D3_PROTO_OFFLOAD_NS: NS (Neighbor Solicitation) is enabled
+ * @IWL_D3_PROTO_IPV4_VALID: IPv4 data is valid
+ * @IWL_D3_PROTO_IPV6_VALID: IPv6 data is valid
+ */
+enum iwl_proto_offloads {
+  IWL_D3_PROTO_OFFLOAD_ARP = BIT(0),
+  IWL_D3_PROTO_OFFLOAD_NS = BIT(1),
+  IWL_D3_PROTO_IPV4_VALID = BIT(2),
+  IWL_D3_PROTO_IPV6_VALID = BIT(3),
+};
+
+#define IWL_PROTO_OFFLOAD_NUM_IPV6_ADDRS_V1 2
+#define IWL_PROTO_OFFLOAD_NUM_IPV6_ADDRS_V2 6
+#define IWL_PROTO_OFFLOAD_NUM_IPV6_ADDRS_V3L 12
+#define IWL_PROTO_OFFLOAD_NUM_IPV6_ADDRS_V3S 4
+#define IWL_PROTO_OFFLOAD_NUM_IPV6_ADDRS_MAX 12
+
+#define IWL_PROTO_OFFLOAD_NUM_NS_CONFIG_V3L 4
+#define IWL_PROTO_OFFLOAD_NUM_NS_CONFIG_V3S 2
+
+/**
+ * struct iwl_proto_offload_cmd_common - ARP/NS offload common part
+ * @enabled: enable flags
+ * @remote_ipv4_addr: remote address to answer to (or zero if all)
+ * @host_ipv4_addr: our IPv4 address to respond to queries for
+ * @arp_mac_addr: our MAC address for ARP responses
+ * @reserved: unused
+ */
+struct iwl_proto_offload_cmd_common {
+  __le32 enabled;
+  __be32 remote_ipv4_addr;
+  __be32 host_ipv4_addr;
+  uint8_t arp_mac_addr[ETH_ALEN];
+  __le16 reserved;
+} __packed;
+
+/**
+ * struct iwl_proto_offload_cmd_v1 - ARP/NS offload configuration
+ * @common: common/IPv4 configuration
+ * @remote_ipv6_addr: remote address to answer to (or zero if all)
+ * @solicited_node_ipv6_addr: broken -- solicited node address exists
+ *  for each target address
+ * @target_ipv6_addr: our target addresses
+ * @ndp_mac_addr: neighbor solicitation response MAC address
+ * @reserved2: reserved
+ */
+struct iwl_proto_offload_cmd_v1 {
+  struct iwl_proto_offload_cmd_common common;
+  uint8_t remote_ipv6_addr[16];
+  uint8_t solicited_node_ipv6_addr[16];
+  uint8_t target_ipv6_addr[IWL_PROTO_OFFLOAD_NUM_IPV6_ADDRS_V1][16];
+  uint8_t ndp_mac_addr[ETH_ALEN];
+  __le16 reserved2;
+} __packed; /* PROT_OFFLOAD_CONFIG_CMD_DB_S_VER_1 */
+
+/**
+ * struct iwl_proto_offload_cmd_v2 - ARP/NS offload configuration
+ * @common: common/IPv4 configuration
+ * @remote_ipv6_addr: remote address to answer to (or zero if all)
+ * @solicited_node_ipv6_addr: broken -- solicited node address exists
+ *  for each target address
+ * @target_ipv6_addr: our target addresses
+ * @ndp_mac_addr: neighbor solicitation response MAC address
+ * @num_valid_ipv6_addrs: number of valid IPv6 addresses
+ * @reserved2: reserved
+ */
+struct iwl_proto_offload_cmd_v2 {
+  struct iwl_proto_offload_cmd_common common;
+  uint8_t remote_ipv6_addr[16];
+  uint8_t solicited_node_ipv6_addr[16];
+  uint8_t target_ipv6_addr[IWL_PROTO_OFFLOAD_NUM_IPV6_ADDRS_V2][16];
+  uint8_t ndp_mac_addr[ETH_ALEN];
+  uint8_t num_valid_ipv6_addrs;
+  uint8_t reserved2[3];
+} __packed; /* PROT_OFFLOAD_CONFIG_CMD_DB_S_VER_2 */
+
+#if 0   // NEEDS_PORTING
+struct iwl_ns_config {
+    struct in6_addr source_ipv6_addr;
+    struct in6_addr dest_ipv6_addr;
+    uint8_t target_mac_addr[ETH_ALEN];
+    __le16 reserved;
+} __packed; /* NS_OFFLOAD_CONFIG */
+
+struct iwl_targ_addr {
+    struct in6_addr addr;
+    __le32 config_num;
+} __packed; /* TARGET_IPV6_ADDRESS */
+
+/**
+ * struct iwl_proto_offload_cmd_v3_small - ARP/NS offload configuration
+ * @common: common/IPv4 configuration
+ * @num_valid_ipv6_addrs: number of valid IPv6 addresses
+ * @targ_addrs: target IPv6 addresses
+ * @ns_config: NS offload configurations
+ */
+struct iwl_proto_offload_cmd_v3_small {
+    struct iwl_proto_offload_cmd_common common;
+    __le32 num_valid_ipv6_addrs;
+    struct iwl_targ_addr targ_addrs[IWL_PROTO_OFFLOAD_NUM_IPV6_ADDRS_V3S];
+    struct iwl_ns_config ns_config[IWL_PROTO_OFFLOAD_NUM_NS_CONFIG_V3S];
+} __packed; /* PROT_OFFLOAD_CONFIG_CMD_DB_S_VER_3 */
+
+/**
+ * struct iwl_proto_offload_cmd_v3_large - ARP/NS offload configuration
+ * @common: common/IPv4 configuration
+ * @num_valid_ipv6_addrs: number of valid IPv6 addresses
+ * @targ_addrs: target IPv6 addresses
+ * @ns_config: NS offload configurations
+ */
+struct iwl_proto_offload_cmd_v3_large {
+    struct iwl_proto_offload_cmd_common common;
+    __le32 num_valid_ipv6_addrs;
+    struct iwl_targ_addr targ_addrs[IWL_PROTO_OFFLOAD_NUM_IPV6_ADDRS_V3L];
+    struct iwl_ns_config ns_config[IWL_PROTO_OFFLOAD_NUM_NS_CONFIG_V3L];
+} __packed; /* PROT_OFFLOAD_CONFIG_CMD_DB_S_VER_3 */
+#endif  // NEEDS_PORTING
+
+/*
+ * WOWLAN_PATTERNS
+ */
+#define IWL_WOWLAN_MIN_PATTERN_LEN 16
+#define IWL_WOWLAN_MAX_PATTERN_LEN 128
+
+struct iwl_wowlan_pattern {
+  uint8_t mask[IWL_WOWLAN_MAX_PATTERN_LEN / 8];
+  uint8_t pattern[IWL_WOWLAN_MAX_PATTERN_LEN];
+  uint8_t mask_size;
+  uint8_t pattern_size;
+  __le16 reserved;
+} __packed; /* WOWLAN_PATTERN_API_S_VER_1 */
+
+#define IWL_WOWLAN_MAX_PATTERNS 20
+
+/**
+ * struct iwl_wowlan_patterns_cmd - WoWLAN wakeup patterns
+ */
+struct iwl_wowlan_patterns_cmd {
+  /**
+   * @n_patterns: number of patterns
+   */
+  __le32 n_patterns;
+
+  /**
+   * @patterns: the patterns, array length in @n_patterns
+   */
+  struct iwl_wowlan_pattern patterns[];
+} __packed; /* WOWLAN_PATTERN_ARRAY_API_S_VER_1 */
+
+enum iwl_wowlan_wakeup_filters {
+  IWL_WOWLAN_WAKEUP_MAGIC_PACKET = BIT(0),
+  IWL_WOWLAN_WAKEUP_PATTERN_MATCH = BIT(1),
+  IWL_WOWLAN_WAKEUP_BEACON_MISS = BIT(2),
+  IWL_WOWLAN_WAKEUP_LINK_CHANGE = BIT(3),
+  IWL_WOWLAN_WAKEUP_GTK_REKEY_FAIL = BIT(4),
+  IWL_WOWLAN_WAKEUP_EAP_IDENT_REQ = BIT(5),
+  IWL_WOWLAN_WAKEUP_4WAY_HANDSHAKE = BIT(6),
+  IWL_WOWLAN_WAKEUP_ENABLE_NET_DETECT = BIT(7),
+  IWL_WOWLAN_WAKEUP_RF_KILL_DEASSERT = BIT(8),
+  IWL_WOWLAN_WAKEUP_REMOTE_LINK_LOSS = BIT(9),
+  IWL_WOWLAN_WAKEUP_REMOTE_SIGNATURE_TABLE = BIT(10),
+  IWL_WOWLAN_WAKEUP_REMOTE_TCP_EXTERNAL = BIT(11),
+  IWL_WOWLAN_WAKEUP_REMOTE_WAKEUP_PACKET = BIT(12),
+  IWL_WOWLAN_WAKEUP_IOAC_MAGIC_PACKET = BIT(13),
+  IWL_WOWLAN_WAKEUP_HOST_TIMER = BIT(14),
+  IWL_WOWLAN_WAKEUP_RX_FRAME = BIT(15),
+  IWL_WOWLAN_WAKEUP_BCN_FILTERING = BIT(16),
+}; /* WOWLAN_WAKEUP_FILTER_API_E_VER_4 */
+
+enum iwl_wowlan_flags {
+  IS_11W_ASSOC = BIT(0),
+  ENABLE_L3_FILTERING = BIT(1),
+  ENABLE_NBNS_FILTERING = BIT(2),
+  ENABLE_DHCP_FILTERING = BIT(3),
+  ENABLE_STORE_BEACON = BIT(4),
+};
+
+/**
+ * struct iwl_wowlan_config_cmd - WoWLAN configuration
+ * @wakeup_filter: filter from &enum iwl_wowlan_wakeup_filters
+ * @non_qos_seq: non-QoS sequence counter to use next
+ * @qos_seq: QoS sequence counters to use next
+ * @wowlan_ba_teardown_tids: bitmap of BA sessions to tear down
+ * @is_11n_connection: indicates HT connection
+ * @offloading_tid: TID reserved for firmware use
+ * @flags: extra flags, see &enum iwl_wowlan_flags
+ * @reserved: reserved
+ */
+struct iwl_wowlan_config_cmd {
+  __le32 wakeup_filter;
+  __le16 non_qos_seq;
+  __le16 qos_seq[8];
+  uint8_t wowlan_ba_teardown_tids;
+  uint8_t is_11n_connection;
+  uint8_t offloading_tid;
+  uint8_t flags;
+  uint8_t reserved[2];
+} __packed; /* WOWLAN_CONFIG_API_S_VER_4 */
+
+/*
+ * WOWLAN_TSC_RSC_PARAMS
+ */
+#define IWL_NUM_RSC 16
+
+struct tkip_sc {
+  __le16 iv16;
+  __le16 pad;
+  __le32 iv32;
+} __packed; /* TKIP_SC_API_U_VER_1 */
+
+struct iwl_tkip_rsc_tsc {
+  struct tkip_sc unicast_rsc[IWL_NUM_RSC];
+  struct tkip_sc multicast_rsc[IWL_NUM_RSC];
+  struct tkip_sc tsc;
+} __packed; /* TKIP_TSC_RSC_API_S_VER_1 */
+
+struct aes_sc {
+  __le64 pn;
+} __packed; /* TKIP_AES_SC_API_U_VER_1 */
+
+struct iwl_aes_rsc_tsc {
+  struct aes_sc unicast_rsc[IWL_NUM_RSC];
+  struct aes_sc multicast_rsc[IWL_NUM_RSC];
+  struct aes_sc tsc;
+} __packed; /* AES_TSC_RSC_API_S_VER_1 */
+
+union iwl_all_tsc_rsc {
+  struct iwl_tkip_rsc_tsc tkip;
+  struct iwl_aes_rsc_tsc aes;
+}; /* ALL_TSC_RSC_API_S_VER_2 */
+
+struct iwl_wowlan_rsc_tsc_params_cmd {
+  union iwl_all_tsc_rsc all_tsc_rsc;
+} __packed; /* ALL_TSC_RSC_API_S_VER_2 */
+
+#define IWL_MIC_KEY_SIZE 8
+struct iwl_mic_keys {
+  uint8_t tx[IWL_MIC_KEY_SIZE];
+  uint8_t rx_unicast[IWL_MIC_KEY_SIZE];
+  uint8_t rx_mcast[IWL_MIC_KEY_SIZE];
+} __packed; /* MIC_KEYS_API_S_VER_1 */
+
+#define IWL_P1K_SIZE 5
+struct iwl_p1k_cache {
+  __le16 p1k[IWL_P1K_SIZE];
+} __packed;
+
+#define IWL_NUM_RX_P1K_CACHE 2
+
+struct iwl_wowlan_tkip_params_cmd {
+  struct iwl_mic_keys mic_keys;
+  struct iwl_p1k_cache tx;
+  struct iwl_p1k_cache rx_uni[IWL_NUM_RX_P1K_CACHE];
+  struct iwl_p1k_cache rx_multi[IWL_NUM_RX_P1K_CACHE];
+} __packed; /* WOWLAN_TKIP_SETTING_API_S_VER_1 */
+
+#define IWL_KCK_MAX_SIZE 32
+#define IWL_KEK_MAX_SIZE 32
+
+struct iwl_wowlan_kek_kck_material_cmd {
+  uint8_t kck[IWL_KCK_MAX_SIZE];
+  uint8_t kek[IWL_KEK_MAX_SIZE];
+  __le16 kck_len;
+  __le16 kek_len;
+  __le64 replay_ctr;
+} __packed; /* KEK_KCK_MATERIAL_API_S_VER_2 */
+
+#define RF_KILL_INDICATOR_FOR_WOWLAN 0x87
+
+enum iwl_wowlan_rekey_status {
+  IWL_WOWLAN_REKEY_POST_REKEY = 0,
+  IWL_WOWLAN_REKEY_WHILE_REKEY = 1,
+}; /* WOWLAN_REKEY_STATUS_API_E_VER_1 */
+
+enum iwl_wowlan_wakeup_reason {
+  IWL_WOWLAN_WAKEUP_BY_NON_WIRELESS = 0,
+  IWL_WOWLAN_WAKEUP_BY_MAGIC_PACKET = BIT(0),
+  IWL_WOWLAN_WAKEUP_BY_PATTERN = BIT(1),
+  IWL_WOWLAN_WAKEUP_BY_DISCONNECTION_ON_MISSED_BEACON = BIT(2),
+  IWL_WOWLAN_WAKEUP_BY_DISCONNECTION_ON_DEAUTH = BIT(3),
+  IWL_WOWLAN_WAKEUP_BY_GTK_REKEY_FAILURE = BIT(4),
+  IWL_WOWLAN_WAKEUP_BY_RFKILL_DEASSERTED = BIT(5),
+  IWL_WOWLAN_WAKEUP_BY_UCODE_ERROR = BIT(6),
+  IWL_WOWLAN_WAKEUP_BY_EAPOL_REQUEST = BIT(7),
+  IWL_WOWLAN_WAKEUP_BY_FOUR_WAY_HANDSHAKE = BIT(8),
+  IWL_WOWLAN_WAKEUP_BY_REM_WAKE_LINK_LOSS = BIT(9),
+  IWL_WOWLAN_WAKEUP_BY_REM_WAKE_SIGNATURE_TABLE = BIT(10),
+  IWL_WOWLAN_WAKEUP_BY_REM_WAKE_TCP_EXTERNAL = BIT(11),
+  IWL_WOWLAN_WAKEUP_BY_REM_WAKE_WAKEUP_PACKET = BIT(12),
+  IWL_WOWLAN_WAKEUP_BY_IOAC_MAGIC_PACKET = BIT(13),
+  IWL_WOWLAN_WAKEUP_BY_D3_WAKEUP_HOST_TIMER = BIT(14),
+  IWL_WOWLAN_WAKEUP_BY_RXFRAME_FILTERED_IN = BIT(15),
+  IWL_WOWLAN_WAKEUP_BY_BEACON_FILTERED_IN = BIT(16),
+
+}; /* WOWLAN_WAKE_UP_REASON_API_E_VER_2 */
+
+struct iwl_wowlan_gtk_status_v1 {
+  uint8_t key_index;
+  uint8_t reserved[3];
+  uint8_t decrypt_key[16];
+  uint8_t tkip_mic_key[8];
+  struct iwl_wowlan_rsc_tsc_params_cmd rsc;
+} __packed; /* WOWLAN_GTK_MATERIAL_VER_1 */
+
+#define WOWLAN_KEY_MAX_SIZE 32
+#define WOWLAN_GTK_KEYS_NUM 2
+#define WOWLAN_IGTK_KEYS_NUM 2
+
+/**
+ * struct iwl_wowlan_gtk_status - GTK status
+ * @key: GTK material
+ * @key_len: GTK legth, if set to 0, the key is not available
+ * @key_flags: information about the key:
+ *  bits[0:1]:  key index assigned by the AP
+ *  bits[2:6]:  GTK index of the key in the internal DB
+ *  bit[7]:     Set iff this is the currently used GTK
+ * @reserved: padding
+ * @tkip_mic_key: TKIP RX MIC key
+ * @rsc: TSC RSC counters
+ */
+struct iwl_wowlan_gtk_status {
+  uint8_t key[WOWLAN_KEY_MAX_SIZE];
+  uint8_t key_len;
+  uint8_t key_flags;
+  uint8_t reserved[2];
+  uint8_t tkip_mic_key[8];
+  struct iwl_wowlan_rsc_tsc_params_cmd rsc;
+} __packed; /* WOWLAN_GTK_MATERIAL_VER_2 */
+
+#define IWL_WOWLAN_GTK_IDX_MASK (BIT(0) | BIT(1))
+
+/**
+ * struct iwl_wowlan_igtk_status - IGTK status
+ * @key: IGTK material
+ * @ipn: the IGTK packet number (replay counter)
+ * @key_len: IGTK length, if set to 0, the key is not available
+ * @key_flags: information about the key:
+ *  bits[0]:    key index assigned by the AP (0: index 4, 1: index 5)
+ *  bits[1:5]:  IGTK index of the key in the internal DB
+ *  bit[6]:     Set iff this is the currently used IGTK
+ */
+struct iwl_wowlan_igtk_status {
+  uint8_t key[WOWLAN_KEY_MAX_SIZE];
+  uint8_t ipn[6];
+  uint8_t key_len;
+  uint8_t key_flags;
+} __packed; /* WOWLAN_IGTK_MATERIAL_VER_1 */
+
+/**
+ * struct iwl_wowlan_status_v6 - WoWLAN status
+ * @gtk: GTK data
+ * @replay_ctr: GTK rekey replay counter
+ * @pattern_number: number of the matched pattern
+ * @non_qos_seq_ctr: non-QoS sequence counter to use next
+ * @qos_seq_ctr: QoS sequence counters to use next
+ * @wakeup_reasons: wakeup reasons, see &enum iwl_wowlan_wakeup_reason
+ * @num_of_gtk_rekeys: number of GTK rekeys
+ * @transmitted_ndps: number of transmitted neighbor discovery packets
+ * @received_beacons: number of received beacons
+ * @wake_packet_length: wakeup packet length
+ * @wake_packet_bufsize: wakeup packet buffer size
+ * @wake_packet: wakeup packet
+ */
+struct iwl_wowlan_status_v6 {
+  struct iwl_wowlan_gtk_status_v1 gtk;
+  __le64 replay_ctr;
+  __le16 pattern_number;
+  __le16 non_qos_seq_ctr;
+  __le16 qos_seq_ctr[8];
+  __le32 wakeup_reasons;
+  __le32 num_of_gtk_rekeys;
+  __le32 transmitted_ndps;
+  __le32 received_beacons;
+  __le32 wake_packet_length;
+  __le32 wake_packet_bufsize;
+  uint8_t wake_packet[]; /* can be truncated from _length to _bufsize */
+} __packed;              /* WOWLAN_STATUSES_API_S_VER_6 */
+
+/**
+ * struct iwl_wowlan_status - WoWLAN status
+ * @gtk: GTK data
+ * @igtk: IGTK data
+ * @replay_ctr: GTK rekey replay counter
+ * @pattern_number: number of the matched pattern
+ * @non_qos_seq_ctr: non-QoS sequence counter to use next
+ * @qos_seq_ctr: QoS sequence counters to use next
+ * @wakeup_reasons: wakeup reasons, see &enum iwl_wowlan_wakeup_reason
+ * @num_of_gtk_rekeys: number of GTK rekeys
+ * @transmitted_ndps: number of transmitted neighbor discovery packets
+ * @received_beacons: number of received beacons
+ * @wake_packet_length: wakeup packet length
+ * @wake_packet_bufsize: wakeup packet buffer size
+ * @wake_packet: wakeup packet
+ */
+struct iwl_wowlan_status {
+  struct iwl_wowlan_gtk_status gtk[WOWLAN_GTK_KEYS_NUM];
+  struct iwl_wowlan_igtk_status igtk[WOWLAN_IGTK_KEYS_NUM];
+  __le64 replay_ctr;
+  __le16 pattern_number;
+  __le16 non_qos_seq_ctr;
+  __le16 qos_seq_ctr[8];
+  __le32 wakeup_reasons;
+  __le32 num_of_gtk_rekeys;
+  __le32 transmitted_ndps;
+  __le32 received_beacons;
+  __le32 wake_packet_length;
+  __le32 wake_packet_bufsize;
+  uint8_t wake_packet[]; /* can be truncated from _length to _bufsize */
+} __packed;              /* WOWLAN_STATUSES_API_S_VER_7 */
+
+static inline uint8_t iwlmvm_wowlan_gtk_idx(struct iwl_wowlan_gtk_status* gtk) {
+  return gtk->key_flags & IWL_WOWLAN_GTK_IDX_MASK;
+}
+
+#define IWL_WOWLAN_TCP_MAX_PACKET_LEN 64
+#define IWL_WOWLAN_REMOTE_WAKE_MAX_PACKET_LEN 128
+#define IWL_WOWLAN_REMOTE_WAKE_MAX_TOKENS 2048
+
+struct iwl_tcp_packet_info {
+  __le16 tcp_pseudo_header_checksum;
+  __le16 tcp_payload_length;
+} __packed; /* TCP_PACKET_INFO_API_S_VER_2 */
+
+struct iwl_tcp_packet {
+  struct iwl_tcp_packet_info info;
+  uint8_t rx_mask[IWL_WOWLAN_MAX_PATTERN_LEN / 8];
+  uint8_t data[IWL_WOWLAN_TCP_MAX_PACKET_LEN];
+} __packed; /* TCP_PROTOCOL_PACKET_API_S_VER_1 */
+
+struct iwl_remote_wake_packet {
+  struct iwl_tcp_packet_info info;
+  uint8_t rx_mask[IWL_WOWLAN_MAX_PATTERN_LEN / 8];
+  uint8_t data[IWL_WOWLAN_REMOTE_WAKE_MAX_PACKET_LEN];
+} __packed; /* TCP_PROTOCOL_PACKET_API_S_VER_1 */
+
+struct iwl_wowlan_remote_wake_config {
+  __le32 connection_max_time; /* unused */
+  /* TCP_PROTOCOL_CONFIG_API_S_VER_1 */
+  uint8_t max_syn_retries;
+  uint8_t max_data_retries;
+  uint8_t tcp_syn_ack_timeout;
+  uint8_t tcp_ack_timeout;
+
+  struct iwl_tcp_packet syn_tx;
+  struct iwl_tcp_packet synack_rx;
+  struct iwl_tcp_packet keepalive_ack_rx;
+  struct iwl_tcp_packet fin_tx;
+
+  struct iwl_remote_wake_packet keepalive_tx;
+  struct iwl_remote_wake_packet wake_rx;
+
+  /* REMOTE_WAKE_OFFSET_INFO_API_S_VER_1 */
+  uint8_t sequence_number_offset;
+  uint8_t sequence_number_length;
+  uint8_t token_offset;
+  uint8_t token_length;
+  /* REMOTE_WAKE_PROTOCOL_PARAMS_API_S_VER_1 */
+  __le32 initial_sequence_number;
+  __le16 keepalive_interval;
+  __le16 num_tokens;
+  uint8_t tokens[IWL_WOWLAN_REMOTE_WAKE_MAX_TOKENS];
+} __packed; /* REMOTE_WAKE_CONFIG_API_S_VER_2 */
+
+/* TODO: NetDetect API */
+
+#endif  // SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_D3_H_
diff --git a/third_party/iwlwifi/fw/api/datapath.h b/third_party/iwlwifi/fw/api/datapath.h
new file mode 100644
index 0000000..36a3955
--- /dev/null
+++ b/third_party/iwlwifi/fw/api/datapath.h
@@ -0,0 +1,156 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * Copyright (C) 2018 Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+
+#ifndef SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_DATAPATH_H_
+#define SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_DATAPATH_H_
+
+#include "src/iwlwifi/platform/compiler.h"
+
+/**
+ * enum iwl_data_path_subcmd_ids - data path group commands
+ */
+enum iwl_data_path_subcmd_ids {
+  /**
+   * @DQA_ENABLE_CMD: &struct iwl_dqa_enable_cmd
+   */
+  DQA_ENABLE_CMD = 0x0,
+
+  /**
+   * @UPDATE_MU_GROUPS_CMD: &struct iwl_mu_group_mgmt_cmd
+   */
+  UPDATE_MU_GROUPS_CMD = 0x1,
+
+  /**
+   * @TRIGGER_RX_QUEUES_NOTIF_CMD: &struct iwl_rxq_sync_cmd
+   */
+  TRIGGER_RX_QUEUES_NOTIF_CMD = 0x2,
+
+  /**
+   * @STA_HE_CTXT_CMD: &struct iwl_he_sta_context_cmd
+   */
+  STA_HE_CTXT_CMD = 0x7,
+
+#ifdef CPTCFG_IWLMVM_AX_SOFTAP_TESTMODE
+  /**
+   * @AX_SOFTAP_TESTMODE_DL_BASIC: &struct ax_softap_testmode_dl_basic_cmd
+   */
+  AX_SOFTAP_TESTMODE_DL_BASIC = 0x9,
+
+  /**
+   * @AX_SOFTAP_TESTMODE_DL_MU_BAR:
+   *  &struct ax_softap_testmode_dl_mu_bar_cmd
+   */
+  AX_SOFTAP_TESTMODE_DL_MU_BAR = 0xA,
+
+  /**
+   * @AX_SOFTAP_TESTMODE_UL: &struct ax_softap_testmode_ul_cmd
+   */
+  AX_SOFTAP_TESTMODE_UL = 0xB,
+#endif
+
+  /**
+   * @AX_SOFTAP_CLIENT_TESTMODE: &struct ax_softap_client_testmode_cmd
+   */
+  AX_SOFTAP_CLIENT_TESTMODE = 0xC,
+
+  /**
+   * @RFH_QUEUE_CONFIG_CMD: &struct iwl_rfh_queue_config
+   */
+  RFH_QUEUE_CONFIG_CMD = 0xD,
+
+  /**
+   * @TLC_MNG_CONFIG_CMD: &struct iwl_tlc_config_cmd
+   */
+  TLC_MNG_CONFIG_CMD = 0xF,
+
+  /**
+   * @HE_AIR_SNIFFER_CONFIG_CMD: &struct iwl_he_monitor_cmd
+   */
+  HE_AIR_SNIFFER_CONFIG_CMD = 0x13,
+
+  /**
+   * @RX_NO_DATA_NOTIF: &struct iwl_rx_no_data
+   */
+  RX_NO_DATA_NOTIF = 0xF5,
+
+  /**
+   * @TLC_MNG_UPDATE_NOTIF: &struct iwl_tlc_update_notif
+   */
+  TLC_MNG_UPDATE_NOTIF = 0xF7,
+
+  /**
+   * @STA_PM_NOTIF: &struct iwl_mvm_pm_state_notification
+   */
+  STA_PM_NOTIF = 0xFD,
+
+  /**
+   * @MU_GROUP_MGMT_NOTIF: &struct iwl_mu_group_mgmt_notif
+   */
+  MU_GROUP_MGMT_NOTIF = 0xFE,
+
+  /**
+   * @RX_QUEUES_NOTIFICATION: &struct iwl_rxq_sync_notification
+   */
+  RX_QUEUES_NOTIFICATION = 0xFF,
+};
+
+/**
+ * struct iwl_mu_group_mgmt_cmd - VHT MU-MIMO group configuration
+ *
+ * @reserved: reserved
+ * @membership_status: a bitmap of MU groups
+ * @user_position:the position of station in a group. If the station is in the
+ *  group then bits (group * 2) is the position -1
+ */
+struct iwl_mu_group_mgmt_cmd {
+  __le32 reserved;
+  __le32 membership_status[2];
+  __le32 user_position[4];
+} __packed; /* MU_GROUP_ID_MNG_TABLE_API_S_VER_1 */
+
+/**
+ * struct iwl_mu_group_mgmt_notif - VHT MU-MIMO group id notification
+ *
+ * @membership_status: a bitmap of MU groups
+ * @user_position: the position of station in a group. If the station is in the
+ *  group then bits (group * 2) is the position -1
+ */
+struct iwl_mu_group_mgmt_notif {
+  __le32 membership_status[2];
+  __le32 user_position[4];
+} __packed; /* MU_GROUP_MNG_NTFY_API_S_VER_1 */
+
+#endif  // SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_DATAPATH_H_
diff --git a/third_party/iwlwifi/fw/api/dbg-tlv.h b/third_party/iwlwifi/fw/api/dbg-tlv.h
new file mode 100644
index 0000000..0622859
--- /dev/null
+++ b/third_party/iwlwifi/fw/api/dbg-tlv.h
@@ -0,0 +1,376 @@
+/******************************************************************************
+ *
+ * Copyright (C) 2018 Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+#ifndef SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_DBG_TLV_H_
+#define SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_DBG_TLV_H_
+
+#include "src/iwlwifi/platform/compiler.h"
+
+/*
+ * struct iwl_fw_ini_header: Common Header for all debug group TLV's structures
+ * @tlv_version: version info
+ * @apply_point: &enum iwl_fw_ini_apply_point
+ * @data: TLV data followed
+ **/
+struct iwl_fw_ini_header {
+  __le32 tlv_version;
+  __le32 apply_point;
+  uint8_t data[0];
+} __packed; /* FW_INI_HEADER_TLV_S */
+
+/**
+ * struct iwl_fw_ini_allocation_tlv - (IWL_FW_INI_TLV_TYPE_BUFFER_ALLOCATION)
+ * buffer allocation TLV - for debug
+ *
+ * @iwl_fw_ini_header: header
+ * @allocation_id: &enum iwl_fw_ini_allocation_id - to bind allocation and hcmd
+ *  if needed (DBGC1/DBGC2/SDFX/...)
+ * @buffer_location: type of iwl_fw_ini_buffer_location
+ * @size: size in bytes
+ * @max_fragments: the maximum allowed fragmentation in the desired memory
+ *  allocation above
+ * @min_frag_size: the minimum allowed fragmentation size in bytes
+ */
+struct iwl_fw_ini_allocation_tlv {
+  struct iwl_fw_ini_header header;
+  __le32 allocation_id;
+  __le32 buffer_location;
+  __le32 size;
+  __le32 max_fragments;
+  __le32 min_frag_size;
+} __packed; /* FW_INI_BUFFER_ALLOCATION_TLV_S_VER_1 */
+
+/**
+ * struct iwl_fw_ini_hcmd (IWL_FW_INI_TLV_TYPE_HCMD)
+ * Generic Host command pass through TLV
+ *
+ * @id: the debug configuration command type for instance: 0xf6 / 0xf5 / DHC
+ * @group: the desired cmd group
+ * @padding: all zeros for dword alignment
+ * @data: all of the relevant command (0xf6/0xf5) to be sent
+ */
+struct iwl_fw_ini_hcmd {
+  uint8_t id;
+  uint8_t group;
+  __le16 padding;
+  uint8_t data[0];
+} __packed; /* FW_INI_HCMD_S */
+
+/**
+ * struct iwl_fw_ini_hcmd_tlv
+ * @header: header
+ * @hcmd: a variable length host-command to be sent to apply the configuration.
+ */
+struct iwl_fw_ini_hcmd_tlv {
+  struct iwl_fw_ini_header header;
+  struct iwl_fw_ini_hcmd hcmd;
+} __packed; /* FW_INI_HCMD_TLV_S_VER_1 */
+
+/*
+ * struct iwl_fw_ini_debug_flow_tlv (IWL_FW_INI_TLV_TYPE_DEBUG_FLOW)
+ *
+ * @header: header
+ * @debug_flow_cfg: &enum iwl_fw_ini_debug_flow
+ */
+struct iwl_fw_ini_debug_flow_tlv {
+  struct iwl_fw_ini_header header;
+  __le32 debug_flow_cfg;
+} __packed; /* FW_INI_DEBUG_FLOW_TLV_S_VER_1 */
+
+#define IWL_FW_INI_MAX_REGION_ID 20
+#define IWL_FW_INI_MAX_NAME 32
+/**
+ * struct iwl_fw_ini_region_cfg
+ * @region_id: ID of this dump configuration
+ * @region_type: &enum iwl_fw_ini_region_type
+ * @num_regions: amount of regions in the address array.
+ * @allocation_id: For DRAM type field substitutes for allocation_id.
+ * @name_len: name length
+ * @name: file name to use for this region
+ * @size: size of the data, in bytes.(unused for IWL_FW_INI_REGION_DRAM_BUFFER)
+ * @start_addr: array of addresses. (unused for IWL_FW_INI_REGION_DRAM_BUFFER)
+ */
+struct iwl_fw_ini_region_cfg {
+  __le32 region_id;
+  __le32 region_type;
+  __le32 name_len;
+  uint8_t name[IWL_FW_INI_MAX_NAME];
+  union {
+    __le32 num_regions;
+    __le32 allocation_id;
+  };
+  __le32 size;
+  __le32 start_addr[];
+} __packed; /* FW_INI_REGION_CONFIG_S */
+
+/**
+ * struct iwl_fw_ini_region_tlv - (IWL_FW_INI_TLV_TYPE_REGION_CFG)
+ * DUMP sections define IDs and triggers that use those IDs TLV
+ * @header: header
+ * @num_regions: how many different region section and IDs are coming next
+ * @iwl_fw_ini_dump dump_config: list of dump configurations
+ */
+struct iwl_fw_ini_region_tlv {
+  struct iwl_fw_ini_header header;
+  __le32 num_regions;
+  struct iwl_fw_ini_region_cfg region_config[];
+} __packed; /* FW_INI_REGION_CFG_S */
+
+/**
+ * struct iwl_fw_ini_trigger - (IWL_FW_INI_TLV_TYPE_DUMP_CFG)
+ * Region sections define IDs and triggers that use those IDs TLV
+ *
+ * @trigger_id: enum &iwl_fw_ini_tigger_id
+ * @ignore_default: override FW TLV with binary TLV
+ * @dump_delay: delay from trigger fire to dump, in usec
+ * @occurrences: max amount of times to be fired
+ * @ignore_consec: ignore consecutive triggers, in usec
+ * @force_restart: force FW restart
+ * @multi_dut: initiate debug dump data on several DUTs
+ * @trigger_data: generic data to be utilized per trigger
+ * @num_regions: number of dump regions defined for this trigger
+ * @data: region IDs
+ */
+struct iwl_fw_ini_trigger {
+  __le32 trigger_id;
+  __le32 ignore_default;
+  __le32 dump_delay;
+  __le32 occurrences;
+  __le32 ignore_consec;
+  __le32 force_restart;
+  __le32 multi_dut;
+  __le32 trigger_data;
+  __le32 num_regions;
+  __le32 data[];
+} __packed; /* FW_INI_TRIGGER_CONFIG_S */
+
+/**
+ * struct iwl_fw_ini_trigger_tlv - (IWL_FW_INI_TLV_TYPE_TRIGGERS_CFG)
+ * DUMP sections define IDs and triggers that use those IDs TLV
+ *
+ * @header: header
+ * @num_triggers: how many different triggers section and IDs are coming next
+ * @trigger_config: list of trigger configurations
+ */
+struct iwl_fw_ini_trigger_tlv {
+  struct iwl_fw_ini_header header;
+  __le32 num_triggers;
+  struct iwl_fw_ini_trigger trigger_config[];
+} __packed; /* FW_INI_TRIGGER_CFG_S */
+
+/**
+ * enum iwl_fw_ini_trigger_id
+ * @IWL_FW_TRIGGER_ID_FW_ASSERT: FW assert
+ * @IWL_FW_TRIGGER_ID_FW_TFD_Q_HANG: TFD queue hang
+ * @IWL_FW_TRIGGER_ID_FW_HW_ERROR: HW assert
+ * @IWL_FW_TRIGGER_ID_FW_TRIGGER_ERROR: FW error notification
+ * @IWL_FW_TRIGGER_ID_FW_TRIGGER_WARNING: FW warning notification
+ * @IWL_FW_TRIGGER_ID_FW_TRIGGER_INFO: FW info notification
+ * @IWL_FW_TRIGGER_ID_FW_TRIGGER_DEBUG: FW debug notification
+ * @IWL_FW_TRIGGER_ID_USER_TRIGGER: User trigger
+ * @IWL_FW_TRIGGER_ID_HOST_PEER_CLIENT_INACTIVITY: peer inactivity
+ * @FW_DEBUG_TLV_TRIGGER_ID_HOST_DID_INITIATED_EVENT: undefined
+ * @IWL_FW_TRIGGER_ID_HOST_TX_LATENCY_THRESHOLD_CROSSED: TX latency
+ *  threshold was crossed
+ * @IWL_FW_TRIGGER_ID_HOST_TX_RESPONSE_STATUS_FAILED: TX failed
+ * @IWL_FW_TRIGGER_ID_HOST_OS_REQ_DEAUTH_PEER: Deauth initiated by host
+ * @IWL_FW_TRIGGER_ID_HOST_STOP_GO_REQUEST: stop GO request
+ * @IWL_FW_TRIGGER_ID_HOST_START_GO_REQUEST: start GO request
+ * @IWL_FW_TRIGGER_ID_HOST_JOIN_GROUP_REQUEST: join P2P group request
+ * @IWL_FW_TRIGGER_ID_HOST_SCAN_START: scan started event
+ * @IWL_FW_TRIGGER_ID_HOST_SCAN_SUBMITTED: undefined
+ * @IWL_FW_TRIGGER_ID_HOST_SCAN_PARAMS: undefined
+ * @IWL_FW_TRIGGER_ID_HOST_CHECK_FOR_HANG: undefined
+ * @IWL_FW_TRIGGER_ID_HOST_BAR_RECEIVED: BAR frame was received
+ * @IWL_FW_TRIGGER_ID_HOST_AGG_TX_RESPONSE_STATUS_FAILED: agg TX failed
+ * @IWL_FW_TRIGGER_ID_HOST_EAPOL_TX_RESPONSE_FAILED: EAPOL TX failed
+ * @IWL_FW_TRIGGER_ID_HOST_FAKE_TX_RESPONSE_SUSPECTED: suspicious TX response
+ * @IWL_FW_TRIGGER_ID_HOST_AUTH_REQ_FROM_ASSOC_CLIENT: received suspicious auth
+ * @IWL_FW_TRIGGER_ID_HOST_ROAM_COMPLETE: roaming was completed
+ * @IWL_FW_TRIGGER_ID_HOST_AUTH_ASSOC_FAST_FAILED: fast assoc failed
+ * @IWL_FW_TRIGGER_ID_HOST_D3_START: D3 start
+ * @IWL_FW_TRIGGER_ID_HOST_D3_END: D3 end
+ * @IWL_FW_TRIGGER_ID_HOST_BSS_MISSED_BEACONS: missed beacon events
+ * @IWL_FW_TRIGGER_ID_HOST_P2P_CLIENT_MISSED_BEACONS: P2P missed beacon events
+ * @IWL_FW_TRIGGER_ID_HOST_PEER_CLIENT_TX_FAILURES:  undefined
+ * @IWL_FW_TRIGGER_ID_HOST_TX_WFD_ACTION_FRAME_FAILED: undefined
+ * @IWL_FW_TRIGGER_ID_HOST_AUTH_ASSOC_FAILED: authentication / association
+ *  failed
+ * @IWL_FW_TRIGGER_ID_HOST_SCAN_COMPLETE: scan complete event
+ * @IWL_FW_TRIGGER_ID_HOST_SCAN_ABORT: scan abort complete
+ * @IWL_FW_TRIGGER_ID_HOST_NIC_ALIVE: nic alive message was received
+ * @IWL_FW_TRIGGER_ID_HOST_CHANNEL_SWITCH_COMPLETE: CSA was completed
+ * @IWL_FW_TRIGGER_ID_NUM: number of trigger IDs
+ */
+enum iwl_fw_ini_trigger_id {
+  /* Errors triggers */
+  IWL_FW_TRIGGER_ID_FW_ASSERT = 1,
+  IWL_FW_TRIGGER_ID_FW_TFD_Q_HANG = 2,
+  IWL_FW_TRIGGER_ID_FW_HW_ERROR = 3,
+  /* Generic triggers */
+  IWL_FW_TRIGGER_ID_FW_TRIGGER_ERROR = 4,
+  IWL_FW_TRIGGER_ID_FW_TRIGGER_WARNING = 5,
+  IWL_FW_TRIGGER_ID_FW_TRIGGER_INFO = 6,
+  IWL_FW_TRIGGER_ID_FW_TRIGGER_DEBUG = 7,
+  /* User Trigger */
+  IWL_FW_TRIGGER_ID_USER_TRIGGER = 8,
+  /* Host triggers */
+  IWL_FW_TRIGGER_ID_HOST_PEER_CLIENT_INACTIVITY = 9,
+  IWL_FW_TRIGGER_ID_HOST_DID_INITIATED_EVENT = 10,
+  IWL_FW_TRIGGER_ID_HOST_TX_LATENCY_THRESHOLD_CROSSED = 11,
+  IWL_FW_TRIGGER_ID_HOST_TX_RESPONSE_STATUS_FAILED = 12,
+  IWL_FW_TRIGGER_ID_HOST_OS_REQ_DEAUTH_PEER = 13,
+  IWL_FW_TRIGGER_ID_HOST_STOP_GO_REQUEST = 14,
+  IWL_FW_TRIGGER_ID_HOST_START_GO_REQUEST = 15,
+  IWL_FW_TRIGGER_ID_HOST_JOIN_GROUP_REQUEST = 16,
+  IWL_FW_TRIGGER_ID_HOST_SCAN_START = 17,
+  IWL_FW_TRIGGER_ID_HOST_SCAN_SUBITTED = 18,
+  IWL_FW_TRIGGER_ID_HOST_SCAN_PARAMS = 19,
+  IWL_FW_TRIGGER_ID_HOST_CHECK_FOR_HANG = 20,
+  IWL_FW_TRIGGER_ID_HOST_BAR_RECEIVED = 21,
+  IWL_FW_TRIGGER_ID_HOST_AGG_TX_RESPONSE_STATUS_FAILED = 22,
+  IWL_FW_TRIGGER_ID_HOST_EAPOL_TX_RESPONSE_FAILED = 23,
+  IWL_FW_TRIGGER_ID_HOST_FAKE_TX_RESPONSE_SUSPECTED = 24,
+  IWL_FW_TRIGGER_ID_HOST_AUTH_REQ_FROM_ASSOC_CLIENT = 25,
+  IWL_FW_TRIGGER_ID_HOST_ROAM_COMPLETE = 26,
+  IWL_FW_TRIGGER_ID_HOST_AUTH_ASSOC_FAST_FAILED = 27,
+  IWL_FW_TRIGGER_ID_HOST_D3_START = 28,
+  IWL_FW_TRIGGER_ID_HOST_D3_END = 29,
+  IWL_FW_TRIGGER_ID_HOST_BSS_MISSED_BEACONS = 30,
+  IWL_FW_TRIGGER_ID_HOST_P2P_CLIENT_MISSED_BEACONS = 31,
+  IWL_FW_TRIGGER_ID_HOST_PEER_CLIENT_TX_FAILURES = 32,
+  IWL_FW_TRIGGER_ID_HOST_TX_WFD_ACTION_FRAME_FAILED = 33,
+  IWL_FW_TRIGGER_ID_HOST_AUTH_ASSOC_FAILED = 34,
+  IWL_FW_TRIGGER_ID_HOST_SCAN_COMPLETE = 35,
+  IWL_FW_TRIGGER_ID_HOST_SCAN_ABORT = 36,
+  IWL_FW_TRIGGER_ID_HOST_NIC_ALIVE = 37,
+  IWL_FW_TRIGGER_ID_HOST_CHANNEL_SWITCH_COMPLETE = 38,
+  IWL_FW_TRIGGER_ID_NUM,
+}; /* FW_INI_TRIGGER_ID_E_VER_1 */
+
+/**
+ * enum iwl_fw_ini_apply_point
+ * @IWL_FW_INI_APPLY_INVALID: invalid
+ * @IWL_FW_INI_APPLY_EARLY: pre loading FW
+ * @IWL_FW_INI_APPLY_AFTER_ALIVE: first cmd from host after alive
+ * @IWL_FW_INI_APPLY_POST_INIT: last cmd in initialization sequence
+ * @IWL_FW_INI_APPLY_MISSED_BEACONS: missed beacons notification
+ * @IWL_FW_INI_APPLY_SCAN_COMPLETE: scan completed
+ * @IWL_FW_INI_APPLY_NUM: number of apply points
+ */
+enum iwl_fw_ini_apply_point {
+  IWL_FW_INI_APPLY_INVALID,
+  IWL_FW_INI_APPLY_EARLY,
+  IWL_FW_INI_APPLY_AFTER_ALIVE,
+  IWL_FW_INI_APPLY_POST_INIT,
+  IWL_FW_INI_APPLY_MISSED_BEACONS,
+  IWL_FW_INI_APPLY_SCAN_COMPLETE,
+  IWL_FW_INI_APPLY_NUM,
+}; /* FW_INI_APPLY_POINT_E_VER_1 */
+
+/**
+ * enum iwl_fw_ini_allocation_id
+ * @IWL_FW_INI_ALLOCATION_INVALID: invalid
+ * @IWL_FW_INI_ALLOCATION_ID_DBGC1: allocation meant for DBGC1 configuration
+ * @IWL_FW_INI_ALLOCATION_ID_DBGC2: allocation meant for DBGC2 configuration
+ * @IWL_FW_INI_ALLOCATION_ID_DBGC3: allocation meant for DBGC3 configuration
+ * @IWL_FW_INI_ALLOCATION_ID_SDFX: for SDFX module
+ * @IWL_FW_INI_ALLOCATION_ID_FW_DUMP: used for crash and runtime dumps
+ * @IWL_FW_INI_ALLOCATION_ID_USER_DEFINED: for future user scenarios
+ */
+enum iwl_fw_ini_allocation_id {
+  IWL_FW_INI_ALLOCATION_INVALID,
+  IWL_FW_INI_ALLOCATION_ID_DBGC1,
+  IWL_FW_INI_ALLOCATION_ID_DBGC2,
+  IWL_FW_INI_ALLOCATION_ID_DBGC3,
+  IWL_FW_INI_ALLOCATION_ID_SDFX,
+  IWL_FW_INI_ALLOCATION_ID_FW_DUMP,
+  IWL_FW_INI_ALLOCATION_ID_USER_DEFINED,
+}; /* FW_INI_ALLOCATION_ID_E_VER_1 */
+
+/**
+ * enum iwl_fw_ini_buffer_location
+ * @IWL_FW_INI_LOCATION_INVALID: invalid
+ * @IWL_FW_INI_LOCATION_SRAM_PATH: SRAM location
+ * @IWL_FW_INI_LOCATION_DRAM_PATH: DRAM location
+ */
+enum iwl_fw_ini_buffer_location {
+  IWL_FW_INI_LOCATION_SRAM_INVALID,
+  IWL_FW_INI_LOCATION_SRAM_PATH,
+  IWL_FW_INI_LOCATION_DRAM_PATH,
+}; /* FW_INI_BUFFER_LOCATION_E_VER_1 */
+
+/**
+ * enum iwl_fw_ini_debug_flow
+ * @IWL_FW_INI_DEBUG_INVALID: invalid
+ * @IWL_FW_INI_DEBUG_DBTR_FLOW: undefined
+ * @IWL_FW_INI_DEBUG_TB2DTF_FLOW: undefined
+ */
+enum iwl_fw_ini_debug_flow {
+  IWL_FW_INI_DEBUG_INVALID,
+  IWL_FW_INI_DEBUG_DBTR_FLOW,
+  IWL_FW_INI_DEBUG_TB2DTF_FLOW,
+}; /* FW_INI_DEBUG_FLOW_E_VER_1 */
+
+/**
+ * enum iwl_fw_ini_region_type
+ * @IWL_FW_INI_REGION_INVALID: invalid
+ * @IWL_FW_INI_REGION_DEVICE_MEMORY: device internal memory
+ * @IWL_FW_INI_REGION_PERIPHERY_MAC: periphery registers of MAC
+ * @IWL_FW_INI_REGION_PERIPHERY_PHY: periphery registers of PHY
+ * @IWL_FW_INI_REGION_PERIPHERY_AUX: periphery registers of AUX
+ * @IWL_FW_INI_REGION_DRAM_BUFFER: DRAM buffer
+ * @IWL_FW_INI_REGION_DRAM_IMR: IMR memory
+ * @IWL_FW_INI_REGION_INTERNAL_BUFFER: undefined
+ * @IWL_FW_INI_REGION_TXF: TX fifos
+ * @IWL_FW_INI_REGION_RXF: RX fifo
+ * @IWL_FW_INI_REGION_PAGING: paging memory
+ * @IWL_FW_INI_REGION_CSR: CSR registers
+ * @IWL_FW_INI_REGION_NUM: number of region types
+ */
+enum iwl_fw_ini_region_type {
+  IWL_FW_INI_REGION_INVALID,
+  IWL_FW_INI_REGION_DEVICE_MEMORY,
+  IWL_FW_INI_REGION_PERIPHERY_MAC,
+  IWL_FW_INI_REGION_PERIPHERY_PHY,
+  IWL_FW_INI_REGION_PERIPHERY_AUX,
+  IWL_FW_INI_REGION_DRAM_BUFFER,
+  IWL_FW_INI_REGION_DRAM_IMR,
+  IWL_FW_INI_REGION_INTERNAL_BUFFER,
+  IWL_FW_INI_REGION_TXF,
+  IWL_FW_INI_REGION_RXF,
+  IWL_FW_INI_REGION_PAGING,
+  IWL_FW_INI_REGION_CSR,
+  IWL_FW_INI_REGION_NUM
+}; /* FW_INI_REGION_TYPE_E_VER_1*/
+
+#endif  // SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_DBG_TLV_H_
diff --git a/third_party/iwlwifi/fw/api/debug.h b/third_party/iwlwifi/fw/api/debug.h
new file mode 100644
index 0000000..5007c17
--- /dev/null
+++ b/third_party/iwlwifi/fw/api/debug.h
@@ -0,0 +1,368 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * Copyright (C) 2018 Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+#ifndef SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_DEBUG_H_
+#define SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_DEBUG_H_
+
+/**
+ * enum iwl_debug_cmds - debug commands
+ */
+enum iwl_debug_cmds {
+  /**
+   * @LMAC_RD_WR:
+   * LMAC memory read/write, using &struct iwl_dbg_mem_access_cmd and
+   * &struct iwl_dbg_mem_access_rsp
+   */
+  LMAC_RD_WR = 0x0,
+  /**
+   * @UMAC_RD_WR:
+   * UMAC memory read/write, using &struct iwl_dbg_mem_access_cmd and
+   * &struct iwl_dbg_mem_access_rsp
+   */
+  UMAC_RD_WR = 0x1,
+#ifdef CPTCFG_IWLWIFI_DEBUG_HOST_CMD_ENABLED
+  /**
+   * @DEBUG_HOST_NTF:
+   * &struct iwl_adwell_fine_tune_metrics_report or
+   * &struct iwl_channel_dwell_report or
+   * &struct iwl_profiling_notification
+   */
+  DEBUG_HOST_NTF = 0xFC,
+#endif
+  /**
+   * @MFU_ASSERT_DUMP_NTF:
+   * &struct iwl_mfu_assert_dump_notif
+   */
+  MFU_ASSERT_DUMP_NTF = 0xFE,
+};
+
+/* Error response/notification */
+enum {
+  FW_ERR_UNKNOWN_CMD = 0x0,
+  FW_ERR_INVALID_CMD_PARAM = 0x1,
+  FW_ERR_SERVICE = 0x2,
+  FW_ERR_ARC_MEMORY = 0x3,
+  FW_ERR_ARC_CODE = 0x4,
+  FW_ERR_WATCH_DOG = 0x5,
+  FW_ERR_WEP_GRP_KEY_INDX = 0x10,
+  FW_ERR_WEP_KEY_SIZE = 0x11,
+  FW_ERR_OBSOLETE_FUNC = 0x12,
+  FW_ERR_UNEXPECTED = 0xFE,
+  FW_ERR_FATAL = 0xFF
+};
+
+/**
+ * struct iwl_error_resp - FW error indication
+ * ( REPLY_ERROR = 0x2 )
+ * @error_type: one of FW_ERR_*
+ * @cmd_id: the command ID for which the error occurred
+ * @reserved1: reserved
+ * @bad_cmd_seq_num: sequence number of the erroneous command
+ * @error_service: which service created the error, applicable only if
+ *     error_type = 2, otherwise 0
+ * @timestamp: TSF in usecs.
+ */
+struct iwl_error_resp {
+  __le32 error_type;
+  uint8_t cmd_id;
+  uint8_t reserved1;
+  __le16 bad_cmd_seq_num;
+  __le32 error_service;
+  __le64 timestamp;
+} __packed;
+
+#define TX_FIFO_MAX_NUM_9000 8
+#define TX_FIFO_MAX_NUM 15
+#define RX_FIFO_MAX_NUM 2
+#define TX_FIFO_INTERNAL_MAX_NUM 6
+
+/**
+ * struct iwl_shared_mem_cfg_v2 - Shared memory configuration information
+ *
+ * @shared_mem_addr: shared memory addr (pre 8000 HW set to 0x0 as MARBH is not
+ *  accessible)
+ * @shared_mem_size: shared memory size
+ * @sample_buff_addr: internal sample (mon/adc) buff addr (pre 8000 HW set to
+ *  0x0 as accessible only via DBGM RDAT)
+ * @sample_buff_size: internal sample buff size
+ * @txfifo_addr: start addr of TXF0 (excluding the context table 0.5KB), (pre
+ *  8000 HW set to 0x0 as not accessible)
+ * @txfifo_size: size of TXF0 ... TXF7
+ * @rxfifo_size: RXF1, RXF2 sizes. If there is no RXF2, it'll have a value of 0
+ * @page_buff_addr: used by UMAC and performance debug (page miss analysis),
+ *  when paging is not supported this should be 0
+ * @page_buff_size: size of %page_buff_addr
+ * @rxfifo_addr: Start address of rxFifo
+ * @internal_txfifo_addr: start address of internalFifo
+ * @internal_txfifo_size: internal fifos' size
+ *
+ * NOTE: on firmware that don't have IWL_UCODE_TLV_CAPA_EXTEND_SHARED_MEM_CFG
+ *   set, the last 3 members don't exist.
+ */
+struct iwl_shared_mem_cfg_v2 {
+  __le32 shared_mem_addr;
+  __le32 shared_mem_size;
+  __le32 sample_buff_addr;
+  __le32 sample_buff_size;
+  __le32 txfifo_addr;
+  __le32 txfifo_size[TX_FIFO_MAX_NUM_9000];
+  __le32 rxfifo_size[RX_FIFO_MAX_NUM];
+  __le32 page_buff_addr;
+  __le32 page_buff_size;
+  __le32 rxfifo_addr;
+  __le32 internal_txfifo_addr;
+  __le32 internal_txfifo_size[TX_FIFO_INTERNAL_MAX_NUM];
+} __packed; /* SHARED_MEM_ALLOC_API_S_VER_2 */
+
+/**
+ * struct iwl_shared_mem_lmac_cfg - LMAC shared memory configuration
+ *
+ * @txfifo_addr: start addr of TXF0 (excluding the context table 0.5KB)
+ * @txfifo_size: size of TX FIFOs
+ * @rxfifo1_addr: RXF1 addr
+ * @rxfifo1_size: RXF1 size
+ */
+struct iwl_shared_mem_lmac_cfg {
+  __le32 txfifo_addr;
+  __le32 txfifo_size[TX_FIFO_MAX_NUM];
+  __le32 rxfifo1_addr;
+  __le32 rxfifo1_size;
+
+} __packed; /* SHARED_MEM_ALLOC_LMAC_API_S_VER_1 */
+
+/**
+ * struct iwl_shared_mem_cfg - Shared memory configuration information
+ *
+ * @shared_mem_addr: shared memory address
+ * @shared_mem_size: shared memory size
+ * @sample_buff_addr: internal sample (mon/adc) buff addr
+ * @sample_buff_size: internal sample buff size
+ * @rxfifo2_addr: start addr of RXF2
+ * @rxfifo2_size: size of RXF2
+ * @page_buff_addr: used by UMAC and performance debug (page miss analysis),
+ *  when paging is not supported this should be 0
+ * @page_buff_size: size of %page_buff_addr
+ * @lmac_num: number of LMACs (1 or 2)
+ * @lmac_smem: per - LMAC smem data
+ */
+struct iwl_shared_mem_cfg {
+  __le32 shared_mem_addr;
+  __le32 shared_mem_size;
+  __le32 sample_buff_addr;
+  __le32 sample_buff_size;
+  __le32 rxfifo2_addr;
+  __le32 rxfifo2_size;
+  __le32 page_buff_addr;
+  __le32 page_buff_size;
+  __le32 lmac_num;
+  struct iwl_shared_mem_lmac_cfg lmac_smem[2];
+} __packed; /* SHARED_MEM_ALLOC_API_S_VER_3 */
+
+/**
+ * struct iwl_mfuart_load_notif - mfuart image version & status
+ * ( MFUART_LOAD_NOTIFICATION = 0xb1 )
+ * @installed_ver: installed image version
+ * @external_ver: external image version
+ * @status: MFUART loading status
+ * @duration: MFUART loading time
+ * @image_size: MFUART image size in bytes
+ */
+struct iwl_mfuart_load_notif {
+  __le32 installed_ver;
+  __le32 external_ver;
+  __le32 status;
+  __le32 duration;
+  /* image size valid only in v2 of the command */
+  __le32 image_size;
+} __packed; /* MFU_LOADER_NTFY_API_S_VER_2 */
+
+/**
+ * struct iwl_mfu_assert_dump_notif - mfuart dump logs
+ * ( MFU_ASSERT_DUMP_NTF = 0xfe )
+ * @assert_id: mfuart assert id that cause the notif
+ * @curr_reset_num: number of asserts since uptime
+ * @index_num: current chunk id
+ * @parts_num: total number of chunks
+ * @data_size: number of data bytes sent
+ * @data: data buffer
+ */
+struct iwl_mfu_assert_dump_notif {
+  __le32 assert_id;
+  __le32 curr_reset_num;
+  __le16 index_num;
+  __le16 parts_num;
+  __le32 data_size;
+  __le32 data[0];
+} __packed; /* MFU_DUMP_ASSERT_API_S_VER_1 */
+
+/**
+ * enum iwl_mvm_marker_id - marker ids
+ *
+ * The ids for different type of markers to insert into the usniffer logs
+ *
+ * @MARKER_ID_TX_FRAME_LATENCY: TX latency marker
+ * @MARKER_ID_SYNC_CLOCK: sync FW time and systime
+ */
+enum iwl_mvm_marker_id {
+  MARKER_ID_TX_FRAME_LATENCY = 1,
+  MARKER_ID_SYNC_CLOCK = 2,
+}; /* MARKER_ID_API_E_VER_2 */
+
+/**
+ * struct iwl_mvm_marker - mark info into the usniffer logs
+ *
+ * (MARKER_CMD = 0xcb)
+ *
+ * Mark the UTC time stamp into the usniffer logs together with additional
+ * metadata, so the usniffer output can be parsed.
+ * In the command response the ucode will return the GP2 time.
+ *
+ * @dw_len: The amount of dwords following this byte including this byte.
+ * @marker_id: A unique marker id (iwl_mvm_marker_id).
+ * @reserved: reserved.
