Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem

Conflicts:
	drivers/net/wireless/iwlwifi/dvm/tx.c
	drivers/net/wireless/ti/wlcore/sdio.c
	drivers/net/wireless/ti/wlcore/spi.c

189 files changed, 12384 insertions, 3233 deletions

diff --git a/arch/arm/mach-omap2/board-omap3evm.c b/arch/arm/mach-omap2/board-omap3evm.c
index 3985f35aee06..a4ca63ba7faa 100644
--- a/arch/arm/mach-omap2/board-omap3evm.c
+++ b/arch/arm/mach-omap2/board-omap3evm.c
@@ -309,7 +309,7 @@ static struct omap2_hsmmc_info mmc[] = {
                 .gpio_wp        = 63,
                 .deferred       = true,
         },
-#ifdef CONFIG_WL12XX_PLATFORM_DATA
+#ifdef CONFIG_WILINK_PLATFORM_DATA
         {
                 .name           = "wl1271",
                 .mmc            = 2,
@@ -450,7 +450,7 @@ static struct regulator_init_data omap3evm_vio = {
         .consumer_supplies      = omap3evm_vio_supply,
 };
 
-#ifdef CONFIG_WL12XX_PLATFORM_DATA
+#ifdef CONFIG_WILINK_PLATFORM_DATA
 
 #define OMAP3EVM_WLAN_PMENA_GPIO        (150)
 #define OMAP3EVM_WLAN_IRQ_GPIO          (149)
@@ -563,7 +563,7 @@ static struct omap_board_mux omap35x_board_mux[] __initdata = {
                                 OMAP_PIN_OFF_NONE),
         OMAP3_MUX(GPMC_WAIT2, OMAP_MUX_MODE4 | OMAP_PIN_INPUT_PULLUP |
                                 OMAP_PIN_OFF_NONE),
-#ifdef CONFIG_WL12XX_PLATFORM_DATA
+#ifdef CONFIG_WILINK_PLATFORM_DATA
         /* WLAN IRQ - GPIO 149 */
         OMAP3_MUX(UART1_RTS, OMAP_MUX_MODE4 | OMAP_PIN_INPUT),
 
@@ -601,7 +601,7 @@ static struct omap_board_mux omap36x_board_mux[] __initdata = {
         OMAP3_MUX(SYS_BOOT4, OMAP_MUX_MODE3 | OMAP_PIN_OFF_NONE),
         OMAP3_MUX(SYS_BOOT5, OMAP_MUX_MODE3 | OMAP_PIN_OFF_NONE),
         OMAP3_MUX(SYS_BOOT6, OMAP_MUX_MODE3 | OMAP_PIN_OFF_NONE),
-#ifdef CONFIG_WL12XX_PLATFORM_DATA
+#ifdef CONFIG_WILINK_PLATFORM_DATA
         /* WLAN IRQ - GPIO 149 */
         OMAP3_MUX(UART1_RTS, OMAP_MUX_MODE4 | OMAP_PIN_INPUT),
 
@@ -637,7 +637,7 @@ static struct gpio omap3_evm_ehci_gpios[] __initdata = {
 
 static void __init omap3_evm_wl12xx_init(void)
 {
-#ifdef CONFIG_WL12XX_PLATFORM_DATA
+#ifdef CONFIG_WILINK_PLATFORM_DATA
         int ret;
 
         /* WL12xx WLAN Init */
diff --git a/drivers/net/wireless/ath/ath5k/phy.c b/drivers/net/wireless/ath/ath5k/phy.c
index ab363f34b4df..a78afa98c650 100644
--- a/drivers/net/wireless/ath/ath5k/phy.c
+++ b/drivers/net/wireless/ath/ath5k/phy.c
@@ -1613,6 +1613,10 @@ ath5k_hw_update_noise_floor(struct ath5k_hw *ah)
         ah->ah_cal_mask |= AR5K_CALIBRATION_NF;
 
         ee_mode = ath5k_eeprom_mode_from_channel(ah->ah_current_channel);
+        if (WARN_ON(ee_mode < 0)) {
+                ah->ah_cal_mask &= ~AR5K_CALIBRATION_NF;
+                return;
+        }
 
         /* completed NF calibration, test threshold */
         nf = ath5k_hw_read_measured_noise_floor(ah);
diff --git a/drivers/net/wireless/ath/ath5k/reset.c b/drivers/net/wireless/ath/ath5k/reset.c
index 4084b1076286..e2d8b2cf19eb 100644
--- a/drivers/net/wireless/ath/ath5k/reset.c
+++ b/drivers/net/wireless/ath/ath5k/reset.c
@@ -985,6 +985,8 @@ ath5k_hw_commit_eeprom_settings(struct ath5k_hw *ah,
                 return;
 
         ee_mode = ath5k_eeprom_mode_from_channel(channel);
+        if (WARN_ON(ee_mode < 0))
+                return;
 
         /* Adjust power delta for channel 14 */
         if (channel->center_freq == 2484)
diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c
index 4225cca0f198..752ffc4f4166 100644
--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
+++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
@@ -427,6 +427,30 @@ static bool ath6kl_is_tx_pending(struct ath6kl *ar)
         return ar->tx_pending[ath6kl_wmi_get_control_ep(ar->wmi)] == 0;
 }
 
+static void ath6kl_cfg80211_sta_bmiss_enhance(struct ath6kl_vif *vif,
+                                              bool enable)
+{
+        int err;
+
+        if (WARN_ON(!test_bit(WMI_READY, &vif->ar->flag)))
+                return;
+
+        if (vif->nw_type != INFRA_NETWORK)
+                return;
+
+        if (!test_bit(ATH6KL_FW_CAPABILITY_BMISS_ENHANCE,
+                      vif->ar->fw_capabilities))
+                return;
+
+        ath6kl_dbg(ATH6KL_DBG_WLAN_CFG, "%s fw bmiss enhance\n",
+                   enable ? "enable" : "disable");
+
+        err = ath6kl_wmi_sta_bmiss_enhance_cmd(vif->ar->wmi,
+                                               vif->fw_vif_idx, enable);
+        if (err)
+                ath6kl_err("failed to %s enhanced bmiss detection: %d\n",
+                           enable ? "enable" : "disable", err);
+}
 
 static int ath6kl_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
                                    struct cfg80211_connect_params *sme)
@@ -616,13 +640,13 @@ static int ath6kl_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
                                         vif->req_bssid, vif->ch_hint,
                                         ar->connect_ctrl_flags, nw_subtype);
 
-        /* disable background scan if period is 0 */
-        if (sme->bg_scan_period == 0)
+        if (sme->bg_scan_period == 0) {
+                /* disable background scan if period is 0 */
                 sme->bg_scan_period = 0xffff;
-
-        /* configure default value if not specified */
-        if (sme->bg_scan_period == -1)
+        } else if (sme->bg_scan_period == -1) {
+                /* configure default value if not specified */
                 sme->bg_scan_period = DEFAULT_BG_SCAN_PERIOD;
+        }
 
         ath6kl_wmi_scanparams_cmd(ar->wmi, vif->fw_vif_idx, 0, 0,
                                   sme->bg_scan_period, 0, 0, 0, 3, 0, 0, 0);
@@ -767,7 +791,7 @@ void ath6kl_cfg80211_connect_event(struct ath6kl_vif *vif, u16 channel,
                 ath6kl_dbg(ATH6KL_DBG_WLAN_CFG, "ad-hoc %s selected\n",
                            nw_type & ADHOC_CREATOR ? "creator" : "joiner");
                 cfg80211_ibss_joined(vif->ndev, bssid, GFP_KERNEL);
-                cfg80211_put_bss(bss);
+                cfg80211_put_bss(ar->wiphy, bss);
                 return;
         }
 
@@ -778,7 +802,7 @@ void ath6kl_cfg80211_connect_event(struct ath6kl_vif *vif, u16 channel,
                                         assoc_req_ie, assoc_req_len,
                                         assoc_resp_ie, assoc_resp_len,
                                         WLAN_STATUS_SUCCESS, GFP_KERNEL);
-                cfg80211_put_bss(bss);
+                cfg80211_put_bss(ar->wiphy, bss);
         } else if (vif->sme_state == SME_CONNECTED) {
                 /* inform roam event to cfg80211 */
                 cfg80211_roamed_bss(vif->ndev, bss, assoc_req_ie, assoc_req_len,
@@ -1454,10 +1478,10 @@ static int ath6kl_cfg80211_set_power_mgmt(struct wiphy *wiphy,
                 return -EIO;
 
         if (pmgmt) {
-                ath6kl_dbg(ATH6KL_DBG_WLAN_CFG, "%s: max perf\n", __func__);
+                ath6kl_dbg(ATH6KL_DBG_WLAN_CFG, "%s: rec power\n", __func__);
                 mode.pwr_mode = REC_POWER;
         } else {
-                ath6kl_dbg(ATH6KL_DBG_WLAN_CFG, "%s: rec power\n", __func__);
+                ath6kl_dbg(ATH6KL_DBG_WLAN_CFG, "%s: max perf\n", __func__);
                 mode.pwr_mode = MAX_PERF_POWER;
         }
 
@@ -1509,7 +1533,7 @@ static int ath6kl_cfg80211_del_iface(struct wiphy *wiphy,
         list_del(&vif->list);
         spin_unlock_bh(&ar->list_lock);
 
-        ath6kl_cleanup_vif(vif, test_bit(WMI_READY, &ar->flag));
+        ath6kl_cfg80211_vif_stop(vif, test_bit(WMI_READY, &ar->flag));
 
         ath6kl_cfg80211_vif_cleanup(vif);
 
@@ -1559,17 +1583,13 @@ static int ath6kl_cfg80211_change_iface(struct wiphy *wiphy,
 set_iface_type:
         switch (type) {
         case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_P2P_CLIENT:
                 vif->next_mode = INFRA_NETWORK;
                 break;
         case NL80211_IFTYPE_ADHOC:
                 vif->next_mode = ADHOC_NETWORK;
                 break;
         case NL80211_IFTYPE_AP:
-                vif->next_mode = AP_NETWORK;
-                break;
-        case NL80211_IFTYPE_P2P_CLIENT:
-                vif->next_mode = INFRA_NETWORK;
-                break;
         case NL80211_IFTYPE_P2P_GO:
                 vif->next_mode = AP_NETWORK;
                 break;
@@ -1778,14 +1798,14 @@ static int ath6kl_get_station(struct wiphy *wiphy, struct net_device *dev,
 
         if (vif->target_stats.rx_byte) {
                 sinfo->rx_bytes = vif->target_stats.rx_byte;
-                sinfo->filled |= STATION_INFO_RX_BYTES;
+                sinfo->filled |= STATION_INFO_RX_BYTES64;
                 sinfo->rx_packets = vif->target_stats.rx_pkt;
                 sinfo->filled |= STATION_INFO_RX_PACKETS;
         }
 
         if (vif->target_stats.tx_byte) {
                 sinfo->tx_bytes = vif->target_stats.tx_byte;
-                sinfo->filled |= STATION_INFO_TX_BYTES;
+                sinfo->filled |= STATION_INFO_TX_BYTES64;
                 sinfo->tx_packets = vif->target_stats.tx_pkt;
                 sinfo->filled |= STATION_INFO_TX_PACKETS;
         }
@@ -2673,30 +2693,6 @@ static int ath6kl_set_ies(struct ath6kl_vif *vif,
         return 0;
 }
 
-void ath6kl_cfg80211_sta_bmiss_enhance(struct ath6kl_vif *vif, bool enable)
-{
-        int err;
-
-        if (WARN_ON(!test_bit(WMI_READY, &vif->ar->flag)))
-                return;
-
-        if (vif->nw_type != INFRA_NETWORK)
-                return;
-
-        if (!test_bit(ATH6KL_FW_CAPABILITY_BMISS_ENHANCE,
-                      vif->ar->fw_capabilities))
-                return;
-
-        ath6kl_dbg(ATH6KL_DBG_WLAN_CFG, "%s fw bmiss enhance\n",
-                   enable ? "enable" : "disable");
-
-        err = ath6kl_wmi_sta_bmiss_enhance_cmd(vif->ar->wmi,
-                                               vif->fw_vif_idx, enable);
-        if (err)
-                ath6kl_err("failed to %s enhanced bmiss detection: %d\n",
-                           enable ? "enable" : "disable", err);
-}
-
 static int ath6kl_get_rsn_capab(struct cfg80211_beacon_data *beacon,
                                 u8 *rsn_capab)
 {
@@ -2776,9 +2772,11 @@ static int ath6kl_start_ap(struct wiphy *wiphy, struct net_device *dev,
 
         ar->ap_mode_bkey.valid = false;
 
-        /* TODO:
-         * info->interval
-         */
+        ret = ath6kl_wmi_ap_set_beacon_intvl_cmd(ar->wmi, vif->fw_vif_idx,
+                                                 info->beacon_interval);
+
+        if (ret)
+                ath6kl_warn("Failed to set beacon interval: %d\n", ret);
 
         ret = ath6kl_wmi_ap_set_dtim_cmd(ar->wmi, vif->fw_vif_idx,
                                          info->dtim_period);
@@ -3557,6 +3555,37 @@ static int ath6kl_cfg80211_vif_init(struct ath6kl_vif *vif)
         return 0;
 }
 
+void ath6kl_cfg80211_vif_stop(struct ath6kl_vif *vif, bool wmi_ready)
+{
+        static u8 bcast_mac[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+        bool discon_issued;
+
+        netif_stop_queue(vif->ndev);
+
+        clear_bit(WLAN_ENABLED, &vif->flags);
+
+        if (wmi_ready) {
+                discon_issued = test_bit(CONNECTED, &vif->flags) ||
+                                test_bit(CONNECT_PEND, &vif->flags);
+                ath6kl_disconnect(vif);
+                del_timer(&vif->disconnect_timer);
+
+                if (discon_issued)
+                        ath6kl_disconnect_event(vif, DISCONNECT_CMD,
+                                                (vif->nw_type & AP_NETWORK) ?
+                                                bcast_mac : vif->bssid,
+                                                0, NULL, 0);
+        }
+
+        if (vif->scan_req) {
+                cfg80211_scan_done(vif->scan_req, true);
+                vif->scan_req = NULL;
+        }
+
+        /* need to clean up enhanced bmiss detection fw state */
+        ath6kl_cfg80211_sta_bmiss_enhance(vif, false);
+}
+
 void ath6kl_cfg80211_vif_cleanup(struct ath6kl_vif *vif)
 {
         struct ath6kl *ar = vif->ar;
diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.h b/drivers/net/wireless/ath/ath6kl/cfg80211.h
index e5e70f3a8ca8..b59becd91aea 100644
--- a/drivers/net/wireless/ath/ath6kl/cfg80211.h
+++ b/drivers/net/wireless/ath/ath6kl/cfg80211.h
@@ -61,7 +61,5 @@ void ath6kl_cfg80211_cleanup(struct ath6kl *ar);
 
 struct ath6kl *ath6kl_cfg80211_create(void);
 void ath6kl_cfg80211_destroy(struct ath6kl *ar);
-/* TODO: remove this once ath6kl_vif_cleanup() is moved to cfg80211.c */
-void ath6kl_cfg80211_sta_bmiss_enhance(struct ath6kl_vif *vif, bool enable);
 
 #endif /* ATH6KL_CFG80211_H */
diff --git a/drivers/net/wireless/ath/ath6kl/core.h b/drivers/net/wireless/ath/ath6kl/core.h
index 189d8faf8c87..61b2f98b4e77 100644
--- a/drivers/net/wireless/ath/ath6kl/core.h
+++ b/drivers/net/wireless/ath/ath6kl/core.h
@@ -940,7 +940,7 @@ void ath6kl_reset_device(struct ath6kl *ar, u32 target_type,
                          bool wait_fot_compltn, bool cold_reset);
 void ath6kl_init_control_info(struct ath6kl_vif *vif);
 struct ath6kl_vif *ath6kl_vif_first(struct ath6kl *ar);
-void ath6kl_cleanup_vif(struct ath6kl_vif *vif, bool wmi_ready);
+void ath6kl_cfg80211_vif_stop(struct ath6kl_vif *vif, bool wmi_ready);
 int ath6kl_init_hw_start(struct ath6kl *ar);
 int ath6kl_init_hw_stop(struct ath6kl *ar);
 int ath6kl_init_fetch_firmwares(struct ath6kl *ar);
diff --git a/drivers/net/wireless/ath/ath6kl/htc_pipe.c b/drivers/net/wireless/ath/ath6kl/htc_pipe.c
index ba6bd497b787..281390178e3d 100644
--- a/drivers/net/wireless/ath/ath6kl/htc_pipe.c
+++ b/drivers/net/wireless/ath/ath6kl/htc_pipe.c
@@ -509,9 +509,7 @@ static void destroy_htc_txctrl_packet(struct htc_packet *packet)
 {
         struct sk_buff *skb;
         skb = packet->skb;
-        if (skb != NULL)
-                dev_kfree_skb(skb);
-
+        dev_kfree_skb(skb);
         kfree(packet);
 }
 
@@ -969,6 +967,22 @@ static int ath6kl_htc_pipe_rx_complete(struct ath6kl *ar, struct sk_buff *skb,
         u16 payload_len;
         int status = 0;
 
+        /*
+         * ar->htc_target can be NULL due to a race condition that can occur
+         * during driver initialization(we do 'ath6kl_hif_power_on' before
+         * initializing 'ar->htc_target' via 'ath6kl_htc_create').
+         * 'ath6kl_hif_power_on' assigns 'ath6kl_recv_complete' as
+         * usb_complete_t/callback function for 'usb_fill_bulk_urb'.
+         * Thus the possibility of ar->htc_target being NULL
+         * via ath6kl_recv_complete -> ath6kl_usb_io_comp_work.
+         */
+        if (WARN_ON_ONCE(!target)) {
+                ath6kl_err("Target not yet initialized\n");
+                status = -EINVAL;
+                goto free_skb;
+        }
+
+
         netdata = skb->data;
         netlen = skb->len;
 
@@ -1054,6 +1068,7 @@ static int ath6kl_htc_pipe_rx_complete(struct ath6kl *ar, struct sk_buff *skb,
 
                 dev_kfree_skb(skb);
                 skb = NULL;
+
                 goto free_skb;
         }
 
@@ -1089,8 +1104,7 @@ static int ath6kl_htc_pipe_rx_complete(struct ath6kl *ar, struct sk_buff *skb,
         skb = NULL;
 
 free_skb:
-        if (skb != NULL)
-                dev_kfree_skb(skb);
+        dev_kfree_skb(skb);
 
         return status;
 
@@ -1184,7 +1198,7 @@ static void reset_endpoint_states(struct htc_target *target)
                 INIT_LIST_HEAD(&ep->pipe.tx_lookup_queue);
                 INIT_LIST_HEAD(&ep->rx_bufq);
                 ep->target = target;
-                ep->pipe.tx_credit_flow_enabled = (bool) 1; /* FIXME */
+                ep->pipe.tx_credit_flow_enabled = true;
         }
 }
 
diff --git a/drivers/net/wireless/ath/ath6kl/init.c b/drivers/net/wireless/ath/ath6kl/init.c
index f21fa322e5ca..5d434cf88f35 100644
--- a/drivers/net/wireless/ath/ath6kl/init.c
+++ b/drivers/net/wireless/ath/ath6kl/init.c
@@ -1715,38 +1715,6 @@ void ath6kl_init_hw_restart(struct ath6kl *ar)
         }
 }
 
-/* FIXME: move this to cfg80211.c and rename to ath6kl_cfg80211_vif_stop() */
-void ath6kl_cleanup_vif(struct ath6kl_vif *vif, bool wmi_ready)
-{
-        static u8 bcast_mac[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
-        bool discon_issued;
-
-        netif_stop_queue(vif->ndev);
-
-        clear_bit(WLAN_ENABLED, &vif->flags);
-
-        if (wmi_ready) {
-                discon_issued = test_bit(CONNECTED, &vif->flags) ||
-                                test_bit(CONNECT_PEND, &vif->flags);
-                ath6kl_disconnect(vif);
-                del_timer(&vif->disconnect_timer);
-
-                if (discon_issued)
-                        ath6kl_disconnect_event(vif, DISCONNECT_CMD,
-                                                (vif->nw_type & AP_NETWORK) ?
-                                                bcast_mac : vif->bssid,
-                                                0, NULL, 0);
-        }
-
-        if (vif->scan_req) {
-                cfg80211_scan_done(vif->scan_req, true);
-                vif->scan_req = NULL;
-        }
-
-        /* need to clean up enhanced bmiss detection fw state */
-        ath6kl_cfg80211_sta_bmiss_enhance(vif, false);
-}
-
 void ath6kl_stop_txrx(struct ath6kl *ar)
 {
         struct ath6kl_vif *vif, *tmp_vif;
@@ -1766,7 +1734,7 @@ void ath6kl_stop_txrx(struct ath6kl *ar)
         list_for_each_entry_safe(vif, tmp_vif, &ar->vif_list, list) {
                 list_del(&vif->list);
                 spin_unlock_bh(&ar->list_lock);
-                ath6kl_cleanup_vif(vif, test_bit(WMI_READY, &ar->flag));
+                ath6kl_cfg80211_vif_stop(vif, test_bit(WMI_READY, &ar->flag));
                 rtnl_lock();
                 ath6kl_cfg80211_vif_cleanup(vif);
                 rtnl_unlock();
@@ -1801,8 +1769,6 @@ void ath6kl_stop_txrx(struct ath6kl *ar)
                    "attempting to reset target on instance destroy\n");
         ath6kl_reset_device(ar, ar->target_type, true, true);
 
-        clear_bit(WLAN_ENABLED, &ar->flag);
-
         up(&ar->sem);
 }
 EXPORT_SYMBOL(ath6kl_stop_txrx);
diff --git a/drivers/net/wireless/ath/ath6kl/usb.c b/drivers/net/wireless/ath/ath6kl/usb.c
index 62bcc0d5bc23..5fcd342762de 100644
--- a/drivers/net/wireless/ath/ath6kl/usb.c
+++ b/drivers/net/wireless/ath/ath6kl/usb.c
@@ -159,10 +159,8 @@ static void ath6kl_usb_free_urb_to_pipe(struct ath6kl_usb_pipe *pipe,
 
 static void ath6kl_usb_cleanup_recv_urb(struct ath6kl_urb_context *urb_context)
 {
-        if (urb_context->skb != NULL) {
-                dev_kfree_skb(urb_context->skb);
-                urb_context->skb = NULL;
-        }
+        dev_kfree_skb(urb_context->skb);
+        urb_context->skb = NULL;
 
         ath6kl_usb_free_urb_to_pipe(urb_context->pipe, urb_context);
 }
diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c
index 998f8b0f62fd..d76b5bd81a0d 100644
--- a/drivers/net/wireless/ath/ath6kl/wmi.c
+++ b/drivers/net/wireless/ath/ath6kl/wmi.c
@@ -751,6 +751,23 @@ int ath6kl_wmi_force_roam_cmd(struct wmi *wmi, const u8 *bssid)
                                    NO_SYNC_WMIFLAG);
 }
 
+int ath6kl_wmi_ap_set_beacon_intvl_cmd(struct wmi *wmi, u8 if_idx,
+                                       u32 beacon_intvl)
+{
+        struct sk_buff *skb;
+        struct set_beacon_int_cmd *cmd;
+
+        skb = ath6kl_wmi_get_new_buf(sizeof(*cmd));
+        if (!skb)
+                return -ENOMEM;
+
+        cmd = (struct set_beacon_int_cmd *) skb->data;
+
+        cmd->beacon_intvl = cpu_to_le32(beacon_intvl);
+        return ath6kl_wmi_cmd_send(wmi, if_idx, skb,
+                                   WMI_SET_BEACON_INT_CMDID, NO_SYNC_WMIFLAG);
+}
+
 int ath6kl_wmi_ap_set_dtim_cmd(struct wmi *wmi, u8 if_idx, u32 dtim_period)
 {
         struct sk_buff *skb;
@@ -1108,7 +1125,7 @@ static int ath6kl_wmi_bssinfo_event_rx(struct wmi *wmi, u8 *datap, int len,
         kfree(mgmt);
         if (bss == NULL)
                 return -ENOMEM;
-        cfg80211_put_bss(bss);
+        cfg80211_put_bss(ar->wiphy, bss);
 
         /*
          * Firmware doesn't return any event when scheduled scan has
@@ -2480,16 +2497,11 @@ static int ath6kl_wmi_sync_point(struct wmi *wmi, u8 if_idx)
 
 free_cmd_skb:
         /* free up any resources left over (possibly due to an error) */
-        if (skb)
-                dev_kfree_skb(skb);
+        dev_kfree_skb(skb);
 
 free_data_skb:
-        for (index = 0; index < num_pri_streams; index++) {
-                if (data_sync_bufs[index].skb != NULL) {
-                        dev_kfree_skb((struct sk_buff *)data_sync_bufs[index].
-                                      skb);
-                }
-        }
+        for (index = 0; index < num_pri_streams; index++)
+                dev_kfree_skb((struct sk_buff *)data_sync_bufs[index].skb);
 
         return ret;
 }
diff --git a/drivers/net/wireless/ath/ath6kl/wmi.h b/drivers/net/wireless/ath/ath6kl/wmi.h
index 98b1755e67f4..b5f226503baf 100644
--- a/drivers/net/wireless/ath/ath6kl/wmi.h
+++ b/drivers/net/wireless/ath/ath6kl/wmi.h
@@ -1660,6 +1660,10 @@ struct roam_ctrl_cmd {
         u8 roam_ctrl;
 } __packed;
 
+struct set_beacon_int_cmd {
+        __le32 beacon_intvl;
+} __packed;
+
 struct set_dtim_cmd {
         __le32 dtim_period;
 } __packed;
@@ -2649,6 +2653,8 @@ int ath6kl_wmi_del_wow_pattern_cmd(struct wmi *wmi, u8 if_idx,
 int ath6kl_wmi_set_rssi_filter_cmd(struct wmi *wmi, u8 if_idx, s8 rssi);
 int ath6kl_wmi_set_roam_lrssi_cmd(struct wmi *wmi, u8 lrssi);
 int ath6kl_wmi_ap_set_dtim_cmd(struct wmi *wmi, u8 if_idx, u32 dtim_period);
+int ath6kl_wmi_ap_set_beacon_intvl_cmd(struct wmi *wmi, u8 if_idx,
+                                       u32 beacon_interval);
 int ath6kl_wmi_force_roam_cmd(struct wmi *wmi, const u8 *bssid);
 int ath6kl_wmi_set_roam_mode_cmd(struct wmi *wmi, enum wmi_roam_mode mode);
 int ath6kl_wmi_mcast_filter_cmd(struct wmi *wmi, u8 if_idx, bool mc_all_on);
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 97c90b21e1cb..a56b2416e2f9 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -389,6 +389,7 @@ struct ath_beacon_config {
         u16 bmiss_timeout;
         u8 dtim_count;
         bool enable_beacon;
+        bool ibss_creator;
 };
 
 struct ath_beacon {
diff --git a/drivers/net/wireless/ath/ath9k/beacon.c b/drivers/net/wireless/ath/ath9k/beacon.c
index dd3771954bd7..5f05c26d1ec4 100644
--- a/drivers/net/wireless/ath/ath9k/beacon.c
+++ b/drivers/net/wireless/ath/ath9k/beacon.c
@@ -407,12 +407,17 @@ void ath9k_beacon_tasklet(unsigned long data)
         }
 }
 
-static void ath9k_beacon_init(struct ath_softc *sc, u32 nexttbtt, u32 intval)
+/*
+ * Both nexttbtt and intval have to be in usecs.
+ */
+static void ath9k_beacon_init(struct ath_softc *sc, u32 nexttbtt,
+                              u32 intval, bool reset_tsf)
 {
         struct ath_hw *ah = sc->sc_ah;
 
         ath9k_hw_disable_interrupts(ah);
-        ath9k_hw_reset_tsf(ah);
+        if (reset_tsf)
+                ath9k_hw_reset_tsf(ah);
         ath9k_beaconq_config(sc);
         ath9k_hw_beaconinit(ah, nexttbtt, intval);
         sc->beacon.bmisscnt = 0;
@@ -442,10 +447,12 @@ static void ath9k_beacon_config_ap(struct ath_softc *sc,
         else
                 ah->imask &= ~ATH9K_INT_SWBA;
 
-        ath_dbg(common, BEACON, "AP nexttbtt: %u intval: %u conf_intval: %u\n",
+        ath_dbg(common, BEACON,
+                "AP (%s) nexttbtt: %u intval: %u conf_intval: %u\n",
+                (conf->enable_beacon) ? "Enable" : "Disable",
                 nexttbtt, intval, conf->beacon_interval);
 
-        ath9k_beacon_init(sc, nexttbtt, intval);
+        ath9k_beacon_init(sc, nexttbtt, intval, true);
 }
 
 /*
@@ -586,17 +593,45 @@ static void ath9k_beacon_config_adhoc(struct ath_softc *sc,
         ath9k_reset_beacon_status(sc);
 
         intval = TU_TO_USEC(conf->beacon_interval);
-        nexttbtt = intval;
+
+        if (conf->ibss_creator) {
+                nexttbtt = intval;
+        } else {
+                u32 tbtt, offset, tsftu;
+                u64 tsf;
+
+                /*
+                 * Pull nexttbtt forward to reflect the current
+                 * sync'd TSF.
+                 */
+                tsf = ath9k_hw_gettsf64(ah);
+                tsftu = TSF_TO_TU(tsf >> 32, tsf) + FUDGE;
+                offset = tsftu % conf->beacon_interval;
+                tbtt = tsftu - offset;
+                if (offset)
+                        tbtt += conf->beacon_interval;
+
+                nexttbtt = TU_TO_USEC(tbtt);
+        }
 
         if (conf->enable_beacon)
                 ah->imask |= ATH9K_INT_SWBA;
         else
                 ah->imask &= ~ATH9K_INT_SWBA;
 
-        ath_dbg(common, BEACON, "IBSS nexttbtt: %u intval: %u conf_intval: %u\n",
+        ath_dbg(common, BEACON,
+                "IBSS (%s) nexttbtt: %u intval: %u conf_intval: %u\n",
+                (conf->enable_beacon) ? "Enable" : "Disable",
                 nexttbtt, intval, conf->beacon_interval);
 
-        ath9k_beacon_init(sc, nexttbtt, intval);
+        ath9k_beacon_init(sc, nexttbtt, intval, conf->ibss_creator);
+
+        /*
+         * Set the global 'beacon has been configured' flag for the
+         * joiner case in IBSS mode.
+         */
+        if (!conf->ibss_creator && conf->enable_beacon)
+                set_bit(SC_OP_BEACONS, &sc->sc_flags);
 }
 
 bool ath9k_allow_beacon_config(struct ath_softc *sc, struct ieee80211_vif *vif)
@@ -639,6 +674,7 @@ static void ath9k_cache_beacon_config(struct ath_softc *sc,
         cur_conf->dtim_period = bss_conf->dtim_period;
         cur_conf->listen_interval = 1;
         cur_conf->dtim_count = 1;
+        cur_conf->ibss_creator = bss_conf->ibss_creator;
         cur_conf->bmiss_timeout =
                 ATH_DEFAULT_BMISS_LIMIT * cur_conf->beacon_interval;
 
@@ -666,34 +702,59 @@ void ath9k_beacon_config(struct ath_softc *sc, struct ieee80211_vif *vif,
 {
         struct ieee80211_bss_conf *bss_conf = &vif->bss_conf;
         struct ath_beacon_config *cur_conf = &sc->cur_beacon_conf;
+        unsigned long flags;
+        bool skip_beacon = false;
 
         if (sc->sc_ah->opmode == NL80211_IFTYPE_STATION) {
                 ath9k_cache_beacon_config(sc, bss_conf);
                 ath9k_set_beacon(sc);
                 set_bit(SC_OP_BEACONS, &sc->sc_flags);
-        } else {
-                /*
-                 * Take care of multiple interfaces when
-                 * enabling/disabling SWBA.
-                 */
-                if (changed & BSS_CHANGED_BEACON_ENABLED) {
-                        if (!bss_conf->enable_beacon &&
-                            (sc->nbcnvifs <= 1)) {
-                                cur_conf->enable_beacon = false;
-                        } else if (bss_conf->enable_beacon) {
-                                cur_conf->enable_beacon = true;
-                                ath9k_cache_beacon_config(sc, bss_conf);
-                        }
+                return;
+
+        }
+
+        /*
+         * Take care of multiple interfaces when
+         * enabling/disabling SWBA.
+         */
+        if (changed & BSS_CHANGED_BEACON_ENABLED) {
+                if (!bss_conf->enable_beacon &&
+                    (sc->nbcnvifs <= 1)) {
+                        cur_conf->enable_beacon = false;
+                } else if (bss_conf->enable_beacon) {
+                        cur_conf->enable_beacon = true;
+                        ath9k_cache_beacon_config(sc, bss_conf);
                 }
+        }
 
-                if (cur_conf->beacon_interval) {
+        /*
+         * Configure the HW beacon registers only when we have a valid
+         * beacon interval.
+         */
+        if (cur_conf->beacon_interval) {
+                /*
+                 * If we are joining an existing IBSS network, start beaconing
+                 * only after a TSF-sync has taken place. Ensure that this
+                 * happens by setting the appropriate flags.
+                 */
+                if ((changed & BSS_CHANGED_IBSS) && !bss_conf->ibss_creator &&
+                    bss_conf->enable_beacon) {
+                        spin_lock_irqsave(&sc->sc_pm_lock, flags);
+                        sc->ps_flags |= PS_BEACON_SYNC | PS_WAIT_FOR_BEACON;
+                        spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
+                        skip_beacon = true;
+                } else {
                         ath9k_set_beacon(sc);
-
-                        if (cur_conf->enable_beacon)
-                                set_bit(SC_OP_BEACONS, &sc->sc_flags);
-                        else
-                                clear_bit(SC_OP_BEACONS, &sc->sc_flags);
                 }
+
+                /*
+                 * Do not set the SC_OP_BEACONS flag for IBSS joiner mode
+                 * here, it is done in ath9k_beacon_config_adhoc().
+                 */
+                if (cur_conf->enable_beacon && !skip_beacon)
+                        set_bit(SC_OP_BEACONS, &sc->sc_flags);
+                else
+                        clear_bit(SC_OP_BEACONS, &sc->sc_flags);
         }
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 5432f1247e2e..6e66f9c6782b 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -320,28 +320,25 @@ static void ath_node_attach(struct ath_softc *sc, struct ieee80211_sta *sta,
                             struct ieee80211_vif *vif)
 {
         struct ath_node *an;
-        u8 density;
         an = (struct ath_node *)sta->drv_priv;
 
         an->sc = sc;
         an->sta = sta;
         an->vif = vif;
 
-        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT) {
-                ath_tx_node_init(sc, an);
+        ath_tx_node_init(sc, an);
+
+        if (sta->ht_cap.ht_supported) {
                 an->maxampdu = 1 << (IEEE80211_HT_MAX_AMPDU_FACTOR +
                                      sta->ht_cap.ampdu_factor);
-                density = ath9k_parse_mpdudensity(sta->ht_cap.ampdu_density);
-                an->mpdudensity = density;
+                an->mpdudensity = ath9k_parse_mpdudensity(sta->ht_cap.ampdu_density);
         }
 }
 
 static void ath_node_detach(struct ath_softc *sc, struct ieee80211_sta *sta)
 {
         struct ath_node *an = (struct ath_node *)sta->drv_priv;
-
-        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT)
-                ath_tx_node_cleanup(sc, an);
+        ath_tx_node_cleanup(sc, an);
 }
 
 void ath9k_tasklet(unsigned long data)
diff --git a/drivers/net/wireless/ath/ath9k/rc.c b/drivers/net/wireless/ath/ath9k/rc.c
index faa752b95d5a..96ac433ba7f6 100644
--- a/drivers/net/wireless/ath/ath9k/rc.c
+++ b/drivers/net/wireless/ath/ath9k/rc.c
@@ -1204,7 +1204,7 @@ static u8 ath_rc_build_ht_caps(struct ath_softc *sc, struct ieee80211_sta *sta)
                         caps |= WLAN_RC_TS_FLAG | WLAN_RC_DS_FLAG;
                 else if (sta->ht_cap.mcs.rx_mask[1])
                         caps |= WLAN_RC_DS_FLAG;
-                if (sta->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
+                if (sta->bandwidth >= IEEE80211_STA_RX_BW_40) {
                         caps |= WLAN_RC_40_FLAG;
                         if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40)
                                 caps |= WLAN_RC_SGI_FLAG;
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index 2d0fd17a1917..ee156e543147 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -533,7 +533,7 @@ static void ath_rx_ps_beacon(struct ath_softc *sc, struct sk_buff *skb)
         if (sc->ps_flags & PS_BEACON_SYNC) {
                 sc->ps_flags &= ~PS_BEACON_SYNC;
                 ath_dbg(common, PS,
-                        "Reconfigure Beacon timers based on timestamp from the AP\n");
+                        "Reconfigure beacon timers based on synchronized timestamp\n");
                 ath9k_set_beacon(sc);
         }
 
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index feacaafee959..89a64411b82e 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1233,7 +1233,7 @@ int ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
          * in HT IBSS when a beacon with HT-info is received after the station
          * has already been added.
          */
-        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT) {
+        if (sta->ht_cap.ht_supported) {
                 an->maxampdu = 1 << (IEEE80211_HT_MAX_AMPDU_FACTOR +
                                      sta->ht_cap.ampdu_factor);
                 density = ath9k_parse_mpdudensity(sta->ht_cap.ampdu_density);
@@ -1904,8 +1904,7 @@ static void ath_tx_start_dma(struct ath_softc *sc, struct sk_buff *skb,
         struct ath_buf *bf;
         u8 tidno;
 
-        if ((sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT) && txctl->an &&
-                ieee80211_is_data_qos(hdr->frame_control)) {
+        if (txctl->an && ieee80211_is_data_qos(hdr->frame_control)) {
                 tidno = ieee80211_get_qos_ctl(hdr)[0] &
                         IEEE80211_QOS_CTL_TID_MASK;
                 tid = ATH_AN_2_TID(txctl->an, tidno);
diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c
index ef82751722e0..f293b3ff4756 100644
--- a/drivers/net/wireless/ath/carl9170/main.c
+++ b/drivers/net/wireless/ath/carl9170/main.c
@@ -1853,7 +1853,7 @@ void *carl9170_alloc(size_t priv_size)
                      IEEE80211_HW_REPORTS_TX_ACK_STATUS |
                      IEEE80211_HW_SUPPORTS_PS |
                      IEEE80211_HW_PS_NULLFUNC_STACK |
-                     IEEE80211_HW_NEED_DTIM_PERIOD |
+                     IEEE80211_HW_NEED_DTIM_BEFORE_ASSOC |
                      IEEE80211_HW_SIGNAL_DBM;
 
         if (!modparam_noht) {
diff --git a/drivers/net/wireless/ath/wil6210/cfg80211.c b/drivers/net/wireless/ath/wil6210/cfg80211.c
index 002851fceb2f..9ecc1968262c 100644
--- a/drivers/net/wireless/ath/wil6210/cfg80211.c
+++ b/drivers/net/wireless/ath/wil6210/cfg80211.c
@@ -341,7 +341,7 @@ static int wil_cfg80211_connect(struct wiphy *wiphy,
         }
 
  out:
-        cfg80211_put_bss(bss);
+        cfg80211_put_bss(wiphy, bss);
 
         return rc;
 }
diff --git a/drivers/net/wireless/ath/wil6210/wmi.c b/drivers/net/wireless/ath/wil6210/wmi.c
index c8aca3d50089..0bb3b76b4b58 100644
--- a/drivers/net/wireless/ath/wil6210/wmi.c
+++ b/drivers/net/wireless/ath/wil6210/wmi.c
@@ -338,7 +338,7 @@ static void wmi_evt_rx_mgmt(struct wil6210_priv *wil, int id, void *d, int len)
                 if (bss) {
                         wil_dbg_wmi(wil, "Added BSS %pM\n",
                                     rx_mgmt_frame->bssid);
-                        cfg80211_put_bss(bss);
+                        cfg80211_put_bss(wiphy, bss);
                 } else {
                         wil_err(wil, "cfg80211_inform_bss() failed\n");
                 }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/Makefile b/drivers/net/wireless/brcm80211/brcmfmac/Makefile
index 1a6661a9f008..756e19fc2795 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/Makefile
+++ b/drivers/net/wireless/brcm80211/brcmfmac/Makefile
@@ -26,6 +26,7 @@ brcmfmac-objs += \
                 wl_cfg80211.o \
                 fwil.o \
                 fweh.o \
+                p2p.o \
                 dhd_cdc.o \
                 dhd_common.o \
                 dhd_linux.o
@@ -37,4 +38,4 @@ brcmfmac-$(CONFIG_BRCMFMAC_SDIO) += \
 brcmfmac-$(CONFIG_BRCMFMAC_USB) += \
                 usb.o
 brcmfmac-$(CONFIG_BRCMDBG) += \
-                dhd_dbg.o
\ No newline at end of file
+                dhd_dbg.o
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
index a2f32fb990fa..ef6f23be6d32 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
@@ -72,6 +72,7 @@
 #define BRCMF_C_SET_WSEC                        134
 #define BRCMF_C_GET_PHY_NOISE                   135
 #define BRCMF_C_GET_BSS_INFO                    136
+#define BRCMF_C_SET_SCB_TIMEOUT                 158
 #define BRCMF_C_GET_PHYLIST                     180
 #define BRCMF_C_SET_SCAN_CHANNEL_TIME           185
 #define BRCMF_C_SET_SCAN_UNASSOC_TIME           187
@@ -149,6 +150,7 @@
 #define BRCMF_E_REASON_MINTXRATE                9
 #define BRCMF_E_REASON_TXFAIL                   10
 
+#define BRCMF_E_REASON_LINK_BSSCFG_DIS          4
 #define BRCMF_E_REASON_FAST_ROAM_FAILED         5
 #define BRCMF_E_REASON_DIRECTED_ROAM            6
 #define BRCMF_E_REASON_TSPEC_REJECTED           7
@@ -375,6 +377,28 @@ struct brcmf_join_params {
         struct brcmf_assoc_params_le params_le;
 };
 
