Merge branch 'for-john' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next

Conflicts:
	drivers/net/wireless/mwifiex/sta_ioctl.c
	net/mac80211/scan.c

15 files changed, 580 insertions, 171 deletions

diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 4965aa6424ec..5c61677487cf 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -398,6 +398,38 @@ void sta_set_rate_info_tx(struct sta_info *sta,
                 rinfo->flags |= RATE_INFO_FLAGS_SHORT_GI;
 }
 
+void sta_set_rate_info_rx(struct sta_info *sta, struct rate_info *rinfo)
+{
+        rinfo->flags = 0;
+
+        if (sta->last_rx_rate_flag & RX_FLAG_HT) {
+                rinfo->flags |= RATE_INFO_FLAGS_MCS;
+                rinfo->mcs = sta->last_rx_rate_idx;
+        } else if (sta->last_rx_rate_flag & RX_FLAG_VHT) {
+                rinfo->flags |= RATE_INFO_FLAGS_VHT_MCS;
+                rinfo->nss = sta->last_rx_rate_vht_nss;
+                rinfo->mcs = sta->last_rx_rate_idx;
+        } else {
+                struct ieee80211_supported_band *sband;
+
+                sband = sta->local->hw.wiphy->bands[
+                                ieee80211_get_sdata_band(sta->sdata)];
+                rinfo->legacy =
+                        sband->bitrates[sta->last_rx_rate_idx].bitrate;
+        }
+
+        if (sta->last_rx_rate_flag & RX_FLAG_40MHZ)
+                rinfo->flags |= RATE_INFO_FLAGS_40_MHZ_WIDTH;
+        if (sta->last_rx_rate_flag & RX_FLAG_SHORT_GI)
+                rinfo->flags |= RATE_INFO_FLAGS_SHORT_GI;
+        if (sta->last_rx_rate_flag & RX_FLAG_80MHZ)
+                rinfo->flags |= RATE_INFO_FLAGS_80_MHZ_WIDTH;
+        if (sta->last_rx_rate_flag & RX_FLAG_80P80MHZ)
+                rinfo->flags |= RATE_INFO_FLAGS_80P80_MHZ_WIDTH;
+        if (sta->last_rx_rate_flag & RX_FLAG_160MHZ)
+                rinfo->flags |= RATE_INFO_FLAGS_160_MHZ_WIDTH;
+}
+
 static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
 {
         struct ieee80211_sub_if_data *sdata = sta->sdata;
@@ -444,34 +476,7 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
         }
 
         sta_set_rate_info_tx(sta, &sta->last_tx_rate, &sinfo->txrate);
-
-        sinfo->rxrate.flags = 0;
-        if (sta->last_rx_rate_flag & RX_FLAG_HT) {
-                sinfo->rxrate.flags |= RATE_INFO_FLAGS_MCS;
-                sinfo->rxrate.mcs = sta->last_rx_rate_idx;
-        } else if (sta->last_rx_rate_flag & RX_FLAG_VHT) {
-                sinfo->rxrate.flags |= RATE_INFO_FLAGS_VHT_MCS;
-                sinfo->rxrate.nss = sta->last_rx_rate_vht_nss;
-                sinfo->rxrate.mcs = sta->last_rx_rate_idx;
-        } else {
-                struct ieee80211_supported_band *sband;
-
-                sband = sta->local->hw.wiphy->bands[
-                                ieee80211_get_sdata_band(sta->sdata)];
-                sinfo->rxrate.legacy =
-                        sband->bitrates[sta->last_rx_rate_idx].bitrate;
-        }
-
-        if (sta->last_rx_rate_flag & RX_FLAG_40MHZ)
-                sinfo->rxrate.flags |= RATE_INFO_FLAGS_40_MHZ_WIDTH;
-        if (sta->last_rx_rate_flag & RX_FLAG_SHORT_GI)
-                sinfo->rxrate.flags |= RATE_INFO_FLAGS_SHORT_GI;
-        if (sta->last_rx_rate_flag & RX_FLAG_80MHZ)
-                sinfo->rxrate.flags |= RATE_INFO_FLAGS_80_MHZ_WIDTH;
-        if (sta->last_rx_rate_flag & RX_FLAG_80P80MHZ)
-                sinfo->rxrate.flags |= RATE_INFO_FLAGS_80P80_MHZ_WIDTH;
-        if (sta->last_rx_rate_flag & RX_FLAG_160MHZ)
-                sinfo->rxrate.flags |= RATE_INFO_FLAGS_160_MHZ_WIDTH;
+        sta_set_rate_info_rx(sta, &sinfo->rxrate);
 
         if (ieee80211_vif_is_mesh(&sdata->vif)) {
 #ifdef CONFIG_MAC80211_MESH
@@ -893,7 +898,8 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
         u32 changed = BSS_CHANGED_BEACON_INT |
                       BSS_CHANGED_BEACON_ENABLED |
                       BSS_CHANGED_BEACON |
-                      BSS_CHANGED_SSID;
+                      BSS_CHANGED_SSID |
+                      BSS_CHANGED_P2P_PS;
         int err;
 
         old = rtnl_dereference(sdata->u.ap.beacon);
@@ -932,6 +938,9 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
         sdata->vif.bss_conf.hidden_ssid =
                 (params->hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE);
 
+        sdata->vif.bss_conf.p2p_ctwindow = params->p2p_ctwindow;
+        sdata->vif.bss_conf.p2p_oppps = params->p2p_opp_ps;
+
         err = ieee80211_assign_beacon(sdata, &params->beacon);
         if (err < 0)
                 return err;
@@ -1807,6 +1816,16 @@ static int ieee80211_change_bss(struct wiphy *wiphy,
                 changed |= BSS_CHANGED_HT;
         }
 
+        if (params->p2p_ctwindow >= 0) {
+                sdata->vif.bss_conf.p2p_ctwindow = params->p2p_ctwindow;
+                changed |= BSS_CHANGED_P2P_PS;
+        }
+
+        if (params->p2p_opp_ps >= 0) {
+                sdata->vif.bss_conf.p2p_oppps = params->p2p_opp_ps;
+                changed |= BSS_CHANGED_P2P_PS;
+        }
+
         ieee80211_bss_info_change_notify(sdata, changed);
 
         return 0;
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index 89281d24b094..49a1c70bbd70 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -53,6 +53,7 @@ static const struct file_operations sta_ ##name## _ops = {		\
 STA_FILE(aid, sta.aid, D);
 STA_FILE(dev, sdata->name, S);
 STA_FILE(last_signal, last_signal, D);
+STA_FILE(last_ack_signal, last_ack_signal, D);
 
 static ssize_t sta_flags_read(struct file *file, char __user *userbuf,
                               size_t count, loff_t *ppos)
@@ -321,6 +322,38 @@ static ssize_t sta_ht_capa_read(struct file *file, char __user *userbuf,
 }
 STA_OPS(ht_capa);
 