+ * @timestamp: in milliseconds since 1970-01-01 00:00:00 UTC
+ * @metadata: additional meta data that will be written to the unsiffer log
+ */
+struct iwl_mvm_marker {
+  uint8_t dw_len;
+  uint8_t marker_id;
+  __le16 reserved;
+  __le64 timestamp;
+  __le32 metadata[0];
+} __packed; /* MARKER_API_S_VER_1 */
+
+/**
+ * struct iwl_mvm_marker_rsp - Response to marker cmd
+ *
+ * @gp2: The gp2 clock value in the FW
+ */
+struct iwl_mvm_marker_rsp {
+  __le32 gp2;
+} __packed;
+
+/* Operation types for the debug mem access */
+enum {
+  DEBUG_MEM_OP_READ = 0,
+  DEBUG_MEM_OP_WRITE = 1,
+  DEBUG_MEM_OP_WRITE_BYTES = 2,
+};
+
+#define DEBUG_MEM_MAX_SIZE_DWORDS 32
+
+/**
+ * struct iwl_dbg_mem_access_cmd - Request the device to read/write memory
+ * @op: DEBUG_MEM_OP_*
+ * @addr: address to read/write from/to
+ * @len: in dwords, to read/write
+ * @data: for write opeations, contains the source buffer
+ */
+struct iwl_dbg_mem_access_cmd {
+  __le32 op;
+  __le32 addr;
+  __le32 len;
+  __le32 data[];
+} __packed; /* DEBUG_(U|L)MAC_RD_WR_CMD_API_S_VER_1 */
+
+/* Status responses for the debug mem access */
+enum {
+  DEBUG_MEM_STATUS_SUCCESS = 0x0,
+  DEBUG_MEM_STATUS_FAILED = 0x1,
+  DEBUG_MEM_STATUS_LOCKED = 0x2,
+  DEBUG_MEM_STATUS_HIDDEN = 0x3,
+  DEBUG_MEM_STATUS_LENGTH = 0x4,
+};
+
+/**
+ * struct iwl_dbg_mem_access_rsp - Response to debug mem commands
+ * @status: DEBUG_MEM_STATUS_*
+ * @len: read dwords (0 for write operations)
+ * @data: contains the read DWs
+ */
+struct iwl_dbg_mem_access_rsp {
+  __le32 status;
+  __le32 len;
+  __le32 data[];
+} __packed; /* DEBUG_(U|L)MAC_RD_WR_RSP_API_S_VER_1 */
+
+#define CONT_REC_COMMAND_SIZE 80
+#define ENABLE_CONT_RECORDING 0x15
+#define DISABLE_CONT_RECORDING 0x16
+#define BUFFER_ALLOCATION 0x27
+#define START_DEBUG_RECORDING 0x29
+#define STOP_DEBUG_RECORDING 0x2A
+
+/*
+ * struct iwl_continuous_record_mode - recording mode
+ */
+struct iwl_continuous_record_mode {
+  __le16 enable_recording;
+} __packed;
+
+/*
+ * struct iwl_continuous_record_cmd - enable/disable continuous recording
+ */
+struct iwl_continuous_record_cmd {
+  struct iwl_continuous_record_mode record_mode;
+  uint8_t pad[CONT_REC_COMMAND_SIZE - sizeof(struct iwl_continuous_record_mode)];
+} __packed;
+
+/* maximum fragments to be allocated per target of allocationId */
+#define IWL_BUFFER_LOCATION_MAX_FRAGS 2
+
+/**
+ * struct iwl_fragment_data single fragment structure
+ * @address: 64bit start address
+ * @size: size in bytes
+ */
+struct iwl_fragment_data {
+  __le64 address;
+  __le32 size;
+} __packed; /* FRAGMENT_STRUCTURE_API_S_VER_1 */
+
+/**
+ * struct iwl_buffer_allocation_cmd - buffer allocation command structure
+ * @allocation_id: id of the allocation
+ * @buffer_location: location of the buffer
+ * @num_frags: number of fragments
+ * @fragments: memory fragments
+ */
+struct iwl_buffer_allocation_cmd {
+  __le32 allocation_id;
+  __le32 buffer_location;
+  __le32 num_frags;
+  struct iwl_fragment_data fragments[IWL_BUFFER_LOCATION_MAX_FRAGS];
+} __packed; /* BUFFER_ALLOCATION_CMD_API_S_VER_1 */
+
+#endif  // SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_DEBUG_H_
diff --git a/third_party/iwlwifi/fw/api/dhc.h b/third_party/iwlwifi/fw/api/dhc.h
new file mode 100644
index 0000000..bd0dc07
--- /dev/null
+++ b/third_party/iwlwifi/fw/api/dhc.h
@@ -0,0 +1,643 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018 Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+
+#ifndef SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_DHC_H_
+#define SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_DHC_H_
+
+#include "src/iwlwifi/fw/api/mac.h"
+#include "src/iwlwifi/fw/api/scan.h"
+
+#define DHC_TABLE_MASK_POS (28)
+
+/**
+ * enum iwl_dhc_table_id - DHC table operations index
+ * @DHC_TABLE_TOOLS: select the tools table
+ * @DHC_TABLE_AUTOMATION: select the automation table
+ * @DHC_TABLE_INTEGRATION: select the integration table
+ * @DHC_TABLE_DEVELOPMENT: select the development table
+ * @DHC_TABLE_UT: select the UT table
+ * @DHC_TABLE_MAX: maximal id value
+ */
+enum iwl_dhc_table_id {
+  DHC_TABLE_TOOLS = 0,
+  DHC_TABLE_AUTOMATION = 1 << DHC_TABLE_MASK_POS,
+  DHC_TABLE_INTEGRATION = 2 << DHC_TABLE_MASK_POS,
+  DHC_TABLE_DEVELOPMENT = 3 << DHC_TABLE_MASK_POS,
+  DHC_TABLE_UT = 4 << DHC_TABLE_MASK_POS,
+  DHC_TABLE_MAX = DHC_TABLE_UT,
+};
+
+/**
+ * enum iwl_dhc_lmac_tools_table - tools operations
+ * @DHC_TOOLS_LMAC_TXF_FIFO_DISABLE: disable tx fifo interrupts
+ *  1 DW param - bitmask of tx fifos to disable interrupts for
+ */
+enum iwl_dhc_lmac_tools_table {
+  DHC_TOOLS_LMAC_TXF_FIFO_DISABLE = 6,
+};
+
+/**
+ * enum iwl_dhc_lmac_automation_table - automation operations
+ * @DHC_AUTO_LMAC_PHY_GET_STAT: get rx/tx statistics
+ * @DHC_AUTO_LMAC_CONFIG_DEBUG_EBS: configure debug data on/off for EBS
+ * @DHC_AUTO_LMAC_PHY_ENABLE_CRC_CHECK: enable CRC check
+ * @DHC_AUTO_LMAC_SAD_RETURN_PREF_ANTS: get preferred antenna for each
+ *  context where SAD is enabled
+ * @DHC_AUTO_LMAC_PYFI_TIMING: override PyFi timing
+ * @DHC_AUTO_LMAC_REPORT_POWER_STATISTICS: get power statistics report
+ * @DHC_MAX_AUTO_LMAC_REQUEST: the size of the Automation table in lmac
+ */
+enum iwl_dhc_lmac_automation_table {
+  DHC_AUTO_LMAC_PHY_GET_STAT = 0,
+  DHC_AUTO_LMAC_CONFIG_DEBUG_EBS = 1,
+  DHC_AUTO_LMAC_PHY_ENABLE_CRC_CHECK = 2,
+  DHC_AUTO_LMAC_SAD_RETURN_PREF_ANTS = 3,
+  DHC_AUTO_LMAC_PYFI_TIMING = 4,
+  DHC_AUTO_LMAC_REPORT_POWER_STATISTICS = 5,
+  DHC_MAX_AUTO_LMAC_REQUEST = 6,
+};
+
+/**
+ * enum iwl_dhc_umac_automation_table - automation operations
+ * @DHC_AUTO_UMAC_SET_PROFILING_REPORT_CONF: configure the profiling
+ *  metrics collection
+ * @DHC_AUTO_UMAC_REPORT_PROFILING: get profiling report
+ * @DHC_AUTO_UMAC_SCAN_CHANNEL_DWELL_ENABLE_REPORT: enable scan channel dwell
+ *  reports (received as payload in DHN)
+ * @DHC_AUTO_UMAC_ADAPTIVE_DWELL_SCAN_FINE_TUNE_ENABLE_REPORT: enable adaptive
+ *  dwell scan fine tune report (received as payload in DHN)
+ * @DHC_AUTO_UMAC_CONFIGURE_POWER_FLAGS: configure power flags DW
+ * @DHC_AUTO_UMAC_REPORT_POWER_STATISTICS: get power statistics report
+ * @DHC_MAX_AUTO_UMAC_REQUEST: the size of the Automation table in umac
+ */
+enum iwl_dhc_umac_automation_table {
+  DHC_AUTO_UMAC_SET_PROFILING_REPORT_CONF = 0,
+  DHC_AUTO_UMAC_REPORT_PROFILING = 1,
+  DHC_AUTO_UMAC_SCAN_CHANNEL_DWELL_ENABLE_REPORT = 2,
+  DHC_AUTO_UMAC_ADAPTIVE_DWELL_SCAN_FINE_TUNE_ENABLE_REPORT = 3,
+  DHC_AUTO_UMAC_CONFIGURE_POWER_FLAGS = 4,
+  DHC_AUTO_UMAC_REPORT_POWER_STATISTICS = 5,
+  DHC_MAX_AUTO_UMAC_REQUEST = 6,
+};
+
+/**
+ * enum iwl_dhc_umac_integration_table - integration operations
+ * @DHC_INTEGRATION_POWER_FLAGS: Power flags
+ * @DHC_INTEGRATION_TLC_DEBUG_CONFIG: TLC debug
+ * @DHC_INTEGRATION_QUOTA_ENFORCE: Enforce maximum quota
+ * @DHC_INT_UMAC_BT_COEX_USER_OVERRIDES: Override BT Coex user
+ * @DHC_INT_UMAC_TWT_OPERATION: trigger a TWT operation
+ * @DHC_INTEGRATION_MAX: Maximum UMAC integration table entries
+ */
+enum iwl_dhc_umac_integration_table {
+  DHC_INTEGRATION_POWER_FLAGS,
+  DHC_INTEGRATION_TLC_DEBUG_CONFIG,
+  DHC_INTEGRATION_QUOTA_ENFORCE,
+  DHC_INT_UMAC_BT_COEX_USER_OVERRIDES,
+  DHC_INT_UMAC_TWT_OPERATION,
+  DHC_INTEGRATION_MAX
+};
+
+#define DHC_TARGET_UMAC BIT(27)
+#define DHC_ADWELL_SCAN_CHANNEL_DWELL_INDEX 2
+#define DHC_ADWELL_SCAN_FINE_TUNE_INDEX 3
+
+/**
+ * struct iwl_dhc_cmd - debug host command
+ * @length: length in DWs of the data structure that is concatenated to the end
+ *  of this struct
+ * @index_and_mask: bit 31 is 1 for data set operation else it's 0
+ *  bits 28-30 is the index of the table of the operation -
+ *  &enum iwl_dhc_table_id *
+ *  bit 27 is 0 if the cmd targeted to LMAC and 1 if targeted to UMAC,
+ *  (LMAC is 0 for backward compatibility)
+ *  bit 26 is 0 if the cmd targeted to LMAC0 and 1 if targeted to LMAC1,
+ *  relevant only if bit 27 set to 0
+ *  bits 0-25 is a specific entry index in the table specified in bits 28-30
+ *
+ * @data: the concatenated data.
+ */
+struct iwl_dhc_cmd {
+  __le32 length;
+  __le32 index_and_mask;
+  __le32 data[0];
+} __packed; /* DHC_CMD_API_S */
+
+/**
+ * struct iwl_dhc_cmd_resp - debug host command response
+ * @status: status of the command
+ * @data: the response data
+ */
+struct iwl_dhc_cmd_resp {
+  __le32 status;
+  __le32 data[0];
+} __packed;
+
+/**
+ * struct iwl_dhc_profile_cmd - profiling command.
+ * should be concatenated to &struct iwl_dhc_cmd
+ * @period: the time period, in seconds, of the report.
+ *  if it's set to 0 then report will be sent only when requested
+ * @reset: set to 1 for resetting the metrics data
+ *  set to 0 for not restting.
+ * @enabled_metrics: bitmask of the metrics to enable
+ *  bit 0 - cpu_usage_metric
+ *  bit 1 - paging_metric
+ *  bit 2 - flow_timing_metric
+ *  bit 3 - critical_section_metric
+ *  bit 4 - memory_pool_metric
+ *  bit 5 - fifos_metric
+ */
+struct iwl_dhc_profile_cmd {
+  __le32 period;
+  __le32 reset;
+  __le32 enabled_metrics;
+} __packed;
+
+enum iwl_profiling_context_id {
+  PROFILING_CONTEXT_PS_THREAD,
+  PROFILING_CONTEXT_FMAC_THREAD,
+  PROFILING_CONTEXT_MAIN_THREAD,
+  PROFILING_CONTEXT_AIRTIME_THREAD,
+  PROFILING_CONTEXT_MPAPD_THREAD,
+  PROFILING_CONTEXT_TIMER_IRQ,
+  PROFILING_CONTEXT_RXF2_IRQ,
+  PROFILING_CONTEXT_CMD_IRQ,
+  PROFILING_CONTEXT_MAX_NUM
+}; /* PROFILING_CONTEXT_ID_API_E */
+
+enum iwl_profiling_tasks_id {
+  PROFILING_MAIN_INIT_TASK,
+  PROFILING_FMAC_INIT_TASK,
+  PROFILING_ELOOP_TASK,
+  PROFILING_UMAC_TO_FMAC_EVENT_TASK,
+  PROFILING_LMAC_RXF_TASK,
+  PROFILING_MPAPD_TASK,
+  PROFILING_TASKS_MAX_NUM
+}; /* PROFILING_TASKS_ID_API_E */
+
+enum iwl_profiling_flow_id {
+  PROFILING_HANDLING_PRB_RQST_UMAC_FLOW,
+  PROFILING_UMAC_BCN_HANDLING_FLOW,
+  PROFILING_UMAC_NON_TKIP_HANDLING_FLOW,
+  PROFILING_UMAC_TKIP_HANDLING_FLOW,
+  PROFILING_UMAC_LMAC_NOTIFICATION_THREAD_HANDLING,
+  PROFILING_UMAC_RXF2_DROPPABLE_FRAME_ISR_HANDLING,
+  PROFILING_UMAC_OTHER_FRAMES_HANDLING_FLOW,
+  PROFILING_AIRTIME_CONTEXT_GET_FLOW,
+  PROFILING_AIRTIME_CONTEXT_LOSE_FLOW,
+  PROFILING_MAC_CONTEXT_LOSE_FLOW,
+  PROFILING_AUX_CONTEXT_GET_FLOW,
+  PROFILING_AUX_CONTEXT_CLEAR_FLOW,
+  PROFILING_AUX_CONTEXT_SET_FLOW,
+  PROFILING_AIRTIME_SCHEDULER_SESSION_CALC_FLOW,
+  PROFILING_TLC_STATISTICS_HANDLING_FLOW,
+  PROFILING_CHANNEL_SWITCH_FLOW,
+  PROFILING_THREAD_CONTEXT_SWITCH_FLOW,
+  PROFILING_SYSTEM_POWER_DOWN_FLOW,
+  PROFILING_FLOW_MAX_NUM
+}; /* PROFILING_FLOW_ID_API_E */
+
+enum iwl_profiling_fifo_id {
+  PROFILING_FIFO_UMAC_TO_LMAC1,
+  PROFILING_FIFO_UMAC_TO_LMAC2,
+  PROFILING_FIFO_LMAC1_TO_UMAC,
+  PROFILING_FIFO_LMAC2_TO_UMAC,
+  PROFILING_FIFO_RXF2,
+  PROFILING_FIFO_MAX_NUM
+}; /* PROFILING_FIFO_ID_API_E */
+
+enum iwl_profiling_pool_id {
+  PROFILING_POOL_MGMT_FRAME,
+  PROFILING_POOL_MPDU_FRWK_1,
+  PROFILING_POOL_MPDU_FRWK_2,
+  PROFILING_POOL_MSG_QUEUE_AIRTIME,
+  PROFILING_POOL_MSG_QUEUE_MAIN,
+  PROFILING_POOL_MSG_QUEUE_BACKGROUND,
+  PROFILING_POOL_MSG_QUEUE_MPAPD,
+  PROFILING_POOL_MSG_QUEUE_FMAC,
+  PROFILING_POOL_BLOCK_MSG_QUEUE_AIRTIME_BIG,
+  PROFILING_POOL_BLOCK_MSG_QUEUE_AIRTIME_SMALL,
+  PROFILING_POOL_BLOCK_MSG_QUEUE_MAIN_BIG,
+  PROFILING_POOL_BLOCK_MSG_QUEUE_MAIN_SMALL,
+  PROFILING_POOL_BLOCK_MSG_QUEUE_FMAC_BIG,
+  PROFILING_POOL_BLOCK_MSG_QUEUE_FMAC_SMALL,
+  PROFILING_POOL_INTERNAL_TX,
+  PROFILING_POOL_CYCLIC_LMAC_RX,
+  PROFILING_POOL_CYCLIC_UMAC_2_FMAC,
+  PROFILING_POOL_BYTE_UMAC_TX,
+  PROFILING_POOL_BYTE_UMAC_OS,
+  PROFILING_POOL_MAX_NUM
+}; /* PROFILING_POOL_ID_API_E */
+
+/**
+ * struct iwl_profiling_configuration - profiling collection configuration
+ * @time_since_last_metrics_reset: Time elapsed since last FW metrics reset in
+ *  usec
+ * @current_system_time: Time at which this report was generated
+ * @enabled_metrics: Enabled metrics bitmap
+ */
+struct iwl_profiling_configuration {
+  __le32 time_since_last_metrics_reset;
+  __le32 current_system_time;
+  __le32 enabled_metrics;
+} __packed; /* PROFILING_CONFIGURATION_API_S */
+
+/**
+ * struct iwl_profiling_umac_cpu_usage - profiling data on CPU usage
+ * @context_id: ID of the execution context for which the following information
+ *  is provided
+ * @run_time: Total run time (since last metrics reset) for this context in
+ *  usec
+ * @enabled_metrics: enabled metrics bitmap
+ * @max_processing_time: Maximal amount of time (since last metrics reset) that
+ *  the context ran to completion
+ * @num_of_page_faults_dl: Number of Page Fault downloads only for this context
+ *  since last metrics reset. Not relevant for IRQ contexts
+ * @num_of_page_faults_dl_up: Number of Page Fault uploads and downloads for
+ *  this context since last metrics reset. Not relevant for IRQ contexts
+ * @max_processing_time_task: ID of task which caused the longest processing
+ *  time for this context
+ * @max_block_time: Maximal amount of time (since last metrics reset)
+ *  thread was blocked due to higher priority context
+ * @max_pf_handle_time_dl: Maximal Time between PF exception to return from
+ *  completion handling ISR  Download only
+ * @max_pf_handle_time_dl_up: Upload + Download - Including cache write back
+ *  and invalidation
+ * @min_pf_handle_time_dl: Minimal Time between PF exception to return from
+ *  completion handling ISR Download only
+ * @min_pf_handle_time_dl_up: Upload + Download - Including cache write back
+ *  and invalidation
+ * @sum_pf_handle_time_dl: Accumulated Time between PF exception to return from
+ *  completion handling ISR
+ * @sum_pf_handle_time_dl_up: Upload + Download - Including cache write back
+ *  and invalidation
+ * @p_fHandle_time_bucket1:  Time for Handling Page Faults Histogram
+ *  (any PF - DL or UL+DL) Number of page faults that were handled within
+ *  31 microseconds. Buckets are emptied every metrics reset
+ * @p_fHandle_time_bucket2:  Time for Handling Page Faults Histogram
+ *  (any PF - DL or UL+DL) Number of page faults that were handled within
+ *  32-63us. Buckets are emptied every metrics reset
+ * @p_fHandle_time_bucket3:  Time for Handling Page Faults Histogram
+ *  (any PF - DL or UL+DL) Number of page faults that were handled within
+ *  64-127us. Buckets are emptied every metrics reset
+ * @p_fHandle_time_bucket4:  Time for Handling Page Faults Histogram
+ *  (any PF - DL or UL+DL) Number of page faults that were handled within
+ *  128-255us. Buckets are emptied every metrics reset
+ * @p_fHandle_time_bucket5:  Time for Handling Page Faults Histogram
+ *  (any PF - DL or UL+DL) Number of page faults that were handled within
+ *  256+us. Buckets are emptied every metrics reset
+ * @stack_size:  Total stack size for this context
+ * @stack_max_usage:  Max used stack since last reset (stack is repainted on
+ *  each metrics reset)
+ * @stack_max_usage_task: Task ID that used the max stack space
+ */
+struct iwl_profiling_umac_cpu_usage {
+  __le32 context_id;
+  __le32 run_time;
+  __le32 enabled_metrics;
+  __le32 max_processing_time;
+  __le32 num_of_page_faults_dl;
+  __le32 num_of_page_faults_dl_up;
+  __le32 max_processing_time_task;
+  __le32 max_block_time;
+  __le16 max_pf_handle_time_dl;
+  __le16 max_pf_handle_time_dl_up;
+  __le16 min_pf_handle_time_dl;
+  __le16 min_pf_handle_time_dl_up;
+  __le32 sum_pf_handle_time_dl;
+  __le32 sum_pf_handle_time_dl_up;
+  __le16 p_fHandle_time_bucket1;
+  __le16 p_fHandle_time_bucket2;
+  __le16 p_fHandle_time_bucket3;
+  __le16 p_fHandle_time_bucket4;
+  __le16 p_fHandle_time_bucket5;
+  __le16 stack_size;
+  __le16 stack_max_usage;
+  __le32 stack_max_usage_task;
+
+} __packed; /* PROFILING_UMAC_CPU_USAGE_API_S */
+
+/**
+ * struct iwl_profiling_umac_general_paging
+ * @num_of_page_faults:  Total number of PF since last metrics reset
+ * @inter_page_fault_time_bucket1:  Time Between Page Faults Histogram Number of
+ *  page faults that occurred 0-5 microseconds from the end of the previous
+ *  page fault. Buckets are emptied every metrics reset
+ * @inter_page_fault_time_bucket2:  Time Between Page Faults Histogram Number of
+ *  page faults that occurred 6-10us from the end of the previous page
+ *  fault. Buckets are emptied every metrics reset
+ * @inter_page_fault_time_bucket3:  Time Between Page Faults Histogram Number of
+ *  page faults that occurred 11-1000us from the end of the previous page
+ *  fault. Buckets are emptied every metrics reset
+ * @inter_page_fault_time_bucket4: Time Between Page Faults Histogram Number of
+ *  page faults that occurred 1ms-100ms from the end of the previous page
+ *  fault. Buckets are emptied every metrics reset
+ * @inter_page_fault_time_bucket5: Time Between Page Faults Histogram Number of
+ *  page faults that occurred 100ms+ from the end of the previous page
+ *  fault. Buckets are emptied every metrics reset
+ * @max_page_fault_wait_time: The maximal number of microseconds that a PF was
+ *  waiting in line to be handled (due to other PFs that were handled
+ *  previously)
+ * @max_num_of_pending_pfs: The maximal number of pending page faults that was
+ *  encountered (measured each time a PF is queued to be handled).
+ */
+struct iwl_profiling_umac_general_paging {
+  __le32 num_of_page_faults;
+  __le32 inter_page_fault_time_bucket1;
+  __le32 inter_page_fault_time_bucket2;
+  __le32 inter_page_fault_time_bucket3;
+  __le32 inter_page_fault_time_bucket4;
+  __le32 inter_page_fault_time_bucket5;
+  __le16 max_page_fault_wait_time;
+  __le16 max_num_of_pending_pfs;
+} __packed; /* PROFILING_UMAC_GENERAL_PAGING_API_S */
+
+/**
+ * struct iwl_profiling_umac_flow_timing
+ * @flow_id: Identifier of the flow for which the following information is
+ *  provided should be in &enum iwl_profiling_flow_id
+ * @num_of_runs: Number of times this flow occurred
+ * @total_run_time: Total time this flow ran
+ * @max_run_time: Maximal time this flow was timed running
+ * @min_run_time: Minimal time this flow was timed running
+ */
+struct iwl_profiling_umac_flow_timing {
+  __le32 flow_id;
+  __le32 num_of_runs;
+  __le32 total_run_time;
+  __le32 max_run_time;
+  __le32 min_run_time;
+} __packed; /* PROFILING_UMAC_FLOW_TIMING_API_S */
+
+/**
+ * struct iwl_profiling_umac_critical_section
+ * @max_critical_section_time: Maximal length of time of all critical sections
+ */
+struct iwl_profiling_umac_critical_section {
+  __le32 max_critical_section_time;
+} __packed; /* PROFILING_UMAC_CRITICAL_SECTION_API_S */
+
+/**
+ * struct iwl_profiling_umac_memory_pools {
+ * @pool_id: Identifier of the memory pool for which the following information
+ *  is provided should be in &enum iwl_profiling_pool_id
+ * @min_free_space: Minimum number of blocks or bytes (depending on the pool
+ *  type) that were available since last metrics reset
+ * @largest_allocated_size: For byte pools, gives an indication of level of
+ *  fragmentation
+ */
+struct iwl_profiling_umac_memory_pools {
+  __le32 pool_id;
+  __le32 min_free_space;
+  __le32 largest_allocated_size;
+} __packed; /* PROFILING_UMAC_MEMORY_POOLS_API_S */
+
+/**
+ * struct iwl_profiling_umac_fifos
+ * @fifo_id: Identifier of the FIFO for which the following information is
+ *  provided should be in &enum iwl_profiling_fifo_id
+ * @min_free_bytes: Min number of bytes that were available since last metrics
+ *  reset
+ */
+struct iwl_profiling_umac_fifos {
+  __le32 fifo_id;
+  __le32 min_free_bytes;
+} __packed; /* PROFILING_UMAC_FIFOS_API_S */
+
+/**
+ * struct iwl_profiling_umac_metrics_report
+ * @configuration: configuration of the following
+ *  metric report
+ * @umac_cpu_usage_ctx: UMAC CPU Usage per context
+ * @umac_general_paging: UMAC General Paging  (not context specific)
+ * @umac_flows_timing: Flows Timing (provided for each enumerated flow)
+ * @umac_critical_section: UMAC critical sections
+ * @umac_memory_pools: UMAC Memory Pools (provided for each enumerated
+ *  memory pool)
+ * @umac_fifos_arr: UMAC FIFOs (provided for each enumerated FIFO)
+ */
+struct iwl_profiling_umac_metrics_report {
+  struct iwl_profiling_configuration configuration;
+  struct iwl_profiling_umac_cpu_usage umac_cpu_usage_ctx[PROFILING_CONTEXT_MAX_NUM];
+  struct iwl_profiling_umac_general_paging umac_general_paging;
+  struct iwl_profiling_umac_flow_timing umac_flows_timing[PROFILING_FLOW_MAX_NUM];
+  struct iwl_profiling_umac_critical_section umac_critical_section;
+  struct iwl_profiling_umac_memory_pools umac_memory_pools[PROFILING_POOL_MAX_NUM];
+  struct iwl_profiling_umac_fifos umac_fifos_arr[PROFILING_FIFO_MAX_NUM];
+} __packed; /* PROFILING_UMAC_METRICS_REPORT_API_S */
+
+/**
+ * struct iwl_ps_report {
+ * @sleep_allowed_count: number of times NIC actually went to PD - accumulator
+ * @sleep_time: total sleep time in usec - accumulator
+ * @max_sleep_time: max sleep time in usec
+ * @missed_beacon_count: number of missed beacons - accumulator
+ * @missed_3_consecutive_beacon_count: number of missed-3-consecutive-beacons
+ *  events - accumulator
+ * @ps_flags: flag bits, divided to 4 bytes - misbehaving AP indication, is
+ *  beacon abort mechanism enabled, is LPRX enabled, is uAPSD enabled
+ * @max_active_duration: Max time device was active and power save didn't
+ *      apply.
+ */
+struct iwl_ps_report {
+  __le32 sleep_allowed_count;
+  __le32 sleep_time;
+  __le32 max_sleep_time;
+  __le32 missed_beacon_count;
+  __le32 missed_3_consecutive_beacon_count;
+  __le32 ps_flags;
+  __le32 max_active_duration;
+} __packed; /* PS_REPORT_API_S */
+
+/**
+ * struct iwl_dhn_hdr - the header of the Debug Host Notification (DHN)
+ * @length: length in DWs of the data structure that is concatenated to the end
+ *  of this struct
+ * @index_and_mask: bit 31 is 1 for data set operation else it's 0
+ *  bits 28-30 is the index of the table of the operation -
+ *  &enum iwl_dhc_table_id
+ *  bit 27 is 0 if the cmd targeted to LMAC and 1 if targeted to UMAC,
+ *  (LMAC is 0 for backward compatibility)
+ *  bit 26 is 0 if the cmd targeted to LMAC0 and 1 if targeted to LMAC1,
+ *  relevant only if bit 27 set to 0
+ *  bits 0-25 is a specific entry index in the table specified in bits 28-30
+ */
+struct iwl_dhn_hdr {
+  __le32 length;
+  __le32 index_and_mask;
+} __packed; /* DHC_NOTIFICATION_API_S */
+
+/**
+ * struct iwl_profiling_notification - the notification of the profiling report
+ * @header: DHN header
+ * @profiling_metrics: the profiling metrics
+ */
+struct iwl_profiling_notification {
+  struct iwl_dhn_hdr header;
+  struct iwl_profiling_umac_metrics_report profiling_metrics;
+} __packed; /* DHC_NOTIFICATION_API_S */
+
+/**
+ * struct iwl_channel_dwell_report - channel dwell time report
+ *
+ * This DHN (Debug Host Notification) is raised for each channel during
+ * the scan, at the beginning of the dwell time,
+ * and includes the following data:
+ *
+ * @header: DHN header
+ * @channel_num: the current channel
+ * @dwell_tsf: start dwell tsf
+ * @dwell_time: requested dwell time
+ */
+struct iwl_channel_dwell_report {
+  struct iwl_dhn_hdr header;
+  __le32 channel_num;
+  __le32 dwell_tsf;
+  __le32 dwell_time;
+} __packed; /* SCAN_CHANNEL_DWELL_REPORT_API_S */
+
+/**
+ * struct iwl_adwell_fine_tune_metrics_report
+ *
+ * This DHN (Debug Host Notification) raised at the end of the scan
+ * and contains the following table:
+ *
+ * @header: DHN header
+ * @index: indices array of the channels numbers
+ * @scan_counter: fine tune scans number
+ * @success_counter: fine tune success counter
+ */
+struct iwl_adwell_fine_tune_metrics_report {
+  struct iwl_dhn_hdr header;
+  int8_t index[IWL_SCAN_MAX_NUM_OF_CHANNELS];
+  uint8_t scan_counter[IWL_SCAN_MAX_NUM_OF_CHANNELS];
+  uint8_t success_counter[IWL_SCAN_MAX_NUM_OF_CHANNELS];
+} __packed; /* ADAPTIVE_DWELL_SCAN_FINE_TUNE_METRICS_REPORT_API_S */
+
+/**
+ * enum iwl_dhc_quota_enforce_type
+ *
+ * @QUOTA_ENFORCE_TYPE_RESERVATION: Enforce minimum quota.
+ * @QUOTA_ENFORCE_TYPE_LIMITATION: Enforce maximum quota.
+ */
+enum iwl_dhc_quota_enforce_type {
+  QUOTA_ENFORCE_TYPE_RESERVATION,
+  QUOTA_ENFORCE_TYPE_LIMITATION,
+}; /* DHC_QUOTA_ENFORCE_TYPE_API_E */
+
+/**
+ * struct iwl_quota_enforce - Enforce quota percent
+ *
+ * @macs: bitmask of MAC IDs relevant here
+ * @quota_enforce_type: &enum iwl_dhc_quota_enforce_type
+ * @reserved: reserved for alignment
+ * @quota_percentage: quota to enforce as percentage [0 - 100]
+ */
+struct iwl_dhc_quota_enforce {
+  uint8_t macs;
+  uint8_t quota_enforce_type;
+  __le16 reserved;
+  __le32 quota_percentage[MAC_INDEX_AUX];
+} __packed; /* DHC_QUOTA_ENFORCE_API_S */
+
+/**
+ * enum iwl_dhc_twt_operation_type - describes the TWT operation type
+ *
+ * @DHC_TWT_REQUEST: Send a Request TWT command
+ * @DHC_TWT_SUGGEST: Send a Suggest TWT command
+ * @DHC_TWT_DEMAND: Send a Demand TWT command
+ * @DHC_TWT_GROUPING: Send a Grouping TWT command
+ * @DHC_TWT_ACCEPT: Send a Accept TWT command
+ * @DHC_TWT_ALTERNATE: Send a Alternate TWT command
+ * @DHC_TWT_DICTATE: Send a Dictate TWT command
+ * @DHC_TWT_REJECT: Send a Reject TWT command
+ * @DHC_TWT_TEARDOWN: Send a TearDown TWT command
+ */
+enum iwl_dhc_twt_operation_type {
+  DHC_TWT_REQUEST,
+  DHC_TWT_SUGGEST,
+  DHC_TWT_DEMAND,
+  DHC_TWT_GROUPING,
+  DHC_TWT_ACCEPT,
+  DHC_TWT_ALTERNATE,
+  DHC_TWT_DICTATE,
+  DHC_TWT_REJECT,
+  DHC_TWT_TEARDOWN,
+}; /* DHC_TWT_OPERATION_TYPE_E */
+
+/**
+ * struct iwl_dhc_twt_operation - trigger a TWT operation
+ *
+ * @mac_id: the mac Id on which to trigger TWT operation
+ * @twt_operation: see &enum iwl_dhc_twt_operation_type
+ * @target_wake_time: when should we be on channel
+ * @interval_exp: the exponent for the interval
+ * @interval_mantissa: the mantissa for the interval
+ * @min_wake_duration: the minimum duration for the wake period
+ * @trigger: is the TWT triggered or not
+ * @flow_type: is the TWT announced or not
+ * @flow_id: the TWT flow identifier from 0 to 7
+ * @protection: is the TWT protected
+ * @ndo_paging_indicator: is ndo_paging_indicator set
+ * @responder_pm_mode: is responder_pm_mode set
+ * @negotiation_type: if the responder wants to doze outside the TWT SP
+ * @twt_request: 1 for TWT request, 0 otherwise
+ * @implicit: is TWT implicit
+ * @twt_group_assignment: the TWT group assignment
+ * @twt_channel: the TWT channel
+ * @reserved: reserved
+ */
+struct iwl_dhc_twt_operation {
+  __le32 mac_id;
+  __le32 twt_operation;
+  __le64 target_wake_time;
+  __le32 interval_exp;
+  __le32 interval_mantissa;
+  __le32 min_wake_duration;
+  uint8_t trigger;
+  uint8_t flow_type;
+  uint8_t flow_id;
+  uint8_t protection;
+  uint8_t ndo_paging_indicator;
+  uint8_t responder_pm_mode;
+  uint8_t negotiation_type;
+  uint8_t twt_request;
+  uint8_t implicit;
+  uint8_t twt_group_assignment;
+  uint8_t twt_channel;
+  uint8_t reserved;
+}; /* DHC_TWT_OPERATION_API_S */
+
+#endif  // SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_DHC_H_
diff --git a/third_party/iwlwifi/fw/api/filter.h b/third_party/iwlwifi/fw/api/filter.h
new file mode 100644
index 0000000..330ba97
--- /dev/null
+++ b/third_party/iwlwifi/fw/api/filter.h
@@ -0,0 +1,157 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+
+#ifndef SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_FILTER_H_
+#define SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_FILTER_H_
+
+#include "src/iwlwifi/fw/api/mac.h"
+#include "src/iwlwifi/platform/compiler.h"
+
+#define MAX_PORT_ID_NUM 2
+#define MAX_MCAST_FILTERING_ADDRESSES 256
+
+/**
+ * struct iwl_mcast_filter_cmd - configure multicast filter.
+ * @filter_own: Set 1 to filter out multicast packets sent by station itself
+ * @port_id:    Multicast MAC addresses array specifier. This is a strange way
+ *      to identify network interface adopted in host-device IF.
+ *      It is used by FW as index in array of addresses. This array has
+ *      MAX_PORT_ID_NUM members.
+ * @count:  Number of MAC addresses in the array
+ * @pass_all:   Set 1 to pass all multicast packets.
+ * @bssid:  current association BSSID.
+ * @reserved:   reserved
+ * @addr_list:  Place holder for array of MAC addresses.
+ *      IMPORTANT: add padding if necessary to ensure DWORD alignment.
+ */
+struct iwl_mcast_filter_cmd {
+  uint8_t filter_own;
+  uint8_t port_id;
+  uint8_t count;
+  uint8_t pass_all;
+  uint8_t bssid[6];
+  uint8_t reserved[2];
+  uint8_t addr_list[0];
+} __packed; /* MCAST_FILTERING_CMD_API_S_VER_1 */
+
+#define MAX_BCAST_FILTERS 8
+#define MAX_BCAST_FILTER_ATTRS 2
+
+/**
+ * enum iwl_mvm_bcast_filter_attr_offset - written by fw for each Rx packet
+ * @BCAST_FILTER_OFFSET_PAYLOAD_START: offset is from payload start.
+ * @BCAST_FILTER_OFFSET_IP_END: offset is from ip header end (i.e.
+ *  start of ip payload).
+ */
+enum iwl_mvm_bcast_filter_attr_offset {
+  BCAST_FILTER_OFFSET_PAYLOAD_START = 0,
+  BCAST_FILTER_OFFSET_IP_END = 1,
+};
+
+/**
+ * struct iwl_fw_bcast_filter_attr - broadcast filter attribute
+ * @offset_type:    &enum iwl_mvm_bcast_filter_attr_offset.
+ * @offset: starting offset of this pattern.
+ * @reserved1:  reserved
+ * @val:    value to match - big endian (MSB is the first
+ *      byte to match from offset pos).
+ * @mask:   mask to match (big endian).
+ */
+struct iwl_fw_bcast_filter_attr {
+  uint8_t offset_type;
+  uint8_t offset;
+  __le16 reserved1;
+  __be32 val;
+  __be32 mask;
+} __packed; /* BCAST_FILTER_ATT_S_VER_1 */
+
+/**
+ * enum iwl_mvm_bcast_filter_frame_type - filter frame type
+ * @BCAST_FILTER_FRAME_TYPE_ALL: consider all frames.
+ * @BCAST_FILTER_FRAME_TYPE_IPV4: consider only ipv4 frames
+ */
+enum iwl_mvm_bcast_filter_frame_type {
+  BCAST_FILTER_FRAME_TYPE_ALL = 0,
+  BCAST_FILTER_FRAME_TYPE_IPV4 = 1,
+};
+
+/**
+ * struct iwl_fw_bcast_filter - broadcast filter
+ * @discard: discard frame (1) or let it pass (0).
+ * @frame_type: &enum iwl_mvm_bcast_filter_frame_type.
+ * @reserved1: reserved
+ * @num_attrs: number of valid attributes in this filter.
+ * @attrs: attributes of this filter. a filter is considered matched
+ *  only when all its attributes are matched (i.e. AND relationship)
+ */
+struct iwl_fw_bcast_filter {
+  uint8_t discard;
+  uint8_t frame_type;
+  uint8_t num_attrs;
+  uint8_t reserved1;
+  struct iwl_fw_bcast_filter_attr attrs[MAX_BCAST_FILTER_ATTRS];
+} __packed; /* BCAST_FILTER_S_VER_1 */
+
+/**
+ * struct iwl_fw_bcast_mac - per-mac broadcast filtering configuration.
+ * @default_discard: default action for this mac (discard (1) / pass (0)).
+ * @reserved1: reserved
+ * @attached_filters: bitmap of relevant filters for this mac.
+ */
+struct iwl_fw_bcast_mac {
+  uint8_t default_discard;
+  uint8_t reserved1;
+  __le16 attached_filters;
+} __packed; /* BCAST_MAC_CONTEXT_S_VER_1 */
+
+/**
+ * struct iwl_bcast_filter_cmd - broadcast filtering configuration
+ * @disable: enable (0) / disable (1)
+ * @max_bcast_filters: max number of filters (MAX_BCAST_FILTERS)
+ * @max_macs: max number of macs (NUM_MAC_INDEX_DRIVER)
+ * @reserved1: reserved
+ * @filters: broadcast filters
+ * @macs: broadcast filtering configuration per-mac
+ */
+struct iwl_bcast_filter_cmd {
+  uint8_t disable;
+  uint8_t max_bcast_filters;
+  uint8_t max_macs;
+  uint8_t reserved1;
+  struct iwl_fw_bcast_filter filters[MAX_BCAST_FILTERS];
+  struct iwl_fw_bcast_mac macs[NUM_MAC_INDEX_DRIVER];
+} __packed; /* BCAST_FILTERING_HCMD_API_S_VER_1 */
+
+#endif  // SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_FILTER_H_
diff --git a/third_party/iwlwifi/fw/api/fmac-version.h b/third_party/iwlwifi/fw/api/fmac-version.h
new file mode 100644
index 0000000..7264be1
--- /dev/null
+++ b/third_party/iwlwifi/fw/api/fmac-version.h
@@ -0,0 +1,43 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2018 Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+
+#ifndef SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_FMAC_VERSION_H_
+#define SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_FMAC_VERSION_H_
+
+/* This API Version number should be incremented anytime
+ * backward compatibility is broken on BSS only commands.
+ */
+#define FMAC_MIN_API_VERSION 7
+#define FMAC_MAX_API_VERSION 8
+
+#endif  // SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_FMAC_VERSION_H_
diff --git a/third_party/iwlwifi/fw/api/fmac.h b/third_party/iwlwifi/fw/api/fmac.h
new file mode 100644
index 0000000..7d84de6
--- /dev/null
+++ b/third_party/iwlwifi/fw/api/fmac.h
@@ -0,0 +1,2441 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018 Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+
+#ifndef SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_FMAC_H_
+#define SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_FMAC_H_
+
+#include <fuchsia/wlan/ieee80211/c/fidl.h>
+
+#define FMAC_GROUP 0x10
+
+/**
+ * enum iwl_fmac_cmds - Supported FMAC commands and notifications
+ */
+enum iwl_fmac_cmds {
+  /* Commands */
+  /**
+   * @FMAC_SCAN:
+   * Perform a scan using configuration defined in
+   * &struct iwl_fmac_scan_cmd.
+   * The scan flow is asynchronous and upon completion a
+   * %FMAC_SCAN_COMPLETE notification is sent by fmac using
+   * &struct iwl_fmac_scan_complete_notif.
+   */
+  FMAC_SCAN = 0x0,
+
+  /**
+   * @FMAC_SCAN_ABORT:
+   * Stop an ongoing scan. The command is defined in
+   * &struct iwl_fmac_scan_abort_cmd.
+   */
+  FMAC_SCAN_ABORT = 0x1,
+
+  /**
+   * @FMAC_ADD_VIF:
+   * Add a virtual interface. The interface configuration is
+   * defined in &struct iwl_fmac_add_vif_cmd.
+   */
+  FMAC_ADD_VIF = 0x2,
+
+  /**
+   * @FMAC_DEL_VIF:
+   * Delete a virtual interface. The command is defined in
+   * &struct iwl_fmac_del_vif_cmd.
+   */
+  FMAC_DEL_VIF = 0x3,
+
+  /**
+   * @FMAC_CONNECT:
+   * As a station interface, connect to a network, using the configuration
+   * defined in &struct iwl_fmac_connect_cmd. The connect flow is
+   * asynchronous and upon completion a %FMAC_CONNECT_RESULT notification
+   * is sent by FMAC using &struct iwl_fmac_connect_result.
+   */
+  FMAC_CONNECT = 0x4,
+
+  /**
+   * @FMAC_DISCONNECT:
+   * As station interface, disconnect. The command is defined in
+   * &struct iwl_fmac_disconnect_cmd.
+   */
+  FMAC_DISCONNECT = 0x5,
+
+  /**
+   * @FMAC_SAR: TODO
+   */
+  FMAC_SAR = 0x6,
+
+  /**
+   * @FMAC_NVM:
+   * Apply the global NVM configuration using configuration defined in
+   * &struct iwl_fmac_nvm_cmd.
+   */
+  FMAC_NVM = 0x7,
+
+#ifdef CPTCFG_IWLFMAC_9000_SUPPORT
+  /**
+   * @FMAC_REQ_QUEUE:
+   * Request a new transmit queue, using the configuration in
+   * &struct iwl_fmac_req_queue. Only used with 9000-series devices.
+   */
+  FMAC_REQ_QUEUE = 0x8,
+
+  /**
+   * @FMAC_REL_QUEUE:
+   * Release a queue allocated for <RA, TID>, using the configuration in
+   * &struct iwl_fmac_rel_queue. Only used with 9000-series devices.
+   */
+  FMAC_REL_QUEUE = 0x9,
+#endif
+
+#ifdef CPTCFG_IWLFMAC_9000_SUPPORT
+  /**
+   * @FMAC_SCD_QUEUE_CFG:
+   * Configure a transmit queue, as defined in
+   * &struct iwl_fmac_scd_txq_cfg_cmd.
+   * Only used with 9000-series devices.
+   */
+  FMAC_SCD_QUEUE_CFG = 0xb,
+#endif
+
+  /**
+   * @FMAC_CONFIG:
+   * Configure global or interface specific settings as defined
+   * in &struct iwl_fmac_config_cmd.
+   */
+  FMAC_CONFIG = 0xc,
+
+  /* 0xd is reserved */
+  /* 0xe is reserved */
+
+  /**
+   * @FMAC_REG_CFG: TODO
+   */
+  FMAC_REG_CFG = 0xf,
+
+  /* 0x10 is reverved */
+  /* 0x11 is reverved */
+  /* 0x12 is reverved */
+  /* 0x13 is reverved */
+
+  /**
+   * @FMAC_SET_PMK:
+   * Set the key after a successful IEEE802.1X authentication.
+   * The available key types are defined in &iwl_fmac_key_type.
+   * &struct iwl_fmac_mlme_set_pmk_cmd as the command struct.
+   */
+  FMAC_SET_PMK = 0x14,
+
+  /**
+   * @FMAC_ACK_STA_REMOVED:
+   * Acknowledge that station removal was processed and the driver has
+   * stopped using the station ID; uses the notification
+   * &struct iwl_fmac_sta_removed as the command struct.
+   */
+  FMAC_ACK_STA_REMOVED = 0x15,
+
+  /**
+   * @FMAC_TEST_FIPS:
+   * Test security algorithms implemented in FMAC
+   */
+  FMAC_TEST_FIPS = 0x16,
+
+  /* 0x17 is reserved */
+  /* 0x19 is reserved */
+  /* 0x1a is reserved */
+  /* 0x1b is reserved */
+  /* 0x1c is reserved */
+  /* 0x1d is reserved */
+  /* 0x1e is reserved */
+
+  /**
+   * @FMAC_MIC_FAILURE:
+   * Inform FMAC about TKIP MMIC failures, FMAC will run countermeasures.
+   * &struct iwl_fmac_mic_failure as the command struct.
+   */
+  FMAC_MIC_FAILURE = 0x1f,
+
+  /**
+   * @FMAC_SET_MONITOR_CHAN:
+   * Set channel of monitor interface.
+   * &struct iwl_fmac_set_monitor_chan_cmd as the command struct.
+   */
+  FMAC_SET_MONITOR_CHAN = 0x20,
+
+  /* 0x21 is reserved */
+
+  /**
+   * @FMAC_HOST_BASED_AP:
+   * Manage (start / modify / stop) a host based AP.
+   * &struct iwl_fmac_host_ap_cmd as the command struct or
+   * &struct iwl_fmac_host_ap_resp for the response
+   */
+  FMAC_HOST_BASED_AP = 0x22,
+
+  /**
+   * @FMAC_HOST_BASED_AP_STA:
+   * Add / modify / remove stations for the host based AP.
+   * &struct iwl_fmac_host_ap_sta_cmd as the command struct.
+   */
+  FMAC_HOST_BASED_AP_STA = 0x23,
+
+  /**
+   * @FMAC_TEMPORAL_KEY:
+   * Add / remove keys for the host based AP.
+   * &struct iwl_fmac_temporal_key_cmd as the command struct.
+   * &struct iwl_fmac_temporal_key_resp is the response.
+   */
+  FMAC_TEMPORAL_KEY = 0x24,
+
+  /**
+   * @FMAC_TKIP_SET_MCAST_RSC:
+   * Update TKIP MCAST Receive Sequence Counter. The driver should send
+   * this command every time the 4 high bytes of the RSC change.
+   * &struct iwl_fmac_tkip_mcast_rsc is the command struct.
+   */
+  FMAC_TKIP_SET_MCAST_RSC = 0x25,
+
+  /**
+   * @FMAC_PORT_AUTHORIZED:
+   * Inform FMAC that VIF is authorized.
+   * &struct iwl_fmac_port_authorized_cmd as the command struct.
+   */
+  FMAC_PORT_AUTHORIZED = 0x26,
+
+  /**
+   * @FMAC_ROAM:
+   * Roam to the current network, using the configuration defined in
+   * &struct iwl_fmac_connect_cmd.
+   * The roam flow is asynchronous and upon completion
+   * a %FMAC_ROAM_RESULT notification is sent by FMAC using &struct
+   * iwl_fmac_roam_result.
+   */
+  FMAC_ROAM = 0x27,
+
+  /**
+   * @FMAC_RECOVER:
+   * Ask FMAC to recover after a firmware reset using the configuration
+   * blob in &struct iwl_fmac_recover_cmd.
+   */
+  FMAC_RECOVER = 0x28,
+
+  /* Notifications */
+
+  /**
+   * @FMAC_RECOVERY_COMPLETE:
+   * Notifies that the recovery is complete. Uses the
+   * &struct iwl_fmac_recovery_complete as the notification structure.
+   */
+  FMAC_RECOVERY_COMPLETE = 0xe8,
+
+  /**
+   * @FMAC_INACTIVE_STATION:
+   * Notifies about a station that we haven't heard from and that
+   * does't reply to our probe (Null Data Packet). This station
+   * should be disconnected.
+   * &struct iwl_fmac_inactive_sta is the notification struct.
+   */
+  FMAC_INACTIVE_STATION = 0xe9,
+
+  /**
+   * @FMAC_ROAM_IS_NEEDED:
+   * Roam is needed notification, with roam information
+   * given in &struct iwl_fmac_roam_is_needed.
+   */
+  FMAC_ROAM_IS_NEEDED = 0xea,
+
+  /**
+   * @FMAC_ROAM_RESULT:
+   * Roam result notification, with information given in &struct
+   * iwl_fmac_roam_result.
+   */
+  FMAC_ROAM_RESULT = 0xeb,
+
+#ifdef CPTCFG_IWLFMAC_9000_SUPPORT
+  /**
+   * @FMAC_SEND_FRAME:
+   * Notification about a frame that should be sent by the host
+   * on FMAC's behalf as defined in &struct iwl_fmac_send_frame_notif
+   * Only used with 9000-series devices.
+   */
+  FMAC_SEND_FRAME = 0xf0,
+#endif
+
+  /* 0xf1 is reserved */
+  /* 0xf2 is reserved */
+
+  /**
+   * @FMAC_EAPOL:
+   * Notification about a received EAPOL frame. This notification is
+   * used to notify the host about EAPOL frames required for IEEE802.1X
+   * authentication. Other EAPOL frames are not passed to the host.
+   */
+  FMAC_EAPOL = 0xf3,
+
+  /* 0xf4 is reserved */
+  /* 0xf5 is reserved */
+
+  /**
+   * @FMAC_REG_UPDATE: TODO
+   */
+  FMAC_REG_UPDATE = 0xf6,
+
+  /**
+   * @FMAC_TRIGGER_NOTIF: TODO
+   */
+  FMAC_TRIGGER_NOTIF = 0xf7,
+
+  /* 0xf8 is reserved */
+
+  /* 0xf9 is reserved */
+  /* 0xfa is reserved */
+
+  /**
+   * @FMAC_KEYS_UPDATE:
+   * Notification about new keys, where the new key configuration is
+   * given in &struct iwl_fmac_keys_update_notif.
+   */
+  FMAC_KEYS_UPDATE = 0xfb,
+
+  /**
+   * @FMAC_DISCONNECTED:
+   * For station interface, disconnection from a network notification,
+   * with additional information given in &struct iwl_fmac_disconnect_cmd.
+   */
+  FMAC_DISCONNECTED = 0xfc,
+
+  /**
+   * @FMAC_DEBUG:
+   * Debug information notification with additional information given
+   * in &struct iwl_fmac_debug_notif.
+   */
+  FMAC_DEBUG = 0xfd,
+
+  /**
+   * @FMAC_CONNECT_RESULT:
+   * Connect request result notification, with the
+   * connection information given in &struct iwl_fmac_connect_result.
+   */
+  FMAC_CONNECT_RESULT = 0xfe,
+
+  /**
+   * @FMAC_SCAN_COMPLETE:
+   * Scan completed notification, with additional information
+   * in &struct iwl_fmac_scan_complete_notif.
+   */
+  FMAC_SCAN_COMPLETE = 0xff,
+};
+
+#define IWL_FMAC_MAX_SSIDS 20
+#define IWL_FMAC_MAX_CHANS 50
+
+#ifdef CPTCFG_IWLFMAC_9000_SUPPORT
+/*
+ * Value used, in 9000-series API, when no queue is
+ * assigned/present.
+ */
+#define IWL_FMAC_NO_QUEUE 0xff
+#endif
+
+/**
+ * struct iwl_fmac_scan_cmd - MLME scan command
+ * @vif_id: vif_id returned by &FMAC_ADD_VIF command
+ * @random_mac: use randomized mac address
+ * @n_ssids: number of ssids in &ssids.
+ * @n_freqs: number of freqs in &freqs
+ * @flags: currently unused.
+ * @rates_24: currently unused.
+ * @rates_52: currently unused.
+ * @ssids: SSIDs to scan for (active scan only)
+ * @ssids_lengths: lengths of the SSIDs in &ssids
+ * @freqs: freqs in MHz. If none are specified all the supported frequencies are
+ *  scanned.
+ * @bssid: BSSID to scan for (most commonly, the wildcard BSSID).
+ * @ie_len: length of IEs in octets.
+ * @ie: optional IEs added to probe request.
+ *
+ * Request a scan operation on &freqs, probing for the networks
+ * specified by &ssids. The scan execution is done in an asynchronous manner,
+ * and the completion of the flow is indicated via %FMAC_SCAN_COMPLETE
+ * notification.
+ */
+struct iwl_fmac_scan_cmd {
+  uint8_t vif_id;
+  uint8_t random_mac;
+  uint8_t n_ssids;
+  uint8_t n_freqs;
+  __le32 flags;
+  __le16 rates_24;
+  __le16 rates_52;
+  uint8_t ssids[IWL_FMAC_MAX_SSIDS][fuchsia_wlan_ieee80211_MAX_SSID_BYTE_LEN];
+  uint8_t ssids_lengths[IWL_FMAC_MAX_SSIDS];
+  __le16 freqs[IWL_FMAC_MAX_CHANS];
+  uint8_t bssid[ETH_ALEN];
+  __le16 ie_len;
+#ifndef _MSC_VER
+  uint8_t ie[0];
+#endif
+  /* pad to a multiple of 4 bytes */
+} __packed;
+
+/**
+ * struct iwl_fmac_scan_abort_cmd - MLME scan abort command
+ * @vif_id: the interface identifier returned in &iwl_fmac_add_vif_resp
+ * @reserved: for alignment.
+ *
+ * Request to abort an ongoing scan operation initiated by %FMAC_SCAN command.
+ */
+struct iwl_fmac_scan_abort_cmd {
+  uint8_t vif_id;
+  uint8_t reserved[3];
+} __packed;
+
+/**
+ * enum iwl_fmac_vif_type - Interface types supported by fmac
+ * @IWL_FMAC_IFTYPE_MGD: Managed interface.
+ * @IWL_FMAC_IFTYPE_P2P_CLIENT: P2P Client interface. Not supported yet.
+ * @IWL_FMAC_IFTYPE_P2P_GO: P2P Group Owner interface. Not supported yet.
+ * @IWL_FMAC_IFTYPE_P2P_DEVICE: P2P Device interface. Not supported yet.
+ * @IWL_FMAC_IFTYPE_MONITOR: Sniffer Device interface.
+ * @IWL_FMAC_IFTYPE_HOST_BASED_AP: Access Point interface, but handled by the
+ *      host. All management frames will be forwarded to the host. There can be
+ *      at most one such vif in the system.
+ * @IWL_FMAC_IFTYPE_ANY: catch-all interface type for config command.
+ */
+enum iwl_fmac_vif_type {
+  IWL_FMAC_IFTYPE_MGD = 1,
+  /* 2 is reserved */
+  IWL_FMAC_IFTYPE_P2P_CLIENT = 3,
+  IWL_FMAC_IFTYPE_P2P_GO,
+  IWL_FMAC_IFTYPE_P2P_DEVICE,
+  /* 6 is reserved */
+  IWL_FMAC_IFTYPE_MONITOR = 7,
+  IWL_FMAC_IFTYPE_HOST_BASED_AP,
+  /* 7 is reserved */
+  IWL_FMAC_IFTYPE_ANY = 0xff,
+};
+
+#define IWL_FMAC_STATION_COUNT 16
+
+enum iwl_fmac_tx_fifo {
+  IWL_FMAC_TX_FIFO_BK = 0,
+  IWL_FMAC_TX_FIFO_BE,
+  IWL_FMAC_TX_FIFO_VI,
+  IWL_FMAC_TX_FIFO_VO,
+  IWL_FMAC_TX_FIFO_MCAST = 5,
+  IWL_FMAC_TX_FIFO_CMD = 7,
+};
+
+static const uint8_t iwl_fmac_tid_to_tx_fifo[] = {
+    IWL_FMAC_TX_FIFO_BE, IWL_FMAC_TX_FIFO_BK, IWL_FMAC_TX_FIFO_BK,
+    IWL_FMAC_TX_FIFO_BE, IWL_FMAC_TX_FIFO_VI, IWL_FMAC_TX_FIFO_VI,
+    IWL_FMAC_TX_FIFO_VO, IWL_FMAC_TX_FIFO_VO, IWL_FMAC_TX_FIFO_VO /* MGMT is mapped to VO */
+};
+
+/**
+ * struct iwl_fmac_add_vif_cmd - Add a new virtual interface.
+ * @addr: the mac address that should be assigned to the interface.
+ * @type: the requested interface type as specified in %iwl_fmac_vif_type.
+ * @reserved: for alignment.
+ *
+ * Add a new virtual interface. The flow is a synchronous one, and upon
+ * completion, the operation result is conveyed using &iwl_fmac_add_vif_resp.
+ */
+struct iwl_fmac_add_vif_cmd {
+  uint8_t addr[ETH_ALEN];
+  uint8_t type;
+  uint8_t reserved;
+} __packed;
+
+/**
+ * enum iwl_fw_add_vif_resp_status - Status of %FMAC_ADD_VIF command.
+ * @IWL_ADD_VIF_SUCCESS: Success to add a new interface.
+ * @IWL_ADD_VIF_FAILURE: Failure to add a new interface.
+ */
+enum iwl_fw_add_vif_resp_status {
+  IWL_ADD_VIF_SUCCESS = 0,
+  IWL_ADD_VIF_FAILURE,
+};
+
+/**
+ * struct iwl_fmac_del_vif_cmd - Delete a virtual interface.
+ * @id: the interface id, as returned in &iwl_fmac_add_vif_resp in case of a
+ * @reserved: for alignment.
+ * successful %FMAC_ADD_VIF command.
+ */
+struct iwl_fmac_del_vif_cmd {
+  uint8_t id;
+  uint8_t reserved[3];
+} __packed;
+
+/**
+ * struct iwl_fmac_add_vif_resp - response for a %FMAC_ADD_VIF command.
+ * @status: see &iwl_fw_add_vif_resp_status.
+ * @id: on successful operation, would hold the new interface identifier.
+ * @reserved: for alignment.
+ */
+struct iwl_fmac_add_vif_resp {
+  uint8_t status;
+  uint8_t id;
+  __le16 reserved;
+} __packed;
+
+/**
+ * enum iwl_fmac_connection_flags - connection flags
+ * @IWL_FMAC_FREQ_IN_USE: use only the specified frequency.
+ * @IWL_FMAC_FREQ_HINT: use as an hint to optimize connection time.
+ * @IWL_FMAC_CONNECT_FLAGS_BSSID_WHITELIST: If this is set, the BSSIDs list is
+ *  a whitelist, i.e. a list of the acceptable BSSIDs for connection.
+ *  Otherwise, the BSSIDs list is a blacklist specifying disallowed BSSIDs.