+/* scan params for extended join */
+struct brcmf_join_scan_params_le {
+        u8 scan_type;           /* 0 use default, active or passive scan */
+        __le32 nprobes;         /* -1 use default, nr of probes per channel */
+        __le32 active_time;     /* -1 use default, dwell time per channel for
+                                 * active scanning
+                                 */
+        __le32 passive_time;    /* -1 use default, dwell time per channel
+                                 * for passive scanning
+                                 */
+        __le32 home_time;       /* -1 use default, dwell time for the home
+                                 * channel between channel scans
+                                 */
+};
+
+/* extended join params */
+struct brcmf_ext_join_params_le {
+        struct brcmf_ssid_le ssid_le;   /* {0, ""}: wildcard scan */
+        struct brcmf_join_scan_params_le scan_le;
+        struct brcmf_assoc_params_le assoc_le;
+};
+
 struct brcmf_wsec_key {
         u32 index;              /* key index */
         u32 len;                /* key length */
@@ -451,6 +475,19 @@ struct brcmf_sta_info_le {
         __le32  rx_decrypt_failures;    /* # of packet decrypted failed */
 };
 
+/*
+ * WLC_E_PROBRESP_MSG
+ * WLC_E_P2P_PROBREQ_MSG
+ * WLC_E_ACTION_FRAME_RX
+ */
+struct brcmf_rx_mgmt_data {
+        __be16  version;
+        __be16  chanspec;
+        __be32  rssi;
+        __be32  mactime;
+        __be32  rate;
+};
+
 /* Bus independent dongle command */
 struct brcmf_dcmd {
         uint cmd;               /* common dongle cmd definition */
@@ -489,9 +526,6 @@ struct brcmf_pub {
         struct mutex proto_block;
         unsigned char proto_buf[BRCMF_DCMD_MAXLEN];
 
-        atomic_t pend_8021x_cnt;
-        wait_queue_head_t pend_8021x_wait;
-
         struct brcmf_fweh_info fweh;
 #ifdef DEBUG
         struct dentry *dbgfs_dir;
@@ -515,9 +549,11 @@ struct brcmf_cfg80211_vif;
  * @vif: points to cfg80211 specific interface information.
  * @ndev: associated network device.
  * @stats: interface specific network statistics.
- * @idx: interface index in device firmware.
+ * @ifidx: interface index in device firmware.
  * @bssidx: index of bss associated with this interface.
  * @mac_addr: assigned mac address.
+ * @pend_8021x_cnt: tracks outstanding number of 802.1x frames.
+ * @pend_8021x_wait: used for signalling change in count.
  */
 struct brcmf_if {
         struct brcmf_pub *drvr;
@@ -526,9 +562,11 @@ struct brcmf_if {
         struct net_device_stats stats;
         struct work_struct setmacaddr_work;
         struct work_struct multicast_work;
-        int idx;
+        int ifidx;
         s32 bssidx;
         u8 mac_addr[ETH_ALEN];
+        atomic_t pend_8021x_cnt;
+        wait_queue_head_t pend_8021x_wait;
 };
 
 
@@ -547,9 +585,10 @@ extern int brcmf_proto_cdc_set_dcmd(struct brcmf_pub *drvr, int ifidx, uint cmd,
 extern int brcmf_proto_hdrpull(struct brcmf_pub *drvr, u8 *ifidx,
                                struct sk_buff *rxp);
 
-extern int brcmf_net_attach(struct brcmf_if *ifp);
-extern struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, int ifidx,
-                                     s32 bssidx, char *name, u8 *mac_addr);
-extern void brcmf_del_if(struct brcmf_pub *drvr, int ifidx);
+extern int brcmf_net_attach(struct brcmf_if *ifp, bool rtnl_locked);
+extern struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, s32 bssidx,
+                                     s32 ifidx, char *name, u8 *mac_addr);
+extern void brcmf_del_if(struct brcmf_pub *drvr, s32 bssidx);
+extern u32 brcmf_get_chip_info(struct brcmf_if *ifp);
 
 #endif                          /* _BRCMF_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
index 64c38f4226a3..ad25c3408b59 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
@@ -24,18 +24,6 @@ enum brcmf_bus_state {
         BRCMF_BUS_DATA          /* Ready for frame transfers */
 };
 
-struct dngl_stats {
-        unsigned long rx_packets;       /* total packets received */
-        unsigned long tx_packets;       /* total packets transmitted */
-        unsigned long rx_bytes; /* total bytes received */
-        unsigned long tx_bytes; /* total bytes transmitted */
-        unsigned long rx_errors;        /* bad packets received */
-        unsigned long tx_errors;        /* packet transmit problems */
-        unsigned long rx_dropped;       /* packets dropped by dongle */
-        unsigned long tx_dropped;       /* packets dropped by dongle */
-        unsigned long multicast;        /* multicast packets received */
-};
-
 struct brcmf_bus_dcmd {
         char *name;
         char *param;
@@ -72,11 +60,12 @@ struct brcmf_bus_ops {
  * @drvr: public driver information.
  * @state: operational state of the bus interface.
  * @maxctl: maximum size for rxctl request message.
- * @drvr_up: indicates driver up/down status.
  * @tx_realloc: number of tx packets realloced for headroom.
  * @dstats: dongle-based statistical data.
  * @align: alignment requirement for the bus.
  * @dcmd_list: bus/device specific dongle initialization commands.
+ * @chip: device identifier of the dongle chip.
+ * @chiprev: revision of the dongle chip.
  */
 struct brcmf_bus {
         union {
@@ -87,10 +76,10 @@ struct brcmf_bus {
         struct brcmf_pub *drvr;
         enum brcmf_bus_state state;
         uint maxctl;
-        bool drvr_up;
         unsigned long tx_realloc;
-        struct dngl_stats dstats;
         u8 align;
+        u32 chip;
+        u32 chiprev;
         struct list_head dcmd_list;
 
         struct brcmf_bus_ops *ops;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_cdc.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_cdc.c
index bb454cdab29d..a2354d951dd7 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_cdc.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_cdc.c
@@ -303,6 +303,14 @@ int brcmf_proto_hdrpull(struct brcmf_pub *drvr, u8 *ifidx,
                 brcmf_err("rx data ifnum out of range (%d)\n", *ifidx);
                 return -EBADE;
         }
+        /* The ifidx is the idx to map to matching netdev/ifp. When receiving
+         * events this is easy because it contains the bssidx which maps
+         * 1-on-1 to the netdev/ifp. But for data frames the ifidx is rcvd.
+         * bssidx 1 is used for p2p0 and no data can be received or
+         * transmitted on it. Therefor bssidx is ifidx + 1 if ifidx > 0
+         */
+        if (*ifidx)
+                (*ifidx)++;
 
         if (((h->flags & BDC_FLAG_VER_MASK) >> BDC_FLAG_VER_SHIFT) !=
             BDC_PROTO_VER) {
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
index 14b8fdde6954..c06cea88df0d 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
@@ -26,6 +26,8 @@
 #include "dhd_bus.h"
 #include "dhd_proto.h"
 #include "dhd_dbg.h"
+#include "fwil_types.h"
+#include "p2p.h"
 #include "wl_cfg80211.h"
 #include "fwil.h"
 
@@ -40,6 +42,12 @@ MODULE_LICENSE("Dual BSD/GPL");
 int brcmf_msg_level;
 module_param(brcmf_msg_level, int, 0);
 
+/* P2P0 enable */
+static int brcmf_p2p_enable;
+#ifdef CONFIG_BRCMDBG
+module_param_named(p2pon, brcmf_p2p_enable, int, 0);
+MODULE_PARM_DESC(p2pon, "enable p2p management functionality");
+#endif
 
 char *brcmf_ifname(struct brcmf_pub *drvr, int ifidx)
 {
@@ -70,9 +78,10 @@ static void _brcmf_set_multicast_list(struct work_struct *work)
         u32 buflen;
         s32 err;
 
-        brcmf_dbg(TRACE, "enter\n");
-
         ifp = container_of(work, struct brcmf_if, multicast_work);
+
+        brcmf_dbg(TRACE, "Enter, idx=%d\n", ifp->bssidx);
+
         ndev = ifp->ndev;
 
         /* Determine initial value of allmulti flag */
@@ -129,9 +138,10 @@ _brcmf_set_mac_address(struct work_struct *work)
         struct brcmf_if *ifp;
         s32 err;
 
-        brcmf_dbg(TRACE, "enter\n");
-
         ifp = container_of(work, struct brcmf_if, setmacaddr_work);
+
+        brcmf_dbg(TRACE, "Enter, idx=%d\n", ifp->bssidx);
+
         err = brcmf_fil_iovar_data_set(ifp, "cur_etheraddr", ifp->mac_addr,
                                        ETH_ALEN);
         if (err < 0) {
@@ -168,7 +178,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,
         struct brcmf_pub *drvr = ifp->drvr;
         struct ethhdr *eh;
 
-        brcmf_dbg(TRACE, "Enter\n");
+        brcmf_dbg(TRACE, "Enter, idx=%d\n", ifp->bssidx);
 
         /* Can the device send data? */
         if (drvr->bus_if->state != BRCMF_BUS_DATA) {
@@ -179,8 +189,8 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,
                 goto done;
         }
 
-        if (!drvr->iflist[ifp->idx]) {
-                brcmf_err("bad ifidx %d\n", ifp->idx);
+        if (!drvr->iflist[ifp->bssidx]) {
+                brcmf_err("bad ifidx %d\n", ifp->bssidx);
                 netif_stop_queue(ndev);
                 dev_kfree_skb(skb);
                 ret = -ENODEV;
@@ -192,14 +202,14 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,
                 struct sk_buff *skb2;
 
                 brcmf_dbg(INFO, "%s: insufficient headroom\n",
-                          brcmf_ifname(drvr, ifp->idx));
+                          brcmf_ifname(drvr, ifp->bssidx));
                 drvr->bus_if->tx_realloc++;
                 skb2 = skb_realloc_headroom(skb, drvr->hdrlen);
                 dev_kfree_skb(skb);
                 skb = skb2;
                 if (skb == NULL) {
                         brcmf_err("%s: skb_realloc_headroom failed\n",
-                                  brcmf_ifname(drvr, ifp->idx));
+                                  brcmf_ifname(drvr, ifp->bssidx));
                         ret = -ENOMEM;
                         goto done;
                 }
@@ -217,19 +227,21 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,
         if (is_multicast_ether_addr(eh->h_dest))
                 drvr->tx_multicast++;
         if (ntohs(eh->h_proto) == ETH_P_PAE)
-                atomic_inc(&drvr->pend_8021x_cnt);
+                atomic_inc(&ifp->pend_8021x_cnt);
 
         /* If the protocol uses a data header, apply it */
-        brcmf_proto_hdrpush(drvr, ifp->idx, skb);
+        brcmf_proto_hdrpush(drvr, ifp->ifidx, skb);
 
         /* Use bus module to send data frame */
         ret =  brcmf_bus_txdata(drvr->bus_if, skb);
 
 done:
-        if (ret)
-                drvr->bus_if->dstats.tx_dropped++;
-        else
-                drvr->bus_if->dstats.tx_packets++;
+        if (ret) {
+                ifp->stats.tx_dropped++;
+        } else {
+                ifp->stats.tx_packets++;
+                ifp->stats.tx_bytes += skb->len;
+        }
 
         /* Return ok: we always eat the packet */
         return NETDEV_TX_OK;
@@ -270,12 +282,13 @@ void brcmf_rx_frames(struct device *dev, struct sk_buff_head *skb_list)
         skb_queue_walk_safe(skb_list, skb, pnext) {
                 skb_unlink(skb, skb_list);
 
-                /* process and remove protocol-specific header
-                 */
+                /* process and remove protocol-specific header */
                 ret = brcmf_proto_hdrpull(drvr, &ifidx, skb);
-                if (ret < 0) {
-                        if (ret != -ENODATA)
-                                bus_if->dstats.rx_errors++;
+                ifp = drvr->iflist[ifidx];
+
+                if (ret || !ifp || !ifp->ndev) {
+                        if ((ret != -ENODATA) && ifp)
+                                ifp->stats.rx_errors++;
                         brcmu_pkt_buf_free_skb(skb);
                         continue;
                 }
@@ -295,21 +308,11 @@ void brcmf_rx_frames(struct device *dev, struct sk_buff_head *skb_list)
                 eth = skb->data;
                 len = skb->len;
 
-                ifp = drvr->iflist[ifidx];
-                if (ifp == NULL)
-                        ifp = drvr->iflist[0];
-
-                if (!ifp || !ifp->ndev ||
-                    ifp->ndev->reg_state != NETREG_REGISTERED) {
-                        brcmu_pkt_buf_free_skb(skb);
-                        continue;
-                }
-
                 skb->dev = ifp->ndev;
                 skb->protocol = eth_type_trans(skb, skb->dev);
 
                 if (skb->pkt_type == PACKET_MULTICAST)
-                        bus_if->dstats.multicast++;
+                        ifp->stats.multicast++;
 
                 skb->data = eth;
                 skb->len = len;
@@ -325,8 +328,13 @@ void brcmf_rx_frames(struct device *dev, struct sk_buff_head *skb_list)
                         ifp->ndev->last_rx = jiffies;
                 }
 
-                bus_if->dstats.rx_bytes += skb->len;
-                bus_if->dstats.rx_packets++;    /* Local count */
+                if (!(ifp->ndev->flags & IFF_UP)) {
+                        brcmu_pkt_buf_free_skb(skb);
+                        continue;
+                }
+
+                ifp->stats.rx_bytes += skb->len;
+                ifp->stats.rx_packets++;
 
                 if (in_interrupt())
                         netif_rx(skb);
@@ -348,36 +356,31 @@ void brcmf_txcomplete(struct device *dev, struct sk_buff *txp, bool success)
         u16 type;
         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
         struct brcmf_pub *drvr = bus_if->drvr;
+        struct brcmf_if *ifp;
 
         brcmf_proto_hdrpull(drvr, &ifidx, txp);
 
+        ifp = drvr->iflist[ifidx];
+        if (!ifp)
+                return;
+
         eh = (struct ethhdr *)(txp->data);
         type = ntohs(eh->h_proto);
 
         if (type == ETH_P_PAE) {
-                atomic_dec(&drvr->pend_8021x_cnt);
-                if (waitqueue_active(&drvr->pend_8021x_wait))
-                        wake_up(&drvr->pend_8021x_wait);
+                atomic_dec(&ifp->pend_8021x_cnt);
+                if (waitqueue_active(&ifp->pend_8021x_wait))
+                        wake_up(&ifp->pend_8021x_wait);
         }
+        if (!success)
+                ifp->stats.tx_errors++;
 }
 
 static struct net_device_stats *brcmf_netdev_get_stats(struct net_device *ndev)
 {
         struct brcmf_if *ifp = netdev_priv(ndev);
-        struct brcmf_bus *bus_if = ifp->drvr->bus_if;
-
-        brcmf_dbg(TRACE, "Enter\n");
 
-        /* Copy dongle stats to net device stats */
-        ifp->stats.rx_packets = bus_if->dstats.rx_packets;
-        ifp->stats.tx_packets = bus_if->dstats.tx_packets;
-        ifp->stats.rx_bytes = bus_if->dstats.rx_bytes;
-        ifp->stats.tx_bytes = bus_if->dstats.tx_bytes;
-        ifp->stats.rx_errors = bus_if->dstats.rx_errors;
-        ifp->stats.tx_errors = bus_if->dstats.tx_errors;
-        ifp->stats.rx_dropped = bus_if->dstats.rx_dropped;
-        ifp->stats.tx_dropped = bus_if->dstats.tx_dropped;
-        ifp->stats.multicast = bus_if->dstats.multicast;
+        brcmf_dbg(TRACE, "Enter, idx=%d\n", ifp->bssidx);
 
         return &ifp->stats;
 }
@@ -431,7 +434,7 @@ static int brcmf_ethtool(struct brcmf_if *ifp, void __user *uaddr)
         u32 toe_cmpnt, csum_dir;
         int ret;
 
-        brcmf_dbg(TRACE, "Enter\n");
+        brcmf_dbg(TRACE, "Enter, idx=%d\n", ifp->bssidx);
 
         /* all ethtool calls start with a cmd word */
         if (copy_from_user(&cmd, uaddr, sizeof(u32)))
@@ -454,13 +457,7 @@ static int brcmf_ethtool(struct brcmf_if *ifp, void __user *uaddr)
                         sprintf(info.driver, "dhd");
                         strcpy(info.version, BRCMF_VERSION_STR);
                 }
-
-                /* otherwise, require dongle to be up */
-                else if (!drvr->bus_if->drvr_up) {
-                        brcmf_err("dongle is not up\n");
-                        return -ENODEV;
-                }
-                /* finally, report dongle driver type */
+                /* report dongle driver type */
                 else
                         sprintf(info.driver, "wl");
 
@@ -534,9 +531,9 @@ static int brcmf_netdev_ioctl_entry(struct net_device *ndev, struct ifreq *ifr,
         struct brcmf_if *ifp = netdev_priv(ndev);
         struct brcmf_pub *drvr = ifp->drvr;
 
-        brcmf_dbg(TRACE, "ifidx %d, cmd 0x%04x\n", ifp->idx, cmd);
+        brcmf_dbg(TRACE, "Enter, idx=%d, cmd=0x%04x\n", ifp->bssidx, cmd);
 
-        if (!drvr->iflist[ifp->idx])
+        if (!drvr->iflist[ifp->bssidx])
                 return -1;
 
         if (cmd == SIOCETHTOOL)
@@ -548,17 +545,12 @@ static int brcmf_netdev_ioctl_entry(struct net_device *ndev, struct ifreq *ifr,
 static int brcmf_netdev_stop(struct net_device *ndev)
 {
         struct brcmf_if *ifp = netdev_priv(ndev);
-        struct brcmf_pub *drvr = ifp->drvr;
-
-        brcmf_dbg(TRACE, "Enter\n");
 
-        if (drvr->bus_if->drvr_up == 0)
-                return 0;
+        brcmf_dbg(TRACE, "Enter, idx=%d\n", ifp->bssidx);
 
         brcmf_cfg80211_down(ndev);
 
         /* Set state and stop OS transmissions */
-        drvr->bus_if->drvr_up = false;
         netif_stop_queue(ndev);
 
         return 0;
@@ -572,7 +564,7 @@ static int brcmf_netdev_open(struct net_device *ndev)
         u32 toe_ol;
         s32 ret = 0;
 
-        brcmf_dbg(TRACE, "ifidx %d\n", ifp->idx);
+        brcmf_dbg(TRACE, "Enter, idx=%d\n", ifp->bssidx);
 
         /* If bus is not ready, can't continue */
         if (bus_if->state != BRCMF_BUS_DATA) {
@@ -580,9 +572,7 @@ static int brcmf_netdev_open(struct net_device *ndev)
                 return -EAGAIN;
         }
 
-        atomic_set(&drvr->pend_8021x_cnt, 0);
-
-        memcpy(ndev->dev_addr, drvr->mac, ETH_ALEN);
+        atomic_set(&ifp->pend_8021x_cnt, 0);
 
         /* Get current TOE mode from dongle */
         if (brcmf_fil_iovar_int_get(ifp, "toe_ol", &toe_ol) >= 0
@@ -593,7 +583,6 @@ static int brcmf_netdev_open(struct net_device *ndev)
 
         /* Allow transmit calls */
         netif_start_queue(ndev);
-        drvr->bus_if->drvr_up = true;
         if (brcmf_cfg80211_up(ndev)) {
                 brcmf_err("failed to bring up cfg80211\n");
                 return -1;
@@ -612,29 +601,18 @@ static const struct net_device_ops brcmf_netdev_ops_pri = {
         .ndo_set_rx_mode = brcmf_netdev_set_multicast_list
 };
 
-static const struct net_device_ops brcmf_netdev_ops_virt = {
-        .ndo_open = brcmf_cfg80211_up,
-        .ndo_stop = brcmf_cfg80211_down,
-        .ndo_get_stats = brcmf_netdev_get_stats,
-        .ndo_do_ioctl = brcmf_netdev_ioctl_entry,
-        .ndo_start_xmit = brcmf_netdev_start_xmit,
-        .ndo_set_mac_address = brcmf_netdev_set_mac_address,
-        .ndo_set_rx_mode = brcmf_netdev_set_multicast_list
-};
-
-int brcmf_net_attach(struct brcmf_if *ifp)
+int brcmf_net_attach(struct brcmf_if *ifp, bool rtnl_locked)
 {
         struct brcmf_pub *drvr = ifp->drvr;
         struct net_device *ndev;
+        s32 err;
 
-        brcmf_dbg(TRACE, "ifidx %d mac %pM\n", ifp->idx, ifp->mac_addr);
+        brcmf_dbg(TRACE, "Enter, idx=%d mac=%pM\n", ifp->bssidx,
+                  ifp->mac_addr);
         ndev = ifp->ndev;
 
         /* set appropriate operations */
-        if (!ifp->idx)
-                ndev->netdev_ops = &brcmf_netdev_ops_pri;
-        else
-                ndev->netdev_ops = &brcmf_netdev_ops_virt;
+        ndev->netdev_ops = &brcmf_netdev_ops_pri;
 
         ndev->hard_header_len = ETH_HLEN + drvr->hdrlen;
         ndev->ethtool_ops = &brcmf_ethtool_ops;
@@ -645,7 +623,14 @@ int brcmf_net_attach(struct brcmf_if *ifp)
         /* set the mac address */
         memcpy(ndev->dev_addr, ifp->mac_addr, ETH_ALEN);
 
-        if (register_netdev(ndev) != 0) {
+        INIT_WORK(&ifp->setmacaddr_work, _brcmf_set_mac_address);
+        INIT_WORK(&ifp->multicast_work, _brcmf_set_multicast_list);
+
+        if (rtnl_locked)
+                err = register_netdevice(ndev);
+        else
+                err = register_netdev(ndev);
+        if (err != 0) {
                 brcmf_err("couldn't register the net device\n");
                 goto fail;
         }
@@ -659,16 +644,78 @@ fail:
         return -EBADE;
 }
 
-struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, int ifidx, s32 bssidx,
-                              char *name, u8 *addr_mask)
+static int brcmf_net_p2p_open(struct net_device *ndev)
+{
+        brcmf_dbg(TRACE, "Enter\n");
+
+        return brcmf_cfg80211_up(ndev);
+}
+
+static int brcmf_net_p2p_stop(struct net_device *ndev)
+{
+        brcmf_dbg(TRACE, "Enter\n");
+
+        return brcmf_cfg80211_down(ndev);
+}
+
+static int brcmf_net_p2p_do_ioctl(struct net_device *ndev,
+                                  struct ifreq *ifr, int cmd)
+{
+        brcmf_dbg(TRACE, "Enter\n");
+        return 0;
+}
+
+static netdev_tx_t brcmf_net_p2p_start_xmit(struct sk_buff *skb,
+                                            struct net_device *ndev)
+{
+        if (skb)
+                dev_kfree_skb_any(skb);
+
+        return NETDEV_TX_OK;
+}
+
+static const struct net_device_ops brcmf_netdev_ops_p2p = {
+        .ndo_open = brcmf_net_p2p_open,
+        .ndo_stop = brcmf_net_p2p_stop,
+        .ndo_do_ioctl = brcmf_net_p2p_do_ioctl,
+        .ndo_start_xmit = brcmf_net_p2p_start_xmit
+};
+
+static int brcmf_net_p2p_attach(struct brcmf_if *ifp)
+{
+        struct net_device *ndev;
+
+        brcmf_dbg(TRACE, "Enter, idx=%d mac=%pM\n", ifp->bssidx,
+                  ifp->mac_addr);
+        ndev = ifp->ndev;
+
+        ndev->netdev_ops = &brcmf_netdev_ops_p2p;
+
+        /* set the mac address */
+        memcpy(ndev->dev_addr, ifp->mac_addr, ETH_ALEN);
+
+        if (register_netdev(ndev) != 0) {
+                brcmf_err("couldn't register the p2p net device\n");
+                goto fail;
+        }
+
+        brcmf_dbg(INFO, "%s: Broadcom Dongle Host Driver\n", ndev->name);
+
+        return 0;
+
+fail:
+        return -EBADE;
+}
+
+struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, s32 bssidx, s32 ifidx,
+                              char *name, u8 *mac_addr)
 {
         struct brcmf_if *ifp;
         struct net_device *ndev;
-        int i;
 
-        brcmf_dbg(TRACE, "idx %d\n", ifidx);
+        brcmf_dbg(TRACE, "Enter, idx=%d, ifidx=%d\n", bssidx, ifidx);
 
-        ifp = drvr->iflist[ifidx];
+        ifp = drvr->iflist[bssidx];
         /*
          * Delete the existing interface before overwriting it
          * in case we missed the BRCMF_E_IF_DEL event.
@@ -680,7 +727,7 @@ struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, int ifidx, s32 bssidx,
                         netif_stop_queue(ifp->ndev);
                         unregister_netdev(ifp->ndev);
                         free_netdev(ifp->ndev);
-                        drvr->iflist[ifidx] = NULL;
+                        drvr->iflist[bssidx] = NULL;
                 } else {
                         brcmf_err("ignore IF event\n");
                         return ERR_PTR(-EINVAL);
@@ -697,16 +744,15 @@ struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, int ifidx, s32 bssidx,
         ifp = netdev_priv(ndev);
         ifp->ndev = ndev;
         ifp->drvr = drvr;
-        drvr->iflist[ifidx] = ifp;
-        ifp->idx = ifidx;
+        drvr->iflist[bssidx] = ifp;
+        ifp->ifidx = ifidx;
         ifp->bssidx = bssidx;
 
-        INIT_WORK(&ifp->setmacaddr_work, _brcmf_set_mac_address);
-        INIT_WORK(&ifp->multicast_work, _brcmf_set_multicast_list);
 
-        if (addr_mask != NULL)
-                for (i = 0; i < ETH_ALEN; i++)
-                        ifp->mac_addr[i] = drvr->mac[i] ^ addr_mask[i];
+        init_waitqueue_head(&ifp->pend_8021x_wait);
+
+        if (mac_addr != NULL)
+                memcpy(ifp->mac_addr, mac_addr, ETH_ALEN);
 
         brcmf_dbg(TRACE, " ==== pid:%x, if:%s (%pM) created ===\n",
                   current->pid, ifp->ndev->name, ifp->mac_addr);
@@ -714,19 +760,18 @@ struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, int ifidx, s32 bssidx,
         return ifp;
 }
 
-void brcmf_del_if(struct brcmf_pub *drvr, int ifidx)
+void brcmf_del_if(struct brcmf_pub *drvr, s32 bssidx)
 {
         struct brcmf_if *ifp;
 
-        brcmf_dbg(TRACE, "idx %d\n", ifidx);
-
-        ifp = drvr->iflist[ifidx];
+        ifp = drvr->iflist[bssidx];
         if (!ifp) {
-                brcmf_err("Null interface\n");
+                brcmf_err("Null interface, idx=%d\n", bssidx);
                 return;
         }
+        brcmf_dbg(TRACE, "Enter, idx=%d, ifidx=%d\n", bssidx, ifp->ifidx);
         if (ifp->ndev) {
-                if (ifidx == 0) {
+                if (bssidx == 0) {
                         if (ifp->ndev->netdev_ops == &brcmf_netdev_ops_pri) {
                                 rtnl_lock();
                                 brcmf_netdev_stop(ifp->ndev);
@@ -736,12 +781,14 @@ void brcmf_del_if(struct brcmf_pub *drvr, int ifidx)
                         netif_stop_queue(ifp->ndev);
                 }
 
-                cancel_work_sync(&ifp->setmacaddr_work);
-                cancel_work_sync(&ifp->multicast_work);
+                if (ifp->ndev->netdev_ops == &brcmf_netdev_ops_pri) {
+                        cancel_work_sync(&ifp->setmacaddr_work);
+                        cancel_work_sync(&ifp->multicast_work);
+                }
 
                 unregister_netdev(ifp->ndev);
-                drvr->iflist[ifidx] = NULL;
-                if (ifidx == 0)
+                drvr->iflist[bssidx] = NULL;
+                if (bssidx == 0)
                         brcmf_cfg80211_detach(drvr->config);
                 free_netdev(ifp->ndev);
         }
@@ -781,8 +828,6 @@ int brcmf_attach(uint bus_hdrlen, struct device *dev)
 
         INIT_LIST_HEAD(&drvr->bus_if->dcmd_list);
 
-        init_waitqueue_head(&drvr->pend_8021x_wait);
-
         return ret;
 
 fail:
@@ -797,6 +842,7 @@ int brcmf_bus_start(struct device *dev)
         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
         struct brcmf_pub *drvr = bus_if->drvr;
         struct brcmf_if *ifp;
+        struct brcmf_if *p2p_ifp;
 
         brcmf_dbg(TRACE, "\n");
 
@@ -812,6 +858,13 @@ int brcmf_bus_start(struct device *dev)
         if (IS_ERR(ifp))
                 return PTR_ERR(ifp);
 
+        if (brcmf_p2p_enable)
+                p2p_ifp = brcmf_add_if(drvr, 1, 0, "p2p%d", NULL);
+        else
+                p2p_ifp = NULL;
+        if (IS_ERR(p2p_ifp))
+                p2p_ifp = NULL;
+
         /* signal bus ready */
         bus_if->state = BRCMF_BUS_DATA;
 
@@ -830,16 +883,22 @@ int brcmf_bus_start(struct device *dev)
         if (ret < 0)
                 goto fail;
 
-        ret = brcmf_net_attach(ifp);
+        ret = brcmf_net_attach(ifp, false);
 fail:
         if (ret < 0) {
                 brcmf_err("failed: %d\n", ret);
                 if (drvr->config)
                         brcmf_cfg80211_detach(drvr->config);
-                free_netdev(drvr->iflist[0]->ndev);
+                free_netdev(ifp->ndev);
                 drvr->iflist[0] = NULL;
+                if (p2p_ifp) {
+                        free_netdev(p2p_ifp->ndev);
+                        drvr->iflist[1] = NULL;
+                }
                 return ret;
         }
+        if ((brcmf_p2p_enable) && (p2p_ifp))
+                brcmf_net_p2p_attach(p2p_ifp);
 
         return 0;
 }
@@ -865,12 +924,13 @@ void brcmf_dev_reset(struct device *dev)
         if (drvr == NULL)
                 return;
 
-        brcmf_fil_cmd_int_set(drvr->iflist[0], BRCMF_C_TERMINATED, 1);
+        if (drvr->iflist[0])
+                brcmf_fil_cmd_int_set(drvr->iflist[0], BRCMF_C_TERMINATED, 1);
 }
 
 void brcmf_detach(struct device *dev)
 {
-        int i;
+        s32 i;
         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
         struct brcmf_pub *drvr = bus_if->drvr;
 
@@ -897,19 +957,18 @@ void brcmf_detach(struct device *dev)
         kfree(drvr);
 }
 
-static int brcmf_get_pend_8021x_cnt(struct brcmf_pub *drvr)
+static int brcmf_get_pend_8021x_cnt(struct brcmf_if *ifp)
 {
-        return atomic_read(&drvr->pend_8021x_cnt);
+        return atomic_read(&ifp->pend_8021x_cnt);
 }
 
 int brcmf_netdev_wait_pend8021x(struct net_device *ndev)
 {
         struct brcmf_if *ifp = netdev_priv(ndev);
-        struct brcmf_pub *drvr = ifp->drvr;
         int err;
 
-        err = wait_event_timeout(drvr->pend_8021x_wait,
-                                 !brcmf_get_pend_8021x_cnt(drvr),
+        err = wait_event_timeout(ifp->pend_8021x_wait,
+                                 !brcmf_get_pend_8021x_cnt(ifp),
                                  msecs_to_jiffies(MAX_WAIT_FOR_8021X_TX));
 
         WARN_ON(!err);
@@ -917,6 +976,16 @@ int brcmf_netdev_wait_pend8021x(struct net_device *ndev)
         return !err;
 }
 
+/*
+ * return chip id and rev of the device encoded in u32.
+ */
+u32 brcmf_get_chip_info(struct brcmf_if *ifp)
+{
+        struct brcmf_bus *bus = ifp->drvr->bus_if;
+
+        return bus->chip << 4 | bus->chiprev;
+}
+
 static void brcmf_driver_init(struct work_struct *work)
 {
         brcmf_debugfs_init();
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
index 6d786a281f1e..4469321c0eb3 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
@@ -1096,7 +1096,6 @@ static int brcmf_sdio_hdparser(struct brcmf_sdio *bus, u8 *header,
         if (len > MAX_RX_DATASZ && rd->channel != SDPCM_CONTROL_CHANNEL &&
             type != BRCMF_SDIO_FT_SUPER) {
                 brcmf_err("HW header length too long\n");
-                bus->sdiodev->bus_if->dstats.rx_errors++;
                 bus->sdcnt.rx_toolong++;
                 brcmf_sdbrcm_rxfail(bus, false, false);
                 rd->len = 0;
@@ -1298,7 +1297,6 @@ static u8 brcmf_sdbrcm_rxglom(struct brcmf_sdio *bus, u8 rxseq)
                 if (errcode < 0) {
                         brcmf_err("glom read of %d bytes failed: %d\n",
                                   dlen, errcode);
-                        bus->sdiodev->bus_if->dstats.rx_errors++;
 
                         sdio_claim_host(bus->sdiodev->func[1]);
                         if (bus->glomerr++ < 3) {
@@ -1477,7 +1475,6 @@ brcmf_sdbrcm_read_control(struct brcmf_sdio *bus, u8 *hdr, uint len, uint doff)
         if ((rdlen + BRCMF_FIRSTREAD) > bus->sdiodev->bus_if->maxctl) {
                 brcmf_err("%d-byte control read exceeds %d-byte buffer\n",
                           rdlen, bus->sdiodev->bus_if->maxctl);
-                bus->sdiodev->bus_if->dstats.rx_errors++;
                 brcmf_sdbrcm_rxfail(bus, false, false);
                 goto done;
         }
@@ -1485,7 +1482,6 @@ brcmf_sdbrcm_read_control(struct brcmf_sdio *bus, u8 *hdr, uint len, uint doff)
         if ((len - doff) > bus->sdiodev->bus_if->maxctl) {
                 brcmf_err("%d-byte ctl frame (%d-byte ctl data) exceeds %d-byte limit\n",
                           len, len - doff, bus->sdiodev->bus_if->maxctl);
-                bus->sdiodev->bus_if->dstats.rx_errors++;
                 bus->sdcnt.rx_toolong++;
                 brcmf_sdbrcm_rxfail(bus, false, false);
                 goto done;
@@ -1633,7 +1629,6 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
                 if (!pkt) {
                         /* Give up on data, request rtx of events */
                         brcmf_err("brcmu_pkt_buf_get_skb failed\n");
-                        bus->sdiodev->bus_if->dstats.rx_dropped++;
                         brcmf_sdbrcm_rxfail(bus, false,
                                             RETRYCHAN(rd->channel));
                         sdio_release_host(bus->sdiodev->func[1]);
@@ -1651,7 +1646,6 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
                         brcmf_err("read %d bytes from channel %d failed: %d\n",
                                   rd->len, rd->channel, sdret);
                         brcmu_pkt_buf_free_skb(pkt);
-                        bus->sdiodev->bus_if->dstats.rx_errors++;
                         sdio_claim_host(bus->sdiodev->func[1]);
                         brcmf_sdbrcm_rxfail(bus, true,
                                             RETRYCHAN(rd->channel));
@@ -1939,10 +1933,6 @@ static uint brcmf_sdbrcm_sendfromq(struct brcmf_sdio *bus, uint maxframes)
                 datalen = pkt->len - SDPCM_HDRLEN;
 
                 ret = brcmf_sdbrcm_txpkt(bus, pkt, SDPCM_DATA_CHANNEL, true);
-                if (ret)
-                        bus->sdiodev->bus_if->dstats.tx_errors++;
-                else
-                        bus->sdiodev->bus_if->dstats.tx_bytes += datalen;
 
                 /* In poll mode, need to check for other events */
                 if (!bus->intr && cnt) {
@@ -1961,8 +1951,7 @@ static uint brcmf_sdbrcm_sendfromq(struct brcmf_sdio *bus, uint maxframes)
         }
 
         /* Deflow-control stack if needed */
-        if (bus->sdiodev->bus_if->drvr_up &&
-            (bus->sdiodev->bus_if->state == BRCMF_BUS_DATA) &&
+        if ((bus->sdiodev->bus_if->state == BRCMF_BUS_DATA) &&
             bus->txoff && (pktq_len(&bus->txq) < TXLOW)) {
                 bus->txoff = false;
                 brcmf_txflowblock(bus->sdiodev->dev, false);
@@ -2709,9 +2698,10 @@ static int brcmf_sdio_readshared(struct brcmf_sdio *bus,
          * address of sdpcm_shared structure
          */
         sdio_claim_host(bus->sdiodev->func[1]);
+        brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
         rv = brcmf_sdbrcm_membytes(bus, false, shaddr,
                                    (u8 *)&addr_le, 4);
-        sdio_claim_host(bus->sdiodev->func[1]);
+        sdio_release_host(bus->sdiodev->func[1]);
         if (rv < 0)
                 return rv;
 
@@ -2730,10 +2720,8 @@ static int brcmf_sdio_readshared(struct brcmf_sdio *bus,
         }
 
         /* Read hndrte_shared structure */
-        sdio_claim_host(bus->sdiodev->func[1]);
         rv = brcmf_sdbrcm_membytes(bus, false, addr, (u8 *)&sh_le,
                                    sizeof(struct sdpcm_shared_le));
-        sdio_release_host(bus->sdiodev->func[1]);
         if (rv < 0)
                 return rv;
 
@@ -2835,14 +2823,12 @@ static int brcmf_sdio_trap_info(struct brcmf_sdio *bus, struct sdpcm_shared *sh,
         if ((sh->flags & SDPCM_SHARED_TRAP) == 0)
                 return 0;
 
-        sdio_claim_host(bus->sdiodev->func[1]);
         error = brcmf_sdbrcm_membytes(bus, false, sh->trap_addr, (u8 *)&tr,
                                       sizeof(struct brcmf_trap_info));
         if (error < 0)
                 return error;
 
         nbytes = brcmf_sdio_dump_console(bus, sh, data, count);
-        sdio_release_host(bus->sdiodev->func[1]);
         if (nbytes < 0)
                 return nbytes;
 
@@ -3307,9 +3293,6 @@ static int brcmf_sdbrcm_download_nvram(struct brcmf_sdio *bus)
 {
         int ret;
 
-        if (bus->sdiodev->bus_if->drvr_up)
-                return -EISCONN;
-
         ret = request_firmware(&bus->firmware, BRCMF_SDIO_NV_NAME,
                                &bus->sdiodev->func[2]->dev);
         if (ret) {
@@ -3940,6 +3923,8 @@ void *brcmf_sdbrcm_probe(u32 regsva, struct brcmf_sdio_dev *sdiodev)
         /* Assign bus interface call back */
         bus->sdiodev->bus_if->dev = bus->sdiodev->dev;
         bus->sdiodev->bus_if->ops = &brcmf_sdio_bus_ops;
+        bus->sdiodev->bus_if->chip = bus->ci->chip;
+        bus->sdiodev->bus_if->chiprev = bus->ci->chiprev;
 
         /* Attach to the brcmf/OS/network interface */
         ret = brcmf_attach(SDPCM_RESERVE, bus->sdiodev->dev);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fweh.c b/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
index ba0b22512f12..e9d6f91a1f2b 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fweh.c
@@ -189,24 +189,24 @@ static void brcmf_fweh_handle_if_event(struct brcmf_pub *drvr,
                 return;
         }
 
-        ifp = drvr->iflist[ifevent->ifidx];
+        ifp = drvr->iflist[ifevent->bssidx];
 
         if (ifevent->action == BRCMF_E_IF_ADD) {
                 brcmf_dbg(EVENT, "adding %s (%pM)\n", emsg->ifname,
                           emsg->addr);
-                ifp = brcmf_add_if(drvr, ifevent->ifidx, ifevent->bssidx,
+                ifp = brcmf_add_if(drvr, ifevent->bssidx, ifevent->ifidx,
                                    emsg->ifname, emsg->addr);
                 if (IS_ERR(ifp))
                         return;
 
                 if (!drvr->fweh.evt_handler[BRCMF_E_IF])
-                        err = brcmf_net_attach(ifp);
+                        err = brcmf_net_attach(ifp, false);
         }
 
         err = brcmf_fweh_call_event_handler(ifp, emsg->event_code, emsg, data);
 
         if (ifevent->action == BRCMF_E_IF_DEL)
-                brcmf_del_if(drvr, ifevent->ifidx);
+                brcmf_del_if(drvr, ifevent->bssidx);
 }
 
 /**
@@ -250,8 +250,6 @@ static void brcmf_fweh_event_worker(struct work_struct *work)
         drvr = container_of(fweh, struct brcmf_pub, fweh);
 
         while ((event = brcmf_fweh_dequeue_event(fweh))) {
-                ifp = drvr->iflist[event->ifidx];
-
                 brcmf_dbg(EVENT, "event %s (%u) ifidx %u bsscfg %u addr %pM\n",
                           brcmf_fweh_event_name(event->code), event->code,
                           event->emsg.ifidx, event->emsg.bsscfgidx,
@@ -283,6 +281,7 @@ static void brcmf_fweh_event_worker(struct work_struct *work)
                         goto event_free;
                 }
 
+                ifp = drvr->iflist[emsg.bsscfgidx];
                 err = brcmf_fweh_call_event_handler(ifp, event->code, &emsg,
                                                     event->data);
                 if (err) {
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fweh.h b/drivers/net/wireless/brcm80211/brcmfmac/fweh.h
index 36901f76a3b5..8c39b51dcccf 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fweh.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fweh.h
@@ -83,6 +83,7 @@ struct brcmf_event;
         BRCMF_ENUM_DEF(MULTICAST_DECODE_ERROR, 51) \
         BRCMF_ENUM_DEF(TRACE, 52) \
         BRCMF_ENUM_DEF(IF, 54) \
+        BRCMF_ENUM_DEF(P2P_DISC_LISTEN_COMPLETE, 55) \
         BRCMF_ENUM_DEF(RSSI, 56) \
         BRCMF_ENUM_DEF(PFN_SCAN_COMPLETE, 57) \
         BRCMF_ENUM_DEF(EXTLOG_MSG, 58) \
@@ -96,8 +97,11 @@ struct brcmf_event;
         BRCMF_ENUM_DEF(DFS_AP_RESUME, 66) \
         BRCMF_ENUM_DEF(ESCAN_RESULT, 69) \
         BRCMF_ENUM_DEF(ACTION_FRAME_OFF_CHAN_COMPLETE, 70) \
+        BRCMF_ENUM_DEF(PROBERESP_MSG, 71) \
+        BRCMF_ENUM_DEF(P2P_PROBEREQ_MSG, 72) \
         BRCMF_ENUM_DEF(DCS_REQUEST, 73) \
-        BRCMF_ENUM_DEF(FIFO_CREDIT_MAP, 74)
+        BRCMF_ENUM_DEF(FIFO_CREDIT_MAP, 74) \
+        BRCMF_ENUM_DEF(ACTION_FRAME_RX, 75)
 