+static ssize_t sta_current_tx_rate_read(struct file *file, char __user *userbuf,
+                                        size_t count, loff_t *ppos)
+{
+        struct sta_info *sta = file->private_data;
+        struct rate_info rinfo;
+        u16 rate;
+        sta_set_rate_info_tx(sta, &sta->last_tx_rate, &rinfo);
+        rate = cfg80211_calculate_bitrate(&rinfo);
+
+        return mac80211_format_buffer(userbuf, count, ppos,
+                                      "%d.%d MBit/s\n",
+                                      rate/10, rate%10);
+}
+STA_OPS(current_tx_rate);
+
+static ssize_t sta_last_rx_rate_read(struct file *file, char __user *userbuf,
+                                     size_t count, loff_t *ppos)
+{
+        struct sta_info *sta = file->private_data;
+        struct rate_info rinfo;
+        u16 rate;
+
+        sta_set_rate_info_rx(sta, &rinfo);
+
+        rate = cfg80211_calculate_bitrate(&rinfo);
+
+        return mac80211_format_buffer(userbuf, count, ppos,
+                                      "%d.%d MBit/s\n",
+                                      rate/10, rate%10);
+}
+STA_OPS(last_rx_rate);
+
 #define DEBUGFS_ADD(name) \
         debugfs_create_file(#name, 0400, \
                 sta->debugfs.dir, sta, &sta_ ##name## _ops);
@@ -369,6 +402,9 @@ void ieee80211_sta_debugfs_add(struct sta_info *sta)
         DEBUGFS_ADD(dev);
         DEBUGFS_ADD(last_signal);
         DEBUGFS_ADD(ht_capa);
+        DEBUGFS_ADD(last_ack_signal);
+        DEBUGFS_ADD(current_tx_rate);
+        DEBUGFS_ADD(last_rx_rate);
 
         DEBUGFS_ADD_COUNTER(rx_packets, rx_packets);
         DEBUGFS_ADD_COUNTER(tx_packets, tx_packets);
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 5c0d5a6946c1..42d0d0267730 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -371,6 +371,8 @@ enum ieee80211_sta_flags {
         IEEE80211_STA_RESET_SIGNAL_AVE  = BIT(9),
         IEEE80211_STA_DISABLE_40MHZ     = BIT(10),
         IEEE80211_STA_DISABLE_VHT       = BIT(11),
+        IEEE80211_STA_DISABLE_80P80MHZ  = BIT(12),
+        IEEE80211_STA_DISABLE_160MHZ    = BIT(13),
 };
 
 struct ieee80211_mgd_auth_data {
@@ -1032,6 +1034,7 @@ struct ieee80211_local {
         enum ieee80211_band hw_scan_band;
         int scan_channel_idx;
         int scan_ies_len;
+        int hw_scan_ies_bufsize;
 
         struct work_struct sched_scan_stopped_work;
         struct ieee80211_sub_if_data __rcu *sched_scan_sdata;
@@ -1573,7 +1576,7 @@ void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
                                     const u8 *bssid, u16 stype, u16 reason,
                                     bool send_frame, u8 *frame_buf);
 int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
-                             const u8 *ie, size_t ie_len,
+                             size_t buffer_len, const u8 *ie, size_t ie_len,
                              enum ieee80211_band band, u32 rate_mask,
                              u8 channel);
 struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 5331662489f7..40c36d5d7377 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -223,6 +223,47 @@ static int ieee80211_change_mtu(struct net_device *dev, int new_mtu)
         return 0;
 }
 
+static int ieee80211_verify_mac(struct ieee80211_local *local, u8 *addr)
+{
+        struct ieee80211_sub_if_data *sdata;
+        u64 new, mask, tmp;
+        u8 *m;
+        int ret = 0;
+
+        if (is_zero_ether_addr(local->hw.wiphy->addr_mask))
+                return 0;
+
+        m = addr;
+        new =   ((u64)m[0] << 5*8) | ((u64)m[1] << 4*8) |
+                ((u64)m[2] << 3*8) | ((u64)m[3] << 2*8) |
+                ((u64)m[4] << 1*8) | ((u64)m[5] << 0*8);
+
+        m = local->hw.wiphy->addr_mask;
+        mask =  ((u64)m[0] << 5*8) | ((u64)m[1] << 4*8) |
+                ((u64)m[2] << 3*8) | ((u64)m[3] << 2*8) |
+                ((u64)m[4] << 1*8) | ((u64)m[5] << 0*8);
+
+
+        mutex_lock(&local->iflist_mtx);
+        list_for_each_entry(sdata, &local->interfaces, list) {
+                if (sdata->vif.type == NL80211_IFTYPE_MONITOR)
+                        continue;
+
+                m = sdata->vif.addr;
+                tmp =   ((u64)m[0] << 5*8) | ((u64)m[1] << 4*8) |
+                        ((u64)m[2] << 3*8) | ((u64)m[3] << 2*8) |
+                        ((u64)m[4] << 1*8) | ((u64)m[5] << 0*8);
+
+                if ((new & ~mask) != (tmp & ~mask)) {
+                        ret = -EINVAL;
+                        break;
+                }
+        }
+        mutex_unlock(&local->iflist_mtx);
+
+        return ret;
+}
+
 static int ieee80211_change_mac(struct net_device *dev, void *addr)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
@@ -232,6 +273,10 @@ static int ieee80211_change_mac(struct net_device *dev, void *addr)
         if (ieee80211_sdata_running(sdata))
                 return -EBUSY;
 