+ */
+enum iwl_fmac_connection_flags {
+  IWL_FMAC_FREQ_IN_USE = BIT(0),
+  IWL_FMAC_FREQ_HINT = BIT(1),
+  IWL_FMAC_CONNECT_FLAGS_BSSID_WHITELIST = BIT(2),
+};
+
+/*
+ * Supported cipher suites (both pairwise and group):
+ * @IWL_FMAC_CIPHER_NONE:
+ * @IWL_FMAC_CIPHER_WEP40:
+ * @IWL_FMAC_CIPHER_WEP104:
+ * @IWL_FMAC_CIPHER_TKIP:
+ * @IWL_FMAC_CIPHER_CCMP:
+ * @IWL_FMAC_CIPHER_GCMP:
+ * @IWL_FMAC_CIPHER_GCMP_256:
+ * @IWL_FMAC_CIPHER_CCMP_256:
+ */
+#define IWL_FMAC_CIPHER_NONE BIT(0)
+#define IWL_FMAC_CIPHER_WEP40 BIT(1)
+#define IWL_FMAC_CIPHER_WEP104 BIT(2)
+#define IWL_FMAC_CIPHER_TKIP BIT(3)
+#define IWL_FMAC_CIPHER_CCMP BIT(4)
+#define IWL_FMAC_CIPHER_AES_128_CMAC BIT(5)
+#define IWL_FMAC_CIPHER_GCMP BIT(6)
+#define IWL_FMAC_CIPHER_GCMP_256 BIT(8)
+#define IWL_FMAC_CIPHER_CCMP_256 BIT(9)
+#define IWL_FMAC_SUPPORTED_CIPHERS                                                                \
+  (IWL_FMAC_CIPHER_NONE | IWL_FMAC_CIPHER_WEP40 | IWL_FMAC_CIPHER_WEP104 | IWL_FMAC_CIPHER_TKIP | \
+   IWL_FMAC_CIPHER_CCMP | IWL_FMAC_CIPHER_AES_128_CMAC | IWL_FMAC_CIPHER_GCMP |                   \
+   IWL_FMAC_CIPHER_GCMP_256 | IWL_FMAC_CIPHER_CCMP_256)
+
+/**
+ * Supported key management suites:
+ * @IWL_FMAC_KEY_MGMT_IEEE8021X:
+ * @IWL_FMAC_KEY_MGMT_PSK:
+ * @IWL_FMAC_KEY_MGMT_IEEE8021X_SHA256:
+ * @IWL_FMAC_KEY_MGMT_PSK_SHA256:
+ * @IWL_FMAC_KEY_MGMT_IEEE8021X_SUITE_B:
+ * @IWL_FMAC_KEY_MGMT_IEEE8021X_SUITE_B_192:
+ */
+#define IWL_FMAC_KEY_MGMT_IEEE8021X BIT(0)
+#define IWL_FMAC_KEY_MGMT_PSK BIT(1)
+#define IWL_FMAC_KEY_MGMT_FT_IEEE8021X BIT(5)
+#define IWL_FMAC_KEY_MGMT_FT_PSK BIT(6)
+#define IWL_FMAC_KEY_MGMT_IEEE8021X_SHA256 BIT(7)
+#define IWL_FMAC_KEY_MGMT_PSK_SHA256 BIT(8)
+#define IWL_FMAC_KEY_MGMT_IEEE8021X_SUITE_B BIT(16)
+#define IWL_FMAC_KEY_MGMT_IEEE8021X_SUITE_B_192 BIT(17)
+#define IWL_FMAC_SUPPORTED_KEY_MGMT                                                              \
+  (IWL_FMAC_KEY_MGMT_PSK | IWL_FMAC_KEY_MGMT_PSK_SHA256 | IWL_FMAC_KEY_MGMT_FT_IEEE8021X |       \
+   IWL_FMAC_KEY_MGMT_FT_PSK | IWL_FMAC_KEY_MGMT_IEEE8021X | IWL_FMAC_KEY_MGMT_IEEE8021X_SHA256 | \
+   IWL_FMAC_KEY_MGMT_IEEE8021X_SUITE_B | IWL_FMAC_KEY_MGMT_IEEE8021X_SUITE_B_192)
+
+/**
+ * Supported security protocols:
+ * @IWL_FMAC_PROTO_WPA:
+ * @IWL_FMAC_PROTO_RSN:
+ */
+#define IWL_FMAC_PROTO_WPA BIT(0)
+#define IWL_FMAC_PROTO_RSN BIT(1)
+#define IWL_FMAC_SUPPORTED_PROTO (IWL_FMAC_PROTO_WPA | IWL_FMAC_PROTO_RSN)
+
+/**
+ * enum iwl_fmac_mfp_mode: Supported Management Frame Protection modes.
+ * @IWL_FMAC_MFP_NO: management frame protection not used
+ * @IWL_FMAC_MFP_OPTIONAL: management frame protection is optional
+ * @IWL_FMAC_MFP_REQUIRED: management frame protection is required
+ */
+enum iwl_fmac_mfp_mode {
+  IWL_FMAC_MFP_NO,
+  IWL_FMAC_MFP_OPTIONAL,
+  IWL_FMAC_MFP_REQUIRED,
+};
+
+#define IWL_NUM_WEP_KEYS 4
+#define IWL_MAX_WEP_KEY_LEN 13
+
+/**
+ * struct iwl_fmac_crypto - Security configuration.
+ * @cipher_group: the allowed group cipher suite as specified in
+ *  %IWL_FMAC_CIPHER_\*.
+ * @ciphers_pairwise: the allowed pairwise cipher suites as specified in
+ *  %IWL_FMAC_CIPHER_\*
+ * @key_mgmt: the supported key management suites as specified in
+ *  %IWL_FMAC_KEY_MGMT_\*. If set to NONE only wep section of the union
+ *  below will be accessed. If PSK is set the key and proto will be read
+ *  from wpa section.
+ * @mfp: the Management Frame Protection configuration. The allowed
+ *  configurations are specified in %iwl_fmac_mfp_mode. Only supported
+ *  for station mode for now. This option is not supported on 9000 devices.
+ * @reserved: reserved
+ * @psk: the pre-shared key used with key management suites
+ *  %IWL_FMAC_KEY_MGMT_PSK and %IWL_FMAC_KEY_MGMT_PSK_SHA256.
+ * @proto: the allowed protocol as specified in %IWL_FMAC_PROTO_\*.
+ * @key: WEP keys data.
+ * @key_len: WEP key length (can vary between 5 or 13)
+ * @def_key: default wep key, the other keys aren't used. The default key
+ *  is also used for shared WEP authentication.
+ * @reserved: for future use and alignment.
+ * @u: union of the various types of key material
+ */
+struct iwl_fmac_crypto {
+  __le32 cipher_group;
+  __le32 ciphers_pairwise;
+  __le32 key_mgmt;
+  uint8_t mfp;
+  uint8_t reserved[3];
+  union {
+    struct {
+      uint8_t psk[32];
+      __le32 proto;
+    } __packed wpa;
+    struct {
+      uint8_t key[IWL_NUM_WEP_KEYS][IWL_MAX_WEP_KEY_LEN];
+      uint8_t key_len[IWL_NUM_WEP_KEYS];
+      uint8_t def_key;
+      uint8_t reserved1[3];
+    } __packed wep;
+  } u;
+} __packed;
+
+#define IWL_FMAC_MAX_BSSIDS 10
+
+/**
+ * struct iwl_fmac_connect_cmd - connect to a network.
+ * @vif_id: the virtual interface identifier as returned in
+ *  &iwl_fmac_add_vif_resp.
+ * @max_retries: number of retries before notifying connection failure.
+ * @center_freq: optional frequency that can be used to limit the connection
+ *  only for BSSs on the specified frequency.
+ * @flags: see &enum iwl_fmac_connection_flags.
+ * @bssid: optional parameter to limit the connection only to a BSS
+ *  with the specified BSSID.
+ * @reserved1: for alignment.
+ * @ssid_len: the length of %ssid.
+ * @ssid: the SSID of the network to connect to.
+ * @crypto: the connection security configuration as specified in
+ *  %iwl_fmac_crypto.
+ * @reserved2: for alignment.
+ * @n_bssids: number of BSSIDs in the @bssids array.
+ * @bssids: array of @n_bssids. Depending on the @flags field, this is either
+ *  a blacklist (i.e. specifies disallowed BSSIDs, and all other BSSIDs are
+ *  allowed) or a whitelist (i.e. speficies a list of acceptable BSSIDs, and
+ *  all other BSSIDs are disallowed). If this array is empty, all BSSIDs are
+ *  allowed.
+ *
+ * A connect request to the network specified in %ssid. The command is allowed
+ * iff the interface specified in %vif_id is currently idle (i.e., not connected
+ * or trying to connect). The flow is an asynchronous one, and upon completion,
+ * the operation result is conveyed by %FMAC_CONNECT_RESULT.
+ */
+struct iwl_fmac_connect_cmd {
+  uint8_t vif_id;
+  uint8_t max_retries;
+  __le16 center_freq;
+  __le32 flags;
+  uint8_t bssid[ETH_ALEN];
+  uint8_t reserved1;
+  uint8_t ssid_len;
+  uint8_t ssid[fuchsia_wlan_ieee80211_MAX_SSID_BYTE_LEN];
+
+  struct iwl_fmac_crypto crypto;
+  uint8_t reserved2[3];
+  uint8_t n_bssids;
+  uint8_t bssids[IWL_FMAC_MAX_BSSIDS * ETH_ALEN];
+} __packed;
+
+/**
+ * struct iwl_fmac_port_authorized_cmd - set port to authorized
+ * @vif_id: the interface identifier for which port is authorized
+ * @reserved: reserved for 4 byte alignment.
+ */
+struct iwl_fmac_port_authorized_cmd {
+  uint8_t vif_id;
+  uint8_t reserved[3];
+} __packed;
+
+#define UMAC_DEFAULT_KEYS 4
+#define IWL_FMAC_MAX_PN_LEN 16
+#define IWL_FMAC_TKIP_MCAST_RX_MIC_KEY 8
+
+/**
+ * struct iwl_fmac_key - Meta data for an fmac key entry.
+ * @valid: 1 if the key is valid for use; Otherwise 0.
+ * @keyidx: a SW key identifier.
+ * @hw_keyidx: a HW key identifier.
+ * @rx_pn_len: the number of valid octets in &rx_pn.
+ * @rx_pn: the Rx packet number in the order needed for PN comparison for
+ *  &cipher.
+ * @cipher: the cipher suite associated with the key (one of
+ *  %IWL_FMAC_CIPHER_\*).
+ * @tkip_mcast_rx_mic_key: key used for TKIP MIC key for multicast Rx.
+ * @reserved: reserved for none 9000 family support
+ */
+struct iwl_fmac_key {
+  uint8_t valid;
+  uint8_t keyidx;
+  uint8_t hw_keyidx;
+  uint8_t rx_pn_len;
+  uint8_t rx_pn[IWL_FMAC_MAX_PN_LEN];
+  __le32 cipher;
+#ifdef CPTCFG_IWLFMAC_9000_SUPPORT
+  uint8_t tkip_mcast_rx_mic_key[IWL_FMAC_TKIP_MCAST_RX_MIC_KEY];
+#else
+  uint8_t reserved[IWL_FMAC_TKIP_MCAST_RX_MIC_KEY];
+#endif /* CPTCFG_IWLFMAC_9000_SUPPORT */
+} __packed;
+
+/**
+ * struct iwl_fmac_keys - Describing a set of keys.
+ * @ptk: an array of pairwise transient keys as specified in %iwl_fmac_key.
+ * @gtk: an array of group transient keys as specified in %iwl_fmac_key.
+ * @wep_tx_keyidx: default WEP TX key index
+ * @reserved: for alignment.
+ */
+struct iwl_fmac_keys {
+  struct iwl_fmac_key ptk[UMAC_DEFAULT_KEYS];
+  struct iwl_fmac_key gtk[UMAC_DEFAULT_KEYS];
+  uint8_t wep_tx_keyidx;
+  uint8_t reserved[3];
+} __packed;
+
+/**
+ * struct iwl_fmac_connect_result - connect result notification.
+ */
+struct iwl_fmac_connect_result {
+  /**
+   * @vif_id:
+   * the interface identifier returned in &iwl_fmac_add_vif_resp
+   */
+  uint8_t vif_id;
+
+  /**
+   * @sta_id:
+   * on successful connection, holds a station entry index associated
+   * with AP the station interface associated with.
+   */
+  uint8_t sta_id;
+
+  /**
+   * @center_freq:
+   * on successful connection, the center frequency of the BSS.
+   */
+  __le16 center_freq;
+
+  /**
+   * @status:
+   * status code as defined in IEEE 802.11-2016 Table 9-46
+   * ("Status codes").
+   */
+  __le16 status;
+
+  /**
+   * @bssid:
+   * on successful connection, the bssid of the BSS.
+   */
+  uint8_t bssid[ETH_ALEN];
+
+  /**
+   * @signal:
+   * on successful connection, the signal in dBm of the BSS.
+   */
+  __le32 signal;
+
+  /**
+   * @capability:
+   * on successful connection, the BSS capabilities as reported in
+   * the beacon/probe response.
+   */
+  __le16 capability;
+
+  /**
+   * @beacon_int:
+   * on successful connection, the beacon interval of the BSS.
+   */
+  __le16 beacon_int;
+
+  /**
+   * @tsf: TODO
+   */
+  __le64 tsf;
+
+  /**
+   * @presp_ielen:
+   * the length of the probe response ies.
+   */
+  __le32 presp_ielen;
+
+  /**
+   * @beacon_ielen:
+   * the length of the beacon ies.
+   */
+  __le32 beacon_ielen;
+
+  /**
+   * @assoc_req_ie_len:
+   * the length of the association request body (fixed part + IEs).
+   */
+  __le32 assoc_req_ie_len;
+
+  /**
+   * @assoc_resp_ie_len:
+   * the length of the association response body (fixed part + IEs).
+   */
+  __le32 assoc_resp_ie_len;
+
+  /**
+   * @qos:
+   * 1 iff the BSS supports WMM.
+   */
+  uint8_t qos;
+
+  /**
+   * @bk_acm:
+   * 1 iff %qos and the BK AC requires admission control.
+   */
+  uint8_t bk_acm;
+
+  /**
+   * @be_acm:
+   * 1 iff %qos and the BE AC requires admission control.
+   */
+  uint8_t be_acm;
+
+  /**
+   * @vi_acm:
+   * 1 iff %qos and the VI AC requires admission control.
+   */
+  uint8_t vi_acm;
+
+  /**
+   * @vo_acm:
+   * 1 iff %qos and the VO AC requires admission control.
+   */
+  uint8_t vo_acm;
+
+  /**
+   * @not_found:
+   * 1 iff no BSS was found suitable for connection.
+   */
+  uint8_t not_found;
+
+  /**
+   * @authorized: TODO
+   */
+  uint8_t authorized;
+
+  /**
+   * @reassoc:
+   * flag indicates if the assoc request was reassoc.
+   */
+  uint8_t reassoc;
+
+  /**
+   * @keys:
+   * On successful connection to a secure network that does not require
+   * 802.1x authentication and key derivation, holds the security keys as
+   * defined in &iwl_fmac_keys.
+   */
+  struct iwl_fmac_keys keys;
+
+  /**
+   * @ie_data:
+   * the probe response ies (&presp_ielen), followed by the beacon ies
+   * (&beacon_ielen), followed by the association request ies
+   * (&assoc_req_ie_len) followed by the association response ies
+   * (&assoc_resp_ie_len).
+   */
+#ifndef _MSC_VER
+  uint8_t ie_data[0];
+#endif
+} __packed;
+
+/**
+ * struct iwl_fmac_disconnect_cmd - disconnect from a network.
+ * @vif_id: the virtual interface identifier as returned in
+ *  &iwl_fmac_add_vif_resp
+ * @locally_generated: 1 if the disconnection was locally generated; Otherwise
+ *  0.
+ * @reason: reason code for disconnection, if available
+ *
+ * Can be used both as a command to fmac requesting it to disconnect, and can
+ * also be used as a notification sent from fmac to indicate that a previous
+ * connection is no longer valid.
+ */
+struct iwl_fmac_disconnect_cmd {
+  uint8_t vif_id;
+  uint8_t locally_generated;
+  __le16 reason;
+} __packed;
+
+/**
+ * enum iwl_fmac_dbg_type - support debug notification types.
+ * @IWL_FMAC_DBG_INT_CMD: Debug notification describing an internal command
+ *  from fmac.
+ * @IWL_FMAC_DBG_INT_RESP: Debug notification describing an internal command
+ *  response to fmac.
+ * @IWL_FMAC_DBG_INT_NOTIF: Debug notification describing an asynchronous
+ *  notification received by fmac.
+ * @IWL_FMAC_DBG_INT_TX: Debug notification describing a frame being
+ *  transmitter by fmac.
+ */
+enum iwl_fmac_dbg_type {
+  IWL_FMAC_DBG_INT_CMD,
+  IWL_FMAC_DBG_INT_RESP,
+  IWL_FMAC_DBG_INT_NOTIF,
+  IWL_FMAC_DBG_INT_TX,
+};
+
+/**
+ * struct iwl_fmac_debug_notif - Notification containing debug data.
+ * @type: See %iwl_fmac_dbg_type.
+ * @reserved: for alignment.
+ * @data: type dependent data.
+ *
+ * Sent asynchronously from fmac, to notify about fmac interaction with other
+ * components.
+ */
+struct iwl_fmac_debug_notif {
+  uint8_t type;
+  uint8_t reserved[3];
+#ifndef _MSC_VER
+  uint8_t data[0];
+#endif
+} __packed;
+
+/**
+ * struct iwl_fmac_keys_update_notif - Notification about update keys.
+ * @vif_id: the virtual interface identifier as returned in
+ *  &iwl_fmac_add_vif_resp.
+ * @sta_id: holds a station entry index associated with the station for which
+ *  the keys were updated.
+ * @reserved: for alignment.
+ * @keys: see &iwl_fmac_keys.
+ *
+ * The notification is sent from fmac to indicate that new keys were derived for
+ * the given station.
+ */
+struct iwl_fmac_keys_update_notif {
+  uint8_t vif_id;
+  uint8_t sta_id;
+  uint8_t reserved[2];
+
+  struct iwl_fmac_keys keys;
+} __packed;
+
+/**
+ * struct iwl_fmac_scan_complete_notif - Scan complete notification
+ * @aborted: 1 if the scan was aborted; Otherwise 0.
+ * @reserved: for alignment.
+ *
+ * Used to notify about the completion of a scan request originated by calling
+ * %FMAC_SCAN.
+ */
+struct iwl_fmac_scan_complete_notif {
+  uint8_t aborted;
+  uint8_t reserved[3];
+} __packed;
+
+/**
+ * enum iwl_fmac_nvm_sku_cap - Supported capabilities.
+ * @NVM_SKU_CAP_BAND_24GHZ_ENABLED: Operation on 2.4 GHz enabled.
+ * @NVM_SKU_CAP_BAND_52GHZ_ENABLED: Operation on 5.2 GHz enabled.
+ * @NVM_SKU_CAP_11N_ENABLED: 802.11n support enabled.
+ * @NVM_SKU_CAP_11AC_ENABLED: 80211.11ac support enabled.
+ * @NVM_SKU_CAP_AMT_ENABLED: AMT enabled.
+ * @NVM_SKU_CAP_IPAN_ENABLED: P2P enabled.
+ * @NVM_SKU_CAP_MIMO_DISABLED: MIMO is disabled.
+ * @NVM_SKU_CAP_11AX_ENABLED: 80211.11ax support enabled.
+ */
+enum iwl_fmac_nvm_sku_cap {
+  NVM_SKU_CAP_BAND_24GHZ_ENABLED = 0x1,
+  NVM_SKU_CAP_BAND_52GHZ_ENABLED = 0x2,
+  NVM_SKU_CAP_11N_ENABLED = 0x4,
+  NVM_SKU_CAP_11AC_ENABLED = 0x8,
+  NVM_SKU_CAP_AMT_ENABLED = 0x10,
+  NVM_SKU_CAP_IPAN_ENABLED = 0x20,
+  NVM_SKU_CAP_MIMO_DISABLED = 0x40,
+  NVM_SKU_CAP_11AX_ENABLED = 0x80,
+};
+
+/**
+ * enum iwl_fmac_nvm_ht_cap - Supported HT capabilities.
+ * @NVM_HT_CAP_LDPC_CODING: LDPC enabled.
+ * @NVM_HT_CAP_SUP_WIDTH_20_40: 40 MHz is supported.
+ * @NVM_HT_CAP_SM_PS: SMPS enabled.
+ * @NVM_HT_CAP_GRN_FLD: Green field supported.
+ * @NVM_HT_CAP_SGI_20: Short guard interval in 20MHz enabled.
+ * @NVM_HT_CAP_SGI_40: Short guard interval in 40MHz enabled.
+ * @NVM_HT_CAP_TX_STBC: Transmit STBC enabled.
+ * @NVM_HT_CAP_RX_STBC: Received STBC enabled
+ * @NVM_HT_CAP_DELAY_BA: Delayed block acknowledgment enabled.
+ * @NVM_HT_CAP_MAX_AMSDU: large A-MSDU size is supported
+ * @NVM_HT_CAP_DSSSCCK40: DSSS-CCK40 is supported
+ * @NVM_HT_CAP_RESERVED: (reserved)
+ * @NVM_HT_CAP_40MHZ_INTOLERANT: device is 40 MHz intolerant
+ * @NVM_HT_CAP_LSIG_TXOP_PROT: L-SIG TXOP protection is supported
+ *
+ * See 9.4.2.56.2 ("HT Capability Information field") in P802.11Revmc_D5.0.
+ */
+enum iwl_fmac_nvm_ht_cap {
+  NVM_HT_CAP_LDPC_CODING = 0x0001,
+  NVM_HT_CAP_SUP_WIDTH_20_40 = 0x0002,
+  NVM_HT_CAP_SM_PS = 0x000C,
+  NVM_HT_CAP_GRN_FLD = 0x0010,
+  NVM_HT_CAP_SGI_20 = 0x0020,
+  NVM_HT_CAP_SGI_40 = 0x0040,
+  NVM_HT_CAP_TX_STBC = 0x0080,
+  NVM_HT_CAP_RX_STBC = 0x0300,
+  NVM_HT_CAP_DELAY_BA = 0x0400,
+  NVM_HT_CAP_MAX_AMSDU = 0x0800,
+  NVM_HT_CAP_DSSSCCK40 = 0x1000,
+  NVM_HT_CAP_RESERVED = 0x2000,
+  NVM_HT_CAP_40MHZ_INTOLERANT = 0x4000,
+  NVM_HT_CAP_LSIG_TXOP_PROT = 0x8000,
+};
+
+/**
+ * enum iwl_fmac_nvm_vht_cap - Supported VHT capabilities.
+ * @NVM_VHT_CAP_MAX_MPDU_LENGTH_3895: max MPDU (A-MSDU) length 3895 bytes
+ * @NVM_VHT_CAP_MAX_MPDU_LENGTH_7991: max MPDU (A-MSDU) length 7991 bytes
+ * @NVM_VHT_CAP_MAX_MPDU_LENGTH_11454: max MPDU (A-MSDU) length 11454 bytes
+ * @NVM_VHT_CAP_MAX_MPDU_MASK: Mask of supported MPDU lengths.
+ * @NVM_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ: Operation in 160MHz channels supported.
+ * @NVM_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ: Operation in 80MHz + 80MHz
+ *  channels supported.
+ * @NVM_VHT_CAP_SUPP_CHAN_WIDTH_MASK: Supported channel widths.
+ * @NVM_VHT_CAP_RXLDPC: LDPC is supported on RX
+ * @NVM_VHT_CAP_SHORT_GI_80: short guard interval supported in 80 MHz
+ * @NVM_VHT_CAP_SHORT_GI_160: short guard interval supported in 160 MHz
+ * @NVM_VHT_CAP_TXSTBC: TX STBC supported
+ * @NVM_VHT_CAP_RXSTBC_1: RX STBC support: 1 chain
+ * @NVM_VHT_CAP_RXSTBC_2: RX STBC support: 2 chains
+ * @NVM_VHT_CAP_RXSTBC_3: RX STBC support: 3 chains
+ * @NVM_VHT_CAP_RXSTBC_4: RX STBC support: 4 chains
+ * @NVM_VHT_CAP_RXSTBC_MASK: RX STBC mask
+ * @NVM_VHT_CAP_SU_BEAMFORMER_CAPABLE: Single user Beamformer supported.
+ * @NVM_VHT_CAP_SU_BEAMFORMEE_CAPABLE: Single user Beamformee supported.
+ * @NVM_VHT_CAP_BEAMFORMEE_STS_MASK: beamformee STS mask
+ * @NVM_VHT_CAP_SOUNDING_DIMENSIONS_MASK: sounding dimensions mask
+ * @NVM_VHT_CAP_MU_BEAMFORMER_CAPABLE: Multi user Beamformer supported.
+ * @NVM_VHT_CAP_MU_BEAMFORMEE_CAPABLE: Multi user Beacmformee supported.
+ * @NVM_VHT_CAP_VHT_TXOP_PS: VHT TXOP PS supported
+ * @NVM_VHT_CAP_HTC_VHT: HTC supported
+ * @NVM_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK: A-MPDU length exponent mask
+ * @NVM_VHT_CAP_VHT_LINK_ADAPTATION_VHT_UNSOL_MFB:
+ *  VHT link adaptation: unsolicited MFB supported
+ * @NVM_VHT_CAP_VHT_LINK_ADAPTATION_VHT_MRQ_MFB:
+ *  VHT link adaptation: MRQ MFB is supported
+ * @NVM_VHT_CAP_RX_ANTENNA_PATTERN: RX antenna pattern
+ * @NVM_VHT_CAP_TX_ANTENNA_PATTERN: TX antenna pattern
+ *
+ * See 9.4.2.158.2 ("VHT Capabilities Information field") in P802.11Revmc_D5.0.
+ */
+enum iwl_fmac_nvm_vht_cap {
+  NVM_VHT_CAP_MAX_MPDU_LENGTH_3895 = 0x00000000,
+  NVM_VHT_CAP_MAX_MPDU_LENGTH_7991 = 0x00000001,
+  NVM_VHT_CAP_MAX_MPDU_LENGTH_11454 = 0x00000002,
+  NVM_VHT_CAP_MAX_MPDU_MASK = 0x00000003,
+  NVM_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ = 0x00000004,
+  NVM_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ = 0x00000008,
+  NVM_VHT_CAP_SUPP_CHAN_WIDTH_MASK = 0x0000000C,
+  NVM_VHT_CAP_RXLDPC = 0x00000010,
+  NVM_VHT_CAP_SHORT_GI_80 = 0x00000020,
+  NVM_VHT_CAP_SHORT_GI_160 = 0x00000040,
+  NVM_VHT_CAP_TXSTBC = 0x00000080,
+  NVM_VHT_CAP_RXSTBC_1 = 0x00000100,
+  NVM_VHT_CAP_RXSTBC_2 = 0x00000200,
+  NVM_VHT_CAP_RXSTBC_3 = 0x00000300,
+  NVM_VHT_CAP_RXSTBC_4 = 0x00000400,
+  NVM_VHT_CAP_RXSTBC_MASK = 0x00000700,
+  NVM_VHT_CAP_SU_BEAMFORMER_CAPABLE = 0x00000800,
+  NVM_VHT_CAP_SU_BEAMFORMEE_CAPABLE = 0x00001000,
+  NVM_VHT_CAP_BEAMFORMEE_STS_MASK = 0x0000e000,
+  NVM_VHT_CAP_SOUNDING_DIMENSIONS_MASK = 0x00070000,
+  NVM_VHT_CAP_MU_BEAMFORMER_CAPABLE = 0x00080000,
+  NVM_VHT_CAP_MU_BEAMFORMEE_CAPABLE = 0x00100000,
+  NVM_VHT_CAP_VHT_TXOP_PS = 0x00200000,
+  NVM_VHT_CAP_HTC_VHT = 0x00400000,
+  NVM_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK = 0x03800000,
+  NVM_VHT_CAP_VHT_LINK_ADAPTATION_VHT_UNSOL_MFB = 0x08000000,
+  NVM_VHT_CAP_VHT_LINK_ADAPTATION_VHT_MRQ_MFB = 0x0c000000,
+  NVM_VHT_CAP_RX_ANTENNA_PATTERN = 0x10000000,
+  NVM_VHT_CAP_TX_ANTENNA_PATTERN = 0x20000000,
+};
+
+#define NVM_HT_MCS_MASK_LEN 10
+
+/**
+ * struct iwl_fmac_nvm_mcs_info - Supported HT MCSes
+ * @rx_mask: RX mask (like in 802.11)
+ * @rx_highest: RX highest (like in 802.11)
+ * @tx_params: TX parameters (like in 802.11)
+ * @reserved: for alignment.
+ *
+ * See 9.4.2.56.4 ("Supported MCS Set field") in P802.11Revmc_D5.0.
+ */
+struct iwl_fmac_nvm_mcs_info {
+  uint8_t rx_mask[NVM_HT_MCS_MASK_LEN];
+  __le16 rx_highest;
+  uint8_t tx_params;
+  uint8_t reserved[3];
+} __packed;
+
+/**
+ * struct iwl_fmac_nvm_vht_mcs_info - Supported VHT MCSes
+ * @rx_mcs_map: RX MCS map (like in 802.11)
+ * @rx_highest: RX highest (like in 802.11)
+ * @tx_mcs_map: TX MCS map (like in 802.11)
+ * @tx_highest: TX highest (like in 802.11)
+ *
+ * See 9.4.2.158.3 ("Supported VHT-MCS and NSS Set field") in P802.11Revmc_D5.0.
+ */
+struct iwl_fmac_nvm_vht_mcs_info {
+  __le16 rx_mcs_map;
+  __le16 rx_highest;
+  __le16 tx_mcs_map;
+  __le16 tx_highest;
+} __packed;
+
+/**
+ * enum iwl_fmac_nvm_bands - Supported bands.
+ * @NVM_BAND_24GHZ: Operation on 2.4GHz.
+ * @NVM_BAND_52GHZ: Operation on 5.2GHz.
+ * @NVM_NUM_BANDS: number of defined/possible bands
+ */
+enum iwl_fmac_nvm_bands { NVM_BAND_24GHZ, NVM_BAND_52GHZ, NVM_NUM_BANDS };
+
+/**
+ * struct iwl_fmac_nvm_ht - supported HT capabilities.
+ * @ht_supported: 1 if HT is supported; Otherwise 0.
+ * @reserved: for alignment.
+ * @cap: See &iwl_fmac_nvm_ht_cap.
+ * @ampdu_factor: A-MPDU factor (like in 802.11)
+ * @ampdu_density: A-MPDU density (like in 802.11)
+ * @mcs: See &iwl_fmac_nvm_mcs_info.
+ */
+struct iwl_fmac_nvm_ht {
+  uint8_t ht_supported;
+  uint8_t reserved[3];
+  __le16 cap;
+  uint8_t ampdu_factor;
+  uint8_t ampdu_density;
+  struct iwl_fmac_nvm_mcs_info mcs;
+} __packed;
+
+/**
+ * struct iwl_fmac_nvm_vht - supported VHT capabilities
+ * @vht_supported: 1 if VHT is supported; Otherwise 0.
+ * @reserved: for alignment.
+ * @cap: See %iwl_fmac_nvm_vht_cap
+ * @vht_mcs: See %iwl_fmac_nvm_vht_mcs_info
+ */
+struct iwl_fmac_nvm_vht {
+  uint8_t vht_supported;
+  uint8_t reserved[3];
+  __le32 cap;
+  struct iwl_fmac_nvm_vht_mcs_info vht_mcs;
+} __packed;
+
+/**
+ * struct iwl_fmac_nvm_cmd - NVM configuration command.
+ * @sku_cap: See &enum iwl_fmac_nvm_sku_cap
+ * @n_addr: number of supported addresses.
+ * @hw_addr: hw base address.
+ * @valid_ant: Valid antenna configuration.
+ * @reserved: for alignment.
+ * @ht: HT configuration for each band. See &iwl_fmac_nvm_ht.
+ * @vht: VHT configuration for each band. See &iwl_fmac_nvm_vht.
+ *
+ * The command is sent once in the lifetime of fmac, as part of the
+ * initialization flow, to configure the runtime capabilities and supported
+ * features of fmac.
+ */
+struct iwl_fmac_nvm_cmd {
+  uint8_t sku_cap;
+  uint8_t n_addr;
+  uint8_t hw_addr[ETH_ALEN];
+#define NVM_CMD_TX_ANT(_x) ((_x)&0xf)
+#define NVM_CMD_RX_ANT(_x) (((_x)&0xf0) >> 4)
+  uint8_t valid_ant;
+  uint8_t reserved[3];
+  struct iwl_fmac_nvm_ht ht[NVM_NUM_BANDS];
+  struct iwl_fmac_nvm_vht vht[NVM_NUM_BANDS];
+} __packed;
+
+#ifdef CPTCFG_IWLFMAC_9000_SUPPORT
+/**
+ * struct iwl_fmac_req_queue - Request Transmit queue.
+ * @vif_id: the vif_id of the STA to use.
+ * @sta_id: sta_id to add a queue to.
+ * @tid: the TID of the traffic for the requested queue.
+ * @reserved: for alignment.
+ *
+ * The command is used to request a transmit queue for the given
+ * <station, TID>.
+ *
+ * Note that this is only used with 9000-series devices.
+ */
+struct iwl_fmac_req_queue {
+  uint8_t vif_id;
+  uint8_t sta_id;
+  uint8_t tid;
+  uint8_t reserved;
+} __packed;
+
+/**
+ * struct iwl_fmac_req_queue_response - Response to a transmit queue allocation
+ * request.
+ * @queue: the queue allocated for the request. 0xff means failure.
+ * @reserved: for alignment.
+ *
+ * Note that this is only used with 9000-series devices.
+ */
+struct iwl_fmac_req_queue_response {
+  uint8_t queue;
+  uint8_t reserved[3];
+} __packed;
+
+/**
+ * struct iwl_fmac_rel_queue - Request to release a transmit queue.
+ * @vif_id: the vif_id of the STA to use.
+ * @sta_id: sta_id to release the TID from.
+ * @tid: the TID of the traffic to remove
+ * @reserved: for alignment.
+ *
+ * The command is used to request to release the transmit queue allocation for
+ * the <sta, TID>
+ *
+ * Note that this is only used with 9000-series devices.
+ */
+struct iwl_fmac_rel_queue {
+  uint8_t vif_id;
+  uint8_t sta_id;
+  uint8_t tid;
+  uint8_t reserved;
+} __packed;
+
+/**
+ * struct iwl_fmac_rel_queue_response - Response to a transmit queue release
+ * request.
+ * @free_queue: 1 if the queue should be freed, 0 otherwise.
+ * @reserved: for alignment.
+ *
+ * Note that this is only used with 9000-series devices.
+ */
+struct iwl_fmac_rel_queue_response {
+  uint8_t free_queue;
+  uint8_t reserved[3];
+} __packed;
+#endif
+
+/**
+ * struct iwl_fmac_rs_fixed_cmd - set fixed rate for transmit.
+ * @sta_id: station to set the rate.
+ * @vif_id: the vif_id of the STA to use.
+ * @reduced_txp: set power reduction.
+ * @reserved: for alignment.
+ * @hw_rate: the fixed value for the rate in LMAC format.
+ *
+ * The command is used to request to disable the transmit rate scaling
+ * algorithm, and instead use the given fixed rate.
+ */
+struct iwl_fmac_rs_fixed_cmd {
+  uint8_t sta_id;
+  uint8_t vif_id;
+  uint8_t reduced_txp;
+  uint8_t reserved;
+  __le32 hw_rate;
+} __packed;
+
+#ifdef CPTCFG_IWLFMAC_9000_SUPPORT
+/**
+ * struct iwl_fmac_scd_txq_cfg_cmd - FMAC txq hw scheduler config command.
+ * @vif_id: the vif_id of the STA to use.
+ * @reserved1: for alignment.
+ * @token: token (unused)
+ * @sta_id: sta_id to use.
+ * @tid: the TID of the traffic for the requested queue.
+ * @scd_queue: scheduler queue to configure.
+ * @enable: 1 queue enable, 0 queue disable.
+ * @aggregate: 1 aggregated queue, 0 otherwise.
+ * @tx_fifo: &enum iwl_fmac_tx_fifo.
+ * @window: BA window size.
+ * @ssn: SSN for the BA agreement.
+ * @reserved2: for alignment.
+ *
+ * Note that this is only used with 9000-series devices.
+ */
+struct iwl_fmac_scd_txq_cfg_cmd {
+  uint8_t vif_id;
+  uint8_t reserved1[3];
+  uint8_t token;
+  uint8_t sta_id;
+  uint8_t tid;
+  uint8_t scd_queue;
+  uint8_t enable;
+  uint8_t aggregate;
+  uint8_t tx_fifo;
+  uint8_t window;
+  __le16 ssn;
+  __le16 reserved2;
+} __packed;
+#endif
+
+/**
+ * enum iwl_fmac_sync_source - Source of the Rx multi queue synchronization
+ * request
+ * @IWL_FMAC_SYNC_SRC_DRIVER: the request originated in the driver.
+ * @IWL_FMAC_SYNC_SRC_FMAC: the request originated in fmac.
+ */
+enum iwl_fmac_sync_source {
+  IWL_FMAC_SYNC_SRC_DRIVER,
+  IWL_FMAC_SYNC_SRC_FMAC,
+};
+
+/**
+ * enum iwl_fmac_sync_type - Type of the Rx multi queue synchronization request.
+ * @IWL_FMAC_SYNC_TYPE_DELBA: request due to Rx delba.
+ */
+enum iwl_fmac_sync_type {
+  IWL_FMAC_SYNC_TYPE_DELBA,
+};
+
+/**
+ * struct iwl_rxq_sync_payload - shared sync notification payload.
+ * @src: see &enum iwl_fmac_sync_source.
+ * @type: see &enum iwl_fmac_sync_type for FMAC-sourced messages.
+ * @reserved: for alignment.
+ * @payload: payload for the message.
+ *
+ * This is the sync message payload, sometimes generated by the
+ * FMAC firmware and possibly for use by the driver.
+ */
+struct iwl_rxq_sync_payload {
+  uint8_t src;
+  uint8_t type;
+  uint8_t reserved[2];
+#ifndef _MSC_VER
+  uint8_t payload[0];
+#endif
+} __packed;
+
+/**
+ * struct iwl_rx_sync_delba - shared sync notification for delba.
+ * @hdr: see &iwl_req_sync_payload.
+ * @sta_id: the corresponding station identifier.
+ * @ba_id: the bloack ack identifier.
+ * @reserved: for alignment.
+ */
+struct iwl_rx_sync_delba {
+  struct iwl_rxq_sync_payload hdr;
+  uint8_t sta_id;
+  uint8_t ba_id;
+  uint8_t reserved[2];
+} __packed;
+
+/**
+ * enum fmac_ps_mode - Enumerates the support power schemes for the device.
+ * @FMAC_PS_MODE_CAM: No power save.
+ * @FMAC_PS_MODE_BALANCED: Balanced power save.
+ * @FMAC_PS_MODE_LP: Low power save mode.
+ */
+enum fmac_ps_mode {
+  FMAC_PS_MODE_CAM = 1,
+  FMAC_PS_MODE_BALANCED,
+  FMAC_PS_MODE_LP,
+};
+
+/**
+ * enum fmac_bt_cfg_mode - Enumerates the support the BT Coex modes.
+ * @FMAC_BT_CFG_NW: N-wire.
+ * @FMAC_BT_CFG_DISABLE: BT Coex disabled.
+ * @FMAC_BT_CFG_BT: BT always gets the antenna.
+ * @FMAC_BT_CFG_WIFI: WIFI always gets the antenna.
+ */
+enum fmac_bt_cfg_mode {
+  FMAC_BT_CFG_NW = 0,
+  FMAC_BT_CFG_DISABLE,
+  FMAC_BT_CFG_BT,
+  FMAC_BT_CFG_WIFI,
+};
+
+/**
+ * enum fmac_uapsd_enable_mode - Enumerates the bits for U-APSD enablement.
+ * @FMAC_UAPSD_ENABLE_BSS: U-APSD is enabled for BSS role.
+ * @FMAC_UAPSD_ENABLE_P2P_CLIENT: U-APSD is enabled for P2P Client role.
+ */
+enum fmac_uapsd_enable_mode {
+  FMAC_UAPSD_ENABLE_BSS = BIT(0),
+  FMAC_UAPSD_ENABLE_P2P_CLIENT = BIT(1),
+};
+
+/**
+ * enum umac_scan_type - defines the possible scan types
+ * @IWL_SCAN_TYPE_NOT_SET: the scan type is undefined
+ * @IWL_SCAN_TYPE_UNASSOC: scan type to be used when unassociated
+ * @IWL_SCAN_TYPE_WILD: agressive scan that can be used when the
+ *  latency requirement and the throughput are not high.
+ * @IWL_SCAN_TYPE_MILD: gentle scan that can be used when there is
+ *  some throughput without low latency requirements.
+ * @IWL_SCAN_TYPE_FRAGMENTED: fragmented scan types where small blocks
+ *  of scan are performed separately in order to prevent latency
+ *  and throughput disruptions.
+ * @IWL_SCAN_TYPE_MAX: highest index of scan.
+ */
+enum umac_scan_type {
+  IWL_SCAN_TYPE_NOT_SET,
+  IWL_SCAN_TYPE_UNASSOC,
+  IWL_SCAN_TYPE_WILD,
+  IWL_SCAN_TYPE_MILD,
+  IWL_SCAN_TYPE_FRAGMENTED,
+  IWL_SCAN_TYPE_MAX,
+};
+
+#define IWL_FMAC_POWER_LEVEL_UNSET 0xff
+
+/**
+ * enum fmac_sad_mode: choose the single antenna diversity mode (SAD)
+ * @FMAC_SAD_ENABLED: toogle the enablement of SAD
+ * @FMAC_SAD_NIC_DEFAULT: use NIC default value
+ * @FMAC_SAD_ANT_A: choose antenna A by default
+ * @FMAC_SAD_ANT_B: choose antenna B by default
+ */
+enum fmac_sad_mode {
+  FMAC_SAD_ENABLED = BIT(0),
+  FMAC_SAD_NIC_DEFAULT = 0 << 1,
+  FMAC_SAD_ANT_A = 1 << 1,
+  FMAC_SAD_ANT_B = 2 << 1,
+};
+
+/**
+ * enum iwl_fmac_config_id - configuration id.
+ * @IWL_FMAC_STATIC_CONFIG_U32_START: first static global config that fit a
+ *  uint32_t. A static config is a config that can't be modified after
+ *  @IWL_FMAC_STATIC_CONFIG_COMPLETE has been sent.
+ * @IWL_FMAC_STATIC_CONFIG_POWER_SCHEME: see &enum fmac_ps_mode.
+ * @IWL_FMAC_STATIC_CONFIG_COEX_MODE: see &enum fmac_bt_cfg_mode.
+ * @IWL_FMAC_STATIC_CONFIG_COEX_SYNC2SCO: boolean.
+ * @IWL_FMAC_STATIC_CONFIG_COEX_PLCR: boolean.
+ * @IWL_FMAC_STATIC_CONFIG_COEX_MPLUT: boolean.
+ * @IWL_FMAC_STATIC_CONFIG_DEPRECATED_1: Not in use
+ * @IWL_FMAC_STATIC_CONFIG_DEPRECATED_2: Not in use
+ * @IWL_FMAC_STATIC_CONFIG_UAPSD_ENABLED: bitmap for U-APSD enablement. Check
+ *  &enum fmac_uapsd_enable_mode. Default is 0.
+ * @IWL_FMAC_STATIC_CONFIG_LTR_MODE: PCIe link training mode
+ * @IWL_FMAC_STATIC_CONFIG_SINGLE_ANT_DIVERSITY_CONF: see &enum fmac_sad_mode.
+ * @IWL_FMAC_STATIC_CONFIG_EXTERNAL_WPA: Configure to work in external WPA mode
+ *  (Security upload mode) for all future added interfaces.
+ * @IWL_FMAC_STATIC_CONFIG_U32_MAX: highest index of static global
+ *  configuration.
+ * @IWL_FMAC_STATIC_CONFIG_U32_NUM: number of static global configs that fit
+ *  a uint32_t. A static config is a config that can't be modified after
+ *  @IWL_FMAC_STATIC_CONFIG_COMPLETE has been sent.
+ *
+ * @IWL_FMAC_CONFIG_U32_START: first uint32_t config that is global but can be
+ *  changed on the fly.
+ * @IWL_FMAC_CONFIG_INTERNAL_CMD_TO_HOST: forward internal commands to
+ *  host for debug.
+ * @IWL_FMAC_CONFIG_RS_STAT_THOLD: threshold for sending RS statistics
+ *  notifications from LMAC.
+ * @IWL_FMAC_CONFIG_SCAN_TYPE: force scan type, regardless of internal
+ *  policies, according to &enum umac_scan_type.
+ * @IWL_FMAC_CONFIG_U32_MAX:highest index of configs that fit a uint32_t and that
+ *  can be changed on the fly.
+ * @IWL_FMAC_CONFIG_U32_NUM: number of configs that fit a uint32_t and that can
+ *  be changed on the fly.
+ *
+ * @IWL_FMAC_CONFIG_START: first config that doesn't fit a uint32_t. Those
+ *  configurations may or may not be modified on the fly. Depending
+ *  on the configuration. The firmware will not enforce any policy.
+ * @IWL_FMAC_CONFIG_DEBUG_LEVEL: debug level of the FMAC component in the
+ *  firmware. Since it can't be stored in the same place as other
+ *  CONFIG_U32 confs, it is in this section.
+ * @IWL_FMAC_CONFIG_TRIGGER: trigger configuration
+ * @IWL_FMAC_CONFIG_MAX: highest index of configs that don't fit a uint32_t.
+ * @IWL_FMAC_CONFIG_NUM: number of configs that don't git a uint32_t.
+ *
+ * @IWL_FMAC_CONFIG_VIF_START: first per-vif configuration
+ * @IWL_FMAC_CONFIG_VIF_POWER_DISABLED: power save disablement
+ * @IWL_FMAC_CONFIG_VIF_TXPOWER_USER: user-configured txpower in dbm,
+ *  or IWL_FMAC_UNSET_POWER_LEVEL if unset
+ * @IWL_FMAC_CONFIG_VIF_LOW_LATENCY: user-configured low latency mode.
+ * @IWL_FMAC_CONFIG_VIF_INDICATE_ROAM_IS_NEEDED: config that roam indication
+ *  is needed instead of internal FMAC roam flow.
+ * @IWL_FMAC_CONFIG_VIF_MAX: highest index of per-vif config
+ * @IWL_FMAC_CONFIG_VIF_NUM: number of per-vif configs
+ *
+ * @IWL_FMAC_CONFIG_WPAS_GLOBAL: a key=value string (NULL terminated) where
+ *  key is one of wpa_supplicant global configuration options.
+ * @IWL_FMAC_STATIC_CONFIG_COMPLETE: indicates that all the static
+ *  configuration has been applied. Must be sent once in the firmware's
+ *  life. No data should be attached to this configuration.
+ */
+enum iwl_fmac_config_id {
+  IWL_FMAC_STATIC_CONFIG_U32_START = 0x0,
+  IWL_FMAC_STATIC_CONFIG_POWER_SCHEME = IWL_FMAC_STATIC_CONFIG_U32_START,
+  IWL_FMAC_STATIC_CONFIG_COEX_MODE,
+  IWL_FMAC_STATIC_CONFIG_COEX_SYNC2SCO,
+  IWL_FMAC_STATIC_CONFIG_COEX_PLCR,
+  IWL_FMAC_STATIC_CONFIG_COEX_MPLUT,
+  IWL_FMAC_STATIC_CONFIG_DEPRECATED_1,
+  IWL_FMAC_STATIC_CONFIG_DEPRECATED_2,
+  IWL_FMAC_STATIC_CONFIG_UAPSD_ENABLED,
+  IWL_FMAC_STATIC_CONFIG_LTR_MODE,
+  IWL_FMAC_STATIC_CONFIG_SINGLE_ANT_DIVERSITY_CONF,
+  IWL_FMAC_STATIC_CONFIG_EXTERNAL_WPA,
+  IWL_FMAC_STATIC_CONFIG_U32_MAX,
+  IWL_FMAC_STATIC_CONFIG_U32_NUM =
+      IWL_FMAC_STATIC_CONFIG_U32_MAX - IWL_FMAC_STATIC_CONFIG_U32_START,
+
+  IWL_FMAC_CONFIG_U32_START = 0x100,
+  IWL_FMAC_CONFIG_INTERNAL_CMD_TO_HOST = IWL_FMAC_CONFIG_U32_START,
+  IWL_FMAC_CONFIG_RS_STAT_THOLD,
+  IWL_FMAC_CONFIG_SCAN_TYPE,
+  IWL_FMAC_CONFIG_U32_MAX,
+  IWL_FMAC_CONFIG_U32_NUM = IWL_FMAC_CONFIG_U32_MAX - IWL_FMAC_CONFIG_U32_START,
+
+  IWL_FMAC_CONFIG_START = 0x200,
+  IWL_FMAC_CONFIG_DEBUG_LEVEL = IWL_FMAC_CONFIG_START,
+  IWL_FMAC_CONFIG_TRIGGER,
+  IWL_FMAC_CONFIG_MAX,
+  IWL_FMAC_CONFIG_NUM = IWL_FMAC_CONFIG_MAX - IWL_FMAC_CONFIG_START,
+
+  IWL_FMAC_CONFIG_VIF_START = 0x300,
+  IWL_FMAC_CONFIG_VIF_POWER_DISABLED = IWL_FMAC_CONFIG_VIF_START,
+  IWL_FMAC_CONFIG_VIF_TXPOWER_USER,
+  IWL_FMAC_CONFIG_VIF_LOW_LATENCY,
+  IWL_FMAC_CONFIG_VIF_INDICATE_ROAM_IS_NEEDED,
+  IWL_FMAC_CONFIG_VIF_MAX,
+  IWL_FMAC_CONFIG_VIF_NUM = IWL_FMAC_CONFIG_VIF_MAX - IWL_FMAC_CONFIG_VIF_START,
+
+  IWL_FMAC_CONFIG_WPAS_GLOBAL = 0x400,
+
+  IWL_FMAC_STATIC_CONFIG_COMPLETE = 0xffff,
+};
+
+#define IWL_FMAC_VIF_ID_GLOBAL 0xff
+
+/**
+ * struct iwl_fmac_config_cmd - configuration command.
+ * @vif_id: vif_id or IWL_FMAC_VIF_ID_GLOBAL for global configuration.
+ * @reserved: for alignment.
+ * @config_id: see &enum iwl_fmac_config_id.
+ * @len: the length of the configuration in bytes (must be a multiple of 4).
+ * @data: the data of the configuration.
+ */
+struct iwl_fmac_config_cmd {
+  uint8_t vif_id;
+  uint8_t reserved[3];
+  __le16 config_id;
+  __le16 len;
+#ifndef _MSC_VER
+  uint8_t data[0];
+#endif
+} __packed;
+
+/**
+ * enum iwl_fmac_chan_width - channel widths.
+ * @IWL_CHAN_WIDTH_20_NOHT: 20MHz without HT.
+ * @IWL_CHAN_WIDTH_20: 20MHz with HT.
+ * @IWL_CHAN_WIDTH_40: 40MHz.
+ * @IWL_CHAN_WIDTH_80: 80MHz.
+ * @IWL_CHAN_WIDTH_160: 160MHz (including 80MHz + 80MHz).
+ * @IWL_NUM_CHAN_WIDTH: number of supported channel width values
+ */
+enum iwl_fmac_chan_width {
+  IWL_CHAN_WIDTH_20_NOHT,
+  IWL_CHAN_WIDTH_20,
+  IWL_CHAN_WIDTH_40,
+  IWL_CHAN_WIDTH_80,
+  IWL_CHAN_WIDTH_160,
+  IWL_NUM_CHAN_WIDTH
+};
+
+#define IWL_FMAC_NUM_CHAIN_LIMITS 2
+#define IWL_FMAC_NUM_SUB_BANDS 5
+
+struct iwl_fmac_sar_restrictions {
+  __le16 per_chain_restriction[IWL_FMAC_NUM_CHAIN_LIMITS][IWL_FMAC_NUM_SUB_BANDS];
+} __packed;
+
+/**
+ * enum iwl_fmac_hidden_ssid - types of hidden ssid
+ * @IWL_FMAC_HIDDEN_SSID_NONE: not hidden
+ * @IWL_FMAC_HIDDEN_SSID_ZERO_LEN: use zero length in the SSID IE.
+ * @IWL_FMAC_HIDDEN_SSID_ZERO_BYTES: use real length, but zero the SSID bytes
+ */
+enum iwl_fmac_hidden_ssid {
+  IWL_FMAC_HIDDEN_SSID_NONE = 0,
+  IWL_FMAC_HIDDEN_SSID_ZERO_LEN = 1,
+  IWL_FMAC_HIDDEN_SSID_ZERO_BYTES = 2,
+};
+
+/**
+ * struct iwl_fmac_chandef - channel definition.
+ * @control_freq: control frequency.
+ * @reserved: for alignment.
+ * @center_freq1: center frequency for the channel.
+ * @bandwidth: see &iwl_fmac_chan_width.
+ * @reserved2: for alignment.
+ */
+struct iwl_fmac_chandef {
+  __le16 control_freq;
+  __le16 center_freq1;
+  __le16 reserved;
+  uint8_t bandwidth;
+  uint8_t reserved2;
+} __packed;
+
+/**
+ * enum iwl_fmac_start_ap_resp_status - Status in &struct iwl_fmac_host_ap_resp
+ * @IWL_FMAC_START_AP_SUCCESS: Success to start AP.
+ * @IWL_FMAC_START_AP_FAILURE: Fail to start AP.
+ */
+enum iwl_fmac_start_ap_resp_status {
+  IWL_FMAC_START_AP_SUCCESS = 0,
+  IWL_FMAC_START_AP_FAILURE,
+};
+
+/**
+ * enum iwl_fmac_action_host_based_ap - for struct iwl_fmac_host_ap_cmd's action
+ * @IWL_FMAC_START_HOST_BASED_AP: to start the host based AP
+ * @IWL_FMAC_STOP_HOST_BASED_AP: to stop the host based AP
+ * @IWL_FMAC_MODIFY_HOST_BASED_AP: modify the host based AP
+ */
+enum iwl_fmac_action_host_based_ap {
+  IWL_FMAC_START_HOST_BASED_AP = 0,
+  IWL_FMAC_STOP_HOST_BASED_AP = 1,
+  IWL_FMAC_MODIFY_HOST_BASED_AP = 2,
+};
+
+/**
+ * enum iwl_fmac_host_ap_changed - describe what field is valid
+ * @IWL_FMAC_CTS_PROT_CHANGED: use_cts_prot is valid
+ * @IWL_FMAC_SHORT_PREAMBLE_CHANGED: use_short_preamble is valid
+ * @IWL_FMAC_SHORT_SLOT_CHANGED: use_short_slot is valid
+ * @IWL_FMAC_BASIC_RATES_CHANGED: basic_rates_bitmap is valid
+ * @IWL_FMAC_HT_OPMODE_CHANGED: ht_opmode is valid
+ * @IWL_FMAC_AC_PARAMS_CHANGED_BK: ac_params for BK is valid
+ * @IWL_FMAC_AC_PARAMS_CHANGED_BE: ac_params for BE is valid
+ * @IWL_FMAC_AC_PARAMS_CHANGED_VI: ac_params for VI is valid
+ * @IWL_FMAC_AC_PARAMS_CHANGED_VO: ac_params for VO is valid
+ * @IWL_FMAC_BEACON_CHANGED: beacon frame has been updated
+ */
+enum iwl_fmac_host_ap_changed {
+  IWL_FMAC_CTS_PROT_CHANGED = BIT(0),
+  IWL_FMAC_SHORT_PREAMBLE_CHANGED = BIT(1),
+  IWL_FMAC_SHORT_SLOT_CHANGED = BIT(2),
+  IWL_FMAC_BASIC_RATES_CHANGED = BIT(3),
+  IWL_FMAC_HT_OPMODE_CHANGED = BIT(4),
+  IWL_FMAC_AC_PARAMS_CHANGED_BK = BIT(5),
+  IWL_FMAC_AC_PARAMS_CHANGED_BE = BIT(6),
+  IWL_FMAC_AC_PARAMS_CHANGED_VI = BIT(7),
+  IWL_FMAC_AC_PARAMS_CHANGED_VO = BIT(8),
+  IWL_FMAC_BEACON_CHANGED = BIT(9),
+};
+
+/**
+ * struct iwl_fmac_ac_params - describes the AC params
+ * @txop: maximum burst time
+ * @cw_min: minimum contention window
+ * @cw_max: maximum contention window
+ * @aifs: Arbitration interframe space
+ * @reserved: for alignment
+ */
+struct iwl_fmac_ac_params {
+  __le16 txop;
+  __le16 cw_min;
+  __le16 cw_max;
+  uint8_t aifs;
+  uint8_t reserved;
+} __packed;
+
+/**
+ * struct iwl_fmac_host_ap_cmd - manage a host based AP vif
+ * @vif_id: the interface identifier returned in &iwl_fmac_add_vif_resp.
+ *  The vif's type must be %@IWL_FMAC_IFTYPE_HOST_BASED_AP.
+ * @action: see &enum iwl_fmac_action_host_based_ap. Note: not all fields are
+ *  relevant for all the actions.
+ * @dtim_period: the DTIM beacon in units of &beacon_int. Ignored in any action
+ *  that is not %IWL_FMAC_START_HOST_BASED_AP.
+ * @use_cts_prot: Whether to use CTS protection
+ * @use_short_preamble: Whether the use of short preambles is allowed
+ * @use_short_slot: Whether the use of short slot time is allowed
+ * @basic_rates_bitmap: bitmap of basic rates:
+ *  bit  0:  1Mbps bit  1: 2Mbps  bit 2:  5Mbps bit 3: 11Mbps bit 4:  6Mbps
+ *  bit  5:  9Mbps bit  6: 12Mbps bit 7: 18Mbps bit 8: 24Mbps bit 9: 36Mbps
+ *  bit 10: 48Mbps bit 11: 54Mbps
+ * @ht_opmode: HT Operation mode
+ * @beacon_int: the beacon interval in TU. Ignored in any &action that is not
+ *  %IWL_FMAC_START_HOST_BASED_AP.
+ * @inactivity_timeout: the max inactivity for clients, before they are removed
+ *  from the BSS (given in seconds). Ignored in any &action that is not
+ *  %IWL_FMAC_START_HOST_BASED_AP.
+ * @chandef: see &iwl_fmac_chandef. Ignored in any &action that is not
+ *  %IWL_FMAC_START_HOST_BASED_AP.
+ * @changed: indicates what field changed. See &enum iwl_fmac_host_ap_changed.
+ * @ac_params: the AC parameters. The order of the AC in the array is:
+ *  0: BK, 1: BE, 2: VI, 3: VO
+ * @byte_cnt: length of the beacon frame. Ignored if %IWL_FMAC_BEACON_CHANGED
+ *  is not set in &changed.
+ * @tim_idx: The index in bytes to where the TIM IE should be inserted. Ignored
+ *  if %IWL_FMAC_BEACON_CHANGED is not set in &changed.
+ * @frame: the template of the beacon frame. Ignored if
+ *  %IWL_FMAC_BEACON_CHANGED is not set in &changed.
+ *
+ * The command is used to manage (start / modify / stop) host based AP
+ * functionality.
+ * The flow to manage the host based AP is a synchronous flow as opposed to
+ * the regular AP mode. The response of this command is &struct
+ * iwl_fmac_host_ap_resp. All the management and EAPOL frames will be handled
+ * in the host.
+ */
+struct iwl_fmac_host_ap_cmd {
+  uint8_t vif_id;
+  uint8_t action;
+  uint8_t dtim_period;
+  uint8_t use_cts_prot;
+  uint8_t use_short_preamble;
+  uint8_t use_short_slot;
+  __le16 basic_rates_bitmap;
+  __le16 ht_opmode;
+  __le16 beacon_int;
+  __le32 inactivity_timeout;
+  struct iwl_fmac_chandef chandef;
+  struct iwl_fmac_ac_params ac_params[4];
+  __le16 byte_cnt;
+  __le16 tim_idx;
+  __le32 changed;
+#ifndef _MSC_VER
+  uint8_t frame[0];
+#endif
+} __packed;
+
+/**
+ * struct iwl_fmac_host_ap_resp - Response of the %FMAC_HOST_BASED_AP
+ */
+struct iwl_fmac_host_ap_resp {
+  /**
+   * @vif_id:
+   * the interface identifier returned in &iwl_fmac_add_vif_resp.
+   */
+  uint8_t vif_id;
+
+  /**
+   * @mcast_sta_id:
+   * the identifier allocation for the used for broadcast and  multicast
+   * transmissions. Relevant only if the %action was
+   * %IWL_FMAC_START_HOST_BASED_AP.
+   */
+  uint8_t mcast_sta_id;
+
+  /**
+   * @bcast_sta_id:
+   * the identifier allocation for the used for broadcast management
+   * frames. Relevant only if the %action was
+   * %IWL_FMAC_START_HOST_BASED_AP.
+   */
+  uint8_t bcast_sta_id;
+
+#ifdef CPTCFG_IWLFMAC_9000_SUPPORT
+  /**
+   * @mcast_queue:
+   * queue allocation for broadcast and multicast transmissions.
+   * Only valid for 9000-series devices, otherwise reserved.
+   * Relevant only if the %action was
+   * %IWL_FMAC_START_HOST_BASED_AP.
+   */
+  uint8_t mcast_queue;
+
+  /**
+   * @bcast_queue:
+   * queue allocation for broadcast management frames.
+   * Only valid for 9000-series devices, otherwise reserved.
+   * Relevant only if the %action was
+   * %IWL_FMAC_START_HOST_BASED_AP.
+   */
+  uint8_t bcast_queue;
+
+  /**
+   * @reserved:
+   * for alignment.