 #define BRCMF_ENUM_DEF(id, val) \
         BRCMF_E_##id = (val),
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwil.c b/drivers/net/wireless/brcm80211/brcmfmac/fwil.c
index d8d8b6549dc5..8d1def935b8d 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fwil.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwil.c
@@ -45,9 +45,10 @@ brcmf_fil_cmd_data(struct brcmf_if *ifp, u32 cmd, void *data, u32 len, bool set)
         if (data != NULL)
                 len = min_t(uint, len, BRCMF_DCMD_MAXLEN);
         if (set)
-                err = brcmf_proto_cdc_set_dcmd(drvr, ifp->idx, cmd, data, len);
+                err = brcmf_proto_cdc_set_dcmd(drvr, ifp->ifidx, cmd, data,
+                                               len);
         else
-                err = brcmf_proto_cdc_query_dcmd(drvr, ifp->idx, cmd, data,
+                err = brcmf_proto_cdc_query_dcmd(drvr, ifp->ifidx, cmd, data,
                                                  len);
 
         if (err >= 0)
@@ -100,6 +101,7 @@ brcmf_fil_cmd_int_set(struct brcmf_if *ifp, u32 cmd, u32 data)
         __le32 data_le = cpu_to_le32(data);
 
         mutex_lock(&ifp->drvr->proto_block);
+        brcmf_dbg(FIL, "cmd=%d, value=%d\n", cmd, data);
         err = brcmf_fil_cmd_data(ifp, cmd, &data_le, sizeof(data_le), true);
         mutex_unlock(&ifp->drvr->proto_block);
 
@@ -116,6 +118,7 @@ brcmf_fil_cmd_int_get(struct brcmf_if *ifp, u32 cmd, u32 *data)
         err = brcmf_fil_cmd_data(ifp, cmd, &data_le, sizeof(data_le), false);
         mutex_unlock(&ifp->drvr->proto_block);
         *data = le32_to_cpu(data_le);
+        brcmf_dbg(FIL, "cmd=%d, value=%d\n", cmd, *data);
 