+        ret = ieee80211_verify_mac(sdata->local, sa->sa_data);
+        if (ret)
+                return ret;
+
         ret = eth_mac_addr(dev, sa);
 
         if (ret == 0)
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index f5e4c1f24bf2..1b087fff93e7 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -474,7 +474,8 @@ ieee80211_default_mgmt_stypes[NUM_NL80211_IFTYPES] = {
                 .tx = 0xffff,
                 .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
                         BIT(IEEE80211_STYPE_AUTH >> 4) |
-                        BIT(IEEE80211_STYPE_DEAUTH >> 4),
+                        BIT(IEEE80211_STYPE_DEAUTH >> 4) |
+                        BIT(IEEE80211_STYPE_PROBE_REQ >> 4),
         },
         [NL80211_IFTYPE_STATION] = {
                 .tx = 0xffff,
@@ -638,6 +639,8 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
         local->hw.radiotap_mcs_details = IEEE80211_RADIOTAP_MCS_HAVE_MCS |
                                          IEEE80211_RADIOTAP_MCS_HAVE_GI |
                                          IEEE80211_RADIOTAP_MCS_HAVE_BW;
+        local->hw.radiotap_vht_details = IEEE80211_RADIOTAP_VHT_KNOWN_GI |
+                                         IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH;
         local->user_power_level = IEEE80211_UNSET_POWER_LEVEL;
         wiphy->ht_capa_mod_mask = &mac80211_ht_capa_mod_mask;
 
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index ca52dfdd5375..4b274e9c91a5 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -391,7 +391,8 @@ static struct sta_info *mesh_peer_init(struct ieee80211_sub_if_data *sdata,
                 sta->ch_width = chandef.width;
         }
 
-        rate_control_rate_init(sta);
+        if (insert)
+                rate_control_rate_init(sta);
         spin_unlock_bh(&sta->lock);
 
         if (insert && sta_info_insert(sta))
diff --git a/net/mac80211/mesh_sync.c b/net/mac80211/mesh_sync.c
index 0f40086cce18..aa8d1e437385 100644
--- a/net/mac80211/mesh_sync.c
+++ b/net/mac80211/mesh_sync.c
@@ -195,11 +195,15 @@ static void mesh_sync_offset_adjust_tbtt(struct ieee80211_sub_if_data *sdata)
                           ifmsh->sync_offset_clockdrift_max);
                 set_bit(MESH_WORK_DRIFT_ADJUST,
                         &ifmsh->wrkq_flags);
+
+                ifmsh->adjusting_tbtt = true;
         } else {
                 msync_dbg(sdata,
                           "TBTT : max clockdrift=%lld; too small to adjust\n",
                           (long long)ifmsh->sync_offset_clockdrift_max);
                 ifmsh->sync_offset_clockdrift_max = 0;
+
+                ifmsh->adjusting_tbtt = false;
         }
         spin_unlock_bh(&ifmsh->sync_offset_lock);
 }
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index d2a4f78b4b0f..09556303c7e1 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -354,6 +354,16 @@ static void ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,
         /* determine capability flags */
         cap = vht_cap.cap;
 
+        if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_80P80MHZ) {
+                cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ;
+                cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
+        }
+
+        if (sdata->u.mgd.flags & IEEE80211_STA_DISABLE_160MHZ) {
+                cap &= ~IEEE80211_VHT_CAP_SHORT_GI_160;
+                cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
+        }
+
         /* reserve and fill IE */
         pos = skb_put(skb, sizeof(struct ieee80211_vht_cap) + 2);
         ieee80211_ie_build_vht_cap(pos, &vht_cap, cap);
@@ -543,6 +553,10 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
                 offset = noffset;
         }
 
+        if (WARN_ON_ONCE((ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
+                         !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT)))
+                ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
+
         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
                 ieee80211_add_ht_ie(sdata, skb, assoc_data->ap_ht_param,
                                     sband, chan, sdata->smps_mode);
@@ -775,6 +789,7 @@ void ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
                            "not handling channel switch with channel contexts\n");
                 ieee80211_queue_work(&sdata->local->hw,
                                      &ifmgd->csa_connection_drop_work);
+                return;
         }
 
         mutex_lock(&sdata->local->chanctx_mtx);
@@ -1368,19 +1383,26 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
         sdata->u.mgd.flags |= IEEE80211_STA_RESET_SIGNAL_AVE;
 
         if (sdata->vif.p2p) {
-                u8 noa[2];
-                int ret;
+                const struct cfg80211_bss_ies *ies;
 
-                ret = cfg80211_get_p2p_attr(cbss->information_elements,
-                                            cbss->len_information_elements,
-                                            IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
-                                            noa, sizeof(noa));
-                if (ret >= 2) {
-                        bss_conf->p2p_oppps = noa[1] & 0x80;
-                        bss_conf->p2p_ctwindow = noa[1] & 0x7f;
-                        bss_info_changed |= BSS_CHANGED_P2P_PS;
-                        sdata->u.mgd.p2p_noa_index = noa[0];
+                rcu_read_lock();
+                ies = rcu_dereference(cbss->ies);
+                if (ies) {
+                        u8 noa[2];
+                        int ret;
+
+                        ret = cfg80211_get_p2p_attr(
+                                        ies->data, ies->len,
+                                        IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
+                                        noa, sizeof(noa));
+                        if (ret >= 2) {
+                                bss_conf->p2p_oppps = noa[1] & 0x80;
+                                bss_conf->p2p_ctwindow = noa[1] & 0x7f;
+                                bss_info_changed |= BSS_CHANGED_P2P_PS;
+                                sdata->u.mgd.p2p_noa_index = noa[0];
+                        }
                 }
+                rcu_read_unlock();
         }
 
         /* just to be sure */
@@ -1645,6 +1667,7 @@ static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
         } else {
                 int ssid_len;
 
+                rcu_read_lock();
                 ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
                 if (WARN_ON_ONCE(ssid == NULL))
                         ssid_len = 0;
@@ -1654,6 +1677,7 @@ static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
                 ieee80211_send_probe_req(sdata, dst, ssid + 2, ssid_len, NULL,
                                          0, (u32) -1, true, false,
                                          ifmgd->associated->channel, false);
+                rcu_read_unlock();
         }
 
         ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms);
@@ -1749,6 +1773,7 @@ struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
         else
                 return NULL;
 
+        rcu_read_lock();
         ssid = ieee80211_bss_get_ie(cbss, WLAN_EID_SSID);
         if (WARN_ON_ONCE(ssid == NULL))
                 ssid_len = 0;
@@ -1759,6 +1784,7 @@ struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
                                         (u32) -1, cbss->channel,
                                         ssid + 2, ssid_len,
                                         NULL, 0, true);
+        rcu_read_unlock();
 
         return skb;
 }
@@ -2844,9 +2870,12 @@ static int ieee80211_probe_auth(struct ieee80211_sub_if_data *sdata)
                            auth_data->bss->bssid, auth_data->tries,
                            IEEE80211_AUTH_MAX_TRIES);
 