+   */
+  uint8_t reserved[3];
+#else
+  /**
+   * @reserved: reserved
+   */
+  uint8_t reserved[5];
+#endif
+
+  /**
+   * @status:
+   * status defined in &enum iwl_fmac_start_ap_resp_status.
+   */
+  __le32 status;
+} __packed;
+
+/**
+ * enum iwl_fmac_action_host_based_ap_sta - for %FMAC_HOST_BASED_AP_STA command
+ * @IWL_FMAC_ADD_HOST_BASED_STA: to add a station to the host based AP
+ * @IWL_FMAC_REM_HOST_BASED_STA: to remove a station from the host based AP
+ * @IWL_FMAC_MOD_HOST_BASED_STA: to modify a station of the host based AP
+ */
+enum iwl_fmac_action_host_based_ap_sta {
+  IWL_FMAC_ADD_HOST_BASED_STA = 0,
+  IWL_FMAC_REM_HOST_BASED_STA = 1,
+  IWL_FMAC_MOD_HOST_BASED_STA = 2,
+};
+
+/**
+ * enum iwl_fmac_host_ap_sta_changed - describes what field is valid
+ * @IWL_FMAC_STA_AID_CHANGED: aid was updated
+ * @IWL_FMAC_STA_SUPP_RATE_CHANGED: supported_rates_bitmap was updated
+ * @IWL_FMAC_STA_HT_CAP_CHANGED: ht_cap was updated
+ * @IWL_FMAC_STA_VHT_CAP_CHANGED: vht_cap was updated
+ * @IWL_FMAC_STA_UAPSD_PARAMS_CHANGED: uapsd_ac/sp_length was updated
+ */
+enum iwl_fmac_host_ap_sta_changed {
+  IWL_FMAC_STA_AID_CHANGED = BIT(0),
+  IWL_FMAC_STA_SUPP_RATE_CHANGED = BIT(1),
+  IWL_FMAC_STA_HT_CAP_CHANGED = BIT(2),
+  IWL_FMAC_STA_VHT_CAP_CHANGED = BIT(3),
+  IWL_FMAC_STA_UAPSD_PARAMS_CHANGED = BIT(4),
+};
+
+/**
+ * enum iwl_fmac_host_ap_sta_flags - flags for the host based AP's station
+ * @IWL_FMAC_STA_HT_CAPABLE: the station is HT capable
+ * @IWL_FMAC_STA_VHT_CAPABLE: the station is VHT capable
+ */
+enum iwl_fmac_host_ap_sta_flags {
+  IWL_FMAC_STA_HT_CAPABLE = BIT(0),
+  IWL_FMAC_STA_VHT_CAPABLE = BIT(1),
+};
+
+/**
+ * struct iwl_fmac_host_ap_sta_cmd - add a station to a host based AP
+ * @action: see &enum iwl_fmac_action_host_based_ap_sta Note: not all fields are
+ *  relevant for all the actions.
+ * @sta_id: valid only if the action isn't %IWL_FMAC_ADD.
+ * @vif_id: the id of the host based AP
+ * @flags: See &enum iwl_fmac_host_ap_sta_flags
+ * @addr: the MAC address of the station
+ * @aid: the association ID given to the station
+ * @changed: indicates what field changed. Note that this field must be set
+ *  even if action is %IWL_FMAC_ADD.
+ *  See &enum iwl_fmac_host_ap_sta_changed.
+ * @supp_rates_bitmap: the bitmap describing the supported non-HT rates.
+ *  bit  0:  1Mbps bit  1: 2Mbps  bit 2:  5Mbps bit 3: 11Mbps bit 4:  6Mbps
+ *  bit  5:  9Mbps bit  6: 12Mbps bit 7: 18Mbps bit 8: 24Mbps bit 9: 36Mbps
+ *  bit 10: 48Mbps bit 11: 54Mbps
+ * @ht_cap: the HT capability Information Element
+ * @uapsd_ac: ACs that are trigger-delivery enabled. The order of the bits is:
+ *  0: BK, 1: BE, 2: VI, 3: VO
+ * @sp_length: the actual number of frames to be sent in a Service Period
+ * @vht_cap: the VHT capability Information Element
+ */
+struct iwl_fmac_host_ap_sta_cmd {
+  uint8_t action;
+  uint8_t sta_id;
+  uint8_t vif_id;
+  uint8_t flags;
+  uint8_t addr[ETH_ALEN];
+  __le16 aid;
+  __le16 changed;
+  __le16 supp_rates_bitmap;
+  uint8_t ht_cap[26];
+  uint8_t uapsd_ac;
+  uint8_t sp_length;
+  uint8_t vht_cap[12];
+} __packed;
+
+#define IWL_FMAC_HOST_AP_INVALID_STA 0xffffffff
+
+/**
+ * struct iwl_fmac_host_ap_sta_resp - response of %FMAC_HOST_BASED_AP_STA
+ * @sta_id: the station id. If there is no room in the station table,
+ *  %IWL_FMAC_HOST_AP_INVALID_STA will be returned.
+ *  For any action other than %IWL_FMAC_ADD, the value will be 0.
+ */
+struct iwl_fmac_host_ap_sta_resp {
+  __le32 sta_id;
+};
+
+/**
+ * enum iwl_fmac_action_temporal_key - for %FMAC_TEMPORAL_KEY command
+ * @IWL_FMAC_ADD_TEMPORAL_KEY: to add a temporal key
+ * @IWL_FMAC_REM_TEMPORAL_KEY: to remove a temporal key
+ */
+enum iwl_fmac_action_temporal_key {
+  IWL_FMAC_ADD_TEMPORAL_KEY = 0,
+  IWL_FMAC_REM_TEMPORAL_KEY = 1,
+};
+
+/**
+ * enum iwl_fmac_key_type - for %FMAC_TEMPORAL_KEY command
+ * @IWL_FMAC_TEMPORAL_KEY_TYPE_PTK: pairwise key
+ * @IWL_FMAC_TEMPORAL_KEY_TYPE_GTK: multicast key
+ * @IWL_FMAC_TEMPORAL_KEY_TYPE_IGTK: IGTK
+ */
+enum iwl_fmac_temporal_key_type {
+  IWL_FMAC_TEMPORAL_KEY_TYPE_PTK = 0,
+  IWL_FMAC_TEMPORAL_KEY_TYPE_GTK = 1,
+  IWL_FMAC_TEMPORAL_KEY_TYPE_IGTK = 2,
+};
+
+/**
+ * struct iwl_fmac_temporal_key_cmd - add a PTK (used for the host based AP or
+ *  when external WPA is enabled)
+ * @action: see &enum iwl_fmac_action_temporal_key
+ * @sta_id: the station id to which this key relates. Can be the
+ *  multicast station for the groupwise key.
+ * @keyidx: the key index
+ * @keylen: the length of the key material
+ * @cipher: one of %IWL_FMAC_CIPHER_\*
+ * @key: the key material
+ * @key_type: see &enum iwl_fmac_temporal_key_type
+ * @vif_id: the interface identifier returned in &iwl_fmac_add_vif_resp.
+ * @reserved: reserved
+ */
+struct iwl_fmac_temporal_key_cmd {
+  uint8_t action;
+  uint8_t sta_id;
+  uint8_t keyidx;
+  uint8_t keylen;
+  __le32 cipher;
+  uint8_t key[32];
+  uint8_t key_type;
+  uint8_t vif_id;
+  uint8_t reserved[2];
+};
+
+/**
+ * struct iwl_fmac_temporal_key_resp - response to %FMAC_KEY
+ * @hw_keyoffset: the index to be used in the Tx command to use this key
+ */
+struct iwl_fmac_temporal_key_resp {
+  __le32 hw_keyoffset;
+};
+
+/**
+ * struct iwl_fmac_sta_removed - Notify about a removed station.
+ * @vif_id: the interface identifier returned in &iwl_fmac_add_vif_resp.
+ * @sta_id: holds a station entry index associated the removed station.
+ * @reserved: reserved
+ */
+struct iwl_fmac_sta_removed {
+  uint8_t vif_id;
+  uint8_t sta_id;
+  uint8_t reserved[2];
+} __packed;
+
+/**
+ * enum iwl_fmac_dbg_trigger - triggers available
+ */
+enum iwl_fmac_dbg_trigger {
+  /**
+   * @IWL_FMAC_DBG_TRIGGER_INVALID:
+   * (reserved)
+   */
+  IWL_FMAC_DBG_TRIGGER_INVALID = 0,
+
+  /**
+   * @IWL_FMAC_DBG_TRIGGER_MISSED_BEACONS:
+   * trigger on missed beacons
+   */
+  IWL_FMAC_DBG_TRIGGER_MISSED_BEACONS = 3,
+
+  /**
+   * @IWL_FMAC_DBG_TRIGGER_CHANNEL_SWITCH:
+   * trigger on channel switch
+   */
+  IWL_FMAC_DBG_TRIGGER_CHANNEL_SWITCH = 4,
+
+  /**
+   * @IWL_FMAC_DBG_TRIGGER_MAX:
+   * maximum number of triggers supported
+   */
+  IWL_FMAC_DBG_TRIGGER_MAX /* must be last */
+};
+
+/**
+ * struct iwl_fmac_trigger_cmd
+ * @len: length of %data
+ * @id: &enum iwl_fmac_dbg_trigger
+ * @vif_type: %iwl_fmac_vif_type
+ * @data: trigger-dependent data
+ */
+struct iwl_fmac_trigger_cmd {
+  __le32 len;
+  __le32 id;
+  __le32 vif_type;
+#ifndef _MSC_VER
+  uint8_t data[0];
+#endif
+} __packed;
+
+#define MAX_TRIGGER_STR 64
+/**
+ * struct iwl_fmac_trigger_notif - notification with invoked trigger info
+ * @id: &enum iwl_fmac_dbg_trigger
+ * @data: string that describes what happened
+ */
+struct iwl_fmac_trigger_notif {
+  __le32 id;
+  uint8_t data[MAX_TRIGGER_STR];
+} __packed;
+
+enum iwl_fmac_mcc_source {
+  IWL_FMAC_MCC_SOURCE_OLD_FW = 0,
+  IWL_FMAC_MCC_SOURCE_ME = 1,
+  IWL_FMAC_MCC_SOURCE_BIOS = 2,
+  IWL_FMAC_MCC_SOURCE_3G_LTE_HOST = 3,
+  IWL_FMAC_MCC_SOURCE_3G_LTE_DEVICE = 4,
+  IWL_FMAC_MCC_SOURCE_WIFI = 5,
+  IWL_FMAC_MCC_SOURCE_RESERVED = 6,
+  IWL_FMAC_MCC_SOURCE_DEFAULT = 7,
+  IWL_FMAC_MCC_SOURCE_UNINITIALIZED = 8,
+  IWL_FMAC_MCC_SOURCE_MCC_API = 9,
+  IWL_FMAC_MCC_SOURCE_GET_CURRENT = 0x10,
+  IWL_FMAC_MCC_SOURCE_GETTING_MCC_TEST_MODE = 0x11,
+};
+
+/**
+ * struct iwl_fmac_reg_cmd - send regulatory data to FW
+ * @mcc: country code or "ZZ" for default
+ * @source_id: &enum iwl_fmac_mcc_source
+ * @reserved: reserved
+ */
+struct iwl_fmac_reg_cmd {
+  __le16 mcc;
+  uint8_t source_id;
+  uint8_t reserved;
+} __packed;
+
+/**
+ * struct iwl_fmac_reg_resp - response to %FMAC_REG_CFG, %FMAC_REG_UPDATE notif
+ * @mcc: the current MCC
+ * @source_id: the MCC source, see &enum iwl_fmac_mcc_source
+ * @n_channels: number of channels in @channels
+ * @channels: channel control data map, 32bits for each channel. Only the first
+ *  16bits are used.
+ * @reserved: reserved
+ *
+ * Contains the new channel control profile map and the current MCC (mobile
+ * country code). The new MCC may be different than what was requested in
+ * FMAC_REG_CFG, if this is a cmd response.
+ */
+struct iwl_fmac_reg_resp {
+  __le16 mcc;
+  uint8_t source_id;
+  uint8_t reserved[1];
+  __le32 n_channels;
+#ifndef _MSC_VER
+  __le32 channels[0];
+#endif
+} __packed;
+
+/**
+ * struct iwl_fw_dbg_trigger_missed_bcon - configures trigger for missed
+ *  beacons
+ * @stop_consec_missed_bcon: stop recording if threshold is crossed.
+ *  stop recording means to collect the current dump data.
+ * @stop_consec_missed_bcon_since_rx: stop recording if threshold is crossed.
+ * @reserved: reserved
+ */
+struct iwl_fmac_dbg_trigger_missed_bcon {
+  __le32 stop_consec_missed_bcon;
+  __le32 stop_consec_missed_bcon_since_rx;
+  uint8_t reserved[24];
+} __packed;
+
+/**
+ * struct iwl_fmac_rx_eapol_notif - EAPOL RX notification
+ * @addr: frame source address
+ * @len: frame length in bytes
+ * @data: frame body
+ *
+ * This message is used to pass 802.1X EAPOL frames to the host.
+ * The host is expected to send the response EAPOL via the TX path,
+ * and if 802.1X authentication fails the host should disconnect with
+ * disconnect reason 23 (IEEE 802.1x authentication failed).
+ */
+struct iwl_fmac_rx_eapol_notif {
+  uint8_t addr[ETH_ALEN];
+  __le16 len;
+#ifndef _MSC_VER
+  uint8_t data[0];
+#endif
+} __packed;
+
+#ifdef CPTCFG_IWLFMAC_9000_SUPPORT
+/**
+ * struct iwl_fmac_send_frame_notif - Ask the host to send a frame
+ * @vif_id: the interface identifier
+ * @reserved: reserved
+ * @len: frame length in bytes
+ * @dst_addr: the destination MAC address
+ * @src_addr: the source MAC address
+ * @proto: the protocol (only EAP for now)
+ * @data: frame body starts with a valid 802.11 MAC header
+ *
+ * This message is used to instruct the host to send a frame. This is
+ * used to use the host's PN pool and avoid racing between the host and
+ * FMAC.
+ */
+struct iwl_fmac_send_frame_notif {
+  uint8_t vif_id;
+  uint8_t reserved;
+  __le16 len;
+  uint8_t dst_addr[ETH_ALEN];
+  uint8_t src_addr[ETH_ALEN];
+  __be16 proto;
+#ifndef _MSC_VER
+  uint8_t data[0];
+#endif
+} __packed;
+#endif
+
+#define KEY_MAX_LEN 48
+
+/**
+ * enum iwl_fmac_key_type - available key types for FMAC_SET_PMK command
+ * @IWL_FMAC_KEY_TYPE_PMK: PMK from 802.1X authentication. The PMK length
+ *  is 32 bytes.
+ * @IWL_FMAC_KEY_TYPE_PMK_EAP_LEAP: PMK from 802.1X authentication when
+ *  EAP-LEAP is used. The PMK length is 16.
+ * @IWL_FMAC_KEY_TYPE_PMK_SUITE_B_192: PMK from 802.1X authentication when
+ *  suite_b_192 is used. The PMK length is 48 bytes.
+ */
+enum iwl_fmac_key_type {
+  IWL_FMAC_KEY_TYPE_PMK,
+  IWL_FMAC_KEY_TYPE_PMK_EAP_LEAP,
+  IWL_FMAC_KEY_TYPE_PMK_SUITE_B_192,
+};
+
+/**
+ * struct iwl_fmac_mlme_set_pmk_cmd - set pmk command
+ * @vif_id: the interface identifier returned in &iwl_fmac_add_vif_resp
+ * @key_type: the key type as specified in &iwl_fmac_key_type. This field
+ *  defines the used length of the key buffer.
+ * @aa: authenticator address
+ * @key: key data. The length of the data is determined by the type
+ *  of the key as specified in &key_type. See also &enum iwl_fmac_key_type.
+ */
+struct iwl_fmac_mlme_set_pmk_cmd {
+  uint8_t vif_id;
+  uint8_t key_type;
+  uint8_t aa[ETH_ALEN];
+  uint8_t key[KEY_MAX_LEN];
+};
+
+/**
+ * struct iwl_fmac_mic_failure - Notify fmac of TKIP MMIC failures.
+ * @vif_id: the interface identifier connected to TKIP WLAN.
+ * @pairwise: whether the mic failure was on unicaseet or multicast.
+ * @reserved: reserved for 4 byte alignment.
+ */
+struct iwl_fmac_mic_failure {
+  uint8_t vif_id;
+  uint8_t pairwise;
+  uint8_t reserved[2];
+} __packed;
+
+/**
+ * enum iwl_fmac_sha_type - SHA function types
+ * @IWL_FMAC_SHA_TYPE_SHA1: SHA1
+ * @IWL_FMAC_SHA_TYPE_SHA256: SHA256
+ * @IWL_FMAC_SHA_TYPE_SHA384: SHA384
+ */
+enum iwl_fmac_sha_type {
+  IWL_FMAC_SHA_TYPE_SHA1,
+  IWL_FMAC_SHA_TYPE_SHA256,
+  IWL_FMAC_SHA_TYPE_SHA384,
+};
+
+#define SHA_MAX_MSG_LEN 128
+
+/**
+ * struct iwl_fmac_vector_sha - vector for FIPS SHA tests
+ * @type: the SHA type to use. One of &enum iwl_fmac_sha_type.
+ * @msg_len: the length of &msg in bytes.
+ * @reserved: for alignment.
+ * @msg: the message to generate the hash for.
+ */
+struct iwl_fmac_vector_sha {
+  uint8_t type;
+  uint8_t msg_len;
+  __le16 reserved;
+  uint8_t msg[SHA_MAX_MSG_LEN];
+} __packed;
+
+#define HMAC_KDF_MAX_KEY_LEN 192
+#define HMAC_KDF_MAX_MSG_LEN 144
+
+/**
+ * struct iwl_fmac_vector_hmac_kdf - vector for FIPS HMAC/KDF tests
+ * @type: the SHA type to use. One of &enum iwl_fmac_sha_type.
+ * @res_len: requested result length in bytes.
+ * @key_len: the length of &key in bytes.
+ * @msg_len: the length of &msg in bytes.
+ * @key: key for HMAC/KDF operations.
+ * @msg: the message to generate the MAC for.
+ */
+struct iwl_fmac_vector_hmac_kdf {
+  uint8_t type;
+  uint8_t res_len;
+  uint8_t key_len;
+  uint8_t msg_len;
+  uint8_t key[HMAC_KDF_MAX_KEY_LEN];
+  uint8_t msg[HMAC_KDF_MAX_MSG_LEN];
+} __packed;
+
+/**
+ * enum iwl_fmac_fips_test_type - FIPS test types
+ * @IWL_FMAC_FIPS_TEST_SHA: test SHA functions.
+ * @IWL_FMAC_FIPS_TEST_HMAC: test HMAC functions.
+ * @IWL_FMAC_FIPS_TEST_KDF: test KDF functions.
+ */
+enum iwl_fmac_fips_test_type {
+  IWL_FMAC_FIPS_TEST_SHA,
+  IWL_FMAC_FIPS_TEST_HMAC,
+  IWL_FMAC_FIPS_TEST_KDF,
+};
+
+union iwl_fmac_fips_test_vector {
+  struct iwl_fmac_vector_sha sha_vector;
+  struct iwl_fmac_vector_hmac_kdf hmac_kdf_vector;
+};
+
+#define MAX_FIPS_VECTOR_LEN sizeof(union iwl_fmac_fips_test_vector)
+
+/**
+ * struct iwl_fmac_test_fips_cmd - FIPS test command
+ * @type: test type. One of &enum iwl_fmac_fips_test_type.
+ * @reserved: for alignment.
+ * @vector: buffer with vector data. Union &iwl_fmac_fips_test_vector.
+ */
+struct iwl_fmac_test_fips_cmd {
+  uint8_t type;
+  uint8_t reserved[3];
+  uint8_t vector[MAX_FIPS_VECTOR_LEN];
+} __packed;
+
+/**
+ * enum iwl_fmac_fips_test_status - FIPS test result status
+ * @IWL_FMAC_TEST_FIPS_STATUS_SUCCESS: The requested operation was completed
+ *  successfully. The result buffer is valid.
+ * @IWL_FMAC_TEST_FIPS_STATUS_FAIL: The requested operation failed.
+ */
+enum iwl_fmac_test_fips_status {
+  IWL_FMAC_TEST_FIPS_STATUS_SUCCESS,
+  IWL_FMAC_TEST_FIPS_STATUS_FAIL,
+};
+
+#define FIPS_MAX_RES_LEN 88
+#define MAX_RES_LEN_HMAC_SHA1 20
+#define MAX_RES_LEN_HMAC_SHA256 32
+#define MAX_RES_LEN_HMAC_SHA384 48
+
+/**
+ * struct iwl_fmac_test_fips_resp - FIPS test response
+ * @status: one of &enum iwl_fmac_fips_test_status.
+ * @len: the length of the response in bytes.
+ * @reserved: for alignment.
+ * @buf: response buffer.
+ *
+ * Note that the response buffer has valid data only if &status is
+ * &IWL_FMAC_TEST_FIPS_STATUS_SUCCESS. Otherwise it should be ignored.
+ */
+struct iwl_fmac_test_fips_resp {
+  uint8_t status;
+  uint8_t len;
+  __le16 reserved;
+  uint8_t buf[FIPS_MAX_RES_LEN];
+} __packed;
+
+/**
+ * struct iwl_fmac_set_monitor_chan_cmd - Set the monifor channel
+ * @vif_id: id of monitor vif to set
+ * @reserved: reserved for dword alignment
+ * @chandef: channel to set
+ */
+struct iwl_fmac_set_monitor_chan_cmd {
+  uint8_t vif_id;
+  uint8_t reserved[3];
+  struct iwl_fmac_chandef chandef;
+} __packed;
+
+/**
+ * struct iwl_fmac_roam_is_needed - Roam is needed information notification
+ *
+ * @vif_id: vif_id returned by &FMAC_ADD_VIF command
+ * @n_bssids: number of BSSIDs in the &bssids array.
+ * @bssids: array of bssids whose length is &n_bssids. this bssid list
+ *  is the candidate list for roam.
+ */
+struct iwl_fmac_roam_is_needed {
+  uint8_t vif_id;
+  uint8_t n_bssids;
+  uint8_t bssids[IWL_FMAC_MAX_BSSIDS * ETH_ALEN];
+} __packed;
+
+/**
+ * enum iwl_fmac_roam_result_status - roam result status
+ *
+ * @IWL_FMAC_ROAM_RESULT_STATUS_ROAMED_NEW_AP: roamed to new ap successfully.
+ * @IWL_FMAC_ROAM_RESULT_STATUS_ROAM_FAILED: roamed to new ap failed.
+ * @IWL_FMAC_ROAM_RESULT_STATUS_LEFT_WITH_CURRENT_AP: current AP is the best
+ *  AP, so no need to roam.
+ * @IWL_FMAC_ROAM_RESULT_STATUS_NOT_CONNECTED: the ctrl iface state is not
+ *  connected.
+ */
+enum iwl_fmac_roam_result_status {
+  IWL_FMAC_ROAM_RESULT_STATUS_ROAMED_NEW_AP,
+  IWL_FMAC_ROAM_RESULT_STATUS_ROAM_FAILED,
+  IWL_FMAC_ROAM_RESULT_STATUS_LEFT_WITH_CURRENT_AP,
+  IWL_FMAC_ROAM_RESULT_STATUS_NOT_CONNECTED,
+};
+
+/**
+ * struct iwl_fmac_roam_result - Roam result information notification
+ *
+ * @status: one of &enum iwl_fmac_roam_result_status.
+ * @vif_id: the virtual interface identifier as returned in
+ *     &iwl_fmac_add_vif_resp.
+ * @reserved: for alignment.
+ * @connect_result: as defined in &struct iwl_fmac_connect_result.
+ */
+struct iwl_fmac_roam_result {
+  uint8_t status;
+  uint8_t vif_id;
+  uint8_t reserved[2];
+  struct iwl_fmac_connect_result connect_result;
+} __packed;
+
+/**
+ * struct iwl_fmac_tkip_mcast_rsc - TKIP receive sequence counter
+ *
+ * @vif_id: the virtual interface identifier as returned in
+ *     &iwl_fmac_add_vif_resp.
+ * @key_idx: key index
+ * @addr: station address
+ * @rsc: the new receive sequence counter
+ * @reserved: for alignment.
+ */
+struct iwl_fmac_tkip_mcast_rsc {
+  uint8_t vif_id;
+  uint8_t key_idx;
+  uint8_t addr[ETH_ALEN];
+  uint8_t rsc[6];
+  uint8_t reserved[2];
+};
+
+/**
+ * struct iwl_fmac_inactive_sta - notifies about an inactive station
+ * @vif_id: the id of the vif
+ * @sta_id: the id of the station that is inactive
+ * @reserved: for alignment
+ */
+struct iwl_fmac_inactive_sta {
+  uint8_t vif_id;
+  uint8_t sta_id;
+  __le16 reserved;
+};
+
+#define IWL_FMAC_RECOVERY_NUM_VIFS 4
+
+/**
+ * struct iwl_fmac_recover_cmd - command to recover connetions
+ * @add_vif_bitmap: a bitmap of vif_id's that should be added by the recovery
+ *  flow. If i is set, then vif i will be added.
+ * @restore_vif_bitmap: a bitmap of vif_id's that should be recovered. If bit
+ *  i is set, then vif i will be recovered.
+ * @reserved: for alignment
+ * @vif_types: the type of the vifs to be restored. See &enum iwl_fmac_vif_type.
+ * @vif_addrs: the addresses of the vifs
+ * @blob: raw data read by the host upon firmware crash
+ */
+struct iwl_fmac_recover_cmd {
+  uint8_t add_vif_bitmap;
+  uint8_t restore_vif_bitmap;
+  uint8_t reserved[2];
+  uint8_t vif_types[IWL_FMAC_RECOVERY_NUM_VIFS];
+  uint8_t vif_addrs[IWL_FMAC_RECOVERY_NUM_VIFS * ETH_ALEN];
+#ifndef _MSC_VER
+  uint8_t blob[0];
+#endif
+} __packed;
+
+/**
+ * enum iwl_fmac_recovery_complete_status - values for the recovery status
+ * @IWL_FMAC_RECOV_SUCCESS: all the vifs were added
+ * @IWL_FMAC_RECOV_CORRUPTED: the buffer was corrupted, no vifs were added
+ */
+enum iwl_fmac_recovery_complete_status {
+  IWL_FMAC_RECOV_SUCCESS = 0,
+  IWL_FMAC_RECOV_CORRUPTED = 1,
+};
+
+/**
+ * struct iwl_fmac_recovery_complete - notifies the completion of the recovery
+ * @status: If %IWL_FMAC_RECOV_SUCCESS, then all the vifs that were requested
+ *  to be recvored in the %FMAC_RECOVER command were re-added even if
+ *  their state may not have been recovered (see &vif_id_bitmap).
+ *  A non-0 value means that the firmware has not done anything to recover
+ *  and the host should start by re-adding the vifs.
+ * @vif_id_bitmap: a bitmap of vif_id's. If bit i is set, then vif i was
+ *  properly recovered.
+ * @reserved: for alignment
+ */
+struct iwl_fmac_recovery_complete {
+  uint8_t status;
+  uint8_t vif_id_bitmap;
+  uint8_t reserved[2];
+} __packed;
+
+#endif  // SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_FMAC_H_
diff --git a/third_party/iwlwifi/fw/api/led.h b/third_party/iwlwifi/fw/api/led.h
new file mode 100644
index 0000000..35d82e3
--- /dev/null
+++ b/third_party/iwlwifi/fw/api/led.h
@@ -0,0 +1,48 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2017 Intel Deutschland GmbH
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+
+#ifndef SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_LED_H_
+#define SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_LED_H_
+
+#include "src/iwlwifi/platform/compiler.h"
+
+/**
+ * struct iwl_led_cmd - LED switching command
+ *
+ * @status: LED status (on/off)
+ */
+struct iwl_led_cmd {
+  __le32 status;
+} __packed; /* LEDS_CMD_API_S_VER_2 */
+
+#endif  // SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_LED_H_
diff --git a/third_party/iwlwifi/fw/api/mac-cfg.h b/third_party/iwlwifi/fw/api/mac-cfg.h
new file mode 100644
index 0000000..75b7b6e
--- /dev/null
+++ b/third_party/iwlwifi/fw/api/mac-cfg.h
@@ -0,0 +1,129 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018 Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+
+#ifndef SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_MAC_CFG_H_
+#define SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_MAC_CFG_H_
+
+#include "src/iwlwifi/platform/compiler.h"
+#include "src/iwlwifi/platform/ieee80211.h"
+#include "src/iwlwifi/platform/kernel.h"
+
+/**
+ * enum iwl_mac_conf_subcmd_ids - mac configuration command IDs
+ */
+enum iwl_mac_conf_subcmd_ids {
+  /**
+   * @LOW_LATENCY_CMD: &struct iwl_mac_low_latency_cmd
+   */
+  LOW_LATENCY_CMD = 0x3,
+  /**
+   * @PROBE_RESPONSE_DATA_NOTIF: &struct iwl_probe_resp_data_notif
+   */
+  PROBE_RESPONSE_DATA_NOTIF = 0xFC,
+
+  /**
+   * @CHANNEL_SWITCH_NOA_NOTIF: &struct iwl_channel_switch_noa_notif
+   */
+  CHANNEL_SWITCH_NOA_NOTIF = 0xFF,
+};
+
+#define IWL_P2P_NOA_DESC_COUNT (2)
+
+/**
+ * struct iwl_p2p_noa_attr - NOA attr contained in probe resp FW notification
+ *
+ * @id: attribute id
+ * @len_low: length low half
+ * @len_high: length high half
+ * @idx: instance of NoA timing
+ * @ctwin: GO's ct window and pwer save capability
+ * @desc: NoA descriptor
+ * @reserved: reserved for alignment purposes
+ */
+struct iwl_p2p_noa_attr {
+  uint8_t id;
+  uint8_t len_low;
+  uint8_t len_high;
+  uint8_t idx;
+  uint8_t ctwin;
+  struct ieee80211_p2p_noa_desc desc[IWL_P2P_NOA_DESC_COUNT];
+  uint8_t reserved;
+} __packed;
+
+#define IWL_PROBE_RESP_DATA_NO_CSA (0xff)
+
+/**
+ * struct iwl_probe_resp_data_notif - notification with NOA and CSA counter
+ *
+ * @mac_id: the mac which should send the probe response
+ * @noa_active: notifies if the noa attribute should be handled
+ * @noa_attr: P2P NOA attribute
+ * @csa_counter: current csa counter
+ * @reserved: reserved for alignment purposes
+ */
+struct iwl_probe_resp_data_notif {
+  __le32 mac_id;
+  __le32 noa_active;
+  struct iwl_p2p_noa_attr noa_attr;
+  uint8_t csa_counter;
+  uint8_t reserved[3];
+} __packed; /* PROBE_RESPONSE_DATA_NTFY_API_S_VER_1 */
+
+/**
+ * struct iwl_channel_switch_noa_notif - Channel switch NOA notification
+ *
+ * @id_and_color: ID and color of the MAC
+ */
+struct iwl_channel_switch_noa_notif {
+  __le32 id_and_color;
+} __packed; /* CHANNEL_SWITCH_START_NTFY_API_S_VER_1 */
+
+/**
+ * struct iwl_mac_low_latency_cmd - set/clear mac to 'low-latency mode'
+ *
+ * @mac_id: MAC ID to whom to apply the low-latency configurations
+ * @low_latency_rx: 1/0 to set/clear Rx low latency direction
+ * @low_latency_tx: 1/0 to set/clear Tx low latency direction
+ * @reserved: reserved for alignment purposes
+ */
+struct iwl_mac_low_latency_cmd {
+  __le32 mac_id;
+  uint8_t low_latency_rx;
+  uint8_t low_latency_tx;
+  __le16 reserved;
+} __packed; /* MAC_LOW_LATENCY_API_S_VER_1 */
+
+#endif  // SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_MAC_CFG_H_
diff --git a/third_party/iwlwifi/fw/api/mac.h b/third_party/iwlwifi/fw/api/mac.h
new file mode 100644
index 0000000..b83dc84
--- /dev/null
+++ b/third_party/iwlwifi/fw/api/mac.h
@@ -0,0 +1,576 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2017        Intel Deutschland GmbH
+ * Copyright(c) 2018 Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *****************************************************************************/
+
+#ifndef SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_MAC_H_
+#define SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_MAC_H_
+
+#include "src/iwlwifi/platform/compiler.h"
+
+/*
+ * The first MAC indices (starting from 0) are available to the driver,
+ * AUX indices follows - 1 for non-CDB, 2 for CDB.
+ */
+#define MAC_INDEX_AUX 4
+#define MAC_INDEX_MIN_DRIVER 0
+#define NUM_MAC_INDEX_DRIVER MAC_INDEX_AUX
+#define NUM_MAC_INDEX (NUM_MAC_INDEX_DRIVER + 1)
+#define NUM_MAC_INDEX_CDB (NUM_MAC_INDEX_DRIVER + 2)
+
+#define IWL_MVM_STATION_COUNT 16
+#define IWL_MVM_INVALID_STA 0xFF
+
+enum iwl_ac {
+  AC_BK,
+  AC_BE,
+  AC_VI,
+  AC_VO,
+  AC_NUM,
+};
+
+/**
+ * enum iwl_mac_protection_flags - MAC context flags
+ * @MAC_PROT_FLG_TGG_PROTECT: 11g protection when transmitting OFDM frames,
+ *  this will require CCK RTS/CTS2self.
+ *  RTS/CTS will protect full burst time.
+ * @MAC_PROT_FLG_HT_PROT: enable HT protection
+ * @MAC_PROT_FLG_FAT_PROT: protect 40 MHz transmissions
+ * @MAC_PROT_FLG_SELF_CTS_EN: allow CTS2self
+ */
+enum iwl_mac_protection_flags {
+  MAC_PROT_FLG_TGG_PROTECT = BIT(3),
+  MAC_PROT_FLG_HT_PROT = BIT(23),
+  MAC_PROT_FLG_FAT_PROT = BIT(24),
+  MAC_PROT_FLG_SELF_CTS_EN = BIT(30),
+};
+
+#define MAC_FLG_SHORT_SLOT BIT(4)
+#define MAC_FLG_SHORT_PREAMBLE BIT(5)
+
+/**
+ * enum iwl_mac_types - Supported MAC types
+ * @FW_MAC_TYPE_FIRST: lowest supported MAC type
+ * @FW_MAC_TYPE_AUX: Auxiliary MAC (internal)
+ * @FW_MAC_TYPE_LISTENER: monitor MAC type (?)
+ * @FW_MAC_TYPE_PIBSS: Pseudo-IBSS
+ * @FW_MAC_TYPE_IBSS: IBSS
+ * @FW_MAC_TYPE_BSS_STA: BSS (managed) station
+ * @FW_MAC_TYPE_P2P_DEVICE: P2P Device
+ * @FW_MAC_TYPE_P2P_STA: P2P client
+ * @FW_MAC_TYPE_GO: P2P GO
+ * @FW_MAC_TYPE_TEST: ?
+ * @FW_MAC_TYPE_MAX: highest support MAC type
+ */
+enum iwl_mac_types {
+  FW_MAC_TYPE_FIRST = 1,
+  FW_MAC_TYPE_AUX = FW_MAC_TYPE_FIRST,
+  FW_MAC_TYPE_LISTENER,
+  FW_MAC_TYPE_PIBSS,
+  FW_MAC_TYPE_IBSS,
+  FW_MAC_TYPE_BSS_STA,
+  FW_MAC_TYPE_P2P_DEVICE,
+  FW_MAC_TYPE_P2P_STA,
+  FW_MAC_TYPE_GO,
+  FW_MAC_TYPE_TEST,
+  FW_MAC_TYPE_MAX = FW_MAC_TYPE_TEST
+}; /* MAC_CONTEXT_TYPE_API_E_VER_1 */
+
+/**
+ * enum iwl_tsf_id - TSF hw timer ID
+ * @TSF_ID_A: use TSF A
+ * @TSF_ID_B: use TSF B
+ * @TSF_ID_C: use TSF C
+ * @TSF_ID_D: use TSF D
+ * @NUM_TSF_IDS: number of TSF timers available
+ */
+enum iwl_tsf_id {
+  TSF_ID_A = 0,
+  TSF_ID_B = 1,
+  TSF_ID_C = 2,
+  TSF_ID_D = 3,
+  NUM_TSF_IDS = 4,
+}; /* TSF_ID_API_E_VER_1 */
+
+/**
+ * struct iwl_mac_data_ap - configuration data for AP MAC context
+ * @beacon_time: beacon transmit time in system time
+ * @beacon_tsf: beacon transmit time in TSF
+ * @bi: beacon interval in TU
+ * @reserved1: reserved
+ * @dtim_interval: dtim transmit time in TU
+ * @reserved2: reserved
+ * @mcast_qid: queue ID for multicast traffic.
+ *  NOTE: obsolete from VER2 and on
+ * @beacon_template: beacon template ID
+ */
+struct iwl_mac_data_ap {
+  __le32 beacon_time;
+  __le64 beacon_tsf;
+  __le32 bi;
+  __le32 reserved1;
+  __le32 dtim_interval;
+  __le32 reserved2;
+  __le32 mcast_qid;
+  __le32 beacon_template;
+} __packed; /* AP_MAC_DATA_API_S_VER_2 */
+
+/**
+ * struct iwl_mac_data_ibss - configuration data for IBSS MAC context
+ * @beacon_time: beacon transmit time in system time
+ * @beacon_tsf: beacon transmit time in TSF
+ * @bi: beacon interval in TU
+ * @reserved: reserved
+ * @beacon_template: beacon template ID
+ */
+struct iwl_mac_data_ibss {
+  __le32 beacon_time;
+  __le64 beacon_tsf;
+  __le32 bi;
+  __le32 reserved;
+  __le32 beacon_template;
+} __packed; /* IBSS_MAC_DATA_API_S_VER_1 */
+
+/**
+ * enum iwl_mac_data_policy - policy of the data path for this MAC
+ * @TWT_SUPPORTED: twt is supported
+ */
+enum iwl_mac_data_policy {
+  TWT_SUPPORTED = BIT(0),
+};
+
+/**
+ * struct iwl_mac_data_sta - configuration data for station MAC context
+ * @is_assoc: 1 for associated state, 0 otherwise
+ * @dtim_time: DTIM arrival time in system time
+ * @dtim_tsf: DTIM arrival time in TSF
+ * @bi: beacon interval in TU, applicable only when associated
+ * @reserved1: reserved
+ * @dtim_interval: DTIM interval in TU, applicable only when associated
+ * @data_policy: see &enum iwl_mac_data_policy
+ * @listen_interval: in beacon intervals, applicable only when associated
+ * @assoc_id: unique ID assigned by the AP during association
+ * @assoc_beacon_arrive_time: TSF of first beacon after association
+ */
+struct iwl_mac_data_sta {
+  __le32 is_assoc;
+  __le32 dtim_time;
+  __le64 dtim_tsf;
+  __le32 bi;
+  __le32 reserved1;
+  __le32 dtim_interval;
+  __le32 data_policy;
+  __le32 listen_interval;
+  __le32 assoc_id;
+  __le32 assoc_beacon_arrive_time;
+} __packed; /* STA_MAC_DATA_API_S_VER_2 */
+
+/**
+ * struct iwl_mac_data_go - configuration data for P2P GO MAC context
+ * @ap: iwl_mac_data_ap struct with most config data
+ * @ctwin: client traffic window in TU (period after TBTT when GO is present).
+ *  0 indicates that there is no CT window.
+ * @opp_ps_enabled: indicate that opportunistic PS allowed
+ */
+struct iwl_mac_data_go {
+  struct iwl_mac_data_ap ap;
+  __le32 ctwin;
+  __le32 opp_ps_enabled;
+} __packed; /* GO_MAC_DATA_API_S_VER_1 */
+
+/**
+ * struct iwl_mac_data_p2p_sta - configuration data for P2P client MAC context
+ * @sta: iwl_mac_data_sta struct with most config data
+ * @ctwin: client traffic window in TU (period after TBTT when GO is present).
+ *  0 indicates that there is no CT window.
+ */
+struct iwl_mac_data_p2p_sta {
+  struct iwl_mac_data_sta sta;
+  __le32 ctwin;
+} __packed; /* P2P_STA_MAC_DATA_API_S_VER_2 */
+
+/**
+ * struct iwl_mac_data_pibss - Pseudo IBSS config data
+ * @stats_interval: interval in TU between statistics notifications to host.
+ */
+struct iwl_mac_data_pibss {
+  __le32 stats_interval;
+} __packed; /* PIBSS_MAC_DATA_API_S_VER_1 */
+
+/*
+ * struct iwl_mac_data_p2p_dev - configuration data for the P2P Device MAC
+ * context.
+ * @is_disc_extended: if set to true, P2P Device discoverability is enabled on
+ *  other channels as well. This should be to true only in case that the
+ *  device is discoverable and there is an active GO. Note that setting this
+ *  field when not needed, will increase the number of interrupts and have
+ *  effect on the platform power, as this setting opens the Rx filters on
+ *  all macs.
+ */
+struct iwl_mac_data_p2p_dev {
+  __le32 is_disc_extended;
+} __packed; /* _P2P_DEV_MAC_DATA_API_S_VER_1 */
+
+/**
+ * enum iwl_mac_filter_flags - MAC context filter flags
+ * @MAC_FILTER_IN_PROMISC: accept all data frames
+ * @MAC_FILTER_IN_CONTROL_AND_MGMT: pass all management and
+ *  control frames to the host
+ * @MAC_FILTER_ACCEPT_GRP: accept multicast frames
+ * @MAC_FILTER_DIS_DECRYPT: don't decrypt unicast frames
+ * @MAC_FILTER_DIS_GRP_DECRYPT: don't decrypt multicast frames
+ * @MAC_FILTER_IN_BEACON: transfer foreign BSS's beacons to host
+ *  (in station mode when associated)
+ * @MAC_FILTER_OUT_BCAST: filter out all broadcast frames
+ * @MAC_FILTER_IN_CRC32: extract FCS and append it to frames
+ * @MAC_FILTER_IN_PROBE_REQUEST: pass probe requests to host
+ */
+enum iwl_mac_filter_flags {
+  MAC_FILTER_IN_PROMISC = BIT(0),
+  MAC_FILTER_IN_CONTROL_AND_MGMT = BIT(1),
+  MAC_FILTER_ACCEPT_GRP = BIT(2),
+  MAC_FILTER_DIS_DECRYPT = BIT(3),
+  MAC_FILTER_DIS_GRP_DECRYPT = BIT(4),
+  MAC_FILTER_IN_BEACON = BIT(6),
+  MAC_FILTER_OUT_BCAST = BIT(8),
+  MAC_FILTER_IN_CRC32 = BIT(11),
+  MAC_FILTER_IN_PROBE_REQUEST = BIT(12),
+  /**
+   * @MAC_FILTER_IN_11AX: mark BSS as supporting 802.11ax
+   */
+  MAC_FILTER_IN_11AX = BIT(14),
+};
+
+/**
+ * enum iwl_mac_qos_flags - QoS flags
+ * @MAC_QOS_FLG_UPDATE_EDCA: ?
+ * @MAC_QOS_FLG_TGN: HT is enabled
+ * @MAC_QOS_FLG_TXOP_TYPE: ?
+ *
+ */
+enum iwl_mac_qos_flags {
+  MAC_QOS_FLG_UPDATE_EDCA = BIT(0),
+  MAC_QOS_FLG_TGN = BIT(1),
+  MAC_QOS_FLG_TXOP_TYPE = BIT(4),
+};
+
+/**
+ * struct iwl_ac_qos - QOS timing params for MAC_CONTEXT_CMD
+ * @cw_min: Contention window, start value in numbers of slots.
+ *  Should be a power-of-2, minus 1.  Device's default is 0x0f.
+ * @cw_max: Contention window, max value in numbers of slots.
+ *  Should be a power-of-2, minus 1.  Device's default is 0x3f.
+ * @aifsn:  Number of slots in Arbitration Interframe Space (before
+ *  performing random backoff timing prior to Tx).  Device default 1.
+ * @fifos_mask: FIFOs used by this MAC for this AC
+ * @edca_txop:  Length of Tx opportunity, in uSecs.  Device default is 0.
+ *
+ * One instance of this config struct for each of 4 EDCA access categories
+ * in struct iwl_qosparam_cmd.
+ *
+ * Device will automatically increase contention window by (2*CW) + 1 for each
+ * transmission retry.  Device uses cw_max as a bit mask, ANDed with new CW
+ * value, to cap the CW value.
+ */
+struct iwl_ac_qos {
+  __le16 cw_min;
+  __le16 cw_max;
+  uint8_t aifsn;
+  uint8_t fifos_mask;
+  __le16 edca_txop;
+} __packed; /* AC_QOS_API_S_VER_2 */
+
+/**
+ * struct iwl_mac_ctx_cmd - command structure to configure MAC contexts
+ * ( MAC_CONTEXT_CMD = 0x28 )
+ * @id_and_color: ID and color of the MAC
+ * @action: action to perform, one of FW_CTXT_ACTION_*
+ * @mac_type: one of &enum iwl_mac_types
+ * @tsf_id: TSF HW timer, one of &enum iwl_tsf_id
+ * @node_addr: MAC address
+ * @reserved_for_node_addr: reserved
+ * @bssid_addr: BSSID
+ * @reserved_for_bssid_addr: reserved
+ * @cck_rates: basic rates available for CCK
+ * @ofdm_rates: basic rates available for OFDM
+ * @protection_flags: combination of &enum iwl_mac_protection_flags
+ * @cck_short_preamble: 0x20 for enabling short preamble, 0 otherwise
+ * @short_slot: 0x10 for enabling short slots, 0 otherwise
+ * @filter_flags: combination of &enum iwl_mac_filter_flags
+ * @qos_flags: from &enum iwl_mac_qos_flags
+ * @ac: one iwl_mac_qos configuration for each AC
+ */
+struct iwl_mac_ctx_cmd {
+  /* COMMON_INDEX_HDR_API_S_VER_1 */
+  __le32 id_and_color;
+  __le32 action;
+  /* MAC_CONTEXT_COMMON_DATA_API_S_VER_1 */
+  __le32 mac_type;
+  __le32 tsf_id;
+  uint8_t node_addr[6];
+  __le16 reserved_for_node_addr;
+  uint8_t bssid_addr[6];
+  __le16 reserved_for_bssid_addr;
+  __le32 cck_rates;
+  __le32 ofdm_rates;
+  __le32 protection_flags;
+  __le32 cck_short_preamble;
+  __le32 short_slot;
+  __le32 filter_flags;
+  /* MAC_QOS_PARAM_API_S_VER_1 */
+  __le32 qos_flags;
+  struct iwl_ac_qos ac[AC_NUM + 1];
+  /* MAC_CONTEXT_COMMON_DATA_API_S */
+  union {
+    struct iwl_mac_data_ap ap;
+    struct iwl_mac_data_go go;
+    struct iwl_mac_data_sta sta;
+    struct iwl_mac_data_p2p_sta p2p_sta;
+    struct iwl_mac_data_p2p_dev p2p_dev;
+    struct iwl_mac_data_pibss pibss;
+    struct iwl_mac_data_ibss ibss;
+  };
+} __packed; /* MAC_CONTEXT_CMD_API_S_VER_1 */
+
+#define IWL_NONQOS_SEQ_GET 0x1
+#define IWL_NONQOS_SEQ_SET 0x2
+struct iwl_nonqos_seq_query_cmd {
+  __le32 get_set_flag;
+  __le32 mac_id_n_color;
+  __le16 value;
+  __le16 reserved;
+} __packed; /* NON_QOS_TX_COUNTER_GET_SET_API_S_VER_1 */
+
+/**
+ * struct iwl_missed_beacons_notif - information on missed beacons
+ * ( MISSED_BEACONS_NOTIFICATION = 0xa2 )
+ * @mac_id: interface ID
+ * @consec_missed_beacons_since_last_rx: number of consecutive missed
+ *  beacons since last RX.
+ * @consec_missed_beacons: number of consecutive missed beacons
+ * @num_expected_beacons: number of expected beacons
+ * @num_recvd_beacons: number of received beacons
+ */
+struct iwl_missed_beacons_notif {
+  __le32 mac_id;
+  __le32 consec_missed_beacons_since_last_rx;
+  __le32 consec_missed_beacons;
+  __le32 num_expected_beacons;
+  __le32 num_recvd_beacons;
+} __packed; /* MISSED_BEACON_NTFY_API_S_VER_3 */
+
+/**
+ * struct iwl_he_backoff_conf - used for backoff configuration
+ * Per each trigger-based AC, (set by MU EDCA Parameter set info-element)
+ * used for backoff configuration of TXF5..TXF8 trigger based.
+ * The MU-TIMER is reloaded w/ MU_TIME each time a frame from the AC is sent via
+ * trigger-based TX.
+ * @cwmin: CW min
+ * @cwmax: CW max
+ * @aifsn: AIFSN
+ *  AIFSN=0, means that no backoff from the specified TRIG-BASED AC is
+ *  allowed till the MU-TIMER is 0
+ * @mu_time: MU time in 8TU units
+ */
+struct iwl_he_backoff_conf {
+  __le16 cwmin;
+  __le16 cwmax;
+  __le16 aifsn;
+  __le16 mu_time;
+} __packed; /* AC_QOS_DOT11AX_API_S */
+
+#define MAX_HE_SUPP_NSS 2
+#define MAX_HE_CHANNEL_BW_INDX 4
+
+/**
+ * struct iwl_he_pkt_ext - QAM thresholds
+ * The required PPE is set via HE Capabilities IE, per Nss x BW x MCS
+ * The IE is organized in the following way:
+ * Support for Nss x BW (or RU) matrix:
+ *  (0=SISO, 1=MIMO2) x (0-20MHz, 1-40MHz, 2-80MHz, 3-160MHz)
+ * Each entry contains 2 QAM thresholds for 8us and 16us:
+ *  0=BPSK, 1=QPSK, 2=16QAM, 3=64QAM, 4=256QAM, 5=1024QAM, 6=RES, 7=NONE
+ * i.e. QAM_th1 < QAM_th2 such if TX uses QAM_tx:
+ *  QAM_tx < QAM_th1            --> PPE=0us
+ *  QAM_th1 <= QAM_tx < QAM_th2 --> PPE=8us
+ *  QAM_th2 <= QAM_tx           --> PPE=16us
+ * @pkt_ext_qam_th: QAM thresholds
+ *  For each Nss/Bw define 2 QAM thrsholds (0..5)
+ *  For rates below the low_th, no need for PPE
+ *  For rates between low_th and high_th, need 8us PPE
+ *  For rates equal or higher then the high_th, need 16us PPE
+ *  Nss (0-siso, 1-mimo2) x BW (0-20MHz, 1-40MHz, 2-80MHz, 3-160MHz) x
+ *  (0-low_th, 1-high_th)
+ */
+struct iwl_he_pkt_ext {
+  uint8_t pkt_ext_qam_th[MAX_HE_SUPP_NSS][MAX_HE_CHANNEL_BW_INDX][2];
+} __packed; /* PKT_EXT_DOT11AX_API_S */
+
+/**
+ * enum iwl_he_sta_ctxt_flags - HE STA context flags
+ * @STA_CTXT_HE_REF_BSSID_VALID: ref bssid addr valid (for receiving specific
+ *  control frames such as TRIG, NDPA, BACK)
+ * @STA_CTXT_HE_BSS_COLOR_DIS: BSS color disable, don't use the BSS
+ *  color for RX filter but use MAC header
+ * @STA_CTXT_HE_PARTIAL_BSS_COLOR: partial BSS color allocation
+ * @STA_CTXT_HE_32BIT_BA_BITMAP: indicates the receiver supports BA bitmap
+ *  of 32-bits
+ * @STA_CTXT_HE_PACKET_EXT: indicates that the packet-extension info is valid
+ *  and should be used
+ * @STA_CTXT_HE_TRIG_RND_ALLOC: indicates that trigger based random allocation
+ *  is enabled according to UORA element existence
+ * @STA_CTXT_HE_CONST_TRIG_RND_ALLOC: used for AV testing
+ * @STA_CTXT_HE_ACK_ENABLED: indicates that the AP supports receiving ACK-
+ *  enabled AGG, i.e. both BACK and non-BACK frames in a single AGG
+ * @STA_CTXT_HE_MU_EDCA_CW: indicates that there is an element of MU EDCA
+ *  parameter set, i.e. the backoff counters for trig-based ACs
+ * @STA_CTXT_HE_NIC_NOT_ACK_ENABLED: mark that the NIC doesn't support receiving
+ *  ACK-enabled AGG, (i.e. both BACK and non-BACK frames in single AGG).
+ *  If the NIC is not ACK_ENABLED it may use the EOF-bit in first non-0
+ *  len delim to determine if AGG or single.
+ */
+enum iwl_he_sta_ctxt_flags {
+  STA_CTXT_HE_REF_BSSID_VALID = BIT(4),
+  STA_CTXT_HE_BSS_COLOR_DIS = BIT(5),
+  STA_CTXT_HE_PARTIAL_BSS_COLOR = BIT(6),
+  STA_CTXT_HE_32BIT_BA_BITMAP = BIT(7),
+  STA_CTXT_HE_PACKET_EXT = BIT(8),
+  STA_CTXT_HE_TRIG_RND_ALLOC = BIT(9),
+  STA_CTXT_HE_CONST_TRIG_RND_ALLOC = BIT(10),
+  STA_CTXT_HE_ACK_ENABLED = BIT(11),
+  STA_CTXT_HE_MU_EDCA_CW = BIT(12),
+  STA_CTXT_HE_NIC_NOT_ACK_ENABLED = BIT(13),
+};
+
+/**
+ * enum iwl_he_htc_flags - HE HTC support flags
+ * @IWL_HE_HTC_SUPPORT: HE-HTC support
+ * @IWL_HE_HTC_UL_MU_RESP_SCHED: HE UL MU response schedule
+ *  support via A-control field
+ * @IWL_HE_HTC_BSR_SUPP: BSR support in A-control field
+ * @IWL_HE_HTC_OMI_SUPP: A-OMI support in A-control field
+ * @IWL_HE_HTC_BQR_SUPP: A-BQR support in A-control field
+ */
+enum iwl_he_htc_flags {
+  IWL_HE_HTC_SUPPORT = BIT(0),
+  IWL_HE_HTC_UL_MU_RESP_SCHED = BIT(3),
+  IWL_HE_HTC_BSR_SUPP = BIT(4),
+  IWL_HE_HTC_OMI_SUPP = BIT(5),
+  IWL_HE_HTC_BQR_SUPP = BIT(6),
+};
+
+/*
+ * @IWL_HE_HTC_LINK_ADAP_NO_FEEDBACK: the STA does not provide HE MFB
+ * @IWL_HE_HTC_LINK_ADAP_UNSOLICITED: the STA provides only unsolicited HE MFB
+ * @IWL_HE_HTC_LINK_ADAP_BOTH: the STA is capable of providing HE MFB in
+ *      response to HE MRQ and if the STA provides unsolicited HE MFB
+ */
+#define IWL_HE_HTC_LINK_ADAP_POS (1)
+#define IWL_HE_HTC_LINK_ADAP_NO_FEEDBACK (0)
+#define IWL_HE_HTC_LINK_ADAP_UNSOLICITED (2 << IWL_HE_HTC_LINK_ADAP_POS)
+#define IWL_HE_HTC_LINK_ADAP_BOTH (3 << IWL_HE_HTC_LINK_ADAP_POS)
+
+/**
+ * struct iwl_he_sta_context_cmd - configure FW to work with HE AP
+ * @sta_id: STA id
+ * @tid_limit: max num of TIDs in TX HE-SU multi-TID agg
+ *  0 - bad value, 1 - multi-tid not supported, 2..8 - tid limit
+ * @reserved1: reserved byte for future use
+ * @reserved2: reserved byte for future use
+ * @flags: see %iwl_11ax_sta_ctxt_flags
+ * @ref_bssid_addr: reference BSSID used by the AP
+ * @reserved0: reserved 2 bytes for aligning the ref_bssid_addr field to 8 bytes
+ * @htc_flags: which features are supported in HTC
+ * @frag_flags: frag support in A-MSDU
+ * @frag_level: frag support level
+ * @frag_max_num: max num of "open" MSDUs in the receiver (in power of 2)
+ * @frag_min_size: min frag size (except last frag)
+ * @pkt_ext: optional, exists according to PPE-present bit in the HE-PHY capa
+ * @bss_color: 11ax AP ID that is used in the HE SIG-A to mark inter BSS frame
+ * @htc_trig_based_pkt_ext: default PE in 4us units
+ * @frame_time_rts_th: HE duration RTS threshold, in units of 32us
+ * @rand_alloc_ecwmin: random CWmin = 2**ECWmin-1
+ * @rand_alloc_ecwmax: random CWmax = 2**ECWmax-1
+ * @reserved3: reserved byte for future use
+ * @trig_based_txf: MU EDCA Parameter set for the trigger based traffic queues
+ */
+struct iwl_he_sta_context_cmd {
+  uint8_t sta_id;
+  uint8_t tid_limit;
+  uint8_t reserved1;
+  uint8_t reserved2;
+  __le32 flags;
+
+  /* The below fields are set via Multiple BSSID IE */
+  uint8_t ref_bssid_addr[6];
+  __le16 reserved0;
+
+  /* The below fields are set via HE-capabilities IE */
+  __le32 htc_flags;
+
+  uint8_t frag_flags;
+  uint8_t frag_level;
+  uint8_t frag_max_num;
+  uint8_t frag_min_size;
+
+  /* The below fields are set via PPE thresholds element */
+  struct iwl_he_pkt_ext pkt_ext;
+
+  /* The below fields are set via HE-Operation IE */
+  uint8_t bss_color;
+  uint8_t htc_trig_based_pkt_ext;
+  __le16 frame_time_rts_th;
+
+  /* Random access parameter set (i.e. RAPS) */
+  uint8_t rand_alloc_ecwmin;
+  uint8_t rand_alloc_ecwmax;
+  __le16 reserved3;
+
+  /* The below fields are set via MU EDCA parameter set element */
+  struct iwl_he_backoff_conf trig_based_txf[AC_NUM];
+} __packed; /* STA_CONTEXT_DOT11AX_API_S */
+
+/**
+ * struct iwl_he_monitor_cmd - configure air sniffer for HE
+ * @bssid: the BSSID to sniff for
+ * @reserved1: reserved for dword alignment
+ * @aid: the AID to track on for HE MU
+ * @reserved2: reserved for future use
+ */
+struct iwl_he_monitor_cmd {
+  uint8_t bssid[6];
+  __le16 reserved1;
+  __le16 aid;
+  uint8_t reserved2[6];
+} __packed; /* HE_AIR_SNIFFER_CONFIG_CMD_API_S_VER_1 */
+
+#endif  // SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_MAC_H_
diff --git a/third_party/iwlwifi/fw/api/nan.h b/third_party/iwlwifi/fw/api/nan.h
new file mode 100644
index 0000000..9c4e750
--- /dev/null
+++ b/third_party/iwlwifi/fw/api/nan.h
@@ -0,0 +1,486 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2015-2017 Intel Deutschland GmbH
+ * Copyright(c) 2018        Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+
+#ifndef SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_NAN_H_
+#define SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_NAN_H_
+
+#include <stdint.h>
+
+#include "src/iwlwifi/fw/api/phy-ctxt.h"
+#include "src/iwlwifi/platform/compiler.h"
+
+/* TODO: read it from tlv */
+#define NAN_MAX_SUPPORTED_DE_ENTRIES 10
+
+/**
+ * enum iwl_nan_subcmd_ids - Neighbor Awareness Networking (NaN) commands IDS
+ */
+enum iwl_nan_subcmd_ids {
+  /**
+   * @NAN_CONFIG_CMD:
+   * &struct iwl_nan_cfg_cmd_v2 or &struct iwl_nan_cfg_cmd
+   */
+  NAN_CONFIG_CMD = 0,
+
+  /**
+   * @NAN_DISCOVERY_FUNC_CMD:
+   * &struct iwl_nan_add_func_cmd or &struct iwl_nan_add_func_cmd_v2
+   */
+  NAN_DISCOVERY_FUNC_CMD = 0x1,
+
+  /**
+   * @NAN_FAW_CONFIG_CMD:
+   * &struct iwl_nan_faw_config
+   */
+  NAN_FAW_CONFIG_CMD = 0x2,
+
+  /**
+   * @NAN_DISCOVERY_EVENT_NOTIF:
+   * &struct iwl_nan_disc_evt_notify_v1 or
+   * &struct iwl_nan_disc_evt_notify_v2
+   */
+  NAN_DISCOVERY_EVENT_NOTIF = 0xFD,
+
+  /**
+   * @NAN_DISCOVERY_TERMINATE_NOTIF:
+   * &struct iwl_nan_de_term
+   */
+  NAN_DISCOVERY_TERMINATE_NOTIF = 0xFE,
+
+  /**
+   * @NAN_FAW_START_NOTIF:
+   * Further availability window started.