         return err;
 }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h b/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
new file mode 100644
index 000000000000..0f2c83bc95dc
--- /dev/null
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (c) 2012 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+
+#ifndef FWIL_TYPES_H_
+#define FWIL_TYPES_H_
+
+#include <linux/if_ether.h>
+
+
+#define BRCMF_FIL_ACTION_FRAME_SIZE     1800
+
+
+enum brcmf_fil_p2p_if_types {
+        BRCMF_FIL_P2P_IF_CLIENT,
+        BRCMF_FIL_P2P_IF_GO,
+        BRCMF_FIL_P2P_IF_DYNBCN_GO,
+        BRCMF_FIL_P2P_IF_DEV,
+};
+
+struct brcmf_fil_p2p_if_le {
+        u8 addr[ETH_ALEN];
+        __le16 type;
+        __le16 chspec;
+};
+
+struct brcmf_fil_chan_info_le {
+        __le32 hw_channel;
+        __le32 target_channel;
+        __le32 scan_channel;
+};
+
+struct brcmf_fil_action_frame_le {
+        u8      da[ETH_ALEN];
+        __le16  len;
+        __le32  packet_id;
+        u8      data[BRCMF_FIL_ACTION_FRAME_SIZE];
+};
+
+struct brcmf_fil_af_params_le {
+        __le32                                  channel;
+        __le32                                  dwell_time;
+        u8                                      bssid[ETH_ALEN];
+        u8                                      pad[2];
+        struct brcmf_fil_action_frame_le        action_frame;
+};
+
+struct brcmf_fil_bss_enable_le {
+        __le32 bsscfg_idx;
+        __le32 enable;
+};
+
+#endif /* FWIL_TYPES_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
new file mode 100644
index 000000000000..4166e642068b
--- /dev/null
+++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
@@ -0,0 +1,2277 @@
+/*
+ * Copyright (c) 2012 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#include <linux/slab.h>
+#include <linux/netdevice.h>
+#include <net/cfg80211.h>
+
+#include <brcmu_wifi.h>
+#include <brcmu_utils.h>
+#include <defs.h>
+#include <dhd.h>
+#include <dhd_dbg.h>
+#include "fwil.h"
+#include "fwil_types.h"
+#include "p2p.h"
+#include "wl_cfg80211.h"
+
+/* parameters used for p2p escan */
+#define P2PAPI_SCAN_NPROBES 1
+#define P2PAPI_SCAN_DWELL_TIME_MS 80
+#define P2PAPI_SCAN_SOCIAL_DWELL_TIME_MS 40
+#define P2PAPI_SCAN_HOME_TIME_MS 60
+#define P2PAPI_SCAN_NPROBS_TIME_MS 30
+#define P2PAPI_SCAN_AF_SEARCH_DWELL_TIME_MS 100
+#define WL_SCAN_CONNECT_DWELL_TIME_MS 200
+#define WL_SCAN_JOIN_PROBE_INTERVAL_MS 20
+
+#define BRCMF_P2P_WILDCARD_SSID         "DIRECT-"
+#define BRCMF_P2P_WILDCARD_SSID_LEN     (sizeof(BRCMF_P2P_WILDCARD_SSID) - 1)
+
+#define SOCIAL_CHAN_1           1
+#define SOCIAL_CHAN_2           6
+#define SOCIAL_CHAN_3           11
+#define IS_P2P_SOCIAL_CHANNEL(channel) ((channel == SOCIAL_CHAN_1) || \
+                                         (channel == SOCIAL_CHAN_2) || \
+                                         (channel == SOCIAL_CHAN_3))
+#define SOCIAL_CHAN_CNT         3
+#define AF_PEER_SEARCH_CNT      2
+
+#define BRCMF_SCB_TIMEOUT_VALUE 20
+
+#define P2P_VER                 9       /* P2P version: 9=WiFi P2P v1.0 */
+#define P2P_PUB_AF_CATEGORY     0x04
+#define P2P_PUB_AF_ACTION       0x09
+#define P2P_AF_CATEGORY         0x7f
+#define P2P_OUI                 "\x50\x6F\x9A"  /* P2P OUI */
+#define P2P_OUI_LEN             3               /* P2P OUI length */
+
+/* Action Frame Constants */
+#define DOT11_ACTION_HDR_LEN    2       /* action frame category + action */
+#define DOT11_ACTION_CAT_OFF    0       /* category offset */
+#define DOT11_ACTION_ACT_OFF    1       /* action offset */
+
+#define P2P_AF_DWELL_TIME               200
+#define P2P_AF_MIN_DWELL_TIME           100
+#define P2P_AF_MED_DWELL_TIME           400
+#define P2P_AF_LONG_DWELL_TIME          1000
+#define P2P_AF_TX_MAX_RETRY             1
+#define P2P_AF_MAX_WAIT_TIME            2000
+#define P2P_INVALID_CHANNEL             -1
+#define P2P_CHANNEL_SYNC_RETRY          5
+#define P2P_AF_FRM_SCAN_MAX_WAIT        1500
+#define P2P_DEFAULT_SLEEP_TIME_VSDB     200
+
+/* WiFi P2P Public Action Frame OUI Subtypes */
+#define P2P_PAF_GON_REQ         0       /* Group Owner Negotiation Req */
+#define P2P_PAF_GON_RSP         1       /* Group Owner Negotiation Rsp */
+#define P2P_PAF_GON_CONF        2       /* Group Owner Negotiation Confirm */
+#define P2P_PAF_INVITE_REQ      3       /* P2P Invitation Request */
+#define P2P_PAF_INVITE_RSP      4       /* P2P Invitation Response */
+#define P2P_PAF_DEVDIS_REQ      5       /* Device Discoverability Request */
+#define P2P_PAF_DEVDIS_RSP      6       /* Device Discoverability Response */
+#define P2P_PAF_PROVDIS_REQ     7       /* Provision Discovery Request */
+#define P2P_PAF_PROVDIS_RSP     8       /* Provision Discovery Response */
+#define P2P_PAF_SUBTYPE_INVALID 255     /* Invalid Subtype */
+
+/* WiFi P2P Action Frame OUI Subtypes */
+#define P2P_AF_NOTICE_OF_ABSENCE        0       /* Notice of Absence */
+#define P2P_AF_PRESENCE_REQ             1       /* P2P Presence Request */
+#define P2P_AF_PRESENCE_RSP             2       /* P2P Presence Response */
+#define P2P_AF_GO_DISC_REQ              3       /* GO Discoverability Request */
+
+/* P2P Service Discovery related */
+#define P2PSD_ACTION_CATEGORY           0x04    /* Public action frame */
+#define P2PSD_ACTION_ID_GAS_IREQ        0x0a    /* GAS Initial Request AF */
+#define P2PSD_ACTION_ID_GAS_IRESP       0x0b    /* GAS Initial Response AF */
+#define P2PSD_ACTION_ID_GAS_CREQ        0x0c    /* GAS Comback Request AF */
+#define P2PSD_ACTION_ID_GAS_CRESP       0x0d    /* GAS Comback Response AF */
+
+/**
+ * struct brcmf_p2p_disc_st_le - set discovery state in firmware.
+ *
+ * @state: requested discovery state (see enum brcmf_p2p_disc_state).
+ * @chspec: channel parameter for %WL_P2P_DISC_ST_LISTEN state.
+ * @dwell: dwell time in ms for %WL_P2P_DISC_ST_LISTEN state.
+ */
+struct brcmf_p2p_disc_st_le {
+        u8 state;
+        __le16 chspec;
+        __le16 dwell;
+};
+
+/**
+ * enum brcmf_p2p_disc_state - P2P discovery state values
+ *
+ * @WL_P2P_DISC_ST_SCAN: P2P discovery with wildcard SSID and P2P IE.
+ * @WL_P2P_DISC_ST_LISTEN: P2P discovery off-channel for specified time.
+ * @WL_P2P_DISC_ST_SEARCH: P2P discovery with P2P wildcard SSID and P2P IE.
+ */
+enum brcmf_p2p_disc_state {
+        WL_P2P_DISC_ST_SCAN,
+        WL_P2P_DISC_ST_LISTEN,
+        WL_P2P_DISC_ST_SEARCH
+};
+
+/**
+ * struct brcmf_p2p_scan_le - P2P specific scan request.
+ *
+ * @type: type of scan method requested (values: 'E' or 'S').
+ * @reserved: reserved (ignored).
+ * @eparams: parameters used for type 'E'.
+ * @sparams: parameters used for type 'S'.
+ */
+struct brcmf_p2p_scan_le {
+        u8 type;
+        u8 reserved[3];
+        union {
+                struct brcmf_escan_params_le eparams;
+                struct brcmf_scan_params_le sparams;
+        };
+};
+
+/**
+ * struct brcmf_p2p_pub_act_frame - WiFi P2P Public Action Frame
+ *
+ * @category: P2P_PUB_AF_CATEGORY
+ * @action: P2P_PUB_AF_ACTION
+ * @oui[3]: P2P_OUI
+ * @oui_type: OUI type - P2P_VER
+ * @subtype: OUI subtype - P2P_TYPE_*
+ * @dialog_token: nonzero, identifies req/rsp transaction
+ * @elts[1]: Variable length information elements.
+ */
+struct brcmf_p2p_pub_act_frame {
+        u8      category;
+        u8      action;
+        u8      oui[3];
+        u8      oui_type;
+        u8      subtype;
+        u8      dialog_token;
+        u8      elts[1];
+};
+
+/**
+ * struct brcmf_p2p_action_frame - WiFi P2P Action Frame
+ *
+ * @category: P2P_AF_CATEGORY
+ * @OUI[3]: OUI - P2P_OUI
+ * @type: OUI Type - P2P_VER
+ * @subtype: OUI Subtype - P2P_AF_*
+ * @dialog_token: nonzero, identifies req/resp tranaction
+ * @elts[1]: Variable length information elements.
+ */
+struct brcmf_p2p_action_frame {
+        u8      category;
+        u8      oui[3];
+        u8      type;
+        u8      subtype;
+        u8      dialog_token;
+        u8      elts[1];
+};
+
+/**
+ * struct brcmf_p2psd_gas_pub_act_frame - Wi-Fi GAS Public Action Frame
+ *
+ * @category: 0x04 Public Action Frame
+ * @action: 0x6c Advertisement Protocol
+ * @dialog_token: nonzero, identifies req/rsp transaction
+ * @query_data[1]: Query Data. SD gas ireq SD gas iresp
+ */
+struct brcmf_p2psd_gas_pub_act_frame {
+        u8      category;
+        u8      action;
+        u8      dialog_token;
+        u8      query_data[1];
+};
+
+/**
+ * struct brcmf_config_af_params - Action Frame Parameters for tx.
+ *
+ * @mpc_onoff: To make sure to send successfully action frame, we have to
+ *             turn off mpc  0: off, 1: on,  (-1): do nothing
+ * @search_channel: 1: search peer's channel to send af
+ * extra_listen: keep the dwell time to get af response frame.
+ */
+struct brcmf_config_af_params {
+        s32 mpc_onoff;
+        bool search_channel;
+        bool extra_listen;
+};
+
+/**
+ * brcmf_p2p_is_pub_action() - true if p2p public type frame.
+ *
+ * @frame: action frame data.
+ * @frame_len: length of action frame data.
+ *
+ * Determine if action frame is p2p public action type
+ */
+static bool brcmf_p2p_is_pub_action(void *frame, u32 frame_len)
+{
+        struct brcmf_p2p_pub_act_frame *pact_frm;
+
+        if (frame == NULL)
+                return false;
+
+        pact_frm = (struct brcmf_p2p_pub_act_frame *)frame;
+        if (frame_len < sizeof(struct brcmf_p2p_pub_act_frame) - 1)
+                return false;
+
+        if (pact_frm->category == P2P_PUB_AF_CATEGORY &&
+            pact_frm->action == P2P_PUB_AF_ACTION &&
+            pact_frm->oui_type == P2P_VER &&
+            memcmp(pact_frm->oui, P2P_OUI, P2P_OUI_LEN) == 0)
+                return true;
+
+        return false;
+}
+
+/**
+ * brcmf_p2p_is_p2p_action() - true if p2p action type frame.
+ *
+ * @frame: action frame data.
+ * @frame_len: length of action frame data.
+ *
+ * Determine if action frame is p2p action type
+ */
+static bool brcmf_p2p_is_p2p_action(void *frame, u32 frame_len)
+{
+        struct brcmf_p2p_action_frame *act_frm;
+
+        if (frame == NULL)
+                return false;
+
+        act_frm = (struct brcmf_p2p_action_frame *)frame;
+        if (frame_len < sizeof(struct brcmf_p2p_action_frame) - 1)
+                return false;
+
+        if (act_frm->category == P2P_AF_CATEGORY &&
+            act_frm->type  == P2P_VER &&
+            memcmp(act_frm->oui, P2P_OUI, P2P_OUI_LEN) == 0)
+                return true;
+
+        return false;
+}
+
+/**
+ * brcmf_p2p_is_gas_action() - true if p2p gas action type frame.
+ *
+ * @frame: action frame data.
+ * @frame_len: length of action frame data.
+ *
+ * Determine if action frame is p2p gas action type
+ */
+static bool brcmf_p2p_is_gas_action(void *frame, u32 frame_len)
+{
+        struct brcmf_p2psd_gas_pub_act_frame *sd_act_frm;
+
+        if (frame == NULL)
+                return false;
+
+        sd_act_frm = (struct brcmf_p2psd_gas_pub_act_frame *)frame;
+        if (frame_len < sizeof(struct brcmf_p2psd_gas_pub_act_frame) - 1)
+                return false;
+
+        if (sd_act_frm->category != P2PSD_ACTION_CATEGORY)
+                return false;
+
+        if (sd_act_frm->action == P2PSD_ACTION_ID_GAS_IREQ ||
+            sd_act_frm->action == P2PSD_ACTION_ID_GAS_IRESP ||
+            sd_act_frm->action == P2PSD_ACTION_ID_GAS_CREQ ||
+            sd_act_frm->action == P2PSD_ACTION_ID_GAS_CRESP)
+                return true;
+
+        return false;
+}
+
+/**
+ * brcmf_p2p_print_actframe() - debug print routine.
+ *
+ * @tx: Received or to be transmitted
+ * @frame: action frame data.
+ * @frame_len: length of action frame data.
+ *
+ * Print information about the p2p action frame
+ */
+
+#ifdef DEBUG
+
+static void brcmf_p2p_print_actframe(bool tx, void *frame, u32 frame_len)
+{
+        struct brcmf_p2p_pub_act_frame *pact_frm;
+        struct brcmf_p2p_action_frame *act_frm;
+        struct brcmf_p2psd_gas_pub_act_frame *sd_act_frm;
+
+        if (!frame || frame_len <= 2)
+                return;
+
+        if (brcmf_p2p_is_pub_action(frame, frame_len)) {
+                pact_frm = (struct brcmf_p2p_pub_act_frame *)frame;
+                switch (pact_frm->subtype) {
+                case P2P_PAF_GON_REQ:
+                        brcmf_dbg(TRACE, "%s P2P Group Owner Negotiation Req Frame\n",
+                                  (tx) ? "TX" : "RX");
+                        break;
+                case P2P_PAF_GON_RSP:
+                        brcmf_dbg(TRACE, "%s P2P Group Owner Negotiation Rsp Frame\n",
+                                  (tx) ? "TX" : "RX");
+                        break;
+                case P2P_PAF_GON_CONF:
+                        brcmf_dbg(TRACE, "%s P2P Group Owner Negotiation Confirm Frame\n",
+                                  (tx) ? "TX" : "RX");
+                        break;
+                case P2P_PAF_INVITE_REQ:
+                        brcmf_dbg(TRACE, "%s P2P Invitation Request  Frame\n",
+                                  (tx) ? "TX" : "RX");
+                        break;
+                case P2P_PAF_INVITE_RSP:
+                        brcmf_dbg(TRACE, "%s P2P Invitation Response Frame\n",
+                                  (tx) ? "TX" : "RX");
+                        break;
+                case P2P_PAF_DEVDIS_REQ:
+                        brcmf_dbg(TRACE, "%s P2P Device Discoverability Request Frame\n",
+                                  (tx) ? "TX" : "RX");
+                        break;
+                case P2P_PAF_DEVDIS_RSP:
+                        brcmf_dbg(TRACE, "%s P2P Device Discoverability Response Frame\n",
+                                  (tx) ? "TX" : "RX");
+                        break;
+                case P2P_PAF_PROVDIS_REQ:
+                        brcmf_dbg(TRACE, "%s P2P Provision Discovery Request Frame\n",
+                                  (tx) ? "TX" : "RX");
+                        break;
+                case P2P_PAF_PROVDIS_RSP:
+                        brcmf_dbg(TRACE, "%s P2P Provision Discovery Response Frame\n",
+                                  (tx) ? "TX" : "RX");
+                        break;
+                default:
+                        brcmf_dbg(TRACE, "%s Unknown P2P Public Action Frame\n",
+                                  (tx) ? "TX" : "RX");
+                        break;
+                }
+        } else if (brcmf_p2p_is_p2p_action(frame, frame_len)) {
+                act_frm = (struct brcmf_p2p_action_frame *)frame;
+                switch (act_frm->subtype) {
+                case P2P_AF_NOTICE_OF_ABSENCE:
+                        brcmf_dbg(TRACE, "%s P2P Notice of Absence Frame\n",
+                                  (tx) ? "TX" : "RX");
+                        break;
+                case P2P_AF_PRESENCE_REQ:
+                        brcmf_dbg(TRACE, "%s P2P Presence Request Frame\n",
+                                  (tx) ? "TX" : "RX");
+                        break;
+                case P2P_AF_PRESENCE_RSP:
+                        brcmf_dbg(TRACE, "%s P2P Presence Response Frame\n",
+                                  (tx) ? "TX" : "RX");
+                        break;
+                case P2P_AF_GO_DISC_REQ:
+                        brcmf_dbg(TRACE, "%s P2P Discoverability Request Frame\n",
+                                  (tx) ? "TX" : "RX");
+                        break;
+                default:
+                        brcmf_dbg(TRACE, "%s Unknown P2P Action Frame\n",
+                                  (tx) ? "TX" : "RX");
+                }
+
+        } else if (brcmf_p2p_is_gas_action(frame, frame_len)) {
+                sd_act_frm = (struct brcmf_p2psd_gas_pub_act_frame *)frame;
+                switch (sd_act_frm->action) {
+                case P2PSD_ACTION_ID_GAS_IREQ:
+                        brcmf_dbg(TRACE, "%s P2P GAS Initial Request\n",
+                                  (tx) ? "TX" : "RX");
+                        break;
+                case P2PSD_ACTION_ID_GAS_IRESP:
+                        brcmf_dbg(TRACE, "%s P2P GAS Initial Response\n",
+                                  (tx) ? "TX" : "RX");
+                        break;
+                case P2PSD_ACTION_ID_GAS_CREQ:
+                        brcmf_dbg(TRACE, "%s P2P GAS Comback Request\n",
+                                  (tx) ? "TX" : "RX");
+                        break;
+                case P2PSD_ACTION_ID_GAS_CRESP:
+                        brcmf_dbg(TRACE, "%s P2P GAS Comback Response\n",
+                                  (tx) ? "TX" : "RX");
+                        break;
+                default:
+                        brcmf_dbg(TRACE, "%s Unknown P2P GAS Frame\n",
+                                  (tx) ? "TX" : "RX");
+                        break;
+                }
+        }
+}
+
+#else
+
+static void brcmf_p2p_print_actframe(bool tx, void *frame, u32 frame_len)
+{
+}
+
+#endif
+
+
+/**
+ * brcmf_p2p_chnr_to_chspec() - convert channel number to chanspec.
+ *
+ * @channel: channel number
+ */
+static u16 brcmf_p2p_chnr_to_chspec(u16 channel)
+{
+        u16 chanspec;
+
+        chanspec = channel & WL_CHANSPEC_CHAN_MASK;
+
+        if (channel <= CH_MAX_2G_CHANNEL)
+                chanspec |= WL_CHANSPEC_BAND_2G;
+        else
+                chanspec |= WL_CHANSPEC_BAND_5G;
+
+        chanspec |= WL_CHANSPEC_BW_20;
+        chanspec |= WL_CHANSPEC_CTL_SB_NONE;
+
+        return chanspec;
+}
+
+
+/**
+ * brcmf_p2p_set_firmware() - prepare firmware for peer-to-peer operation.
+ *
+ * @ifp: ifp to use for iovars (primary).
+ * @p2p_mac: mac address to configure for p2p_da_override
+ */
+static int brcmf_p2p_set_firmware(struct brcmf_if *ifp, u8 *p2p_mac)
+{
+        s32 ret = 0;
+
+        brcmf_fil_iovar_int_set(ifp, "apsta", 1);
+
+        /* In case of COB type, firmware has default mac address
+         * After Initializing firmware, we have to set current mac address to
+         * firmware for P2P device address
+         */
+        ret = brcmf_fil_iovar_data_set(ifp, "p2p_da_override", p2p_mac,
+                                       ETH_ALEN);
+        if (ret)
+                brcmf_err("failed to update device address ret %d\n", ret);
+
+        return ret;
+}
+
+/**
+ * brcmf_p2p_generate_bss_mac() - derive mac addresses for P2P.
+ *
+ * @p2p: P2P specific data.
+ *
+ * P2P needs mac addresses for P2P device and interface. These are
+ * derived from the primary net device, ie. the permanent ethernet
+ * address of the device.
+ */
+static void brcmf_p2p_generate_bss_mac(struct brcmf_p2p_info *p2p)
+{
+        struct brcmf_if *pri_ifp = p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp;
+        struct brcmf_if *p2p_ifp = p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif->ifp;
+
+        /* Generate the P2P Device Address.  This consists of the device's
+         * primary MAC address with the locally administered bit set.
+         */
+        memcpy(p2p->dev_addr, pri_ifp->mac_addr, ETH_ALEN);
+        p2p->dev_addr[0] |= 0x02;
+        memcpy(p2p_ifp->mac_addr, p2p->dev_addr, ETH_ALEN);
+
+        /* Generate the P2P Interface Address.  If the discovery and connection
+         * BSSCFGs need to simultaneously co-exist, then this address must be
+         * different from the P2P Device Address, but also locally administered.
+         */
+        memcpy(p2p->int_addr, p2p->dev_addr, ETH_ALEN);
+        p2p->int_addr[4] ^= 0x80;
+}
+
+/**
+ * brcmf_p2p_scan_is_p2p_request() - is cfg80211 scan request a P2P scan.
+ *
+ * @request: the scan request as received from cfg80211.
+ *
+ * returns true if one of the ssids in the request matches the
+ * P2P wildcard ssid; otherwise returns false.
+ */
+static bool brcmf_p2p_scan_is_p2p_request(struct cfg80211_scan_request *request)
+{
+        struct cfg80211_ssid *ssids = request->ssids;
+        int i;
+
+        for (i = 0; i < request->n_ssids; i++) {
+                if (ssids[i].ssid_len != BRCMF_P2P_WILDCARD_SSID_LEN)
+                        continue;
+
+                brcmf_dbg(INFO, "comparing ssid \"%s\"", ssids[i].ssid);
+                if (!memcmp(BRCMF_P2P_WILDCARD_SSID, ssids[i].ssid,
+                            BRCMF_P2P_WILDCARD_SSID_LEN))
+                        return true;
+        }
+        return false;
+}
+
+/**
+ * brcmf_p2p_set_discover_state - set discover state in firmware.
+ *
+ * @ifp: low-level interface object.
+ * @state: discover state to set.
+ * @chanspec: channel parameters (for state @WL_P2P_DISC_ST_LISTEN only).
+ * @listen_ms: duration to listen (for state @WL_P2P_DISC_ST_LISTEN only).
+ */
+static s32 brcmf_p2p_set_discover_state(struct brcmf_if *ifp, u8 state,
+                                        u16 chanspec, u16 listen_ms)
+{
+        struct brcmf_p2p_disc_st_le discover_state;
+        s32 ret = 0;
+        brcmf_dbg(TRACE, "enter\n");
+
+        discover_state.state = state;
+        discover_state.chspec = cpu_to_le16(chanspec);
+        discover_state.dwell = cpu_to_le16(listen_ms);
+        ret = brcmf_fil_bsscfg_data_set(ifp, "p2p_state", &discover_state,
+                                        sizeof(discover_state));
+        return ret;
+}
+
+/**
+ * brcmf_p2p_deinit_discovery() - disable P2P device discovery.
+ *
+ * @p2p: P2P specific data.
+ *
+ * Resets the discovery state and disables it in firmware.
+ */
+static s32 brcmf_p2p_deinit_discovery(struct brcmf_p2p_info *p2p)
+{
+        struct brcmf_cfg80211_vif *vif;
+
+        brcmf_dbg(TRACE, "enter\n");
+
+        /* Set the discovery state to SCAN */
+        vif = p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
+        (void)brcmf_p2p_set_discover_state(vif->ifp, WL_P2P_DISC_ST_SCAN, 0, 0);
+
+        /* Disable P2P discovery in the firmware */
+        vif = p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY].vif;
+        (void)brcmf_fil_iovar_int_set(vif->ifp, "p2p_disc", 0);
+
+        return 0;
+}
+
+/**
+ * brcmf_p2p_enable_discovery() - initialize and configure discovery.
+ *
+ * @p2p: P2P specific data.
+ *
+ * Initializes the discovery device and configure the virtual interface.
+ */
+static int brcmf_p2p_enable_discovery(struct brcmf_p2p_info *p2p)
+{
+        struct brcmf_cfg80211_vif *vif;
+        s32 ret = 0;
+
+        brcmf_dbg(TRACE, "enter\n");
+        vif = p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
+        if (!vif) {
+                brcmf_err("P2P config device not available\n");
+                ret = -EPERM;
+                goto exit;
+        }
+
+        if (test_bit(BRCMF_P2P_STATUS_ENABLED, &p2p->status)) {
+                brcmf_dbg(INFO, "P2P config device already configured\n");
+                goto exit;
+        }
+
+        /* Re-initialize P2P Discovery in the firmware */
+        vif = p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY].vif;
+        ret = brcmf_fil_iovar_int_set(vif->ifp, "p2p_disc", 1);
+        if (ret < 0) {
+                brcmf_err("set p2p_disc error\n");
+                goto exit;
+        }
+        vif = p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
+        ret = brcmf_p2p_set_discover_state(vif->ifp, WL_P2P_DISC_ST_SCAN, 0, 0);
+        if (ret < 0) {
+                brcmf_err("unable to set WL_P2P_DISC_ST_SCAN\n");
+                goto exit;
+        }
+
+        /*
+         * Set wsec to any non-zero value in the discovery bsscfg
+         * to ensure our P2P probe responses have the privacy bit
+         * set in the 802.11 WPA IE. Some peer devices may not
+         * initiate WPS with us if this bit is not set.
+         */
+        ret = brcmf_fil_bsscfg_int_set(vif->ifp, "wsec", AES_ENABLED);
+        if (ret < 0) {
+                brcmf_err("wsec error %d\n", ret);
+                goto exit;
+        }
+
+        set_bit(BRCMF_P2P_STATUS_ENABLED, &p2p->status);
+exit:
+        return ret;
+}
+
+/**
+ * brcmf_p2p_escan() - initiate a P2P scan.
+ *
+ * @p2p: P2P specific data.
+ * @num_chans: number of channels to scan.
+ * @chanspecs: channel parameters for @num_chans channels.
+ * @search_state: P2P discover state to use.
+ * @action: scan action to pass to firmware.
+ * @bss_type: type of P2P bss.
+ */
+static s32 brcmf_p2p_escan(struct brcmf_p2p_info *p2p, u32 num_chans,
+                           u16 chanspecs[], s32 search_state, u16 action,
+                           enum p2p_bss_type bss_type)
+{
+        s32 ret = 0;
+        s32 memsize = offsetof(struct brcmf_p2p_scan_le,
+                               eparams.params_le.channel_list);
+        s32 nprobes;
+        s32 active;
+        u32 i;
+        u8 *memblk;
+        struct brcmf_cfg80211_vif *vif;
+        struct brcmf_p2p_scan_le *p2p_params;
+        struct brcmf_scan_params_le *sparams;
+        struct brcmf_ssid ssid;
+
+        memsize += num_chans * sizeof(__le16);
+        memblk = kzalloc(memsize, GFP_KERNEL);
+        if (!memblk)
+                return -ENOMEM;
+
+        vif = p2p->bss_idx[bss_type].vif;
+        if (vif == NULL) {
+                brcmf_err("no vif for bss type %d\n", bss_type);
+                ret = -EINVAL;
+                goto exit;
+        }
+
+        switch (search_state) {
+        case WL_P2P_DISC_ST_SEARCH:
+                /*
+                 * If we in SEARCH STATE, we don't need to set SSID explictly
+                 * because dongle use P2P WILDCARD internally by default
+                 */
+                /* use null ssid */
+                ssid.SSID_len = 0;
+                memset(ssid.SSID, 0, sizeof(ssid.SSID));
+                break;
+        case WL_P2P_DISC_ST_SCAN:
+                /*
+                 * wpa_supplicant has p2p_find command with type social or
+                 * progressive. For progressive, we need to set the ssid to
+                 * P2P WILDCARD because we just do broadcast scan unless
+                 * setting SSID.
+                 */
+                ssid.SSID_len = BRCMF_P2P_WILDCARD_SSID_LEN;
+                memcpy(ssid.SSID, BRCMF_P2P_WILDCARD_SSID, ssid.SSID_len);
+                break;
+        default:
+                brcmf_err(" invalid search state %d\n", search_state);
+                ret = -EINVAL;
+                goto exit;
+        }
+
+        brcmf_p2p_set_discover_state(vif->ifp, search_state, 0, 0);
+
+        /*
+         * set p2p scan parameters.
+         */
+        p2p_params = (struct brcmf_p2p_scan_le *)memblk;
+        p2p_params->type = 'E';
+
+        /* determine the scan engine parameters */
+        sparams = &p2p_params->eparams.params_le;
+        sparams->bss_type = DOT11_BSSTYPE_ANY;
+        if (p2p->cfg->active_scan)
+                sparams->scan_type = 0;
+        else
+                sparams->scan_type = 1;
+
+        memset(&sparams->bssid, 0xFF, ETH_ALEN);
+        if (ssid.SSID_len)
+                memcpy(sparams->ssid_le.SSID, ssid.SSID, ssid.SSID_len);
+        sparams->ssid_le.SSID_len = cpu_to_le32(ssid.SSID_len);
+        sparams->home_time = cpu_to_le32(P2PAPI_SCAN_HOME_TIME_MS);
+
+        /*
+         * SOCIAL_CHAN_CNT + 1 takes care of the Progressive scan
+         * supported by the supplicant.
+         */
+        if (num_chans == SOCIAL_CHAN_CNT || num_chans == (SOCIAL_CHAN_CNT + 1))
+                active = P2PAPI_SCAN_SOCIAL_DWELL_TIME_MS;
+        else if (num_chans == AF_PEER_SEARCH_CNT)
+                active = P2PAPI_SCAN_AF_SEARCH_DWELL_TIME_MS;
+        else if (wl_get_vif_state_all(p2p->cfg, BRCMF_VIF_STATUS_CONNECTED))
+                active = -1;
+        else
+                active = P2PAPI_SCAN_DWELL_TIME_MS;
+
+        /* Override scan params to find a peer for a connection */
+        if (num_chans == 1) {
+                active = WL_SCAN_CONNECT_DWELL_TIME_MS;
+                /* WAR to sync with presence period of VSDB GO.
+                 * send probe request more frequently
+                 */
+                nprobes = active / WL_SCAN_JOIN_PROBE_INTERVAL_MS;
+        } else {
+                nprobes = active / P2PAPI_SCAN_NPROBS_TIME_MS;
+        }
+
+        if (nprobes <= 0)
+                nprobes = 1;
+
+        brcmf_dbg(INFO, "nprobes # %d, active_time %d\n", nprobes, active);
+        sparams->active_time = cpu_to_le32(active);
+        sparams->nprobes = cpu_to_le32(nprobes);
+        sparams->passive_time = cpu_to_le32(-1);
+        sparams->channel_num = cpu_to_le32(num_chans &
+                                           BRCMF_SCAN_PARAMS_COUNT_MASK);
+        for (i = 0; i < num_chans; i++)
+                sparams->channel_list[i] = cpu_to_le16(chanspecs[i]);
+
+        /* set the escan specific parameters */
+        p2p_params->eparams.version = cpu_to_le32(BRCMF_ESCAN_REQ_VERSION);
+        p2p_params->eparams.action =  cpu_to_le16(action);
+        p2p_params->eparams.sync_id = cpu_to_le16(0x1234);
+        /* perform p2p scan on primary device */
+        ret = brcmf_fil_bsscfg_data_set(vif->ifp, "p2p_scan", memblk, memsize);
+        if (!ret)
+                set_bit(BRCMF_SCAN_STATUS_BUSY, &p2p->cfg->scan_status);
+exit:
+        kfree(memblk);
+        return ret;
+}
+
+/**
+ * brcmf_p2p_run_escan() - escan callback for peer-to-peer.
+ *
+ * @cfg: driver private data for cfg80211 interface.
+ * @ndev: net device for which scan is requested.
+ * @request: scan request from cfg80211.
+ * @action: scan action.
+ *
+ * Determines the P2P discovery state based to scan request parameters and
+ * validates the channels in the request.
+ */
+static s32 brcmf_p2p_run_escan(struct brcmf_cfg80211_info *cfg,
+                               struct net_device *ndev,
+                               struct cfg80211_scan_request *request,
+                               u16 action)
+{
+        struct brcmf_p2p_info *p2p = &cfg->p2p;
+        s32 err = 0;
+        s32 search_state = WL_P2P_DISC_ST_SCAN;
+        struct brcmf_cfg80211_vif *vif;
+        struct net_device *dev = NULL;
+        int i, num_nodfs = 0;
+        u16 *chanspecs;
+
+        brcmf_dbg(TRACE, "enter\n");
+
+        if (!request) {
+                err = -EINVAL;
+                goto exit;
+        }
+
+        if (request->n_channels) {
+                chanspecs = kcalloc(request->n_channels, sizeof(*chanspecs),
+                                    GFP_KERNEL);
+                if (!chanspecs) {
+                        err = -ENOMEM;
+                        goto exit;
+                }
+                vif = p2p->bss_idx[P2PAPI_BSSCFG_CONNECTION].vif;
+                if (vif)
+                        dev = vif->wdev.netdev;
+                if (request->n_channels == 3 &&
+                    request->channels[0]->hw_value == SOCIAL_CHAN_1 &&
+                    request->channels[1]->hw_value == SOCIAL_CHAN_2 &&
+                    request->channels[2]->hw_value == SOCIAL_CHAN_3) {
+                        /* SOCIAL CHANNELS 1, 6, 11 */
+                        search_state = WL_P2P_DISC_ST_SEARCH;
+                        brcmf_dbg(INFO, "P2P SEARCH PHASE START\n");
+                } else if (dev != NULL && vif->mode == WL_MODE_AP) {
+                        /* If you are already a GO, then do SEARCH only */
+                        brcmf_dbg(INFO, "Already a GO. Do SEARCH Only\n");
+                        search_state = WL_P2P_DISC_ST_SEARCH;
+                } else {
+                        brcmf_dbg(INFO, "P2P SCAN STATE START\n");
+                }
+
+                /*
+                 * no P2P scanning on passive or DFS channels.
+                 */
+                for (i = 0; i < request->n_channels; i++) {
+                        struct ieee80211_channel *chan = request->channels[i];
+
+                        if (chan->flags & (IEEE80211_CHAN_RADAR |
+                                           IEEE80211_CHAN_PASSIVE_SCAN))
+                                continue;
+
+                        chanspecs[i] = channel_to_chanspec(chan);
+                        brcmf_dbg(INFO, "%d: chan=%d, channel spec=%x\n",
+                                  num_nodfs, chan->hw_value, chanspecs[i]);
+                        num_nodfs++;
+                }
+                err = brcmf_p2p_escan(p2p, num_nodfs, chanspecs, search_state,
+                                      action, P2PAPI_BSSCFG_DEVICE);
+        }
+exit:
+        if (err)
+                brcmf_err("error (%d)\n", err);
+        return err;
+}
+
+
+/**
+ * brcmf_p2p_find_listen_channel() - find listen channel in ie string.
+ *
+ * @ie: string of information elements.
+ * @ie_len: length of string.
+ *
+ * Scan ie for p2p ie and look for attribute 6 channel. If available determine
+ * channel and return it.
+ */
+static s32 brcmf_p2p_find_listen_channel(const u8 *ie, u32 ie_len)
+{
+        u8 channel_ie[5];
+        s32 listen_channel;
+        s32 err;
+
+        err = cfg80211_get_p2p_attr(ie, ie_len,
+                                    IEEE80211_P2P_ATTR_LISTEN_CHANNEL,
+                                    channel_ie, sizeof(channel_ie));
+        if (err < 0)
+                return err;
+
+        /* listen channel subel length format:     */
+        /* 3(country) + 1(op. class) + 1(chan num) */
+        listen_channel = (s32)channel_ie[3 + 1];
+
+        if (listen_channel == SOCIAL_CHAN_1 ||
+            listen_channel == SOCIAL_CHAN_2 ||
+            listen_channel == SOCIAL_CHAN_3) {
+                brcmf_dbg(INFO, "Found my Listen Channel %d\n", listen_channel);
+                return listen_channel;
+        }
+
+        return -EPERM;
+}
+
+
+/**
+ * brcmf_p2p_scan_prep() - prepare scan based on request.
+ *
+ * @wiphy: wiphy device.
+ * @request: scan request from cfg80211.
+ * @vif: vif on which scan request is to be executed.
+ *
+ * Prepare the scan appropriately for type of scan requested. Overrides the
+ * escan .run() callback for peer-to-peer scanning.
+ */
+int brcmf_p2p_scan_prep(struct wiphy *wiphy,
+                        struct cfg80211_scan_request *request,
+                        struct brcmf_cfg80211_vif *vif)
+{
+        struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+        struct brcmf_p2p_info *p2p = &cfg->p2p;
+        int err = 0;
+
+        if (brcmf_p2p_scan_is_p2p_request(request)) {
+                /* find my listen channel */
+                err = brcmf_p2p_find_listen_channel(request->ie,
+                                                    request->ie_len);
+                if (err < 0)
+                        return err;
+
+                p2p->afx_hdl.my_listen_chan = err;
+
+                clear_bit(BRCMF_P2P_STATUS_GO_NEG_PHASE, &p2p->status);
+                brcmf_dbg(INFO, "P2P: GO_NEG_PHASE status cleared\n");
+
+                err = brcmf_p2p_enable_discovery(p2p);
+                if (err)
+                        return err;
+
+                vif = p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
+
+                /* override .run_escan() callback. */
+                cfg->escan_info.run = brcmf_p2p_run_escan;
+        }
+        err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_PRBREQ_FLAG,
+                                    request->ie, request->ie_len);
+        return err;
+}
+
+
+/**
+ * brcmf_p2p_discover_listen() - set firmware to discover listen state.
+ *
+ * @p2p: p2p device.
+ * @channel: channel nr for discover listen.
+ * @duration: time in ms to stay on channel.
+ *
+ */
+static s32
+brcmf_p2p_discover_listen(struct brcmf_p2p_info *p2p, u16 channel, u32 duration)
+{
+        struct brcmf_cfg80211_vif *vif;
+        s32 err = 0;
+        u16 chanspec;
+
+        vif = p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
+        if (!vif) {
+                brcmf_err("Discovery is not set, so we have nothing to do\n");
+                err = -EPERM;
+                goto exit;
+        }
+
+        if (test_bit(BRCMF_P2P_STATUS_DISCOVER_LISTEN, &p2p->status)) {
+                brcmf_err("Previous LISTEN is not completed yet\n");
+                /* WAR: prevent cookie mismatch in wpa_supplicant return OK */
+                goto exit;
+        }
+
+        chanspec = brcmf_p2p_chnr_to_chspec(channel);
+        err = brcmf_p2p_set_discover_state(vif->ifp, WL_P2P_DISC_ST_LISTEN,
+                                           chanspec, (u16)duration);
+        if (!err) {
+                set_bit(BRCMF_P2P_STATUS_DISCOVER_LISTEN, &p2p->status);
+                p2p->remain_on_channel_cookie++;
+        }
+exit:
+        return err;
+}
+
+
+/**
+ * brcmf_p2p_remain_on_channel() - put device on channel and stay there.
+ *
+ * @wiphy: wiphy device.
+ * @channel: channel to stay on.
+ * @duration: time in ms to remain on channel.
+ *
+ */
+int brcmf_p2p_remain_on_channel(struct wiphy *wiphy, struct wireless_dev *wdev,
+                                struct ieee80211_channel *channel,
+                                unsigned int duration, u64 *cookie)
+{
+        struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+        struct brcmf_p2p_info *p2p = &cfg->p2p;
+        s32 err;
+        u16 channel_nr;
+
+        channel_nr = ieee80211_frequency_to_channel(channel->center_freq);
+        brcmf_dbg(TRACE, "Enter, channel: %d, duration ms (%d)\n", channel_nr,
+                  duration);
+
+        err = brcmf_p2p_enable_discovery(p2p);
+        if (err)
+                goto exit;
+        err = brcmf_p2p_discover_listen(p2p, channel_nr, duration);
+        if (err)
+                goto exit;
+
+        memcpy(&p2p->remain_on_channel, channel, sizeof(*channel));
+        *cookie = p2p->remain_on_channel_cookie;
+        cfg80211_ready_on_channel(wdev, *cookie, channel, duration, GFP_KERNEL);
+
+exit:
+        return err;
+}
+
+
+/**
+ * brcmf_p2p_notify_listen_complete() - p2p listen has completed.
+ *
+ * @ifp: interfac control.
+ * @e: event message. Not used, to make it usable for fweh event dispatcher.
+ * @data: payload of message. Not used.
+ *
+ */
+int brcmf_p2p_notify_listen_complete(struct brcmf_if *ifp,
+                                     const struct brcmf_event_msg *e,
+                                     void *data)
+{
+        struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
+        struct brcmf_p2p_info *p2p = &cfg->p2p;
+
+        brcmf_dbg(TRACE, "Enter\n");
+        if (test_and_clear_bit(BRCMF_P2P_STATUS_DISCOVER_LISTEN,
+                               &p2p->status)) {
+                if (test_and_clear_bit(BRCMF_P2P_STATUS_WAITING_NEXT_AF_LISTEN,
+                                       &p2p->status)) {
+                        clear_bit(BRCMF_P2P_STATUS_WAITING_NEXT_ACT_FRAME,
+                                  &p2p->status);
+                        brcmf_dbg(INFO, "Listen DONE, wake up wait_next_af\n");
+                        complete(&p2p->wait_next_af);
+                }
+
+                cfg80211_remain_on_channel_expired(&ifp->vif->wdev,
+                                                   p2p->remain_on_channel_cookie,
+                                                   &p2p->remain_on_channel,
+                                                   GFP_KERNEL);
+        }
+        return 0;
+}
+
+
+/**
+ * brcmf_p2p_cancel_remain_on_channel() - cancel p2p listen state.
+ *
+ * @ifp: interfac control.
+ *
+ */
+void brcmf_p2p_cancel_remain_on_channel(struct brcmf_if *ifp)
+{
+        if (!ifp)
+                return;
+        brcmf_p2p_set_discover_state(ifp, WL_P2P_DISC_ST_SCAN, 0, 0);
+        brcmf_p2p_notify_listen_complete(ifp, NULL, NULL);
+}
+
+
+/**
+ * brcmf_p2p_act_frm_search() - search function for action frame.
+ *
+ * @p2p: p2p device.
+ * channel: channel on which action frame is to be trasmitted.
+ *
+ * search function to reach at common channel to send action frame. When
+ * channel is 0 then all social channels will be used to send af
+ */
+static s32 brcmf_p2p_act_frm_search(struct brcmf_p2p_info *p2p, u16 channel)
+{
+        s32 err;
+        u32 channel_cnt;
+        u16 *default_chan_list;
+        u32 i;
+
+        brcmf_dbg(TRACE, "Enter\n");
+
+        if (channel)
+                channel_cnt = AF_PEER_SEARCH_CNT;
+        else
+                channel_cnt = SOCIAL_CHAN_CNT;
+        default_chan_list = kzalloc(channel_cnt * sizeof(*default_chan_list),
+                                    GFP_KERNEL);
+        if (default_chan_list == NULL) {
+                brcmf_err("channel list allocation failed\n");
+                err = -ENOMEM;
+                goto exit;
+        }
+        if (channel) {
+                /* insert same channel to the chan_list */
+                for (i = 0; i < channel_cnt; i++)
+                        default_chan_list[i] =
+                                        brcmf_p2p_chnr_to_chspec(channel);
+        } else {
+                default_chan_list[0] = brcmf_p2p_chnr_to_chspec(SOCIAL_CHAN_1);
+                default_chan_list[1] = brcmf_p2p_chnr_to_chspec(SOCIAL_CHAN_2);
+                default_chan_list[2] = brcmf_p2p_chnr_to_chspec(SOCIAL_CHAN_3);
+        }
+        err = brcmf_p2p_escan(p2p, channel_cnt, default_chan_list,
+                              WL_P2P_DISC_ST_SEARCH, WL_ESCAN_ACTION_START,
+                              P2PAPI_BSSCFG_DEVICE);
+        kfree(default_chan_list);
+exit:
+        return err;
+}
+
+
+/**
+ * brcmf_p2p_afx_handler() - afx worker thread.
+ *
+ * @work:
+ *
+ */
+static void brcmf_p2p_afx_handler(struct work_struct *work)
+{
+        struct afx_hdl *afx_hdl = container_of(work, struct afx_hdl, afx_work);
+        struct brcmf_p2p_info *p2p = container_of(afx_hdl,
+                                                  struct brcmf_p2p_info,
+                                                  afx_hdl);
+        s32 err;
+
+        if (!afx_hdl->is_active)
+                return;
+
+        if (afx_hdl->is_listen && afx_hdl->my_listen_chan)
+                /* 100ms ~ 300ms */
+                err = brcmf_p2p_discover_listen(p2p, afx_hdl->my_listen_chan,
+                                                100 * (1 + (random32() % 3)));
+        else
+                err = brcmf_p2p_act_frm_search(p2p, afx_hdl->peer_listen_chan);
+
+        if (err) {
+                brcmf_err("ERROR occurred! value is (%d)\n", err);
+                if (test_bit(BRCMF_P2P_STATUS_FINDING_COMMON_CHANNEL,
+                             &p2p->status))
+                        complete(&afx_hdl->act_frm_scan);
+        }
+}
+
+
+/**
+ * brcmf_p2p_af_searching_channel() - search channel.
+ *
+ * @p2p: p2p device info struct.
+ *
+ */
+static s32 brcmf_p2p_af_searching_channel(struct brcmf_p2p_info *p2p)
+{
+        struct afx_hdl *afx_hdl = &p2p->afx_hdl;
+        struct brcmf_cfg80211_vif *pri_vif;
+        unsigned long duration;
+        s32 retry;
+
+        brcmf_dbg(TRACE, "Enter\n");
+
+        pri_vif = p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY].vif;
+
+        INIT_COMPLETION(afx_hdl->act_frm_scan);
+        set_bit(BRCMF_P2P_STATUS_FINDING_COMMON_CHANNEL, &p2p->status);
+        afx_hdl->is_active = true;
+        afx_hdl->peer_chan = P2P_INVALID_CHANNEL;
+
+        /* Loop to wait until we find a peer's channel or the
+         * pending action frame tx is cancelled.
+         */
+        retry = 0;
+        duration = msecs_to_jiffies(P2P_AF_FRM_SCAN_MAX_WAIT);
+        while ((retry < P2P_CHANNEL_SYNC_RETRY) &&
+               (afx_hdl->peer_chan == P2P_INVALID_CHANNEL)) {
+                afx_hdl->is_listen = false;
+                brcmf_dbg(TRACE, "Scheduling action frame for sending.. (%d)\n",
+                          retry);
+                /* search peer on peer's listen channel */
+                schedule_work(&afx_hdl->afx_work);
+                wait_for_completion_timeout(&afx_hdl->act_frm_scan, duration);
+                if ((afx_hdl->peer_chan != P2P_INVALID_CHANNEL) ||
+                    (!test_bit(BRCMF_P2P_STATUS_FINDING_COMMON_CHANNEL,
+                               &p2p->status)))
+                        break;
+
+                if (afx_hdl->my_listen_chan) {
+                        brcmf_dbg(TRACE, "Scheduling listen peer, channel=%d\n",
+                                  afx_hdl->my_listen_chan);
+                        /* listen on my listen channel */
+                        afx_hdl->is_listen = true;
+                        schedule_work(&afx_hdl->afx_work);
+                        wait_for_completion_timeout(&afx_hdl->act_frm_scan,
+                                                    duration);
+                }
+                if ((afx_hdl->peer_chan != P2P_INVALID_CHANNEL) ||
+                    (!test_bit(BRCMF_P2P_STATUS_FINDING_COMMON_CHANNEL,
+                               &p2p->status)))
+                        break;
+                retry++;
+
+                /* if sta is connected or connecting, sleep for a while before
+                 * retry af tx or finding a peer
+                 */
+                if (test_bit(BRCMF_VIF_STATUS_CONNECTED, &pri_vif->sme_state) ||
+                    test_bit(BRCMF_VIF_STATUS_CONNECTING, &pri_vif->sme_state))
+                        msleep(P2P_DEFAULT_SLEEP_TIME_VSDB);
+        }
+
+        brcmf_dbg(TRACE, "Completed search/listen peer_chan=%d\n",
+                  afx_hdl->peer_chan);
+        afx_hdl->is_active = false;
+
+        clear_bit(BRCMF_P2P_STATUS_FINDING_COMMON_CHANNEL, &p2p->status);
+
+        return afx_hdl->peer_chan;
+}
+
+
+/**
+ * brcmf_p2p_scan_finding_common_channel() - was escan used for finding channel
+ *
+ * @cfg: common configuration struct.
+ * @bi: bss info struct, result from scan.
+ *
+ */
+bool brcmf_p2p_scan_finding_common_channel(struct brcmf_cfg80211_info *cfg,
+                                           struct brcmf_bss_info_le *bi)
+
+{
+        struct brcmf_p2p_info *p2p = &cfg->p2p;
+        struct afx_hdl *afx_hdl = &p2p->afx_hdl;
+        u8 *ie;
+        s32 err;
+        u8 p2p_dev_addr[ETH_ALEN];
+
+        if (!test_bit(BRCMF_P2P_STATUS_FINDING_COMMON_CHANNEL, &p2p->status))
+                return false;
+
+        if (bi == NULL) {
+                brcmf_dbg(TRACE, "ACTION FRAME SCAN Done\n");
+                if (afx_hdl->peer_chan == P2P_INVALID_CHANNEL)
+                        complete(&afx_hdl->act_frm_scan);
+                return true;
+        }
+
+        ie = ((u8 *)bi) + le16_to_cpu(bi->ie_offset);
+        memset(p2p_dev_addr, 0, sizeof(p2p_dev_addr));
+        err = cfg80211_get_p2p_attr(ie, le32_to_cpu(bi->ie_length),
+                                    IEEE80211_P2P_ATTR_DEVICE_INFO,
+                                    p2p_dev_addr, sizeof(p2p_dev_addr));
+        if (err < 0)
+                err = cfg80211_get_p2p_attr(ie, le32_to_cpu(bi->ie_length),
+                                            IEEE80211_P2P_ATTR_DEVICE_ID,
+                                            p2p_dev_addr, sizeof(p2p_dev_addr));
+        if ((err >= 0) &&
+            (!memcmp(p2p_dev_addr, afx_hdl->tx_dst_addr, ETH_ALEN))) {
+                afx_hdl->peer_chan = bi->ctl_ch ? bi->ctl_ch :
+                                      CHSPEC_CHANNEL(le16_to_cpu(bi->chanspec));
+                brcmf_dbg(TRACE, "ACTION FRAME SCAN : Peer %pM found, channel : %d\n",
+                          afx_hdl->tx_dst_addr, afx_hdl->peer_chan);
+                complete(&afx_hdl->act_frm_scan);
+        }
+        return true;
+}
+
+/**
+ * brcmf_p2p_stop_wait_next_action_frame() - finish scan if af tx complete.
+ *
+ * @cfg: common configuration struct.
+ *
+ */
+static void
+brcmf_p2p_stop_wait_next_action_frame(struct brcmf_cfg80211_info *cfg)
+{
+        struct brcmf_p2p_info *p2p = &cfg->p2p;
+        struct net_device *ndev = cfg->escan_info.ndev;
+
+        if (test_bit(BRCMF_P2P_STATUS_SENDING_ACT_FRAME, &p2p->status) &&
+            (test_bit(BRCMF_P2P_STATUS_ACTION_TX_COMPLETED, &p2p->status) ||
+             test_bit(BRCMF_P2P_STATUS_ACTION_TX_NOACK, &p2p->status))) {
+                brcmf_dbg(TRACE, "*** Wake UP ** abort actframe iovar\n");
+                /* if channel is not zero, "actfame" uses off channel scan.
+                 * So abort scan for off channel completion.
+                 */
+                if (p2p->af_sent_channel)
+                        brcmf_notify_escan_complete(cfg, ndev, true, true);
+        } else if (test_bit(BRCMF_P2P_STATUS_WAITING_NEXT_AF_LISTEN,
+                            &p2p->status)) {
+                brcmf_dbg(TRACE, "*** Wake UP ** abort listen for next af frame\n");
+                /* So abort scan to cancel listen */
+                brcmf_notify_escan_complete(cfg, ndev, true, true);
+        }
+}
+
+
+/**
+ * brcmf_p2p_gon_req_collision() - Check if go negotiaton collission
+ *
+ * @p2p: p2p device info struct.
+ *
+ * return true if recevied action frame is to be dropped.
+ */
+static bool
+brcmf_p2p_gon_req_collision(struct brcmf_p2p_info *p2p, u8 *mac)
+{
+        struct brcmf_cfg80211_info *cfg = p2p->cfg;
+        struct brcmf_if *ifp;
+
+        brcmf_dbg(TRACE, "Enter\n");
+
+        if (!test_bit(BRCMF_P2P_STATUS_WAITING_NEXT_ACT_FRAME, &p2p->status) ||
+            !p2p->gon_req_action)
+                return false;
+
+        brcmf_dbg(TRACE, "GO Negotiation Request COLLISION !!!\n");
+        /* if sa(peer) addr is less than da(my) addr, then this device
+         * process peer's gon request and block to send gon req.
+         * if not (sa addr > da addr),
+         * this device will process gon request and drop gon req of peer.
+         */
+        ifp = p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif->ifp;
+        if (memcmp(mac, ifp->mac_addr, ETH_ALEN) < 0) {
+                brcmf_dbg(INFO, "Block transmit gon req !!!\n");
+                p2p->block_gon_req_tx = true;
+                /* if we are finding a common channel for sending af,
+                 * do not scan more to block to send current gon req
+                 */
+                if (test_and_clear_bit(BRCMF_P2P_STATUS_FINDING_COMMON_CHANNEL,
+                                       &p2p->status))
+                        complete(&p2p->afx_hdl.act_frm_scan);
+                if (test_and_clear_bit(BRCMF_P2P_STATUS_WAITING_NEXT_ACT_FRAME,
+                                       &p2p->status))
+                        brcmf_p2p_stop_wait_next_action_frame(cfg);
+                return false;
+        }
+
+        /* drop gon request of peer to process gon request by this device. */
+        brcmf_dbg(INFO, "Drop received gon req !!!\n");
+
+        return true;
+}
+
+
+/**
+ * brcmf_p2p_notify_action_frame_rx() - received action frame.
+ *
+ * @ifp: interfac control.
+ * @e: event message. Not used, to make it usable for fweh event dispatcher.
+ * @data: payload of message, containing action frame data.
+ *
+ */
+int brcmf_p2p_notify_action_frame_rx(struct brcmf_if *ifp,
+                                     const struct brcmf_event_msg *e,
+                                     void *data)
+{
+        struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
+        struct brcmf_p2p_info *p2p = &cfg->p2p;
+        struct afx_hdl *afx_hdl = &p2p->afx_hdl;
+        struct wireless_dev *wdev;
+        u32 mgmt_frame_len = e->datalen - sizeof(struct brcmf_rx_mgmt_data);
+        struct brcmf_rx_mgmt_data *rxframe = (struct brcmf_rx_mgmt_data *)data;
+        u8 *frame = (u8 *)(rxframe + 1);
+        struct brcmf_p2p_pub_act_frame *act_frm;
+        struct brcmf_p2psd_gas_pub_act_frame *sd_act_frm;
+        u16 chanspec = be16_to_cpu(rxframe->chanspec);
+        struct ieee80211_mgmt *mgmt_frame;
+        s32 freq;
+        u16 mgmt_type;
+        u8 action;
+
+        /* Check if wpa_supplicant has registered for this frame */
+        brcmf_dbg(INFO, "ifp->vif->mgmt_rx_reg %04x\n", ifp->vif->mgmt_rx_reg);
+        mgmt_type = (IEEE80211_STYPE_ACTION & IEEE80211_FCTL_STYPE) >> 4;
+        if ((ifp->vif->mgmt_rx_reg & BIT(mgmt_type)) == 0)
+                return 0;
+
+        brcmf_p2p_print_actframe(false, frame, mgmt_frame_len);
+
+        action = P2P_PAF_SUBTYPE_INVALID;
+        if (brcmf_p2p_is_pub_action(frame, mgmt_frame_len)) {
+                act_frm = (struct brcmf_p2p_pub_act_frame *)frame;
+                action = act_frm->subtype;
+                if ((action == P2P_PAF_GON_REQ) &&
+                    (brcmf_p2p_gon_req_collision(p2p, (u8 *)e->addr))) {
+                        if (test_bit(BRCMF_P2P_STATUS_FINDING_COMMON_CHANNEL,
+                                     &p2p->status) &&
+                            (memcmp(afx_hdl->tx_dst_addr, e->addr,
+                                    ETH_ALEN) == 0)) {
+                                afx_hdl->peer_chan = CHSPEC_CHANNEL(chanspec);
+                                brcmf_dbg(INFO, "GON request: Peer found, channel=%d\n",
+                                          afx_hdl->peer_chan);
+                                complete(&afx_hdl->act_frm_scan);
+                        }
+                        return 0;
+                }
+                /* After complete GO Negotiation, roll back to mpc mode */
+                if ((action == P2P_PAF_GON_CONF) ||
+                    (action == P2P_PAF_PROVDIS_RSP))
+                        brcmf_set_mpc(ifp->ndev, 1);
+                if (action == P2P_PAF_GON_CONF) {
+                        brcmf_dbg(TRACE, "P2P: GO_NEG_PHASE status cleared\n");
+                        clear_bit(BRCMF_P2P_STATUS_GO_NEG_PHASE, &p2p->status);
+                }
+        } else if (brcmf_p2p_is_gas_action(frame, mgmt_frame_len)) {
+                sd_act_frm = (struct brcmf_p2psd_gas_pub_act_frame *)frame;
+                action = sd_act_frm->action;
+        }
+
+        if (test_bit(BRCMF_P2P_STATUS_WAITING_NEXT_ACT_FRAME, &p2p->status) &&
+            (p2p->next_af_subtype == action)) {
+                brcmf_dbg(TRACE, "We got a right next frame! (%d)\n", action);
+                clear_bit(BRCMF_P2P_STATUS_WAITING_NEXT_ACT_FRAME,
+                          &p2p->status);
+                /* Stop waiting for next AF. */
+                brcmf_p2p_stop_wait_next_action_frame(cfg);
+        }
+
+        mgmt_frame = kzalloc(offsetof(struct ieee80211_mgmt, u) +
+                             mgmt_frame_len, GFP_KERNEL);
+        if (!mgmt_frame) {
+                brcmf_err("No memory available for action frame\n");
+                return -ENOMEM;
+        }
+        memcpy(mgmt_frame->da, ifp->mac_addr, ETH_ALEN);
+        brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_BSSID, mgmt_frame->bssid,
+                               ETH_ALEN);
+        memcpy(mgmt_frame->sa, e->addr, ETH_ALEN);
+        mgmt_frame->frame_control = cpu_to_le16(IEEE80211_STYPE_ACTION);
+        memcpy(&mgmt_frame->u, frame, mgmt_frame_len);
+        mgmt_frame_len += offsetof(struct ieee80211_mgmt, u);
+
+        freq = ieee80211_channel_to_frequency(CHSPEC_CHANNEL(chanspec),
+                                              CHSPEC_IS2G(chanspec) ?
+                                              IEEE80211_BAND_2GHZ :
+                                              IEEE80211_BAND_5GHZ);
+        wdev = ifp->ndev->ieee80211_ptr;
+        cfg80211_rx_mgmt(wdev, freq, 0, (u8 *)mgmt_frame, mgmt_frame_len,
+                         GFP_ATOMIC);
+
+        kfree(mgmt_frame);
+        return 0;
+}
+
+
+/**
+ * brcmf_p2p_notify_action_tx_complete() - transmit action frame complete
+ *
+ * @ifp: interfac control.
+ * @e: event message. Not used, to make it usable for fweh event dispatcher.
+ * @data: not used.
+ *
+ */
+int brcmf_p2p_notify_action_tx_complete(struct brcmf_if *ifp,
+                                        const struct brcmf_event_msg *e,
+                                        void *data)
+{
+        struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
+        struct brcmf_p2p_info *p2p = &cfg->p2p;
+
+        brcmf_dbg(INFO, "Enter: event %s, status=%d\n",
+                  e->event_code == BRCMF_E_ACTION_FRAME_OFF_CHAN_COMPLETE ?
+                  "ACTION_FRAME_OFF_CHAN_COMPLETE" : "ACTION_FRAME_COMPLETE",
+                  e->status);
+
+        if (!test_bit(BRCMF_P2P_STATUS_SENDING_ACT_FRAME, &p2p->status))
+                return 0;
+
+        if (e->event_code == BRCMF_E_ACTION_FRAME_COMPLETE) {
+                if (e->status == BRCMF_E_STATUS_SUCCESS)
+                        set_bit(BRCMF_P2P_STATUS_ACTION_TX_COMPLETED,
+                                &p2p->status);
+                else {
+                        set_bit(BRCMF_P2P_STATUS_ACTION_TX_NOACK, &p2p->status);
+                        /* If there is no ack, we don't need to wait for
+                         * WLC_E_ACTION_FRAME_OFFCHAN_COMPLETE event
+                         */
+                        brcmf_p2p_stop_wait_next_action_frame(cfg);
+                }
+
+        } else {
+                complete(&p2p->send_af_done);
+        }
+        return 0;
+}
+
+
+/**
+ * brcmf_p2p_tx_action_frame() - send action frame over fil.
+ *
+ * @p2p: p2p info struct for vif.
+ * @af_params: action frame data/info.
+ *
+ * Send an action frame immediately without doing channel synchronization.
+ *
+ * This function waits for a completion event before returning.
+ * The WLC_E_ACTION_FRAME_COMPLETE event will be received when the action
+ * frame is transmitted.
+ */
+static s32 brcmf_p2p_tx_action_frame(struct brcmf_p2p_info *p2p,
+                                     struct brcmf_fil_af_params_le *af_params)
+{
+        struct brcmf_cfg80211_vif *vif;
+        s32 err = 0;
+        s32 timeout = 0;
+
+        brcmf_dbg(TRACE, "Enter\n");
+
+        INIT_COMPLETION(p2p->send_af_done);
+        clear_bit(BRCMF_P2P_STATUS_ACTION_TX_COMPLETED, &p2p->status);
+        clear_bit(BRCMF_P2P_STATUS_ACTION_TX_NOACK, &p2p->status);
+
+        vif = p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
+        err = brcmf_fil_bsscfg_data_set(vif->ifp, "actframe", af_params,
+                                        sizeof(*af_params));
+        if (err) {
+                brcmf_err(" sending action frame has failed\n");
+                goto exit;
+        }
+
+        p2p->af_sent_channel = le32_to_cpu(af_params->channel);
+        p2p->af_tx_sent_jiffies = jiffies;
+
+        timeout = wait_for_completion_timeout(&p2p->send_af_done,
+                                        msecs_to_jiffies(P2P_AF_MAX_WAIT_TIME));
+
+        if (test_bit(BRCMF_P2P_STATUS_ACTION_TX_COMPLETED, &p2p->status)) {
+                brcmf_dbg(TRACE, "TX action frame operation is success\n");
+        } else {
+                err = -EIO;
+                brcmf_dbg(TRACE, "TX action frame operation has failed\n");
+        }
+        /* clear status bit for action tx */
+        clear_bit(BRCMF_P2P_STATUS_ACTION_TX_COMPLETED, &p2p->status);
+        clear_bit(BRCMF_P2P_STATUS_ACTION_TX_NOACK, &p2p->status);
+
+exit:
+        return err;
+}
+
+
+/**
+ * brcmf_p2p_pub_af_tx() - public action frame tx routine.
+ *
+ * @cfg: driver private data for cfg80211 interface.
+ * @af_params: action frame data/info.
+ * @config_af_params: configuration data for action frame.
+ *
+ * routine which transmits ation frame public type.
+ */
+static s32 brcmf_p2p_pub_af_tx(struct brcmf_cfg80211_info *cfg,
+                               struct brcmf_fil_af_params_le *af_params,
+                               struct brcmf_config_af_params *config_af_params)
+{
+        struct brcmf_p2p_info *p2p = &cfg->p2p;
+        struct brcmf_fil_action_frame_le *action_frame;
+        struct brcmf_p2p_pub_act_frame *act_frm;
+        s32 err = 0;
+        u16 ie_len;
+
+        action_frame = &af_params->action_frame;
+        act_frm = (struct brcmf_p2p_pub_act_frame *)(action_frame->data);
+
+        config_af_params->extra_listen = true;
+
+        switch (act_frm->subtype) {
+        case P2P_PAF_GON_REQ:
+                brcmf_dbg(TRACE, "P2P: GO_NEG_PHASE status set\n");
+                set_bit(BRCMF_P2P_STATUS_GO_NEG_PHASE, &p2p->status);
+                config_af_params->mpc_onoff = 0;
+                config_af_params->search_channel = true;
+                p2p->next_af_subtype = act_frm->subtype + 1;
+                p2p->gon_req_action = true;
+                /* increase dwell time to wait for RESP frame */
+                af_params->dwell_time = cpu_to_le32(P2P_AF_MED_DWELL_TIME);
+                break;
+        case P2P_PAF_GON_RSP:
+                p2p->next_af_subtype = act_frm->subtype + 1;
+                /* increase dwell time to wait for CONF frame */
+                af_params->dwell_time = cpu_to_le32(P2P_AF_MED_DWELL_TIME);
+                break;
+        case P2P_PAF_GON_CONF:
+                /* If we reached till GO Neg confirmation reset the filter */
+                brcmf_dbg(TRACE, "P2P: GO_NEG_PHASE status cleared\n");
+                clear_bit(BRCMF_P2P_STATUS_GO_NEG_PHASE, &p2p->status);
+                /* turn on mpc again if go nego is done */
+                config_af_params->mpc_onoff = 1;
+                /* minimize dwell time */
+                af_params->dwell_time = cpu_to_le32(P2P_AF_MIN_DWELL_TIME);
+                config_af_params->extra_listen = false;
+                break;
+        case P2P_PAF_INVITE_REQ:
+                config_af_params->search_channel = true;
+                p2p->next_af_subtype = act_frm->subtype + 1;
+                /* increase dwell time */
+                af_params->dwell_time = cpu_to_le32(P2P_AF_MED_DWELL_TIME);
+                break;
+        case P2P_PAF_INVITE_RSP:
+                /* minimize dwell time */
+                af_params->dwell_time = cpu_to_le32(P2P_AF_MIN_DWELL_TIME);
+                config_af_params->extra_listen = false;
+                break;
+        case P2P_PAF_DEVDIS_REQ:
+                config_af_params->search_channel = true;
+                p2p->next_af_subtype = act_frm->subtype + 1;
+                /* maximize dwell time to wait for RESP frame */
+                af_params->dwell_time = cpu_to_le32(P2P_AF_LONG_DWELL_TIME);
+                break;
+        case P2P_PAF_DEVDIS_RSP:
+                /* minimize dwell time */
+                af_params->dwell_time = cpu_to_le32(P2P_AF_MIN_DWELL_TIME);
+                config_af_params->extra_listen = false;
+                break;
+        case P2P_PAF_PROVDIS_REQ:
+                ie_len = le16_to_cpu(action_frame->len) -
+                         offsetof(struct brcmf_p2p_pub_act_frame, elts);
+                if (cfg80211_get_p2p_attr(&act_frm->elts[0], ie_len,
+                                          IEEE80211_P2P_ATTR_GROUP_ID,
+                                          NULL, 0) < 0)
+                        config_af_params->search_channel = true;
+                config_af_params->mpc_onoff = 0;
+                p2p->next_af_subtype = act_frm->subtype + 1;
+                /* increase dwell time to wait for RESP frame */
+                af_params->dwell_time = cpu_to_le32(P2P_AF_MED_DWELL_TIME);
+                break;
+        case P2P_PAF_PROVDIS_RSP:
+                /* wpa_supplicant send go nego req right after prov disc */
+                p2p->next_af_subtype = P2P_PAF_GON_REQ;
+                /* increase dwell time to MED level */
+                af_params->dwell_time = cpu_to_le32(P2P_AF_MED_DWELL_TIME);
+                config_af_params->extra_listen = false;
+                break;
+        default:
+                brcmf_err("Unknown p2p pub act frame subtype: %d\n",
+                          act_frm->subtype);
+                err = -EINVAL;
+        }
+        return err;
+}
+
+/**
+ * brcmf_p2p_send_action_frame() - send action frame .
+ *
+ * @cfg: driver private data for cfg80211 interface.
+ * @ndev: net device to transmit on.
+ * @af_params: configuration data for action frame.
+ */
+bool brcmf_p2p_send_action_frame(struct brcmf_cfg80211_info *cfg,
+                                 struct net_device *ndev,
+                                 struct brcmf_fil_af_params_le *af_params)
+{
+        struct brcmf_p2p_info *p2p = &cfg->p2p;
+        struct brcmf_fil_action_frame_le *action_frame;
+        struct brcmf_config_af_params config_af_params;
+        struct afx_hdl *afx_hdl = &p2p->afx_hdl;
+        u16 action_frame_len;
+        bool ack = false;
+        u8 category;
+        u8 action;
+        s32 tx_retry;
+        s32 extra_listen_time;
+        uint delta_ms;
+
+        action_frame = &af_params->action_frame;
+        action_frame_len = le16_to_cpu(action_frame->len);
+
+        brcmf_p2p_print_actframe(true, action_frame->data, action_frame_len);
+
+        /* Add the default dwell time. Dwell time to stay off-channel */
+        /* to wait for a response action frame after transmitting an  */
+        /* GO Negotiation action frame                                */
+        af_params->dwell_time = cpu_to_le32(P2P_AF_DWELL_TIME);
+
+        category = action_frame->data[DOT11_ACTION_CAT_OFF];
+        action = action_frame->data[DOT11_ACTION_ACT_OFF];
+
+        /* initialize variables */
+        p2p->next_af_subtype = P2P_PAF_SUBTYPE_INVALID;
+        p2p->gon_req_action = false;
+
+        /* config parameters */
+        config_af_params.mpc_onoff = -1;
+        config_af_params.search_channel = false;
+        config_af_params.extra_listen = false;
+
+        if (brcmf_p2p_is_pub_action(action_frame->data, action_frame_len)) {
+                /* p2p public action frame process */
+                if (brcmf_p2p_pub_af_tx(cfg, af_params, &config_af_params)) {
+                        /* Just send unknown subtype frame with */
+                        /* default parameters.                  */
+                        brcmf_err("P2P Public action frame, unknown subtype.\n");
+                }
+        } else if (brcmf_p2p_is_gas_action(action_frame->data,
+                                           action_frame_len)) {
+                /* service discovery process */
+                if (action == P2PSD_ACTION_ID_GAS_IREQ ||
+                    action == P2PSD_ACTION_ID_GAS_CREQ) {
+                        /* configure service discovery query frame */
+                        config_af_params.search_channel = true;
+
+                        /* save next af suptype to cancel */
+                        /* remaining dwell time           */
+                        p2p->next_af_subtype = action + 1;
+
+                        af_params->dwell_time =
+                                cpu_to_le32(P2P_AF_MED_DWELL_TIME);
+                } else if (action == P2PSD_ACTION_ID_GAS_IRESP ||
+                           action == P2PSD_ACTION_ID_GAS_CRESP) {
+                        /* configure service discovery response frame */
+                        af_params->dwell_time =
+                                cpu_to_le32(P2P_AF_MIN_DWELL_TIME);
+                } else {
+                        brcmf_err("Unknown action type: %d\n", action);
+                        goto exit;
+                }
+        } else if (brcmf_p2p_is_p2p_action(action_frame->data,
+                                           action_frame_len)) {
+                /* do not configure anything. it will be */
+                /* sent with a default configuration     */
+        } else {
+                brcmf_err("Unknown Frame: category 0x%x, action 0x%x\n",
+                          category, action);
+                return false;
+        }
+
+        /* if connecting on primary iface, sleep for a while before sending
+         * af tx for VSDB
+         */
+        if (test_bit(BRCMF_VIF_STATUS_CONNECTING,
+                     &p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->sme_state))
+                msleep(50);
+
+        /* if scan is ongoing, abort current scan. */
+        if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status))
+                brcmf_abort_scanning(cfg);
+
+        memcpy(afx_hdl->tx_dst_addr, action_frame->da, ETH_ALEN);
+
+        /* To make sure to send successfully action frame, turn off mpc */
+        if (config_af_params.mpc_onoff == 0)
+                brcmf_set_mpc(ndev, 0);
+
+        /* set status and destination address before sending af */
+        if (p2p->next_af_subtype != P2P_PAF_SUBTYPE_INVALID) {
+                /* set status to cancel the remained dwell time in rx process */
+                set_bit(BRCMF_P2P_STATUS_WAITING_NEXT_ACT_FRAME, &p2p->status);
+        }
+
+        p2p->af_sent_channel = 0;
+        set_bit(BRCMF_P2P_STATUS_SENDING_ACT_FRAME, &p2p->status);
+        /* validate channel and p2p ies */
+        if (config_af_params.search_channel &&
+            IS_P2P_SOCIAL_CHANNEL(le32_to_cpu(af_params->channel)) &&
+            p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif->saved_ie.probe_req_ie_len) {
+                afx_hdl = &p2p->afx_hdl;
+                afx_hdl->peer_listen_chan = le32_to_cpu(af_params->channel);
+
+                if (brcmf_p2p_af_searching_channel(p2p) ==
+                                                        P2P_INVALID_CHANNEL) {
+                        brcmf_err("Couldn't find peer's channel.\n");
+                        goto exit;
+                }
+
+                /* Abort scan even for VSDB scenarios. Scan gets aborted in
+                 * firmware but after the check of piggyback algorithm. To take
+                 * care of current piggback algo, lets abort the scan here
+                 * itself.
+                 */
+                brcmf_notify_escan_complete(cfg, ndev, true, true);
+
+                /* update channel */
+                af_params->channel = cpu_to_le32(afx_hdl->peer_chan);
+        }
+
+        tx_retry = 0;
+        while (!p2p->block_gon_req_tx &&
+               (ack == false) && (tx_retry < P2P_AF_TX_MAX_RETRY)) {
+                ack = !brcmf_p2p_tx_action_frame(p2p, af_params);
+                tx_retry++;
+        }
+        if (ack == false) {
+                brcmf_err("Failed to send Action Frame(retry %d)\n", tx_retry);
+                clear_bit(BRCMF_P2P_STATUS_GO_NEG_PHASE, &p2p->status);
+        }
+
+exit:
+        clear_bit(BRCMF_P2P_STATUS_SENDING_ACT_FRAME, &p2p->status);
+
+        /* WAR: sometimes dongle does not keep the dwell time of 'actframe'.
+         * if we coundn't get the next action response frame and dongle does
+         * not keep the dwell time, go to listen state again to get next action
+         * response frame.
+         */
+        if (ack && config_af_params.extra_listen && !p2p->block_gon_req_tx &&
+            test_bit(BRCMF_P2P_STATUS_WAITING_NEXT_ACT_FRAME, &p2p->status) &&
+            p2p->af_sent_channel == afx_hdl->my_listen_chan) {
+                delta_ms = jiffies_to_msecs(jiffies - p2p->af_tx_sent_jiffies);
+                if (le32_to_cpu(af_params->dwell_time) > delta_ms)
+                        extra_listen_time = le32_to_cpu(af_params->dwell_time) -
+                                            delta_ms;
+                else
+                        extra_listen_time = 0;
+                if (extra_listen_time > 50) {
+                        set_bit(BRCMF_P2P_STATUS_WAITING_NEXT_AF_LISTEN,
+                                &p2p->status);
+                        brcmf_dbg(INFO, "Wait more time! actual af time:%d, calculated extra listen:%d\n",
+                                  le32_to_cpu(af_params->dwell_time),
+                                  extra_listen_time);
+                        extra_listen_time += 100;
+                        if (!brcmf_p2p_discover_listen(p2p,
+                                                       p2p->af_sent_channel,
+                                                       extra_listen_time)) {
+                                unsigned long duration;
+
+                                extra_listen_time += 100;
+                                duration = msecs_to_jiffies(extra_listen_time);
+                                wait_for_completion_timeout(&p2p->wait_next_af,
+                                                            duration);
+                        }
+                        clear_bit(BRCMF_P2P_STATUS_WAITING_NEXT_AF_LISTEN,
+                                  &p2p->status);
+                }
+        }
+
+        if (p2p->block_gon_req_tx) {
+                /* if ack is true, supplicant will wait more time(100ms).
+                 * so we will return it as a success to get more time .
+                 */
+                p2p->block_gon_req_tx = false;
+                ack = true;
+        }
+
+        clear_bit(BRCMF_P2P_STATUS_WAITING_NEXT_ACT_FRAME, &p2p->status);
+        /* if all done, turn mpc on again */
+        if (config_af_params.mpc_onoff == 1)
+                brcmf_set_mpc(ndev, 1);
+
+        return ack;
+}
+
+/**
+ * brcmf_p2p_notify_rx_mgmt_p2p_probereq() - Event handler for p2p probe req.
+ *
+ * @ifp: interface pointer for which event was received.
+ * @e: even message.
+ * @data: payload of event message (probe request).
+ */
+s32 brcmf_p2p_notify_rx_mgmt_p2p_probereq(struct brcmf_if *ifp,
+                                          const struct brcmf_event_msg *e,
+                                          void *data)
+{
+        struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
+        struct brcmf_p2p_info *p2p = &cfg->p2p;
+        struct afx_hdl *afx_hdl = &p2p->afx_hdl;
+        struct wireless_dev *wdev;
+        struct brcmf_cfg80211_vif *vif = ifp->vif;
+        struct brcmf_rx_mgmt_data *rxframe = (struct brcmf_rx_mgmt_data *)data;
+        u16 chanspec = be16_to_cpu(rxframe->chanspec);
+        u8 *mgmt_frame;
+        u32 mgmt_frame_len;
+        s32 freq;
+        u16 mgmt_type;
+
+        brcmf_dbg(INFO, "Enter: event %d reason %d\n", e->event_code,
+                  e->reason);
+
+        if (test_bit(BRCMF_P2P_STATUS_FINDING_COMMON_CHANNEL, &p2p->status) &&
+            (memcmp(afx_hdl->tx_dst_addr, e->addr, ETH_ALEN) == 0)) {
+                afx_hdl->peer_chan = CHSPEC_CHANNEL(chanspec);
+                brcmf_dbg(INFO, "PROBE REQUEST: Peer found, channel=%d\n",
+                          afx_hdl->peer_chan);
+                complete(&afx_hdl->act_frm_scan);
+        }
+
+        /* Firmware sends us two proberesponses for each idx one. At the */
+        /* moment anything but bsscfgidx 0 is passed up to supplicant    */
+        if (e->bsscfgidx == 0)
+                return 0;
+
+        /* Filter any P2P probe reqs arriving during the GO-NEG Phase */
+        if (test_bit(BRCMF_P2P_STATUS_GO_NEG_PHASE, &p2p->status)) {
+                brcmf_dbg(INFO, "Filtering P2P probe_req in GO-NEG phase\n");
+                return 0;
+        }
+
+        /* Check if wpa_supplicant has registered for this frame */
+        brcmf_dbg(INFO, "vif->mgmt_rx_reg %04x\n", vif->mgmt_rx_reg);
+        mgmt_type = (IEEE80211_STYPE_PROBE_REQ & IEEE80211_FCTL_STYPE) >> 4;
+        if ((vif->mgmt_rx_reg & BIT(mgmt_type)) == 0)
+                return 0;
+
+        mgmt_frame = (u8 *)(rxframe + 1);
+        mgmt_frame_len = e->datalen - sizeof(*rxframe);
+        freq = ieee80211_channel_to_frequency(CHSPEC_CHANNEL(chanspec),
+                                              CHSPEC_IS2G(chanspec) ?
+                                              IEEE80211_BAND_2GHZ :
+                                              IEEE80211_BAND_5GHZ);
+        wdev = ifp->ndev->ieee80211_ptr;
+        cfg80211_rx_mgmt(wdev, freq, 0, mgmt_frame, mgmt_frame_len, GFP_ATOMIC);
+
+        brcmf_dbg(INFO, "mgmt_frame_len (%d) , e->datalen (%d), chanspec (%04x), freq (%d)\n",
+                  mgmt_frame_len, e->datalen, chanspec, freq);
+
+        return 0;
+}
+
+
+/**
+ * brcmf_p2p_attach() - attach for P2P.
+ *
+ * @cfg: driver private data for cfg80211 interface.
+ */
+s32 brcmf_p2p_attach(struct brcmf_cfg80211_info *cfg)
+{
+        struct brcmf_if *pri_ifp;
+        struct brcmf_if *p2p_ifp;
+        struct brcmf_cfg80211_vif *p2p_vif;
+        struct brcmf_p2p_info *p2p;
+        struct brcmf_pub *drvr;
+        s32 bssidx;
+        s32 err = 0;
+
+        p2p = &cfg->p2p;
+        p2p->cfg = cfg;
+
+        drvr = cfg->pub;
+
+        pri_ifp = drvr->iflist[0];
+        p2p_ifp = drvr->iflist[1];
+
+        p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY].vif = pri_ifp->vif;
+
+        if (p2p_ifp) {
+                p2p_vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_P2P_DEVICE,
+                                          false);
+                if (IS_ERR(p2p_vif)) {
+                        brcmf_err("could not create discovery vif\n");
+                        err = -ENOMEM;
+                        goto exit;
+                }
+
+                p2p_vif->ifp = p2p_ifp;
+                p2p_ifp->vif = p2p_vif;
+                p2p_vif->wdev.netdev = p2p_ifp->ndev;
+                p2p_ifp->ndev->ieee80211_ptr = &p2p_vif->wdev;
+                SET_NETDEV_DEV(p2p_ifp->ndev, wiphy_dev(cfg->wiphy));
+
+                p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif = p2p_vif;
+
+                brcmf_p2p_generate_bss_mac(p2p);
+                brcmf_p2p_set_firmware(pri_ifp, p2p->dev_addr);
+
+                /* Initialize P2P Discovery in the firmware */
+                err = brcmf_fil_iovar_int_set(pri_ifp, "p2p_disc", 1);
+                if (err < 0) {
+                        brcmf_err("set p2p_disc error\n");
+                        brcmf_free_vif(p2p_vif);
+                        goto exit;
+                }
+                /* obtain bsscfg index for P2P discovery */
+                err = brcmf_fil_iovar_int_get(pri_ifp, "p2p_dev", &bssidx);
+                if (err < 0) {
+                        brcmf_err("retrieving discover bsscfg index failed\n");
+                        brcmf_free_vif(p2p_vif);
+                        goto exit;
+                }
+                /* Verify that firmware uses same bssidx as driver !! */
+                if (p2p_ifp->bssidx != bssidx) {
+                        brcmf_err("Incorrect bssidx=%d, compared to p2p_ifp->bssidx=%d\n",
+                                  bssidx, p2p_ifp->bssidx);
+                        brcmf_free_vif(p2p_vif);
+                        goto exit;
+                }
+
+                init_completion(&p2p->send_af_done);
+                INIT_WORK(&p2p->afx_hdl.afx_work, brcmf_p2p_afx_handler);
+                init_completion(&p2p->afx_hdl.act_frm_scan);
+                init_completion(&p2p->wait_next_af);
+        }
+exit:
+        return err;
+}
+
+
+/**
+ * brcmf_p2p_detach() - detach P2P.
+ *
+ * @p2p: P2P specific data.
+ */
+void brcmf_p2p_detach(struct brcmf_p2p_info *p2p)
+{
+        struct brcmf_cfg80211_vif *vif;
+
+        vif = p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
+        if (vif != NULL) {
+                brcmf_p2p_cancel_remain_on_channel(vif->ifp);
+                brcmf_p2p_deinit_discovery(p2p);
+                /* remove discovery interface */
+                brcmf_free_vif(vif);
+                p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif = NULL;
+        }
+        /* just set it all to zero */
+        memset(p2p, 0, sizeof(*p2p));
+}
+
+/**
+ * brcmf_p2p_get_current_chanspec() - Get current operation channel.
+ *
+ * @p2p: P2P specific data.
+ * @chanspec: chanspec to be returned.
+ */
+static void brcmf_p2p_get_current_chanspec(struct brcmf_p2p_info *p2p,
+                                           u16 *chanspec)
+{
+        struct brcmf_if *ifp;
+        struct brcmf_fil_chan_info_le ci;
+        s32 err;
+
+        ifp = p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp;
+
+        *chanspec = 11 & WL_CHANSPEC_CHAN_MASK;
+
+        err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_CHANNEL, &ci, sizeof(ci));
+        if (!err) {
+                *chanspec = le32_to_cpu(ci.hw_channel) & WL_CHANSPEC_CHAN_MASK;
+                if (*chanspec < CH_MAX_2G_CHANNEL)
+                        *chanspec |= WL_CHANSPEC_BAND_2G;
+                else
+                        *chanspec |= WL_CHANSPEC_BAND_5G;
+        }
+        *chanspec |= WL_CHANSPEC_BW_20 | WL_CHANSPEC_CTL_SB_NONE;
+}
+
+/**
+ * Change a P2P Role.
+ * Parameters:
+ * @mac: MAC address of the BSS to change a role
+ * Returns 0 if success.
+ */
+int brcmf_p2p_ifchange(struct brcmf_cfg80211_info *cfg,
+                       enum brcmf_fil_p2p_if_types if_type)
+{
+        struct brcmf_p2p_info *p2p = &cfg->p2p;
+        struct brcmf_cfg80211_vif *vif;
+        struct brcmf_fil_p2p_if_le if_request;
+        s32 err;
+        u16 chanspec;
+
+        brcmf_dbg(TRACE, "Enter\n");
+
+        vif = p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY].vif;
+        if (!vif) {
+                brcmf_err("vif for P2PAPI_BSSCFG_PRIMARY does not exist\n");
+                return -EPERM;
+        }
+        brcmf_notify_escan_complete(cfg, vif->ifp->ndev, true, true);
+        vif = p2p->bss_idx[P2PAPI_BSSCFG_CONNECTION].vif;
+        if (!vif) {
+                brcmf_err("vif for P2PAPI_BSSCFG_CONNECTION does not exist\n");
+                return -EPERM;
+        }
+        brcmf_set_mpc(vif->ifp->ndev, 0);
+
+        /* In concurrency case, STA may be already associated in a particular */
+        /* channel. so retrieve the current channel of primary interface and  */
+        /* then start the virtual interface on that.                          */
+        brcmf_p2p_get_current_chanspec(p2p, &chanspec);
+
+        if_request.type = cpu_to_le16((u16)if_type);
+        if_request.chspec = cpu_to_le16(chanspec);
+        memcpy(if_request.addr, p2p->int_addr, sizeof(if_request.addr));
+
+        brcmf_cfg80211_arm_vif_event(cfg, vif);
+        err = brcmf_fil_iovar_data_set(vif->ifp, "p2p_ifupd", &if_request,
+                                       sizeof(if_request));
+        if (err) {
+                brcmf_err("p2p_ifupd FAILED, err=%d\n", err);
+                brcmf_cfg80211_arm_vif_event(cfg, NULL);
+                return err;
+        }
+        err = brcmf_cfg80211_wait_vif_event_timeout(cfg, BRCMF_E_IF_CHANGE,
+                                                    msecs_to_jiffies(1500));
+        brcmf_cfg80211_arm_vif_event(cfg, NULL);
+        if (!err)  {
+                brcmf_err("No BRCMF_E_IF_CHANGE event received\n");
+                return -EIO;
+        }
+
+        err = brcmf_fil_cmd_int_set(vif->ifp, BRCMF_C_SET_SCB_TIMEOUT,
+                                    BRCMF_SCB_TIMEOUT_VALUE);
+
+        return err;
+}
+
+static int brcmf_p2p_request_p2p_if(struct brcmf_p2p_info *p2p,
+                                    struct brcmf_if *ifp, u8 ea[ETH_ALEN],
+                                    enum brcmf_fil_p2p_if_types iftype)
+{
+        struct brcmf_fil_p2p_if_le if_request;
+        int err;
+        u16 chanspec;
+
+        /* we need a default channel */
+        brcmf_p2p_get_current_chanspec(p2p, &chanspec);
+
+        /* fill the firmware request */
+        memcpy(if_request.addr, ea, ETH_ALEN);
+        if_request.type = cpu_to_le16((u16)iftype);
+        if_request.chspec = cpu_to_le16(chanspec);
+
+        err = brcmf_fil_iovar_data_set(ifp, "p2p_ifadd", &if_request,
+                                       sizeof(if_request));
+        if (err)
+                return err;
+
+        return err;
+}
+
+static int brcmf_p2p_disable_p2p_if(struct brcmf_cfg80211_vif *vif)
+{
+        struct brcmf_cfg80211_info *cfg = wdev_to_cfg(&vif->wdev);
+        struct net_device *pri_ndev = cfg_to_ndev(cfg);
+        struct brcmf_if *ifp = netdev_priv(pri_ndev);
+        u8 *addr = vif->wdev.netdev->dev_addr;
+
+        return brcmf_fil_iovar_data_set(ifp, "p2p_ifdis", addr, ETH_ALEN);
+}
+
+static int brcmf_p2p_release_p2p_if(struct brcmf_cfg80211_vif *vif)
+{
+        struct brcmf_cfg80211_info *cfg = wdev_to_cfg(&vif->wdev);
+        struct net_device *pri_ndev = cfg_to_ndev(cfg);
+        struct brcmf_if *ifp = netdev_priv(pri_ndev);
+        u8 *addr = vif->wdev.netdev->dev_addr;
+
+        return brcmf_fil_iovar_data_set(ifp, "p2p_ifdel", addr, ETH_ALEN);
+}
+
+/**
+ * brcmf_p2p_add_vif() - create a new P2P virtual interface.
+ *
+ * @wiphy: wiphy device of new interface.
+ * @name: name of the new interface.
+ * @type: nl80211 interface type.
+ * @flags: TBD
+ * @params: TBD
+ */
+struct wireless_dev *brcmf_p2p_add_vif(struct wiphy *wiphy, const char *name,
+                                       enum nl80211_iftype type, u32 *flags,
+                                       struct vif_params *params)
+{
+        struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+        struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
+        struct brcmf_cfg80211_vif *vif;
+        enum brcmf_fil_p2p_if_types iftype;
+        enum wl_mode mode;
+        int err;
+
+        if (brcmf_cfg80211_vif_event_armed(cfg))
+                return ERR_PTR(-EBUSY);
+
+        brcmf_dbg(INFO, "adding vif \"%s\" (type=%d)\n", name, type);
+
+        switch (type) {
+        case NL80211_IFTYPE_P2P_CLIENT:
+                iftype = BRCMF_FIL_P2P_IF_CLIENT;
+                mode = WL_MODE_BSS;
+                break;
+        case NL80211_IFTYPE_P2P_GO:
+                iftype = BRCMF_FIL_P2P_IF_GO;
+                mode = WL_MODE_AP;
+                break;
+        default:
+                return ERR_PTR(-EOPNOTSUPP);
+        }
+
+        vif = brcmf_alloc_vif(cfg, type, false);
+        if (IS_ERR(vif))
+                return (struct wireless_dev *)vif;
+        brcmf_cfg80211_arm_vif_event(cfg, vif);
+
+        err = brcmf_p2p_request_p2p_if(&cfg->p2p, ifp, cfg->p2p.int_addr,
+                                       iftype);
+        if (err) {
+                brcmf_cfg80211_arm_vif_event(cfg, NULL);
+                goto fail;
+        }
+
+        /* wait for firmware event */
+        err = brcmf_cfg80211_wait_vif_event_timeout(cfg, BRCMF_E_IF_ADD,
+                                                    msecs_to_jiffies(1500));
+        brcmf_cfg80211_arm_vif_event(cfg, NULL);
+        if (!err) {
+                brcmf_err("timeout occurred\n");
+                err = -EIO;
+                goto fail;
+        }
+
+        /* interface created in firmware */
+        ifp = vif->ifp;
+        if (!ifp) {
+                brcmf_err("no if pointer provided\n");
+                err = -ENOENT;
+                goto fail;
+        }
+
+        strncpy(ifp->ndev->name, name, sizeof(ifp->ndev->name) - 1);
+        err = brcmf_net_attach(ifp, true);
+        if (err) {
+                brcmf_err("Registering netdevice failed\n");
+                goto fail;
+        }
+        cfg->p2p.bss_idx[P2PAPI_BSSCFG_CONNECTION].vif = vif;
+        /* Disable firmware roaming for P2P interface  */
+        brcmf_fil_iovar_int_set(ifp, "roam_off", 1);
+        if (iftype == BRCMF_FIL_P2P_IF_GO) {
+                /* set station timeout for p2p */
+                brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCB_TIMEOUT,
+                                      BRCMF_SCB_TIMEOUT_VALUE);
+        }
+        return &ifp->vif->wdev;
+
+fail:
+        brcmf_free_vif(vif);
+        return ERR_PTR(err);
+}
+
+/**
+ * brcmf_p2p_del_vif() - delete a P2P virtual interface.
+ *
+ * @wiphy: wiphy device of interface.
+ * @wdev: wireless device of interface.
+ *
+ * TODO: not yet supported.
+ */
+int brcmf_p2p_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev)
+{
+        struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
+        struct brcmf_p2p_info *p2p = &cfg->p2p;
+        struct brcmf_cfg80211_vif *vif;
+        unsigned long jiffie_timeout = msecs_to_jiffies(1500);
+        bool wait_for_disable = false;
+        int err;
+
+        brcmf_dbg(TRACE, "delete P2P vif\n");
+        vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
+
+        switch (vif->wdev.iftype) {
+        case NL80211_IFTYPE_P2P_CLIENT:
+                if (test_bit(BRCMF_VIF_STATUS_DISCONNECTING, &vif->sme_state))
+                        wait_for_disable = true;
+                break;
+
+        case NL80211_IFTYPE_P2P_GO:
+                if (!brcmf_p2p_disable_p2p_if(vif))
+                        wait_for_disable = true;
+                break;
+
+        case NL80211_IFTYPE_P2P_DEVICE:
+        default:
+                return -ENOTSUPP;
+                break;
+        }
+
+        clear_bit(BRCMF_P2P_STATUS_GO_NEG_PHASE, &p2p->status);
+        brcmf_dbg(INFO, "P2P: GO_NEG_PHASE status cleared\n");
+
+        if (wait_for_disable)
+                wait_for_completion_timeout(&cfg->vif_disabled,
+                                            msecs_to_jiffies(500));
+
+        brcmf_vif_clear_mgmt_ies(vif);
+
+        brcmf_cfg80211_arm_vif_event(cfg, vif);
+        err = brcmf_p2p_release_p2p_if(vif);
+        if (!err) {
+                /* wait for firmware event */
+                err = brcmf_cfg80211_wait_vif_event_timeout(cfg, BRCMF_E_IF_DEL,
+                                                            jiffie_timeout);
+                if (!err)
+                        err = -EIO;
+                else
+                        err = 0;
+        }
+        brcmf_cfg80211_arm_vif_event(cfg, NULL);
+        brcmf_free_vif(vif);
+        p2p->bss_idx[P2PAPI_BSSCFG_CONNECTION].vif = NULL;
+
+        return err;
+}
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/p2p.h b/drivers/net/wireless/brcm80211/brcmfmac/p2p.h
new file mode 100644
index 000000000000..6821b26224be
--- /dev/null
+++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.h
@@ -0,0 +1,183 @@
+/*
+ * Copyright (c) 2012 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#ifndef WL_CFGP2P_H_
+#define WL_CFGP2P_H_
+
+#include <net/cfg80211.h>
+
+struct brcmf_cfg80211_info;
+
+/**
+ * enum p2p_bss_type - different type of BSS configurations.
+ *
+ * @P2PAPI_BSSCFG_PRIMARY: maps to driver's primary bsscfg.
+ * @P2PAPI_BSSCFG_DEVICE: maps to driver's P2P device discovery bsscfg.
+ * @P2PAPI_BSSCFG_CONNECTION: maps to driver's P2P connection bsscfg.
+ * @P2PAPI_BSSCFG_MAX: used for range checking.
+ */
+enum p2p_bss_type {
+        P2PAPI_BSSCFG_PRIMARY, /* maps to driver's primary bsscfg */
+        P2PAPI_BSSCFG_DEVICE, /* maps to driver's P2P device discovery bsscfg */
+        P2PAPI_BSSCFG_CONNECTION, /* maps to driver's P2P connection bsscfg */
+        P2PAPI_BSSCFG_MAX
+};
+
+/**
+ * struct p2p_bss - peer-to-peer bss related information.
+ *
+ * @vif: virtual interface of this P2P bss.
+ * @private_data: TBD
+ */
+struct p2p_bss {
+        struct brcmf_cfg80211_vif *vif;
+        void *private_data;
+};
+
+/**
+ * enum brcmf_p2p_status - P2P specific dongle status.
+ *
+ * @BRCMF_P2P_STATUS_IF_ADD: peer-to-peer vif add sent to dongle.
+ * @BRCMF_P2P_STATUS_IF_DEL: NOT-USED?
+ * @BRCMF_P2P_STATUS_IF_DELETING: peer-to-peer vif delete sent to dongle.
+ * @BRCMF_P2P_STATUS_IF_CHANGING: peer-to-peer vif change sent to dongle.
+ * @BRCMF_P2P_STATUS_IF_CHANGED: peer-to-peer vif change completed on dongle.
+ * @BRCMF_P2P_STATUS_ACTION_TX_COMPLETED: action frame tx completed.
+ * @BRCMF_P2P_STATUS_ACTION_TX_NOACK: action frame tx not acked.
+ * @BRCMF_P2P_STATUS_GO_NEG_PHASE: P2P GO negotiation ongoing.
+ * @BRCMF_P2P_STATUS_DISCOVER_LISTEN: P2P listen, remaining on channel.
+ * @BRCMF_P2P_STATUS_SENDING_ACT_FRAME: In the process of sending action frame.
+ * @BRCMF_P2P_STATUS_WAITING_NEXT_AF_LISTEN: extra listen time for af tx.
+ * @BRCMF_P2P_STATUS_WAITING_NEXT_ACT_FRAME: waiting for action frame response.
+ * @BRCMF_P2P_STATUS_FINDING_COMMON_CHANNEL: search channel for AF active.
+ */
+enum brcmf_p2p_status {
+        BRCMF_P2P_STATUS_ENABLED,
+        BRCMF_P2P_STATUS_IF_ADD,
+        BRCMF_P2P_STATUS_IF_DEL,
+        BRCMF_P2P_STATUS_IF_DELETING,
+        BRCMF_P2P_STATUS_IF_CHANGING,
+        BRCMF_P2P_STATUS_IF_CHANGED,
+        BRCMF_P2P_STATUS_ACTION_TX_COMPLETED,
+        BRCMF_P2P_STATUS_ACTION_TX_NOACK,
+        BRCMF_P2P_STATUS_GO_NEG_PHASE,
+        BRCMF_P2P_STATUS_DISCOVER_LISTEN,
+        BRCMF_P2P_STATUS_SENDING_ACT_FRAME,
+        BRCMF_P2P_STATUS_WAITING_NEXT_AF_LISTEN,
+        BRCMF_P2P_STATUS_WAITING_NEXT_ACT_FRAME,
+        BRCMF_P2P_STATUS_FINDING_COMMON_CHANNEL
+};
+
+/**
+ * struct afx_hdl - action frame off channel storage.
+ *
+ * @afx_work: worker thread for searching channel
+ * @act_frm_scan: thread synchronizing struct.
+ * @is_active: channel searching active.
+ * @peer_chan: current channel.
+ * @is_listen: sets mode for afx worker.
+ * @my_listen_chan: this peers listen channel.
+ * @peer_listen_chan: remote peers listen channel.
+ * @tx_dst_addr: mac address where tx af should be sent to.
+ */
+struct afx_hdl {
+        struct work_struct afx_work;
+        struct completion act_frm_scan;
+        bool is_active;
+        s32 peer_chan;
+        bool is_listen;
+        u16 my_listen_chan;
+        u16 peer_listen_chan;
+        u8 tx_dst_addr[ETH_ALEN];
+};
+
+/**
+ * struct brcmf_p2p_info - p2p specific driver information.
+ *
+ * @cfg: driver private data for cfg80211 interface.
+ * @status: status of P2P (see enum brcmf_p2p_status).
+ * @dev_addr: P2P device address.
+ * @int_addr: P2P interface address.
+ * @bss_idx: informate for P2P bss types.
+ * @listen_timer: timer for @WL_P2P_DISC_ST_LISTEN discover state.
+ * @ssid: ssid for P2P GO.
+ * @listen_channel: channel for @WL_P2P_DISC_ST_LISTEN discover state.
+ * @remain_on_channel: contains copy of struct used by cfg80211.
+ * @remain_on_channel_cookie: cookie counter for remain on channel cmd
+ * @next_af_subtype: expected action frame subtype.
+ * @send_af_done: indication that action frame tx is complete.
+ * @afx_hdl: action frame search handler info.
+ * @af_sent_channel: channel action frame is sent.
+ * @af_tx_sent_jiffies: jiffies time when af tx was transmitted.
+ * @wait_next_af: thread synchronizing struct.
+ * @gon_req_action: about to send go negotiation requets frame.
+ * @block_gon_req_tx: drop tx go negotiation requets frame.
+ */
+struct brcmf_p2p_info {
+        struct brcmf_cfg80211_info *cfg;
+        unsigned long status;
+        u8 dev_addr[ETH_ALEN];
+        u8 int_addr[ETH_ALEN];
+        struct p2p_bss bss_idx[P2PAPI_BSSCFG_MAX];
+        struct timer_list listen_timer;
+        struct brcmf_ssid ssid;
+        u8 listen_channel;
+        struct ieee80211_channel remain_on_channel;
+        u32 remain_on_channel_cookie;
+        u8 next_af_subtype;
+        struct completion send_af_done;
+        struct afx_hdl afx_hdl;
+        u32 af_sent_channel;
+        unsigned long af_tx_sent_jiffies;
+        struct completion wait_next_af;
+        bool gon_req_action;
+        bool block_gon_req_tx;
+};
+
+s32 brcmf_p2p_attach(struct brcmf_cfg80211_info *cfg);
+void brcmf_p2p_detach(struct brcmf_p2p_info *p2p);
+struct wireless_dev *brcmf_p2p_add_vif(struct wiphy *wiphy, const char *name,
+                                       enum nl80211_iftype type, u32 *flags,
+                                       struct vif_params *params);
+int brcmf_p2p_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev);
+int brcmf_p2p_ifchange(struct brcmf_cfg80211_info *cfg,
+                       enum brcmf_fil_p2p_if_types if_type);
+int brcmf_p2p_start_device(struct wiphy *wiphy, struct wireless_dev *wdev);
+void brcmf_p2p_stop_device(struct wiphy *wiphy, struct wireless_dev *wdev);
+int brcmf_p2p_scan_prep(struct wiphy *wiphy,
+                        struct cfg80211_scan_request *request,
+                        struct brcmf_cfg80211_vif *vif);
+int brcmf_p2p_remain_on_channel(struct wiphy *wiphy, struct wireless_dev *wdev,
+                                struct ieee80211_channel *channel,
+                                unsigned int duration, u64 *cookie);
+int brcmf_p2p_notify_listen_complete(struct brcmf_if *ifp,
+                                     const struct brcmf_event_msg *e,
+                                     void *data);
+void brcmf_p2p_cancel_remain_on_channel(struct brcmf_if *ifp);
+int brcmf_p2p_notify_action_frame_rx(struct brcmf_if *ifp,
+                                     const struct brcmf_event_msg *e,
+                                     void *data);
+int brcmf_p2p_notify_action_tx_complete(struct brcmf_if *ifp,
+                                        const struct brcmf_event_msg *e,
+                                        void *data);
+bool brcmf_p2p_send_action_frame(struct brcmf_cfg80211_info *cfg,
+                                 struct net_device *ndev,
+                                 struct brcmf_fil_af_params_le *af_params);
+bool brcmf_p2p_scan_finding_common_channel(struct brcmf_cfg80211_info *cfg,
+                                           struct brcmf_bss_info_le *bi);
+s32 brcmf_p2p_notify_rx_mgmt_p2p_probereq(struct brcmf_if *ifp,
+                                          const struct brcmf_event_msg *e,
+                                          void *data);
+#endif /* WL_CFGP2P_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
index bc5a042c9a96..42289e9ea886 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
@@ -420,10 +420,6 @@ static void brcmf_usb_tx_complete(struct urb *urb)
         brcmf_dbg(USB, "Enter, urb->status=%d, skb=%p\n", urb->status,
                   req->skb);
         brcmf_usb_del_fromq(devinfo, req);
-        if (urb->status == 0)
-                devinfo->bus_pub.bus->dstats.tx_packets++;
-        else
-                devinfo->bus_pub.bus->dstats.tx_errors++;
 