+                rcu_read_lock();
                 ssidie = ieee80211_bss_get_ie(auth_data->bss, WLAN_EID_SSID);
-                if (!ssidie)
+                if (!ssidie) {
+                        rcu_read_unlock();
                         return -EINVAL;
+                }
                 /*
                  * Direct probe is sent to broadcast address as some APs
                  * will not answer to direct packet in unassociated state.
@@ -2854,6 +2883,7 @@ static int ieee80211_probe_auth(struct ieee80211_sub_if_data *sdata)
                 ieee80211_send_probe_req(sdata, NULL, ssidie + 2, ssidie[1],
                                          NULL, 0, (u32) -1, true, false,
                                          auth_data->bss->channel, false);
+                rcu_read_unlock();
         }
 
         auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
@@ -3183,106 +3213,313 @@ int ieee80211_max_network_latency(struct notifier_block *nb,
         return 0;
 }
 
+static u32 chandef_downgrade(struct cfg80211_chan_def *c)
+{
+        u32 ret;
+        int tmp;
+
+        switch (c->width) {
+        case NL80211_CHAN_WIDTH_20:
+                c->width = NL80211_CHAN_WIDTH_20_NOHT;
+                ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
+                break;
+        case NL80211_CHAN_WIDTH_40:
+                c->width = NL80211_CHAN_WIDTH_20;
+                c->center_freq1 = c->chan->center_freq;
+                ret = IEEE80211_STA_DISABLE_40MHZ |
+                      IEEE80211_STA_DISABLE_VHT;
+                break;
+        case NL80211_CHAN_WIDTH_80:
+                tmp = (30 + c->chan->center_freq - c->center_freq1)/20;
+                /* n_P40 */
+                tmp /= 2;
+                /* freq_P40 */
+                c->center_freq1 = c->center_freq1 - 20 + 40 * tmp;
+                c->width = NL80211_CHAN_WIDTH_40;
+                ret = IEEE80211_STA_DISABLE_VHT;
+                break;
+        case NL80211_CHAN_WIDTH_80P80:
+                c->center_freq2 = 0;
+                c->width = NL80211_CHAN_WIDTH_80;
+                ret = IEEE80211_STA_DISABLE_80P80MHZ |
+                      IEEE80211_STA_DISABLE_160MHZ;
+                break;
+        case NL80211_CHAN_WIDTH_160:
+                /* n_P20 */
+                tmp = (70 + c->chan->center_freq - c->center_freq1)/20;
+                /* n_P80 */
+                tmp /= 4;
+                c->center_freq1 = c->center_freq1 - 40 + 80 * tmp;
+                c->width = NL80211_CHAN_WIDTH_80;
+                ret = IEEE80211_STA_DISABLE_80P80MHZ |
+                      IEEE80211_STA_DISABLE_160MHZ;
+                break;
+        default:
+        case NL80211_CHAN_WIDTH_20_NOHT:
+                WARN_ON_ONCE(1);
+                c->width = NL80211_CHAN_WIDTH_20_NOHT;
+                ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
+                break;
+        }
+
+        WARN_ON_ONCE(!cfg80211_chandef_valid(c));
+
+        return ret;
+}
+
+static u32
+ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
+                             struct ieee80211_supported_band *sband,
+                             struct ieee80211_channel *channel,
+                             const struct ieee80211_ht_operation *ht_oper,
+                             const struct ieee80211_vht_operation *vht_oper,
+                             struct cfg80211_chan_def *chandef)
+{
+        struct cfg80211_chan_def vht_chandef;
+        u32 ht_cfreq, ret;
+
+        chandef->chan = channel;
+        chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
+        chandef->center_freq1 = channel->center_freq;
+        chandef->center_freq2 = 0;
+
+        if (!ht_oper || !sband->ht_cap.ht_supported) {
+                ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
+                goto out;
+        }
+
+        chandef->width = NL80211_CHAN_WIDTH_20;
+
+        ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
+                                                  channel->band);
+        /* check that channel matches the right operating channel */
+        if (channel->center_freq != ht_cfreq) {
+                /*
+                 * It's possible that some APs are confused here;
+                 * Netgear WNDR3700 sometimes reports 4 higher than
+                 * the actual channel in association responses, but
+                 * since we look at probe response/beacon data here
+                 * it should be OK.
+                 */
+                sdata_info(sdata,
+                           "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
+                           channel->center_freq, ht_cfreq,
+                           ht_oper->primary_chan, channel->band);
+                ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
+                goto out;
+        }
+
+        /* check 40 MHz support, if we have it */
+        if (sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
+                switch (ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
+                case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
+                        chandef->width = NL80211_CHAN_WIDTH_40;
+                        chandef->center_freq1 += 10;
+                        break;
+                case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
+                        chandef->width = NL80211_CHAN_WIDTH_40;
+                        chandef->center_freq1 -= 10;
+                        break;
+                }
+        } else {
+                /* 40 MHz (and 80 MHz) must be supported for VHT */
+                ret = IEEE80211_STA_DISABLE_VHT;
+                goto out;
+        }
+
+        if (!vht_oper || !sband->vht_cap.vht_supported) {
+                ret = IEEE80211_STA_DISABLE_VHT;
+                goto out;
+        }
+
+        vht_chandef.chan = channel;
+        vht_chandef.center_freq1 =
+                ieee80211_channel_to_frequency(vht_oper->center_freq_seg1_idx,
+                                               channel->band);
+        vht_chandef.center_freq2 = 0;
+
+        if (vht_oper->center_freq_seg2_idx)
+                vht_chandef.center_freq2 =
+                        ieee80211_channel_to_frequency(
+                                vht_oper->center_freq_seg2_idx,
+                                channel->band);
+
+        switch (vht_oper->chan_width) {
+        case IEEE80211_VHT_CHANWIDTH_USE_HT:
+                vht_chandef.width = chandef->width;
+                break;
+        case IEEE80211_VHT_CHANWIDTH_80MHZ:
+                vht_chandef.width = NL80211_CHAN_WIDTH_80;
+                break;
+        case IEEE80211_VHT_CHANWIDTH_160MHZ:
+                vht_chandef.width = NL80211_CHAN_WIDTH_160;
+                break;
+        case IEEE80211_VHT_CHANWIDTH_80P80MHZ:
+                vht_chandef.width = NL80211_CHAN_WIDTH_80P80;
+                break;
+        default:
+                sdata_info(sdata,
+                           "AP VHT operation IE has invalid channel width (%d), disable VHT\n",
+                           vht_oper->chan_width);
+                ret = IEEE80211_STA_DISABLE_VHT;
+                goto out;
+        }
+
+        if (!cfg80211_chandef_valid(&vht_chandef)) {
+                sdata_info(sdata,
+                           "AP VHT information is invalid, disable VHT\n");
+                ret = IEEE80211_STA_DISABLE_VHT;
+                goto out;
+        }
+
+        if (cfg80211_chandef_identical(chandef, &vht_chandef)) {
+                ret = 0;
+                goto out;
+        }
+
+        if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
+                sdata_info(sdata,
+                           "AP VHT information doesn't match HT, disable VHT\n");
+                ret = IEEE80211_STA_DISABLE_VHT;
+                goto out;
+        }
+
+        *chandef = vht_chandef;
+
+        ret = 0;
+
+        while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
+                                        IEEE80211_CHAN_DISABLED)) {
+                if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
+                        ret = IEEE80211_STA_DISABLE_HT |
+                              IEEE80211_STA_DISABLE_VHT;
+                        goto out;
+                }
+
+                ret = chandef_downgrade(chandef);
+        }
+
+        if (chandef->width != vht_chandef.width)
+                sdata_info(sdata,
+                           "local regulatory prevented using AP HT/VHT configuration, downgraded\n");
+
+out:
+        WARN_ON_ONCE(!cfg80211_chandef_valid(chandef));
+        return ret;
+}
+
+static u8 ieee80211_ht_vht_rx_chains(struct ieee80211_sub_if_data *sdata,
+                                     struct cfg80211_bss *cbss)
+{
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        const u8 *ht_cap_ie, *vht_cap_ie;
+        const struct ieee80211_ht_cap *ht_cap;
+        const struct ieee80211_vht_cap *vht_cap;
+        u8 chains = 1;
+
+        if (ifmgd->flags & IEEE80211_STA_DISABLE_HT)
+                return chains;
+
+        ht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
+        if (ht_cap_ie && ht_cap_ie[1] >= sizeof(*ht_cap)) {
+                ht_cap = (void *)(ht_cap_ie + 2);
+                chains = ieee80211_mcs_to_chains(&ht_cap->mcs);
+                /*
+                 * TODO: use "Tx Maximum Number Spatial Streams Supported" and
+                 *       "Tx Unequal Modulation Supported" fields.
+                 */
+        }
+
+        if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
+                return chains;
+
+        vht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY);
+        if (vht_cap_ie && vht_cap_ie[1] >= sizeof(*vht_cap)) {
+                u8 nss;
+                u16 tx_mcs_map;
+
+                vht_cap = (void *)(vht_cap_ie + 2);
+                tx_mcs_map = le16_to_cpu(vht_cap->supp_mcs.tx_mcs_map);
+                for (nss = 8; nss > 0; nss--) {
+                        if (((tx_mcs_map >> (2 * (nss - 1))) & 3) !=
+                                        IEEE80211_VHT_MCS_NOT_SUPPORTED)
+                                break;
+                }
+                /* TODO: use "Tx Highest Supported Long GI Data Rate" field? */
+                chains = max(chains, nss);
+        }
+
+        return chains;
+}
+
 static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
                                   struct cfg80211_bss *cbss)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        int ht_cfreq;
-        enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
-        const u8 *ht_oper_ie;
         const struct ieee80211_ht_operation *ht_oper = NULL;
+        const struct ieee80211_vht_operation *vht_oper = NULL;
         struct ieee80211_supported_band *sband;
         struct cfg80211_chan_def chandef;
+        int ret;
 