+   */
+  NAN_FAW_START_NOTIF = 0xFF,
+};
+
+/**
+ * struct iwl_fw_chan_avail - Defines per op. class channel availability
+ *
+ * @op_class: operating class
+ * @chan_bitmap: channel bitmap
+ */
+struct iwl_fw_chan_avail {
+  uint8_t op_class;
+  __le16 chan_bitmap;
+} __packed;
+
+/**
+ * struct iwl_nan_umac_cfg - NAN umac config parameters
+ *
+ * @action: one of the FW_CTXT_ACTION_*
+ * @tsf_id: tsf id to use in beacons
+ * @sta_id: STA used for NAN operations. Currently it is AUX STA.
+ * @node_addr: our address
+ * @reserved1: reserved
+ * @master_pref: master preference value
+ * @master_rand: random factor to override fw's decision (DEBUG)
+ * @cluster_id: cluster id, if 0 the fw will choose one for us.
+ * @dual_band: enables dual band operation.
+ * @beacon_template_id: beacon template id for NAN
+ */
+struct iwl_nan_umac_cfg {
+  __le32 action;
+  __le32 tsf_id;
+  __le32 sta_id;
+  uint8_t node_addr[6];
+  __le16 reserved1;
+  uint8_t master_pref;
+  uint8_t master_rand;
+  __le16 cluster_id;
+  __le32 dual_band;
+  __le32 beacon_template_id;
+} __packed; /* _NAN_UMAC_CONFIG_CMD_API_S_VER_1 */
+
+/**
+ * struct iwl_nan_testbed_cfg - NAN testbed specific config parameters
+ *
+ * @chan24: override default 2.4GHz channel (DEBUG)
+ * @chan52: override default 5.2GHz channel (DEBUG)
+ * @hop_count: fake hop count (DEBUG)
+ * @op_bands: band bit mask (DEBUG)
+ * @warmup_timer: warmup_timer in us (DEBUG)
+ * @custom_tsf: fake tsf value (DEBUG)
+ * @action_delay: usecs to delay SDFs (DEBUG)
+ */
+struct iwl_nan_testbed_cfg {
+  uint8_t chan24;
+  uint8_t chan52;
+  uint8_t hop_count;
+  uint8_t op_bands;
+  __le32 warmup_timer;
+  __le64 custom_tsf;
+  __le32 action_delay;
+} __packed; /* NAN_TEST_BED_SPECIFIC_CONFIG_S_VER_1 */
+
+/*
+ * struct iwl_nan_nan2_cfg - NAN2 specific configuration
+ *
+ * @cdw: committed DW interval as defined in NAN2 spec (NAN2)
+ * @op_mode: operation mode as defined in NAN2 spec (NAN2)
+ * @pot_avail_len: length of pot_avail array (NAN2)
+ * @pot_avail: potential availability per op. class (NAN2)
+ */
+struct iwl_nan_nan2_cfg {
+  __le16 cdw;
+  uint8_t op_mode;
+  uint8_t pot_avail_len;
+  struct iwl_fw_chan_avail pot_avail[20];
+} __packed; /* NAN_CONFIG_CMD_API_S_VER_1 */
+
+/**
+ * struct iwl_nan_cfg_cmd - NAN configuration command
+ *
+ * This command starts/stops/modifies NAN sync engine.
+ *
+ * @umac_cfg: umac specific configuration
+ * @tb_cfg: testbed specific configuration
+ * @nan2_cfg: nan2 specific configuration
+ */
+struct iwl_nan_cfg_cmd {
+  struct iwl_nan_umac_cfg umac_cfg;
+  struct iwl_nan_testbed_cfg tb_cfg;
+  /* NAN 2 specific configuration */
+  struct iwl_nan_nan2_cfg nan2_cfg;
+} __packed; /* NAN_CONFIG_CMD_API_S_VER_1 */
+
+/**
+ * struct iwl_nan_cfg_cmd_v2 - NAN configuration command, version 2
+ *
+ * This command starts/stops/modifies NAN sync engine.
+ *
+ * @umac_cfg: umac specific configuration
+ * @tb_cfg: testbed specific configuration
+ * @unavailable_slots: Force this amount of slots to be unavailable in potential
+ *  map
+ * @nan2_cfg: nan2 specific configuration
+ */
+struct iwl_nan_cfg_cmd_v2 {
+  struct iwl_nan_umac_cfg umac_cfg;
+  struct iwl_nan_testbed_cfg tb_cfg;
+  __le32 unavailable_slots;
+  /* NAN 2 specific configuration */
+  struct iwl_nan_nan2_cfg nan2_cfg;
+} __packed; /* NAN_CONFIG_CMD_API_S_VER_2 */
+
+/* NAN DE function type */
+enum iwl_fw_nan_func_type {
+  IWL_NAN_DE_FUNC_PUBLISH = 0,
+  IWL_NAN_DE_FUNC_SUBSCRIBE = 1,
+  IWL_NAN_DE_FUNC_FOLLOW_UP = 2,
+
+  /* keep last */
+  IWL_NAN_DE_FUNC_NOT_VALID,
+};
+
+/* NAN DE function flags */
+enum iwl_fw_nan_func_flags {
+  IWL_NAN_DE_FUNC_FLAG_UNSOLICITED_OR_ACTIVE = BIT(0),
+  IWL_NAN_DE_FUNC_FLAG_SOLICITED = BIT(1),
+  IWL_NAN_DE_FUNC_FLAG_UNICAST = BIT(2),
+  IWL_NAN_DE_FUNC_FLAG_CLOSE_RANGE = BIT(3),
+  IWL_NAN_DE_FUNC_FLAG_FAW_PRESENT = BIT(4),
+  IWL_NAN_DE_FUNC_FLAG_FAW_TYPE = BIT(5),
+  IWL_NAN_DE_FUNC_FLAG_FAW_NOTIFY = BIT(6),
+  IWL_NAN_DE_FUNC_FLAG_RAISE_EVENTS = BIT(7),
+};
+
+/**
+ * struct iwl_nan_add_func_common - NAN add/remove function, common part
+ *
+ * @action: one of the FW_CTXT_ACTION_ADD/REMOVE
+ * @instance_id: instance id of the DE function to remove
+ * @type: enum %iwl_fw_nan_func_type
+ * @service_id: service id
+ * @flags: a combination of &enum iwl_fw_nan_func_flags
+ * @flw_up_id: follow up id
+ * @flw_up_req_id: follow up requestor id
+ * @flw_up_addr: follow up destination address
+ * @reserved1: reserved
+ * @ttl: ttl in DW's or 0 for infinite
+ * @faw_ci: &struct iwl_fw_channel_info for further availability
+ * @faw_attrtype: further availability bitmap
+ * @serv_info_len: length of service specific information
+ * @srf_len: length of the srf
+ * @rx_filter_len: length of rx filter
+ * @tx_filter_len: length of tx filter
+ * @dw_interval: awake dw interval
+ */
+struct iwl_nan_add_func_common {
+  __le32 action;
+  uint8_t instance_id;
+  uint8_t type;
+  uint8_t service_id[6];
+  __le16 flags;
+  uint8_t flw_up_id;
+  uint8_t flw_up_req_id;
+  uint8_t flw_up_addr[6];
+  __le16 reserved1;
+  __le32 ttl;
+  struct iwl_fw_channel_info faw_ci;
+  uint8_t faw_attrtype;
+  uint8_t serv_info_len;
+  uint8_t srf_len;
+  uint8_t rx_filter_len;
+  uint8_t tx_filter_len;
+  uint8_t dw_interval;
+} __packed; /* NAN_DISCO_FUNC_FIXED_CMD_API_S_VER_1 */
+
+/**
+ * struct iwl_nan_add_func_cmd_v2 - NAN add/remove function command, version 2
+ *
+ * @cmn: nan add function common part
+ * @cipher_capa: Cipher suite information capabilities
+ * @cipher_suite_id: Bitmap of the list of cipher suite IDs
+ * @security_ctx_len: length of tx security context attributes
+ * @sdea_ctrl: SDEA control field
+ * @data: dw aligned fields: service_info, srf, rxFilter, txFilter,
+ *  security_ctx
+ */
+struct iwl_nan_add_func_cmd_v2 {
+  struct iwl_nan_add_func_common cmn;
+  uint8_t cipher_capa;
+  uint8_t cipher_suite_id;
+  __le16 security_ctx_len;
+  __le16 sdea_ctrl;
+  uint8_t data[0];
+} __packed; /* NAN_DISCO_FUNC_FIXED_CMD_API_S_VER_2 */
+
+/**
+ * struct iwl_nan_add_func_cmd - NAN add/remove function command
+ *
+ * @cmn: nan add function common part
+ * @reserved: reserved
+ * @data: dw aligned fields -service_info, srf, rxFilter, txFilter
+ */
+struct iwl_nan_add_func_cmd {
+  struct iwl_nan_add_func_common cmn;
+  uint8_t reserved[2];
+  uint8_t data[0];
+} __packed; /* NAN_DISCO_FUNC_FIXED_CMD_API_S_VER_1 */
+
+enum iwl_nan_add_func_resp_status {
+  IWL_NAN_DE_FUNC_STATUS_SUCCESSFUL,
+  IWL_NAN_DE_FUNC_STATUS_INSUFFICIENT_ENTRIES,
+  IWL_NAN_DE_FUNC_STATUS_INSUFFICIENT_MEMORY,
+  IWL_NAN_DE_FUNC_STATUS_INVALID_INSTANCE,
+  IWL_NAN_DE_FUNC_STATUS_UNSPECIFIED,
+};
+
+/**
+ * struct iwl_nan_add_func_res - Add NAN function response
+ *
+ * @instance_id: assigned instance_id (if added)
+ * @status: status of the command (&enum iwl_nan_add_func_resp_status)
+ * @reserved: reserved
+ */
+struct iwl_nan_add_func_res {
+  uint8_t instance_id;
+  uint8_t status;
+  __le16 reserved;
+} __packed; /* NAN_DISCO_FUNC_CMD_API_S_VER_1 */
+
+/* Shared key cipher suite with CCMP with a 128 bit TK */
+#define IWL_NAN_DE_FUNC_CS_SK_CCM_128 BIT(0)
+
+/* Shared key cipher suite with GCMP with a 256 bit TK */
+#define IWL_NAN_DE_FUNC_CS_SK_GCM_256 BIT(1)
+
+/**
+ * enum iwl_nan_de_func_sdea_flags - NAN func SDEA flags
+ * @IWL_NAN_DE_FUNC_SDEA_FSD_REQ: Further Service Discovery (FSD) is required
+ *     for the service
+ * @IWL_NAN_DE_FUNC_SDEA_FSD_GAS: GAS is used for FSD
+ * @IWL_NAN_DE_FUNC_SDEA_DP_REQ: Data path required for the service
+ * @IWL_NAN_DE_FUNC_SDEA_DP_MCAST: If data path is required, the type is
+ *     multicast
+ * @IWL_NAN_DE_FUNC_SDEA_DP_MCAST_M_TO_M:if multicast data path is required then
+ *     it is many to many
+ * @IWL_NAN_DE_FUNC_SDEA_QOS_REQ: QoS is required for the service
+ * @IWL_NAN_DE_FUNC_SDEA_SEC_REQ: Security is required for the service
+ * @IWL_NAN_DE_FUNC_SDEA_RANGIGN_REQ: Ranging is required prior to subscription
+ *     to the service
+ */
+enum iwl_nan_de_func_sdea_flags {
+  IWL_NAN_DE_FUNC_SDEA_FSD_REQ = BIT(0),
+  IWL_NAN_DE_FUNC_SDEA_FSD_GAS = BIT(1),
+  IWL_NAN_DE_FUNC_SDEA_DP_REQ = BIT(2),
+  IWL_NAN_DE_FUNC_SDEA_DP_MCAST = BIT(3),
+  IWL_NAN_DE_FUNC_SDEA_DP_MCAST_M_TO_M = BIT(4),
+  IWL_NAN_DE_FUNC_SDEA_QOS_REQ = BIT(5),
+  IWL_NAN_DE_FUNC_SDEA_SEC_REQ = BIT(6),
+  IWL_NAN_DE_FUNC_SDEA_RANGIGN_REQ = BIT(7),
+};
+
+/**
+ * struct iwl_nan_disc_evt_notify_v1 - NaN discovery event
+ *
+ * @peer_mac_addr: peer address
+ * @reserved1: reserved
+ * @type: Type of matching function
+ * @instance_id: local matching instance id
+ * @peer_instance: peer matching instance id
+ * @service_info_len: service specific information length
+ * @attrs_len: additional peer attributes length
+ * @buf: service specific information followed by attributes
+ */
+struct iwl_nan_disc_evt_notify_v1 {
+  uint8_t peer_mac_addr[6];
+  __le16 reserved1;
+  uint8_t type;
+  uint8_t instance_id;
+  uint8_t peer_instance;
+  uint8_t service_info_len;
+  __le32 attrs_len;
+  uint8_t buf[0];
+} __packed; /* NAN_DISCO_EVENT_NTFY_API_S_VER_1 */
+
+/**
+ * struct iwl_nan_sec_ctxt_info - NaN security context information
+ *
+ * @type: the security context type
+ * @reserved: for alignment
+ * @len: the length of the security context
+ * @buf: security context data
+ */
+struct iwl_nan_sec_ctxt_info {
+  uint8_t type;
+  uint8_t reserved;
+  __le16 len;
+  uint8_t buf[0];
+} __packed; /* NAN_DISCO_SEC_CTXT_ID_API_S_VER_1 */
+
+/**
+ * struct iwl_nan_disc_info - NaN match information
+ *
+ * @type: Type of matching function
+ * @instance_id: local matching instance id
+ * @peer_instance: peer matching instance id
+ * @service_info_len: service specific information length
+ * @sdea_control: bit mask of &enum iwl_nan_de_func_sdea_flags_
+ * @sdea_service_info_len: sdea service specific information length
+ * @sec_ctxt_len: security context information length
+ * @cipher_suite_ids: bit mask of cipher suite IDs
+ * @sdea_update_indicator: update indicator from the sdea attribute
+ * @buf: service specific information followed by sdea service specific
+ *     information and by security context information which encapsulates 0 or
+ *     more iwl_nan_sec_ctxt_info entries.
+ */
+struct iwl_nan_disc_info {
+  uint8_t type;
+  uint8_t instance_id;
+  uint8_t peer_instance;
+  uint8_t service_info_len;
+  __le16 sdea_control;
+  __le16 sdea_service_info_len;
+  __le16 sec_ctxt_len;
+  uint8_t cipher_suite_ids;
+  uint8_t sdea_update_indicator;
+  uint8_t buf[0];
+} __packed; /* NAN_DISCO_INFO_API_S_VER_1 */
+
+/**
+ * struct iwl_nan_disc_evt_notify_v2 - NaN discovery information
+ *
+ * @peer_mac_addr: peer address
+ * @reserved1: reserved
+ * @match_len: Length of the match data
+ * @avail_attrs_len: Length of the availability attributes associated with the
+ *     peer
+ * @buf: aggregation of matches, each starting on a dword aligned address,
+ *     followed by the peer availability attributes, which also start on a
+ *     dword aligned address.
+ */
+struct iwl_nan_disc_evt_notify_v2 {
+  uint8_t peer_mac_addr[6];
+  __le16 reserved1;
+  __le32 match_len;
+  __le32 avail_attrs_len;
+  uint8_t buf[0];
+} __packed; /* NAN_DISCO_EVENT_NTFY_API_S_VER_2 */
+
+/* NAN function termination reasons */
+enum iwl_fw_nan_de_term_reason {
+  IWL_NAN_DE_TERM_FAILURE = 0,
+  IWL_NAN_DE_TERM_TTL_REACHED,
+  IWL_NAN_DE_TERM_USER_REQUEST,
+};
+
+/**
+ * struct iwl_nan_de_term - NAN function termination event
+ *
+ * @type: type of terminated function (&enum iwl_fw_nan_func_type)
+ * @instance_id: instance id
+ * @reason: termination reason (&enum iwl_fw_nan_de_term_reason)
+ * @reserved1: reserved
+ */
+struct iwl_nan_de_term {
+  uint8_t type;
+  uint8_t instance_id;
+  uint8_t reason;
+  uint8_t reserved1;
+} __packed; /* NAN_DISCO_TERM_NTFY_API_S_VER_1 */
+
+enum iwl_fw_post_nan_type {
+  IWL_NAN_POST_NAN_ATTR_WLAN = 0,
+  IWL_NAN_POST_NAN_ATTR_P2P,
+  IWL_NAN_POST_NAN_ATTR_IBSS,
+  IWL_NAN_POST_NAN_ATTR_MESH,
+  IWL_NAN_POST_NAN_ATTR_FURTHER_NAN,
+};
+
+enum iwl_fw_config_flags {
+  NAN_FAW_FLAG_NOTIFY_HOST = BIT(0),
+};
+
+/**
+ * struct iwl_nan_faw_config - NAN further availability configuration command
+ *
+ * @id_n_color: id and color of the mac used for further availability
+ * @faw_ci: channel to be available on
+ * @type: type of post NAN availability (enum %iwl_fw_post_nan_type)
+ * @slots: number of 16TU slots to be available on (should be < 32)
+ * @flags: NAN_FAW_FLAG_*
+ * @op_class: operating class which corresponds to faw_ci
+ */
+struct iwl_nan_faw_config {
+  __le32 id_n_color;
+  struct iwl_fw_channel_info faw_ci;
+  uint8_t type;
+  uint8_t slots;
+  uint8_t flags;
+  uint8_t op_class;
+} __packed; /* _NAN_DISCO_FAW_CMD_API_S_VER_1 */
+
+#endif  // SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_NAN_H_
diff --git a/third_party/iwlwifi/fw/api/nvm-reg.h b/third_party/iwlwifi/fw/api/nvm-reg.h
new file mode 100644
index 0000000..dfed61f
--- /dev/null
+++ b/third_party/iwlwifi/fw/api/nvm-reg.h
@@ -0,0 +1,381 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * Copyright (C) 2018 Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+
+#ifndef SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_NVM_REG_H_
+#define SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_NVM_REG_H_
+
+#include "src/iwlwifi/platform/compiler.h"
+
+/**
+ * enum iwl_regulatory_and_nvm_subcmd_ids - regulatory/NVM commands
+ */
+enum iwl_regulatory_and_nvm_subcmd_ids {
+  /**
+   * @NVM_ACCESS_COMPLETE: &struct iwl_nvm_access_complete_cmd
+   */
+  NVM_ACCESS_COMPLETE = 0x0,
+
+  /**
+   * @NVM_GET_INFO:
+   * Command is &struct iwl_nvm_get_info,
+   * response is &struct iwl_nvm_get_info_rsp
+   */
+  NVM_GET_INFO = 0x2,
+};
+
+/**
+ * enum iwl_nvm_access_op - NVM access opcode
+ * @IWL_NVM_READ: read NVM
+ * @IWL_NVM_WRITE: write NVM
+ */
+enum iwl_nvm_access_op {
+  IWL_NVM_READ = 0,
+  IWL_NVM_WRITE = 1,
+};
+
+/**
+ * enum iwl_nvm_access_target - target of the NVM_ACCESS_CMD
+ * @NVM_ACCESS_TARGET_CACHE: access the cache
+ * @NVM_ACCESS_TARGET_OTP: access the OTP
+ * @NVM_ACCESS_TARGET_EEPROM: access the EEPROM
+ */
+enum iwl_nvm_access_target {
+  NVM_ACCESS_TARGET_CACHE = 0,
+  NVM_ACCESS_TARGET_OTP = 1,
+  NVM_ACCESS_TARGET_EEPROM = 2,
+};
+
+/**
+ * enum iwl_nvm_section_type - section types for NVM_ACCESS_CMD
+ * @NVM_SECTION_TYPE_SW: software section
+ * @NVM_SECTION_TYPE_REGULATORY: regulatory section
+ * @NVM_SECTION_TYPE_CALIBRATION: calibration section
+ * @NVM_SECTION_TYPE_PRODUCTION: production section
+ * @NVM_SECTION_TYPE_REGULATORY_SDP: regulatory section used by 3168 series
+ * @NVM_SECTION_TYPE_MAC_OVERRIDE: MAC override section
+ * @NVM_SECTION_TYPE_PHY_SKU: PHY SKU section
+ * @NVM_MAX_NUM_SECTIONS: number of sections
+ */
+enum iwl_nvm_section_type {
+  NVM_SECTION_TYPE_SW = 1,
+  NVM_SECTION_TYPE_REGULATORY = 3,
+  NVM_SECTION_TYPE_CALIBRATION = 4,
+  NVM_SECTION_TYPE_PRODUCTION = 5,
+  NVM_SECTION_TYPE_REGULATORY_SDP = 8,
+  NVM_SECTION_TYPE_MAC_OVERRIDE = 11,
+  NVM_SECTION_TYPE_PHY_SKU = 12,
+  NVM_MAX_NUM_SECTIONS = 13,
+};
+
+/**
+ * struct iwl_nvm_access_cmd - Request the device to send an NVM section
+ * @op_code: &enum iwl_nvm_access_op
+ * @target: &enum iwl_nvm_access_target
+ * @type: &enum iwl_nvm_section_type
+ * @offset: offset in bytes into the section
+ * @length: in bytes, to read/write
+ * @data: if write operation, the data to write. On read its empty
+ */
+struct iwl_nvm_access_cmd {
+  uint8_t op_code;
+  uint8_t target;
+  __le16 type;
+  __le16 offset;
+  __le16 length;
+  uint8_t data[];
+} __packed; /* NVM_ACCESS_CMD_API_S_VER_2 */
+
+/**
+ * struct iwl_nvm_access_resp_ver2 - response to NVM_ACCESS_CMD
+ * @offset: offset in bytes into the section
+ * @length: in bytes, either how much was written or read
+ * @type: NVM_SECTION_TYPE_*
+ * @status: 0 for success, fail otherwise
+ * @data: if read operation, the data returned. Empty on write.
+ */
+struct iwl_nvm_access_resp {
+  __le16 offset;
+  __le16 length;
+  __le16 type;
+  __le16 status;
+  uint8_t data[];
+} __packed; /* NVM_ACCESS_CMD_RESP_API_S_VER_2 */
+
+/*
+ * struct iwl_nvm_get_info - request to get NVM data
+ */
+struct iwl_nvm_get_info {
+  __le32 reserved;
+} __packed; /* REGULATORY_NVM_GET_INFO_CMD_API_S_VER_1 */
+
+/**
+ * enum iwl_nvm_info_general_flags - flags in NVM_GET_INFO resp
+ * @NVM_GENERAL_FLAGS_EMPTY_OTP: 1 if OTP is empty
+ */
+enum iwl_nvm_info_general_flags {
+  NVM_GENERAL_FLAGS_EMPTY_OTP = BIT(0),
+};
+
+/**
+ * struct iwl_nvm_get_info_general - general NVM data
+ * @flags: bit 0: 1 - empty, 0 - non-empty
+ * @nvm_version: nvm version
+ * @board_type: board type
+ * @n_hw_addrs: number of reserved MAC addresses
+ */
+struct iwl_nvm_get_info_general {
+  __le32 flags;
+  __le16 nvm_version;
+  uint8_t board_type;
+  uint8_t n_hw_addrs;
+} __packed; /* REGULATORY_NVM_GET_INFO_GENERAL_S_VER_2 */
+
+/**
+ * enum iwl_nvm_mac_sku_flags - flags in &iwl_nvm_get_info_sku
+ * @NVM_MAC_SKU_FLAGS_BAND_2_4_ENABLED: true if 2.4 band enabled
+ * @NVM_MAC_SKU_FLAGS_BAND_5_2_ENABLED: true if 5.2 band enabled
+ * @NVM_MAC_SKU_FLAGS_802_11N_ENABLED: true if 11n enabled
+ * @NVM_MAC_SKU_FLAGS_802_11AC_ENABLED: true if 11ac enabled
+ * @NVM_MAC_SKU_FLAGS_MIMO_DISABLED: true if MIMO disabled
+ * @NVM_MAC_SKU_FLAGS_WAPI_ENABLED: true if WAPI enabled
+ * @NVM_MAC_SKU_FLAGS_REG_CHECK_ENABLED: true if regulatory checker enabled
+ * @NVM_MAC_SKU_FLAGS_API_LOCK_ENABLED: true if API lock enabled
+ */
+enum iwl_nvm_mac_sku_flags {
+  NVM_MAC_SKU_FLAGS_BAND_2_4_ENABLED = BIT(0),
+  NVM_MAC_SKU_FLAGS_BAND_5_2_ENABLED = BIT(1),
+  NVM_MAC_SKU_FLAGS_802_11N_ENABLED = BIT(2),
+  NVM_MAC_SKU_FLAGS_802_11AC_ENABLED = BIT(3),
+  /**
+   * @NVM_MAC_SKU_FLAGS_802_11AX_ENABLED: true if 11ax enabled
+   */
+  NVM_MAC_SKU_FLAGS_802_11AX_ENABLED = BIT(4),
+  NVM_MAC_SKU_FLAGS_MIMO_DISABLED = BIT(5),
+  NVM_MAC_SKU_FLAGS_WAPI_ENABLED = BIT(8),
+  NVM_MAC_SKU_FLAGS_REG_CHECK_ENABLED = BIT(14),
+  NVM_MAC_SKU_FLAGS_API_LOCK_ENABLED = BIT(15),
+};
+
+/**
+ * struct iwl_nvm_get_info_sku - mac information
+ * @mac_sku_flags: flags for SKU, see &enum iwl_nvm_mac_sku_flags
+ */
+struct iwl_nvm_get_info_sku {
+  __le32 mac_sku_flags;
+} __packed; /* REGULATORY_NVM_GET_INFO_MAC_SKU_SECTION_S_VER_2 */
+
+/**
+ * struct iwl_nvm_get_info_phy - phy information
+ * @tx_chains: BIT 0 chain A, BIT 1 chain B
+ * @rx_chains: BIT 0 chain A, BIT 1 chain B
+ */
+struct iwl_nvm_get_info_phy {
+  __le32 tx_chains;
+  __le32 rx_chains;
+} __packed; /* REGULATORY_NVM_GET_INFO_PHY_SKU_SECTION_S_VER_1 */
+
+#define IWL_NUM_CHANNELS (51)
+
+/**
+ * struct iwl_nvm_get_info_regulatory - regulatory information
+ * @lar_enabled: is LAR enabled
+ * @channel_profile: regulatory data of this channel
+ * @reserved: reserved
+ */
+struct iwl_nvm_get_info_regulatory {
+  __le32 lar_enabled;
+  __le16 channel_profile[IWL_NUM_CHANNELS];
+  __le16 reserved;
+} __packed; /* REGULATORY_NVM_GET_INFO_REGULATORY_S_VER_1 */
+
+/**
+ * struct iwl_nvm_get_info_rsp - response to get NVM data
+ * @general: general NVM data
+ * @mac_sku: data relating to MAC sku
+ * @phy_sku: data relating to PHY sku
+ * @regulatory: regulatory data
+ */
+struct iwl_nvm_get_info_rsp {
+  struct iwl_nvm_get_info_general general;
+  struct iwl_nvm_get_info_sku mac_sku;
+  struct iwl_nvm_get_info_phy phy_sku;
+  struct iwl_nvm_get_info_regulatory regulatory;
+} __packed; /* REGULATORY_NVM_GET_INFO_RSP_API_S_VER_3 */
+
+/**
+ * struct iwl_nvm_access_complete_cmd - NVM_ACCESS commands are completed
+ * @reserved: reserved
+ */
+struct iwl_nvm_access_complete_cmd {
+  __le32 reserved;
+} __packed; /* NVM_ACCESS_COMPLETE_CMD_API_S_VER_1 */
+
+/**
+ * struct iwl_mcc_update_cmd - Request the device to update geographic
+ * regulatory profile according to the given MCC (Mobile Country Code).
+ * The MCC is two letter-code, ascii upper case[A-Z] or '00' for world domain.
+ * 'ZZ' MCC will be used to switch to NVM default profile; in this case, the
+ * MCC in the cmd response will be the relevant MCC in the NVM.
+ * @mcc: given mobile country code
+ * @source_id: the source from where we got the MCC, see iwl_mcc_source
+ * @reserved: reserved for alignment
+ * @key: integrity key for MCC API OEM testing
+ * @reserved2: reserved
+ */
+struct iwl_mcc_update_cmd {
+  __le16 mcc;
+  uint8_t source_id;
+  uint8_t reserved;
+  __le32 key;
+  uint8_t reserved2[20];
+} __packed; /* LAR_UPDATE_MCC_CMD_API_S_VER_2 */
+
+/**
+ * enum iwl_geo_information - geographic information.
+ * @GEO_NO_INFO: no special info for this geo profile.
+ * @GEO_WMM_ETSI_5GHZ_INFO: this geo profile limits the WMM params
+ *  for the 5 GHz band.
+ */
+enum iwl_geo_information {
+  GEO_NO_INFO = 0,
+  GEO_WMM_ETSI_5GHZ_INFO = BIT(0),
+};
+
+/**
+ * struct iwl_mcc_update_resp_v3 - response to MCC_UPDATE_CMD.
+ * Contains the new channel control profile map, if changed, and the new MCC
+ * (mobile country code).
+ * The new MCC may be different than what was requested in MCC_UPDATE_CMD.
+ * @status: see &enum iwl_mcc_update_status
+ * @mcc: the new applied MCC
+ * @cap: capabilities for all channels which matches the MCC
+ * @source_id: the MCC source, see iwl_mcc_source
+ * @time: time elapsed from the MCC test start (in units of 30 seconds)
+ * @geo_info: geographic specific profile information
+ *  see &enum iwl_geo_information.
+ * @n_channels: number of channels in @channels_data.
+ * @channels: channel control data map, DWORD for each channel. Only the first
+ *  16bits are used.
+ */
+struct iwl_mcc_update_resp_v3 {
+  __le32 status;
+  __le16 mcc;
+  uint8_t cap;
+  uint8_t source_id;
+  __le16 time;
+  __le16 geo_info;
+  __le32 n_channels;
+  __le32 channels[0];
+} __packed; /* LAR_UPDATE_MCC_CMD_RESP_S_VER_3 */
+
+/**
+ * struct iwl_mcc_update_resp - response to MCC_UPDATE_CMD.
+ * Contains the new channel control profile map, if changed, and the new MCC
+ * (mobile country code).
+ * The new MCC may be different than what was requested in MCC_UPDATE_CMD.
+ * @status: see &enum iwl_mcc_update_status
+ * @mcc: the new applied MCC
+ * @cap: capabilities for all channels which matches the MCC
+ * @time: time elapsed from the MCC test start (in units of 30 seconds)
+ * @geo_info: geographic specific profile information
+ *  see &enum iwl_geo_information.
+ * @source_id: the MCC source, see iwl_mcc_source
+ * @reserved: for four bytes alignment.
+ * @n_channels: number of channels in @channels_data.
+ * @channels: channel control data map, DWORD for each channel. Only the first
+ *  16bits are used.
+ */
+struct iwl_mcc_update_resp {
+  __le32 status;
+  __le16 mcc;
+  __le16 cap;
+  __le16 time;
+  __le16 geo_info;
+  uint8_t source_id;
+  uint8_t reserved[3];
+  __le32 n_channels;
+  __le32 channels[0];
+} __packed; /* LAR_UPDATE_MCC_CMD_RESP_S_VER_4 */
+
+/**
+ * struct iwl_mcc_chub_notif - chub notifies of mcc change
+ * (MCC_CHUB_UPDATE_CMD = 0xc9)
+ * The Chub (Communication Hub, CommsHUB) is a HW component that connects to
+ * the cellular and connectivity cores that gets updates of the mcc, and
+ * notifies the ucode directly of any mcc change.
+ * The ucode requests the driver to request the device to update geographic
+ * regulatory  profile according to the given MCC (Mobile Country Code).
+ * The MCC is two letter-code, ascii upper case[A-Z] or '00' for world domain.
+ * 'ZZ' MCC will be used to switch to NVM default profile; in this case, the
+ * MCC in the cmd response will be the relevant MCC in the NVM.
+ * @mcc: given mobile country code
+ * @source_id: identity of the change originator, see iwl_mcc_source
+ * @reserved1: reserved for alignment
+ */
+struct iwl_mcc_chub_notif {
+  __le16 mcc;
+  uint8_t source_id;
+  uint8_t reserved1;
+} __packed; /* LAR_MCC_NOTIFY_S */
+
+enum iwl_mcc_update_status {
+  MCC_RESP_NEW_CHAN_PROFILE,
+  MCC_RESP_SAME_CHAN_PROFILE,
+  MCC_RESP_INVALID,
+  MCC_RESP_NVM_DISABLED,
+  MCC_RESP_ILLEGAL,
+  MCC_RESP_LOW_PRIORITY,
+  MCC_RESP_TEST_MODE_ACTIVE,
+  MCC_RESP_TEST_MODE_NOT_ACTIVE,
+  MCC_RESP_TEST_MODE_DENIAL_OF_SERVICE,
+};
+
+enum iwl_mcc_source {
+  MCC_SOURCE_OLD_FW = 0,
+  MCC_SOURCE_ME = 1,
+  MCC_SOURCE_BIOS = 2,
+  MCC_SOURCE_3G_LTE_HOST = 3,
+  MCC_SOURCE_3G_LTE_DEVICE = 4,
+  MCC_SOURCE_WIFI = 5,
+  MCC_SOURCE_RESERVED = 6,
+  MCC_SOURCE_DEFAULT = 7,
+  MCC_SOURCE_UNINITIALIZED = 8,
+  MCC_SOURCE_MCC_API = 9,
+  MCC_SOURCE_GET_CURRENT = 0x10,
+  MCC_SOURCE_GETTING_MCC_TEST_MODE = 0x11,
+};
+
+#endif  // SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_NVM_REG_H_
diff --git a/third_party/iwlwifi/fw/api/offload.h b/third_party/iwlwifi/fw/api/offload.h
new file mode 100644
index 0000000..ac7393f
--- /dev/null
+++ b/third_party/iwlwifi/fw/api/offload.h
@@ -0,0 +1,76 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+
+#ifndef SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_OFFLOAD_H_
+#define SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_OFFLOAD_H_
+
+#include "src/iwlwifi/platform/compiler.h"
+
+/**
+ * enum iwl_prot_offload_subcmd_ids - protocol offload commands
+ */
+enum iwl_prot_offload_subcmd_ids {
+  /**
+   * @STORED_BEACON_NTF: &struct iwl_stored_beacon_notif
+   */
+  STORED_BEACON_NTF = 0xFF,
+};
+
+#define MAX_STORED_BEACON_SIZE 600
+
+/**
+ * struct iwl_stored_beacon_notif - Stored beacon notification
+ *
+ * @system_time: system time on air rise
+ * @tsf: TSF on air rise
+ * @beacon_timestamp: beacon on air rise
+ * @band: band, matches &RX_RES_PHY_FLAGS_BAND_24 definition
+ * @channel: channel this beacon was received on
+ * @rates: rate in ucode internal format
+ * @byte_count: frame's byte count
+ * @data: beacon data, length in @byte_count
+ */
+struct iwl_stored_beacon_notif {
+  __le32 system_time;
+  __le64 tsf;
+  __le32 beacon_timestamp;
+  __le16 band;
+  __le16 channel;
+  __le32 rates;
+  __le32 byte_count;
+  uint8_t data[MAX_STORED_BEACON_SIZE];
+} __packed; /* WOWLAN_STROED_BEACON_INFO_S_VER_2 */
+
+#endif  // SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_OFFLOAD_H_
diff --git a/third_party/iwlwifi/fw/api/paging.h b/third_party/iwlwifi/fw/api/paging.h
new file mode 100644
index 0000000..1929618
--- /dev/null
+++ b/third_party/iwlwifi/fw/api/paging.h
@@ -0,0 +1,59 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+#ifndef SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_PAGING_H_
+#define SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_PAGING_H_
+
+#include "src/iwlwifi/platform/compiler.h"
+
+#define NUM_OF_FW_PAGING_BLOCKS 33 /* 32 for data and 1 block for CSS */
+
+/**
+ * struct iwl_fw_paging_cmd - paging layout
+ *
+ * Send to FW the paging layout in the driver.
+ *
+ * @flags: various flags for the command
+ * @block_size: the block size in powers of 2
+ * @block_num: number of blocks specified in the command.
+ * @device_phy_addr: virtual addresses from device side
+ */
+struct iwl_fw_paging_cmd {
+  __le32 flags;
+  __le32 block_size;
+  __le32 block_num;
+  __le32 device_phy_addr[NUM_OF_FW_PAGING_BLOCKS];
+} __packed; /* FW_PAGING_BLOCK_CMD_API_S_VER_1 */
+
+#endif  // SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_PAGING_H_
diff --git a/third_party/iwlwifi/fw/api/phy-ctxt.h b/third_party/iwlwifi/fw/api/phy-ctxt.h
new file mode 100644
index 0000000..98cba15
--- /dev/null
+++ b/third_party/iwlwifi/fw/api/phy-ctxt.h
@@ -0,0 +1,132 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+
+#ifndef SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_PHY_CTXT_H_
+#define SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_PHY_CTXT_H_
+
+#include "src/iwlwifi/platform/compiler.h"
+
+/* Supported bands */
+#define PHY_BAND_5 (0)
+#define PHY_BAND_24 (1)
+
+/* Supported channel width, vary if there is VHT support */
+#define PHY_VHT_CHANNEL_MODE20 (0x0)
+#define PHY_VHT_CHANNEL_MODE40 (0x1)
+#define PHY_VHT_CHANNEL_MODE80 (0x2)
+#define PHY_VHT_CHANNEL_MODE160 (0x3)
+
+/*
+ * Control channel position:
+ * For legacy set bit means upper channel, otherwise lower.
+ * For VHT - bit-2 marks if the control is lower/upper relative to center-freq
+ *   bits-1:0 mark the distance from the center freq. for 20Mhz, offset is 0.
+ *                                   center_freq
+ *                                        |
+ * 40Mhz                          |_______|_______|
+ * 80Mhz                  |_______|_______|_______|_______|
+ * 160Mhz |_______|_______|_______|_______|_______|_______|_______|_______|
+ * code      011     010     001     000  |  100     101     110    111
+ */
+#define PHY_VHT_CTRL_POS_1_BELOW (0x0)
+#define PHY_VHT_CTRL_POS_2_BELOW (0x1)
+#define PHY_VHT_CTRL_POS_3_BELOW (0x2)
+#define PHY_VHT_CTRL_POS_4_BELOW (0x3)
+#define PHY_VHT_CTRL_POS_1_ABOVE (0x4)
+#define PHY_VHT_CTRL_POS_2_ABOVE (0x5)
+#define PHY_VHT_CTRL_POS_3_ABOVE (0x6)
+#define PHY_VHT_CTRL_POS_4_ABOVE (0x7)
+
+/*
+ * @band: PHY_BAND_*
+ * @channel: channel number
+ * @width: PHY_[VHT|LEGACY]_CHANNEL_*
+ * @ctrl channel: PHY_[VHT|LEGACY]_CTRL_*
+ */
+struct iwl_fw_channel_info {
+  uint8_t band;
+  uint8_t channel;
+  uint8_t width;
+  uint8_t ctrl_pos;
+} __packed;
+
+#define PHY_RX_CHAIN_DRIVER_FORCE_POS (0)
+#define PHY_RX_CHAIN_DRIVER_FORCE_MSK (0x1 << PHY_RX_CHAIN_DRIVER_FORCE_POS)
+#define PHY_RX_CHAIN_VALID_POS (1)
+#define PHY_RX_CHAIN_VALID_MSK (0x7 << PHY_RX_CHAIN_VALID_POS)
+#define PHY_RX_CHAIN_FORCE_SEL_POS (4)
+#define PHY_RX_CHAIN_FORCE_SEL_MSK (0x7 << PHY_RX_CHAIN_FORCE_SEL_POS)
+#define PHY_RX_CHAIN_FORCE_MIMO_SEL_POS (7)
+#define PHY_RX_CHAIN_FORCE_MIMO_SEL_MSK (0x7 << PHY_RX_CHAIN_FORCE_MIMO_SEL_POS)
+#define PHY_RX_CHAIN_CNT_POS (10)
+#define PHY_RX_CHAIN_CNT_MSK (0x3 << PHY_RX_CHAIN_CNT_POS)
+#define PHY_RX_CHAIN_MIMO_CNT_POS (12)
+#define PHY_RX_CHAIN_MIMO_CNT_MSK (0x3 << PHY_RX_CHAIN_MIMO_CNT_POS)
+#define PHY_RX_CHAIN_MIMO_FORCE_POS (14)
+#define PHY_RX_CHAIN_MIMO_FORCE_MSK (0x1 << PHY_RX_CHAIN_MIMO_FORCE_POS)
+
+/* TODO: fix the value, make it depend on firmware at runtime? */
+#define NUM_PHY_CTX 3
+
+/* TODO: complete missing documentation */
+/**
+ * struct iwl_phy_context_cmd - config of the PHY context
+ * ( PHY_CONTEXT_CMD = 0x8 )
+ * @id_and_color: ID and color of the relevant Binding
+ * @action: action to perform, one of FW_CTXT_ACTION_*
+ * @apply_time: 0 means immediate apply and context switch.
+ *  other value means apply new params after X usecs
+ * @tx_param_color: ???
+ * @ci: channel info
+ * @txchain_info: ???
+ * @rxchain_info: ???
+ * @acquisition_data: ???
+ * @dsp_cfg_flags: set to 0
+ */
+struct iwl_phy_context_cmd {
+  /* COMMON_INDEX_HDR_API_S_VER_1 */
+  __le32 id_and_color;
+  __le32 action;
+  /* PHY_CONTEXT_DATA_API_S_VER_1 */
+  __le32 apply_time;
+  __le32 tx_param_color;
+  struct iwl_fw_channel_info ci;
+  __le32 txchain_info;
+  __le32 rxchain_info;
+  __le32 acquisition_data;
+  __le32 dsp_cfg_flags;
+} __packed; /* PHY_CONTEXT_CMD_API_VER_1 */
+
+#endif  // SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_PHY_CTXT_H_
diff --git a/third_party/iwlwifi/fw/api/phy.h b/third_party/iwlwifi/fw/api/phy.h
new file mode 100644
index 0000000..2e26d70
--- /dev/null
+++ b/third_party/iwlwifi/fw/api/phy.h
@@ -0,0 +1,233 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+
+#ifndef SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_PHY_H_
+#define SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_PHY_H_
+
+#include "src/iwlwifi/platform/compiler.h"
+
+/**
+ * enum iwl_phy_ops_subcmd_ids - PHY group commands
+ */
+enum iwl_phy_ops_subcmd_ids {
+  /**
+   * @CMD_DTS_MEASUREMENT_TRIGGER_WIDE:
+   * Uses either &struct iwl_dts_measurement_cmd or
+   * &struct iwl_ext_dts_measurement_cmd
+   */
+  CMD_DTS_MEASUREMENT_TRIGGER_WIDE = 0x0,
+
+  /**
+   * @CTDP_CONFIG_CMD: &struct iwl_mvm_ctdp_cmd
+   */
+  CTDP_CONFIG_CMD = 0x03,
+
+  /**
+   * @TEMP_REPORTING_THRESHOLDS_CMD: &struct temp_report_ths_cmd
+   */
+  TEMP_REPORTING_THRESHOLDS_CMD = 0x04,
+
+  /**
+   * @GEO_TX_POWER_LIMIT: &struct iwl_geo_tx_power_profiles_cmd
+   */
+  GEO_TX_POWER_LIMIT = 0x05,
+
+  /**
+   * @CT_KILL_NOTIFICATION: &struct ct_kill_notif
+   */
+  CT_KILL_NOTIFICATION = 0xFE,
+
+  /**
+   * @DTS_MEASUREMENT_NOTIF_WIDE:
+   * &struct iwl_dts_measurement_notif_v1 or
+   * &struct iwl_dts_measurement_notif_v2
+   */
+  DTS_MEASUREMENT_NOTIF_WIDE = 0xFF,
+};
+
+/* DTS measurements */
+
+enum iwl_dts_measurement_flags {
+  DTS_TRIGGER_CMD_FLAGS_TEMP = BIT(0),
+  DTS_TRIGGER_CMD_FLAGS_VOLT = BIT(1),
+};
+
+/**
+ * struct iwl_dts_measurement_cmd - request DTS temp and/or voltage measurements
+ *
+ * @flags: indicates which measurements we want as specified in
+ *  &enum iwl_dts_measurement_flags
+ */
+struct iwl_dts_measurement_cmd {
+  __le32 flags;
+} __packed; /* TEMPERATURE_MEASUREMENT_TRIGGER_CMD_S */
+
+/**
+ * enum iwl_dts_control_measurement_mode - DTS measurement type
+ * @DTS_AUTOMATIC: Automatic mode (full SW control). Provide temperature read
+ *                 back (latest value. Not waiting for new value). Use automatic
+ *                 SW DTS configuration.
+ * @DTS_REQUEST_READ: Request DTS read. Configure DTS with manual settings,
+ *                    trigger DTS reading and provide read back temperature read
+ *                    when available.
+ * @DTS_OVER_WRITE: over-write the DTS temperatures in the SW until next read
+ * @DTS_DIRECT_WITHOUT_MEASURE: DTS returns its latest temperature result,
+ *                              without measurement trigger.
+ */
+enum iwl_dts_control_measurement_mode {
+  DTS_AUTOMATIC = 0,
+  DTS_REQUEST_READ = 1,
+  DTS_OVER_WRITE = 2,
+  DTS_DIRECT_WITHOUT_MEASURE = 3,
+};
+
+/**
+ * enum iwl_dts_used - DTS to use or used for measurement in the DTS request
+ * @DTS_USE_TOP: Top
+ * @DTS_USE_CHAIN_A: chain A
+ * @DTS_USE_CHAIN_B: chain B
+ * @DTS_USE_CHAIN_C: chain C
+ * @XTAL_TEMPERATURE: read temperature from xtal
+ */
+enum iwl_dts_used {
+  DTS_USE_TOP = 0,
+  DTS_USE_CHAIN_A = 1,
+  DTS_USE_CHAIN_B = 2,
+  DTS_USE_CHAIN_C = 3,
+  XTAL_TEMPERATURE = 4,
+};
+
+/**
+ * enum iwl_dts_bit_mode - bit-mode to use in DTS request read mode
+ * @DTS_BIT6_MODE: bit 6 mode
+ * @DTS_BIT8_MODE: bit 8 mode
+ */
+enum iwl_dts_bit_mode {
+  DTS_BIT6_MODE = 0,
+  DTS_BIT8_MODE = 1,
+};
+
+/**
+ * struct iwl_ext_dts_measurement_cmd - request extended DTS temp measurements
+ * @control_mode: see &enum iwl_dts_control_measurement_mode
+ * @temperature: used when over write DTS mode is selected
+ * @sensor: set temperature sensor to use. See &enum iwl_dts_used
+ * @avg_factor: average factor to DTS in request DTS read mode
+ * @bit_mode: value defines the DTS bit mode to use. See &enum iwl_dts_bit_mode
+ * @step_duration: step duration for the DTS
+ */
+struct iwl_ext_dts_measurement_cmd {
+  __le32 control_mode;
+  __le32 temperature;
+  __le32 sensor;
+  __le32 avg_factor;
+  __le32 bit_mode;
+  __le32 step_duration;
+} __packed; /* XVT_FW_DTS_CONTROL_MEASUREMENT_REQUEST_API_S */
+
+/**
+ * struct iwl_dts_measurement_notif_v1 - measurements notification
+ *
+ * @temp: the measured temperature
+ * @voltage: the measured voltage
+ */
+struct iwl_dts_measurement_notif_v1 {
+  __le32 temp;
+  __le32 voltage;
+} __packed; /* TEMPERATURE_MEASUREMENT_TRIGGER_NTFY_S_VER_1*/
+
+/**
+ * struct iwl_dts_measurement_notif_v2 - measurements notification
+ *
+ * @temp: the measured temperature
+ * @voltage: the measured voltage
+ * @threshold_idx: the trip index that was crossed
+ */
+struct iwl_dts_measurement_notif_v2 {
+  __le32 temp;
+  __le32 voltage;
+  __le32 threshold_idx;
+} __packed; /* TEMPERATURE_MEASUREMENT_TRIGGER_NTFY_S_VER_2 */
+
+/**
+ * struct ct_kill_notif - CT-kill entry notification
+ *
+ * @temperature: the current temperature in celsius
+ * @reserved: reserved
+ */
+struct ct_kill_notif {
+  __le16 temperature;
+  __le16 reserved;
+} __packed; /* GRP_PHY_CT_KILL_NTF */
+
+/**
+ * enum ctdp_cmd_operation - CTDP command operations
+ * @CTDP_CMD_OPERATION_START: update the current budget
+ * @CTDP_CMD_OPERATION_STOP: stop ctdp
+ * @CTDP_CMD_OPERATION_REPORT: get the average budget
+ */
+enum iwl_mvm_ctdp_cmd_operation {
+  CTDP_CMD_OPERATION_START = 0x1,
+  CTDP_CMD_OPERATION_STOP = 0x2,
+  CTDP_CMD_OPERATION_REPORT = 0x4,
+}; /* CTDP_CMD_OPERATION_TYPE_E */
+
+/**
+ * struct iwl_mvm_ctdp_cmd - track and manage the FW power consumption budget
+ *
+ * @operation: see &enum iwl_mvm_ctdp_cmd_operation
+ * @budget: the budget in milliwatt
+ * @window_size: defined in API but not used
+ */
+struct iwl_mvm_ctdp_cmd {
+  __le32 operation;
+  __le32 budget;
+  __le32 window_size;
+} __packed;
+
+#define IWL_MAX_DTS_TRIPS 8
+
+/**
+ * struct temp_report_ths_cmd - set temperature thresholds
+ *
+ * @num_temps: number of temperature thresholds passed
+ * @thresholds: array with the thresholds to be configured
+ */
+struct temp_report_ths_cmd {
+  __le32 num_temps;
+  __le16 thresholds[IWL_MAX_DTS_TRIPS];
+} __packed; /* GRP_PHY_TEMP_REPORTING_THRESHOLDS_CMD */
+
+#endif  // SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_PHY_H_
diff --git a/third_party/iwlwifi/fw/api/power.h b/third_party/iwlwifi/fw/api/power.h
new file mode 100644
index 0000000..04ed405
--- /dev/null
+++ b/third_party/iwlwifi/fw/api/power.h
@@ -0,0 +1,524 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
+ * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
+ * Copyright (C) 2018 Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+
+#ifndef SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_POWER_H_
+#define SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_POWER_H_
+
+#include "src/iwlwifi/platform/compiler.h"
+
+/* Power Management Commands, Responses, Notifications */
+
+/**
+ * enum iwl_ltr_config_flags - masks for LTR config command flags
+ * @LTR_CFG_FLAG_FEATURE_ENABLE: Feature operational status
+ * @LTR_CFG_FLAG_HW_DIS_ON_SHADOW_REG_ACCESS: allow LTR change on shadow
+ *  memory access
+ * @LTR_CFG_FLAG_HW_EN_SHRT_WR_THROUGH: allow LTR msg send on ANY LTR
+ *  reg change
+ * @LTR_CFG_FLAG_HW_DIS_ON_D0_2_D3: allow LTR msg send on transition from
+ *  D0 to D3
+ * @LTR_CFG_FLAG_SW_SET_SHORT: fixed static short LTR register
+ * @LTR_CFG_FLAG_SW_SET_LONG: fixed static short LONG register
+ * @LTR_CFG_FLAG_DENIE_C10_ON_PD: allow going into C10 on PD
+ * @LTR_CFG_FLAG_UPDATE_VALUES: update config values and short
+ *  idle timeout
+ */
+enum iwl_ltr_config_flags {
+  LTR_CFG_FLAG_FEATURE_ENABLE = BIT(0),
+  LTR_CFG_FLAG_HW_DIS_ON_SHADOW_REG_ACCESS = BIT(1),
+  LTR_CFG_FLAG_HW_EN_SHRT_WR_THROUGH = BIT(2),
+  LTR_CFG_FLAG_HW_DIS_ON_D0_2_D3 = BIT(3),
+  LTR_CFG_FLAG_SW_SET_SHORT = BIT(4),
+  LTR_CFG_FLAG_SW_SET_LONG = BIT(5),
+  LTR_CFG_FLAG_DENIE_C10_ON_PD = BIT(6),
+  LTR_CFG_FLAG_UPDATE_VALUES = BIT(7),
+};
+
+/**
+ * struct iwl_ltr_config_cmd_v1 - configures the LTR
+ * @flags: See &enum iwl_ltr_config_flags
+ * @static_long: static LTR Long register value.
+ * @static_short: static LTR Short register value.
+ */
+struct iwl_ltr_config_cmd_v1 {
+  __le32 flags;
+  __le32 static_long;
+  __le32 static_short;
+} __packed; /* LTR_CAPABLE_API_S_VER_1 */
+
+#define LTR_VALID_STATES_NUM 4
+
+/**
+ * struct iwl_ltr_config_cmd - configures the LTR
+ * @flags: See &enum iwl_ltr_config_flags
+ * @static_long: static LTR Long register value.
+ * @static_short: static LTR Short register value.
+ * @ltr_cfg_values: LTR parameters table values (in usec) in folowing order:
+ *  TX, RX, Short Idle, Long Idle. Used only if %LTR_CFG_FLAG_UPDATE_VALUES
+ *  is set.
+ * @ltr_short_idle_timeout: LTR Short Idle timeout (in usec). Used only if
+ *  %LTR_CFG_FLAG_UPDATE_VALUES is set.
+ */
+struct iwl_ltr_config_cmd {
+  __le32 flags;
+  __le32 static_long;
+  __le32 static_short;
+  __le32 ltr_cfg_values[LTR_VALID_STATES_NUM];
+  __le32 ltr_short_idle_timeout;
+} __packed; /* LTR_CAPABLE_API_S_VER_2 */
+
+/* Radio LP RX Energy Threshold measured in dBm */
+#define POWER_LPRX_RSSI_THRESHOLD 75
+#define POWER_LPRX_RSSI_THRESHOLD_MAX 94
+#define POWER_LPRX_RSSI_THRESHOLD_MIN 30
+
+/**
+ * enum iwl_power_flags - masks for power table command flags
+ * @POWER_FLAGS_POWER_SAVE_ENA_MSK: '1' Allow to save power by turning off
+ *      receiver and transmitter. '0' - does not allow.
+ * @POWER_FLAGS_POWER_MANAGEMENT_ENA_MSK: '0' Driver disables power management,
+ *      '1' Driver enables PM (use rest of parameters)
+ * @POWER_FLAGS_SKIP_OVER_DTIM_MSK: '0' PM have to walk up every DTIM,
+ *      '1' PM could sleep over DTIM till listen Interval.
+ * @POWER_FLAGS_SNOOZE_ENA_MSK: Enable snoozing only if uAPSD is enabled and all
+ *      access categories are both delivery and trigger enabled.
+ * @POWER_FLAGS_BT_SCO_ENA: Enable BT SCO coex only if uAPSD and
+ *      PBW Snoozing enabled
+ * @POWER_FLAGS_ADVANCE_PM_ENA_MSK: Advanced PM (uAPSD) enable mask
+ * @POWER_FLAGS_LPRX_ENA_MSK: Low Power RX enable.
+ * @POWER_FLAGS_UAPSD_MISBEHAVING_ENA_MSK: AP/GO's uAPSD misbehaving
+ *      detection enablement
+ */
+enum iwl_power_flags {
+  POWER_FLAGS_POWER_SAVE_ENA_MSK = BIT(0),
+  POWER_FLAGS_POWER_MANAGEMENT_ENA_MSK = BIT(1),
+  POWER_FLAGS_SKIP_OVER_DTIM_MSK = BIT(2),
+  POWER_FLAGS_SNOOZE_ENA_MSK = BIT(5),
+  POWER_FLAGS_BT_SCO_ENA = BIT(8),
+  POWER_FLAGS_ADVANCE_PM_ENA_MSK = BIT(9),
+  POWER_FLAGS_LPRX_ENA_MSK = BIT(11),
+  POWER_FLAGS_UAPSD_MISBEHAVING_ENA_MSK = BIT(12),
+};
+
+#define IWL_POWER_VEC_SIZE 5
+
+/**
+ * struct iwl_powertable_cmd - legacy power command. Beside old API support this
+ *  is used also with a new power API for device wide power settings.
+ * POWER_TABLE_CMD = 0x77 (command, has simple generic response)
+ *
+ * @flags:      Power table command flags from POWER_FLAGS_*
+ * @keep_alive_seconds: Keep alive period in seconds. Default - 25 sec.
+ *          Minimum allowed:- 3 * DTIM. Keep alive period must be
+ *          set regardless of power scheme or current power state.
+ *          FW use this value also when PM is disabled.
+ * @debug_flags:    debug flags
+ * @rx_data_timeout:    Minimum time (usec) from last Rx packet for AM to
+ *          PSM transition - legacy PM
+ * @tx_data_timeout:    Minimum time (usec) from last Tx packet for AM to
+ *          PSM transition - legacy PM
+ * @sleep_interval: not in use
+ * @skip_dtim_periods:  Number of DTIM periods to skip if Skip over DTIM flag
+ *          is set. For example, if it is required to skip over
+ *          one DTIM, this value need to be set to 2 (DTIM periods).
+ * @lprx_rssi_threshold: Signal strength up to which LP RX can be enabled.
+ *          Default: 80dbm
+ */
+struct iwl_powertable_cmd {
+  /* PM_POWER_TABLE_CMD_API_S_VER_6 */
+  __le16 flags;
+  uint8_t keep_alive_seconds;
+  uint8_t debug_flags;
+  __le32 rx_data_timeout;
+  __le32 tx_data_timeout;
+  __le32 sleep_interval[IWL_POWER_VEC_SIZE];
+  __le32 skip_dtim_periods;
+  __le32 lprx_rssi_threshold;
+} __packed;
+
+/**
+ * enum iwl_device_power_flags - masks for device power command flags
+ * @DEVICE_POWER_FLAGS_POWER_SAVE_ENA_MSK:
+ *  '1' Allow to save power by turning off
+ *  receiver and transmitter. '0' - does not allow.
+ */
+enum iwl_device_power_flags {
+  DEVICE_POWER_FLAGS_POWER_SAVE_ENA_MSK = BIT(0),
+};
+
+/**
+ * struct iwl_device_power_cmd - device wide power command.
+ * DEVICE_POWER_CMD = 0x77 (command, has simple generic response)
+ *
+ * @flags:  Power table command flags from &enum iwl_device_power_flags
+ * @reserved: reserved (padding)
+ */
+struct iwl_device_power_cmd {
+  /* PM_POWER_TABLE_CMD_API_S_VER_6 */
+  __le16 flags;
+  __le16 reserved;
+} __packed;
+
+/**
+ * struct iwl_mac_power_cmd - New power command containing uAPSD support
+ * MAC_PM_POWER_TABLE = 0xA9 (command, has simple generic response)
+ * @id_and_color:   MAC contex identifier, &enum iwl_ctxt_id_and_color
+ * @flags:      Power table command flags from POWER_FLAGS_*
+ * @keep_alive_seconds: Keep alive period in seconds. Default - 25 sec.
+ *          Minimum allowed:- 3 * DTIM. Keep alive period must be
+ *          set regardless of power scheme or current power state.
+ *          FW use this value also when PM is disabled.
+ * @rx_data_timeout:    Minimum time (usec) from last Rx packet for AM to
+ *          PSM transition - legacy PM
+ * @tx_data_timeout:    Minimum time (usec) from last Tx packet for AM to
+ *          PSM transition - legacy PM
+ * @skip_dtim_periods:  Number of DTIM periods to skip if Skip over DTIM flag
+ *          is set. For example, if it is required to skip over
+ *          one DTIM, this value need to be set to 2 (DTIM periods).
+ * @rx_data_timeout_uapsd: Minimum time (usec) from last Rx packet for AM to
+ *          PSM transition - uAPSD
+ * @tx_data_timeout_uapsd: Minimum time (usec) from last Tx packet for AM to
+ *          PSM transition - uAPSD
+ * @lprx_rssi_threshold: Signal strength up to which LP RX can be enabled.
+ *          Default: 80dbm
+ * @snooze_interval:    Maximum time between attempts to retrieve buffered data
+ *          from the AP [msec]
+ * @snooze_window:  A window of time in which PBW snoozing insures that all
+ *          packets received. It is also the minimum time from last
+ *          received unicast RX packet, before client stops snoozing
+ *          for data. [msec]
+ * @snooze_step:    TBD
+ * @qndp_tid:       TID client shall use for uAPSD QNDP triggers
+ * @uapsd_ac_flags: Set trigger-enabled and delivery-enabled indication for
+ *          each corresponding AC.
+ *          Use IEEE80211_WMM_IE_STA_QOSINFO_AC* for correct values.
+ * @uapsd_max_sp:   Use IEEE80211_WMM_IE_STA_QOSINFO_SP_* for correct
+ *          values.