         brcmf_txcomplete(devinfo->dev, req->skb, urb->status == 0);
 
@@ -450,10 +446,7 @@ static void brcmf_usb_rx_complete(struct urb *urb)
         req->skb = NULL;
 
         /* zero lenght packets indicate usb "failure". Do not refill */
-        if (urb->status == 0 && urb->actual_length) {
-                devinfo->bus_pub.bus->dstats.rx_packets++;
-        } else {
-                devinfo->bus_pub.bus->dstats.rx_errors++;
+        if (urb->status != 0 || !urb->actual_length) {
                 brcmu_pkt_buf_free_skb(skb);
                 brcmf_usb_enq(devinfo, &devinfo->rx_freeq, req, NULL);
                 return;
@@ -1256,6 +1249,8 @@ static int brcmf_usb_probe_cb(struct brcmf_usbdev_info *devinfo)
         bus->bus_priv.usb = bus_pub;
         dev_set_drvdata(dev, bus);
         bus->ops = &brcmf_usb_bus_ops;
+        bus->chip = bus_pub->devid;
+        bus->chiprev = bus_pub->chiprev;
 
         /* Attach to the common driver interface */
         ret = brcmf_attach(0, dev);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
index 62a528e8b958..cecc3eff72e9 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
@@ -26,6 +26,8 @@
 #include <brcmu_wifi.h>
 #include "dhd.h"
 #include "dhd_dbg.h"
+#include "fwil_types.h"
+#include "p2p.h"
 #include "wl_cfg80211.h"
 #include "fwil.h"
 
@@ -41,16 +43,13 @@
 #define BRCMF_PNO_SCAN_COMPLETE         1
 #define BRCMF_PNO_SCAN_INCOMPLETE       0
 
-#define BRCMF_IFACE_MAX_CNT             2
+#define BRCMF_IFACE_MAX_CNT             3
 
-#define TLV_LEN_OFF                     1       /* length offset */
-#define TLV_HDR_LEN                     2       /* header length */
-#define TLV_BODY_OFF                    2       /* body offset */
-#define TLV_OUI_LEN                     3       /* oui id length */
 #define WPA_OUI                         "\x00\x50\xF2"  /* WPA OUI */
 #define WPA_OUI_TYPE                    1
 #define RSN_OUI                         "\x00\x0F\xAC"  /* RSN OUI */
 #define WME_OUI_TYPE                    2
+#define WPS_OUI_TYPE                    4
 
 #define VS_IE_FIXED_HDR_LEN             6
 #define WPA_IE_VERSION_LEN              2
@@ -76,13 +75,15 @@
 #define VNDR_IE_PKTFLAG_OFFSET          8
 #define VNDR_IE_VSIE_OFFSET             12
 #define VNDR_IE_HDR_SIZE                12
-#define VNDR_IE_BEACON_FLAG             0x1
-#define VNDR_IE_PRBRSP_FLAG             0x2
-#define MAX_VNDR_IE_NUMBER              5
+#define VNDR_IE_PARSE_LIMIT             5
 
 #define DOT11_MGMT_HDR_LEN              24      /* d11 management header len */
 #define DOT11_BCN_PRB_FIXED_LEN         12      /* beacon/probe fixed length */
 
+#define BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS    320
+#define BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS   400
+#define BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS       20
+
 #define BRCMF_ASSOC_PARAMS_FIXED_SIZE \
         (sizeof(struct brcmf_assoc_params_le) - sizeof(u16))
 
@@ -271,13 +272,6 @@ static const u32 __wl_cipher_suites[] = {
         WLAN_CIPHER_SUITE_AES_CMAC,
 };
 
-/* tag_ID/length/value_buffer tuple */
-struct brcmf_tlv {
-        u8 id;
-        u8 len;
-        u8 data[1];
-};
-
 /* Vendor specific ie. id = 221, oui and type defines exact ie */
 struct brcmf_vs_tlv {
         u8 id;
@@ -294,7 +288,7 @@ struct parsed_vndr_ie_info {
 
 struct parsed_vndr_ies {
         u32 count;
-        struct parsed_vndr_ie_info ie_info[MAX_VNDR_IE_NUMBER];
+        struct parsed_vndr_ie_info ie_info[VNDR_IE_PARSE_LIMIT];
 };
 
 /* Quarter dBm units to mW
@@ -381,7 +375,7 @@ static u8 brcmf_mw_to_qdbm(u16 mw)
         return qdbm;
 }
 
-static u16 channel_to_chanspec(struct ieee80211_channel *ch)
+u16 channel_to_chanspec(struct ieee80211_channel *ch)
 {
         u16 chanspec;
 
@@ -393,19 +387,92 @@ static u16 channel_to_chanspec(struct ieee80211_channel *ch)
         else
                 chanspec |= WL_CHANSPEC_BAND_5G;
 
-        if (ch->flags & IEEE80211_CHAN_NO_HT40) {
-                chanspec |= WL_CHANSPEC_BW_20;
-                chanspec |= WL_CHANSPEC_CTL_SB_NONE;
-        } else {
-                chanspec |= WL_CHANSPEC_BW_40;
-                if (ch->flags & IEEE80211_CHAN_NO_HT40PLUS)
-                        chanspec |= WL_CHANSPEC_CTL_SB_LOWER;
-                else
-                        chanspec |= WL_CHANSPEC_CTL_SB_UPPER;
-        }
+        chanspec |= WL_CHANSPEC_BW_20;
+        chanspec |= WL_CHANSPEC_CTL_SB_NONE;
+
         return chanspec;
 }
 
+/* Traverse a string of 1-byte tag/1-byte length/variable-length value
+ * triples, returning a pointer to the substring whose first element
+ * matches tag
+ */
+struct brcmf_tlv *brcmf_parse_tlvs(void *buf, int buflen, uint key)
+{
+        struct brcmf_tlv *elt;
+        int totlen;
+
+        elt = (struct brcmf_tlv *)buf;
+        totlen = buflen;
+
+        /* find tagged parameter */
+        while (totlen >= TLV_HDR_LEN) {
+                int len = elt->len;
+
+                /* validate remaining totlen */
+                if ((elt->id == key) && (totlen >= (len + TLV_HDR_LEN)))
+                        return elt;
+
+                elt = (struct brcmf_tlv *)((u8 *)elt + (len + TLV_HDR_LEN));
+                totlen -= (len + TLV_HDR_LEN);
+        }
+
+        return NULL;
+}
+
+/* Is any of the tlvs the expected entry? If
+ * not update the tlvs buffer pointer/length.
+ */
+static bool
+brcmf_tlv_has_ie(u8 *ie, u8 **tlvs, u32 *tlvs_len,
+                 u8 *oui, u32 oui_len, u8 type)
+{
+        /* If the contents match the OUI and the type */
+        if (ie[TLV_LEN_OFF] >= oui_len + 1 &&
+            !memcmp(&ie[TLV_BODY_OFF], oui, oui_len) &&
+            type == ie[TLV_BODY_OFF + oui_len]) {
+                return true;
+        }
+
+        if (tlvs == NULL)
+                return false;
+        /* point to the next ie */
+        ie += ie[TLV_LEN_OFF] + TLV_HDR_LEN;
+        /* calculate the length of the rest of the buffer */
+        *tlvs_len -= (int)(ie - *tlvs);
+        /* update the pointer to the start of the buffer */
+        *tlvs = ie;
+
+        return false;
+}
+
+static struct brcmf_vs_tlv *
+brcmf_find_wpaie(u8 *parse, u32 len)
+{
+        struct brcmf_tlv *ie;
+
+        while ((ie = brcmf_parse_tlvs(parse, len, WLAN_EID_VENDOR_SPECIFIC))) {
+                if (brcmf_tlv_has_ie((u8 *)ie, &parse, &len,
+                                     WPA_OUI, TLV_OUI_LEN, WPA_OUI_TYPE))
+                        return (struct brcmf_vs_tlv *)ie;
+        }
+        return NULL;
+}
+
+static struct brcmf_vs_tlv *
+brcmf_find_wpsie(u8 *parse, u32 len)
+{
+        struct brcmf_tlv *ie;
+
+        while ((ie = brcmf_parse_tlvs(parse, len, WLAN_EID_VENDOR_SPECIFIC))) {
+                if (brcmf_tlv_has_ie((u8 *)ie, &parse, &len,
+                                     WPA_OUI, TLV_OUI_LEN, WPS_OUI_TYPE))
+                        return (struct brcmf_vs_tlv *)ie;
+        }
+        return NULL;
+}
+
+
 static void convert_key_from_CPU(struct brcmf_wsec_key *key,
                                  struct brcmf_wsec_key_le *key_le)
 {
@@ -438,11 +505,153 @@ send_key_to_dongle(struct net_device *ndev, struct brcmf_wsec_key *key)
         return err;
 }
 
+static struct wireless_dev *brcmf_cfg80211_add_iface(struct wiphy *wiphy,
+                                                     const char *name,
+                                                     enum nl80211_iftype type,
+                                                     u32 *flags,
+                                                     struct vif_params *params)
+{
+        brcmf_dbg(TRACE, "enter: %s type %d\n", name, type);
+        switch (type) {
+        case NL80211_IFTYPE_ADHOC:
+        case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_AP_VLAN:
+        case NL80211_IFTYPE_WDS:
+        case NL80211_IFTYPE_MONITOR:
+        case NL80211_IFTYPE_MESH_POINT:
+                return ERR_PTR(-EOPNOTSUPP);
+        case NL80211_IFTYPE_P2P_CLIENT:
+        case NL80211_IFTYPE_P2P_GO:
+                return brcmf_p2p_add_vif(wiphy, name, type, flags, params);
+        case NL80211_IFTYPE_UNSPECIFIED:
+        case NL80211_IFTYPE_P2P_DEVICE:
+        default:
+                return ERR_PTR(-EINVAL);
+        }
+}
+
+void brcmf_set_mpc(struct net_device *ndev, int mpc)
+{
+        struct brcmf_if *ifp = netdev_priv(ndev);
+        s32 err = 0;
+
+        if (check_vif_up(ifp->vif)) {
+                err = brcmf_fil_iovar_int_set(ifp, "mpc", mpc);
+                if (err) {
+                        brcmf_err("fail to set mpc\n");
+                        return;
+                }
+                brcmf_dbg(INFO, "MPC : %d\n", mpc);
+        }
+}
+
+s32
+brcmf_notify_escan_complete(struct brcmf_cfg80211_info *cfg,
+                            struct net_device *ndev,
+                            bool aborted, bool fw_abort)
+{
+        struct brcmf_scan_params_le params_le;
+        struct cfg80211_scan_request *scan_request;
+        s32 err = 0;
+
+        brcmf_dbg(SCAN, "Enter\n");
+
+        /* clear scan request, because the FW abort can cause a second call */
+        /* to this functon and might cause a double cfg80211_scan_done      */
+        scan_request = cfg->scan_request;
+        cfg->scan_request = NULL;
+
+        if (timer_pending(&cfg->escan_timeout))
+                del_timer_sync(&cfg->escan_timeout);
+
+        if (fw_abort) {
+                /* Do a scan abort to stop the driver's scan engine */
+                brcmf_dbg(SCAN, "ABORT scan in firmware\n");
+                memset(&params_le, 0, sizeof(params_le));
+                memset(params_le.bssid, 0xFF, ETH_ALEN);
+                params_le.bss_type = DOT11_BSSTYPE_ANY;
+                params_le.scan_type = 0;
+                params_le.channel_num = cpu_to_le32(1);
+                params_le.nprobes = cpu_to_le32(1);
+                params_le.active_time = cpu_to_le32(-1);
+                params_le.passive_time = cpu_to_le32(-1);
+                params_le.home_time = cpu_to_le32(-1);
+                /* Scan is aborted by setting channel_list[0] to -1 */
+                params_le.channel_list[0] = cpu_to_le16(-1);
+                /* E-Scan (or anyother type) can be aborted by SCAN */
+                err = brcmf_fil_cmd_data_set(netdev_priv(ndev), BRCMF_C_SCAN,
+                                             &params_le, sizeof(params_le));
+                if (err)
+                        brcmf_err("Scan abort  failed\n");
+        }
+        /*
+         * e-scan can be initiated by scheduled scan
+         * which takes precedence.
+         */
+        if (cfg->sched_escan) {
+                brcmf_dbg(SCAN, "scheduled scan completed\n");
+                cfg->sched_escan = false;
+                if (!aborted)
+                        cfg80211_sched_scan_results(cfg_to_wiphy(cfg));
+                brcmf_set_mpc(ndev, 1);
+        } else if (scan_request) {
+                brcmf_dbg(SCAN, "ESCAN Completed scan: %s\n",
+                          aborted ? "Aborted" : "Done");
+                cfg80211_scan_done(scan_request, aborted);
+                brcmf_set_mpc(ndev, 1);
+        }
+        if (!test_and_clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status))
+                brcmf_dbg(SCAN, "Scan complete, probably P2P scan\n");
+
+        return err;
+}
+
+static
+int brcmf_cfg80211_del_iface(struct wiphy *wiphy, struct wireless_dev *wdev)
+{
+        struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
+        struct net_device *ndev = wdev->netdev;
+
+        /* vif event pending in firmware */
+        if (brcmf_cfg80211_vif_event_armed(cfg))
+                return -EBUSY;
+
+        if (ndev) {
+                if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status) &&
+                    cfg->escan_info.ndev == ndev)
+                        brcmf_notify_escan_complete(cfg, ndev, true,
+                                                    true);
+
+                brcmf_fil_iovar_int_set(netdev_priv(ndev), "mpc", 1);
+        }
+
+        switch (wdev->iftype) {
+        case NL80211_IFTYPE_ADHOC:
+        case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_AP_VLAN:
+        case NL80211_IFTYPE_WDS:
+        case NL80211_IFTYPE_MONITOR:
+        case NL80211_IFTYPE_MESH_POINT:
+                return -EOPNOTSUPP;
+        case NL80211_IFTYPE_P2P_CLIENT:
+        case NL80211_IFTYPE_P2P_GO:
+                return brcmf_p2p_del_vif(wiphy, wdev);
+        case NL80211_IFTYPE_UNSPECIFIED:
+        case NL80211_IFTYPE_P2P_DEVICE:
+        default:
+                return -EINVAL;
+        }
+        return -EOPNOTSUPP;
+}
+
 static s32
 brcmf_cfg80211_change_iface(struct wiphy *wiphy, struct net_device *ndev,
                          enum nl80211_iftype type, u32 *flags,
                          struct vif_params *params)
 {
+        struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
         struct brcmf_if *ifp = netdev_priv(ndev);
         struct brcmf_cfg80211_vif *vif = ifp->vif;
         s32 infra = 0;
@@ -462,10 +671,23 @@ brcmf_cfg80211_change_iface(struct wiphy *wiphy, struct net_device *ndev,
                 infra = 0;
                 break;
         case NL80211_IFTYPE_STATION:
+                /* Ignore change for p2p IF. Unclear why supplicant does this */
+                if ((vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT) ||
+                    (vif->wdev.iftype == NL80211_IFTYPE_P2P_GO)) {
+                        brcmf_dbg(TRACE, "Ignoring cmd for p2p if\n");
+                        /* WAR: It is unexpected to get a change of VIF for P2P
+                         * IF, but it happens. The request can not be handled
+                         * but returning EPERM causes a crash. Returning 0
+                         * without setting ieee80211_ptr->iftype causes trace
+                         * (WARN_ON) but it works with wpa_supplicant
+                         */
+                        return 0;
+                }
                 vif->mode = WL_MODE_BSS;
                 infra = 1;
                 break;
         case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_P2P_GO:
                 vif->mode = WL_MODE_AP;
                 ap = 1;
                 break;
@@ -475,8 +697,14 @@ brcmf_cfg80211_change_iface(struct wiphy *wiphy, struct net_device *ndev,
         }
 
         if (ap) {
-                set_bit(BRCMF_VIF_STATUS_AP_CREATING, &vif->sme_state);
-                brcmf_dbg(INFO, "IF Type = AP\n");
+                if (type == NL80211_IFTYPE_P2P_GO) {
+                        brcmf_dbg(INFO, "IF Type = P2P GO\n");
+                        err = brcmf_p2p_ifchange(cfg, BRCMF_FIL_P2P_IF_GO);
+                }
+                if (!err) {
+                        set_bit(BRCMF_VIF_STATUS_AP_CREATING, &vif->sme_state);
+                        brcmf_dbg(INFO, "IF Type = AP\n");
+                }
         } else {
                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, infra);
                 if (err) {
@@ -495,21 +723,6 @@ done:
         return err;
 }
 
-static void brcmf_set_mpc(struct net_device *ndev, int mpc)
-{
-        struct brcmf_if *ifp = netdev_priv(ndev);
-        s32 err = 0;
-
-        if (check_vif_up(ifp->vif)) {
-                err = brcmf_fil_iovar_int_set(ifp, "mpc", mpc);
-                if (err) {
-                        brcmf_err("fail to set mpc\n");
-                        return;
-                }
-                brcmf_dbg(INFO, "MPC : %d\n", mpc);
-        }
-}
-
 static void brcmf_escan_prep(struct brcmf_scan_params_le *params_le,
                              struct cfg80211_scan_request *request)
 {
@@ -590,69 +803,6 @@ static void brcmf_escan_prep(struct brcmf_scan_params_le *params_le,
 }
 
 static s32
-brcmf_notify_escan_complete(struct brcmf_cfg80211_info *cfg,
-                            struct net_device *ndev,
-                            bool aborted, bool fw_abort)
-{
-        struct brcmf_scan_params_le params_le;
-        struct cfg80211_scan_request *scan_request;
-        s32 err = 0;
-
-        brcmf_dbg(SCAN, "Enter\n");
-
-        /* clear scan request, because the FW abort can cause a second call */
-        /* to this functon and might cause a double cfg80211_scan_done      */
-        scan_request = cfg->scan_request;
-        cfg->scan_request = NULL;
-
-        if (timer_pending(&cfg->escan_timeout))
-                del_timer_sync(&cfg->escan_timeout);
-
-        if (fw_abort) {
-                /* Do a scan abort to stop the driver's scan engine */
-                brcmf_dbg(SCAN, "ABORT scan in firmware\n");
-                memset(&params_le, 0, sizeof(params_le));
-                memset(params_le.bssid, 0xFF, ETH_ALEN);
-                params_le.bss_type = DOT11_BSSTYPE_ANY;
-                params_le.scan_type = 0;
-                params_le.channel_num = cpu_to_le32(1);
-                params_le.nprobes = cpu_to_le32(1);
-                params_le.active_time = cpu_to_le32(-1);
-                params_le.passive_time = cpu_to_le32(-1);
-                params_le.home_time = cpu_to_le32(-1);
-                /* Scan is aborted by setting channel_list[0] to -1 */
-                params_le.channel_list[0] = cpu_to_le16(-1);
-                /* E-Scan (or anyother type) can be aborted by SCAN */
-                err = brcmf_fil_cmd_data_set(netdev_priv(ndev), BRCMF_C_SCAN,
-                                             &params_le, sizeof(params_le));
-                if (err)
-                        brcmf_err("Scan abort  failed\n");
-        }
-        /*
-         * e-scan can be initiated by scheduled scan
-         * which takes precedence.
-         */
-        if (cfg->sched_escan) {
-                brcmf_dbg(SCAN, "scheduled scan completed\n");
-                cfg->sched_escan = false;
-                if (!aborted)
-                        cfg80211_sched_scan_results(cfg_to_wiphy(cfg));
-                brcmf_set_mpc(ndev, 1);
-        } else if (scan_request) {
-                brcmf_dbg(SCAN, "ESCAN Completed scan: %s\n",
-                          aborted ? "Aborted" : "Done");
-                cfg80211_scan_done(scan_request, aborted);
-                brcmf_set_mpc(ndev, 1);
-        }
-        if (!test_and_clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
-                brcmf_err("Scan complete while device not scanning\n");
-                return -EPERM;
-        }
-
-        return err;
-}
-
-static s32
 brcmf_run_escan(struct brcmf_cfg80211_info *cfg, struct net_device *ndev,
                 struct cfg80211_scan_request *request, u16 action)
 {
@@ -703,11 +853,12 @@ brcmf_do_escan(struct brcmf_cfg80211_info *cfg, struct wiphy *wiphy,
         s32 err;
         u32 passive_scan;
         struct brcmf_scan_results *results;
+        struct escan_info *escan = &cfg->escan_info;
 
         brcmf_dbg(SCAN, "Enter\n");
-        cfg->escan_info.ndev = ndev;
-        cfg->escan_info.wiphy = wiphy;
-        cfg->escan_info.escan_state = WL_ESCAN_STATE_SCANNING;
+        escan->ndev = ndev;
+        escan->wiphy = wiphy;
+        escan->escan_state = WL_ESCAN_STATE_SCANNING;
         passive_scan = cfg->active_scan ? 0 : 1;
         err = brcmf_fil_cmd_int_set(netdev_priv(ndev), BRCMF_C_SET_PASSIVE_SCAN,
                                     passive_scan);
@@ -721,7 +872,7 @@ brcmf_do_escan(struct brcmf_cfg80211_info *cfg, struct wiphy *wiphy,
         results->count = 0;
         results->buflen = WL_ESCAN_RESULTS_FIXED_SIZE;
 