         sband = local->hw.wiphy->bands[cbss->channel->band];
 
-        ifmgd->flags &= ~IEEE80211_STA_DISABLE_40MHZ;
+        ifmgd->flags &= ~(IEEE80211_STA_DISABLE_40MHZ |
+                          IEEE80211_STA_DISABLE_80P80MHZ |
+                          IEEE80211_STA_DISABLE_160MHZ);
 
-        if (sband->ht_cap.ht_supported) {
-                ht_oper_ie = cfg80211_find_ie(WLAN_EID_HT_OPERATION,
-                                              cbss->information_elements,
-                                              cbss->len_information_elements);
+        rcu_read_lock();
+
+        if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
+            sband->ht_cap.ht_supported) {
+                const u8 *ht_oper_ie;
+
+                ht_oper_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_OPERATION);
                 if (ht_oper_ie && ht_oper_ie[1] >= sizeof(*ht_oper))
                         ht_oper = (void *)(ht_oper_ie + 2);
         }
 
-        if (ht_oper) {
-                ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
-                                                          cbss->channel->band);
-                /* check that channel matches the right operating channel */
-                if (cbss->channel->center_freq != ht_cfreq) {
-                        /*
-                         * It's possible that some APs are confused here;
-                         * Netgear WNDR3700 sometimes reports 4 higher than
-                         * the actual channel in association responses, but
-                         * since we look at probe response/beacon data here
-                         * it should be OK.
-                         */
+        if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
+            sband->vht_cap.vht_supported) {
+                const u8 *vht_oper_ie;
+
+                vht_oper_ie = ieee80211_bss_get_ie(cbss,
+                                                   WLAN_EID_VHT_OPERATION);
+                if (vht_oper_ie && vht_oper_ie[1] >= sizeof(*vht_oper))
+                        vht_oper = (void *)(vht_oper_ie + 2);
+                if (vht_oper && !ht_oper) {
+                        vht_oper = NULL;
                         sdata_info(sdata,
-                                   "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
-                                   cbss->channel->center_freq,
-                                   ht_cfreq, ht_oper->primary_chan,
-                                   cbss->channel->band);
-                        ht_oper = NULL;
+                                   "AP advertised VHT without HT, disabling both\n");
+                        sdata->flags |= IEEE80211_STA_DISABLE_HT;
+                        sdata->flags |= IEEE80211_STA_DISABLE_VHT;
                 }
         }
 