+ * @heavy_tx_thld_packets:  TX threshold measured in number of packets
+ * @heavy_rx_thld_packets:  RX threshold measured in number of packets
+ * @heavy_tx_thld_percentage:   TX threshold measured in load's percentage
+ * @heavy_rx_thld_percentage:   RX threshold measured in load's percentage
+ * @limited_ps_threshold: (unused)
+ * @reserved: reserved (padding)
+ */
+struct iwl_mac_power_cmd {
+  /* CONTEXT_DESC_API_T_VER_1 */
+  __le32 id_and_color;
+
+  /* CLIENT_PM_POWER_TABLE_S_VER_1 */
+  __le16 flags;
+  __le16 keep_alive_seconds;
+  __le32 rx_data_timeout;
+  __le32 tx_data_timeout;
+  __le32 rx_data_timeout_uapsd;
+  __le32 tx_data_timeout_uapsd;
+  uint8_t lprx_rssi_threshold;
+  uint8_t skip_dtim_periods;
+  __le16 snooze_interval;
+  __le16 snooze_window;
+  uint8_t snooze_step;
+  uint8_t qndp_tid;
+  uint8_t uapsd_ac_flags;
+  uint8_t uapsd_max_sp;
+  uint8_t heavy_tx_thld_packets;
+  uint8_t heavy_rx_thld_packets;
+  uint8_t heavy_tx_thld_percentage;
+  uint8_t heavy_rx_thld_percentage;
+  uint8_t limited_ps_threshold;
+  uint8_t reserved;
+} __packed;
+
+/*
+ * struct iwl_uapsd_misbehaving_ap_notif - FW sends this notification when
+ * associated AP is identified as improperly implementing uAPSD protocol.
+ * PSM_UAPSD_AP_MISBEHAVING_NOTIFICATION = 0x78
+ * @sta_id: index of station in uCode's station table - associated AP ID in
+ *      this context.
+ */
+struct iwl_uapsd_misbehaving_ap_notif {
+  __le32 sta_id;
+  uint8_t mac_id;
+  uint8_t reserved[3];
+} __packed;
+
+/**
+ * struct iwl_reduce_tx_power_cmd - TX power reduction command
+ * REDUCE_TX_POWER_CMD = 0x9f
+ * @flags: (reserved for future implementation)
+ * @mac_context_id: id of the mac ctx for which we are reducing TX power.
+ * @pwr_restriction: TX power restriction in dBms.
+ */
+struct iwl_reduce_tx_power_cmd {
+  uint8_t flags;
+  uint8_t mac_context_id;
+  __le16 pwr_restriction;
+} __packed; /* TX_REDUCED_POWER_API_S_VER_1 */
+
+enum iwl_dev_tx_power_cmd_mode {
+  IWL_TX_POWER_MODE_SET_MAC = 0,
+  IWL_TX_POWER_MODE_SET_DEVICE = 1,
+  IWL_TX_POWER_MODE_SET_CHAINS = 2,
+  IWL_TX_POWER_MODE_SET_ACK = 3,
+  IWL_TX_POWER_MODE_SET_SAR_TIMER = 4,
+  IWL_TX_POWER_MODE_SET_SAR_TIMER_DEFAULT_TABLE = 5,
+}; /* TX_POWER_REDUCED_FLAGS_TYPE_API_E_VER_5 */
+
+#define IWL_NUM_CHAIN_LIMITS 2
+#define IWL_NUM_SUB_BANDS 5
+
+/**
+ * struct iwl_dev_tx_power_cmd - TX power reduction command
+ * @set_mode: see &enum iwl_dev_tx_power_cmd_mode
+ * @mac_context_id: id of the mac ctx for which we are reducing TX power.
+ * @pwr_restriction: TX power restriction in 1/8 dBms.
+ * @dev_24: device TX power restriction in 1/8 dBms
+ * @dev_52_low: device TX power restriction upper band - low
+ * @dev_52_high: device TX power restriction upper band - high
+ * @per_chain_restriction: per chain restrictions
+ */
+struct iwl_dev_tx_power_cmd_v3 {
+  __le32 set_mode;
+  __le32 mac_context_id;
+  __le16 pwr_restriction;
+  __le16 dev_24;
+  __le16 dev_52_low;
+  __le16 dev_52_high;
+  __le16 per_chain_restriction[IWL_NUM_CHAIN_LIMITS][IWL_NUM_SUB_BANDS];
+} __packed; /* TX_REDUCED_POWER_API_S_VER_3 */
+
+#define IWL_DEV_MAX_TX_POWER 0x7FFF
+
+/**
+ * struct iwl_dev_tx_power_cmd - TX power reduction command
+ * @v3: version 3 of the command, embedded here for easier software handling
+ * @enable_ack_reduction: enable or disable close range ack TX power
+ *  reduction.
+ * @reserved: reserved (padding)
+ */
+struct iwl_dev_tx_power_cmd_v4 {
+  /* v4 is just an extension of v3 - keep this here */
+  struct iwl_dev_tx_power_cmd_v3 v3;
+  uint8_t enable_ack_reduction;
+  uint8_t reserved[3];
+} __packed; /* TX_REDUCED_POWER_API_S_VER_4 */
+
+/**
+ * struct iwl_dev_tx_power_cmd - TX power reduction command
+ * @v3: version 3 of the command, embedded here for easier software handling
+ * @enable_ack_reduction: enable or disable close range ack TX power
+ *  reduction.
+ * @per_chain_restriction_changed: is per_chain_restriction has changed
+ *  from last command. used if set_mode is
+ *  IWL_TX_POWER_MODE_SET_SAR_TIMER.
+ *  note: if not changed, the command is used for keep alive only.
+ * @reserved: reserved (padding)
+ * @timer_period: timer in milliseconds. if expires FW will change to default
+ *  BIOS values. relevant if setMode is IWL_TX_POWER_MODE_SET_SAR_TIMER
+ */
+struct iwl_dev_tx_power_cmd {
+  /* v5 is just an extension of v3 - keep this here */
+  struct iwl_dev_tx_power_cmd_v3 v3;
+  uint8_t enable_ack_reduction;
+  uint8_t per_chain_restriction_changed;
+  uint8_t reserved[2];
+  __le32 timer_period;
+} __packed; /* TX_REDUCED_POWER_API_S_VER_5 */
+
+#define IWL_NUM_GEO_PROFILES 3
+
+/**
+ * enum iwl_geo_per_chain_offset_operation - type of operation
+ * @IWL_PER_CHAIN_OFFSET_SET_TABLES: send the tables from the host to the FW.
+ * @IWL_PER_CHAIN_OFFSET_GET_CURRENT_TABLE: retrieve the last configured table.
+ */
+enum iwl_geo_per_chain_offset_operation {
+  IWL_PER_CHAIN_OFFSET_SET_TABLES,
+  IWL_PER_CHAIN_OFFSET_GET_CURRENT_TABLE,
+}; /* GEO_TX_POWER_LIMIT FLAGS TYPE */
+
+/**
+ * struct iwl_per_chain_offset - embedded struct for GEO_TX_POWER_LIMIT.
+ * @max_tx_power: maximum allowed tx power.
+ * @chain_a: tx power offset for chain a.
+ * @chain_b: tx power offset for chain b.
+ */
+struct iwl_per_chain_offset {
+  __le16 max_tx_power;
+  uint8_t chain_a;
+  uint8_t chain_b;
+} __packed; /* PER_CHAIN_LIMIT_OFFSET_PER_CHAIN_S_VER_1 */
+
+struct iwl_per_chain_offset_group {
+  struct iwl_per_chain_offset lb;
+  struct iwl_per_chain_offset hb;
+} __packed; /* PER_CHAIN_LIMIT_OFFSET_GROUP_S_VER_1 */
+
+/**
+ * struct iwl_geo_tx_power_profile_cmd - struct for GEO_TX_POWER_LIMIT cmd.
+ * @ops: operations, value from &enum iwl_geo_per_chain_offset_operation
+ * @table: offset profile per band.
+ */
+struct iwl_geo_tx_power_profiles_cmd {
+  __le32 ops;
+  struct iwl_per_chain_offset_group table[IWL_NUM_GEO_PROFILES];
+} __packed; /* GEO_TX_POWER_LIMIT */
+
+/**
+ * struct iwl_geo_tx_power_profiles_resp -  response to GEO_TX_POWER_LIMIT cmd
+ * @profile_idx: current geo profile in use
+ */
+struct iwl_geo_tx_power_profiles_resp {
+  __le32 profile_idx;
+} __packed; /* GEO_TX_POWER_LIMIT_RESP */
+
+/**
+ * struct iwl_beacon_filter_cmd
+ * REPLY_BEACON_FILTERING_CMD = 0xd2 (command)
+ * @bf_energy_delta: Used for RSSI filtering, if in 'normal' state. Send beacon
+ *      to driver if delta in Energy values calculated for this and last
+ *      passed beacon is greater than this threshold. Zero value means that
+ *      the Energy change is ignored for beacon filtering, and beacon will
+ *      not be forced to be sent to driver regardless of this delta. Typical
+ *      energy delta 5dB.
+ * @bf_roaming_energy_delta: Used for RSSI filtering, if in 'roaming' state.
+ *      Send beacon to driver if delta in Energy values calculated for this
+ *      and last passed beacon is greater than this threshold. Zero value
+ *      means that the Energy change is ignored for beacon filtering while in
+ *      Roaming state, typical energy delta 1dB.
+ * @bf_roaming_state: Used for RSSI filtering. If absolute Energy values
+ *      calculated for current beacon is less than the threshold, use
+ *      Roaming Energy Delta Threshold, otherwise use normal Energy Delta
+ *      Threshold. Typical energy threshold is -72dBm.
+ * @bf_temp_threshold: This threshold determines the type of temperature
+ *  filtering (Slow or Fast) that is selected (Units are in Celsuis):
+ *  If the current temperature is above this threshold - Fast filter
+ *  will be used, If the current temperature is below this threshold -
+ *  Slow filter will be used.
+ * @bf_temp_fast_filter: Send Beacon to driver if delta in temperature values
+ *      calculated for this and the last passed beacon is greater than this
+ *      threshold. Zero value means that the temperature change is ignored for
+ *      beacon filtering; beacons will not be  forced to be sent to driver
+ *      regardless of whether its temerature has been changed.
+ * @bf_temp_slow_filter: Send Beacon to driver if delta in temperature values
+ *      calculated for this and the last passed beacon is greater than this
+ *      threshold. Zero value means that the temperature change is ignored for
+ *      beacon filtering; beacons will not be forced to be sent to driver
+ *      regardless of whether its temerature has been changed.
+ * @bf_enable_beacon_filter: 1, beacon filtering is enabled; 0, disabled.
+ * @bf_debug_flag: beacon filtering debug configuration
+ * @bf_escape_timer: Send beacons to to driver if no beacons were passed
+ *      for a specific period of time. Units: Beacons.
+ * @ba_escape_timer: Fully receive and parse beacon if no beacons were passed
+ *      for a longer period of time then this escape-timeout. Units: Beacons.
+ * @ba_enable_beacon_abort: 1, beacon abort is enabled; 0, disabled.
+ */
+struct iwl_beacon_filter_cmd {
+  __le32 bf_energy_delta;
+  __le32 bf_roaming_energy_delta;
+  __le32 bf_roaming_state;
+  __le32 bf_temp_threshold;
+  __le32 bf_temp_fast_filter;
+  __le32 bf_temp_slow_filter;
+  __le32 bf_enable_beacon_filter;
+  __le32 bf_debug_flag;
+  __le32 bf_escape_timer;
+  __le32 ba_escape_timer;
+  __le32 ba_enable_beacon_abort;
+} __packed;
+
+/* Beacon filtering and beacon abort */
+#define IWL_BF_ENERGY_DELTA_DEFAULT 5
+#define IWL_BF_ENERGY_DELTA_D0I3 20
+#define IWL_BF_ENERGY_DELTA_MAX 255
+#define IWL_BF_ENERGY_DELTA_MIN 0
+
+#define IWL_BF_ROAMING_ENERGY_DELTA_DEFAULT 1
+#define IWL_BF_ROAMING_ENERGY_DELTA_D0I3 20
+#define IWL_BF_ROAMING_ENERGY_DELTA_MAX 255
+#define IWL_BF_ROAMING_ENERGY_DELTA_MIN 0
+
+#define IWL_BF_ROAMING_STATE_DEFAULT 72
+#define IWL_BF_ROAMING_STATE_D0I3 72
+#define IWL_BF_ROAMING_STATE_MAX 255
+#define IWL_BF_ROAMING_STATE_MIN 0
+
+#define IWL_BF_TEMP_THRESHOLD_DEFAULT 112
+#define IWL_BF_TEMP_THRESHOLD_D0I3 112
+#define IWL_BF_TEMP_THRESHOLD_MAX 255
+#define IWL_BF_TEMP_THRESHOLD_MIN 0
+
+#define IWL_BF_TEMP_FAST_FILTER_DEFAULT 1
+#define IWL_BF_TEMP_FAST_FILTER_D0I3 1
+#define IWL_BF_TEMP_FAST_FILTER_MAX 255
+#define IWL_BF_TEMP_FAST_FILTER_MIN 0
+
+#define IWL_BF_TEMP_SLOW_FILTER_DEFAULT 5
+#define IWL_BF_TEMP_SLOW_FILTER_D0I3 20
+#define IWL_BF_TEMP_SLOW_FILTER_MAX 255
+#define IWL_BF_TEMP_SLOW_FILTER_MIN 0
+
+#define IWL_BF_ENABLE_BEACON_FILTER_DEFAULT 1
+
+#define IWL_BF_DEBUG_FLAG_DEFAULT 0
+#define IWL_BF_DEBUG_FLAG_D0I3 0
+
+#define IWL_BF_ESCAPE_TIMER_DEFAULT 0
+#define IWL_BF_ESCAPE_TIMER_D0I3 0
+#define IWL_BF_ESCAPE_TIMER_MAX 1024
+#define IWL_BF_ESCAPE_TIMER_MIN 0
+
+#define IWL_BA_ESCAPE_TIMER_DEFAULT 6
+#define IWL_BA_ESCAPE_TIMER_D0I3 6
+#define IWL_BA_ESCAPE_TIMER_D3 9
+#define IWL_BA_ESCAPE_TIMER_MAX 1024
+#define IWL_BA_ESCAPE_TIMER_MIN 0
+
+#define IWL_BA_ENABLE_BEACON_ABORT_DEFAULT 1
+
+#define IWL_BF_CMD_CONFIG(mode)                                              \
+  .bf_energy_delta = cpu_to_le32(IWL_BF_ENERGY_DELTA##mode),                 \
+  .bf_roaming_energy_delta = cpu_to_le32(IWL_BF_ROAMING_ENERGY_DELTA##mode), \
+  .bf_roaming_state = cpu_to_le32(IWL_BF_ROAMING_STATE##mode),               \
+  .bf_temp_threshold = cpu_to_le32(IWL_BF_TEMP_THRESHOLD##mode),             \
+  .bf_temp_fast_filter = cpu_to_le32(IWL_BF_TEMP_FAST_FILTER##mode),         \
+  .bf_temp_slow_filter = cpu_to_le32(IWL_BF_TEMP_SLOW_FILTER##mode),         \
+  .bf_debug_flag = cpu_to_le32(IWL_BF_DEBUG_FLAG##mode),                     \
+  .bf_escape_timer = cpu_to_le32(IWL_BF_ESCAPE_TIMER##mode),                 \
+  .ba_escape_timer = cpu_to_le32(IWL_BA_ESCAPE_TIMER##mode)
+
+#define IWL_BF_CMD_CONFIG_DEFAULTS IWL_BF_CMD_CONFIG(_DEFAULT)
+#define IWL_BF_CMD_CONFIG_D0I3 IWL_BF_CMD_CONFIG(_D0I3)
+#endif  // SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_POWER_H_
diff --git a/third_party/iwlwifi/fw/api/rs.h b/third_party/iwlwifi/fw/api/rs.h
new file mode 100644
index 0000000..394a80e
--- /dev/null
+++ b/third_party/iwlwifi/fw/api/rs.h
@@ -0,0 +1,615 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018 Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *****************************************************************************/
+
+#ifndef SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_RS_H_
+#define SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_RS_H_
+
+#include "src/iwlwifi/fw/api/mac.h"
+#include "src/iwlwifi/platform/compiler.h"
+
+/**
+ * enum iwl_tlc_mng_cfg_flags_enum - options for TLC config flags
+ * @IWL_TLC_MNG_CFG_FLAGS_STBC_MSK: enable STBC. For HE this enables STBC for
+ *                  bandwidths <= 80MHz
+ * @IWL_TLC_MNG_CFG_FLAGS_LDPC_MSK: enable LDPC
+ * @IWL_TLC_MNG_CFG_FLAGS_HE_STBC_160MHZ_MSK: enable STBC in HE at 160MHz
+ *                        bandwidth
+ * @IWL_TLC_MNG_CFG_FLAGS_HE_DCM_NSS_1_MSK: enable HE Dual Carrier Modulation
+ *                      for BPSK (MCS 0) with 1 spatial
+ *                      stream
+ * @IWL_TLC_MNG_CFG_FLAGS_HE_DCM_NSS_2_MSK: enable HE Dual Carrier Modulation
+ *                      for BPSK (MCS 0) with 2 spatial
+ *                      streams
+ */
+enum iwl_tlc_mng_cfg_flags {
+  IWL_TLC_MNG_CFG_FLAGS_STBC_MSK = BIT(0),
+  IWL_TLC_MNG_CFG_FLAGS_LDPC_MSK = BIT(1),
+  IWL_TLC_MNG_CFG_FLAGS_HE_STBC_160MHZ_MSK = BIT(2),
+  IWL_TLC_MNG_CFG_FLAGS_HE_DCM_NSS_1_MSK = BIT(3),
+  IWL_TLC_MNG_CFG_FLAGS_HE_DCM_NSS_2_MSK = BIT(4),
+};
+
+/**
+ * enum iwl_tlc_mng_cfg_cw - channel width options
+ * @IWL_TLC_MNG_CH_WIDTH_20MHZ: 20MHZ channel
+ * @IWL_TLC_MNG_CH_WIDTH_40MHZ: 40MHZ channel
+ * @IWL_TLC_MNG_CH_WIDTH_80MHZ: 80MHZ channel
+ * @IWL_TLC_MNG_CH_WIDTH_160MHZ: 160MHZ channel
+ * @IWL_TLC_MNG_CH_WIDTH_LAST: maximum value
+ */
+enum iwl_tlc_mng_cfg_cw {
+  IWL_TLC_MNG_CH_WIDTH_20MHZ,
+  IWL_TLC_MNG_CH_WIDTH_40MHZ,
+  IWL_TLC_MNG_CH_WIDTH_80MHZ,
+  IWL_TLC_MNG_CH_WIDTH_160MHZ,
+  IWL_TLC_MNG_CH_WIDTH_LAST = IWL_TLC_MNG_CH_WIDTH_160MHZ,
+};
+
+/**
+ * enum iwl_tlc_mng_cfg_chains - possible chains
+ * @IWL_TLC_MNG_CHAIN_A_MSK: chain A
+ * @IWL_TLC_MNG_CHAIN_B_MSK: chain B
+ */
+enum iwl_tlc_mng_cfg_chains {
+  IWL_TLC_MNG_CHAIN_A_MSK = BIT(0),
+  IWL_TLC_MNG_CHAIN_B_MSK = BIT(1),
+};
+
+/**
+ * enum iwl_tlc_mng_cfg_mode - supported modes
+ * @IWL_TLC_MNG_MODE_CCK: enable CCK
+ * @IWL_TLC_MNG_MODE_OFDM_NON_HT: enable OFDM (non HT)
+ * @IWL_TLC_MNG_MODE_NON_HT: enable non HT
+ * @IWL_TLC_MNG_MODE_HT: enable HT
+ * @IWL_TLC_MNG_MODE_VHT: enable VHT
+ * @IWL_TLC_MNG_MODE_HE: enable HE
+ * @IWL_TLC_MNG_MODE_INVALID: invalid value
+ * @IWL_TLC_MNG_MODE_NUM: a count of possible modes
+ */
+enum iwl_tlc_mng_cfg_mode {
+  IWL_TLC_MNG_MODE_CCK = 0,
+  IWL_TLC_MNG_MODE_OFDM_NON_HT = IWL_TLC_MNG_MODE_CCK,
+  IWL_TLC_MNG_MODE_NON_HT = IWL_TLC_MNG_MODE_CCK,
+  IWL_TLC_MNG_MODE_HT,
+  IWL_TLC_MNG_MODE_VHT,
+  IWL_TLC_MNG_MODE_HE,
+  IWL_TLC_MNG_MODE_INVALID,
+  IWL_TLC_MNG_MODE_NUM = IWL_TLC_MNG_MODE_INVALID,
+};
+
+/**
+ * enum iwl_tlc_mng_ht_rates - HT/VHT/HE rates
+ * @IWL_TLC_MNG_HT_RATE_MCS0: index of MCS0
+ * @IWL_TLC_MNG_HT_RATE_MCS1: index of MCS1
+ * @IWL_TLC_MNG_HT_RATE_MCS2: index of MCS2
+ * @IWL_TLC_MNG_HT_RATE_MCS3: index of MCS3
+ * @IWL_TLC_MNG_HT_RATE_MCS4: index of MCS4
+ * @IWL_TLC_MNG_HT_RATE_MCS5: index of MCS5
+ * @IWL_TLC_MNG_HT_RATE_MCS6: index of MCS6
+ * @IWL_TLC_MNG_HT_RATE_MCS7: index of MCS7
+ * @IWL_TLC_MNG_HT_RATE_MCS8: index of MCS8
+ * @IWL_TLC_MNG_HT_RATE_MCS9: index of MCS9
+ * @IWL_TLC_MNG_HT_RATE_MCS10: index of MCS10
+ * @IWL_TLC_MNG_HT_RATE_MCS11: index of MCS11
+ * @IWL_TLC_MNG_HT_RATE_MAX: maximal rate for HT/VHT
+ */
+enum iwl_tlc_mng_ht_rates {
+  IWL_TLC_MNG_HT_RATE_MCS0 = 0,
+  IWL_TLC_MNG_HT_RATE_MCS1,
+  IWL_TLC_MNG_HT_RATE_MCS2,
+  IWL_TLC_MNG_HT_RATE_MCS3,
+  IWL_TLC_MNG_HT_RATE_MCS4,
+  IWL_TLC_MNG_HT_RATE_MCS5,
+  IWL_TLC_MNG_HT_RATE_MCS6,
+  IWL_TLC_MNG_HT_RATE_MCS7,
+  IWL_TLC_MNG_HT_RATE_MCS8,
+  IWL_TLC_MNG_HT_RATE_MCS9,
+  IWL_TLC_MNG_HT_RATE_MCS10,
+  IWL_TLC_MNG_HT_RATE_MCS11,
+  IWL_TLC_MNG_HT_RATE_MAX = IWL_TLC_MNG_HT_RATE_MCS11,
+};
+
+/* Maximum supported tx antennas number */
+#define MAX_NSS 2
+
+/**
+ * struct tlc_config_cmd - TLC configuration
+ * @sta_id: station id
+ * @reserved1: reserved
+ * @max_ch_width: max supported channel width from @enum iwl_tlc_mng_cfg_cw
+ * @mode: &enum iwl_tlc_mng_cfg_mode
+ * @chains: bitmask of &enum iwl_tlc_mng_cfg_chains
+ * @amsdu: TX amsdu is supported
+ * @flags: bitmask of &enum iwl_tlc_mng_cfg_flags
+ * @non_ht_rates: bitmap of supported legacy rates
+ * @ht_rates: bitmap of &enum iwl_tlc_mng_ht_rates, per <nss, channel-width>
+ *        pair (0 - 80mhz width and below, 1 - 160mhz).
+ * @max_mpdu_len: max MPDU length, in bytes
+ * @sgi_ch_width_supp: bitmap of SGI support per channel width
+ *             use BIT(@enum iwl_tlc_mng_cfg_cw)
+ * @reserved2: reserved
+ */
+struct iwl_tlc_config_cmd {
+  uint8_t sta_id;
+  uint8_t reserved1[3];
+  uint8_t max_ch_width;
+  uint8_t mode;
+  uint8_t chains;
+  uint8_t amsdu;
+  __le16 flags;
+  __le16 non_ht_rates;
+  __le16 ht_rates[MAX_NSS][2];
+  __le16 max_mpdu_len;
+  uint8_t sgi_ch_width_supp;
+  uint8_t reserved2[1];
+} __packed; /* TLC_MNG_CONFIG_CMD_API_S_VER_2 */
+
+/**
+ * enum iwl_tlc_update_flags - updated fields
+ * @IWL_TLC_NOTIF_FLAG_RATE: last initial rate update
+ * @IWL_TLC_NOTIF_FLAG_AMSDU: umsdu parameters update
+ */
+enum iwl_tlc_update_flags {
+  IWL_TLC_NOTIF_FLAG_RATE = BIT(0),
+  IWL_TLC_NOTIF_FLAG_AMSDU = BIT(1),
+};
+
+/**
+ * struct iwl_tlc_update_notif - TLC notification from FW
+ * @sta_id: station id
+ * @reserved: reserved
+ * @flags: bitmap of notifications reported
+ * @rate: current initial rate
+ * @amsdu_size: Max AMSDU size, in bytes
+ * @amsdu_enabled: bitmap for per-TID AMSDU enablement
+ */
+struct iwl_tlc_update_notif {
+  uint8_t sta_id;
+  uint8_t reserved[3];
+  __le32 flags;
+  __le32 rate;
+  __le32 amsdu_size;
+  __le32 amsdu_enabled;
+} __packed; /* TLC_MNG_UPDATE_NTFY_API_S_VER_2 */
+
+#ifdef CPTCFG_IWLWIFI_DEBUG_HOST_CMD_ENABLED
+/**
+ * enum iwl_tlc_debug_flags - debug options
+ * @IWL_TLC_DEBUG_FIXED_RATE: set fixed rate for rate scaling
+ * @IWL_TLC_DEBUG_AGG_DURATION_LIM: time limit for a BA session, in usec
+ * @IWL_TLC_DEBUG_AGG_FRAME_CNT_LIM: set max number of frames in an aggregation
+ * @IWL_TLC_DEBUG_FLAGS_NUM: number of flags. Used to define the data array in
+ *                           %struct iwl_dhc_tlc_cmd
+ * @IWL_TLC_DEBUG_TPC_ENABLED: enable or disable tpc
+ * @IWL_TLC_DEBUG_TPC_STATS: get number of frames Tx'ed in each tpc step
+ */
+enum iwl_tlc_debug_flags {
+  IWL_TLC_DEBUG_FIXED_RATE,
+  IWL_TLC_DEBUG_AGG_DURATION_LIM,
+  IWL_TLC_DEBUG_AGG_FRAME_CNT_LIM,
+  IWL_TLC_DEBUG_TPC_ENABLED,
+  IWL_TLC_DEBUG_TPC_STATS,
+
+  IWL_TLC_DEBUG_FLAGS_NUM,
+}; /* TLC_MNG_DEBUG_FLAGS_API_E */
+
+/**
+ * struct iwl_dhc_tlc_dbg - fixed debug config
+ * @sta_id: bit 0 - enable/disable, bits 1 - 7 hold station id
+ * @reserved1: reserved
+ * @flags: bitmap of %IWL_TLC_DEBUG_\*
+ * @data: for each bit i set in te %flags, data[i] holds the corresponding data
+ */
+struct iwl_dhc_tlc_cmd {
+  uint8_t sta_id;
+  uint8_t reserved1[3];
+  __le32 flags;
+  __le32 data[IWL_TLC_DEBUG_FLAGS_NUM];
+} __packed; /* TLC_MNG_DEBUG_CMD_S */
+
+/**
+ * struct iwl_tpc_stats - statistics on the number of frames sent at each tpc
+ *                        step.
+ * @no_tpc: number of frames sent with no Tx-power reduction
+ * @step: number of frames sent at each step (0 - 3db reduction, ... 4 - 15db
+ *        reduction)
+ */
+struct iwl_tpc_stats {
+  __le32 no_tpc;
+  __le32 step[5];
+} __packed;
+#endif /* CPTCFG_IWLWIFI_DEBUG_HOST_CMD_ENABLED */
+
+/*
+ * These serve as indexes into
+ * struct iwl_rate_info fw_rate_idx_to_plcp[IWL_RATE_COUNT];
+ * TODO: avoid overlap between legacy and HT rates
+ */
+enum {
+  IWL_RATE_1M_INDEX = 0,
+  IWL_FIRST_CCK_RATE = IWL_RATE_1M_INDEX,
+  IWL_RATE_2M_INDEX,
+  IWL_RATE_5M_INDEX,
+  IWL_RATE_11M_INDEX,
+  IWL_LAST_CCK_RATE = IWL_RATE_11M_INDEX,
+  IWL_RATE_6M_INDEX,
+  IWL_FIRST_OFDM_RATE = IWL_RATE_6M_INDEX,
+  IWL_RATE_MCS_0_INDEX = IWL_RATE_6M_INDEX,
+  IWL_FIRST_HT_RATE = IWL_RATE_MCS_0_INDEX,
+  IWL_FIRST_VHT_RATE = IWL_RATE_MCS_0_INDEX,
+  IWL_RATE_9M_INDEX,
+  IWL_RATE_12M_INDEX,
+  IWL_RATE_MCS_1_INDEX = IWL_RATE_12M_INDEX,
+  IWL_RATE_18M_INDEX,
+  IWL_RATE_MCS_2_INDEX = IWL_RATE_18M_INDEX,
+  IWL_RATE_24M_INDEX,
+  IWL_RATE_MCS_3_INDEX = IWL_RATE_24M_INDEX,
+  IWL_RATE_36M_INDEX,
+  IWL_RATE_MCS_4_INDEX = IWL_RATE_36M_INDEX,
+  IWL_RATE_48M_INDEX,
+  IWL_RATE_MCS_5_INDEX = IWL_RATE_48M_INDEX,
+  IWL_RATE_54M_INDEX,
+  IWL_RATE_MCS_6_INDEX = IWL_RATE_54M_INDEX,
+  IWL_LAST_NON_HT_RATE = IWL_RATE_54M_INDEX,
+  IWL_RATE_60M_INDEX,
+  IWL_RATE_MCS_7_INDEX = IWL_RATE_60M_INDEX,
+  IWL_LAST_HT_RATE = IWL_RATE_MCS_7_INDEX,
+  IWL_RATE_MCS_8_INDEX,
+  IWL_RATE_MCS_9_INDEX,
+  IWL_LAST_VHT_RATE = IWL_RATE_MCS_9_INDEX,
+  IWL_RATE_MCS_10_INDEX,
+  IWL_RATE_MCS_11_INDEX,
+  IWL_LAST_HE_RATE = IWL_RATE_MCS_11_INDEX,
+  IWL_RATE_COUNT_LEGACY = IWL_LAST_NON_HT_RATE + 1,
+  IWL_RATE_COUNT = IWL_LAST_HE_RATE + 1,
+};
+
+#define IWL_RATE_BIT_MSK(r) BIT(IWL_RATE_##r##M_INDEX)
+
+/* fw API values for legacy bit rates, both OFDM and CCK */
+enum {
+  IWL_RATE_6M_PLCP = 13,
+  IWL_RATE_9M_PLCP = 15,
+  IWL_RATE_12M_PLCP = 5,
+  IWL_RATE_18M_PLCP = 7,
+  IWL_RATE_24M_PLCP = 9,
+  IWL_RATE_36M_PLCP = 11,
+  IWL_RATE_48M_PLCP = 1,
+  IWL_RATE_54M_PLCP = 3,
+  IWL_RATE_1M_PLCP = 10,
+  IWL_RATE_2M_PLCP = 20,
+  IWL_RATE_5M_PLCP = 55,
+  IWL_RATE_11M_PLCP = 110,
+  IWL_RATE_INVM_PLCP = -1,
+};
+
+/*
+ * rate_n_flags bit fields
+ *
+ * The 32-bit value has different layouts in the low 8 bites depending on the
+ * format. There are three formats, HT, VHT and legacy (11abg, with subformats
+ * for CCK and OFDM).
+ *
+ * High-throughput (HT) rate format
+ *  bit 8 is 1, bit 26 is 0, bit 9 is 0 (OFDM)
+ * Very High-throughput (VHT) rate format
+ *  bit 8 is 0, bit 26 is 1, bit 9 is 0 (OFDM)
+ * Legacy OFDM rate format for bits 7:0
+ *  bit 8 is 0, bit 26 is 0, bit 9 is 0 (OFDM)
+ * Legacy CCK rate format for bits 7:0:
+ *  bit 8 is 0, bit 26 is 0, bit 9 is 1 (CCK)
+ */
+
+/* Bit 8: (1) HT format, (0) legacy or VHT format */
+#define RATE_MCS_HT_POS 8
+#define RATE_MCS_HT_MSK (1 << RATE_MCS_HT_POS)
+
+/* Bit 9: (1) CCK, (0) OFDM.  HT (bit 8) must be "0" for this bit to be valid */
+#define RATE_MCS_CCK_POS 9
+#define RATE_MCS_CCK_MSK (1 << RATE_MCS_CCK_POS)
+
+/* Bit 26: (1) VHT format, (0) legacy format in bits 8:0 */
+#define RATE_MCS_VHT_POS 26
+#define RATE_MCS_VHT_MSK (1 << RATE_MCS_VHT_POS)
+
+/*
+ * High-throughput (HT) rate format for bits 7:0
+ *
+ *  2-0:  MCS rate base
+ *        0)   6 Mbps
+ *        1)  12 Mbps
+ *        2)  18 Mbps
+ *        3)  24 Mbps
+ *        4)  36 Mbps
+ *        5)  48 Mbps
+ *        6)  54 Mbps
+ *        7)  60 Mbps
+ *  4-3:  0)  Single stream (SISO)
+ *        1)  Dual stream (MIMO)
+ *        2)  Triple stream (MIMO)
+ *    5:  Value of 0x20 in bits 7:0 indicates 6 Mbps HT40 duplicate data
+ *  (bits 7-6 are zero)
+ *
+ * Together the low 5 bits work out to the MCS index because we don't
+ * support MCSes above 15/23, and 0-7 have one stream, 8-15 have two
+ * streams and 16-23 have three streams. We could also support MCS 32
+ * which is the duplicate 20 MHz MCS (bit 5 set, all others zero.)
+ */
+#define RATE_HT_MCS_RATE_CODE_MSK 0x7
+#define RATE_HT_MCS_NSS_POS 3
+#define RATE_HT_MCS_NSS_MSK (3 << RATE_HT_MCS_NSS_POS)
+
+/* Bit 10: (1) Use Green Field preamble */
+#define RATE_HT_MCS_GF_POS 10
+#define RATE_HT_MCS_GF_MSK (1 << RATE_HT_MCS_GF_POS)
+
+#define RATE_HT_MCS_INDEX_MSK 0x3f
+
+/*
+ * Very High-throughput (VHT) rate format for bits 7:0
+ *
+ *  3-0:  VHT MCS (0-9)
+ *  5-4:  number of streams - 1:
+ *        0)  Single stream (SISO)
+ *        1)  Dual stream (MIMO)
+ *        2)  Triple stream (MIMO)
+ */
+
+/* Bit 4-5: (0) SISO, (1) MIMO2 (2) MIMO3 */
+#define RATE_VHT_MCS_RATE_CODE_MSK 0xf
+#define RATE_VHT_MCS_NSS_POS 4
+#define RATE_VHT_MCS_NSS_MSK (3 << RATE_VHT_MCS_NSS_POS)
+
+/*
+ * Legacy OFDM rate format for bits 7:0
+ *
+ *  3-0:  0xD)   6 Mbps
+ *        0xF)   9 Mbps
+ *        0x5)  12 Mbps
+ *        0x7)  18 Mbps
+ *        0x9)  24 Mbps
+ *        0xB)  36 Mbps
+ *        0x1)  48 Mbps
+ *        0x3)  54 Mbps
+ * (bits 7-4 are 0)
+ *
+ * Legacy CCK rate format for bits 7:0:
+ * bit 8 is 0, bit 26 is 0, bit 9 is 1 (CCK):
+ *
+ *  6-0:   10)  1 Mbps
+ *         20)  2 Mbps
+ *         55)  5.5 Mbps
+ *        110)  11 Mbps
+ * (bit 7 is 0)
+ */
+#define RATE_LEGACY_RATE_MSK 0xff
+
+/* Bit 10 - OFDM HE */
+#define RATE_MCS_HE_POS 10
+#define RATE_MCS_HE_MSK BIT(RATE_MCS_HE_POS)
+
+/*
+ * Bit 11-12: (0) 20MHz, (1) 40MHz, (2) 80MHz, (3) 160MHz
+ * 0 and 1 are valid for HT and VHT, 2 and 3 only for VHT
+ */
+#define RATE_MCS_CHAN_WIDTH_POS 11
+#define RATE_MCS_CHAN_WIDTH_MSK (3 << RATE_MCS_CHAN_WIDTH_POS)
+#define RATE_MCS_CHAN_WIDTH_20 (0 << RATE_MCS_CHAN_WIDTH_POS)
+#define RATE_MCS_CHAN_WIDTH_40 (1 << RATE_MCS_CHAN_WIDTH_POS)
+#define RATE_MCS_CHAN_WIDTH_80 (2 << RATE_MCS_CHAN_WIDTH_POS)
+#define RATE_MCS_CHAN_WIDTH_160 (3 << RATE_MCS_CHAN_WIDTH_POS)
+
+/* Bit 13: (1) Short guard interval (0.4 usec), (0) normal GI (0.8 usec) */
+#define RATE_MCS_SGI_POS 13
+#define RATE_MCS_SGI_MSK (1 << RATE_MCS_SGI_POS)
+
+/* Bit 14-16: Antenna selection (1) Ant A, (2) Ant B, (4) Ant C */
+#define RATE_MCS_ANT_POS 14
+#define RATE_MCS_ANT_A_MSK (1 << RATE_MCS_ANT_POS)
+#define RATE_MCS_ANT_B_MSK (2 << RATE_MCS_ANT_POS)
+#define RATE_MCS_ANT_C_MSK (4 << RATE_MCS_ANT_POS)
+#define RATE_MCS_ANT_AB_MSK (RATE_MCS_ANT_A_MSK | RATE_MCS_ANT_B_MSK)
+#define RATE_MCS_ANT_ABC_MSK (RATE_MCS_ANT_AB_MSK | RATE_MCS_ANT_C_MSK)
+#define RATE_MCS_ANT_MSK RATE_MCS_ANT_ABC_MSK
+
+/* Bit 17: (0) SS, (1) SS*2 */
+#define RATE_MCS_STBC_POS 17
+#define RATE_MCS_STBC_MSK BIT(RATE_MCS_STBC_POS)
+
+/* Bit 18: OFDM-HE dual carrier mode */
+#define RATE_HE_DUAL_CARRIER_MODE 18
+#define RATE_HE_DUAL_CARRIER_MODE_MSK BIT(RATE_HE_DUAL_CARRIER_MODE)
+
+/* Bit 19: (0) Beamforming is off, (1) Beamforming is on */
+#define RATE_MCS_BF_POS 19
+#define RATE_MCS_BF_MSK (1 << RATE_MCS_BF_POS)
+
+/*
+ * Bit 20-21: HE LTF type and guard interval
+ * HE (ext) SU:
+ *  0           1xLTF+0.8us
+ *  1           2xLTF+0.8us
+ *  2           2xLTF+1.6us
+ *  3 & SGI (bit 13) clear  4xLTF+3.2us
+ *  3 & SGI (bit 13) set    4xLTF+0.8us
+ * HE MU:
+ *  0           4xLTF+0.8us
+ *  1           2xLTF+0.8us
+ *  2           2xLTF+1.6us
+ *  3           4xLTF+3.2us
+ * HE TRIG:
+ *  0           1xLTF+1.6us
+ *  1           2xLTF+1.6us
+ *  2           4xLTF+3.2us
+ *  3           (does not occur)
+ */
+#define RATE_MCS_HE_GI_LTF_POS 20
+#define RATE_MCS_HE_GI_LTF_MSK (3 << RATE_MCS_HE_GI_LTF_POS)
+
+/* Bit 22-23: HE type. (0) SU, (1) SU_EXT, (2) MU, (3) trigger based */
+#define RATE_MCS_HE_TYPE_POS 22
+#define RATE_MCS_HE_TYPE_SU (0 << RATE_MCS_HE_TYPE_POS)
+#define RATE_MCS_HE_TYPE_EXT_SU (1 << RATE_MCS_HE_TYPE_POS)
+#define RATE_MCS_HE_TYPE_MU (2 << RATE_MCS_HE_TYPE_POS)
+#define RATE_MCS_HE_TYPE_TRIG (3 << RATE_MCS_HE_TYPE_POS)
+#define RATE_MCS_HE_TYPE_MSK (3 << RATE_MCS_HE_TYPE_POS)
+
+/* Bit 24-25: (0) 20MHz (no dup), (1) 2x20MHz, (2) 4x20MHz, 3 8x20MHz */
+#define RATE_MCS_DUP_POS 24
+#define RATE_MCS_DUP_MSK (3 << RATE_MCS_DUP_POS)
+
+/* Bit 27: (1) LDPC enabled, (0) LDPC disabled */
+#define RATE_MCS_LDPC_POS 27
+#define RATE_MCS_LDPC_MSK (1 << RATE_MCS_LDPC_POS)
+
+/* Bit 28: (1) 106-tone RX (8 MHz RU), (0) normal bandwidth */
+#define RATE_MCS_HE_106T_POS 28
+#define RATE_MCS_HE_106T_MSK (1 << RATE_MCS_HE_106T_POS)
+
+/* Link Quality definitions */
+
+/* # entries in rate scale table to support Tx retries */
+#define LQ_MAX_RETRY_NUM 16
+
+/* Link quality command flags bit fields */
+
+/* Bit 0: (0) Don't use RTS (1) Use RTS */
+#define LQ_FLAG_USE_RTS_POS 0
+#define LQ_FLAG_USE_RTS_MSK (1 << LQ_FLAG_USE_RTS_POS)
+
+/* Bit 1-3: LQ command color. Used to match responses to LQ commands */
+#define LQ_FLAG_COLOR_POS 1
+#define LQ_FLAG_COLOR_MSK (7 << LQ_FLAG_COLOR_POS)
+#define LQ_FLAG_COLOR_GET(_f) (((_f)&LQ_FLAG_COLOR_MSK) >> LQ_FLAG_COLOR_POS)
+#define LQ_FLAGS_COLOR_INC(_c) ((((_c) + 1) << LQ_FLAG_COLOR_POS) & LQ_FLAG_COLOR_MSK)
+#define LQ_FLAG_COLOR_SET(_f, _c) ((_c) | ((_f) & ~LQ_FLAG_COLOR_MSK))
+
+/* Bit 4-5: Tx RTS BW Signalling
+ * (0) No RTS BW signalling
+ * (1) Static BW signalling
+ * (2) Dynamic BW signalling
+ */
+#define LQ_FLAG_RTS_BW_SIG_POS 4
+#define LQ_FLAG_RTS_BW_SIG_NONE (0 << LQ_FLAG_RTS_BW_SIG_POS)
+#define LQ_FLAG_RTS_BW_SIG_STATIC (1 << LQ_FLAG_RTS_BW_SIG_POS)
+#define LQ_FLAG_RTS_BW_SIG_DYNAMIC (2 << LQ_FLAG_RTS_BW_SIG_POS)
+
+/* Bit 6: (0) No dynamic BW selection (1) Allow dynamic BW selection
+ * Dyanmic BW selection allows Tx with narrower BW then requested in rates
+ */
+#define LQ_FLAG_DYNAMIC_BW_POS 6
+#define LQ_FLAG_DYNAMIC_BW_MSK (1 << LQ_FLAG_DYNAMIC_BW_POS)
+
+/* Single Stream Tx Parameters (lq_cmd->ss_params)
+ * Flags to control a smart FW decision about whether BFER/STBC/SISO will be
+ * used for single stream Tx.
+ */
+
+/* Bit 0-1: Max STBC streams allowed. Can be 0-3.
+ * (0) - No STBC allowed
+ * (1) - 2x1 STBC allowed (HT/VHT)
+ * (2) - 4x2 STBC allowed (HT/VHT)
+ * (3) - 3x2 STBC allowed (HT only)
+ * All our chips are at most 2 antennas so only (1) is valid for now.
+ */
+#define LQ_SS_STBC_ALLOWED_POS 0
+#define LQ_SS_STBC_ALLOWED_MSK (3 << LQ_SS_STBC_ALLOWED_MSK)
+
+/* 2x1 STBC is allowed */
+#define LQ_SS_STBC_1SS_ALLOWED (1 << LQ_SS_STBC_ALLOWED_POS)
+
+/* Bit 2: Beamformer (VHT only) is allowed */
+#define LQ_SS_BFER_ALLOWED_POS 2
+#define LQ_SS_BFER_ALLOWED (1 << LQ_SS_BFER_ALLOWED_POS)
+
+/* Bit 3: Force BFER or STBC for testing
+ * If this is set:
+ * If BFER is allowed then force the ucode to choose BFER else
+ * If STBC is allowed then force the ucode to choose STBC over SISO
+ */
+#define LQ_SS_FORCE_POS 3
+#define LQ_SS_FORCE (1 << LQ_SS_FORCE_POS)
+
+/* Bit 31: ss_params field is valid. Used for FW backward compatibility
+ * with other drivers which don't support the ss_params API yet
+ */
+#define LQ_SS_PARAMS_VALID_POS 31
+#define LQ_SS_PARAMS_VALID (1 << LQ_SS_PARAMS_VALID_POS)
+
+/**
+ * struct iwl_lq_cmd - link quality command
+ * @sta_id: station to update
+ * @reduced_tpc: reduced transmit power control value
+ * @control: not used
+ * @flags: combination of LQ_FLAG_*
+ * @mimo_delim: the first SISO index in rs_table, which separates MIMO
+ *  and SISO rates
+ * @single_stream_ant_msk: best antenna for SISO (can be dual in CDD).
+ *  Should be ANT_[ABC]
+ * @dual_stream_ant_msk: best antennas for MIMO, combination of ANT_[ABC]
+ * @initial_rate_index: first index from rs_table per AC category
+ * @agg_time_limit: aggregation max time threshold in usec/100, meaning
+ *  value of 100 is one usec. Range is 100 to 8000
+ * @agg_disable_start_th: try-count threshold for starting aggregation.
+ *  If a frame has higher try-count, it should not be selected for
+ *  starting an aggregation sequence.
+ * @agg_frame_cnt_limit: max frame count in an aggregation.
+ *  0: no limit
+ *  1: no aggregation (one frame per aggregation)
+ *  2 - 0x3f: maximal number of frames (up to 3f == 63)
+ * @reserved2: reserved
+ * @rs_table: array of rates for each TX try, each is rate_n_flags,
+ *  meaning it is a combination of RATE_MCS_* and IWL_RATE_*_PLCP
+ * @ss_params: single stream features. declare whether STBC or BFER are allowed.
+ */
+struct iwl_lq_cmd {
+  uint8_t sta_id;
+  uint8_t reduced_tpc;
+  __le16 control;
+  /* LINK_QUAL_GENERAL_PARAMS_API_S_VER_1 */
+  uint8_t flags;
+  uint8_t mimo_delim;
+  uint8_t single_stream_ant_msk;
+  uint8_t dual_stream_ant_msk;
+  uint8_t initial_rate_index[AC_NUM];
+  /* LINK_QUAL_AGG_PARAMS_API_S_VER_1 */
+  __le16 agg_time_limit;
+  uint8_t agg_disable_start_th;
+  uint8_t agg_frame_cnt_limit;
+  __le32 reserved2;
+  __le32 rs_table[LQ_MAX_RETRY_NUM];
+  __le32 ss_params;
+}; /* LINK_QUALITY_CMD_API_S_VER_1 */
+
+#endif  // SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_RS_H_
diff --git a/third_party/iwlwifi/fw/api/rx.h b/third_party/iwlwifi/fw/api/rx.h
new file mode 100644
index 0000000..67eeb3e
--- /dev/null
+++ b/third_party/iwlwifi/fw/api/rx.h
@@ -0,0 +1,952 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018 Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+
+#ifndef SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_RX_H_
+#define SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_RX_H_
+
+#include "src/iwlwifi/platform/compiler.h"
+
+/* API for pre-9000 hardware */
+
+#define IWL_RX_INFO_PHY_CNT 8
+#define IWL_RX_INFO_ENERGY_ANT_ABC_IDX 1
+#define IWL_RX_INFO_ENERGY_ANT_A_MSK 0x000000ff
+#define IWL_RX_INFO_ENERGY_ANT_B_MSK 0x0000ff00
+#define IWL_RX_INFO_ENERGY_ANT_C_MSK 0x00ff0000
+#define IWL_RX_INFO_ENERGY_ANT_A_POS 0
+#define IWL_RX_INFO_ENERGY_ANT_B_POS 8
+#define IWL_RX_INFO_ENERGY_ANT_C_POS 16
+
+enum iwl_mac_context_info {
+  MAC_CONTEXT_INFO_NONE,
+  MAC_CONTEXT_INFO_GSCAN,
+};
+
+/**
+ * struct iwl_rx_phy_info - phy info
+ * (REPLY_RX_PHY_CMD = 0xc0)
+ * @non_cfg_phy_cnt: non configurable DSP phy data byte count
+ * @cfg_phy_cnt: configurable DSP phy data byte count
+ * @stat_id: configurable DSP phy data set ID
+ * @reserved1: reserved
+ * @system_timestamp: GP2  at on air rise
+ * @timestamp: TSF at on air rise
+ * @beacon_time_stamp: beacon at on-air rise
+ * @phy_flags: general phy flags: band, modulation, ...
+ * @channel: channel number
+ * @non_cfg_phy: for various implementations of non_cfg_phy
+ * @rate_n_flags: RATE_MCS_*
+ * @byte_count: frame's byte-count
+ * @frame_time: frame's time on the air, based on byte count and frame rate
+ *  calculation
+ * @mac_active_msk: what MACs were active when the frame was received
+ * @mac_context_info: additional info on the context in which the frame was
+ *  received as defined in &enum iwl_mac_context_info
+ *
+ * Before each Rx, the device sends this data. It contains PHY information
+ * about the reception of the packet.
+ */
+struct iwl_rx_phy_info {
+  uint8_t non_cfg_phy_cnt;
+  uint8_t cfg_phy_cnt;
+  uint8_t stat_id;
+  uint8_t reserved1;
+  __le32 system_timestamp;
+  __le64 timestamp;
+  __le32 beacon_time_stamp;
+  __le16 phy_flags;
+  __le16 channel;
+  __le32 non_cfg_phy[IWL_RX_INFO_PHY_CNT];
+  __le32 rate_n_flags;
+  __le32 byte_count;
+  uint8_t mac_active_msk;
+  uint8_t mac_context_info;
+  __le16 frame_time;
+} __packed;
+
+/*
+ * TCP offload Rx assist info
+ *
+ * bits 0:3 - reserved
+ * bits 4:7 - MIC CRC length
+ * bits 8:12 - MAC header length
+ * bit 13 - Padding indication
+ * bit 14 - A-AMSDU indication
+ * bit 15 - Offload enabled
+ */
+enum iwl_csum_rx_assist_info {
+  CSUM_RXA_RESERVED_MASK = 0x000f,
+  CSUM_RXA_MICSIZE_MASK = 0x00f0,
+  CSUM_RXA_HEADERLEN_MASK = 0x1f00,
+  CSUM_RXA_PADD = BIT(13),
+  CSUM_RXA_AMSDU = BIT(14),
+  CSUM_RXA_ENA = BIT(15)
+};
+
+/**
+ * struct iwl_rx_mpdu_res_start - phy info
+ * @byte_count: byte count of the frame
+ * @assist: see &enum iwl_csum_rx_assist_info
+ */
+struct iwl_rx_mpdu_res_start {
+  __le16 byte_count;
+  __le16 assist;
+} __packed; /* _RX_MPDU_RES_START_API_S_VER_2 */
+
+/**
+ * enum iwl_rx_phy_flags - to parse %iwl_rx_phy_info phy_flags
+ * @RX_RES_PHY_FLAGS_BAND_24: true if the packet was received on 2.4 band
+ * @RX_RES_PHY_FLAGS_MOD_CCK: modulation is CCK
+ * @RX_RES_PHY_FLAGS_SHORT_PREAMBLE: true if packet's preamble was short
+ * @RX_RES_PHY_FLAGS_NARROW_BAND: narrow band (<20 MHz) receive
+ * @RX_RES_PHY_FLAGS_ANTENNA: antenna on which the packet was received
+ * @RX_RES_PHY_FLAGS_ANTENNA_POS: antenna bit position
+ * @RX_RES_PHY_FLAGS_AGG: set if the packet was part of an A-MPDU
+ * @RX_RES_PHY_FLAGS_OFDM_HT: The frame was an HT frame
+ * @RX_RES_PHY_FLAGS_OFDM_GF: The frame used GF preamble
+ * @RX_RES_PHY_FLAGS_OFDM_VHT: The frame was a VHT frame
+ */
+enum iwl_rx_phy_flags {
+  RX_RES_PHY_FLAGS_BAND_24 = BIT(0),
+  RX_RES_PHY_FLAGS_MOD_CCK = BIT(1),
+  RX_RES_PHY_FLAGS_SHORT_PREAMBLE = BIT(2),
+  RX_RES_PHY_FLAGS_NARROW_BAND = BIT(3),
+  RX_RES_PHY_FLAGS_ANTENNA = (0x7 << 4),
+  RX_RES_PHY_FLAGS_ANTENNA_POS = 4,
+  RX_RES_PHY_FLAGS_AGG = BIT(7),
+  RX_RES_PHY_FLAGS_OFDM_HT = BIT(8),
+  RX_RES_PHY_FLAGS_OFDM_GF = BIT(9),
+  RX_RES_PHY_FLAGS_OFDM_VHT = BIT(10),
+};
+
+/**
+ * enum iwl_mvm_rx_status - written by fw for each Rx packet
+ * @RX_MPDU_RES_STATUS_CRC_OK: CRC is fine
+ * @RX_MPDU_RES_STATUS_OVERRUN_OK: there was no RXE overflow
+ * @RX_MPDU_RES_STATUS_SRC_STA_FOUND: station was found
+ * @RX_MPDU_RES_STATUS_KEY_VALID: key was valid
+ * @RX_MPDU_RES_STATUS_KEY_PARAM_OK: key parameters were usable
+ * @RX_MPDU_RES_STATUS_ICV_OK: ICV is fine, if not, the packet is destroyed
+ * @RX_MPDU_RES_STATUS_MIC_OK: used for CCM alg only. TKIP MIC is checked
+ *  in the driver.
+ * @RX_MPDU_RES_STATUS_TTAK_OK: TTAK is fine
+ * @RX_MPDU_RES_STATUS_MNG_FRAME_REPLAY_ERR:  valid for alg = CCM_CMAC or
+ *  alg = CCM only. Checks replay attack for 11w frames. Relevant only if
+ *  %RX_MPDU_RES_STATUS_ROBUST_MNG_FRAME is set.