-        err = brcmf_run_escan(cfg, ndev, request, WL_ESCAN_ACTION_START);
+        err = escan->run(cfg, ndev, request, WL_ESCAN_ACTION_START);
         if (err)
                 brcmf_set_mpc(ndev, 1);
         return err;
@@ -758,6 +909,12 @@ brcmf_cfg80211_escan(struct wiphy *wiphy, struct net_device *ndev,
                 return -EAGAIN;
         }
 
+        /* If scan req comes for p2p0, send it over primary I/F */
+        if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif) {
+                ifp = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp;
+                ndev = ifp->ndev;
+        }
+
         /* Arm scan timeout timer */
         mod_timer(&cfg->escan_timeout, jiffies +
                         WL_ESCAN_TIMER_INTERVAL_MS * HZ / 1000);
@@ -776,6 +933,11 @@ brcmf_cfg80211_escan(struct wiphy *wiphy, struct net_device *ndev,
         cfg->scan_request = request;
         set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
         if (escan_req) {
+                cfg->escan_info.run = brcmf_run_escan;
+                err = brcmf_p2p_scan_prep(wiphy, request, ifp->vif);
+                if (err)
+                        goto scan_out;
+
                 err = brcmf_do_escan(cfg, wiphy, ndev, request);
                 if (err)
                         goto scan_out;
@@ -933,31 +1095,6 @@ static void brcmf_init_prof(struct brcmf_cfg80211_profile *prof)
         memset(prof, 0, sizeof(*prof));
 }
 
-static void brcmf_ch_to_chanspec(int ch, struct brcmf_join_params *join_params,
-        size_t *join_params_size)
-{
-        u16 chanspec = 0;
-
-        if (ch != 0) {
-                if (ch <= CH_MAX_2G_CHANNEL)
-                        chanspec |= WL_CHANSPEC_BAND_2G;
-                else
-                        chanspec |= WL_CHANSPEC_BAND_5G;
-
-                chanspec |= WL_CHANSPEC_BW_20;
-                chanspec |= WL_CHANSPEC_CTL_SB_NONE;
-
-                *join_params_size += BRCMF_ASSOC_PARAMS_FIXED_SIZE +
-                                     sizeof(u16);
-
-                chanspec |= (ch & WL_CHANSPEC_CHAN_MASK);
-                join_params->params_le.chanspec_list[0] = cpu_to_le16(chanspec);
-                join_params->params_le.chanspec_num = cpu_to_le32(1);
-
-                brcmf_dbg(CONN, "channel %d, chanspec %#X\n", ch, chanspec);
-        }
-}
-
 static void brcmf_link_down(struct brcmf_cfg80211_vif *vif)
 {
         s32 err = 0;
@@ -988,6 +1125,7 @@ brcmf_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *ndev,
         s32 err = 0;
         s32 wsec = 0;
         s32 bcnprd;
+        u16 chanspec;
 
         brcmf_dbg(TRACE, "Enter\n");
         if (!check_vif_up(ifp->vif))
@@ -1091,8 +1229,11 @@ brcmf_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *ndev,
                                 params->chandef.chan->center_freq);
                 if (params->channel_fixed) {
                         /* adding chanspec */
-                        brcmf_ch_to_chanspec(cfg->channel,
-                                &join_params, &join_params_size);
+                        chanspec = channel_to_chanspec(params->chandef.chan);
+                        join_params.params_le.chanspec_list[0] =
+                                cpu_to_le16(chanspec);
+                        join_params.params_le.chanspec_num = cpu_to_le32(1);
+                        join_params_size += sizeof(join_params.params_le);
                 }
 
                 /* set channel for starter */
@@ -1155,7 +1296,7 @@ static s32 brcmf_set_wpa_version(struct net_device *ndev,
         else
                 val = WPA_AUTH_DISABLED;
         brcmf_dbg(CONN, "setting wpa_auth to 0x%0x\n", val);
-        err = brcmf_fil_iovar_int_set(netdev_priv(ndev), "wpa_auth", val);
+        err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wpa_auth", val);
         if (err) {
                 brcmf_err("set wpa_auth failed (%d)\n", err);
                 return err;
@@ -1194,7 +1335,7 @@ static s32 brcmf_set_auth_type(struct net_device *ndev,
                 break;
         }
 
-        err = brcmf_fil_iovar_int_set(netdev_priv(ndev), "auth", val);
+        err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "auth", val);
         if (err) {
                 brcmf_err("set auth failed (%d)\n", err);
                 return err;
@@ -1258,7 +1399,12 @@ brcmf_set_set_cipher(struct net_device *ndev,
         }
 
         brcmf_dbg(CONN, "pval (%d) gval (%d)\n", pval, gval);
-        err = brcmf_fil_iovar_int_set(netdev_priv(ndev), "wsec", pval | gval);
+        /* In case of privacy, but no security and WPS then simulate */
+        /* setting AES. WPS-2.0 allows no security                   */
+        if (brcmf_find_wpsie(sme->ie, sme->ie_len) && !pval && !gval &&
+            sme->privacy)
+                pval = AES_ENABLED;
+        err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev), "wsec", pval | gval);
         if (err) {
                 brcmf_err("error (%d)\n", err);
                 return err;
@@ -1280,8 +1426,8 @@ brcmf_set_key_mgmt(struct net_device *ndev, struct cfg80211_connect_params *sme)
         s32 err = 0;
 
         if (sme->crypto.n_akm_suites) {
-                err = brcmf_fil_iovar_int_get(netdev_priv(ndev),
-                                              "wpa_auth", &val);
+                err = brcmf_fil_bsscfg_int_get(netdev_priv(ndev),
+                                               "wpa_auth", &val);
                 if (err) {
                         brcmf_err("could not get wpa_auth (%d)\n", err);
                         return err;
@@ -1315,8 +1461,8 @@ brcmf_set_key_mgmt(struct net_device *ndev, struct cfg80211_connect_params *sme)
                 }
 
                 brcmf_dbg(CONN, "setting wpa_auth to %d\n", val);
-                err = brcmf_fil_iovar_int_set(netdev_priv(ndev),
-                                              "wpa_auth", val);
+                err = brcmf_fil_bsscfg_int_set(netdev_priv(ndev),
+                                               "wpa_auth", val);
                 if (err) {
                         brcmf_err("could not set wpa_auth (%d)\n", err);
                         return err;
@@ -1393,9 +1539,28 @@ brcmf_set_sharedkey(struct net_device *ndev,
         return err;
 }
 
+static
+enum nl80211_auth_type brcmf_war_auth_type(struct brcmf_if *ifp,
+                                           enum nl80211_auth_type type)
+{
+        u32 ci;
+        if (type == NL80211_AUTHTYPE_AUTOMATIC) {
+                /* shift to ignore chip revision */
+                ci = brcmf_get_chip_info(ifp) >> 4;
+                switch (ci) {
+                case 43236:
+                        brcmf_dbg(CONN, "43236 WAR: use OPEN instead of AUTO\n");
+                        return NL80211_AUTHTYPE_OPEN_SYSTEM;
+                default:
+                        break;
+                }
+        }
+        return type;
+}
+
 static s32
 brcmf_cfg80211_connect(struct wiphy *wiphy, struct net_device *ndev,
-                    struct cfg80211_connect_params *sme)
+                       struct cfg80211_connect_params *sme)
 {
         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
         struct brcmf_if *ifp = netdev_priv(ndev);
@@ -1403,7 +1568,12 @@ brcmf_cfg80211_connect(struct wiphy *wiphy, struct net_device *ndev,
         struct ieee80211_channel *chan = sme->channel;
         struct brcmf_join_params join_params;
         size_t join_params_size;
-        struct brcmf_ssid ssid;
+        struct brcmf_tlv *rsn_ie;
+        struct brcmf_vs_tlv *wpa_ie;
+        void *ie;
+        u32 ie_len;
+        struct brcmf_ext_join_params_le *ext_join_params;
+        u16 chanspec;
 
         s32 err = 0;
 
@@ -1416,15 +1586,46 @@ brcmf_cfg80211_connect(struct wiphy *wiphy, struct net_device *ndev,
                 return -EOPNOTSUPP;
         }
 
+        if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif) {
+                /* A normal (non P2P) connection request setup. */
+                ie = NULL;
+                ie_len = 0;
+                /* find the WPA_IE */
+                wpa_ie = brcmf_find_wpaie((u8 *)sme->ie, sme->ie_len);
+                if (wpa_ie) {
+                        ie = wpa_ie;
+                        ie_len = wpa_ie->len + TLV_HDR_LEN;
+                } else {
+                        /* find the RSN_IE */
+                        rsn_ie = brcmf_parse_tlvs((u8 *)sme->ie, sme->ie_len,
+                                                  WLAN_EID_RSN);
+                        if (rsn_ie) {
+                                ie = rsn_ie;
+                                ie_len = rsn_ie->len + TLV_HDR_LEN;
+                        }
+                }
+                brcmf_fil_iovar_data_set(ifp, "wpaie", ie, ie_len);
+        }
+
+        err = brcmf_vif_set_mgmt_ie(ifp->vif, BRCMF_VNDR_IE_ASSOCREQ_FLAG,
+                                    sme->ie, sme->ie_len);
+        if (err)
+                brcmf_err("Set Assoc REQ IE Failed\n");
+        else
+                brcmf_dbg(TRACE, "Applied Vndr IEs for Assoc request\n");
+
         set_bit(BRCMF_VIF_STATUS_CONNECTING, &ifp->vif->sme_state);
 
         if (chan) {
                 cfg->channel =
                         ieee80211_frequency_to_channel(chan->center_freq);
-                brcmf_dbg(CONN, "channel (%d), center_req (%d)\n",
-                          cfg->channel, chan->center_freq);
-        } else
+                chanspec = channel_to_chanspec(chan);
+                brcmf_dbg(CONN, "channel=%d, center_req=%d, chanspec=0x%04x\n",
+                          cfg->channel, chan->center_freq, chanspec);
+        } else {
                 cfg->channel = 0;
+                chanspec = 0;
+        }
 
         brcmf_dbg(INFO, "ie (%p), ie_len (%zd)\n", sme->ie, sme->ie_len);
 
@@ -1434,6 +1635,7 @@ brcmf_cfg80211_connect(struct wiphy *wiphy, struct net_device *ndev,
                 goto done;
         }
 
+        sme->auth_type = brcmf_war_auth_type(ifp, sme->auth_type);
         err = brcmf_set_auth_type(ndev, sme);
         if (err) {
                 brcmf_err("wl_set_auth_type failed (%d)\n", err);
@@ -1458,27 +1660,88 @@ brcmf_cfg80211_connect(struct wiphy *wiphy, struct net_device *ndev,
                 goto done;
         }
 
+        profile->ssid.SSID_len = min_t(u32, (u32)sizeof(profile->ssid.SSID),
+                                       (u32)sme->ssid_len);
+        memcpy(&profile->ssid.SSID, sme->ssid, profile->ssid.SSID_len);
+        if (profile->ssid.SSID_len < IEEE80211_MAX_SSID_LEN) {
+                profile->ssid.SSID[profile->ssid.SSID_len] = 0;
+                brcmf_dbg(CONN, "SSID \"%s\", len (%d)\n", profile->ssid.SSID,
+                          profile->ssid.SSID_len);
+        }
+
+        /* Join with specific BSSID and cached SSID
+         * If SSID is zero join based on BSSID only
+         */
+        join_params_size = offsetof(struct brcmf_ext_join_params_le, assoc_le) +
+                offsetof(struct brcmf_assoc_params_le, chanspec_list);
+        if (cfg->channel)
+                join_params_size += sizeof(u16);
+        ext_join_params = kzalloc(join_params_size, GFP_KERNEL);
+        if (ext_join_params == NULL) {
+                err = -ENOMEM;
+                goto done;
+        }
+        ext_join_params->ssid_le.SSID_len = cpu_to_le32(profile->ssid.SSID_len);
+        memcpy(&ext_join_params->ssid_le.SSID, sme->ssid,
+               profile->ssid.SSID_len);
+        /*increase dwell time to receive probe response or detect Beacon
+         * from target AP at a noisy air only during connect command
+         */
+        ext_join_params->scan_le.active_time =
+                cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS);
+        ext_join_params->scan_le.passive_time =
+                cpu_to_le32(BRCMF_SCAN_JOIN_PASSIVE_DWELL_TIME_MS);
+        /* Set up join scan parameters */
+        ext_join_params->scan_le.scan_type = -1;
+        /* to sync with presence period of VSDB GO.
+         * Send probe request more frequently. Probe request will be stopped
+         * when it gets probe response from target AP/GO.
+         */
+        ext_join_params->scan_le.nprobes =
+                cpu_to_le32(BRCMF_SCAN_JOIN_ACTIVE_DWELL_TIME_MS /
+                            BRCMF_SCAN_JOIN_PROBE_INTERVAL_MS);
+        ext_join_params->scan_le.home_time = cpu_to_le32(-1);
+
+        if (sme->bssid)
+                memcpy(&ext_join_params->assoc_le.bssid, sme->bssid, ETH_ALEN);
+        else
+                memset(&ext_join_params->assoc_le.bssid, 0xFF, ETH_ALEN);
+
+        if (cfg->channel) {
+                ext_join_params->assoc_le.chanspec_num = cpu_to_le32(1);
+
+                ext_join_params->assoc_le.chanspec_list[0] =
+                        cpu_to_le16(chanspec);
+        }
+
+        err  = brcmf_fil_bsscfg_data_set(ifp, "join", ext_join_params,
+                                         join_params_size);
+        kfree(ext_join_params);
+        if (!err)
+                /* This is it. join command worked, we are done */
+                goto done;
+
+        /* join command failed, fallback to set ssid */
         memset(&join_params, 0, sizeof(join_params));
         join_params_size = sizeof(join_params.ssid_le);
 
-        profile->ssid.SSID_len = min_t(u32,
-                                       sizeof(ssid.SSID), (u32)sme->ssid_len);
         memcpy(&join_params.ssid_le.SSID, sme->ssid, profile->ssid.SSID_len);
-        memcpy(&profile->ssid.SSID, sme->ssid, profile->ssid.SSID_len);
         join_params.ssid_le.SSID_len = cpu_to_le32(profile->ssid.SSID_len);
 
-        memset(join_params.params_le.bssid, 0xFF, ETH_ALEN);
-
-        if (ssid.SSID_len < IEEE80211_MAX_SSID_LEN)
-                brcmf_dbg(CONN, "ssid \"%s\", len (%d)\n",
-                          ssid.SSID, ssid.SSID_len);
+        if (sme->bssid)
+                memcpy(join_params.params_le.bssid, sme->bssid, ETH_ALEN);
+        else
+                memset(join_params.params_le.bssid, 0xFF, ETH_ALEN);
 
-        brcmf_ch_to_chanspec(cfg->channel,
-                             &join_params, &join_params_size);
+        if (cfg->channel) {
+                join_params.params_le.chanspec_list[0] = cpu_to_le16(chanspec);
+                join_params.params_le.chanspec_num = cpu_to_le32(1);
+                join_params_size += sizeof(join_params.params_le);
+        }
         err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
                                      &join_params, join_params_size);
         if (err)
-                brcmf_err("WLC_SET_SSID failed (%d)\n", err);
+                brcmf_err("BRCMF_C_SET_SSID failed (%d)\n", err);
 
 done:
         if (err)
@@ -1937,7 +2200,7 @@ brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev,
                         goto done;
                 }
                 /* Report the current tx rate */
-        err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_RATE, &rate);
+                err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_RATE, &rate);
                 if (err) {
                         brcmf_err("Could not get rate (%d)\n", err);
                         goto done;
@@ -2060,7 +2323,7 @@ static s32 brcmf_inform_single_bss(struct brcmf_cfg80211_info *cfg,
         if (!bss)
                 return -ENOMEM;
 
-        cfg80211_put_bss(bss);
+        cfg80211_put_bss(wiphy, bss);
 
         return err;
 }
@@ -2166,7 +2429,7 @@ static s32 wl_inform_ibss(struct brcmf_cfg80211_info *cfg,
                 goto CleanUp;
         }
 
-        cfg80211_put_bss(bss);
+        cfg80211_put_bss(wiphy, bss);
 
 CleanUp:
 
@@ -2182,78 +2445,10 @@ static bool brcmf_is_ibssmode(struct brcmf_cfg80211_vif *vif)
         return vif->mode == WL_MODE_IBSS;
 }
 
-/*
- * Traverse a string of 1-byte tag/1-byte length/variable-length value
- * triples, returning a pointer to the substring whose first element
- * matches tag
- */
-static struct brcmf_tlv *brcmf_parse_tlvs(void *buf, int buflen, uint key)
-{
-        struct brcmf_tlv *elt;
-        int totlen;
-
-        elt = (struct brcmf_tlv *) buf;
-        totlen = buflen;
-
-        /* find tagged parameter */
-        while (totlen >= TLV_HDR_LEN) {
-                int len = elt->len;
-
-                /* validate remaining totlen */
-                if ((elt->id == key) && (totlen >= (len + TLV_HDR_LEN)))
-                        return elt;
-
-                elt = (struct brcmf_tlv *) ((u8 *) elt + (len + TLV_HDR_LEN));
-                totlen -= (len + TLV_HDR_LEN);
-        }
-
-        return NULL;
-}
-
-/* Is any of the tlvs the expected entry? If
- * not update the tlvs buffer pointer/length.
- */
-static bool
-brcmf_tlv_has_ie(u8 *ie, u8 **tlvs, u32 *tlvs_len,
-                 u8 *oui, u32 oui_len, u8 type)
-{
-        /* If the contents match the OUI and the type */
-        if (ie[TLV_LEN_OFF] >= oui_len + 1 &&
-            !memcmp(&ie[TLV_BODY_OFF], oui, oui_len) &&
-            type == ie[TLV_BODY_OFF + oui_len]) {
-                return true;
-        }
-
-        if (tlvs == NULL)
-                return false;
-        /* point to the next ie */
-        ie += ie[TLV_LEN_OFF] + TLV_HDR_LEN;
-        /* calculate the length of the rest of the buffer */
-        *tlvs_len -= (int)(ie - *tlvs);
-        /* update the pointer to the start of the buffer */
-        *tlvs = ie;
-
-        return false;
-}
-
-static struct brcmf_vs_tlv *
-brcmf_find_wpaie(u8 *parse, u32 len)
+static s32 brcmf_update_bss_info(struct brcmf_cfg80211_info *cfg,
+                                 struct brcmf_if *ifp)
 {
-        struct brcmf_tlv *ie;
-
-        while ((ie = brcmf_parse_tlvs(parse, len, WLAN_EID_VENDOR_SPECIFIC))) {
-                if (brcmf_tlv_has_ie((u8 *)ie, &parse, &len,
-                                     WPA_OUI, TLV_OUI_LEN, WPA_OUI_TYPE))
-                        return (struct brcmf_vs_tlv *)ie;
-        }
-        return NULL;
-}
-
-static s32 brcmf_update_bss_info(struct brcmf_cfg80211_info *cfg)
-{
-        struct net_device *ndev = cfg_to_ndev(cfg);
-        struct brcmf_cfg80211_profile *profile = ndev_to_prof(ndev);
-        struct brcmf_if *ifp = netdev_priv(ndev);
+        struct brcmf_cfg80211_profile *profile = ndev_to_prof(ifp->ndev);
         struct brcmf_bss_info_le *bi;
         struct brcmf_ssid *ssid;
         struct brcmf_tlv *tim;
@@ -2309,7 +2504,7 @@ update_bss_info_out:
         return err;
 }
 
-static void brcmf_abort_scanning(struct brcmf_cfg80211_info *cfg)
+void brcmf_abort_scanning(struct brcmf_cfg80211_info *cfg)
 {
         struct escan_info *escan = &cfg->escan_info;
 
@@ -2328,8 +2523,7 @@ static void brcmf_cfg80211_escan_timeout_worker(struct work_struct *work)
                         container_of(work, struct brcmf_cfg80211_info,
                                      escan_timeout_work);
 
-        brcmf_notify_escan_complete(cfg,
-                cfg->escan_info.ndev, true, true);
+        brcmf_notify_escan_complete(cfg, cfg->escan_info.ndev, true, true);
 }
 
 static void brcmf_escan_timeout(unsigned long data)
@@ -2406,11 +2600,6 @@ brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
                         brcmf_err("Invalid escan result (NULL pointer)\n");
                         goto exit;
                 }
-                if (!cfg->scan_request) {
-                        brcmf_dbg(SCAN, "result without cfg80211 request\n");
-                        goto exit;
-                }
-
                 if (le16_to_cpu(escan_result_le->bss_count) != 1) {
                         brcmf_err("Invalid bss_count %d: ignoring\n",
                                   escan_result_le->bss_count);
@@ -2418,6 +2607,14 @@ brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
                 }
                 bss_info_le = &escan_result_le->bss_info_le;
 
+                if (brcmf_p2p_scan_finding_common_channel(cfg, bss_info_le))
+                        goto exit;
+
+                if (!cfg->scan_request) {
+                        brcmf_dbg(SCAN, "result without cfg80211 request\n");
+                        goto exit;
+                }
+
                 bi_length = le32_to_cpu(bss_info_le->length);
                 if (bi_length != (le32_to_cpu(escan_result_le->buflen) -
                                         WL_ESCAN_RESULTS_FIXED_SIZE)) {
@@ -2456,6 +2653,8 @@ brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
                 list->count++;
         } else {
                 cfg->escan_info.escan_state = WL_ESCAN_STATE_IDLE;
+                if (brcmf_p2p_scan_finding_common_channel(cfg, NULL))
+                        goto exit;
                 if (cfg->scan_request) {
                         cfg->bss_list = (struct brcmf_scan_results *)
                                 cfg->escan_info.escan_buf;
@@ -2464,7 +2663,8 @@ brcmf_cfg80211_escan_handler(struct brcmf_if *ifp,
                         brcmf_notify_escan_complete(cfg, ndev, aborted,
                                                     false);
                 } else
-                        brcmf_err("Unexpected scan result 0x%x\n", status);
+                        brcmf_dbg(SCAN, "Ignored scan complete result 0x%x\n",
+                                  status);
         }
 exit:
         return err;
@@ -2968,9 +3168,8 @@ static int brcmf_cfg80211_testmode(struct wiphy *wiphy, void *data, int len)
 }
 #endif
 
-static s32 brcmf_configure_opensecurity(struct net_device *ndev, s32 bssidx)
+static s32 brcmf_configure_opensecurity(struct brcmf_if *ifp)
 {
-        struct brcmf_if *ifp = netdev_priv(ndev);
         s32 err;
 
         /* set auth */
@@ -3229,7 +3428,7 @@ brcmf_parse_vndr_ies(const u8 *vndr_ie_buf, u32 vndr_ie_len,
                           parsed_info->vndrie.oui[2],
                           parsed_info->vndrie.oui_type);
 
-                if (vndr_ies->count >= MAX_VNDR_IE_NUMBER)
+                if (vndr_ies->count >= VNDR_IE_PARSE_LIMIT)
                         break;
 next:
                 remaining_len -= (ie->len + TLV_HDR_LEN);
@@ -3263,7 +3462,6 @@ brcmf_vndr_ie(u8 *iebuf, s32 pktflag, u8 *ie_ptr, u32 ie_len, s8 *add_del_cmd)
         return ie_len + VNDR_IE_HDR_SIZE;
 }
 
-static
 s32 brcmf_vif_set_mgmt_ie(struct brcmf_cfg80211_vif *vif, s32 pktflag,
                           const u8 *vndr_ie_buf, u32 vndr_ie_len)
 {
@@ -3295,24 +3493,28 @@ s32 brcmf_vif_set_mgmt_ie(struct brcmf_cfg80211_vif *vif, s32 pktflag,
         if (!iovar_ie_buf)
                 return -ENOMEM;
         curr_ie_buf = iovar_ie_buf;
-        if (ifp->vif->mode == WL_MODE_AP) {
-                switch (pktflag) {
-                case VNDR_IE_PRBRSP_FLAG:
-                        mgmt_ie_buf = saved_ie->probe_res_ie;
-                        mgmt_ie_len = &saved_ie->probe_res_ie_len;
-                        mgmt_ie_buf_len = sizeof(saved_ie->probe_res_ie);
-                        break;
-                case VNDR_IE_BEACON_FLAG:
-                        mgmt_ie_buf = saved_ie->beacon_ie;
-                        mgmt_ie_len = &saved_ie->beacon_ie_len;
-                        mgmt_ie_buf_len = sizeof(saved_ie->beacon_ie);
-                        break;
-                default:
-                        err = -EPERM;
-                        brcmf_err("not suitable type\n");
-                        goto exit;
-                }
-        } else {
+        switch (pktflag) {
+        case BRCMF_VNDR_IE_PRBREQ_FLAG:
+                mgmt_ie_buf = saved_ie->probe_req_ie;
+                mgmt_ie_len = &saved_ie->probe_req_ie_len;
+                mgmt_ie_buf_len = sizeof(saved_ie->probe_req_ie);
+                break;
+        case BRCMF_VNDR_IE_PRBRSP_FLAG:
+                mgmt_ie_buf = saved_ie->probe_res_ie;
+                mgmt_ie_len = &saved_ie->probe_res_ie_len;
+                mgmt_ie_buf_len = sizeof(saved_ie->probe_res_ie);
+                break;
+        case BRCMF_VNDR_IE_BEACON_FLAG:
+                mgmt_ie_buf = saved_ie->beacon_ie;
+                mgmt_ie_len = &saved_ie->beacon_ie_len;
+                mgmt_ie_buf_len = sizeof(saved_ie->beacon_ie);
+                break;
+        case BRCMF_VNDR_IE_ASSOCREQ_FLAG:
+                mgmt_ie_buf = saved_ie->assoc_req_ie;
+                mgmt_ie_len = &saved_ie->assoc_req_ie_len;
+                mgmt_ie_buf_len = sizeof(saved_ie->assoc_req_ie);
+                break;
+        default:
                 err = -EPERM;
                 brcmf_err("not suitable type\n");
                 goto exit;
@@ -3421,6 +3623,49 @@ exit:
         return err;
 }
 
+s32 brcmf_vif_clear_mgmt_ies(struct brcmf_cfg80211_vif *vif)
+{
+        s32 pktflags[] = {
+                BRCMF_VNDR_IE_PRBREQ_FLAG,
+                BRCMF_VNDR_IE_PRBRSP_FLAG,
+                BRCMF_VNDR_IE_BEACON_FLAG
+        };
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(pktflags); i++)
+                brcmf_vif_set_mgmt_ie(vif, pktflags[i], NULL, 0);
+
+        memset(&vif->saved_ie, 0, sizeof(vif->saved_ie));
+        return 0;
+}
+
+static s32
+brcmf_config_ap_mgmt_ie(struct brcmf_cfg80211_vif *vif,
+                        struct cfg80211_beacon_data *beacon)
+{
+        s32 err;
+
+        /* Set Beacon IEs to FW */
+        err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_BEACON_FLAG,
+                                    beacon->tail, beacon->tail_len);
+        if (err) {
+                brcmf_err("Set Beacon IE Failed\n");
+                return err;
+        }
+        brcmf_dbg(TRACE, "Applied Vndr IEs for Beacon\n");
+
+        /* Set Probe Response IEs to FW */
+        err = brcmf_vif_set_mgmt_ie(vif, BRCMF_VNDR_IE_PRBRSP_FLAG,
+                                    beacon->proberesp_ies,
+                                    beacon->proberesp_ies_len);
+        if (err)
+                brcmf_err("Set Probe Resp IE Failed\n");
+        else
+                brcmf_dbg(TRACE, "Applied Vndr IEs for Probe Resp\n");
+
+        return err;
+}
+
 static s32
 brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
                         struct cfg80211_ap_settings *settings)
@@ -3433,7 +3678,8 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
         struct brcmf_tlv *rsn_ie;
         struct brcmf_vs_tlv *wpa_ie;
         struct brcmf_join_params join_params;
-        s32 bssidx = 0;
+        enum nl80211_iftype dev_role;
+        struct brcmf_fil_bss_enable_le bss_enable;
 
         brcmf_dbg(TRACE, "channel_type=%d, beacon_interval=%d, dtim_period=%d,\n",
                   cfg80211_get_chandef_type(&settings->chandef),
@@ -3443,10 +3689,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
                   settings->ssid, settings->ssid_len, settings->auth_type,
                   settings->inactivity_timeout);
 
-        if (!test_bit(BRCMF_VIF_STATUS_AP_CREATING, &ifp->vif->sme_state)) {
-                brcmf_err("Not in AP creation mode\n");
-                return -EPERM;
-        }
+        dev_role = ifp->vif->wdev.iftype;
 
         memset(&ssid_le, 0, sizeof(ssid_le));
         if (settings->ssid == NULL || settings->ssid_len == 0) {
@@ -3467,21 +3710,6 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
         }
 
         brcmf_set_mpc(ndev, 0);
-        err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
-        if (err < 0) {
-                brcmf_err("BRCMF_C_DOWN error %d\n", err);
-                goto exit;
-        }
-        err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, 1);
-        if (err < 0) {
-                brcmf_err("SET INFRA error %d\n", err);
-                goto exit;
-        }
-        err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 1);
-        if (err < 0) {
-                brcmf_err("setting AP mode failed %d\n", err);
-                goto exit;
-        }
 
         /* find the RSN_IE */
         rsn_ie = brcmf_parse_tlvs((u8 *)settings->beacon.tail,
@@ -3507,27 +3735,10 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
                 }
         } else {
                 brcmf_dbg(TRACE, "No WPA(2) IEs found\n");
-                brcmf_configure_opensecurity(ndev, bssidx);
+                brcmf_configure_opensecurity(ifp);
         }
-        /* Set Beacon IEs to FW */
-        err = brcmf_vif_set_mgmt_ie(ndev_to_vif(ndev),
-                                    VNDR_IE_BEACON_FLAG,
-                                    settings->beacon.tail,
-                                    settings->beacon.tail_len);
-        if (err)
-                brcmf_err("Set Beacon IE Failed\n");
-        else
-                brcmf_dbg(TRACE, "Applied Vndr IEs for Beacon\n");
 
-        /* Set Probe Response IEs to FW */
-        err = brcmf_vif_set_mgmt_ie(ndev_to_vif(ndev),
-                                    VNDR_IE_PRBRSP_FLAG,
-                                    settings->beacon.proberesp_ies,
-                                    settings->beacon.proberesp_ies_len);
-        if (err)
-                brcmf_err("Set Probe Resp IE Failed\n");
-        else
-                brcmf_dbg(TRACE, "Applied Vndr IEs for Probe Resp\n");
+        brcmf_config_ap_mgmt_ie(ifp->vif, &settings->beacon);
 
         if (settings->beacon_interval) {
                 err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_BCNPRD,
@@ -3545,22 +3756,62 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
                         goto exit;
                 }
         }
-        err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
-        if (err < 0) {
-                brcmf_err("BRCMF_C_UP error (%d)\n", err);
-                goto exit;
+
+        if (dev_role == NL80211_IFTYPE_AP) {
+                err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_DOWN, 1);
+                if (err < 0) {
+                        brcmf_err("BRCMF_C_DOWN error %d\n", err);
+                        goto exit;
+                }
+                brcmf_fil_iovar_int_set(ifp, "apsta", 0);
         }
 
-        memset(&join_params, 0, sizeof(join_params));
-        /* join parameters starts with ssid */
-        memcpy(&join_params.ssid_le, &ssid_le, sizeof(ssid_le));
-        /* create softap */
-        err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
-                                     &join_params, sizeof(join_params));
+        err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, 1);
         if (err < 0) {
-                brcmf_err("SET SSID error (%d)\n", err);
+                brcmf_err("SET INFRA error %d\n", err);
                 goto exit;
         }
+        if (dev_role == NL80211_IFTYPE_AP) {
+                err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 1);
+                if (err < 0) {
+                        brcmf_err("setting AP mode failed %d\n", err);
+                        goto exit;
+                }
+                err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_UP, 1);
+                if (err < 0) {
+                        brcmf_err("BRCMF_C_UP error (%d)\n", err);
+                        goto exit;
+                }
+
+                memset(&join_params, 0, sizeof(join_params));
+                /* join parameters starts with ssid */
+                memcpy(&join_params.ssid_le, &ssid_le, sizeof(ssid_le));
+                /* create softap */
+                err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_SSID,
+                                             &join_params, sizeof(join_params));
+                if (err < 0) {
+                        brcmf_err("SET SSID error (%d)\n", err);
+                        goto exit;
+                }
+                brcmf_dbg(TRACE, "AP mode configuration complete\n");
+        } else {
+                err = brcmf_fil_bsscfg_data_set(ifp, "ssid", &ssid_le,
+                                                sizeof(ssid_le));
+                if (err < 0) {
+                        brcmf_err("setting ssid failed %d\n", err);
+                        goto exit;
+                }
+                bss_enable.bsscfg_idx = cpu_to_le32(ifp->bssidx);
+                bss_enable.enable = cpu_to_le32(1);
+                err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
+                                               sizeof(bss_enable));
+                if (err < 0) {
+                        brcmf_err("bss_enable config failed %d\n", err);
+                        goto exit;
+                }
+
+                brcmf_dbg(TRACE, "GO mode configuration complete\n");
+        }
         clear_bit(BRCMF_VIF_STATUS_AP_CREATING, &ifp->vif->sme_state);
         set_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
 
@@ -3574,10 +3825,11 @@ static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev)
 {
         struct brcmf_if *ifp = netdev_priv(ndev);
         s32 err = -EPERM;
+        struct brcmf_fil_bss_enable_le bss_enable;
 
         brcmf_dbg(TRACE, "Enter\n");
 
-        if (ifp->vif->mode == WL_MODE_AP) {
+        if (ifp->vif->wdev.iftype == NL80211_IFTYPE_AP) {
                 /* Due to most likely deauths outstanding we sleep */
                 /* first to make sure they get processed by fw. */
                 msleep(400);
@@ -3591,18 +3843,41 @@ static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev)
                         brcmf_err("BRCMF_C_UP error %d\n", err);
                         goto exit;
                 }
-                brcmf_set_mpc(ndev, 1);
-                clear_bit(BRCMF_VIF_STATUS_AP_CREATING, &ifp->vif->sme_state);
-                clear_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
+        } else {
+                bss_enable.bsscfg_idx = cpu_to_le32(ifp->bssidx);
+                bss_enable.enable = cpu_to_le32(0);
+                err = brcmf_fil_iovar_data_set(ifp, "bss", &bss_enable,
+                                               sizeof(bss_enable));
+                if (err < 0)
+                        brcmf_err("bss_enable config failed %d\n", err);
         }
+        brcmf_set_mpc(ndev, 1);
+        set_bit(BRCMF_VIF_STATUS_AP_CREATING, &ifp->vif->sme_state);
+        clear_bit(BRCMF_VIF_STATUS_AP_CREATED, &ifp->vif->sme_state);
+
 exit:
         return err;
 }
 
+static s32
+brcmf_cfg80211_change_beacon(struct wiphy *wiphy, struct net_device *ndev,
+                             struct cfg80211_beacon_data *info)
+{
+        struct brcmf_if *ifp = netdev_priv(ndev);
+        s32 err;
+
+        brcmf_dbg(TRACE, "Enter\n");
+
+        err = brcmf_config_ap_mgmt_ie(ifp->vif, info);
+
+        return err;
+}
+
 static int
 brcmf_cfg80211_del_station(struct wiphy *wiphy, struct net_device *ndev,
                            u8 *mac)
 {
+        struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
         struct brcmf_scb_val_le scbval;
         struct brcmf_if *ifp = netdev_priv(ndev);
         s32 err;
@@ -3612,6 +3887,8 @@ brcmf_cfg80211_del_station(struct wiphy *wiphy, struct net_device *ndev,
 
         brcmf_dbg(TRACE, "Enter %pM\n", mac);
 
+        if (ifp->vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif)
+                ifp = cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp;
         if (!check_vif_up(ifp->vif))
                 return -EIO;
 
@@ -3626,7 +3903,147 @@ brcmf_cfg80211_del_station(struct wiphy *wiphy, struct net_device *ndev,
         return err;
 }
 
+
+static void
+brcmf_cfg80211_mgmt_frame_register(struct wiphy *wiphy,
+                                   struct wireless_dev *wdev,
+                                   u16 frame_type, bool reg)
+{
+        struct brcmf_if *ifp = netdev_priv(wdev->netdev);
+        struct brcmf_cfg80211_vif *vif = ifp->vif;
+        u16 mgmt_type;
+
+        brcmf_dbg(TRACE, "Enter, frame_type %04x, reg=%d\n", frame_type, reg);
+
+        mgmt_type = (frame_type & IEEE80211_FCTL_STYPE) >> 4;
+        if (reg)
+                vif->mgmt_rx_reg |= BIT(mgmt_type);
+        else
+                vif->mgmt_rx_reg &= ~BIT(mgmt_type);
+}
+
+
+static int
+brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
+                       struct ieee80211_channel *chan, bool offchan,
+                       unsigned int wait, const u8 *buf, size_t len,
+                       bool no_cck, bool dont_wait_for_ack, u64 *cookie)
+{
+        struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+        const struct ieee80211_mgmt *mgmt;
+        struct brcmf_if *ifp;
+        struct brcmf_cfg80211_vif *vif;
+        s32 err = 0;
+        s32 ie_offset;
+        s32 ie_len;
+        struct brcmf_fil_action_frame_le *action_frame;
+        struct brcmf_fil_af_params_le *af_params;
+        bool ack;
+        s32 chan_nr;
+
+        brcmf_dbg(TRACE, "Enter\n");
+
+        *cookie = 0;
+
+        mgmt = (const struct ieee80211_mgmt *)buf;
+
+        if (!ieee80211_is_mgmt(mgmt->frame_control)) {
+                brcmf_err("Driver only allows MGMT packet type\n");
+                return -EPERM;
+        }
+
+        if (ieee80211_is_probe_resp(mgmt->frame_control)) {
+                /* Right now the only reason to get a probe response */
+                /* is for p2p listen response or for p2p GO from     */
+                /* wpa_supplicant. Unfortunately the probe is send   */
+                /* on primary ndev, while dongle wants it on the p2p */
+                /* vif. Since this is only reason for a probe        */
+                /* response to be sent, the vif is taken from cfg.   */
+                /* If ever desired to send proberesp for non p2p     */
+                /* response then data should be checked for          */
+                /* "DIRECT-". Note in future supplicant will take    */
+                /* dedicated p2p wdev to do this and then this 'hack'*/
+                /* is not needed anymore.                            */
+                ie_offset =  DOT11_MGMT_HDR_LEN +
+                             DOT11_BCN_PRB_FIXED_LEN;
+                ie_len = len - ie_offset;
+                ifp = netdev_priv(wdev->netdev);
+                vif = ifp->vif;
+                if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif)
+                        vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
+                err = brcmf_vif_set_mgmt_ie(vif,
+                                            BRCMF_VNDR_IE_PRBRSP_FLAG,
+                                            &buf[ie_offset],
+                                            ie_len);
+                cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, true,
+                                        GFP_KERNEL);
+        } else if (ieee80211_is_action(mgmt->frame_control)) {
+                af_params = kzalloc(sizeof(*af_params), GFP_KERNEL);
+                if (af_params == NULL) {
+                        brcmf_err("unable to allocate frame\n");
+                        err = -ENOMEM;
+                        goto exit;
+                }
+                action_frame = &af_params->action_frame;
+                /* Add the packet Id */
+                action_frame->packet_id = cpu_to_le32(*cookie);
+                /* Add BSSID */
+                memcpy(&action_frame->da[0], &mgmt->da[0], ETH_ALEN);
+                memcpy(&af_params->bssid[0], &mgmt->bssid[0], ETH_ALEN);
+                /* Add the length exepted for 802.11 header  */
+                action_frame->len = cpu_to_le16(len - DOT11_MGMT_HDR_LEN);
+                /* Add the channel */
+                chan_nr = ieee80211_frequency_to_channel(chan->center_freq);
+                af_params->channel = cpu_to_le32(chan_nr);
+
+                memcpy(action_frame->data, &buf[DOT11_MGMT_HDR_LEN],
+                       le16_to_cpu(action_frame->len));
+
+                brcmf_dbg(TRACE, "Action frame, cookie=%lld, len=%d, freq=%d\n",
+                          *cookie, le16_to_cpu(action_frame->len),
+                          chan->center_freq);
+
+                ack = brcmf_p2p_send_action_frame(cfg, wdev->netdev,
+                                                  af_params);
+
+                cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, ack,
+                                        GFP_KERNEL);
+                kfree(af_params);
+        } else {
+                brcmf_dbg(TRACE, "Unhandled, fc=%04x!!\n", mgmt->frame_control);
+                brcmf_dbg_hex_dump(true, buf, len, "payload, len=%Zu\n", len);
+        }
+
+exit:
+        return err;
+}
+
+
+static int
+brcmf_cfg80211_cancel_remain_on_channel(struct wiphy *wiphy,
+                                        struct wireless_dev *wdev,
+                                        u64 cookie)
+{
+        struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+        struct brcmf_cfg80211_vif *vif;
+        int err = 0;
+
+        brcmf_dbg(TRACE, "Enter p2p listen cancel\n");
+
+        vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
+        if (vif == NULL) {
+                brcmf_err("No p2p device available for probe response\n");
+                err = -ENODEV;
+                goto exit;
+        }
+        brcmf_p2p_cancel_remain_on_channel(vif->ifp);
+exit:
+        return err;
+}
+
 static struct cfg80211_ops wl_cfg80211_ops = {
+        .add_virtual_intf = brcmf_cfg80211_add_iface,
+        .del_virtual_intf = brcmf_cfg80211_del_iface,
         .change_virtual_intf = brcmf_cfg80211_change_iface,
         .scan = brcmf_cfg80211_scan,
         .set_wiphy_params = brcmf_cfg80211_set_wiphy_params,
@@ -3650,28 +4067,43 @@ static struct cfg80211_ops wl_cfg80211_ops = {
         .flush_pmksa = brcmf_cfg80211_flush_pmksa,
         .start_ap = brcmf_cfg80211_start_ap,
         .stop_ap = brcmf_cfg80211_stop_ap,
+        .change_beacon = brcmf_cfg80211_change_beacon,
         .del_station = brcmf_cfg80211_del_station,
         .sched_scan_start = brcmf_cfg80211_sched_scan_start,
         .sched_scan_stop = brcmf_cfg80211_sched_scan_stop,
+        .mgmt_frame_register = brcmf_cfg80211_mgmt_frame_register,
+        .mgmt_tx = brcmf_cfg80211_mgmt_tx,
+        .remain_on_channel = brcmf_p2p_remain_on_channel,
+        .cancel_remain_on_channel = brcmf_cfg80211_cancel_remain_on_channel,
 #ifdef CONFIG_NL80211_TESTMODE
         .testmode_cmd = brcmf_cfg80211_testmode
 #endif
 };
 