-        if (ht_oper) {
-                /*
-                 * cfg80211 already verified that the channel itself can
-                 * be used, but it didn't check that we can do the right
-                 * HT type, so do that here as well. If HT40 isn't allowed
-                 * on this channel, disable 40 MHz operation.
-                 */
-                const u8 *ht_cap_ie;
-                const struct ieee80211_ht_cap *ht_cap;
-                u8 chains = 1;
-
-                channel_type = NL80211_CHAN_HT20;
-
-                if (sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
-                        switch (ht_oper->ht_param &
-                                        IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
-                        case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
-                                if (cbss->channel->flags &
-                                                IEEE80211_CHAN_NO_HT40PLUS)
-                                        ifmgd->flags |=
-                                                IEEE80211_STA_DISABLE_40MHZ;
-                                else
-                                        channel_type = NL80211_CHAN_HT40PLUS;
-                                break;
-                        case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
-                                if (cbss->channel->flags &
-                                                IEEE80211_CHAN_NO_HT40MINUS)
-                                        ifmgd->flags |=
-                                                IEEE80211_STA_DISABLE_40MHZ;
-                                else
-                                        channel_type = NL80211_CHAN_HT40MINUS;
-                                break;
-                        }
-                }
+        ifmgd->flags |= ieee80211_determine_chantype(sdata, sband,
+                                                     cbss->channel,
+                                                     ht_oper, vht_oper,
+                                                     &chandef);
 
-                ht_cap_ie = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY,
-                                             cbss->information_elements,
-                                             cbss->len_information_elements);
-                if (ht_cap_ie && ht_cap_ie[1] >= sizeof(*ht_cap)) {
-                        ht_cap = (void *)(ht_cap_ie + 2);
-                        chains = ieee80211_mcs_to_chains(&ht_cap->mcs);
-                }
-                sdata->needed_rx_chains = min(chains, local->rx_chains);
-        } else {
-                sdata->needed_rx_chains = 1;
-                sdata->u.mgd.flags |= IEEE80211_STA_DISABLE_HT;
-        }
+        sdata->needed_rx_chains = min(ieee80211_ht_vht_rx_chains(sdata, cbss),
+                                      local->rx_chains);
+
+        rcu_read_unlock();
 
         /* will change later if needed */
         sdata->smps_mode = IEEE80211_SMPS_OFF;
 
-        ieee80211_vif_release_channel(sdata);
-        cfg80211_chandef_create(&chandef, cbss->channel, channel_type);
-        return ieee80211_vif_use_channel(sdata, &chandef,
-                                         IEEE80211_CHANCTX_SHARED);
+        /*
+         * If this fails (possibly due to channel context sharing
+         * on incompatible channels, e.g. 80+80 and 160 sharing the
+         * same control channel) try to use a smaller bandwidth.
+         */
+        ret = ieee80211_vif_use_channel(sdata, &chandef,
+                                        IEEE80211_CHANCTX_SHARED);
+        while (ret && chandef.width != NL80211_CHAN_WIDTH_20_NOHT)
+                ifmgd->flags |= chandef_downgrade(&chandef);
+        return ret;
 }
 
 static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
@@ -3510,14 +3747,21 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
         const u8 *ssidie, *ht_ie;
         int i, err;
 
-        ssidie = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
-        if (!ssidie)
-                return -EINVAL;
-
         assoc_data = kzalloc(sizeof(*assoc_data) + req->ie_len, GFP_KERNEL);
         if (!assoc_data)
                 return -ENOMEM;
 
+        rcu_read_lock();
+        ssidie = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
+        if (!ssidie) {
+                rcu_read_unlock();
+                kfree(assoc_data);
+                return -EINVAL;
+        }
+        memcpy(assoc_data->ssid, ssidie + 2, ssidie[1]);
+        assoc_data->ssid_len = ssidie[1];
+        rcu_read_unlock();
+
         mutex_lock(&ifmgd->mtx);
 
         if (ifmgd->associated)
@@ -3612,12 +3856,14 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
         assoc_data->supp_rates = bss->supp_rates;
         assoc_data->supp_rates_len = bss->supp_rates_len;
 
+        rcu_read_lock();
         ht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_HT_OPERATION);
         if (ht_ie && ht_ie[1] >= sizeof(struct ieee80211_ht_operation))
                 assoc_data->ap_ht_param =
                         ((struct ieee80211_ht_operation *)(ht_ie + 2))->ht_param;
         else
                 ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
+        rcu_read_unlock();
 
         if (bss->wmm_used && bss->uapsd_supported &&
             (sdata->local->hw.flags & IEEE80211_HW_SUPPORTS_UAPSD)) {
@@ -3628,9 +3874,6 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
                 ifmgd->flags &= ~IEEE80211_STA_UAPSD_ENABLED;
         }
 
-        memcpy(assoc_data->ssid, ssidie + 2, ssidie[1]);
-        assoc_data->ssid_len = ssidie[1];
-
         if (req->prev_bssid)
                 memcpy(assoc_data->prev_bssid, req->prev_bssid, ETH_ALEN);
 
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index fb1d4aa65e8c..9f9c453bc45d 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -389,9 +389,9 @@ minstrel_ht_tx_status(void *priv, struct ieee80211_supported_band *sband,
         struct ieee80211_tx_rate *ar = info->status.rates;
         struct minstrel_rate_stats *rate, *rate2;
         struct minstrel_priv *mp = priv;
-        bool last = false;
+        bool last;
         int group;
-        int i = 0;
+        int i;
 
         if (!msp->is_ht)
                 return mac80211_minstrel.tx_status(priv, sband, sta, &msp->legacy, skb);
@@ -419,13 +419,11 @@ minstrel_ht_tx_status(void *priv, struct ieee80211_supported_band *sband,
         if (info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE)
                 mi->sample_packets += info->status.ampdu_len;
 
+        last = !minstrel_ht_txstat_valid(&ar[0]);
         for (i = 0; !last; i++) {
                 last = (i == IEEE80211_TX_MAX_RATES - 1) ||
                        !minstrel_ht_txstat_valid(&ar[i + 1]);
 
-                if (!minstrel_ht_txstat_valid(&ar[i]))
-                        break;
-
                 group = minstrel_ht_get_group_idx(&ar[i]);
                 rate = &mi->groups[group].rates[ar[i].idx % 8];
 
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 825f33cf7bbc..db343fa8033c 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -49,7 +49,7 @@ static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
                         /* driver bug */
                         WARN_ON(1);
                         dev_kfree_skb(skb);
-                        skb = NULL;
+                        return NULL;
                 }
         }
 
@@ -111,6 +111,11 @@ ieee80211_rx_radiotap_space(struct ieee80211_local *local,
                 len += 8;
         }
 
+        if (status->flag & RX_FLAG_VHT) {
+                len = ALIGN(len, 2);
+                len += 12;
+        }
+
         if (status->vendor_radiotap_len) {
                 if (WARN_ON_ONCE(status->vendor_radiotap_align == 0))
                         status->vendor_radiotap_align = 1;
@@ -297,6 +302,41 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
                 *pos++ = 0;
         }
 