+ * @RX_MPDU_RES_STATUS_SEC_NO_ENC: this frame is not encrypted
+ * @RX_MPDU_RES_STATUS_SEC_WEP_ENC: this frame is encrypted using WEP
+ * @RX_MPDU_RES_STATUS_SEC_CCM_ENC: this frame is encrypted using CCM
+ * @RX_MPDU_RES_STATUS_SEC_TKIP_ENC: this frame is encrypted using TKIP
+ * @RX_MPDU_RES_STATUS_SEC_EXT_ENC: this frame is encrypted using extension
+ *  algorithm
+ * @RX_MPDU_RES_STATUS_SEC_CCM_CMAC_ENC: this frame is encrypted using CCM_CMAC
+ * @RX_MPDU_RES_STATUS_SEC_ENC_ERR: this frame couldn't be decrypted
+ * @RX_MPDU_RES_STATUS_SEC_ENC_MSK: bitmask of the encryption algorithm
+ * @RX_MPDU_RES_STATUS_DEC_DONE: this frame has been successfully decrypted
+ * @RX_MPDU_RES_STATUS_EXT_IV_BIT_CMP: extended IV (set with TKIP)
+ * @RX_MPDU_RES_STATUS_KEY_ID_CMP_BIT: key ID comparison done
+ * @RX_MPDU_RES_STATUS_ROBUST_MNG_FRAME: this frame is an 11w management frame
+ * @RX_MPDU_RES_STATUS_CSUM_DONE: checksum was done by the hw
+ * @RX_MPDU_RES_STATUS_CSUM_OK: checksum found no errors
+ * @RX_MPDU_RES_STATUS_STA_ID_MSK: station ID mask
+ * @RX_MDPU_RES_STATUS_STA_ID_SHIFT: station ID bit shift
+ */
+enum iwl_mvm_rx_status {
+  RX_MPDU_RES_STATUS_CRC_OK = BIT(0),
+  RX_MPDU_RES_STATUS_OVERRUN_OK = BIT(1),
+  RX_MPDU_RES_STATUS_SRC_STA_FOUND = BIT(2),
+  RX_MPDU_RES_STATUS_KEY_VALID = BIT(3),
+  RX_MPDU_RES_STATUS_KEY_PARAM_OK = BIT(4),
+  RX_MPDU_RES_STATUS_ICV_OK = BIT(5),
+  RX_MPDU_RES_STATUS_MIC_OK = BIT(6),
+  RX_MPDU_RES_STATUS_TTAK_OK = BIT(7),
+  RX_MPDU_RES_STATUS_MNG_FRAME_REPLAY_ERR = BIT(7),
+  RX_MPDU_RES_STATUS_SEC_NO_ENC = (0 << 8),
+  RX_MPDU_RES_STATUS_SEC_WEP_ENC = (1 << 8),
+  RX_MPDU_RES_STATUS_SEC_CCM_ENC = (2 << 8),
+  RX_MPDU_RES_STATUS_SEC_TKIP_ENC = (3 << 8),
+  RX_MPDU_RES_STATUS_SEC_EXT_ENC = (4 << 8),
+  RX_MPDU_RES_STATUS_SEC_CCM_CMAC_ENC = (6 << 8),
+  RX_MPDU_RES_STATUS_SEC_ENC_ERR = (7 << 8),
+  RX_MPDU_RES_STATUS_SEC_ENC_MSK = (7 << 8),
+  RX_MPDU_RES_STATUS_DEC_DONE = BIT(11),
+  RX_MPDU_RES_STATUS_EXT_IV_BIT_CMP = BIT(13),
+  RX_MPDU_RES_STATUS_KEY_ID_CMP_BIT = BIT(14),
+  RX_MPDU_RES_STATUS_ROBUST_MNG_FRAME = BIT(15),
+  RX_MPDU_RES_STATUS_CSUM_DONE = BIT(16),
+  RX_MPDU_RES_STATUS_CSUM_OK = BIT(17),
+  RX_MDPU_RES_STATUS_STA_ID_SHIFT = 24,
+  RX_MPDU_RES_STATUS_STA_ID_MSK = 0x1f << RX_MDPU_RES_STATUS_STA_ID_SHIFT,
+};
+
+/* 9000 series API */
+enum iwl_rx_mpdu_mac_flags1 {
+  IWL_RX_MDPU_MFLG1_ADDRTYPE_MASK = 0x03,
+  IWL_RX_MPDU_MFLG1_MIC_CRC_LEN_MASK = 0xf0,
+  /* shift should be 4, but the length is measured in 2-byte
+   * words, so shifting only by 3 gives a byte result
+   */
+  IWL_RX_MPDU_MFLG1_MIC_CRC_LEN_SHIFT = 3,
+};
+
+enum iwl_rx_mpdu_mac_flags2 {
+  /* in 2-byte words */
+  IWL_RX_MPDU_MFLG2_HDR_LEN_MASK = 0x1f,
+  IWL_RX_MPDU_MFLG2_PAD = 0x20,
+  IWL_RX_MPDU_MFLG2_AMSDU = 0x40,
+};
+
+enum iwl_rx_mpdu_amsdu_info {
+  IWL_RX_MPDU_AMSDU_SUBFRAME_IDX_MASK = 0x7f,
+  IWL_RX_MPDU_AMSDU_LAST_SUBFRAME = 0x80,
+};
+
+enum iwl_rx_l3_proto_values {
+  IWL_RX_L3_TYPE_NONE,
+  IWL_RX_L3_TYPE_IPV4,
+  IWL_RX_L3_TYPE_IPV4_FRAG,
+  IWL_RX_L3_TYPE_IPV6_FRAG,
+  IWL_RX_L3_TYPE_IPV6,
+  IWL_RX_L3_TYPE_IPV6_IN_IPV4,
+  IWL_RX_L3_TYPE_ARP,
+  IWL_RX_L3_TYPE_EAPOL,
+};
+
+#define IWL_RX_L3_PROTO_POS 4
+
+enum iwl_rx_l3l4_flags {
+  IWL_RX_L3L4_IP_HDR_CSUM_OK = BIT(0),
+  IWL_RX_L3L4_TCP_UDP_CSUM_OK = BIT(1),
+  IWL_RX_L3L4_TCP_FIN_SYN_RST_PSH = BIT(2),
+  IWL_RX_L3L4_TCP_ACK = BIT(3),
+  IWL_RX_L3L4_L3_PROTO_MASK = 0xf << IWL_RX_L3_PROTO_POS,
+  IWL_RX_L3L4_L4_PROTO_MASK = 0xf << 8,
+  IWL_RX_L3L4_RSS_HASH_MASK = 0xf << 12,
+};
+
+enum iwl_rx_mpdu_status {
+  IWL_RX_MPDU_STATUS_CRC_OK = BIT(0),
+  IWL_RX_MPDU_STATUS_OVERRUN_OK = BIT(1),
+  IWL_RX_MPDU_STATUS_SRC_STA_FOUND = BIT(2),
+  IWL_RX_MPDU_STATUS_KEY_VALID = BIT(3),
+  IWL_RX_MPDU_STATUS_KEY_PARAM_OK = BIT(4),
+  IWL_RX_MPDU_STATUS_ICV_OK = BIT(5),
+  IWL_RX_MPDU_STATUS_MIC_OK = BIT(6),
+  IWL_RX_MPDU_RES_STATUS_TTAK_OK = BIT(7),
+  IWL_RX_MPDU_STATUS_SEC_MASK = 0x7 << 8,
+  IWL_RX_MPDU_STATUS_SEC_UNKNOWN = IWL_RX_MPDU_STATUS_SEC_MASK,
+  IWL_RX_MPDU_STATUS_SEC_NONE = 0x0 << 8,
+  IWL_RX_MPDU_STATUS_SEC_WEP = 0x1 << 8,
+  IWL_RX_MPDU_STATUS_SEC_CCM = 0x2 << 8,
+  IWL_RX_MPDU_STATUS_SEC_TKIP = 0x3 << 8,
+  IWL_RX_MPDU_STATUS_SEC_EXT_ENC = 0x4 << 8,
+  IWL_RX_MPDU_STATUS_SEC_GCM = 0x5 << 8,
+  IWL_RX_MPDU_STATUS_DECRYPTED = BIT(11),
+  IWL_RX_MPDU_STATUS_WEP_MATCH = BIT(12),
+  IWL_RX_MPDU_STATUS_EXT_IV_MATCH = BIT(13),
+  IWL_RX_MPDU_STATUS_KEY_ID_MATCH = BIT(14),
+  IWL_RX_MPDU_STATUS_ROBUST_MNG_FRAME = BIT(15),
+};
+
+enum iwl_rx_mpdu_hash_filter {
+  IWL_RX_MPDU_HF_A1_HASH_MASK = 0x3f,
+  IWL_RX_MPDU_HF_FILTER_STATUS_MASK = 0xc0,
+};
+
+enum iwl_rx_mpdu_sta_id_flags {
+  IWL_RX_MPDU_SIF_STA_ID_MASK = 0x1f,
+  IWL_RX_MPDU_SIF_RRF_ABORT = 0x20,
+  IWL_RX_MPDU_SIF_FILTER_STATUS_MASK = 0xc0,
+};
+
+#define IWL_RX_REORDER_DATA_INVALID_BAID 0x7f
+
+enum iwl_rx_mpdu_reorder_data {
+  IWL_RX_MPDU_REORDER_NSSN_MASK = 0x00000fff,
+  IWL_RX_MPDU_REORDER_SN_MASK = 0x00fff000,
+  IWL_RX_MPDU_REORDER_SN_SHIFT = 12,
+  IWL_RX_MPDU_REORDER_BAID_MASK = 0x7f000000,
+  IWL_RX_MPDU_REORDER_BAID_SHIFT = 24,
+  IWL_RX_MPDU_REORDER_BA_OLD_SN = 0x80000000,
+};
+
+enum iwl_rx_mpdu_phy_info {
+  IWL_RX_MPDU_PHY_8023 = BIT(0),
+  IWL_RX_MPDU_PHY_AMPDU = BIT(5),
+  IWL_RX_MPDU_PHY_AMPDU_TOGGLE = BIT(6),
+  IWL_RX_MPDU_PHY_SHORT_PREAMBLE = BIT(7),
+  IWL_RX_MPDU_PHY_TSF_OVERLOAD = BIT(8),
+};
+
+enum iwl_rx_mpdu_mac_info {
+  IWL_RX_MPDU_PHY_MAC_INDEX_MASK = 0x0f,
+  IWL_RX_MPDU_PHY_PHY_INDEX_MASK = 0xf0,
+};
+
+/* TSF overload low dword */
+enum iwl_rx_phy_data0 {
+  /* info type: HE any */
+  IWL_RX_PHY_DATA0_HE_BEAM_CHNG = 0x00000001,
+  IWL_RX_PHY_DATA0_HE_UPLINK = 0x00000002,
+  IWL_RX_PHY_DATA0_HE_BSS_COLOR_MASK = 0x000000fc,
+  IWL_RX_PHY_DATA0_HE_SPATIAL_REUSE_MASK = 0x00000f00,
+  /* 1 bit reserved */
+  IWL_RX_PHY_DATA0_HE_TXOP_DUR_MASK = 0x000fe000,
+  IWL_RX_PHY_DATA0_HE_LDPC_EXT_SYM = 0x00100000,
+  IWL_RX_PHY_DATA0_HE_PRE_FEC_PAD_MASK = 0x00600000,
+  IWL_RX_PHY_DATA0_HE_PE_DISAMBIG = 0x00800000,
+  IWL_RX_PHY_DATA0_HE_DOPPLER = 0x01000000,
+  /* 6 bits reserved */
+  IWL_RX_PHY_DATA0_HE_DELIM_EOF = 0x80000000,
+};
+
+enum iwl_rx_phy_info_type {
+  IWL_RX_PHY_INFO_TYPE_NONE = 0,
+  IWL_RX_PHY_INFO_TYPE_CCK = 1,
+  IWL_RX_PHY_INFO_TYPE_OFDM_LGCY = 2,
+  IWL_RX_PHY_INFO_TYPE_HT = 3,
+  IWL_RX_PHY_INFO_TYPE_VHT_SU = 4,
+  IWL_RX_PHY_INFO_TYPE_VHT_MU = 5,
+  IWL_RX_PHY_INFO_TYPE_HE_SU = 6,
+  IWL_RX_PHY_INFO_TYPE_HE_MU = 7,
+  IWL_RX_PHY_INFO_TYPE_HE_TB = 8,
+  IWL_RX_PHY_INFO_TYPE_HE_MU_EXT = 9,
+  IWL_RX_PHY_INFO_TYPE_HE_TB_EXT = 10,
+};
+
+/* TSF overload high dword */
+enum iwl_rx_phy_data1 {
+  /*
+   * check this first - if TSF overload is set,
+   * see &enum iwl_rx_phy_info_type
+   */
+  IWL_RX_PHY_DATA1_INFO_TYPE_MASK = 0xf0000000,
+
+  /* info type: HT/VHT/HE any */
+  IWL_RX_PHY_DATA1_LSIG_LEN_MASK = 0x0fff0000,
+
+  /* info type: HE MU/MU-EXT */
+  IWL_RX_PHY_DATA1_HE_MU_SIGB_COMPRESSION = 0x00000001,
+  IWL_RX_PHY_DATA1_HE_MU_SIBG_SYM_OR_USER_NUM_MASK = 0x0000001e,
+
+  /* info type: HE any */
+  IWL_RX_PHY_DATA1_HE_LTF_NUM_MASK = 0x000000e0,
+  IWL_RX_PHY_DATA1_HE_RU_ALLOC_SEC80 = 0x00000100,
+  /* trigger encoded */
+  IWL_RX_PHY_DATA1_HE_RU_ALLOC_MASK = 0x0000fe00,
+
+  /* info type: HE TB/TX-EXT */
+  IWL_RX_PHY_DATA1_HE_TB_PILOT_TYPE = 0x00000001,
+  IWL_RX_PHY_DATA1_HE_TB_LOW_SS_MASK = 0x0000000e,
+};
+
+/* goes into Metadata DW 7 */
+enum iwl_rx_phy_data2 {
+  /* info type: HE MU-EXT */
+  /* the a1/a2/... is what the PHY/firmware calls the values */
+  IWL_RX_PHY_DATA2_HE_MU_EXT_CH1_RU0 = 0x000000ff, /* a1 */
+  IWL_RX_PHY_DATA2_HE_MU_EXT_CH1_RU2 = 0x0000ff00, /* a2 */
+  IWL_RX_PHY_DATA2_HE_MU_EXT_CH2_RU0 = 0x00ff0000, /* b1 */
+  IWL_RX_PHY_DATA2_HE_MU_EXT_CH2_RU2 = 0xff000000, /* b2 */
+
+  /* info type: HE TB-EXT */
+  IWL_RX_PHY_DATA2_HE_TB_EXT_SPTL_REUSE1 = 0x0000000f,
+  IWL_RX_PHY_DATA2_HE_TB_EXT_SPTL_REUSE2 = 0x000000f0,
+  IWL_RX_PHY_DATA2_HE_TB_EXT_SPTL_REUSE3 = 0x00000f00,
+  IWL_RX_PHY_DATA2_HE_TB_EXT_SPTL_REUSE4 = 0x0000f000,
+};
+
+/* goes into Metadata DW 8 */
+enum iwl_rx_phy_data3 {
+  /* info type: HE MU-EXT */
+  IWL_RX_PHY_DATA3_HE_MU_EXT_CH1_RU1 = 0x000000ff, /* c1 */
+  IWL_RX_PHY_DATA3_HE_MU_EXT_CH1_RU3 = 0x0000ff00, /* c2 */
+  IWL_RX_PHY_DATA3_HE_MU_EXT_CH2_RU1 = 0x00ff0000, /* d1 */
+  IWL_RX_PHY_DATA3_HE_MU_EXT_CH2_RU3 = 0xff000000, /* d2 */
+};
+
+/* goes into Metadata DW 4 high 16 bits */
+enum iwl_rx_phy_data4 {
+  /* info type: HE MU-EXT */
+  IWL_RX_PHY_DATA4_HE_MU_EXT_CH1_CTR_RU = 0x0001,
+  IWL_RX_PHY_DATA4_HE_MU_EXT_CH2_CTR_RU = 0x0002,
+  IWL_RX_PHY_DATA4_HE_MU_EXT_CH1_CRC_OK = 0x0004,
+  IWL_RX_PHY_DATA4_HE_MU_EXT_CH2_CRC_OK = 0x0008,
+  IWL_RX_PHY_DATA4_HE_MU_EXT_SIGB_MCS_MASK = 0x00f0,
+  IWL_RX_PHY_DATA4_HE_MU_EXT_SIGB_DCM = 0x0100,
+  IWL_RX_PHY_DATA4_HE_MU_EXT_PREAMBLE_PUNC_TYPE_MASK = 0x0600,
+};
+
+/**
+ * struct iwl_rx_mpdu_desc_v1 - RX MPDU descriptor
+ */
+struct iwl_rx_mpdu_desc_v1 {
+  /* DW7 - carries rss_hash only when rpa_en == 1 */
+  union {
+    /**
+     * @rss_hash: RSS hash value
+     */
+    __le32 rss_hash;
+
+    /**
+     * @phy_data2: depends on info type (see @phy_data1)
+     */
+    __le32 phy_data2;
+  };
+
+  /* DW8 - carries filter_match only when rpa_en == 1 */
+  union {
+    /**
+     * @filter_match: filter match value
+     */
+    __le32 filter_match;
+
+    /**
+     * @phy_data3: depends on info type (see @phy_data1)
+     */
+    __le32 phy_data3;
+  };
+
+  /* DW9 */
+  /**
+   * @rate_n_flags: RX rate/flags encoding
+   */
+  __le32 rate_n_flags;
+  /* DW10 */
+  /**
+   * @energy_a: energy chain A
+   */
+  uint8_t energy_a;
+  /**
+   * @energy_b: energy chain B
+   */
+  uint8_t energy_b;
+  /**
+   * @channel: channel number
+   */
+  uint8_t channel;
+  /**
+   * @mac_context: MAC context mask
+   */
+  uint8_t mac_context;
+  /* DW11 */
+  /**
+   * @gp2_on_air_rise: GP2 timer value on air rise (INA)
+   */
+  __le32 gp2_on_air_rise;
+  /* DW12 & DW13 */
+  union {
+    /**
+     * @tsf_on_air_rise:
+     * TSF value on air rise (INA), only valid if
+     * %IWL_RX_MPDU_PHY_TSF_OVERLOAD isn't set
+     */
+    __le64 tsf_on_air_rise;
+
+    struct {
+      /**
+       * @phy_data0: depends on info_type, see @phy_data1
+       */
+      __le32 phy_data0;
+      /**
+       * @phy_data1: valid only if
+       * %IWL_RX_MPDU_PHY_TSF_OVERLOAD is set,
+       * see &enum iwl_rx_phy_data1.
+       */
+      __le32 phy_data1;
+    };
+  };
+} __packed;
+
+/**
+ * struct iwl_rx_mpdu_desc_v3 - RX MPDU descriptor
+ */
+struct iwl_rx_mpdu_desc_v3 {
+  /* DW7 - carries filter_match only when rpa_en == 1 */
+  union {
+    /**
+     * @filter_match: filter match value
+     */
+    __le32 filter_match;
+
+    /**
+     * @phy_data2: depends on info type (see @phy_data1)
+     */
+    __le32 phy_data2;
+  };
+
+  /* DW8 - carries rss_hash only when rpa_en == 1 */
+  union {
+    /**
+     * @rss_hash: RSS hash value
+     */
+    __le32 rss_hash;
+
+    /**
+     * @phy_data3: depends on info type (see @phy_data1)
+     */
+    __le32 phy_data3;
+  };
+  /* DW9 */
+  /**
+   * @partial_hash: 31:0 ip/tcp header hash
+   *  w/o some fields (such as IP SRC addr)
+   */
+  __le32 partial_hash;
+  /* DW10 */
+  /**
+   * @raw_xsum: raw xsum value
+   */
+  __le32 raw_xsum;
+  /* DW11 */
+  /**
+   * @rate_n_flags: RX rate/flags encoding
+   */
+  __le32 rate_n_flags;
+  /* DW12 */
+  /**
+   * @energy_a: energy chain A
+   */
+  uint8_t energy_a;
+  /**
+   * @energy_b: energy chain B
+   */
+  uint8_t energy_b;
+  /**
+   * @channel: channel number
+   */
+  uint8_t channel;
+  /**
+   * @mac_context: MAC context mask
+   */
+  uint8_t mac_context;
+  /* DW13 */
+  /**
+   * @gp2_on_air_rise: GP2 timer value on air rise (INA)
+   */
+  __le32 gp2_on_air_rise;
+  /* DW14 & DW15 */
+  union {
+    /**
+     * @tsf_on_air_rise:
+     * TSF value on air rise (INA), only valid if
+     * %IWL_RX_MPDU_PHY_TSF_OVERLOAD isn't set
+     */
+    __le64 tsf_on_air_rise;
+
+    struct {
+      /**
+       * @phy_data0: depends on info_type, see @phy_data1
+       */
+      __le32 phy_data0;
+      /**
+       * @phy_data1: valid only if
+       * %IWL_RX_MPDU_PHY_TSF_OVERLOAD is set,
+       * see &enum iwl_rx_phy_data1.
+       */
+      __le32 phy_data1;
+    };
+  };
+  /* DW16 & DW17 */
+  /**
+   * @reserved: reserved
+   */
+  __le32 reserved[2];
+} __packed; /* RX_MPDU_RES_START_API_S_VER_3 */
+
+/**
+ * struct iwl_rx_mpdu_desc - RX MPDU descriptor
+ */
+struct iwl_rx_mpdu_desc {
+  /* DW2 */
+  /**
+   * @mpdu_len: MPDU length
+   */
+  __le16 mpdu_len;
+  /**
+   * @mac_flags1: &enum iwl_rx_mpdu_mac_flags1
+   */
+  uint8_t mac_flags1;
+  /**
+   * @mac_flags2: &enum iwl_rx_mpdu_mac_flags2
+   */
+  uint8_t mac_flags2;
+  /* DW3 */
+  /**
+   * @amsdu_info: &enum iwl_rx_mpdu_amsdu_info
+   */
+  uint8_t amsdu_info;
+  /**
+   * @phy_info: &enum iwl_rx_mpdu_phy_info
+   */
+  __le16 phy_info;
+  /**
+   * @mac_phy_idx: MAC/PHY index
+   */
+  uint8_t mac_phy_idx;
+  /* DW4 - carries csum data only when rpa_en == 1 */
+  /**
+   * @raw_csum: raw checksum (alledgedly unreliable)
+   */
+  __le16 raw_csum;
+
+  union {
+    /**
+     * @l3l4_flags: &enum iwl_rx_l3l4_flags
+     */
+    __le16 l3l4_flags;
+
+    /**
+     * @phy_data4: depends on info type, see phy_data1
+     */
+    __le16 phy_data4;
+  };
+  /* DW5 */
+  /**
+   * @status: &enum iwl_rx_mpdu_status
+   */
+  __le16 status;
+  /**
+   * @hash_filter: hash filter value
+   */
+  uint8_t hash_filter;
+  /**
+   * @sta_id_flags: &enum iwl_rx_mpdu_sta_id_flags
+   */
+  uint8_t sta_id_flags;
+  /* DW6 */
+  /**
+   * @reorder_data: &enum iwl_rx_mpdu_reorder_data
+   */
+  __le32 reorder_data;
+
+  union {
+    struct iwl_rx_mpdu_desc_v1 v1;
+    struct iwl_rx_mpdu_desc_v3 v3;
+  };
+} __packed; /* RX_MPDU_RES_START_API_S_VER_3 */
+
+#define IWL_RX_DESC_SIZE_V1 offsetofend(struct iwl_rx_mpdu_desc, v1)
+
+#define IWL_CD_STTS_OPTIMIZED_POS 0
+#define IWL_CD_STTS_OPTIMIZED_MSK 0x01
+#define IWL_CD_STTS_TRANSFER_STATUS_POS 1
+#define IWL_CD_STTS_TRANSFER_STATUS_MSK 0x0E
+#define IWL_CD_STTS_WIFI_STATUS_POS 4
+#define IWL_CD_STTS_WIFI_STATUS_MSK 0xF0
+
+#define RX_NO_DATA_CHAIN_A_POS 0
+#define RX_NO_DATA_CHAIN_A_MSK (0xff << RX_NO_DATA_CHAIN_A_POS)
+#define RX_NO_DATA_CHAIN_B_POS 8
+#define RX_NO_DATA_CHAIN_B_MSK (0xff << RX_NO_DATA_CHAIN_B_POS)
+#define RX_NO_DATA_CHANNEL_POS 16
+#define RX_NO_DATA_CHANNEL_MSK (0xff << RX_NO_DATA_CHANNEL_POS)
+
+#define RX_NO_DATA_INFO_TYPE_POS 0
+#define RX_NO_DATA_INFO_TYPE_MSK (0xff << RX_NO_DATA_INFO_TYPE_POS)
+#define RX_NO_DATA_INFO_TYPE_NONE 0
+#define RX_NO_DATA_INFO_TYPE_RX_ERR 1
+#define RX_NO_DATA_INFO_TYPE_NDP 2
+#define RX_NO_DATA_INFO_TYPE_MU_UNMATCHED 3
+#define RX_NO_DATA_INFO_TYPE_HE_TB_UNMATCHED 4
+
+#define RX_NO_DATA_INFO_ERR_POS 8
+#define RX_NO_DATA_INFO_ERR_MSK (0xff << RX_NO_DATA_INFO_ERR_POS)
+#define RX_NO_DATA_INFO_ERR_NONE 0
+#define RX_NO_DATA_INFO_ERR_BAD_PLCP 1
+#define RX_NO_DATA_INFO_ERR_UNSUPPORTED_RATE 2
+#define RX_NO_DATA_INFO_ERR_NO_DELIM 3
+#define RX_NO_DATA_INFO_ERR_BAD_MAC_HDR 4
+
+#define RX_NO_DATA_FRAME_TIME_POS 0
+#define RX_NO_DATA_FRAME_TIME_MSK (0xfffff << RX_NO_DATA_FRAME_TIME_POS)
+
+#define RX_NO_DATA_RX_VEC0_HE_NSTS_MSK 0x03800000
+#define RX_NO_DATA_RX_VEC0_VHT_NSTS_MSK 0x38000000
+
+/**
+ * struct iwl_rx_no_data - RX no data descriptor
+ * @info: 7:0 frame type, 15:8 RX error type
+ * @rssi: 7:0 energy chain-A,
+ *  15:8 chain-B, measured at FINA time (FINA_ENERGY), 16:23 channel
+ * @on_air_rise_time: GP2 during on air rise
+ * @fr_time: frame time
+ * @rate: rate/mcs of frame
+ * @phy_info: &enum iwl_rx_phy_data0 and &enum iwl_rx_phy_info_type
+ * @rx_vec: DW-12:9 raw RX vectors from DSP according to modulation type.
+ *  for VHT: OFDM_RX_VECTOR_SIGA1_OUT, OFDM_RX_VECTOR_SIGA2_OUT
+ *  for HE: OFDM_RX_VECTOR_HE_SIGA1_OUT, OFDM_RX_VECTOR_HE_SIGA2_OUT
+ */
+struct iwl_rx_no_data {
+  __le32 info;
+  __le32 rssi;
+  __le32 on_air_rise_time;
+  __le32 fr_time;
+  __le32 rate;
+  __le32 phy_info[2];
+  __le32 rx_vec[2];
+} __packed; /* RX_NO_DATA_NTFY_API_S_VER_1 */
+
+/**
+ * enum iwl_completion_desc_transfer_status -  transfer status (bits 1-3)
+ * @IWL_CD_STTS_UNUSED: unused
+ * @IWL_CD_STTS_UNUSED_2: unused
+ * @IWL_CD_STTS_END_TRANSFER: successful transfer complete.
+ *  In sniffer mode, when split is used, set in last CD completion. (RX)
+ * @IWL_CD_STTS_OVERFLOW: In sniffer mode, when using split - used for
+ *  all CD completion. (RX)
+ * @IWL_CD_STTS_ABORTED: CR abort / close flow. (RX)
+ * @IWL_CD_STTS_ERROR: general error (RX)
+ */
+enum iwl_completion_desc_transfer_status {
+  IWL_CD_STTS_UNUSED,
+  IWL_CD_STTS_UNUSED_2,
+  IWL_CD_STTS_END_TRANSFER,
+  IWL_CD_STTS_OVERFLOW,
+  IWL_CD_STTS_ABORTED,
+  IWL_CD_STTS_ERROR,
+};
+
+/**
+ * enum iwl_completion_desc_wifi_status - wifi status (bits 4-7)
+ * @IWL_CD_STTS_VALID: the packet is valid (RX)
+ * @IWL_CD_STTS_FCS_ERR: frame check sequence error (RX)
+ * @IWL_CD_STTS_SEC_KEY_ERR: error handling the security key of rx (RX)
+ * @IWL_CD_STTS_DECRYPTION_ERR: error decrypting the frame (RX)
+ * @IWL_CD_STTS_DUP: duplicate packet (RX)
+ * @IWL_CD_STTS_ICV_MIC_ERR: MIC error (RX)
+ * @IWL_CD_STTS_INTERNAL_SNAP_ERR: problems removing the snap (RX)
+ * @IWL_CD_STTS_SEC_PORT_FAIL: security port fail (RX)
+ * @IWL_CD_STTS_BA_OLD_SN: block ack received old SN (RX)
+ * @IWL_CD_STTS_QOS_NULL: QoS null packet (RX)
+ * @IWL_CD_STTS_MAC_HDR_ERR: MAC header conversion error (RX)
+ * @IWL_CD_STTS_MAX_RETRANS: reached max number of retransmissions (TX)
+ * @IWL_CD_STTS_EX_LIFETIME: exceeded lifetime (TX)
+ * @IWL_CD_STTS_NOT_USED: completed but not used (RX)
+ * @IWL_CD_STTS_REPLAY_ERR: pn check failed, replay error (RX)
+ */
+enum iwl_completion_desc_wifi_status {
+  IWL_CD_STTS_VALID,
+  IWL_CD_STTS_FCS_ERR,
+  IWL_CD_STTS_SEC_KEY_ERR,
+  IWL_CD_STTS_DECRYPTION_ERR,
+  IWL_CD_STTS_DUP,
+  IWL_CD_STTS_ICV_MIC_ERR,
+  IWL_CD_STTS_INTERNAL_SNAP_ERR,
+  IWL_CD_STTS_SEC_PORT_FAIL,
+  IWL_CD_STTS_BA_OLD_SN,
+  IWL_CD_STTS_QOS_NULL,
+  IWL_CD_STTS_MAC_HDR_ERR,
+  IWL_CD_STTS_MAX_RETRANS,
+  IWL_CD_STTS_EX_LIFETIME,
+  IWL_CD_STTS_NOT_USED,
+  IWL_CD_STTS_REPLAY_ERR,
+};
+
+struct iwl_frame_release {
+  uint8_t baid;
+  uint8_t reserved;
+  __le16 nssn;
+};
+
+enum iwl_rss_hash_func_en {
+  IWL_RSS_HASH_TYPE_IPV4_TCP,
+  IWL_RSS_HASH_TYPE_IPV4_UDP,
+  IWL_RSS_HASH_TYPE_IPV4_PAYLOAD,
+  IWL_RSS_HASH_TYPE_IPV6_TCP,
+  IWL_RSS_HASH_TYPE_IPV6_UDP,
+  IWL_RSS_HASH_TYPE_IPV6_PAYLOAD,
+};
+
+#define IWL_RSS_HASH_KEY_CNT 10
+#define IWL_RSS_INDIRECTION_TABLE_SIZE 128
+#define IWL_RSS_ENABLE 1
+
+/**
+ * struct iwl_rss_config_cmd - RSS (Receive Side Scaling) configuration
+ *
+ * @flags: 1 - enable, 0 - disable
+ * @hash_mask: Type of RSS to use. Values are from %iwl_rss_hash_func_en
+ * @reserved: reserved
+ * @secret_key: 320 bit input of random key configuration from driver
+ * @indirection_table: indirection table
+ */
+struct iwl_rss_config_cmd {
+  __le32 flags;
+  uint8_t hash_mask;
+  uint8_t reserved[3];
+  __le32 secret_key[IWL_RSS_HASH_KEY_CNT];
+  uint8_t indirection_table[IWL_RSS_INDIRECTION_TABLE_SIZE];
+} __packed; /* RSS_CONFIG_CMD_API_S_VER_1 */
+
+#define IWL_MULTI_QUEUE_SYNC_MSG_MAX_SIZE 128
+#define IWL_MULTI_QUEUE_SYNC_SENDER_POS 0
+#define IWL_MULTI_QUEUE_SYNC_SENDER_MSK 0xf
+
+/**
+ * struct iwl_rxq_sync_cmd - RXQ notification trigger
+ *
+ * @flags: flags of the notification. bit 0:3 are the sender queue
+ * @rxq_mask: rx queues to send the notification on
+ * @count: number of bytes in payload, should be DWORD aligned
+ * @payload: data to send to rx queues
+ */
+struct iwl_rxq_sync_cmd {
+  __le32 flags;
+  __le32 rxq_mask;
+  __le32 count;
+  uint8_t payload[];
+} __packed; /* MULTI_QUEUE_DRV_SYNC_HDR_CMD_API_S_VER_1 */
+
+/**
+ * struct iwl_rxq_sync_notification - Notification triggered by RXQ
+ * sync command
+ *
+ * @count: number of bytes in payload
+ * @payload: data to send to rx queues
+ */
+struct iwl_rxq_sync_notification {
+  __le32 count;
+  uint8_t payload[];
+} __packed; /* MULTI_QUEUE_DRV_SYNC_HDR_CMD_API_S_VER_1 */
+
+/**
+ * enum iwl_mvm_rxq_notif_type - Internal message identifier
+ *
+ * @IWL_MVM_RXQ_EMPTY: empty sync notification
+ * @IWL_MVM_RXQ_NOTIF_DEL_BA: notify RSS queues of delBA
+ */
+enum iwl_mvm_rxq_notif_type {
+  IWL_MVM_RXQ_EMPTY,
+  IWL_MVM_RXQ_NOTIF_DEL_BA,
+};
+
+/**
+ * struct iwl_mvm_internal_rxq_notif - Internal representation of the data sent
+ * in &iwl_rxq_sync_cmd. Should be DWORD aligned.
+ * FW is agnostic to the payload, so there are no endianity requirements.
+ *
+ * @type: value from &iwl_mvm_rxq_notif_type
+ * @sync: ctrl path is waiting for all notifications to be received
+ * @cookie: internal cookie to identify old notifications
+ * @data: payload
+ */
+struct iwl_mvm_internal_rxq_notif {
+  uint16_t type;
+  uint16_t sync;
+  uint32_t cookie;
+  uint8_t data[0];
+} __packed;
+
+/**
+ * enum iwl_mvm_pm_event - type of station PM event
+ * @IWL_MVM_PM_EVENT_AWAKE: station woke up
+ * @IWL_MVM_PM_EVENT_ASLEEP: station went to sleep
+ * @IWL_MVM_PM_EVENT_UAPSD: station sent uAPSD trigger
+ * @IWL_MVM_PM_EVENT_PS_POLL: station sent PS-Poll
+ */
+enum iwl_mvm_pm_event {
+  IWL_MVM_PM_EVENT_AWAKE,
+  IWL_MVM_PM_EVENT_ASLEEP,
+  IWL_MVM_PM_EVENT_UAPSD,
+  IWL_MVM_PM_EVENT_PS_POLL,
+}; /* PEER_PM_NTFY_API_E_VER_1 */
+
+/**
+ * struct iwl_mvm_pm_state_notification - station PM state notification
+ * @sta_id: station ID of the station changing state
+ * @type: the new powersave state, see &enum iwl_mvm_pm_event
+ */
+struct iwl_mvm_pm_state_notification {
+  uint8_t sta_id;
+  uint8_t type;
+  /* private: */
+  __le16 reserved;
+} __packed; /* PEER_PM_NTFY_API_S_VER_1 */
+
+#define BA_WINDOW_STREAMS_MAX 16
+#define BA_WINDOW_STATUS_TID_MSK 0x000F
+#define BA_WINDOW_STATUS_STA_ID_POS 4
+#define BA_WINDOW_STATUS_STA_ID_MSK 0x01F0
+#define BA_WINDOW_STATUS_VALID_MSK BIT(9)
+
+/**
+ * struct iwl_ba_window_status_notif - reordering window's status notification
+ * @bitmap: bitmap of received frames [start_seq_num + 0]..[start_seq_num + 63]
+ * @ra_tid: bit 3:0 - TID, bit 8:4 - STA_ID, bit 9 - valid
+ * @start_seq_num: the start sequence number of the bitmap
+ * @mpdu_rx_count: the number of received MPDUs since entering D0i3
+ */
+struct iwl_ba_window_status_notif {
+  __le64 bitmap[BA_WINDOW_STREAMS_MAX];
+  __le16 ra_tid[BA_WINDOW_STREAMS_MAX];
+  __le32 start_seq_num[BA_WINDOW_STREAMS_MAX];
+  __le16 mpdu_rx_count[BA_WINDOW_STREAMS_MAX];
+} __packed; /* BA_WINDOW_STATUS_NTFY_API_S_VER_1 */
+
+/**
+ * struct iwl_rfh_queue_config - RX queue configuration
+ * @q_num: Q num
+ * @enable: enable queue
+ * @reserved: alignment
+ * @urbd_stts_wrptr: DMA address of urbd_stts_wrptr
+ * @fr_bd_cb: DMA address of freeRB table
+ * @ur_bd_cb: DMA address of used RB table
+ * @fr_bd_wid: Initial index of the free table
+ */
+struct iwl_rfh_queue_data {
+  uint8_t q_num;
+  uint8_t enable;
+  __le16 reserved;
+  __le64 urbd_stts_wrptr;
+  __le64 fr_bd_cb;
+  __le64 ur_bd_cb;
+  __le32 fr_bd_wid;
+} __packed; /* RFH_QUEUE_CONFIG_S_VER_1 */
+
+/**
+ * struct iwl_rfh_queue_config - RX queue configuration
+ * @num_queues: number of queues configured
+ * @reserved: alignment
+ * @data: DMA addresses per-queue
+ */
+struct iwl_rfh_queue_config {
+  uint8_t num_queues;
+  uint8_t reserved[3];
+  struct iwl_rfh_queue_data data[];
+} __packed; /* RFH_QUEUE_CONFIG_API_S_VER_1 */
+
+#endif  // SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_RX_H_
diff --git a/third_party/iwlwifi/fw/api/scan.h b/third_party/iwlwifi/fw/api/scan.h
new file mode 100644
index 0000000..c532c4a
--- /dev/null
+++ b/third_party/iwlwifi/fw/api/scan.h
@@ -0,0 +1,837 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018        Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+
+#ifndef SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_SCAN_H_
+#define SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_SCAN_H_
+
+#include <fuchsia/wlan/ieee80211/c/banjo.h>
+#include <netinet/if_ether.h>
+#include <stdint.h>
+
+#include "src/iwlwifi/platform/compiler.h"
+
+/* Scan Commands, Responses, Notifications */
+
+/* Max number of IEs for direct SSID scans in a command */
+#define PROBE_OPTION_MAX 20
+
+/**
+ * struct iwl_ssid_ie - directed scan network information element
+ *
+ * Up to 20 of these may appear in REPLY_SCAN_CMD,
+ * selected by "type" bit field in struct iwl_scan_channel;
+ * each channel may select different ssids from among the 20 entries.
+ * SSID IEs get transmitted in reverse order of entry.
+ *
+ * @id: element ID
+ * @len: element length
+ * @ssid: element (SSID) data
+ */
+struct iwl_ssid_ie {
+  uint8_t id;
+  uint8_t len;
+  uint8_t ssid[fuchsia_wlan_ieee80211_MAX_SSID_BYTE_LEN];
+} __packed; /* SCAN_DIRECT_SSID_IE_API_S_VER_1 */
+
+/* scan offload */
+#define IWL_SCAN_MAX_BLACKLIST_LEN 64
+#define IWL_SCAN_SHORT_BLACKLIST_LEN 16
+#define IWL_SCAN_MAX_PROFILES 11
+#define SCAN_OFFLOAD_PROBE_REQ_SIZE 512
+
+/* Default watchdog (in MS) for scheduled scan iteration */
+#define IWL_SCHED_SCAN_WATCHDOG cpu_to_le16(15000)
+
+#define IWL_GOOD_CRC_TH_DEFAULT cpu_to_le16(1)
+#define CAN_ABORT_STATUS 1
+
+#define IWL_FULL_SCAN_MULTIPLIER 5
+#define IWL_FAST_SCHED_SCAN_ITERATIONS 3
+#define IWL_MAX_SCHED_SCAN_PLANS 2
+#define IWL_SCAN_MAX_NUM_OF_CHANNELS 52
+
+enum scan_framework_client {
+  SCAN_CLIENT_SCHED_SCAN = BIT(0),
+  SCAN_CLIENT_NETDETECT = BIT(1),
+  SCAN_CLIENT_ASSET_TRACKING = BIT(2),
+};
+
+/**
+ * struct iwl_scan_offload_blacklist - SCAN_OFFLOAD_BLACKLIST_S
+ * @ssid:       MAC address to filter out
+ * @reported_rssi:  AP rssi reported to the host
+ * @client_bitmap: clients ignore this entry  - enum scan_framework_client
+ */
+struct iwl_scan_offload_blacklist {
+  uint8_t ssid[ETH_ALEN];
+  uint8_t reported_rssi;
+  uint8_t client_bitmap;
+} __packed;
+
+enum iwl_scan_offload_network_type {
+  IWL_NETWORK_TYPE_BSS = 1,
+  IWL_NETWORK_TYPE_IBSS = 2,
+  IWL_NETWORK_TYPE_ANY = 3,
+};
+
+enum iwl_scan_offload_band_selection {
+  IWL_SCAN_OFFLOAD_SELECT_2_4 = 0x4,
+  IWL_SCAN_OFFLOAD_SELECT_5_2 = 0x8,
+  IWL_SCAN_OFFLOAD_SELECT_ANY = 0xc,
+};
+
+/**
+ * struct iwl_scan_offload_profile - SCAN_OFFLOAD_PROFILE_S
+ * @ssid_index:     index to ssid list in fixed part
+ * @unicast_cipher: encryption algorithm to match - bitmap
+ * @auth_alg:       authentication algorithm to match - bitmap
+ * @network_type:   enum iwl_scan_offload_network_type
+ * @band_selection: enum iwl_scan_offload_band_selection
+ * @client_bitmap:  clients waiting for match - enum scan_framework_client
+ * @reserved:       reserved
+ */
+struct iwl_scan_offload_profile {
+  uint8_t ssid_index;
+  uint8_t unicast_cipher;
+  uint8_t auth_alg;
+  uint8_t network_type;
+  uint8_t band_selection;
+  uint8_t client_bitmap;
+  uint8_t reserved[2];
+} __packed;
+
+/**
+ * struct iwl_scan_offload_profile_cfg - SCAN_OFFLOAD_PROFILES_CFG_API_S_VER_1
+ * @profiles:       profiles to search for match
+ * @blacklist_len:  length of blacklist
+ * @num_profiles:   num of profiles in the list
+ * @match_notify:   clients waiting for match found notification
+ * @pass_match:     clients waiting for the results
+ * @active_clients: active clients bitmap - enum scan_framework_client
+ * @any_beacon_notify:  clients waiting for match notification without match
+ * @reserved:       reserved
+ */
+struct iwl_scan_offload_profile_cfg {
+  struct iwl_scan_offload_profile profiles[IWL_SCAN_MAX_PROFILES];
+  uint8_t blacklist_len;
+  uint8_t num_profiles;
+  uint8_t match_notify;
+  uint8_t pass_match;
+  uint8_t active_clients;
+  uint8_t any_beacon_notify;
+  uint8_t reserved[2];
+} __packed;
+
+/**
+ * struct iwl_scan_schedule_lmac - schedule of scan offload
+ * @delay:      delay between iterations, in seconds.
+ * @iterations:     num of scan iterations
+ * @full_scan_mul:  number of partial scans before each full scan
+ */
+struct iwl_scan_schedule_lmac {
+  __le16 delay;
+  uint8_t iterations;
+  uint8_t full_scan_mul;
+} __packed; /* SCAN_SCHEDULE_API_S */
+
+enum iwl_scan_offload_complete_status {
+  IWL_SCAN_OFFLOAD_COMPLETED = 1,
+  IWL_SCAN_OFFLOAD_ABORTED = 2,
+};
+
+enum iwl_scan_ebs_status {
+  IWL_SCAN_EBS_SUCCESS,
+  IWL_SCAN_EBS_FAILED,
+  IWL_SCAN_EBS_CHAN_NOT_FOUND,
+  IWL_SCAN_EBS_INACTIVE,
+};
+
+/**
+ * struct iwl_scan_req_tx_cmd - SCAN_REQ_TX_CMD_API_S
+ * @tx_flags: combination of TX_CMD_FLG_*
+ * @rate_n_flags: rate for *all* Tx attempts, if TX_CMD_FLG_STA_RATE_MSK is
+ *  cleared. Combination of RATE_MCS_*
+ * @sta_id: index of destination station in FW station table
+ * @reserved: for alignment and future use
+ */
+struct iwl_scan_req_tx_cmd {
+  __le32 tx_flags;
+  __le32 rate_n_flags;
+  uint8_t sta_id;
+  uint8_t reserved[3];
+} __packed;
+
+enum iwl_scan_channel_flags_lmac {
+  IWL_UNIFIED_SCAN_CHANNEL_FULL = BIT(27),
+  IWL_UNIFIED_SCAN_CHANNEL_PARTIAL = BIT(28),
+};
+
+/**
+ * struct iwl_scan_channel_cfg_lmac - SCAN_CHANNEL_CFG_S_VER2
+ * @flags:      bits 1-20: directed scan to i'th ssid
+ *          other bits &enum iwl_scan_channel_flags_lmac
+ * @channel_num:    channel number 1-13 etc
+ * @iter_count:     scan iteration on this channel
+ * @iter_interval:  interval in seconds between iterations on one channel
+ */
+struct iwl_scan_channel_cfg_lmac {
+  __le32 flags;
+  __le16 channel_num;
+  __le16 iter_count;
+  __le32 iter_interval;
+} __packed;
+
+/*
+ * struct iwl_scan_probe_segment - PROBE_SEGMENT_API_S_VER_1
+ * @offset: offset in the data block
+ * @len: length of the segment
+ */
+struct iwl_scan_probe_segment {
+  __le16 offset;
+  __le16 len;
+} __packed;
+
+/* iwl_scan_probe_req - PROBE_REQUEST_FRAME_API_S_VER_2
+ * @mac_header: first (and common) part of the probe
+ * @band_data: band specific data
+ * @common_data: last (and common) part of the probe
+ * @buf: raw data block
+ */
+struct iwl_scan_probe_req {
+  struct iwl_scan_probe_segment mac_header;
+  struct iwl_scan_probe_segment band_data[2];
+  struct iwl_scan_probe_segment common_data;
+  uint8_t buf[SCAN_OFFLOAD_PROBE_REQ_SIZE];
+} __packed;
+
+enum iwl_scan_channel_flags {
+  IWL_SCAN_CHANNEL_FLAG_EBS = BIT(0),
+  IWL_SCAN_CHANNEL_FLAG_EBS_ACCURATE = BIT(1),
+  IWL_SCAN_CHANNEL_FLAG_CACHE_ADD = BIT(2),
+  IWL_SCAN_CHANNEL_FLAG_EBS_FRAG = BIT(3),
+};
+
+/* struct iwl_scan_channel_opt - CHANNEL_OPTIMIZATION_API_S
+ * @flags: enum iwl_scan_channel_flags
+ * @non_ebs_ratio: defines the ratio of number of scan iterations where EBS is
+ *  involved.
+ *  1 - EBS is disabled.
+ *  2 - every second scan will be full scan(and so on).
+ */
+struct iwl_scan_channel_opt {
+  __le16 flags;
+  __le16 non_ebs_ratio;
+} __packed;
+
+/**
+ * enum iwl_mvm_lmac_scan_flags - LMAC scan flags
+ * @IWL_MVM_LMAC_SCAN_FLAG_PASS_ALL: pass all beacons and probe responses
+ *  without filtering.
+ * @IWL_MVM_LMAC_SCAN_FLAG_PASSIVE: force passive scan on all channels
+ * @IWL_MVM_LMAC_SCAN_FLAG_PRE_CONNECTION: single channel scan
+ * @IWL_MVM_LMAC_SCAN_FLAG_ITER_COMPLETE: send iteration complete notification
+ * @IWL_MVM_LMAC_SCAN_FLAG_MULTIPLE_SSIDS: multiple SSID matching
+ * @IWL_MVM_LMAC_SCAN_FLAG_FRAGMENTED: all passive scans will be fragmented
+ * @IWL_MVM_LMAC_SCAN_FLAGS_RRM_ENABLED: insert WFA vendor-specific TPC report
+ *  and DS parameter set IEs into probe requests.
+ * @IWL_MVM_LMAC_SCAN_FLAG_EXTENDED_DWELL: use extended dwell time on channels
+ *  1, 6 and 11.
+ * @IWL_MVM_LMAC_SCAN_FLAG_MATCH: Send match found notification on matches
+ */
+enum iwl_mvm_lmac_scan_flags {
+  IWL_MVM_LMAC_SCAN_FLAG_PASS_ALL = BIT(0),
+  IWL_MVM_LMAC_SCAN_FLAG_PASSIVE = BIT(1),
+  IWL_MVM_LMAC_SCAN_FLAG_PRE_CONNECTION = BIT(2),
+  IWL_MVM_LMAC_SCAN_FLAG_ITER_COMPLETE = BIT(3),
+  IWL_MVM_LMAC_SCAN_FLAG_MULTIPLE_SSIDS = BIT(4),
+  IWL_MVM_LMAC_SCAN_FLAG_FRAGMENTED = BIT(5),
+  IWL_MVM_LMAC_SCAN_FLAGS_RRM_ENABLED = BIT(6),
+  IWL_MVM_LMAC_SCAN_FLAG_EXTENDED_DWELL = BIT(7),
+  IWL_MVM_LMAC_SCAN_FLAG_MATCH = BIT(9),
+};
+
+enum iwl_scan_priority {
+  IWL_SCAN_PRIORITY_LOW,
+  IWL_SCAN_PRIORITY_MEDIUM,
+  IWL_SCAN_PRIORITY_HIGH,
+};
+
+enum iwl_scan_priority_ext {
+  IWL_SCAN_PRIORITY_EXT_0_LOWEST,
+  IWL_SCAN_PRIORITY_EXT_1,
+  IWL_SCAN_PRIORITY_EXT_2,
+  IWL_SCAN_PRIORITY_EXT_3,
+  IWL_SCAN_PRIORITY_EXT_4,
+  IWL_SCAN_PRIORITY_EXT_5,
+  IWL_SCAN_PRIORITY_EXT_6,
+  IWL_SCAN_PRIORITY_EXT_7_HIGHEST,
+};
+
+/**
+ * struct iwl_scan_req_lmac - SCAN_REQUEST_CMD_API_S_VER_1
+ * @reserved1: for alignment and future use
+ * @n_channels: num of channels to scan
+ * @active_dwell: dwell time for active channels
+ * @passive_dwell: dwell time for passive channels
+ * @fragmented_dwell: dwell time for fragmented passive scan
+ * @extended_dwell: dwell time for channels 1, 6 and 11 (in certain cases)
+ * @reserved2: for alignment and future use
+ * @rx_chain_select: PHY_RX_CHAIN_* flags
+ * @scan_flags: &enum iwl_mvm_lmac_scan_flags
+ * @max_out_time: max time (in TU) to be out of associated channel
+ * @suspend_time: pause scan this long (TUs) when returning to service channel
+ * @flags: RXON flags
+ * @filter_flags: RXON filter
+ * @tx_cmd: tx command for active scan; for 2GHz and for 5GHz
+ * @direct_scan: list of SSIDs for directed active scan
+ * @scan_prio: enum iwl_scan_priority
+ * @iter_num: number of scan iterations
+ * @delay: delay in seconds before first iteration
+ * @schedule: two scheduling plans. The first one is finite, the second one can
+ *  be infinite.
+ * @channel_opt: channel optimization options, for full and partial scan
+ * @data: channel configuration and probe request packet.
+ */
+struct iwl_scan_req_lmac {
+  /* SCAN_REQUEST_FIXED_PART_API_S_VER_7 */
+  __le32 reserved1;
+  uint8_t n_channels;
+  uint8_t active_dwell;
+  uint8_t passive_dwell;
+  uint8_t fragmented_dwell;
+  uint8_t extended_dwell;
+  uint8_t reserved2;
+  __le16 rx_chain_select;
+  __le32 scan_flags;
+  __le32 max_out_time;
+  __le32 suspend_time;
+  /* RX_ON_FLAGS_API_S_VER_1 */
+  __le32 flags;
+  __le32 filter_flags;
+  struct iwl_scan_req_tx_cmd tx_cmd[2];
+  struct iwl_ssid_ie direct_scan[PROBE_OPTION_MAX];
+  __le32 scan_prio;
+  /* SCAN_REQ_PERIODIC_PARAMS_API_S */
+  __le32 iter_num;
+  __le32 delay;
+  struct iwl_scan_schedule_lmac schedule[IWL_MAX_SCHED_SCAN_PLANS];
+  struct iwl_scan_channel_opt channel_opt[2];
+  uint8_t data[];
+} __packed;
+
+/**
+ * struct iwl_scan_results_notif - scan results for one channel -
+ *  SCAN_RESULT_NTF_API_S_VER_3
+ * @channel: which channel the results are from
+ * @band: 0 for 5.2 GHz, 1 for 2.4 GHz
+ * @probe_status: SCAN_PROBE_STATUS_*, indicates success of probe request
+ * @num_probe_not_sent: # of request that weren't sent due to not enough time
+ * @duration: duration spent in channel, in usecs
+ */
+struct iwl_scan_results_notif {
+  uint8_t channel;
+  uint8_t band;
+  uint8_t probe_status;
+  uint8_t num_probe_not_sent;
+  __le32 duration;
+} __packed;
+
+/**
+ * struct iwl_lmac_scan_complete_notif - notifies end of scanning (all channels)
+ *  SCAN_COMPLETE_NTF_API_S_VER_3
+ * @scanned_channels: number of channels scanned (and number of valid results)
+ * @status: one of SCAN_COMP_STATUS_*
+ * @bt_status: BT on/off status
+ * @last_channel: last channel that was scanned
+ * @tsf_low: TSF timer (lower half) in usecs
+ * @tsf_high: TSF timer (higher half) in usecs
+ * @results: an array of scan results, only "scanned_channels" of them are valid
+ */
+struct iwl_lmac_scan_complete_notif {
+  uint8_t scanned_channels;
+  uint8_t status;
+  uint8_t bt_status;
+  uint8_t last_channel;
+  __le32 tsf_low;
+  __le32 tsf_high;
+  struct iwl_scan_results_notif results[];
+} __packed;
+
+/**
+ * struct iwl_scan_offload_complete - PERIODIC_SCAN_COMPLETE_NTF_API_S_VER_2
+ * @last_schedule_line: last schedule line executed (fast or regular)
+ * @last_schedule_iteration: last scan iteration executed before scan abort
+ * @status: &enum iwl_scan_offload_complete_status
+ * @ebs_status: EBS success status &enum iwl_scan_ebs_status
+ * @time_after_last_iter: time in seconds elapsed after last iteration
+ * @reserved: reserved
+ */
+struct iwl_periodic_scan_complete {
+  uint8_t last_schedule_line;
+  uint8_t last_schedule_iteration;
+  uint8_t status;
+  uint8_t ebs_status;
+  __le32 time_after_last_iter;
+  __le32 reserved;
+} __packed;
+
+/* UMAC Scan API */
+
+/* The maximum of either of these cannot exceed 8, because we use an
+ * 8-bit mask (see IWL_MVM_SCAN_MASK in mvm.h).
+ */
+#define IWL_MVM_MAX_UMAC_SCANS 8
+#define IWL_MVM_MAX_LMAC_SCANS 1
+
+enum scan_config_flags {
+  SCAN_CONFIG_FLAG_ACTIVATE = BIT(0),
+  SCAN_CONFIG_FLAG_DEACTIVATE = BIT(1),
+  SCAN_CONFIG_FLAG_FORBID_CHUB_REQS = BIT(2),
+  SCAN_CONFIG_FLAG_ALLOW_CHUB_REQS = BIT(3),
+  SCAN_CONFIG_FLAG_SET_TX_CHAINS = BIT(8),
+  SCAN_CONFIG_FLAG_SET_RX_CHAINS = BIT(9),
+  SCAN_CONFIG_FLAG_SET_AUX_STA_ID = BIT(10),
+  SCAN_CONFIG_FLAG_SET_ALL_TIMES = BIT(11),
+  SCAN_CONFIG_FLAG_SET_EFFECTIVE_TIMES = BIT(12),
+  SCAN_CONFIG_FLAG_SET_CHANNEL_FLAGS = BIT(13),
+  SCAN_CONFIG_FLAG_SET_LEGACY_RATES = BIT(14),
+  SCAN_CONFIG_FLAG_SET_MAC_ADDR = BIT(15),
+  SCAN_CONFIG_FLAG_SET_FRAGMENTED = BIT(16),
+  SCAN_CONFIG_FLAG_CLEAR_FRAGMENTED = BIT(17),
+  SCAN_CONFIG_FLAG_SET_CAM_MODE = BIT(18),
+  SCAN_CONFIG_FLAG_CLEAR_CAM_MODE = BIT(19),
+  SCAN_CONFIG_FLAG_SET_PROMISC_MODE = BIT(20),
+  SCAN_CONFIG_FLAG_CLEAR_PROMISC_MODE = BIT(21),
+  SCAN_CONFIG_FLAG_SET_LMAC2_FRAGMENTED = BIT(22),
+  SCAN_CONFIG_FLAG_CLEAR_LMAC2_FRAGMENTED = BIT(23),
+
+/* Bits 26-31 are for num of channels in channel_array */
+#define SCAN_CONFIG_N_CHANNELS(n) ((n) << 26)
+};
+
+enum scan_config_rates {
+  /* OFDM basic rates */
+  SCAN_CONFIG_RATE_6M = BIT(0),
+  SCAN_CONFIG_RATE_9M = BIT(1),
+  SCAN_CONFIG_RATE_12M = BIT(2),
+  SCAN_CONFIG_RATE_18M = BIT(3),
+  SCAN_CONFIG_RATE_24M = BIT(4),
+  SCAN_CONFIG_RATE_36M = BIT(5),
+  SCAN_CONFIG_RATE_48M = BIT(6),
+  SCAN_CONFIG_RATE_54M = BIT(7),
+  /* CCK basic rates */
+  SCAN_CONFIG_RATE_1M = BIT(8),
+  SCAN_CONFIG_RATE_2M = BIT(9),
+  SCAN_CONFIG_RATE_5M = BIT(10),
+  SCAN_CONFIG_RATE_11M = BIT(11),
+
+/* Bits 16-27 are for supported rates */
+#define SCAN_CONFIG_SUPPORTED_RATE(rate) ((rate) << 16)
+};
+
+enum iwl_channel_flags {
+  IWL_CHANNEL_FLAG_EBS = BIT(0),
+  IWL_CHANNEL_FLAG_ACCURATE_EBS = BIT(1),
+  IWL_CHANNEL_FLAG_EBS_ADD = BIT(2),
+  IWL_CHANNEL_FLAG_PRE_SCAN_PASSIVE2ACTIVE = BIT(3),
+};
+
+/**
+ * struct iwl_scan_dwell
+ * @active:     default dwell time for active scan
+ * @passive:        default dwell time for passive scan
+ * @fragmented:     default dwell time for fragmented scan
+ * @extended:       default dwell time for channels 1, 6 and 11
+ */
+struct iwl_scan_dwell {
+  uint8_t active;
+  uint8_t passive;
+  uint8_t fragmented;
+  uint8_t extended;
+} __packed;
+
+/**
+ * struct iwl_scan_config
+ * @flags:          enum scan_config_flags
+ * @tx_chains:          valid_tx antenna - ANT_* definitions
+ * @rx_chains:          valid_rx antenna - ANT_* definitions
+ * @legacy_rates:       default legacy rates - enum scan_config_rates
+ * @out_of_channel_time:    default max out of serving channel time
+ * @suspend_time:       default max suspend time
+ * @dwell:          dwells for the scan
+ * @mac_addr:           default mac address to be used in probes
+ * @bcast_sta_id:       the index of the station in the fw
+ * @channel_flags:      default channel flags - enum iwl_channel_flags
+ *              scan_config_channel_flag
+ * @channel_array:      default supported channels
+ */
+struct iwl_scan_config_v1 {
+  __le32 flags;
+  __le32 tx_chains;
+  __le32 rx_chains;
+  __le32 legacy_rates;
+  __le32 out_of_channel_time;
+  __le32 suspend_time;
+  struct iwl_scan_dwell dwell;
+  uint8_t mac_addr[ETH_ALEN];
+  uint8_t bcast_sta_id;
+  uint8_t channel_flags;
+  uint8_t channel_array[];
+} __packed; /* SCAN_CONFIG_DB_CMD_API_S */
+
+#define SCAN_TWO_LMACS 2
+#define SCAN_LB_LMAC_IDX 0
+#define SCAN_HB_LMAC_IDX 1
+
+struct iwl_scan_config {
+  __le32 flags;
+  __le32 tx_chains;
+  __le32 rx_chains;
+  __le32 legacy_rates;
+  __le32 out_of_channel_time[SCAN_TWO_LMACS];
+  __le32 suspend_time[SCAN_TWO_LMACS];
+  struct iwl_scan_dwell dwell;
+  uint8_t mac_addr[ETH_ALEN];
+  uint8_t bcast_sta_id;
+  uint8_t channel_flags;
+  uint8_t channel_array[];
+} __packed; /* SCAN_CONFIG_DB_CMD_API_S_3 */
+
+/**
+ * enum iwl_umac_scan_flags - UMAC scan flags
+ * @IWL_UMAC_SCAN_FLAG_PREEMPTIVE: scan process triggered by this scan request
+ *  can be preempted by other scan requests with higher priority.
+ *  The low priority scan will be resumed when the higher proirity scan is
+ *  completed.
+ * @IWL_UMAC_SCAN_FLAG_START_NOTIF: notification will be sent to the driver
+ *  when scan starts.
+ */
+enum iwl_umac_scan_flags {
+  IWL_UMAC_SCAN_FLAG_PREEMPTIVE = BIT(0),
+  IWL_UMAC_SCAN_FLAG_START_NOTIF = BIT(1),
+};
+
+enum iwl_umac_scan_uid_offsets {
+  IWL_UMAC_SCAN_UID_TYPE_OFFSET = 0,
+  IWL_UMAC_SCAN_UID_SEQ_OFFSET = 8,
+};
+
+enum iwl_umac_scan_general_flags {
+  IWL_UMAC_SCAN_GEN_FLAGS_PERIODIC = BIT(0),
+  IWL_UMAC_SCAN_GEN_FLAGS_OVER_BT = BIT(1),
+  IWL_UMAC_SCAN_GEN_FLAGS_PASS_ALL = BIT(2),
+  IWL_UMAC_SCAN_GEN_FLAGS_PASSIVE = BIT(3),
+  IWL_UMAC_SCAN_GEN_FLAGS_PRE_CONNECT = BIT(4),
+  IWL_UMAC_SCAN_GEN_FLAGS_ITER_COMPLETE = BIT(5),
+  IWL_UMAC_SCAN_GEN_FLAGS_MULTIPLE_SSID = BIT(6),
+  IWL_UMAC_SCAN_GEN_FLAGS_FRAGMENTED = BIT(7),
+  IWL_UMAC_SCAN_GEN_FLAGS_RRM_ENABLED = BIT(8),
+  IWL_UMAC_SCAN_GEN_FLAGS_MATCH = BIT(9),
+  IWL_UMAC_SCAN_GEN_FLAGS_EXTENDED_DWELL = BIT(10),
+  /* Extended dwell is obselete when adaptive dwell is used, making this
+   * bit reusable. Hence, probe request defer is used only when adaptive
+   * dwell is supported. */
+  IWL_UMAC_SCAN_GEN_FLAGS_PROB_REQ_DEFER_SUPP = BIT(10),
+  IWL_UMAC_SCAN_GEN_FLAGS_LMAC2_FRAGMENTED = BIT(11),
+  IWL_UMAC_SCAN_GEN_FLAGS_ADAPTIVE_DWELL = BIT(13),
+  IWL_UMAC_SCAN_GEN_FLAGS_MAX_CHNL_TIME = BIT(14),
+  IWL_UMAC_SCAN_GEN_FLAGS_PROB_REQ_HIGH_TX_RATE = BIT(15),
+};
+
+/**
+ * enum iwl_umac_scan_general_flags2 - UMAC scan general flags #2
+ * @IWL_UMAC_SCAN_GEN_FLAGS2_NOTIF_PER_CHNL: Whether to send a complete
+ *  notification per channel or not.
+ * @IWL_UMAC_SCAN_GEN_FLAGS2_ALLOW_CHNL_REORDER: Whether to allow channel
+ *  reorder optimization or not.
+ */
+enum iwl_umac_scan_general_flags2 {
+  IWL_UMAC_SCAN_GEN_FLAGS2_NOTIF_PER_CHNL = BIT(0),
+  IWL_UMAC_SCAN_GEN_FLAGS2_ALLOW_CHNL_REORDER = BIT(1),
+};
+
+/**
+ * struct iwl_scan_channel_cfg_umac
+ * @flags:      bitmap - 0-19:  directed scan to i'th ssid.
+ * @channel_num:    channel number 1-13 etc.
+ * @iter_count:     repetition count for the channel.
+ * @iter_interval:  interval between two scan iterations on one channel.
+ */
+struct iwl_scan_channel_cfg_umac {
+  __le32 flags;
+  uint8_t channel_num;
+  uint8_t iter_count;
+  __le16 iter_interval;
+} __packed; /* SCAN_CHANNEL_CFG_S_VER2 */
+
+/**
+ * struct iwl_scan_umac_schedule
+ * @interval: interval in seconds between scan iterations
+ * @iter_count: num of scan iterations for schedule plan, 0xff for infinite loop
+ * @reserved: for alignment and future use
+ */
+struct iwl_scan_umac_schedule {
+  __le16 interval;
+  uint8_t iter_count;
+  uint8_t reserved;
+} __packed; /* SCAN_SCHED_PARAM_API_S_VER_1 */
+
+/**
+ * struct iwl_scan_req_umac_tail - the rest of the UMAC scan request command
+ *      parameters following channels configuration array.
+ * @schedule: two scheduling plans.