-static s32 brcmf_mode_to_nl80211_iftype(s32 mode)
+static s32 brcmf_nl80211_iftype_to_mode(enum nl80211_iftype type)
 {
-        s32 err = 0;
-
-        switch (mode) {
-        case WL_MODE_BSS:
-                return NL80211_IFTYPE_STATION;
-        case WL_MODE_IBSS:
-                return NL80211_IFTYPE_ADHOC;
+        switch (type) {
+        case NL80211_IFTYPE_AP_VLAN:
+        case NL80211_IFTYPE_WDS:
+        case NL80211_IFTYPE_MONITOR:
+        case NL80211_IFTYPE_MESH_POINT:
+                return -ENOTSUPP;
+        case NL80211_IFTYPE_ADHOC:
+                return WL_MODE_IBSS;
+        case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_P2P_CLIENT:
+                return WL_MODE_BSS;
+        case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_P2P_GO:
+                return WL_MODE_AP;
+        case NL80211_IFTYPE_P2P_DEVICE:
+                return WL_MODE_P2P;
+        case NL80211_IFTYPE_UNSPECIFIED:
         default:
-                return NL80211_IFTYPE_UNSPECIFIED;
+                break;
         }
 
-        return err;
+        return -EINVAL;
 }
 
 static void brcmf_wiphy_pno_params(struct wiphy *wiphy)
@@ -3683,6 +4115,56 @@ static void brcmf_wiphy_pno_params(struct wiphy *wiphy)
         wiphy->flags |= WIPHY_FLAG_SUPPORTS_SCHED_SCAN;
 }
 
+static const struct ieee80211_iface_limit brcmf_iface_limits[] = {
+        {
+                .max = 2,
+                .types = BIT(NL80211_IFTYPE_STATION) |
+                         BIT(NL80211_IFTYPE_ADHOC) |
+                         BIT(NL80211_IFTYPE_AP)
+        },
+        {
+                .max = 1,
+                .types = BIT(NL80211_IFTYPE_P2P_DEVICE)
+        },
+        {
+                .max = 1,
+                .types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
+                         BIT(NL80211_IFTYPE_P2P_GO)
+        },
+};
+static const struct ieee80211_iface_combination brcmf_iface_combos[] = {
+        {
+                 .max_interfaces = BRCMF_IFACE_MAX_CNT,
+                 .num_different_channels = 1, /* no multi-channel for now */
+                 .n_limits = ARRAY_SIZE(brcmf_iface_limits),
+                 .limits = brcmf_iface_limits
+        }
+};
+
+static const struct ieee80211_txrx_stypes
+brcmf_txrx_stypes[NUM_NL80211_IFTYPES] = {
+        [NL80211_IFTYPE_STATION] = {
+                .tx = 0xffff,
+                .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+                      BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
+        },
+        [NL80211_IFTYPE_P2P_CLIENT] = {
+                .tx = 0xffff,
+                .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+                      BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
+        },
+        [NL80211_IFTYPE_P2P_GO] = {
+                .tx = 0xffff,
+                .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
+                      BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
+                      BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
+                      BIT(IEEE80211_STYPE_DISASSOC >> 4) |
+                      BIT(IEEE80211_STYPE_AUTH >> 4) |
+                      BIT(IEEE80211_STYPE_DEAUTH >> 4) |
+                      BIT(IEEE80211_STYPE_ACTION >> 4)
+        }
+};
+
 static struct wiphy *brcmf_setup_wiphy(struct device *phydev)
 {
         struct wiphy *wiphy;
@@ -3695,10 +4177,16 @@ static struct wiphy *brcmf_setup_wiphy(struct device *phydev)
         }
         set_wiphy_dev(wiphy, phydev);
         wiphy->max_scan_ssids = WL_NUM_SCAN_MAX;
+        wiphy->max_scan_ie_len = BRCMF_SCAN_IE_LEN_MAX;
         wiphy->max_num_pmkids = WL_NUM_PMKIDS_MAX;
         wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
                                  BIT(NL80211_IFTYPE_ADHOC) |
-                                 BIT(NL80211_IFTYPE_AP);
+                                 BIT(NL80211_IFTYPE_AP) |
+                                 BIT(NL80211_IFTYPE_P2P_CLIENT) |
+                                 BIT(NL80211_IFTYPE_P2P_GO) |
+                                 BIT(NL80211_IFTYPE_P2P_DEVICE);
+        wiphy->iface_combinations = brcmf_iface_combos;
+        wiphy->n_iface_combinations = ARRAY_SIZE(brcmf_iface_combos);
         wiphy->bands[IEEE80211_BAND_2GHZ] = &__wl_band_2ghz;
         wiphy->bands[IEEE80211_BAND_5GHZ] = &__wl_band_5ghz_a;  /* Set
                                                 * it as 11a by default.
@@ -3710,10 +4198,11 @@ static struct wiphy *brcmf_setup_wiphy(struct device *phydev)
         wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
         wiphy->cipher_suites = __wl_cipher_suites;
         wiphy->n_cipher_suites = ARRAY_SIZE(__wl_cipher_suites);
-        wiphy->flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT;    /* enable power
-                                                                 * save mode
-                                                                 * by default
-                                                                 */
+        wiphy->flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT |
+                        WIPHY_FLAG_OFFCHAN_TX |
+                        WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
+        wiphy->mgmt_stypes = brcmf_txrx_stypes;
+        wiphy->max_remain_on_channel_duration = 5000;
         brcmf_wiphy_pno_params(wiphy);
         err = wiphy_register(wiphy);
         if (err < 0) {
@@ -3724,31 +4213,25 @@ static struct wiphy *brcmf_setup_wiphy(struct device *phydev)
         return wiphy;
 }
 
-static
 struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
-                                           struct net_device *netdev,
-                                           s32 mode, bool pm_block)
+                                           enum nl80211_iftype type,
+                                           bool pm_block)
 {
         struct brcmf_cfg80211_vif *vif;
 
         if (cfg->vif_cnt == BRCMF_IFACE_MAX_CNT)
                 return ERR_PTR(-ENOSPC);
 
+        brcmf_dbg(TRACE, "allocating virtual interface (size=%zu)\n",
+                  sizeof(*vif));
         vif = kzalloc(sizeof(*vif), GFP_KERNEL);
         if (!vif)
                 return ERR_PTR(-ENOMEM);
 
         vif->wdev.wiphy = cfg->wiphy;
-        vif->wdev.netdev = netdev;
-        vif->wdev.iftype = brcmf_mode_to_nl80211_iftype(mode);
-
-        if (netdev) {
-                vif->ifp = netdev_priv(netdev);
-                netdev->ieee80211_ptr = &vif->wdev;
-                SET_NETDEV_DEV(netdev, wiphy_dev(cfg->wiphy));
-        }
+        vif->wdev.iftype = type;
 
-        vif->mode = mode;
+        vif->mode = brcmf_nl80211_iftype_to_mode(type);
         vif->pm_block = pm_block;
         vif->roam_off = -1;
 
@@ -3759,7 +4242,7 @@ struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
         return vif;
 }
 
-static void brcmf_free_vif(struct brcmf_cfg80211_vif *vif)
+void brcmf_free_vif(struct brcmf_cfg80211_vif *vif)
 {
         struct brcmf_cfg80211_info *cfg;
         struct wiphy *wiphy;
@@ -3833,9 +4316,9 @@ static void brcmf_clear_assoc_ies(struct brcmf_cfg80211_info *cfg)
         conn_info->resp_ie_len = 0;
 }
 
-static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg)
+static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg,
+                               struct brcmf_if *ifp)
 {
-        struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
         struct brcmf_cfg80211_assoc_ielen_le *assoc_info;
         struct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);
         u32 req_len;
@@ -3911,9 +4394,9 @@ brcmf_bss_roaming_done(struct brcmf_cfg80211_info *cfg,
 
         brcmf_dbg(TRACE, "Enter\n");
 
-        brcmf_get_assoc_ies(cfg);
+        brcmf_get_assoc_ies(cfg, ifp);
         memcpy(profile->bssid, e->addr, ETH_ALEN);
-        brcmf_update_bss_info(cfg);
+        brcmf_update_bss_info(cfg, ifp);
 
         buf = kzalloc(WL_BSS_INFO_MAX, GFP_KERNEL);
         if (buf == NULL) {
@@ -3968,9 +4451,11 @@ brcmf_bss_connect_done(struct brcmf_cfg80211_info *cfg,
         if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTING,
                                &ifp->vif->sme_state)) {
                 if (completed) {
-                        brcmf_get_assoc_ies(cfg);
+                        brcmf_get_assoc_ies(cfg, ifp);
                         memcpy(profile->bssid, e->addr, ETH_ALEN);
-                        brcmf_update_bss_info(cfg);
+                        brcmf_update_bss_info(cfg, ifp);
+                        set_bit(BRCMF_VIF_STATUS_CONNECTED,
+                                &ifp->vif->sme_state);
                 }
                 cfg80211_connect_result(ndev,
                                         (u8 *)profile->bssid,
@@ -3981,9 +4466,6 @@ brcmf_bss_connect_done(struct brcmf_cfg80211_info *cfg,
                                         completed ? WLAN_STATUS_SUCCESS :
                                                     WLAN_STATUS_AUTH_TIMEOUT,
                                         GFP_KERNEL);
-                if (completed)
-                        set_bit(BRCMF_VIF_STATUS_CONNECTED,
-                                &ifp->vif->sme_state);
                 brcmf_dbg(CONN, "Report connect result - connection %s\n",
                           completed ? "succeeded" : "failed");
         }
@@ -3996,38 +4478,38 @@ brcmf_notify_connect_status_ap(struct brcmf_cfg80211_info *cfg,
                                struct net_device *ndev,
                                const struct brcmf_event_msg *e, void *data)
 {
-        s32 err = 0;
+        static int generation;
         u32 event = e->event_code;
         u32 reason = e->reason;
-        u32 len = e->datalen;
-        static int generation;
-
         struct station_info sinfo;
 
         brcmf_dbg(CONN, "event %d, reason %d\n", event, reason);
-        memset(&sinfo, 0, sizeof(sinfo));
+        if (event == BRCMF_E_LINK && reason == BRCMF_E_REASON_LINK_BSSCFG_DIS &&
+            ndev != cfg_to_ndev(cfg)) {
+                brcmf_dbg(CONN, "AP mode link down\n");
+                complete(&cfg->vif_disabled);
+                return 0;
+        }
 
-        sinfo.filled = 0;
         if (((event == BRCMF_E_ASSOC_IND) || (event == BRCMF_E_REASSOC_IND)) &&
-            reason == BRCMF_E_STATUS_SUCCESS) {
+            (reason == BRCMF_E_STATUS_SUCCESS)) {
+                memset(&sinfo, 0, sizeof(sinfo));
                 sinfo.filled = STATION_INFO_ASSOC_REQ_IES;
                 if (!data) {
                         brcmf_err("No IEs present in ASSOC/REASSOC_IND");
                         return -EINVAL;
                 }
                 sinfo.assoc_req_ies = data;
-                sinfo.assoc_req_ies_len = len;
+                sinfo.assoc_req_ies_len = e->datalen;
                 generation++;
                 sinfo.generation = generation;
-                cfg80211_new_sta(ndev, e->addr, &sinfo, GFP_ATOMIC);
+                cfg80211_new_sta(ndev, e->addr, &sinfo, GFP_KERNEL);
         } else if ((event == BRCMF_E_DISASSOC_IND) ||
                    (event == BRCMF_E_DEAUTH_IND) ||
                    (event == BRCMF_E_DEAUTH)) {
-                generation++;
-                sinfo.generation = generation;
-                cfg80211_del_sta(ndev, e->addr, GFP_ATOMIC);
+                cfg80211_del_sta(ndev, e->addr, GFP_KERNEL);
         }
-        return err;
+        return 0;
 }
 
 static s32
@@ -4064,6 +4546,8 @@ brcmf_notify_connect_status(struct brcmf_if *ifp,
                 }
                 brcmf_link_down(ifp->vif);
                 brcmf_init_prof(ndev_to_prof(ndev));
+                if (ndev != cfg_to_ndev(cfg))
+                        complete(&cfg->vif_disabled);
         } else if (brcmf_is_nonetwork(cfg, e)) {
                 if (brcmf_is_ibssmode(ifp->vif))
                         clear_bit(BRCMF_VIF_STATUS_CONNECTING,
@@ -4112,6 +4596,57 @@ brcmf_notify_mic_status(struct brcmf_if *ifp,
         return 0;
 }
 
+static s32 brcmf_notify_vif_event(struct brcmf_if *ifp,
+                                  const struct brcmf_event_msg *e, void *data)
+{
+        struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
+        struct brcmf_if_event *ifevent = (struct brcmf_if_event *)data;
+        struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
+        struct brcmf_cfg80211_vif *vif;
+
+        brcmf_dbg(TRACE, "Enter: action %u flags %u ifidx %u bsscfg %u\n",
+                  ifevent->action, ifevent->flags, ifevent->ifidx,
+                  ifevent->bssidx);
+
+        mutex_lock(&event->vif_event_lock);
+        event->action = ifevent->action;
+        vif = event->vif;
+
+        switch (ifevent->action) {
+        case BRCMF_E_IF_ADD:
+                /* waiting process may have timed out */
+                if (!cfg->vif_event.vif)
+                        return -EBADF;
+
+                ifp->vif = vif;
+                vif->ifp = ifp;
+                vif->wdev.netdev = ifp->ndev;
+                ifp->ndev->ieee80211_ptr = &vif->wdev;
+                SET_NETDEV_DEV(ifp->ndev, wiphy_dev(cfg->wiphy));
+                mutex_unlock(&event->vif_event_lock);
+                wake_up(&event->vif_wq);
+                return 0;
+
+        case BRCMF_E_IF_DEL:
+                ifp->vif = NULL;
+                mutex_unlock(&event->vif_event_lock);
+                /* event may not be upon user request */
+                if (brcmf_cfg80211_vif_event_armed(cfg))
+                        wake_up(&event->vif_wq);
+                return 0;
+
+        case BRCMF_E_IF_CHANGE:
+                mutex_unlock(&event->vif_event_lock);
+                wake_up(&event->vif_wq);
+                return 0;
+
+        default:
+                mutex_unlock(&event->vif_event_lock);
+                break;
+        }
+        return -EINVAL;
+}
+
 static void brcmf_init_conf(struct brcmf_cfg80211_conf *conf)
 {
         conf->frag_threshold = (u32)-1;
@@ -4143,6 +4678,18 @@ static void brcmf_register_event_handlers(struct brcmf_cfg80211_info *cfg)
                             brcmf_notify_connect_status);
         brcmf_fweh_register(cfg->pub, BRCMF_E_PFN_NET_FOUND,
                             brcmf_notify_sched_scan_results);
+        brcmf_fweh_register(cfg->pub, BRCMF_E_IF,
+                            brcmf_notify_vif_event);
+        brcmf_fweh_register(cfg->pub, BRCMF_E_P2P_PROBEREQ_MSG,
+                            brcmf_p2p_notify_rx_mgmt_p2p_probereq);
+        brcmf_fweh_register(cfg->pub, BRCMF_E_P2P_DISC_LISTEN_COMPLETE,
+                            brcmf_p2p_notify_listen_complete);
+        brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_RX,
+                            brcmf_p2p_notify_action_frame_rx);
+        brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_COMPLETE,
+                            brcmf_p2p_notify_action_tx_complete);
+        brcmf_fweh_register(cfg->pub, BRCMF_E_ACTION_FRAME_OFF_CHAN_COMPLETE,
+                            brcmf_p2p_notify_action_tx_complete);
 }
 
 static void brcmf_deinit_priv_mem(struct brcmf_cfg80211_info *cfg)
@@ -4198,7 +4745,7 @@ static s32 wl_init_priv(struct brcmf_cfg80211_info *cfg)
         mutex_init(&cfg->usr_sync);
         brcmf_init_escan(cfg);
         brcmf_init_conf(cfg->conf);
-
+        init_completion(&cfg->vif_disabled);
         return err;
 }
 
@@ -4209,6 +4756,12 @@ static void wl_deinit_priv(struct brcmf_cfg80211_info *cfg)
         brcmf_deinit_priv_mem(cfg);
 }
 
+static void init_vif_event(struct brcmf_cfg80211_vif_event *event)
+{
+        init_waitqueue_head(&event->vif_wq);
+        mutex_init(&event->vif_event_lock);
+}
+
 struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
                                                   struct device *busdev)
 {
@@ -4232,25 +4785,41 @@ struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
         cfg = wiphy_priv(wiphy);
         cfg->wiphy = wiphy;
         cfg->pub = drvr;
+        init_vif_event(&cfg->vif_event);
         INIT_LIST_HEAD(&cfg->vif_list);
 
-        vif = brcmf_alloc_vif(cfg, ndev, WL_MODE_BSS, false);
+        vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_STATION, false);
         if (IS_ERR(vif)) {
                 wiphy_free(wiphy);
                 return NULL;
         }
 
+        vif->ifp = ifp;
+        vif->wdev.netdev = ndev;
+        ndev->ieee80211_ptr = &vif->wdev;
+        SET_NETDEV_DEV(ndev, wiphy_dev(cfg->wiphy));
+
         err = wl_init_priv(cfg);
         if (err) {
                 brcmf_err("Failed to init iwm_priv (%d)\n", err);
                 goto cfg80211_attach_out;
         }
-
         ifp->vif = vif;
+
+        err = brcmf_p2p_attach(cfg);
+        if (err) {
+                brcmf_err("P2P initilisation failed (%d)\n", err);
+                goto cfg80211_p2p_attach_out;
+        }
+
         return cfg;
 
+cfg80211_p2p_attach_out:
+        wl_deinit_priv(cfg);
+
 cfg80211_attach_out:
         brcmf_free_vif(vif);
+        wiphy_free(wiphy);
         return NULL;
 }
 
@@ -4489,3 +5058,57 @@ s32 brcmf_cfg80211_down(struct net_device *ndev)
         return err;
 }
 
+u32 wl_get_vif_state_all(struct brcmf_cfg80211_info *cfg, unsigned long state)
+{
+        struct brcmf_cfg80211_vif *vif;
+        bool result = 0;
+
+        list_for_each_entry(vif, &cfg->vif_list, list) {
+                if (test_bit(state, &vif->sme_state))
+                        result++;
+        }
+        return result;
+}
+
+static inline bool vif_event_equals(struct brcmf_cfg80211_vif_event *event,
+                                    u8 action)
+{
+        u8 evt_action;
+
+        mutex_lock(&event->vif_event_lock);
+        evt_action = event->action;
+        mutex_unlock(&event->vif_event_lock);
+        return evt_action == action;
+}
+
+void brcmf_cfg80211_arm_vif_event(struct brcmf_cfg80211_info *cfg,
+                                  struct brcmf_cfg80211_vif *vif)
+{
+        struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
+
+        mutex_lock(&event->vif_event_lock);
+        event->vif = vif;
+        event->action = 0;
+        mutex_unlock(&event->vif_event_lock);
+}
+
+bool brcmf_cfg80211_vif_event_armed(struct brcmf_cfg80211_info *cfg)
+{
+        struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
+        bool armed;
+
+        mutex_lock(&event->vif_event_lock);
+        armed = event->vif != NULL;
+        mutex_unlock(&event->vif_event_lock);
+
+        return armed;
+}
+int brcmf_cfg80211_wait_vif_event_timeout(struct brcmf_cfg80211_info *cfg,
+                                          u8 action, ulong timeout)
+{
+        struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
+
+        return wait_event_timeout(event->vif_wq,
+                                  vif_event_equals(event, action), timeout);
+}
+
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h
index e4d9cc7a8e63..8b5d4989906c 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h
@@ -41,6 +41,38 @@
 #define WL_AUTH_SHARED_KEY              1       /* d11 shared authentication */
 #define IE_MAX_LEN                      512
 
+/* IE TLV processing */
+#define TLV_LEN_OFF                     1       /* length offset */
+#define TLV_HDR_LEN                     2       /* header length */
+#define TLV_BODY_OFF                    2       /* body offset */
+#define TLV_OUI_LEN                     3       /* oui id length */
+
+/* 802.11 Mgmt Packet flags */
+#define BRCMF_VNDR_IE_BEACON_FLAG       0x1
+#define BRCMF_VNDR_IE_PRBRSP_FLAG       0x2
+#define BRCMF_VNDR_IE_ASSOCRSP_FLAG     0x4
+#define BRCMF_VNDR_IE_AUTHRSP_FLAG      0x8
+#define BRCMF_VNDR_IE_PRBREQ_FLAG       0x10
+#define BRCMF_VNDR_IE_ASSOCREQ_FLAG     0x20
+/* vendor IE in IW advertisement protocol ID field */
+#define BRCMF_VNDR_IE_IWAPID_FLAG       0x40
+/* allow custom IE id */
+#define BRCMF_VNDR_IE_CUSTOM_FLAG       0x100
+
+/* P2P Action Frames flags (spec ordered) */
+#define BRCMF_VNDR_IE_GONREQ_FLAG     0x001000
+#define BRCMF_VNDR_IE_GONRSP_FLAG     0x002000
+#define BRCMF_VNDR_IE_GONCFM_FLAG     0x004000
+#define BRCMF_VNDR_IE_INVREQ_FLAG     0x008000
+#define BRCMF_VNDR_IE_INVRSP_FLAG     0x010000
+#define BRCMF_VNDR_IE_DISREQ_FLAG     0x020000
+#define BRCMF_VNDR_IE_DISRSP_FLAG     0x040000
+#define BRCMF_VNDR_IE_PRDREQ_FLAG     0x080000
+#define BRCMF_VNDR_IE_PRDRSP_FLAG     0x100000
+
+#define BRCMF_VNDR_IE_P2PAF_SHIFT       12
+
+
 /**
  * enum brcmf_scan_status - dongle scan status
  *
@@ -52,11 +84,19 @@ enum brcmf_scan_status {
         BRCMF_SCAN_STATUS_ABORT,
 };
 
-/* wi-fi mode */
+/**
+ * enum wl_mode - driver mode of virtual interface.
+ *
+ * @WL_MODE_BSS: connects to BSS.
+ * @WL_MODE_IBSS: operate as ad-hoc.
+ * @WL_MODE_AP: operate as access-point.
+ * @WL_MODE_P2P: provide P2P discovery.
+ */
 enum wl_mode {
         WL_MODE_BSS,
         WL_MODE_IBSS,
-        WL_MODE_AP
+        WL_MODE_AP,
+        WL_MODE_P2P
 };
 
 /* dongle configuration */
@@ -108,6 +148,7 @@ struct brcmf_cfg80211_profile {
  * @BRCMF_VIF_STATUS_READY: ready for operation.
  * @BRCMF_VIF_STATUS_CONNECTING: connect/join in progress.
  * @BRCMF_VIF_STATUS_CONNECTED: connected/joined succesfully.
+ * @BRCMF_VIF_STATUS_DISCONNECTING: disconnect/disable in progress.
  * @BRCMF_VIF_STATUS_AP_CREATING: interface configured for AP operation.
  * @BRCMF_VIF_STATUS_AP_CREATED: AP operation started.
  */
@@ -115,6 +156,7 @@ enum brcmf_vif_status {
         BRCMF_VIF_STATUS_READY,
         BRCMF_VIF_STATUS_CONNECTING,
         BRCMF_VIF_STATUS_CONNECTED,
+        BRCMF_VIF_STATUS_DISCONNECTING,
         BRCMF_VIF_STATUS_AP_CREATING,
         BRCMF_VIF_STATUS_AP_CREATED
 };
@@ -122,16 +164,22 @@ enum brcmf_vif_status {
 /**
  * struct vif_saved_ie - holds saved IEs for a virtual interface.
  *
+ * @probe_req_ie: IE info for probe request.
  * @probe_res_ie: IE info for probe response.
  * @beacon_ie: IE info for beacon frame.
+ * @probe_req_ie_len: IE info length for probe request.
  * @probe_res_ie_len: IE info length for probe response.
  * @beacon_ie_len: IE info length for beacon frame.
  */
 struct vif_saved_ie {
+        u8  probe_req_ie[IE_MAX_LEN];
         u8  probe_res_ie[IE_MAX_LEN];
         u8  beacon_ie[IE_MAX_LEN];
+        u8  assoc_req_ie[IE_MAX_LEN];
+        u32 probe_req_ie_len;
         u32 probe_res_ie_len;
         u32 beacon_ie_len;
+        u32 assoc_req_ie_len;
 };
 
 /**
@@ -145,6 +193,7 @@ struct vif_saved_ie {
  * @sme_state: SME state using enum brcmf_vif_status bits.
  * @pm_block: power-management blocked.
  * @list: linked list.
+ * @mgmt_rx_reg: registered rx mgmt frame types.
  */
 struct brcmf_cfg80211_vif {
         struct brcmf_if *ifp;
@@ -156,6 +205,7 @@ struct brcmf_cfg80211_vif {
         bool pm_block;
         struct vif_saved_ie saved_ie;
         struct list_head list;
+        u16 mgmt_rx_reg;
 };
 
 /* association inform */
@@ -189,6 +239,9 @@ struct escan_info {
         u8 escan_buf[WL_ESCAN_BUF_SIZE];
         struct wiphy *wiphy;
         struct net_device *ndev;
+        s32 (*run)(struct brcmf_cfg80211_info *cfg,
+                   struct net_device *ndev,
+                   struct cfg80211_scan_request *request, u16 action);
 };
 
 /**
@@ -273,10 +326,27 @@ struct brcmf_pno_scanresults_le {
 };
 
 /**
+ * struct brcmf_cfg80211_vif_event - virtual interface event information.
+ *
+ * @vif_wq: waitqueue awaiting interface event from firmware.
+ * @vif_event_lock: protects other members in this structure.
+ * @vif_complete: completion for net attach.
+ * @action: either add, change, or delete.
+ * @vif: virtual interface object related to the event.
+ */
+struct brcmf_cfg80211_vif_event {
+        wait_queue_head_t vif_wq;
+        struct mutex vif_event_lock;
+        u8 action;
+        struct brcmf_cfg80211_vif *vif;
+};
+
+/**
  * struct brcmf_cfg80211_info - dongle private data of cfg80211 interface
  *
  * @wiphy: wiphy object for cfg80211 interface.
  * @conf: dongle configuration.
+ * @p2p: peer-to-peer specific information.
  * @scan_request: cfg80211 scan request object.
  * @usr_sync: mainly for dongle up/down synchronization.
  * @bss_list: bss_list holding scanned ap information.
@@ -304,10 +374,12 @@ struct brcmf_pno_scanresults_le {
  * @escan_ioctl_buf: dongle command buffer for escan commands.
  * @vif_list: linked list of vif instances.
  * @vif_cnt: number of vif instances.
+ * @vif_event: vif event signalling.
  */
 struct brcmf_cfg80211_info {
         struct wiphy *wiphy;
         struct brcmf_cfg80211_conf *conf;
+        struct brcmf_p2p_info p2p;
         struct cfg80211_scan_request *scan_request;
         struct mutex usr_sync;
         struct brcmf_scan_results *bss_list;
@@ -335,6 +407,21 @@ struct brcmf_cfg80211_info {
         u8 *escan_ioctl_buf;
         struct list_head vif_list;
         u8 vif_cnt;
+        struct brcmf_cfg80211_vif_event vif_event;
+        struct completion vif_disabled;
+};
+
+/**
+ * struct brcmf_tlv - tag_ID/length/value_buffer tuple.
+ *
+ * @id: tag identifier.
+ * @len: number of bytes in value buffer.
+ * @data: value buffer.
+ */
+struct brcmf_tlv {
+        u8 id;
+        u8 len;
+        u8 data[1];
 };
 
 static inline struct wiphy *cfg_to_wiphy(struct brcmf_cfg80211_info *cfg)
@@ -389,4 +476,26 @@ void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg);
 s32 brcmf_cfg80211_up(struct net_device *ndev);
 s32 brcmf_cfg80211_down(struct net_device *ndev);
 
+struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
+                                           enum nl80211_iftype type,
+                                           bool pm_block);
+void brcmf_free_vif(struct brcmf_cfg80211_vif *vif);
+
+s32 brcmf_vif_set_mgmt_ie(struct brcmf_cfg80211_vif *vif, s32 pktflag,
+                          const u8 *vndr_ie_buf, u32 vndr_ie_len);
+s32 brcmf_vif_clear_mgmt_ies(struct brcmf_cfg80211_vif *vif);
+struct brcmf_tlv *brcmf_parse_tlvs(void *buf, int buflen, uint key);
+u16 channel_to_chanspec(struct ieee80211_channel *ch);
+u32 wl_get_vif_state_all(struct brcmf_cfg80211_info *cfg, unsigned long state);
+void brcmf_cfg80211_arm_vif_event(struct brcmf_cfg80211_info *cfg,
+                                  struct brcmf_cfg80211_vif *vif);
+bool brcmf_cfg80211_vif_event_armed(struct brcmf_cfg80211_info *cfg);
+int brcmf_cfg80211_wait_vif_event_timeout(struct brcmf_cfg80211_info *cfg,
+                                          u8 action, ulong timeout);
+s32 brcmf_notify_escan_complete(struct brcmf_cfg80211_info *cfg,
+                                struct net_device *ndev,
+                                bool aborted, bool fw_abort);
+void brcmf_set_mpc(struct net_device *ndev, int mpc);
+void brcmf_abort_scanning(struct brcmf_cfg80211_info *cfg);
+
 #endif                          /* _wl_cfg80211_h_ */
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/channel.c b/drivers/net/wireless/brcm80211/brcmsmac/channel.c
index cdb62b8ccc79..10ee314c4229 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/channel.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/channel.c
@@ -183,8 +183,7 @@ static bool brcms_c_country_valid(const char *ccode)
          * chars.
          */
         if (!((0x80 & ccode[0]) == 0 && ccode[0] >= 0x41 && ccode[0] <= 0x5A &&
-              (0x80 & ccode[1]) == 0 && ccode[1] >= 0x41 && ccode[1] <= 0x5A &&
-              ccode[2] == '\0'))
+              (0x80 & ccode[1]) == 0 && ccode[1] >= 0x41 && ccode[1] <= 0x5A))
                 return false;
 
         /*
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
index 62be5502b95d..8ef02dca8f8c 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
@@ -101,8 +101,6 @@
 #define DOT11_RTS_LEN                   16
 #define DOT11_CTS_LEN                   10
 #define DOT11_BA_BITMAP_LEN             128
-#define DOT11_MIN_BEACON_PERIOD         1
-#define DOT11_MAX_BEACON_PERIOD         0xFFFF
 #define DOT11_MAXNUMFRAGS               16
 #define DOT11_MAX_FRAG_LEN              2346
 
@@ -3140,8 +3138,7 @@ void brcms_c_reset(struct brcms_c_info *wlc)
         brcms_c_statsupd(wlc);
 
         /* reset our snapshot of macstat counters */
-        memset((char *)wlc->core->macstat_snapshot, 0,
-                sizeof(struct macstat));
+        memset(wlc->core->macstat_snapshot, 0, sizeof(struct macstat));
 
         brcms_b_reset(wlc->hw);
 }
@@ -4054,7 +4051,7 @@ void brcms_c_wme_setparams(struct brcms_c_info *wlc, u16 aci,
                 return;
         }
 
-        memset((char *)&acp_shm, 0, sizeof(struct shm_acparams));
+        memset(&acp_shm, 0, sizeof(struct shm_acparams));
         /* fill in shm ac params struct */
         acp_shm.txop = params->txop;
         /* convert from units of 32us to us for ucode */
@@ -4770,7 +4767,7 @@ static void brcms_c_bss_default_init(struct brcms_c_info *wlc)
         struct brcms_bss_info *bi = wlc->default_bss;
 
         /* init default and target BSS with some sane initial values */
-        memset((char *)(bi), 0, sizeof(struct brcms_bss_info));
+        memset(bi, 0, sizeof(*bi));
         bi->beacon_period = BEACON_INTERVAL_DEFAULT;
 
         /* fill the default channel as the first valid channel
@@ -5299,7 +5296,7 @@ int brcms_c_set_gmode(struct brcms_c_info *wlc, u8 gmode, bool config)
                 brcms_c_protection_upd(wlc, BRCMS_PROT_G_USER, gmode);
 
         /* Clear rateset override */
-        memset(&rs, 0, sizeof(struct brcms_c_rateset));
+        memset(&rs, 0, sizeof(rs));
 
         switch (gmode) {
         case GMODE_LEGACY_B:
@@ -5522,7 +5519,7 @@ int brcms_c_set_rateset(struct brcms_c_info *wlc, struct brcm_rateset *rs)
         if (rs->count > BRCMS_NUMRATES)
                 return -ENOBUFS;
 
-        memset(&internal_rs, 0, sizeof(struct brcms_c_rateset));
+        memset(&internal_rs, 0, sizeof(internal_rs));
 
         /* Copy only legacy rateset section */
         internal_rs.count = rs->count;
@@ -5548,8 +5545,7 @@ int brcms_c_set_rateset(struct brcms_c_info *wlc, struct brcm_rateset *rs)
 
 int brcms_c_set_beacon_period(struct brcms_c_info *wlc, u16 period)
 {
-        if (period < DOT11_MIN_BEACON_PERIOD ||
-            period > DOT11_MAX_BEACON_PERIOD)
+        if (period == 0)
                 return -EINVAL;
 
         wlc->default_bss->beacon_period = period;
@@ -5626,7 +5622,7 @@ int brcms_c_module_unregister(struct brcms_pub *pub, const char *name,
         for (i = 0; i < BRCMS_MAXMODULES; i++) {
                 if (!strcmp(wlc->modulecb[i].name, name) &&
                     (wlc->modulecb[i].hdl == hdl)) {
-                        memset(&wlc->modulecb[i], 0, sizeof(struct modulecb));
+                        memset(&wlc->modulecb[i], 0, sizeof(wlc->modulecb[i]));
                         return 0;
                 }
         }
@@ -6446,10 +6442,9 @@ brcms_c_d11hdrs_mac80211(struct brcms_c_info *wlc, struct ieee80211_hw *hw,
 
                         if ((txrate[k]->flags & IEEE80211_TX_RC_MCS)
                             && (!is_mcs_rate(rspec[k]))) {
-                                brcms_err(wlc->hw->d11core,
-                                          "wl%d: %s: IEEE80211_TX_"
-                                          "RC_MCS != is_mcs_rate(rspec)\n",
-                                          wlc->pub->unit, __func__);
+                                brcms_warn(wlc->hw->d11core,
+                                           "wl%d: %s: IEEE80211_TX_RC_MCS != is_mcs_rate(rspec)\n",
+                                           wlc->pub->unit, __func__);
                         }
 
                         if (is_mcs_rate(rspec[k])) {
@@ -6682,11 +6677,9 @@ brcms_c_d11hdrs_mac80211(struct brcms_c_info *wlc, struct ieee80211_hw *hw,
                                         (struct ofdm_phy_hdr *) rts_plcp) :
                                 rts_plcp[0]) << 8;
         } else {
-                memset((char *)txh->RTSPhyHeader, 0, D11_PHY_HDR_LEN);
-                memset((char *)&txh->rts_frame, 0,
-                        sizeof(struct ieee80211_rts));
-                memset((char *)txh->RTSPLCPFallback, 0,
-                      sizeof(txh->RTSPLCPFallback));
+                memset(txh->RTSPhyHeader, 0, D11_PHY_HDR_LEN);
+                memset(&txh->rts_frame, 0, sizeof(struct ieee80211_rts));
+                memset(txh->RTSPLCPFallback, 0, sizeof(txh->RTSPLCPFallback));
                 txh->RTSDurFallback = 0;
         }
 
@@ -6841,21 +6834,19 @@ brcms_c_d11hdrs_mac80211(struct brcms_c_info *wlc, struct ieee80211_hw *hw,
                                         wlc->fragthresh[queue] =
                                             (u16) newfragthresh;
                         } else {
-                                brcms_err(wlc->hw->d11core,
-                                          "wl%d: %s txop invalid "
-                                          "for rate %d\n",
-                                          wlc->pub->unit, fifo_names[queue],
-                                          rspec2rate(rspec[0]));
+                                brcms_warn(wlc->hw->d11core,
+                                           "wl%d: %s txop invalid for rate %d\n",
+                                           wlc->pub->unit, fifo_names[queue],
+                                           rspec2rate(rspec[0]));
                         }
 
                         if (dur > wlc->edcf_txop[ac])
-                                brcms_err(wlc->hw->d11core,
-                                          "wl%d: %s: %s txop "
-                                          "exceeded phylen %d/%d dur %d/%d\n",
-                                          wlc->pub->unit, __func__,
-                                          fifo_names[queue],
-                                          phylen, wlc->fragthresh[queue],
-                                          dur, wlc->edcf_txop[ac]);
+                                brcms_warn(wlc->hw->d11core,
+                                           "wl%d: %s: %s txop exceeded phylen %d/%d dur %d/%d\n",
+                                           wlc->pub->unit, __func__,
+                                           fifo_names[queue],
+                                           phylen, wlc->fragthresh[queue],
+                                           dur, wlc->edcf_txop[ac]);
                 }
         }
 
@@ -7330,7 +7321,7 @@ brcms_c_bcn_prb_template(struct brcms_c_info *wlc, u16 type,
         *len = hdr_len + body_len;
 
         /* format PHY and MAC headers */
-        memset((char *)buf, 0, hdr_len);
+        memset(buf, 0, hdr_len);
 
         plcp = (struct cck_phy_hdr *) buf;
 
@@ -7401,9 +7392,13 @@ brcms_c_bss_update_probe_resp(struct brcms_c_info *wlc,
                               struct brcms_bss_cfg *cfg,
                               bool suspend)
 {
-        u16 prb_resp[BCN_TMPL_LEN / 2];
+        u16 *prb_resp;
         int len = BCN_TMPL_LEN;
 
+        prb_resp = kmalloc(BCN_TMPL_LEN, GFP_ATOMIC);
+        if (!prb_resp)
+                return;
+
         /*
          * write the probe response to hardware, or save in
          * the config structure
@@ -7437,6 +7432,8 @@ brcms_c_bss_update_probe_resp(struct brcms_c_info *wlc,
 
         if (suspend)
                 brcms_c_enable_mac(wlc);
+
+        kfree(prb_resp);
 }
 
 void brcms_c_update_probe_resp(struct brcms_c_info *wlc, bool suspend)
diff --git a/drivers/net/wireless/iwlegacy/3945-mac.c b/drivers/net/wireless/iwlegacy/3945-mac.c
index 83856d1a6101..3630a41df50d 100644
--- a/drivers/net/wireless/iwlegacy/3945-mac.c
+++ b/drivers/net/wireless/iwlegacy/3945-mac.c
@@ -572,26 +572,11 @@ il3945_tx_skb(struct il_priv *il,
         il3945_hw_build_tx_cmd_rate(il, out_cmd, info, hdr, sta_id);
 
         /* Total # bytes to be transmitted */
-        len = (u16) skb->len;
-        tx_cmd->len = cpu_to_le16(len);
+        tx_cmd->len = cpu_to_le16((u16) skb->len);
 
-        il_update_stats(il, true, fc, len);
         tx_cmd->tx_flags &= ~TX_CMD_FLG_ANT_A_MSK;
         tx_cmd->tx_flags &= ~TX_CMD_FLG_ANT_B_MSK;
 
-        if (!ieee80211_has_morefrags(hdr->frame_control)) {
-                txq->need_update = 1;
-        } else {
-                wait_write_ptr = 1;
-                txq->need_update = 0;
-        }
-
-        D_TX("sequence nr = 0X%x\n", le16_to_cpu(out_cmd->hdr.sequence));
-        D_TX("tx_flags = 0X%x\n", le32_to_cpu(tx_cmd->tx_flags));
-        il_print_hex_dump(il, IL_DL_TX, tx_cmd, sizeof(*tx_cmd));
-        il_print_hex_dump(il, IL_DL_TX, (u8 *) tx_cmd->hdr,
-                          ieee80211_hdrlen(fc));
-
         /*
          * Use the first empty entry in this queue's command buffer array
          * to contain the Tx command and MAC header concatenated together
@@ -610,14 +595,8 @@ il3945_tx_skb(struct il_priv *il,
          * within command buffer array. */
         txcmd_phys =
             pci_map_single(il->pci_dev, &out_cmd->hdr, len, PCI_DMA_TODEVICE);
-        /* we do not map meta data ... so we can safely access address to
-         * provide to unmap command*/
-        dma_unmap_addr_set(out_meta, mapping, txcmd_phys);
-        dma_unmap_len_set(out_meta, len, len);
-
-        /* Add buffer containing Tx command and MAC(!) header to TFD's
-         * first entry */
-        il->ops->txq_attach_buf_to_tfd(il, txq, txcmd_phys, len, 1, 0);
+        if (unlikely(pci_dma_mapping_error(il->pci_dev, txcmd_phys)))
+                goto drop_unlock;
 