+        if (status->flag & RX_FLAG_VHT) {
+                u16 known = local->hw.radiotap_vht_details;
+
+                rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_VHT);
+                /* known field - how to handle 80+80? */
+                if (status->flag & RX_FLAG_80P80MHZ)
+                        known &= ~IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH;
+                put_unaligned_le16(known, pos);
+                pos += 2;
+                /* flags */
+                if (status->flag & RX_FLAG_SHORT_GI)
+                        *pos |= IEEE80211_RADIOTAP_VHT_FLAG_SGI;
+                pos++;
+                /* bandwidth */
+                if (status->flag & RX_FLAG_80MHZ)
+                        *pos++ = 4;
+                else if (status->flag & RX_FLAG_80P80MHZ)
+                        *pos++ = 0; /* marked not known above */
+                else if (status->flag & RX_FLAG_160MHZ)
+                        *pos++ = 11;
+                else if (status->flag & RX_FLAG_40MHZ)
+                        *pos++ = 1;
+                else /* 20 MHz */
+                        *pos++ = 0;
+                /* MCS/NSS */
+                *pos = (status->rate_idx << 4) | status->vht_nss;
+                pos += 4;
+                /* coding field */
+                pos++;
+                /* group ID */
+                pos++;
+                /* partial_aid */
+                pos += 2;
+        }
+
         if (status->vendor_radiotap_len) {
                 /* ensure 2 byte alignment for the vendor field as required */
                 if ((pos - (u8 *)rthdr) & 1)
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index f3340279aba3..f7176ac5a535 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -247,6 +247,7 @@ static bool ieee80211_prep_hw_scan(struct ieee80211_local *local)
         local->hw_scan_req->n_channels = n_chans;
 
         ielen = ieee80211_build_preq_ies(local, (u8 *)local->hw_scan_req->ie,
+                                         local->hw_scan_ies_bufsize,
                                          req->ie, req->ie_len, band,
                                          req->rates[band], 0);
         local->hw_scan_req->ie_len = ielen;
@@ -445,11 +446,13 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
         if (local->ops->hw_scan) {
                 u8 *ies;
 
+                local->hw_scan_ies_bufsize = 2 + IEEE80211_MAX_SSID_LEN +
+                                             local->scan_ies_len +
+                                             req->ie_len;
                 local->hw_scan_req = kmalloc(
                                 sizeof(*local->hw_scan_req) +
                                 req->n_channels * sizeof(req->channels[0]) +
-                                2 + IEEE80211_MAX_SSID_LEN + local->scan_ies_len +
-                                req->ie_len, GFP_KERNEL);
+                                local->hw_scan_ies_bufsize, GFP_KERNEL);
                 if (!local->hw_scan_req)
                         return -ENOMEM;
 
@@ -928,7 +931,10 @@ int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_sched_scan_ies sched_scan_ies = {};
-        int ret, i;
+        int ret, i, iebufsz;
+
+        iebufsz = 2 + IEEE80211_MAX_SSID_LEN +
+                  local->scan_ies_len + req->ie_len;
 
         mutex_lock(&local->mtx);
 
@@ -946,10 +952,7 @@ int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
                 if (!local->hw.wiphy->bands[i])
                         continue;
 
-                sched_scan_ies.ie[i] = kzalloc(2 + IEEE80211_MAX_SSID_LEN +
-                                               local->scan_ies_len +
-                                               req->ie_len,
-                                               GFP_KERNEL);
+                sched_scan_ies.ie[i] = kzalloc(iebufsz, GFP_KERNEL);
                 if (!sched_scan_ies.ie[i]) {
                         ret = -ENOMEM;
                         goto out_free;
@@ -957,8 +960,8 @@ int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
 
                 sched_scan_ies.len[i] =
                         ieee80211_build_preq_ies(local, sched_scan_ies.ie[i],
-                                                 req->ie, req->ie_len, i,
-                                                 (u32) -1, 0);
+                                                 iebufsz, req->ie, req->ie_len,
+                                                 i, (u32) -1, 0);
         }
 
         ret = drv_sched_scan_start(local, sdata, req, &sched_scan_ies);
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 6835cea4e402..1489bca9ea97 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -250,6 +250,7 @@ struct sta_ampdu_mlme {
  * @rx_dropped: number of dropped MPDUs from this STA
  * @last_signal: signal of last received frame from this STA
  * @avg_signal: moving average of signal of received frames from this STA
+ * @last_ack_signal: signal of last received Ack frame from this STA
  * @last_seq_ctrl: last received seq/frag number from this STA (per RX queue)
  * @tx_filtered_count: number of frames the hardware filtered for this STA
  * @tx_retry_failed: number of frames that failed retry
@@ -329,6 +330,7 @@ struct sta_info {
         unsigned long rx_dropped;
         int last_signal;
         struct ewma avg_signal;
+        int last_ack_signal;
         /* Plus 1 for non-QoS frames */
         __le16 last_seq_ctrl[IEEE80211_NUM_TIDS + 1];
 
@@ -552,6 +554,8 @@ int sta_info_flush(struct ieee80211_local *local,
 void sta_set_rate_info_tx(struct sta_info *sta,
                           const struct ieee80211_tx_rate *rate,
                           struct rate_info *rinfo);
+void sta_set_rate_info_rx(struct sta_info *sta,
+                          struct rate_info *rinfo);
 void ieee80211_sta_expire(struct ieee80211_sub_if_data *sdata,
                           unsigned long exp_time);
 
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index ab63237107c8..ab50285fcbab 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -539,6 +539,9 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                                 sta->lost_packets = 0;
                         }
                 }
+
+                if (acked)
+                        sta->last_ack_signal = info->status.ack_signal;
         }
 
         rcu_read_unlock();
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index d287a4f2c01b..e9eadc40c09c 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -2623,7 +2623,7 @@ EXPORT_SYMBOL(ieee80211_nullfunc_get);
 struct sk_buff *ieee80211_probereq_get(struct ieee80211_hw *hw,
                                        struct ieee80211_vif *vif,
                                        const u8 *ssid, size_t ssid_len,
-                                       const u8 *ie, size_t ie_len)
+                                       size_t tailroom)
 {
         struct ieee80211_sub_if_data *sdata;
         struct ieee80211_local *local;
@@ -2637,7 +2637,7 @@ struct sk_buff *ieee80211_probereq_get(struct ieee80211_hw *hw,
         ie_ssid_len = 2 + ssid_len;
 