+ * @delay: delay in TUs before starting the first scan iteration
+ * @reserved: for future use and alignment
+ * @preq: probe request with IEs blocks
+ * @direct_scan: list of SSIDs for directed active scan
+ */
+struct iwl_scan_req_umac_tail {
+  /* SCAN_PERIODIC_PARAMS_API_S_VER_1 */
+  struct iwl_scan_umac_schedule schedule[IWL_MAX_SCHED_SCAN_PLANS];
+  __le16 delay;
+  __le16 reserved;
+  /* SCAN_PROBE_PARAMS_API_S_VER_1 */
+  struct iwl_scan_probe_req preq;
+  struct iwl_ssid_ie direct_scan[PROBE_OPTION_MAX];
+} __packed;
+
+/**
+ * struct iwl_scan_umac_chan_param
+ * @flags: channel flags &enum iwl_scan_channel_flags
+ * @count: num of channels in scan request
+ * @reserved: for future use and alignment
+ */
+struct iwl_scan_umac_chan_param {
+  uint8_t flags;
+  uint8_t count;
+  __le16 reserved;
+} __packed; /*SCAN_CHANNEL_PARAMS_API_S_VER_1 */
+
+/**
+ * struct iwl_scan_req_umac
+ * @flags: &enum iwl_umac_scan_flags
+ * @uid: scan id, &enum iwl_umac_scan_uid_offsets
+ * @ooc_priority: out of channel priority - &enum iwl_scan_priority
+ * @general_flags: &enum iwl_umac_scan_general_flags
+ * @scan_start_mac_id: report the scan start TSF time according to this mac TSF
+ * @extended_dwell: dwell time for channels 1, 6 and 11
+ * @active_dwell: dwell time for active scan per LMAC
+ * @passive_dwell: dwell time for passive scan per LMAC
+ * @fragmented_dwell: dwell time for fragmented passive scan
+ * @adwell_default_n_aps: for adaptive dwell the default number of APs
+ *  per channel
+ * @adwell_default_n_aps_social: for adaptive dwell the default
+ *  number of APs per social (1,6,11) channel
+ * @general_flags2: &enum iwl_umac_scan_general_flags2
+ * @adwell_max_budget: for adaptive dwell the maximal budget of TU to be added
+ *  to total scan time
+ * @max_out_time: max out of serving channel time, per LMAC - for CDB there
+ *  are 2 LMACs
+ * @suspend_time: max suspend time, per LMAC - for CDB there are 2 LMACs
+ * @scan_priority: scan internal prioritization &enum iwl_scan_priority
+ * @num_of_fragments: Number of fragments needed for full coverage per band.
+ *  Relevant only for fragmented scan.
+ * @channel: &struct iwl_scan_umac_chan_param
+ * @reserved: for future use and alignment
+ * @reserved3: for future use and alignment
+ * @data: &struct iwl_scan_channel_cfg_umac and
+ *  &struct iwl_scan_req_umac_tail
+ */
+struct iwl_scan_req_umac {
+  __le32 flags;
+  __le32 uid;
+  __le32 ooc_priority;
+  __le16 general_flags;
+  uint8_t reserved;
+  uint8_t scan_start_mac_id;
+  union {
+    struct {
+      uint8_t extended_dwell;
+      uint8_t active_dwell;
+      uint8_t passive_dwell;
+      uint8_t fragmented_dwell;
+      __le32 max_out_time;
+      __le32 suspend_time;
+      __le32 scan_priority;
+      struct iwl_scan_umac_chan_param channel;
+      uint8_t data[];
+    } v1; /* SCAN_REQUEST_CMD_UMAC_API_S_VER_1 */
+    struct {
+      uint8_t extended_dwell;
+      uint8_t active_dwell;
+      uint8_t passive_dwell;
+      uint8_t fragmented_dwell;
+      __le32 max_out_time[SCAN_TWO_LMACS];
+      __le32 suspend_time[SCAN_TWO_LMACS];
+      __le32 scan_priority;
+      struct iwl_scan_umac_chan_param channel;
+      uint8_t data[];
+    } v6; /* SCAN_REQUEST_CMD_UMAC_API_S_VER_6 */
+    struct {
+      uint8_t active_dwell;
+      uint8_t passive_dwell;
+      uint8_t fragmented_dwell;
+      uint8_t adwell_default_n_aps;
+      uint8_t adwell_default_n_aps_social;
+      uint8_t reserved3;
+      __le16 adwell_max_budget;
+      __le32 max_out_time[SCAN_TWO_LMACS];
+      __le32 suspend_time[SCAN_TWO_LMACS];
+      __le32 scan_priority;
+      struct iwl_scan_umac_chan_param channel;
+      uint8_t data[];
+    } v7; /* SCAN_REQUEST_CMD_UMAC_API_S_VER_7 */
+    struct {
+      uint8_t active_dwell[SCAN_TWO_LMACS];
+      uint8_t reserved2;
+      uint8_t adwell_default_n_aps;
+      uint8_t adwell_default_n_aps_social;
+      uint8_t general_flags2;
+      __le16 adwell_max_budget;
+      __le32 max_out_time[SCAN_TWO_LMACS];
+      __le32 suspend_time[SCAN_TWO_LMACS];
+      __le32 scan_priority;
+      uint8_t passive_dwell[SCAN_TWO_LMACS];
+      uint8_t num_of_fragments[SCAN_TWO_LMACS];
+      struct iwl_scan_umac_chan_param channel;
+      uint8_t data[];
+    } v8; /* SCAN_REQUEST_CMD_UMAC_API_S_VER_8 */
+  };
+} __packed;
+
+#define IWL_SCAN_REQ_UMAC_SIZE_V8 sizeof(struct iwl_scan_req_umac)
+#define IWL_SCAN_REQ_UMAC_SIZE_V7 48
+#define IWL_SCAN_REQ_UMAC_SIZE_V6 44
+#define IWL_SCAN_REQ_UMAC_SIZE_V1 36
+
+/**
+ * struct iwl_umac_scan_abort
+ * @uid: scan id, &enum iwl_umac_scan_uid_offsets
+ * @flags: reserved
+ */
+struct iwl_umac_scan_abort {
+  __le32 uid;
+  __le32 flags;
+} __packed; /* SCAN_ABORT_CMD_UMAC_API_S_VER_1 */
+
+/**
+ * struct iwl_umac_scan_complete
+ * @uid: scan id, &enum iwl_umac_scan_uid_offsets
+ * @last_schedule: last scheduling line
+ * @last_iter: last scan iteration number
+ * @status: &enum iwl_scan_offload_complete_status
+ * @ebs_status: &enum iwl_scan_ebs_status
+ * @time_from_last_iter: time elapsed from last iteration
+ * @reserved: for future use
+ */
+struct iwl_umac_scan_complete {
+  __le32 uid;
+  uint8_t last_schedule;
+  uint8_t last_iter;
+  uint8_t status;
+  uint8_t ebs_status;
+  __le32 time_from_last_iter;
+  __le32 reserved;
+} __packed; /* SCAN_COMPLETE_NTF_UMAC_API_S_VER_1 */
+
+#define SCAN_OFFLOAD_MATCHING_CHANNELS_LEN 5
+/**
+ * struct iwl_scan_offload_profile_match - match information
+ * @bssid: matched bssid
+ * @reserved: reserved
+ * @channel: channel where the match occurred
+ * @energy: energy
+ * @matching_feature: feature matches
+ * @matching_channels: bitmap of channels that matched, referencing
+ *  the channels passed in tue scan offload request
+ */
+struct iwl_scan_offload_profile_match {
+  uint8_t bssid[ETH_ALEN];
+  __le16 reserved;
+  uint8_t channel;
+  uint8_t energy;
+  uint8_t matching_feature;
+  uint8_t matching_channels[SCAN_OFFLOAD_MATCHING_CHANNELS_LEN];
+} __packed; /* SCAN_OFFLOAD_PROFILE_MATCH_RESULTS_S_VER_1 */
+
+/**
+ * struct iwl_scan_offload_profiles_query - match results query response
+ * @matched_profiles: bitmap of matched profiles, referencing the
+ *  matches passed in the scan offload request
+ * @last_scan_age: age of the last offloaded scan
+ * @n_scans_done: number of offloaded scans done
+ * @gp2_d0u: GP2 when D0U occurred
+ * @gp2_invoked: GP2 when scan offload was invoked
+ * @resume_while_scanning: not used
+ * @self_recovery: obsolete
+ * @reserved: reserved
+ * @matches: array of match information, one for each match
+ */
+struct iwl_scan_offload_profiles_query {
+  __le32 matched_profiles;
+  __le32 last_scan_age;
+  __le32 n_scans_done;
+  __le32 gp2_d0u;
+  __le32 gp2_invoked;
+  uint8_t resume_while_scanning;
+  uint8_t self_recovery;
+  __le16 reserved;
+  struct iwl_scan_offload_profile_match matches[IWL_SCAN_MAX_PROFILES];
+} __packed; /* SCAN_OFFLOAD_PROFILES_QUERY_RSP_S_VER_2 */
+
+/**
+ * struct iwl_umac_scan_iter_complete_notif - notifies end of scanning iteration
+ * @uid: scan id, &enum iwl_umac_scan_uid_offsets
+ * @scanned_channels: number of channels scanned and number of valid elements in
+ *  results array
+ * @status: one of SCAN_COMP_STATUS_*
+ * @bt_status: BT on/off status
+ * @last_channel: last channel that was scanned
+ * @start_tsf: TSF timer in usecs of the scan start time for the mac specified
+ *  in &struct iwl_scan_req_umac.
+ * @results: array of scan results, length in @scanned_channels
+ */
+struct iwl_umac_scan_iter_complete_notif {
+  __le32 uid;
+  uint8_t scanned_channels;
+  uint8_t status;
+  uint8_t bt_status;
+  uint8_t last_channel;
+  __le64 start_tsf;
+  struct iwl_scan_results_notif results[];
+} __packed; /* SCAN_ITER_COMPLETE_NTF_UMAC_API_S_VER_2 */
+
+#endif  // SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_SCAN_H_
diff --git a/third_party/iwlwifi/fw/api/sf.h b/third_party/iwlwifi/fw/api/sf.h
new file mode 100644
index 0000000..4a37f3c
--- /dev/null
+++ b/third_party/iwlwifi/fw/api/sf.h
@@ -0,0 +1,113 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+
+#ifndef SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_SF_H_
+#define SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_SF_H_
+
+#include "src/iwlwifi/platform/compiler.h"
+
+/* Smart Fifo state */
+enum iwl_sf_state {
+  SF_LONG_DELAY_ON = 0, /* should never be called by driver */
+  SF_FULL_ON,
+  SF_UNINIT,
+  SF_INIT_OFF,
+  SF_HW_NUM_STATES
+};
+
+/* Smart Fifo possible scenario */
+enum iwl_sf_scenario {
+  SF_SCENARIO_SINGLE_UNICAST,
+  SF_SCENARIO_AGG_UNICAST,
+  SF_SCENARIO_MULTICAST,
+  SF_SCENARIO_BA_RESP,
+  SF_SCENARIO_TX_RESP,
+  SF_NUM_SCENARIO
+};
+
+#define SF_TRANSIENT_STATES_NUMBER 2 /* SF_LONG_DELAY_ON and SF_FULL_ON */
+#define SF_NUM_TIMEOUT_TYPES 2       /* Aging timer and Idle timer */
+
+/* smart FIFO default values */
+#define SF_W_MARK_SISO 6144
+#define SF_W_MARK_MIMO2 8192
+#define SF_W_MARK_MIMO3 6144
+#define SF_W_MARK_LEGACY 4096
+#define SF_W_MARK_SCAN 4096
+
+/* SF Scenarios timers for default configuration (aligned to 32 uSec) */
+#define SF_SINGLE_UNICAST_IDLE_TIMER_DEF 160  /* 150 uSec  */
+#define SF_SINGLE_UNICAST_AGING_TIMER_DEF 400 /* 0.4 mSec */
+#define SF_AGG_UNICAST_IDLE_TIMER_DEF 160     /* 150 uSec */
+#define SF_AGG_UNICAST_AGING_TIMER_DEF 400    /* 0.4 mSec */
+#define SF_MCAST_IDLE_TIMER_DEF 160           /* 150 mSec */
+#define SF_MCAST_AGING_TIMER_DEF 400          /* 0.4 mSec */
+#define SF_BA_IDLE_TIMER_DEF 160              /* 150 uSec */
+#define SF_BA_AGING_TIMER_DEF 400             /* 0.4 mSec */
+#define SF_TX_RE_IDLE_TIMER_DEF 160           /* 150 uSec */
+#define SF_TX_RE_AGING_TIMER_DEF 400          /* 0.4 mSec */
+
+/* SF Scenarios timers for BSS MAC configuration (aligned to 32 uSec) */
+#define SF_SINGLE_UNICAST_IDLE_TIMER 320   /* 300 uSec  */
+#define SF_SINGLE_UNICAST_AGING_TIMER 2016 /* 2 mSec */
+#define SF_AGG_UNICAST_IDLE_TIMER 320      /* 300 uSec */
+#define SF_AGG_UNICAST_AGING_TIMER 2016    /* 2 mSec */
+#define SF_MCAST_IDLE_TIMER 2016           /* 2 mSec */
+#define SF_MCAST_AGING_TIMER 10016         /* 10 mSec */
+#define SF_BA_IDLE_TIMER 320               /* 300 uSec */
+#define SF_BA_AGING_TIMER 2016             /* 2 mSec */
+#define SF_TX_RE_IDLE_TIMER 320            /* 300 uSec */
+#define SF_TX_RE_AGING_TIMER 2016          /* 2 mSec */
+
+#define SF_LONG_DELAY_AGING_TIMER 1000000 /* 1 Sec */
+
+#define SF_CFG_DUMMY_NOTIF_OFF BIT(16)
+
+/**
+ * struct iwl_sf_cfg_cmd - Smart Fifo configuration command.
+ * @state: smart fifo state, types listed in &enum iwl_sf_state.
+ * @watermark: Minimum allowed available free space in RXF for transient state.
+ * @long_delay_timeouts: aging and idle timer values for each scenario
+ * in long delay state.
+ * @full_on_timeouts: timer values for each scenario in full on state.
+ */
+struct iwl_sf_cfg_cmd {
+  __le32 state;
+  __le32 watermark[SF_TRANSIENT_STATES_NUMBER];
+  __le32 long_delay_timeouts[SF_NUM_SCENARIO][SF_NUM_TIMEOUT_TYPES];
+  __le32 full_on_timeouts[SF_NUM_SCENARIO][SF_NUM_TIMEOUT_TYPES];
+} __packed; /* SF_CFG_API_S_VER_2 */
+
+#endif  // SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_SF_H_
diff --git a/third_party/iwlwifi/fw/api/soc.h b/third_party/iwlwifi/fw/api/soc.h
new file mode 100644
index 0000000..e8e02ea
--- /dev/null
+++ b/third_party/iwlwifi/fw/api/soc.h
@@ -0,0 +1,58 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+
+#ifndef SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_SOC_H_
+#define SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_SOC_H_
+
+#include "src/iwlwifi/platform/compiler.h"
+
+/* type of devices for defining SOC latency */
+enum iwl_soc_device_types {
+  SOC_CONFIG_CMD_INTEGRATED = 0x0,
+  SOC_CONFIG_CMD_DISCRETE = 0x1,
+};
+
+/**
+ * struct iwl_soc_configuration_cmd - Set device stabilization latency
+ *
+ * @device_type: the device type as defined in &enum iwl_soc_device_types
+ * @soc_latency: time for SOC to ensure stable power & XTAL
+ */
+struct iwl_soc_configuration_cmd {
+  __le32 device_type;
+  __le32 soc_latency;
+} __packed; /* SOC_CONFIGURATION_CMD_S_VER_1 */
+
+#endif  // SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_SOC_H_
diff --git a/third_party/iwlwifi/fw/api/sta.h b/third_party/iwlwifi/fw/api/sta.h
new file mode 100644
index 0000000..06c5830
--- /dev/null
+++ b/third_party/iwlwifi/fw/api/sta.h
@@ -0,0 +1,545 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018 Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *****************************************************************************/
+
+#ifndef SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_STA_H_
+#define SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_STA_H_
+
+#include "src/iwlwifi/platform/compiler.h"
+
+/**
+ * enum iwl_sta_flags - flags for the ADD_STA host command
+ * @STA_FLG_REDUCED_TX_PWR_CTRL: reduced TX power (control frames)
+ * @STA_FLG_REDUCED_TX_PWR_DATA: reduced TX power (data frames)
+ * @STA_FLG_DISABLE_TX: set if TX should be disabled
+ * @STA_FLG_PS: set if STA is in Power Save
+ * @STA_FLG_DRAIN_FLOW: drain flow
+ * @STA_FLG_PAN: STA is for PAN interface
+ * @STA_FLG_CLASS_AUTH: station is authenticated
+ * @STA_FLG_CLASS_ASSOC: station is associated
+ * @STA_FLG_RTS_MIMO_PROT: station requires RTS MIMO protection (dynamic SMPS)
+ * @STA_FLG_MAX_AGG_SIZE_MSK: maximal size for A-MPDU (mask)
+ * @STA_FLG_MAX_AGG_SIZE_SHIFT: maximal size for A-MPDU (bit shift)
+ * @STA_FLG_MAX_AGG_SIZE_8K: maximal size for A-MPDU (8k supported)
+ * @STA_FLG_MAX_AGG_SIZE_16K: maximal size for A-MPDU (16k supported)
+ * @STA_FLG_MAX_AGG_SIZE_32K: maximal size for A-MPDU (32k supported)
+ * @STA_FLG_MAX_AGG_SIZE_64K: maximal size for A-MPDU (64k supported)
+ * @STA_FLG_MAX_AGG_SIZE_128K: maximal size for A-MPDU (128k supported)
+ * @STA_FLG_MAX_AGG_SIZE_256K: maximal size for A-MPDU (256k supported)
+ * @STA_FLG_MAX_AGG_SIZE_512K: maximal size for A-MPDU (512k supported)
+ * @STA_FLG_MAX_AGG_SIZE_1024K: maximal size for A-MPDU (1024k supported)
+ * @STA_FLG_AGG_MPDU_DENS_MSK: maximal MPDU density for Tx aggregation
+ * @STA_FLG_FAT_EN_MSK: support for channel width (for Tx). This flag is
+ *  initialised by driver and can be updated by fw upon reception of
+ *  action frames that can change the channel width. When cleared the fw
+ *  will send all the frames in 20MHz even when FAT channel is requested.
+ * @STA_FLG_FAT_EN_20MHZ: no wide channels are supported, only 20 MHz
+ * @STA_FLG_FAT_EN_40MHZ: wide channels up to 40 MHz supported
+ * @STA_FLG_FAT_EN_80MHZ: wide channels up to 80 MHz supported
+ * @STA_FLG_FAT_EN_160MHZ: wide channels up to 160 MHz supported
+ * @STA_FLG_MIMO_EN_MSK: support for MIMO. This flag is initialised by the
+ *  driver and can be updated by fw upon reception of action frames.
+ * @STA_FLG_MIMO_EN_SISO: no support for MIMO
+ * @STA_FLG_MIMO_EN_MIMO2: 2 streams supported
+ * @STA_FLG_MIMO_EN_MIMO3: 3 streams supported
+ * @STA_FLG_AGG_MPDU_DENS_MSK: A-MPDU density (mask)
+ * @STA_FLG_AGG_MPDU_DENS_SHIFT: A-MPDU density (bit shift)
+ * @STA_FLG_AGG_MPDU_DENS_2US: A-MPDU density (2 usec gap)
+ * @STA_FLG_AGG_MPDU_DENS_4US: A-MPDU density (4 usec gap)
+ * @STA_FLG_AGG_MPDU_DENS_8US: A-MPDU density (8 usec gap)
+ * @STA_FLG_AGG_MPDU_DENS_16US: A-MPDU density (16 usec gap)
+ */
+enum iwl_sta_flags {
+  STA_FLG_REDUCED_TX_PWR_CTRL = BIT(3),
+  STA_FLG_REDUCED_TX_PWR_DATA = BIT(6),
+
+  STA_FLG_DISABLE_TX = BIT(4),
+
+  STA_FLG_PS = BIT(8),
+  STA_FLG_DRAIN_FLOW = BIT(12),
+  STA_FLG_PAN = BIT(13),
+  STA_FLG_CLASS_AUTH = BIT(14),
+  STA_FLG_CLASS_ASSOC = BIT(15),
+  STA_FLG_RTS_MIMO_PROT = BIT(17),
+
+  STA_FLG_MAX_AGG_SIZE_SHIFT = 19,
+  STA_FLG_MAX_AGG_SIZE_8K = (0 << STA_FLG_MAX_AGG_SIZE_SHIFT),
+  STA_FLG_MAX_AGG_SIZE_16K = (1 << STA_FLG_MAX_AGG_SIZE_SHIFT),
+  STA_FLG_MAX_AGG_SIZE_32K = (2 << STA_FLG_MAX_AGG_SIZE_SHIFT),
+  STA_FLG_MAX_AGG_SIZE_64K = (3 << STA_FLG_MAX_AGG_SIZE_SHIFT),
+  STA_FLG_MAX_AGG_SIZE_128K = (4 << STA_FLG_MAX_AGG_SIZE_SHIFT),
+  STA_FLG_MAX_AGG_SIZE_256K = (5 << STA_FLG_MAX_AGG_SIZE_SHIFT),
+  STA_FLG_MAX_AGG_SIZE_512K = (6 << STA_FLG_MAX_AGG_SIZE_SHIFT),
+  STA_FLG_MAX_AGG_SIZE_1024K = (7 << STA_FLG_MAX_AGG_SIZE_SHIFT),
+  STA_FLG_MAX_AGG_SIZE_MSK = (7 << STA_FLG_MAX_AGG_SIZE_SHIFT),
+
+  STA_FLG_AGG_MPDU_DENS_SHIFT = 23,
+  STA_FLG_AGG_MPDU_DENS_2US = (4 << STA_FLG_AGG_MPDU_DENS_SHIFT),
+  STA_FLG_AGG_MPDU_DENS_4US = (5 << STA_FLG_AGG_MPDU_DENS_SHIFT),
+  STA_FLG_AGG_MPDU_DENS_8US = (6 << STA_FLG_AGG_MPDU_DENS_SHIFT),
+  STA_FLG_AGG_MPDU_DENS_16US = (7 << STA_FLG_AGG_MPDU_DENS_SHIFT),
+  STA_FLG_AGG_MPDU_DENS_MSK = (7 << STA_FLG_AGG_MPDU_DENS_SHIFT),
+
+  STA_FLG_FAT_EN_20MHZ = (0 << 26),
+  STA_FLG_FAT_EN_40MHZ = (1 << 26),
+  STA_FLG_FAT_EN_80MHZ = (2 << 26),
+  STA_FLG_FAT_EN_160MHZ = (3 << 26),
+  STA_FLG_FAT_EN_MSK = (3 << 26),
+
+  STA_FLG_MIMO_EN_SISO = (0 << 28),
+  STA_FLG_MIMO_EN_MIMO2 = (1 << 28),
+  STA_FLG_MIMO_EN_MIMO3 = (2 << 28),
+  STA_FLG_MIMO_EN_MSK = (3 << 28),
+};
+
+/**
+ * enum iwl_sta_key_flag - key flags for the ADD_STA host command
+ * @STA_KEY_FLG_NO_ENC: no encryption
+ * @STA_KEY_FLG_WEP: WEP encryption algorithm
+ * @STA_KEY_FLG_CCM: CCMP encryption algorithm
+ * @STA_KEY_FLG_TKIP: TKIP encryption algorithm
+ * @STA_KEY_FLG_EXT: extended cipher algorithm (depends on the FW support)
+ * @STA_KEY_FLG_GCMP: GCMP encryption algorithm
+ * @STA_KEY_FLG_CMAC: CMAC encryption algorithm
+ * @STA_KEY_FLG_ENC_UNKNOWN: unknown encryption algorithm
+ * @STA_KEY_FLG_EN_MSK: mask for encryption algorithmi value
+ * @STA_KEY_FLG_WEP_KEY_MAP: wep is either a group key (0 - legacy WEP) or from
+ *  station info array (1 - n 1X mode)
+ * @STA_KEY_FLG_KEYID_MSK: the index of the key
+ * @STA_KEY_FLG_KEYID_POS: key index bit position
+ * @STA_KEY_NOT_VALID: key is invalid
+ * @STA_KEY_FLG_WEP_13BYTES: set for 13 bytes WEP key
+ * @STA_KEY_FLG_KEY_32BYTES: for non-wep key set for 32 bytes key
+ * @STA_KEY_MULTICAST: set for multical key
+ * @STA_KEY_MFP: key is used for Management Frame Protection
+ */
+enum iwl_sta_key_flag {
+  STA_KEY_FLG_NO_ENC = (0 << 0),
+  STA_KEY_FLG_WEP = (1 << 0),
+  STA_KEY_FLG_CCM = (2 << 0),
+  STA_KEY_FLG_TKIP = (3 << 0),
+  STA_KEY_FLG_EXT = (4 << 0),
+  STA_KEY_FLG_GCMP = (5 << 0),
+  STA_KEY_FLG_CMAC = (6 << 0),
+  STA_KEY_FLG_ENC_UNKNOWN = (7 << 0),
+  STA_KEY_FLG_EN_MSK = (7 << 0),
+
+  STA_KEY_FLG_WEP_KEY_MAP = BIT(3),
+  STA_KEY_FLG_KEYID_POS = 8,
+  STA_KEY_FLG_KEYID_MSK = (3 << STA_KEY_FLG_KEYID_POS),
+  STA_KEY_NOT_VALID = BIT(11),
+  STA_KEY_FLG_WEP_13BYTES = BIT(12),
+  STA_KEY_FLG_KEY_32BYTES = BIT(12),
+  STA_KEY_MULTICAST = BIT(14),
+  STA_KEY_MFP = BIT(15),
+};
+
+/**
+ * enum iwl_sta_modify_flag - indicate to the fw what flag are being changed
+ * @STA_MODIFY_QUEUE_REMOVAL: this command removes a queue
+ * @STA_MODIFY_TID_DISABLE_TX: this command modifies %tid_disable_tx
+ * @STA_MODIFY_UAPSD_ACS: this command modifies %uapsd_acs
+ * @STA_MODIFY_ADD_BA_TID: this command modifies %add_immediate_ba_tid
+ * @STA_MODIFY_REMOVE_BA_TID: this command modifies %remove_immediate_ba_tid
+ * @STA_MODIFY_SLEEPING_STA_TX_COUNT: this command modifies %sleep_tx_count
+ * @STA_MODIFY_PROT_TH: modify RTS threshold
+ * @STA_MODIFY_QUEUES: modify the queues used by this station
+ */
+enum iwl_sta_modify_flag {
+  STA_MODIFY_QUEUE_REMOVAL = BIT(0),
+  STA_MODIFY_TID_DISABLE_TX = BIT(1),
+  STA_MODIFY_UAPSD_ACS = BIT(2),
+  STA_MODIFY_ADD_BA_TID = BIT(3),
+  STA_MODIFY_REMOVE_BA_TID = BIT(4),
+  STA_MODIFY_SLEEPING_STA_TX_COUNT = BIT(5),
+  STA_MODIFY_PROT_TH = BIT(6),
+  STA_MODIFY_QUEUES = BIT(7),
+};
+
+/**
+ * enum iwl_sta_mode - station command mode
+ * @STA_MODE_ADD: add new station
+ * @STA_MODE_MODIFY: modify the station
+ */
+enum iwl_sta_mode {
+  STA_MODE_ADD = 0,
+  STA_MODE_MODIFY = 1,
+};
+
+/**
+ * enum iwl_sta_sleep_flag - type of sleep of the station
+ * @STA_SLEEP_STATE_AWAKE: station is awake
+ * @STA_SLEEP_STATE_PS_POLL: station is PS-polling
+ * @STA_SLEEP_STATE_UAPSD: station uses U-APSD
+ * @STA_SLEEP_STATE_MOREDATA: set more-data bit on
+ *  (last) released frame
+ */
+enum iwl_sta_sleep_flag {
+  STA_SLEEP_STATE_AWAKE = 0,
+  STA_SLEEP_STATE_PS_POLL = BIT(0),
+  STA_SLEEP_STATE_UAPSD = BIT(1),
+  STA_SLEEP_STATE_MOREDATA = BIT(2),
+};
+
+#define STA_KEY_MAX_NUM (16)
+#define STA_KEY_IDX_INVALID (0xff)
+#define STA_KEY_MAX_DATA_KEY_NUM (4)
+#define IWL_MAX_GLOBAL_KEYS (4)
+#define STA_KEY_LEN_WEP40 (5)
+#define STA_KEY_LEN_WEP104 (13)
+
+/**
+ * struct iwl_mvm_keyinfo - key information
+ * @key_flags: type &enum iwl_sta_key_flag
+ * @tkip_rx_tsc_byte2: TSC[2] for key mix ph1 detection
+ * @reserved1: reserved
+ * @tkip_rx_ttak: 10-byte unicast TKIP TTAK for Rx
+ * @key_offset: key offset in the fw's key table
+ * @reserved2: reserved
+ * @key: 16-byte unicast decryption key
+ * @tx_secur_seq_cnt: initial RSC / PN needed for replay check
+ * @hw_tkip_mic_rx_key: byte: MIC Rx Key - used for TKIP only
+ * @hw_tkip_mic_tx_key: byte: MIC Tx Key - used for TKIP only
+ */
+struct iwl_mvm_keyinfo {
+  __le16 key_flags;
+  uint8_t tkip_rx_tsc_byte2;
+  uint8_t reserved1;
+  __le16 tkip_rx_ttak[5];
+  uint8_t key_offset;
+  uint8_t reserved2;
+  uint8_t key[16];
+  __le64 tx_secur_seq_cnt;
+  __le64 hw_tkip_mic_rx_key;
+  __le64 hw_tkip_mic_tx_key;
+} __packed;
+
+#define IWL_ADD_STA_STATUS_MASK 0xFF
+#define IWL_ADD_STA_BAID_VALID_MASK 0x8000
+#define IWL_ADD_STA_BAID_MASK 0x7F00
+#define IWL_ADD_STA_BAID_SHIFT 8
+
+/**
+ * struct iwl_mvm_add_sta_cmd_v7 - Add/modify a station in the fw's sta table.
+ * ( REPLY_ADD_STA = 0x18 )
+ * @add_modify: see &enum iwl_sta_mode
+ * @awake_acs: ACs to transmit data on while station is sleeping (for U-APSD)
+ * @tid_disable_tx: is tid BIT(tid) enabled for Tx. Clear BIT(x) to enable
+ *  AMPDU for tid x. Set %STA_MODIFY_TID_DISABLE_TX to change this field.
+ * @mac_id_n_color: the Mac context this station belongs to,
+ *  see &enum iwl_ctxt_id_and_color
+ * @addr: station's MAC address
+ * @reserved2: reserved
+ * @sta_id: index of station in uCode's station table
+ * @modify_mask: STA_MODIFY_*, selects which parameters to modify vs. leave
+ *  alone. 1 - modify, 0 - don't change.
+ * @reserved3: reserved
+ * @station_flags: look at &enum iwl_sta_flags
+ * @station_flags_msk: what of %station_flags have changed,
+ *  also &enum iwl_sta_flags
+ * @add_immediate_ba_tid: tid for which to add block-ack support (Rx)
+ *  Set %STA_MODIFY_ADD_BA_TID to use this field, and also set
+ *  add_immediate_ba_ssn.
+ * @remove_immediate_ba_tid: tid for which to remove block-ack support (Rx)
+ *  Set %STA_MODIFY_REMOVE_BA_TID to use this field
+ * @add_immediate_ba_ssn: ssn for the Rx block-ack session. Used together with
+ *  add_immediate_ba_tid.
+ * @sleep_tx_count: number of packets to transmit to station even though it is
+ *  asleep. Used to synchronise PS-poll and u-APSD responses while ucode
+ *  keeps track of STA sleep state.
+ * @sleep_state_flags: Look at &enum iwl_sta_sleep_flag.
+ * @assoc_id: assoc_id to be sent in VHT PLCP (9-bit), for grp use 0, for AP
+ *  mac-addr.
+ * @beamform_flags: beam forming controls
+ * @tfd_queue_msk: tfd queues used by this station
+ *
+ * The device contains an internal table of per-station information, with info
+ * on security keys, aggregation parameters, and Tx rates for initial Tx
+ * attempt and any retries (set by REPLY_TX_LINK_QUALITY_CMD).
+ *
+ * ADD_STA sets up the table entry for one station, either creating a new
+ * entry, or modifying a pre-existing one.
+ */
+struct iwl_mvm_add_sta_cmd_v7 {
+  uint8_t add_modify;
+  uint8_t awake_acs;
+  __le16 tid_disable_tx;
+  __le32 mac_id_n_color;
+  uint8_t addr[ETH_ALEN]; /* _STA_ID_MODIFY_INFO_API_S_VER_1 */
+  __le16 reserved2;
+  uint8_t sta_id;
+  uint8_t modify_mask;
+  __le16 reserved3;
+  __le32 station_flags;
+  __le32 station_flags_msk;
+  uint8_t add_immediate_ba_tid;
+  uint8_t remove_immediate_ba_tid;
+  __le16 add_immediate_ba_ssn;
+  __le16 sleep_tx_count;
+  __le16 sleep_state_flags;
+  __le16 assoc_id;
+  __le16 beamform_flags;
+  __le32 tfd_queue_msk;
+} __packed; /* ADD_STA_CMD_API_S_VER_7 */
+
+/**
+ * enum iwl_sta_type - FW station types
+ * ( REPLY_ADD_STA = 0x18 )
+ * @IWL_STA_LINK: Link station - normal RX and TX traffic.
+ * @IWL_STA_GENERAL_PURPOSE: General purpose. In AP mode used for beacons
+ *  and probe responses.
+ * @IWL_STA_MULTICAST: multicast traffic,
+ * @IWL_STA_TDLS_LINK: TDLS link station
+ * @IWL_STA_AUX_ACTIVITY: auxilary station (scan, ROC and so on).
+ */
+enum iwl_sta_type {
+  IWL_STA_LINK,
+  IWL_STA_GENERAL_PURPOSE,
+  IWL_STA_MULTICAST,
+  IWL_STA_TDLS_LINK,
+  IWL_STA_AUX_ACTIVITY,
+};
+
+/**
+ * struct iwl_mvm_add_sta_cmd - Add/modify a station in the fw's sta table.
+ * ( REPLY_ADD_STA = 0x18 )
+ * @add_modify: see &enum iwl_sta_mode
+ * @awake_acs: ACs to transmit data on while station is sleeping (for U-APSD)
+ * @tid_disable_tx: is tid BIT(tid) enabled for Tx. Clear BIT(x) to enable
+ *  AMPDU for tid x. Set %STA_MODIFY_TID_DISABLE_TX to change this field.
+ * @mac_id_n_color: the Mac context this station belongs to,
+ *  see &enum iwl_ctxt_id_and_color
+ * @addr: station's MAC address
+ * @reserved2: reserved
+ * @sta_id: index of station in uCode's station table
+ * @modify_mask: STA_MODIFY_*, selects which parameters to modify vs. leave
+ *  alone. 1 - modify, 0 - don't change.
+ * @reserved3: reserved
+ * @station_flags: look at &enum iwl_sta_flags
+ * @station_flags_msk: what of %station_flags have changed,
+ *  also &enum iwl_sta_flags
+ * @add_immediate_ba_tid: tid for which to add block-ack support (Rx)
+ *  Set %STA_MODIFY_ADD_BA_TID to use this field, and also set
+ *  add_immediate_ba_ssn.
+ * @remove_immediate_ba_tid: tid for which to remove block-ack support (Rx)
+ *  Set %STA_MODIFY_REMOVE_BA_TID to use this field
+ * @add_immediate_ba_ssn: ssn for the Rx block-ack session. Used together with
+ *  add_immediate_ba_tid.
+ * @sleep_tx_count: number of packets to transmit to station even though it is
+ *  asleep. Used to synchronise PS-poll and u-APSD responses while ucode
+ *  keeps track of STA sleep state.
+ * @station_type: type of this station. See &enum iwl_sta_type.
+ * @sleep_state_flags: Look at &enum iwl_sta_sleep_flag.
+ * @assoc_id: assoc_id to be sent in VHT PLCP (9-bit), for grp use 0, for AP
+ *  mac-addr.
+ * @beamform_flags: beam forming controls
+ * @tfd_queue_msk: tfd queues used by this station.
+ *  Obselete for new TX API (9 and above).
+ * @rx_ba_window: aggregation window size
+ * @sp_length: the size of the SP in actual number of frames
+ * @uapsd_acs:  4 LS bits are trigger enabled ACs, 4 MS bits are the deliver
+ *  enabled ACs.
+ *
+ * The device contains an internal table of per-station information, with info
+ * on security keys, aggregation parameters, and Tx rates for initial Tx
+ * attempt and any retries (set by REPLY_TX_LINK_QUALITY_CMD).
+ *
+ * ADD_STA sets up the table entry for one station, either creating a new
+ * entry, or modifying a pre-existing one.
+ */
+struct iwl_mvm_add_sta_cmd {
+  uint8_t add_modify;
+  uint8_t awake_acs;
+  __le16 tid_disable_tx;
+  __le32 mac_id_n_color;
+  uint8_t addr[ETH_ALEN]; /* _STA_ID_MODIFY_INFO_API_S_VER_1 */
+  __le16 reserved2;
+  uint8_t sta_id;
+  uint8_t modify_mask;
+  __le16 reserved3;
+  __le32 station_flags;
+  __le32 station_flags_msk;
+  uint8_t add_immediate_ba_tid;
+  uint8_t remove_immediate_ba_tid;
+  __le16 add_immediate_ba_ssn;
+  __le16 sleep_tx_count;
+  uint8_t sleep_state_flags;
+  uint8_t station_type;
+  __le16 assoc_id;
+  __le16 beamform_flags;
+  __le32 tfd_queue_msk;
+  __le16 rx_ba_window;
+  uint8_t sp_length;
+  uint8_t uapsd_acs;
+} __packed; /* ADD_STA_CMD_API_S_VER_10 */
+
+/**
+ * struct iwl_mvm_add_sta_key_common - add/modify sta key common part
+ * ( REPLY_ADD_STA_KEY = 0x17 )
+ * @sta_id: index of station in uCode's station table
+ * @key_offset: key offset in key storage
+ * @key_flags: type &enum iwl_sta_key_flag
+ * @key: key material data
+ * @rx_secur_seq_cnt: RX security sequence counter for the key
+ */
+struct iwl_mvm_add_sta_key_common {
+  uint8_t sta_id;
+  uint8_t key_offset;
+  __le16 key_flags;
+  uint8_t key[32];
+  uint8_t rx_secur_seq_cnt[16];
+} __packed;
+
+/**
+ * struct iwl_mvm_add_sta_key_cmd_v1 - add/modify sta key
+ * @common: see &struct iwl_mvm_add_sta_key_common
+ * @tkip_rx_tsc_byte2: TSC[2] for key mix ph1 detection
+ * @reserved: reserved
+ * @tkip_rx_ttak: 10-byte unicast TKIP TTAK for Rx
+ */
+struct iwl_mvm_add_sta_key_cmd_v1 {
+  struct iwl_mvm_add_sta_key_common common;
+  uint8_t tkip_rx_tsc_byte2;
+  uint8_t reserved;
+  __le16 tkip_rx_ttak[5];
+} __packed; /* ADD_MODIFY_STA_KEY_API_S_VER_1 */
+
+/**
+ * struct iwl_mvm_add_sta_key_cmd - add/modify sta key
+ * @common: see &struct iwl_mvm_add_sta_key_common
+ * @rx_mic_key: TKIP RX unicast or multicast key
+ * @tx_mic_key: TKIP TX key
+ * @transmit_seq_cnt: TSC, transmit packet number
+ */
+struct iwl_mvm_add_sta_key_cmd {
+  struct iwl_mvm_add_sta_key_common common;
+  __le64 rx_mic_key;
+  __le64 tx_mic_key;
+  __le64 transmit_seq_cnt;
+} __packed; /* ADD_MODIFY_STA_KEY_API_S_VER_2 */
+
+/**
+ * enum iwl_mvm_add_sta_rsp_status - status in the response to ADD_STA command
+ * @ADD_STA_SUCCESS: operation was executed successfully
+ * @ADD_STA_STATIONS_OVERLOAD: no room left in the fw's station table
+ * @ADD_STA_IMMEDIATE_BA_FAILURE: can't add Rx block ack session
+ * @ADD_STA_MODIFY_NON_EXISTING_STA: driver requested to modify a station that
+ *  doesn't exist.
+ */
+enum iwl_mvm_add_sta_rsp_status {
+  ADD_STA_SUCCESS = 0x1,
+  ADD_STA_STATIONS_OVERLOAD = 0x2,
+  ADD_STA_IMMEDIATE_BA_FAILURE = 0x4,
+  ADD_STA_MODIFY_NON_EXISTING_STA = 0x8,
+};
+
+/**
+ * struct iwl_mvm_rm_sta_cmd - Add / modify a station in the fw's station table
+ * ( REMOVE_STA = 0x19 )
+ * @sta_id: the station id of the station to be removed
+ * @reserved: reserved
+ */
+struct iwl_mvm_rm_sta_cmd {
+  uint8_t sta_id;
+  uint8_t reserved[3];
+} __packed; /* REMOVE_STA_CMD_API_S_VER_2 */
+
+/**
+ * struct iwl_mvm_mgmt_mcast_key_cmd_v1
+ * ( MGMT_MCAST_KEY = 0x1f )
+ * @ctrl_flags: &enum iwl_sta_key_flag
+ * @igtk: IGTK key material
+ * @k1: unused
+ * @k2: unused
+ * @sta_id: station ID that support IGTK
+ * @key_id: key ID
+ * @receive_seq_cnt: initial RSC/PN needed for replay check
+ */
+struct iwl_mvm_mgmt_mcast_key_cmd_v1 {
+  __le32 ctrl_flags;
+  uint8_t igtk[16];
+  uint8_t k1[16];
+  uint8_t k2[16];
+  __le32 key_id;
+  __le32 sta_id;
+  __le64 receive_seq_cnt;
+} __packed; /* SEC_MGMT_MULTICAST_KEY_CMD_API_S_VER_1 */
+
+/**
+ * struct iwl_mvm_mgmt_mcast_key_cmd
+ * ( MGMT_MCAST_KEY = 0x1f )
+ * @ctrl_flags: &enum iwl_sta_key_flag
+ * @igtk: IGTK master key
+ * @sta_id: station ID that support IGTK
+ * @key_id: key ID
+ * @receive_seq_cnt: initial RSC/PN needed for replay check
+ */
+struct iwl_mvm_mgmt_mcast_key_cmd {
+  __le32 ctrl_flags;
+  uint8_t igtk[32];
+  __le32 key_id;
+  __le32 sta_id;
+  __le64 receive_seq_cnt;
+} __packed; /* SEC_MGMT_MULTICAST_KEY_CMD_API_S_VER_2 */
+
+struct iwl_mvm_wep_key {
+  uint8_t key_index;
+  uint8_t key_offset;
+  __le16 reserved1;
+  uint8_t key_size;
+  uint8_t reserved2[3];
+  uint8_t key[16];
+} __packed;
+
+struct iwl_mvm_wep_key_cmd {
+  __le32 mac_id_n_color;
+  uint8_t num_keys;
+  uint8_t decryption_type;
+  uint8_t flags;
+  uint8_t reserved;
+  struct iwl_mvm_wep_key wep_key[0];
+} __packed; /* SEC_CURR_WEP_KEY_CMD_API_S_VER_2 */
+
+/**
+ * struct iwl_mvm_eosp_notification - EOSP notification from firmware
+ * @remain_frame_count: # of frames remaining, non-zero if SP was cut
+ *  short by GO absence
+ * @sta_id: station ID
+ */
+struct iwl_mvm_eosp_notification {
+  __le32 remain_frame_count;
+  __le32 sta_id;
+} __packed; /* UAPSD_EOSP_NTFY_API_S_VER_1 */
+
+#endif  // SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_STA_H_
diff --git a/third_party/iwlwifi/fw/api/stats.h b/third_party/iwlwifi/fw/api/stats.h
new file mode 100644
index 0000000..109068f
--- /dev/null
+++ b/third_party/iwlwifi/fw/api/stats.h
@@ -0,0 +1,442 @@
+/******************************************************************************
+ *
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright (C) 2018 Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+
+#ifndef SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_STATS_H_
+#define SRC_CONNECTIVITY_WLAN_DRIVERS_THIRD_PARTY_INTEL_IWLWIFI_FW_API_STATS_H_
+
+#include "src/iwlwifi/fw/api/mac.h"
+#include "src/iwlwifi/platform/compiler.h"
+
+struct mvm_statistics_dbg {
+  __le32 burst_check;
+  __le32 burst_count;
+  __le32 wait_for_silence_timeout_cnt;
+  uint8_t reserved[12];
+} __packed; /* STATISTICS_DEBUG_API_S_VER_2 */
+
+struct mvm_statistics_div {
+  __le32 tx_on_a;
+  __le32 tx_on_b;
+  __le32 exec_time;
+  __le32 probe_time;
+  __le32 rssi_ant;
+  __le32 reserved2;
+} __packed; /* STATISTICS_SLOW_DIV_API_S_VER_2 */
+
+/**
+ * struct mvm_statistics_rx_non_phy
+ * @bogus_cts: CTS received when not expecting CTS
+ * @bogus_ack: ACK received when not expecting ACK
+ * @non_channel_beacons: beacons with our bss id but not on our serving channel
+ * @channel_beacons: beacons with our bss id and in our serving channel
+ * @num_missed_bcon: number of missed beacons
+ * @adc_rx_saturation_time: count in 0.8us units the time the ADC was in
+ *  saturation
+ * @ina_detection_search_time: total time (in 0.8us) searched for INA
+ * @beacon_silence_rssi_a: RSSI silence after beacon frame
+ * @beacon_silence_rssi_b: RSSI silence after beacon frame
+ * @beacon_silence_rssi_c: RSSI silence after beacon frame
+ * @interference_data_flag: flag for interference data availability. 1 when data
+ *  is available.
+ * @channel_load: counts RX Enable time in uSec
+ * @beacon_rssi_a: beacon RSSI on anntena A
+ * @beacon_rssi_b: beacon RSSI on antenna B
+ * @beacon_rssi_c: beacon RSSI on antenna C
+ * @beacon_energy_a: beacon energy on antenna A
+ * @beacon_energy_b: beacon energy on antenna B
+ * @beacon_energy_c: beacon energy on antenna C
+ * @num_bt_kills: number of BT "kills" (frame TX aborts)
+ * @mac_id: mac ID
+ */
+struct mvm_statistics_rx_non_phy {
+  __le32 bogus_cts;
+  __le32 bogus_ack;
+  __le32 non_channel_beacons;
+  __le32 channel_beacons;
+  __le32 num_missed_bcon;
+  __le32 adc_rx_saturation_time;
+  __le32 ina_detection_search_time;
+  __le32 beacon_silence_rssi_a;
+  __le32 beacon_silence_rssi_b;
+  __le32 beacon_silence_rssi_c;
+  __le32 interference_data_flag;
+  __le32 channel_load;
+  __le32 beacon_rssi_a;
+  __le32 beacon_rssi_b;
+  __le32 beacon_rssi_c;
+  __le32 beacon_energy_a;
+  __le32 beacon_energy_b;
+  __le32 beacon_energy_c;
+  __le32 num_bt_kills;
+  __le32 mac_id;
+} __packed; /* STATISTICS_RX_NON_PHY_API_S_VER_4 */
+
+struct mvm_statistics_rx_non_phy_v3 {
+  __le32 bogus_cts;                 /* CTS received when not expecting CTS */
+  __le32 bogus_ack;                 /* ACK received when not expecting ACK */
+  __le32 non_bssid_frames;          /* number of frames with BSSID that
+                                     * doesn't belong to the STA BSSID */
+  __le32 filtered_frames;           /* count frames that were dumped in the
+                                     * filtering process */
+  __le32 non_channel_beacons;       /* beacons with our bss id but not on
+                                     * our serving channel */
+  __le32 channel_beacons;           /* beacons with our bss id and in our
+                                     * serving channel */
+  __le32 num_missed_bcon;           /* number of missed beacons */
+  __le32 adc_rx_saturation_time;    /* count in 0.8us units the time the
+                                     * ADC was in saturation */
+  __le32 ina_detection_search_time; /* total time (in 0.8us) searched
+                                     * for INA */
+  __le32 beacon_silence_rssi_a;     /* RSSI silence after beacon frame */
+  __le32 beacon_silence_rssi_b;     /* RSSI silence after beacon frame */
+  __le32 beacon_silence_rssi_c;     /* RSSI silence after beacon frame */
+  __le32 interference_data_flag;    /* flag for interference data
+                                     * availability. 1 when data is
+                                     * available. */
+  __le32 channel_load;              /* counts RX Enable time in uSec */
+  __le32 dsp_false_alarms;          /* DSP false alarm (both OFDM
+                                     * and CCK) counter */
+  __le32 beacon_rssi_a;
+  __le32 beacon_rssi_b;
+  __le32 beacon_rssi_c;
+  __le32 beacon_energy_a;
+  __le32 beacon_energy_b;
+  __le32 beacon_energy_c;
+  __le32 num_bt_kills;
+  __le32 mac_id;
+  __le32 directed_data_mpdu;
+} __packed; /* STATISTICS_RX_NON_PHY_API_S_VER_3 */
+
+struct mvm_statistics_rx_phy {
+  __le32 unresponded_rts;
+  __le32 rxe_frame_lmt_overrun;
+  __le32 sent_ba_rsp_cnt;
+  __le32 dsp_self_kill;
+  __le32 reserved;
+} __packed; /* STATISTICS_RX_PHY_API_S_VER_3 */
+
+struct mvm_statistics_rx_phy_v2 {
+  __le32 ina_cnt;
+  __le32 fina_cnt;
+  __le32 plcp_err;
+  __le32 crc32_err;
+  __le32 overrun_err;
+  __le32 early_overrun_err;
+  __le32 crc32_good;
+  __le32 false_alarm_cnt;
+  __le32 fina_sync_err_cnt;
+  __le32 sfd_timeout;
+  __le32 fina_timeout;
+  __le32 unresponded_rts;
+  __le32 rxe_frame_lmt_overrun;
+  __le32 sent_ack_cnt;
+  __le32 sent_cts_cnt;
+  __le32 sent_ba_rsp_cnt;
+  __le32 dsp_self_kill;
+  __le32 mh_format_err;
+  __le32 re_acq_main_rssi_sum;
+  __le32 reserved;
+} __packed; /* STATISTICS_RX_PHY_API_S_VER_2 */
+
+struct mvm_statistics_rx_ht_phy_v1 {
+  __le32 plcp_err;
+  __le32 overrun_err;
+  __le32 early_overrun_err;
+  __le32 crc32_good;
+  __le32 crc32_err;
+  __le32 mh_format_err;
+  __le32 agg_crc32_good;
+  __le32 agg_mpdu_cnt;
+  __le32 agg_cnt;
+  __le32 unsupport_mcs;
+} __packed; /* STATISTICS_HT_RX_PHY_API_S_VER_1 */
+
+struct mvm_statistics_rx_ht_phy {
+  __le32 mh_format_err;
+  __le32 agg_mpdu_cnt;
+  __le32 agg_cnt;
+  __le32 unsupport_mcs;
+} __packed; /* STATISTICS_HT_RX_PHY_API_S_VER_2 */
+
+struct mvm_statistics_tx_non_phy_v3 {
+  __le32 preamble_cnt;
+  __le32 rx_detected_cnt;
+  __le32 bt_prio_defer_cnt;
+  __le32 bt_prio_kill_cnt;
+  __le32 few_bytes_cnt;
+  __le32 cts_timeout;
+  __le32 ack_timeout;
+  __le32 expected_ack_cnt;
+  __le32 actual_ack_cnt;
+  __le32 dump_msdu_cnt;
+  __le32 burst_abort_next_frame_mismatch_cnt;
+  __le32 burst_abort_missing_next_frame_cnt;
+  __le32 cts_timeout_collision;
+  __le32 ack_or_ba_timeout_collision;
+} __packed; /* STATISTICS_TX_NON_PHY_API_S_VER_3 */
+
+struct mvm_statistics_tx_non_phy {
+  __le32 bt_prio_defer_cnt;
+  __le32 bt_prio_kill_cnt;
+  __le32 few_bytes_cnt;
+  __le32 cts_timeout;
+  __le32 ack_timeout;
+  __le32 dump_msdu_cnt;
+  __le32 burst_abort_next_frame_mismatch_cnt;
+  __le32 burst_abort_missing_next_frame_cnt;
+  __le32 cts_timeout_collision;
+  __le32 ack_or_ba_timeout_collision;
+} __packed; /* STATISTICS_TX_NON_PHY_API_S_VER_4 */
+
+#define MAX_CHAINS 3
+
+struct mvm_statistics_tx_non_phy_agg {
+  __le32 ba_timeout;
+  __le32 ba_reschedule_frames;
+  __le32 scd_query_agg_frame_cnt;
+  __le32 scd_query_no_agg;
+  __le32 scd_query_agg;
+  __le32 scd_query_mismatch;
+  __le32 frame_not_ready;
+  __le32 underrun;
+  __le32 bt_prio_kill;
+  __le32 rx_ba_rsp_cnt;
+  __s8 txpower[MAX_CHAINS];
+  __s8 reserved;
+  __le32 reserved2;
+} __packed; /* STATISTICS_TX_NON_PHY_AGG_API_S_VER_1 */
+
+struct mvm_statistics_tx_channel_width {
+  __le32 ext_cca_narrow_ch20[1];
+  __le32 ext_cca_narrow_ch40[2];
+  __le32 ext_cca_narrow_ch80[3];
+  __le32 ext_cca_narrow_ch160[4];
+  __le32 last_tx_ch_width_indx;
+  __le32 rx_detected_per_ch_width[4];
+  __le32 success_per_ch_width[4];
+  __le32 fail_per_ch_width[4];
+}; /* STATISTICS_TX_CHANNEL_WIDTH_API_S_VER_1 */
+
+struct mvm_statistics_tx_v4 {
+  struct mvm_statistics_tx_non_phy_v3 general;
+  struct mvm_statistics_tx_non_phy_agg agg;
+  struct mvm_statistics_tx_channel_width channel_width;
+} __packed; /* STATISTICS_TX_API_S_VER_4 */
+
+struct mvm_statistics_tx {
+  struct mvm_statistics_tx_non_phy general;
+  struct mvm_statistics_tx_non_phy_agg agg;
+  struct mvm_statistics_tx_channel_width channel_width;
+} __packed; /* STATISTICS_TX_API_S_VER_5 */
+
+struct mvm_statistics_bt_activity {
+  __le32 hi_priority_tx_req_cnt;
+  __le32 hi_priority_tx_denied_cnt;
+  __le32 lo_priority_tx_req_cnt;
+  __le32 lo_priority_tx_denied_cnt;
+  __le32 hi_priority_rx_req_cnt;
+  __le32 hi_priority_rx_denied_cnt;
+  __le32 lo_priority_rx_req_cnt;
+  __le32 lo_priority_rx_denied_cnt;
+} __packed; /* STATISTICS_BT_ACTIVITY_API_S_VER_1 */
+
+struct mvm_statistics_general_common_v19 {
+  __le32 radio_temperature;
+  __le32 radio_voltage;
+  struct mvm_statistics_dbg dbg;
+  __le32 sleep_time;
+  __le32 slots_out;
+  __le32 slots_idle;
+  __le32 ttl_timestamp;
+  struct mvm_statistics_div slow_div;
+  __le32 rx_enable_counter;
+  /*
+   * num_of_sos_states:
+   *  count the number of times we have to re-tune
+   *  in order to get out of bad PHY status
+   */
+  __le32 num_of_sos_states;
+  __le32 beacon_filtered;
+  __le32 missed_beacons;
+  uint8_t beacon_filter_average_energy;
+  uint8_t beacon_filter_reason;
+  uint8_t beacon_filter_current_energy;
+  uint8_t beacon_filter_reserved;
+  __le32 beacon_filter_delta_time;
+  struct mvm_statistics_bt_activity bt_activity;
+  __le64 rx_time;
+  __le64 on_time_rf;
+  __le64 on_time_scan;
+  __le64 tx_time;
+} __packed;
+
+struct mvm_statistics_general_common {
+  __le32 radio_temperature;
+  struct mvm_statistics_dbg dbg;
+  __le32 sleep_time;
+  __le32 slots_out;
+  __le32 slots_idle;
+  __le32 ttl_timestamp;
+  struct mvm_statistics_div slow_div;
+  __le32 rx_enable_counter;
+  /*
+   * num_of_sos_states:
+   *  count the number of times we have to re-tune
+   *  in order to get out of bad PHY status
+   */
+  __le32 num_of_sos_states;
+  __le32 beacon_filtered;
+  __le32 missed_beacons;
+  uint8_t beacon_filter_average_energy;
+  uint8_t beacon_filter_reason;
+  uint8_t beacon_filter_current_energy;
+  uint8_t beacon_filter_reserved;
+  __le32 beacon_filter_delta_time;
+  struct mvm_statistics_bt_activity bt_activity;
+  __le64 rx_time;
+  __le64 on_time_rf;
+  __le64 on_time_scan;
+  __le64 tx_time;
+} __packed; /* STATISTICS_GENERAL_API_S_VER_10 */
+
+struct mvm_statistics_general_v8 {
+  struct mvm_statistics_general_common_v19 common;
+  __le32 beacon_counter[NUM_MAC_INDEX];
+  uint8_t beacon_average_energy[NUM_MAC_INDEX];
+  uint8_t reserved[4 - (NUM_MAC_INDEX % 4)];
+} __packed; /* STATISTICS_GENERAL_API_S_VER_8 */
+
+struct mvm_statistics_general {
+  struct mvm_statistics_general_common common;
+  __le32 beacon_counter[MAC_INDEX_AUX];
+  uint8_t beacon_average_energy[MAC_INDEX_AUX];
+  uint8_t reserved[8 - MAC_INDEX_AUX];
+} __packed; /* STATISTICS_GENERAL_API_S_VER_10 */
+
+/**
+ * struct mvm_statistics_load - RX statistics for multi-queue devices
+ * @air_time: accumulated air time, per mac
+ * @byte_count: accumulated byte count, per mac
+ * @pkt_count: accumulated packet count, per mac
+ * @avg_energy: average RSSI, per station
+ */
+struct mvm_statistics_load {
+  __le32 air_time[MAC_INDEX_AUX];
+  __le32 byte_count[MAC_INDEX_AUX];
+  __le32 pkt_count[MAC_INDEX_AUX];
+  uint8_t avg_energy[IWL_MVM_STATION_COUNT];
+} __packed; /* STATISTICS_RX_MAC_STATION_S_VER_3 */
+
+struct mvm_statistics_load_v1 {
+  __le32 air_time[NUM_MAC_INDEX];
+  __le32 byte_count[NUM_MAC_INDEX];
+  __le32 pkt_count[NUM_MAC_INDEX];
+  uint8_t avg_energy[IWL_MVM_STATION_COUNT];
+} __packed; /* STATISTICS_RX_MAC_STATION_S_VER_1 */
+
+struct mvm_statistics_rx {
+  struct mvm_statistics_rx_phy ofdm;
+  struct mvm_statistics_rx_phy cck;
+  struct mvm_statistics_rx_non_phy general;
+  struct mvm_statistics_rx_ht_phy ofdm_ht;
+} __packed; /* STATISTICS_RX_API_S_VER_4 */
+
+struct mvm_statistics_rx_v3 {
+  struct mvm_statistics_rx_phy_v2 ofdm;
+  struct mvm_statistics_rx_phy_v2 cck;
+  struct mvm_statistics_rx_non_phy_v3 general;
+  struct mvm_statistics_rx_ht_phy_v1 ofdm_ht;
+} __packed; /* STATISTICS_RX_API_S_VER_3 */
+
+/*
+ * STATISTICS_NOTIFICATION = 0x9d (notification only, not a command)
+ *
+ * By default, uCode issues this notification after receiving a beacon
+ * while associated.  To disable this behavior, set DISABLE_NOTIF flag in the
+ * STATISTICS_CMD (0x9c), below.
+ */
+
+struct iwl_notif_statistics_v10 {
+  __le32 flag;
+  struct mvm_statistics_rx_v3 rx;
+  struct mvm_statistics_tx_v4 tx;
+  struct mvm_statistics_general_v8 general;
+} __packed; /* STATISTICS_NTFY_API_S_VER_10 */
+
+struct iwl_notif_statistics_v11 {
+  __le32 flag;
+  struct mvm_statistics_rx_v3 rx;
+  struct mvm_statistics_tx_v4 tx;
+  struct mvm_statistics_general_v8 general;
+  struct mvm_statistics_load_v1 load_stats;
+} __packed; /* STATISTICS_NTFY_API_S_VER_11 */
+
+struct iwl_notif_statistics {
+  __le32 flag;
+  struct mvm_statistics_rx rx;
+  struct mvm_statistics_tx tx;
+  struct mvm_statistics_general general;
+  struct mvm_statistics_load load_stats;
+} __packed; /* STATISTICS_NTFY_API_S_VER_13 */
+
+/**
+ * enum iwl_statistics_notif_flags - flags used in statistics notification
+ * @IWL_STATISTICS_REPLY_FLG_CLEAR: statistics were cleared after this report
+ */
+enum iwl_statistics_notif_flags {
+  IWL_STATISTICS_REPLY_FLG_CLEAR = 0x1,
+};
+
+/**
+ * enum iwl_statistics_cmd_flags - flags used in statistics command
+ * @IWL_STATISTICS_FLG_CLEAR: request to clear statistics after the report
+ *  that's sent after this command
+ * @IWL_STATISTICS_FLG_DISABLE_NOTIF: disable unilateral statistics
+ *  notifications
+ */
+enum iwl_statistics_cmd_flags {
+  IWL_STATISTICS_FLG_CLEAR = 0x1,
+  IWL_STATISTICS_FLG_DISABLE_NOTIF = 0x2,
+};
+
+/**
+ * struct iwl_statistics_cmd - statistics config command
+ * @flags: flags from &enum i