         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*hdr) +
-                            ie_ssid_len + ie_len);
+                            ie_ssid_len + tailroom);
         if (!skb)
                 return NULL;
 
@@ -2658,11 +2658,6 @@ struct sk_buff *ieee80211_probereq_get(struct ieee80211_hw *hw,
                 memcpy(pos, ssid, ssid_len);
         pos += ssid_len;
 
-        if (ie) {
-                pos = skb_put(skb, ie_len);
-                memcpy(pos, ie, ie_len);
-        }
-
         return skb;
 }
 EXPORT_SYMBOL(ieee80211_probereq_get);
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 08132ff98155..f11e8c540db4 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1107,12 +1107,12 @@ void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
 }
 
 int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
-                             const u8 *ie, size_t ie_len,
+                             size_t buffer_len, const u8 *ie, size_t ie_len,
                              enum ieee80211_band band, u32 rate_mask,
                              u8 channel)
 {
         struct ieee80211_supported_band *sband;
-        u8 *pos;
+        u8 *pos = buffer, *end = buffer + buffer_len;
         size_t offset = 0, noffset;
         int supp_rates_len, i;
         u8 rates[32];
@@ -1123,8 +1123,6 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
         if (WARN_ON_ONCE(!sband))
                 return 0;
 
-        pos = buffer;
-
         num_rates = 0;
         for (i = 0; i < sband->n_bitrates; i++) {
                 if ((BIT(i) & rate_mask) == 0)
@@ -1134,6 +1132,8 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
 
         supp_rates_len = min_t(int, num_rates, 8);
 
+        if (end - pos < 2 + supp_rates_len)
+                goto out_err;
         *pos++ = WLAN_EID_SUPP_RATES;
         *pos++ = supp_rates_len;
         memcpy(pos, rates, supp_rates_len);
@@ -1150,6 +1150,8 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
                                              before_extrates,
                                              ARRAY_SIZE(before_extrates),
                                              offset);
+                if (end - pos < noffset - offset)
+                        goto out_err;
                 memcpy(pos, ie + offset, noffset - offset);
                 pos += noffset - offset;
                 offset = noffset;
@@ -1157,6 +1159,8 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
 
         ext_rates_len = num_rates - supp_rates_len;
         if (ext_rates_len > 0) {
+                if (end - pos < 2 + ext_rates_len)
+                        goto out_err;
                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
                 *pos++ = ext_rates_len;
                 memcpy(pos, rates + supp_rates_len, ext_rates_len);
@@ -1164,6 +1168,8 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
         }
 
         if (channel && sband->band == IEEE80211_BAND_2GHZ) {
+                if (end - pos < 3)
+                        goto out_err;
                 *pos++ = WLAN_EID_DS_PARAMS;
                 *pos++ = 1;
                 *pos++ = channel;
@@ -1182,14 +1188,19 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
                 noffset = ieee80211_ie_split(ie, ie_len,
                                              before_ht, ARRAY_SIZE(before_ht),
                                              offset);
+                if (end - pos < noffset - offset)
+                        goto out_err;
                 memcpy(pos, ie + offset, noffset - offset);
                 pos += noffset - offset;
                 offset = noffset;
         }
 
-        if (sband->ht_cap.ht_supported)
+        if (sband->ht_cap.ht_supported) {
+                if (end - pos < 2 + sizeof(struct ieee80211_ht_cap))
+                        goto out_err;
                 pos = ieee80211_ie_build_ht_cap(pos, &sband->ht_cap,
                                                 sband->ht_cap.cap);
+        }
 
         /*
          * If adding more here, adjust code in main.c
@@ -1199,15 +1210,23 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
         /* add any remaining custom IEs */
         if (ie && ie_len) {
                 noffset = ie_len;
+                if (end - pos < noffset - offset)
+                        goto out_err;
                 memcpy(pos, ie + offset, noffset - offset);
                 pos += noffset - offset;
         }
 
-        if (sband->vht_cap.vht_supported)
+        if (sband->vht_cap.vht_supported) {
+                if (end - pos < 2 + sizeof(struct ieee80211_vht_cap))
+                        goto out_err;
                 pos = ieee80211_ie_build_vht_cap(pos, &sband->vht_cap,
                                                  sband->vht_cap.cap);
+        }
 
         return pos - buffer;
+ out_err:
+        WARN_ONCE(1, "not enough space for preq IEs\n");
+        return pos - buffer;
 }
 
 struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
@@ -1220,14 +1239,8 @@ struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb;
         struct ieee80211_mgmt *mgmt;
-        size_t buf_len;
-        u8 *buf;
         u8 chan_no;
-
-        /* FIXME: come up with a proper value */
-        buf = kmalloc(200 + ie_len, GFP_KERNEL);
-        if (!buf)
-                return NULL;
+        int ies_len;
 
         /*
          * Do not send DS Channel parameter for directed probe requests
@@ -1239,14 +1252,16 @@ struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
         else
                 chan_no = ieee80211_frequency_to_channel(chan->center_freq);
 
-        buf_len = ieee80211_build_preq_ies(local, buf, ie, ie_len, chan->band,
-                                           ratemask, chan_no);
-
         skb = ieee80211_probereq_get(&local->hw, &sdata->vif,
-                                     ssid, ssid_len,
-                                     buf, buf_len);
+                                     ssid, ssid_len, 100 + ie_len);
         if (!skb)
-                goto out;
+                return NULL;
+
+        ies_len = ieee80211_build_preq_ies(local, skb_tail_pointer(skb),
+                                           skb_tailroom(skb),
+                                           ie, ie_len, chan->band,
+                                           ratemask, chan_no);
+        skb_put(skb, ies_len);
 
         if (dst) {
                 mgmt = (struct ieee80211_mgmt *) skb->data;
@@ -1256,9 +1271,6 @@ struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
 
         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
 
- out:
-        kfree(buf);
-
         return skb;
 }
 
@@ -1527,7 +1539,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                         changed |= BSS_CHANGED_IBSS;
                         /* fall through */
                 case NL80211_IFTYPE_AP:
-                        changed |= BSS_CHANGED_SSID;
+                        changed |= BSS_CHANGED_SSID | BSS_CHANGED_P2P_PS;
 
                         if (sdata->vif.type == NL80211_IFTYPE_AP) {
                                 changed |= BSS_CHANGED_AP_PROBE_RESP;