         /* Set up TFD's 2nd entry to point directly to remainder of skb,
          * if any (802.11 null frames have no payload). */
@@ -626,10 +605,34 @@ il3945_tx_skb(struct il_priv *il,
                 phys_addr =
                     pci_map_single(il->pci_dev, skb->data + hdr_len, len,
                                    PCI_DMA_TODEVICE);
+                if (unlikely(pci_dma_mapping_error(il->pci_dev, phys_addr)))
+                        goto drop_unlock;
+        }
+
+        /* Add buffer containing Tx command and MAC(!) header to TFD's
+         * first entry */
+        il->ops->txq_attach_buf_to_tfd(il, txq, txcmd_phys, len, 1, 0);
+        dma_unmap_addr_set(out_meta, mapping, txcmd_phys);
+        dma_unmap_len_set(out_meta, len, len);
+        if (len)
                 il->ops->txq_attach_buf_to_tfd(il, txq, phys_addr, len, 0,
                                                U32_PAD(len));
+
+        if (!ieee80211_has_morefrags(hdr->frame_control)) {
+                txq->need_update = 1;
+        } else {
+                wait_write_ptr = 1;
+                txq->need_update = 0;
         }
 
+        il_update_stats(il, true, fc, skb->len);
+
+        D_TX("sequence nr = 0X%x\n", le16_to_cpu(out_cmd->hdr.sequence));
+        D_TX("tx_flags = 0X%x\n", le32_to_cpu(tx_cmd->tx_flags));
+        il_print_hex_dump(il, IL_DL_TX, tx_cmd, sizeof(*tx_cmd));
+        il_print_hex_dump(il, IL_DL_TX, (u8 *) tx_cmd->hdr,
+                          ieee80211_hdrlen(fc));
+
         /* Tell device the write idx *just past* this latest filled TFD */
         q->write_ptr = il_queue_inc_wrap(q->write_ptr, q->n_bd);
         il_txq_update_write_ptr(il, txq);
diff --git a/drivers/net/wireless/iwlegacy/4965-mac.c b/drivers/net/wireless/iwlegacy/4965-mac.c
index 9741ac10a334..7941eb3a0166 100644
--- a/drivers/net/wireless/iwlegacy/4965-mac.c
+++ b/drivers/net/wireless/iwlegacy/4965-mac.c
@@ -1793,8 +1793,7 @@ il4965_tx_skb(struct il_priv *il,
         memcpy(tx_cmd->hdr, hdr, hdr_len);
 
         /* Total # bytes to be transmitted */
-        len = (u16) skb->len;
-        tx_cmd->len = cpu_to_le16(len);
+        tx_cmd->len = cpu_to_le16((u16) skb->len);
 
         if (info->control.hw_key)
                 il4965_tx_cmd_build_hwcrypto(il, info, tx_cmd, skb, sta_id);
@@ -1804,7 +1803,6 @@ il4965_tx_skb(struct il_priv *il,
 
         il4965_tx_cmd_build_rate(il, tx_cmd, info, sta, fc);
 
-        il_update_stats(il, true, fc, len);
         /*
          * Use the first empty entry in this queue's command buffer array
          * to contain the Tx command and MAC header concatenated together
@@ -1826,18 +1824,8 @@ il4965_tx_skb(struct il_priv *il,
         txcmd_phys =
             pci_map_single(il->pci_dev, &out_cmd->hdr, firstlen,
                            PCI_DMA_BIDIRECTIONAL);
-        dma_unmap_addr_set(out_meta, mapping, txcmd_phys);
-        dma_unmap_len_set(out_meta, len, firstlen);
-        /* Add buffer containing Tx command and MAC(!) header to TFD's
-         * first entry */
-        il->ops->txq_attach_buf_to_tfd(il, txq, txcmd_phys, firstlen, 1, 0);
-
-        if (!ieee80211_has_morefrags(hdr->frame_control)) {
-                txq->need_update = 1;
-        } else {
-                wait_write_ptr = 1;
-                txq->need_update = 0;
-        }
+        if (unlikely(pci_dma_mapping_error(il->pci_dev, txcmd_phys)))
+                goto drop_unlock;
 
         /* Set up TFD's 2nd entry to point directly to remainder of skb,
          * if any (802.11 null frames have no payload). */
@@ -1846,8 +1834,24 @@ il4965_tx_skb(struct il_priv *il,
                 phys_addr =
                     pci_map_single(il->pci_dev, skb->data + hdr_len, secondlen,
                                    PCI_DMA_TODEVICE);
+                if (unlikely(pci_dma_mapping_error(il->pci_dev, phys_addr)))
+                        goto drop_unlock;
+        }
+
+        /* Add buffer containing Tx command and MAC(!) header to TFD's
+         * first entry */
+        il->ops->txq_attach_buf_to_tfd(il, txq, txcmd_phys, firstlen, 1, 0);
+        dma_unmap_addr_set(out_meta, mapping, txcmd_phys);
+        dma_unmap_len_set(out_meta, len, firstlen);
+        if (secondlen)
                 il->ops->txq_attach_buf_to_tfd(il, txq, phys_addr, secondlen,
                                                0, 0);
+
+        if (!ieee80211_has_morefrags(hdr->frame_control)) {
+                txq->need_update = 1;
+        } else {
+                wait_write_ptr = 1;
+                txq->need_update = 0;
         }
 
         scratch_phys =
@@ -1860,6 +1864,8 @@ il4965_tx_skb(struct il_priv *il,
         tx_cmd->dram_lsb_ptr = cpu_to_le32(scratch_phys);
         tx_cmd->dram_msb_ptr = il_get_dma_hi_addr(scratch_phys);
 
+        il_update_stats(il, true, fc, skb->len);
+
         D_TX("sequence nr = 0X%x\n", le16_to_cpu(out_cmd->hdr.sequence));
         D_TX("tx_flags = 0X%x\n", le32_to_cpu(tx_cmd->tx_flags));
         il_print_hex_dump(il, IL_DL_TX, (u8 *) tx_cmd, sizeof(*tx_cmd));
@@ -5733,7 +5739,7 @@ il4965_mac_setup_register(struct il_priv *il, u32 max_probe_length)
         /* Tell mac80211 our characteristics */
         hw->flags =
             IEEE80211_HW_SIGNAL_DBM | IEEE80211_HW_AMPDU_AGGREGATION |
-            IEEE80211_HW_NEED_DTIM_PERIOD | IEEE80211_HW_SPECTRUM_MGMT |
+            IEEE80211_HW_NEED_DTIM_BEFORE_ASSOC | IEEE80211_HW_SPECTRUM_MGMT |
             IEEE80211_HW_REPORTS_TX_ACK_STATUS | IEEE80211_HW_SUPPORTS_PS |
             IEEE80211_HW_SUPPORTS_DYNAMIC_PS;
         if (il->cfg->sku & IL_SKU_N)
diff --git a/drivers/net/wireless/iwlegacy/4965-rs.c b/drivers/net/wireless/iwlegacy/4965-rs.c
index f3b8e91aa3dc..e8324b5e5bfe 100644
--- a/drivers/net/wireless/iwlegacy/4965-rs.c
+++ b/drivers/net/wireless/iwlegacy/4965-rs.c
@@ -1183,8 +1183,7 @@ il4965_rs_switch_to_mimo2(struct il_priv *il, struct il_lq_sta *lq_sta,
         if (!conf_is_ht(conf) || !sta->ht_cap.ht_supported)
                 return -1;
 
-        if (((sta->ht_cap.cap & IEEE80211_HT_CAP_SM_PS) >> 2) ==
-            WLAN_HT_CAP_SM_PS_STATIC)
+        if (sta->smps_mode == IEEE80211_SMPS_STATIC)
                 return -1;
 
         /* Need both Tx chains/antennas to support MIMO */
diff --git a/drivers/net/wireless/iwlegacy/common.c b/drivers/net/wireless/iwlegacy/common.c
index 1f598604a79c..e006ea831320 100644
--- a/drivers/net/wireless/iwlegacy/common.c
+++ b/drivers/net/wireless/iwlegacy/common.c
@@ -1830,32 +1830,30 @@ il_set_ht_add_station(struct il_priv *il, u8 idx, struct ieee80211_sta *sta)
 {
         struct ieee80211_sta_ht_cap *sta_ht_inf = &sta->ht_cap;
         __le32 sta_flags;
-        u8 mimo_ps_mode;
 
         if (!sta || !sta_ht_inf->ht_supported)
                 goto done;
 
-        mimo_ps_mode = (sta_ht_inf->cap & IEEE80211_HT_CAP_SM_PS) >> 2;
         D_ASSOC("spatial multiplexing power save mode: %s\n",
-                (mimo_ps_mode == WLAN_HT_CAP_SM_PS_STATIC) ? "static" :
-                (mimo_ps_mode == WLAN_HT_CAP_SM_PS_DYNAMIC) ? "dynamic" :
+                (sta->smps_mode == IEEE80211_SMPS_STATIC) ? "static" :
+                (sta->smps_mode == IEEE80211_SMPS_DYNAMIC) ? "dynamic" :
                 "disabled");
 
         sta_flags = il->stations[idx].sta.station_flags;
 
         sta_flags &= ~(STA_FLG_RTS_MIMO_PROT_MSK | STA_FLG_MIMO_DIS_MSK);
 
-        switch (mimo_ps_mode) {
-        case WLAN_HT_CAP_SM_PS_STATIC:
+        switch (sta->smps_mode) {
+        case IEEE80211_SMPS_STATIC:
                 sta_flags |= STA_FLG_MIMO_DIS_MSK;
                 break;
-        case WLAN_HT_CAP_SM_PS_DYNAMIC:
+        case IEEE80211_SMPS_DYNAMIC:
                 sta_flags |= STA_FLG_RTS_MIMO_PROT_MSK;
                 break;
-        case WLAN_HT_CAP_SM_PS_DISABLED:
+        case IEEE80211_SMPS_OFF:
                 break;
         default:
-                IL_WARN("Invalid MIMO PS mode %d\n", mimo_ps_mode);
+                IL_WARN("Invalid MIMO PS mode %d\n", sta->smps_mode);
                 break;
         }
 
@@ -3162,18 +3160,23 @@ il_enqueue_hcmd(struct il_priv *il, struct il_host_cmd *cmd)
                      idx, il->cmd_queue);
         }
 #endif
-        txq->need_update = 1;
-
-        if (il->ops->txq_update_byte_cnt_tbl)
-                /* Set up entry in queue's byte count circular buffer */
-                il->ops->txq_update_byte_cnt_tbl(il, txq, 0);
 
         phys_addr =
             pci_map_single(il->pci_dev, &out_cmd->hdr, fix_size,
                            PCI_DMA_BIDIRECTIONAL);
+        if (unlikely(pci_dma_mapping_error(il->pci_dev, phys_addr))) {
+                idx = -ENOMEM;
+                goto out;
+        }
         dma_unmap_addr_set(out_meta, mapping, phys_addr);
         dma_unmap_len_set(out_meta, len, fix_size);
 
+        txq->need_update = 1;
+
+        if (il->ops->txq_update_byte_cnt_tbl)
+                /* Set up entry in queue's byte count circular buffer */
+                il->ops->txq_update_byte_cnt_tbl(il, txq, 0);
+
         il->ops->txq_attach_buf_to_tfd(il, txq, phys_addr, fix_size, 1,
                                             U32_PAD(cmd->len));
 
@@ -3181,6 +3184,7 @@ il_enqueue_hcmd(struct il_priv *il, struct il_host_cmd *cmd)
         q->write_ptr = il_queue_inc_wrap(q->write_ptr, q->n_bd);
         il_txq_update_write_ptr(il, txq);
 
+out:
         spin_unlock_irqrestore(&il->hcmd_lock, flags);
         return idx;
 }
diff --git a/drivers/net/wireless/iwlwifi/dvm/agn.h b/drivers/net/wireless/iwlwifi/dvm/agn.h
index f41ae79e6bc0..41ec27cb6efe 100644
--- a/drivers/net/wireless/iwlwifi/dvm/agn.h
+++ b/drivers/net/wireless/iwlwifi/dvm/agn.h
@@ -338,7 +338,7 @@ int iwl_sta_update_ht(struct iwl_priv *priv, struct iwl_rxon_context *ctx,
 
 bool iwl_is_ht40_tx_allowed(struct iwl_priv *priv,
                             struct iwl_rxon_context *ctx,
-                            struct ieee80211_sta_ht_cap *ht_cap);
+                            struct ieee80211_sta *sta);
 
 static inline int iwl_sta_id(struct ieee80211_sta *sta)
 {
diff --git a/drivers/net/wireless/iwlwifi/dvm/commands.h b/drivers/net/wireless/iwlwifi/dvm/commands.h
index 8bce4b0148e0..02c9ebb3b340 100644
--- a/drivers/net/wireless/iwlwifi/dvm/commands.h
+++ b/drivers/net/wireless/iwlwifi/dvm/commands.h
@@ -3897,6 +3897,24 @@ struct iwlagn_wowlan_kek_kck_material_cmd {
         __le64  replay_ctr;
 } __packed;
 
+#define RF_KILL_INDICATOR_FOR_WOWLAN    0x87
+
+/*
+ * REPLY_WOWLAN_GET_STATUS = 0xe5
+ */
+struct iwlagn_wowlan_status {
+        __le64 replay_ctr;
+        __le32 rekey_status;
+        __le32 wakeup_reason;
+        u8 pattern_number;
+        u8 reserved1;
+        __le16 qos_seq_ctr[8];
+        __le16 non_qos_seq_ctr;
+        __le16 reserved2;
+        union iwlagn_all_tsc_rsc tsc_rsc;
+        __le16 reserved3;
+} __packed;
+
 /*
  * REPLY_WIPAN_PARAMS = 0xb2 (Commands and Notification)
  */
diff --git a/drivers/net/wireless/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
index c2f03ecd4bf8..323e4a33fcac 100644
--- a/drivers/net/wireless/iwlwifi/dvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
@@ -145,14 +145,13 @@ int iwlagn_mac_setup_register(struct iwl_priv *priv,
         /* Tell mac80211 our characteristics */
         hw->flags = IEEE80211_HW_SIGNAL_DBM |
                     IEEE80211_HW_AMPDU_AGGREGATION |
-                    IEEE80211_HW_NEED_DTIM_PERIOD |
+                    IEEE80211_HW_NEED_DTIM_BEFORE_ASSOC |
                     IEEE80211_HW_SPECTRUM_MGMT |
                     IEEE80211_HW_REPORTS_TX_ACK_STATUS |
                     IEEE80211_HW_QUEUE_CONTROL |
                     IEEE80211_HW_SUPPORTS_PS |
                     IEEE80211_HW_SUPPORTS_DYNAMIC_PS |
-                    IEEE80211_HW_WANT_MONITOR_VIF |
-                    IEEE80211_HW_SCAN_WHILE_IDLE;
+                    IEEE80211_HW_WANT_MONITOR_VIF;
 
         hw->offchannel_tx_hw_queue = IWL_AUX_QUEUE;
         hw->radiotap_mcs_details |= IEEE80211_RADIOTAP_MCS_HAVE_FMT;
@@ -442,52 +441,154 @@ static int iwlagn_mac_suspend(struct ieee80211_hw *hw,
         return ret;
 }
 
+struct iwl_resume_data {
+        struct iwl_priv *priv;
+        struct iwlagn_wowlan_status *cmd;
+        bool valid;
+};
+
+static bool iwl_resume_status_fn(struct iwl_notif_wait_data *notif_wait,
+                                 struct iwl_rx_packet *pkt, void *data)
+{
+        struct iwl_resume_data *resume_data = data;
+        struct iwl_priv *priv = resume_data->priv;
+        u32 len = le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
+
+        if (len - 4 != sizeof(*resume_data->cmd)) {
+                IWL_ERR(priv, "rx wrong size data\n");
+                return true;
+        }
+        memcpy(resume_data->cmd, pkt->data, sizeof(*resume_data->cmd));
+        resume_data->valid = true;
+
+        return true;
+}
+
 static int iwlagn_mac_resume(struct ieee80211_hw *hw)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
         struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
         struct ieee80211_vif *vif;
-        unsigned long flags;
-        u32 base, status = 0xffffffff;
-        int ret = -EIO;
+        u32 base;
+        int ret;
+        enum iwl_d3_status d3_status;
+        struct error_table_start {
+                /* cf. struct iwl_error_event_table */
+                u32 valid;
+                u32 error_id;
+        } err_info;
+        struct iwl_notification_wait status_wait;
+        static const u8 status_cmd[] = {
+                REPLY_WOWLAN_GET_STATUS,
+        };
+        struct iwlagn_wowlan_status status_data = {};
+        struct iwl_resume_data resume_data = {
+                .priv = priv,
+                .cmd = &status_data,
+                .valid = false,
+        };
+        struct cfg80211_wowlan_wakeup wakeup = {
+                .pattern_idx = -1,
+        };
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+        const struct fw_img *img;
+#endif
 
         IWL_DEBUG_MAC80211(priv, "enter\n");
         mutex_lock(&priv->mutex);
 
-        iwl_write32(priv->trans, CSR_UCODE_DRV_GP1_CLR,
-                          CSR_UCODE_DRV_GP1_BIT_D3_CFG_COMPLETE);
+        /* we'll clear ctx->vif during iwlagn_prepare_restart() */
+        vif = ctx->vif;
+
+        ret = iwl_trans_d3_resume(priv->trans, &d3_status);
+        if (ret)
+                goto out_unlock;
+
+        if (d3_status != IWL_D3_STATUS_ALIVE) {
+                IWL_INFO(priv, "Device was reset during suspend\n");
+                goto out_unlock;
+        }
 
         base = priv->device_pointers.error_event_table;
-        if (iwlagn_hw_valid_rtc_data_addr(base)) {
-                if (iwl_trans_grab_nic_access(priv->trans, true, &flags)) {
-                        iwl_write32(priv->trans, HBUS_TARG_MEM_RADDR, base);
-                        status = iwl_read32(priv->trans, HBUS_TARG_MEM_RDAT);
-                        iwl_trans_release_nic_access(priv->trans, &flags);
-                        ret = 0;
+        if (!iwlagn_hw_valid_rtc_data_addr(base)) {
+                IWL_WARN(priv, "Invalid error table during resume!\n");
+                goto out_unlock;
+        }
+
+        iwl_trans_read_mem_bytes(priv->trans, base,
+                                 &err_info, sizeof(err_info));
+
+        if (err_info.valid) {
+                IWL_INFO(priv, "error table is valid (%d, 0x%x)\n",
+                         err_info.valid, err_info.error_id);
+                if (err_info.error_id == RF_KILL_INDICATOR_FOR_WOWLAN) {
+                        wakeup.rfkill_release = true;
+                        ieee80211_report_wowlan_wakeup(vif, &wakeup,
+                                                       GFP_KERNEL);
                 }
+                goto out_unlock;
+        }
 
 #ifdef CONFIG_IWLWIFI_DEBUGFS
-                if (ret == 0) {
-                        const struct fw_img *img;
-
-                        img = &(priv->fw->img[IWL_UCODE_WOWLAN]);
-                        if (!priv->wowlan_sram) {
-                                priv->wowlan_sram =
-                                   kzalloc(img->sec[IWL_UCODE_SECTION_DATA].len,
-                                                GFP_KERNEL);
-                        }
+        img = &priv->fw->img[IWL_UCODE_WOWLAN];
+        if (!priv->wowlan_sram)
+                priv->wowlan_sram =
+                        kzalloc(img->sec[IWL_UCODE_SECTION_DATA].len,
+                                GFP_KERNEL);
+
+        if (priv->wowlan_sram)
+                iwl_trans_read_mem(priv->trans, 0x800000,
+                                   priv->wowlan_sram,
+                                   img->sec[IWL_UCODE_SECTION_DATA].len / 4);
+#endif
 
-                        if (priv->wowlan_sram)
-                                iwl_trans_read_mem(
-                                      priv->trans, 0x800000,
-                                      priv->wowlan_sram,
-                                      img->sec[IWL_UCODE_SECTION_DATA].len / 4);
+        /*
+         * This is very strange. The GET_STATUS command is sent but the device
+         * doesn't reply properly, it seems it doesn't close the RBD so one is
+         * always left open ... As a result, we need to send another command
+         * and have to reset the driver afterwards. As we need to switch to
+         * runtime firmware again that'll happen.
+         */
+
+        iwl_init_notification_wait(&priv->notif_wait, &status_wait, status_cmd,
+                                   ARRAY_SIZE(status_cmd), iwl_resume_status_fn,
+                                   &resume_data);
+
+        iwl_dvm_send_cmd_pdu(priv, REPLY_WOWLAN_GET_STATUS, CMD_ASYNC, 0, NULL);
+        iwl_dvm_send_cmd_pdu(priv, REPLY_ECHO, CMD_ASYNC, 0, NULL);
+        /* an RBD is left open in the firmware now! */
+
+        ret = iwl_wait_notification(&priv->notif_wait, &status_wait, HZ/5);
+        if (ret)
+                goto out_unlock;
+
+        if (resume_data.valid && priv->contexts[IWL_RXON_CTX_BSS].vif) {
+                u32 reasons = le32_to_cpu(status_data.wakeup_reason);
+                struct cfg80211_wowlan_wakeup *wakeup_report;
+
+                IWL_INFO(priv, "WoWLAN wakeup reason(s): 0x%.8x\n", reasons);
+
+                if (reasons) {
+                        if (reasons & IWLAGN_WOWLAN_WAKEUP_MAGIC_PACKET)
+                                wakeup.magic_pkt = true;
+                        if (reasons & IWLAGN_WOWLAN_WAKEUP_PATTERN_MATCH)
+                                wakeup.pattern_idx = status_data.pattern_number;
+                        if (reasons & (IWLAGN_WOWLAN_WAKEUP_BEACON_MISS |
+                                       IWLAGN_WOWLAN_WAKEUP_LINK_CHANGE))
+                                wakeup.disconnect = true;
+                        if (reasons & IWLAGN_WOWLAN_WAKEUP_GTK_REKEY_FAIL)
+                                wakeup.gtk_rekey_failure = true;
+                        if (reasons & IWLAGN_WOWLAN_WAKEUP_EAP_IDENT_REQ)
+                                wakeup.eap_identity_req = true;
+                        if (reasons & IWLAGN_WOWLAN_WAKEUP_4WAY_HANDSHAKE)
+                                wakeup.four_way_handshake = true;
+                        wakeup_report = &wakeup;
+                } else {
+                        wakeup_report = NULL;
                 }
-#endif
-        }
 
-        /* we'll clear ctx->vif during iwlagn_prepare_restart() */
-        vif = ctx->vif;
+                ieee80211_report_wowlan_wakeup(vif, wakeup_report, GFP_KERNEL);
+        }
 
         priv->wowlan = false;
 
@@ -497,6 +598,7 @@ static int iwlagn_mac_resume(struct ieee80211_hw *hw)
         iwl_connection_init_rx_config(priv, ctx);
         iwlagn_set_rxon_chain(priv, ctx);
 
+ out_unlock:
         mutex_unlock(&priv->mutex);
         IWL_DEBUG_MAC80211(priv, "leave\n");
 
diff --git a/drivers/net/wireless/iwlwifi/dvm/rs.c b/drivers/net/wireless/iwlwifi/dvm/rs.c
index a131227c49e9..abe304267261 100644
--- a/drivers/net/wireless/iwlwifi/dvm/rs.c
+++ b/drivers/net/wireless/iwlwifi/dvm/rs.c
@@ -1289,8 +1289,7 @@ static int rs_switch_to_mimo2(struct iwl_priv *priv,
         if (!conf_is_ht(conf) || !sta->ht_cap.ht_supported)
                 return -1;
 
-        if (((sta->ht_cap.cap & IEEE80211_HT_CAP_SM_PS) >> 2)
-                                                == WLAN_HT_CAP_SM_PS_STATIC)
+        if (sta->smps_mode == IEEE80211_SMPS_STATIC)
                 return -1;
 
         /* Need both Tx chains/antennas to support MIMO */
@@ -1305,7 +1304,7 @@ static int rs_switch_to_mimo2(struct iwl_priv *priv,
         tbl->max_search = IWL_MAX_SEARCH;
         rate_mask = lq_sta->active_mimo2_rate;
 
-        if (iwl_is_ht40_tx_allowed(priv, ctx, &sta->ht_cap))
+        if (iwl_is_ht40_tx_allowed(priv, ctx, sta))
                 tbl->is_ht40 = 1;
         else
                 tbl->is_ht40 = 0;
@@ -1345,8 +1344,7 @@ static int rs_switch_to_mimo3(struct iwl_priv *priv,
         if (!conf_is_ht(conf) || !sta->ht_cap.ht_supported)
                 return -1;
 
-        if (((sta->ht_cap.cap & IEEE80211_HT_CAP_SM_PS) >> 2)
-                                                == WLAN_HT_CAP_SM_PS_STATIC)
+        if (sta->smps_mode == IEEE80211_SMPS_STATIC)
                 return -1;
 
         /* Need both Tx chains/antennas to support MIMO */
@@ -1361,7 +1359,7 @@ static int rs_switch_to_mimo3(struct iwl_priv *priv,
         tbl->max_search = IWL_MAX_11N_MIMO3_SEARCH;
         rate_mask = lq_sta->active_mimo3_rate;
 
-        if (iwl_is_ht40_tx_allowed(priv, ctx, &sta->ht_cap))
+        if (iwl_is_ht40_tx_allowed(priv, ctx, sta))
                 tbl->is_ht40 = 1;
         else
                 tbl->is_ht40 = 0;
@@ -1410,7 +1408,7 @@ static int rs_switch_to_siso(struct iwl_priv *priv,
         tbl->max_search = IWL_MAX_SEARCH;
         rate_mask = lq_sta->active_siso_rate;
 
-        if (iwl_is_ht40_tx_allowed(priv, ctx, &sta->ht_cap))
+        if (iwl_is_ht40_tx_allowed(priv, ctx, sta))
                 tbl->is_ht40 = 1;
         else
                 tbl->is_ht40 = 0;
diff --git a/drivers/net/wireless/iwlwifi/dvm/rx.c b/drivers/net/wireless/iwlwifi/dvm/rx.c
index e8d5b90abf5c..a4eed2055fdb 100644
--- a/drivers/net/wireless/iwlwifi/dvm/rx.c
+++ b/drivers/net/wireless/iwlwifi/dvm/rx.c
@@ -790,7 +790,7 @@ static void iwlagn_pass_packet_to_mac80211(struct iwl_priv *priv,
 
         memcpy(IEEE80211_SKB_RXCB(skb), stats, sizeof(*stats));
 
-        ieee80211_rx(priv->hw, skb);
+        ieee80211_rx_ni(priv->hw, skb);
 }
 
 static u32 iwlagn_translate_rx_status(struct iwl_priv *priv, u32 decrypt_in)
diff --git a/drivers/net/wireless/iwlwifi/dvm/rxon.c b/drivers/net/wireless/iwlwifi/dvm/rxon.c
index 9fabd26997ca..23be948cf162 100644
--- a/drivers/net/wireless/iwlwifi/dvm/rxon.c
+++ b/drivers/net/wireless/iwlwifi/dvm/rxon.c
@@ -1545,10 +1545,9 @@ void iwlagn_bss_info_changed(struct ieee80211_hw *hw,
                                 bss_conf->bssid);
         }
 
-        if (changes & BSS_CHANGED_BEACON && vif->type == NL80211_IFTYPE_ADHOC &&
-            priv->beacon_ctx) {
+        if (changes & BSS_CHANGED_BEACON && priv->beacon_ctx == ctx) {
                 if (iwlagn_update_beacon(priv, vif))
-                        IWL_ERR(priv, "Error sending IBSS beacon\n");
+                        IWL_ERR(priv, "Error updating beacon\n");
         }
 
         mutex_unlock(&priv->mutex);
diff --git a/drivers/net/wireless/iwlwifi/dvm/sta.c b/drivers/net/wireless/iwlwifi/dvm/sta.c
index ab768045696b..94ef33838bc6 100644
--- a/drivers/net/wireless/iwlwifi/dvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/dvm/sta.c
@@ -77,7 +77,7 @@ static int iwl_process_add_sta_resp(struct iwl_priv *priv,
         IWL_DEBUG_INFO(priv, "Processing response for adding station %u\n",
                        sta_id);
 
-        spin_lock(&priv->sta_lock);
+        spin_lock_bh(&priv->sta_lock);
 
         switch (add_sta_resp->status) {
         case ADD_STA_SUCCESS_MSK:
@@ -119,7 +119,7 @@ static int iwl_process_add_sta_resp(struct iwl_priv *priv,
                        priv->stations[sta_id].sta.mode ==
                        STA_CONTROL_MODIFY_MSK ? "Modified" : "Added",
                        addsta->sta.addr);
-        spin_unlock(&priv->sta_lock);
+        spin_unlock_bh(&priv->sta_lock);
 
         return ret;
 }
@@ -173,7 +173,7 @@ int iwl_send_add_sta(struct iwl_priv *priv,
 
 bool iwl_is_ht40_tx_allowed(struct iwl_priv *priv,
                             struct iwl_rxon_context *ctx,
-                            struct ieee80211_sta_ht_cap *ht_cap)
+                            struct ieee80211_sta *sta)
 {
         if (!ctx->ht.enabled || !ctx->ht.is_40mhz)
                 return false;
@@ -183,20 +183,11 @@ bool iwl_is_ht40_tx_allowed(struct iwl_priv *priv,
                 return false;
 #endif
 
-        /*
-         * Remainder of this function checks ht_cap, but if it's
-         * NULL then we can do HT40 (special case for RXON)
-         */
-        if (!ht_cap)
+        /* special case for RXON */
+        if (!sta)
                 return true;
 
-        if (!ht_cap->ht_supported)
-                return false;
-
-        if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40))
-                return false;
-
-        return true;
+        return sta->bandwidth >= IEEE80211_STA_RX_BW_40;
 }
 
 static void iwl_sta_calc_ht_flags(struct iwl_priv *priv,
@@ -205,7 +196,6 @@ static void iwl_sta_calc_ht_flags(struct iwl_priv *priv,
                                   __le32 *flags, __le32 *mask)
 {
         struct ieee80211_sta_ht_cap *sta_ht_inf = &sta->ht_cap;
-        u8 mimo_ps_mode;
 
         *mask = STA_FLG_RTS_MIMO_PROT_MSK |
                 STA_FLG_MIMO_DIS_MSK |
@@ -217,26 +207,24 @@ static void iwl_sta_calc_ht_flags(struct iwl_priv *priv,
         if (!sta || !sta_ht_inf->ht_supported)
                 return;
 
-        mimo_ps_mode = (sta_ht_inf->cap & IEEE80211_HT_CAP_SM_PS) >> 2;
-
         IWL_DEBUG_INFO(priv, "STA %pM SM PS mode: %s\n",
                         sta->addr,
-                        (mimo_ps_mode == WLAN_HT_CAP_SM_PS_STATIC) ?
+                        (sta->smps_mode == IEEE80211_SMPS_STATIC) ?
                         "static" :
-                        (mimo_ps_mode == WLAN_HT_CAP_SM_PS_DYNAMIC) ?
+                        (sta->smps_mode == IEEE80211_SMPS_DYNAMIC) ?
                         "dynamic" : "disabled");
 
-        switch (mimo_ps_mode) {
-        case WLAN_HT_CAP_SM_PS_STATIC:
+        switch (sta->smps_mode) {
+        case IEEE80211_SMPS_STATIC:
                 *flags |= STA_FLG_MIMO_DIS_MSK;
                 break;
-        case WLAN_HT_CAP_SM_PS_DYNAMIC:
+        case IEEE80211_SMPS_DYNAMIC:
                 *flags |= STA_FLG_RTS_MIMO_PROT_MSK;
                 break;
-        case WLAN_HT_CAP_SM_PS_DISABLED:
+        case IEEE80211_SMPS_OFF:
                 break;
         default:
-                IWL_WARN(priv, "Invalid MIMO PS mode %d\n", mimo_ps_mode);
+                IWL_WARN(priv, "Invalid MIMO PS mode %d\n", sta->smps_mode);
                 break;
         }
 
@@ -246,7 +234,7 @@ static void iwl_sta_calc_ht_flags(struct iwl_priv *priv,
         *flags |= cpu_to_le32(
                 (u32)sta_ht_inf->ampdu_density << STA_FLG_AGG_MPDU_DENSITY_POS);
 
-        if (iwl_is_ht40_tx_allowed(priv, ctx, &sta->ht_cap))
+        if (iwl_is_ht40_tx_allowed(priv, ctx, sta))
                 *flags |= STA_FLG_HT40_EN_MSK;
 }
 
diff --git a/drivers/net/wireless/iwlwifi/dvm/tx.c b/drivers/net/wireless/iwlwifi/dvm/tx.c
index f4a013675947..d1dccb361391 100644
--- a/drivers/net/wireless/iwlwifi/dvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/dvm/tx.c
@@ -1117,7 +1117,7 @@ int iwlagn_rx_reply_tx(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb,
         sta_id = (tx_resp->ra_tid & IWLAGN_TX_RES_RA_MSK) >>
                 IWLAGN_TX_RES_RA_POS;
 
-        spin_lock(&priv->sta_lock);
+        spin_lock_bh(&priv->sta_lock);
 
         if (is_agg)
                 iwl_rx_reply_tx_agg(priv, tx_resp);
@@ -1207,7 +1207,15 @@ int iwlagn_rx_reply_tx(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb,
                         freed++;
                 }
 
-                WARN_ON(!is_agg && freed != 1);
+                if (tid != IWL_TID_NON_QOS) {
+                        priv->tid_data[sta_id][tid].next_reclaimed =
+                                next_reclaimed;
+                        IWL_DEBUG_TX_REPLY(priv, "Next reclaimed packet:%d\n",
+                                           next_reclaimed);
+                }
+
+                if (!is_agg && freed != 1)
+                        IWL_ERR(priv, "Q: %d, freed %d\n", txq_id, freed);
 
                 /*
                  * An offchannel frame can be send only on the AUX queue, where
@@ -1228,11 +1236,11 @@ int iwlagn_rx_reply_tx(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb,
                            le16_to_cpu(tx_resp->seq_ctl));
 
         iwl_check_abort_status(priv, tx_resp->frame_count, status);
-        spin_unlock(&priv->sta_lock);
+        spin_unlock_bh(&priv->sta_lock);
 
         while (!skb_queue_empty(&skbs)) {
                 skb = __skb_dequeue(&skbs);
-                ieee80211_tx_status(priv->hw, skb);
+                ieee80211_tx_status_ni(priv->hw, skb);
         }
 
         if (is_offchannel_skb)
@@ -1279,12 +1287,12 @@ int iwlagn_rx_reply_compressed_ba(struct iwl_priv *priv,
         tid = ba_resp->tid;
         agg = &priv->tid_data[sta_id][tid].agg;
 
-        spin_lock(&priv->sta_lock);
+        spin_lock_bh(&priv->sta_lock);
 
         if (unlikely(!agg->wait_for_ba)) {
                 if (unlikely(ba_resp->bitmap))
                         IWL_ERR(priv, "Received BA when not expected\n");
-                spin_unlock(&priv->sta_lock);
+                spin_unlock_bh(&priv->sta_lock);
                 return 0;
         }
 
@@ -1298,7 +1306,7 @@ int iwlagn_rx_reply_compressed_ba(struct iwl_priv *priv,
                 IWL_DEBUG_TX_QUEUES(priv,
                                     "Bad queue mapping txq_id=%d, agg_txq[sta:%d,tid:%d]=%d\n",
                                     scd_flow, sta_id, tid, agg->txq_id);
-                spin_unlock(&priv->sta_lock);
+                spin_unlock_bh(&priv->sta_lock);
                 return 0;
         }
 
@@ -1367,11 +1375,11 @@ int iwlagn_rx_reply_compressed_ba(struct iwl_priv *priv,
                 }
         }
 
-        spin_unlock(&priv->sta_lock);
+        spin_unlock_bh(&priv->sta_lock);
 
         while (!skb_queue_empty(&reclaimed_skbs)) {
                 skb = __skb_dequeue(&reclaimed_skbs);
-                ieee80211_tx_status(priv->hw, skb);
+                ieee80211_tx_status_ni(priv->hw, skb);
         }
 
         return 0;
diff --git a/drivers/net/wireless/iwlwifi/iwl-op-mode.h b/drivers/net/wireless/iwlwifi/iwl-op-mode.h
index dc792584f401..4a680019e117 100644
--- a/drivers/net/wireless/iwlwifi/iwl-op-mode.h
+++ b/drivers/net/wireless/iwlwifi/iwl-op-mode.h
@@ -113,13 +113,13 @@ struct iwl_cfg;
  *      May sleep
  * @rx: Rx notification to the op_mode. rxb is the Rx buffer itself. Cmd is the
  *      HCMD the this Rx responds to.
- *      Must be atomic and called with BH disabled.
+ *      This callback may sleep, it is called from a threaded IRQ handler.
  * @queue_full: notifies that a HW queue is full.
  *      Must be atomic and called with BH disabled.
  * @queue_not_full: notifies that a HW queue is not full any more.
  *      Must be atomic and called with BH disabled.
  * @hw_rf_kill:notifies of a change in the HW rf kill switch. True means that
- *      the radio is killed. Must be atomic.
+ *      the radio is killed. May sleep.
  * @free_skb: allows the transport layer to free skbs that haven't been
  *      reclaimed by the op_mode. This can happen when the driver is freed and
  *      there are Tx packets pending in the transport layer.
@@ -130,8 +130,7 @@ struct iwl_cfg;
  *      called with BH disabled.
  * @nic_config: configure NIC, called before firmware is started.
  *      May sleep
- * @wimax_active: invoked when WiMax becomes active.  Must be atomic and called
- *      with BH disabled.
+ * @wimax_active: invoked when WiMax becomes active. May sleep
  */
 struct iwl_op_mode_ops {
         struct iwl_op_mode *(*start)(struct iwl_trans *trans,
@@ -178,6 +177,7 @@ static inline int iwl_op_mode_rx(struct iwl_op_mode *op_mode,
                                   struct iwl_rx_cmd_buffer *rxb,
                                   struct iwl_device_cmd *cmd)
 {
+        might_sleep();
         return op_mode->ops->rx(op_mode, rxb, cmd);
 }
 
@@ -196,6 +196,7 @@ static inline void iwl_op_mode_queue_not_full(struct iwl_op_mode *op_mode,
 static inline void iwl_op_mode_hw_rf_kill(struct iwl_op_mode *op_mode,
                                           bool state)
 {
+        might_sleep();
         op_mode->ops->hw_rf_kill(op_mode, state);
 }
 
@@ -223,6 +224,7 @@ static inline void iwl_op_mode_nic_config(struct iwl_op_mode *op_mode)
 
 static inline void iwl_op_mode_wimax_active(struct iwl_op_mode *op_mode)
 {
+        might_sleep();
         op_mode->ops->wimax_active(op_mode);
 }
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans.h b/drivers/net/wireless/iwlwifi/iwl-trans.h
index 0a3d4df5f434..8c7bec6b9a0b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans.h
+++ b/drivers/net/wireless/iwlwifi/iwl-trans.h
@@ -65,6 +65,7 @@
 
 #include <linux/ieee80211.h>
 #include <linux/mm.h> /* for page_address */
+#include <linux/lockdep.h>
 
 #include "iwl-debug.h"
 #include "iwl-config.h"
@@ -526,6 +527,10 @@ struct iwl_trans {
 
         struct dentry *dbgfs_dir;
 
+#ifdef CONFIG_LOCKDEP
+        struct lockdep_map sync_cmd_lockdep_map;
+#endif
+
         /* pointer to trans specific struct */
         /*Ensure that this pointer will always be aligned to sizeof pointer */
         char trans_specific[0] __aligned(sizeof(void *));
@@ -602,12 +607,22 @@ static inline int iwl_trans_d3_resume(struct iwl_trans *trans,
 }
 
 static inline int iwl_trans_send_cmd(struct iwl_trans *trans,
-                                struct iwl_host_cmd *cmd)
+                                     struct iwl_host_cmd *cmd)
 {
+        int ret;
+
         WARN_ONCE(trans->state != IWL_TRANS_FW_ALIVE,
                   "%s bad state = %d", __func__, trans->state);
 
-        return trans->ops->send_cmd(trans, cmd);
+        if (!(cmd->flags & CMD_ASYNC))
+                lock_map_acquire_read(&trans->sync_cmd_lockdep_map);
+
+        ret = trans->ops->send_cmd(trans, cmd);
+
+        if (!(cmd->flags & CMD_ASYNC))
+                lock_map_release(&trans->sync_cmd_lockdep_map);
+
+        return ret;
 }
 
 static inline struct iwl_device_cmd *
@@ -791,4 +806,14 @@ iwl_trans_release_nic_access(struct iwl_trans *trans, unsigned long *flags)
 int __must_check iwl_pci_register_driver(void);
 void iwl_pci_unregister_driver(void);
 
+static inline void trans_lockdep_init(struct iwl_trans *trans)
+{
+#ifdef CONFIG_LOCKDEP
+        static struct lock_class_key __key;
+
+        lockdep_init_map(&trans->sync_cmd_lockdep_map, "sync_cmd_lockdep_map",
+                         &__key, 0);
+#endif
+}
+
 #endif /* __iwl_trans_h__ */
diff --git a/drivers/net/wireless/iwlwifi/mvm/d3.c b/drivers/net/wireless/iwlwifi/mvm/d3.c
index 9a95c374990d..c64d864799cd 100644
--- a/drivers/net/wireless/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/iwlwifi/mvm/d3.c
@@ -97,14 +97,14 @@ void iwl_mvm_ipv6_addr_change(struct ieee80211_hw *hw,
         struct inet6_ifaddr *ifa;
         int idx = 0;
 
-        read_lock(&idev->lock);
+        read_lock_bh(&idev->lock);
         list_for_each_entry(ifa, &idev->addr_list, if_list) {
                 mvmvif->target_ipv6_addrs[idx] = ifa->addr;
                 idx++;
                 if (idx >= IWL_PROTO_OFFLOAD_NUM_IPV6_ADDRS)
                         break;
         }
-        read_unlock(&idev->lock);
+        read_unlock_bh(&idev->lock);
 
         mvmvif->num_target_ipv6_addrs = idx;
 }
@@ -490,7 +490,7 @@ static int iwl_mvm_d3_reprogram(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                 return -EIO;
         }
 
-        ret = iwl_mvm_sta_add_to_fw(mvm, ap_sta);
+        ret = iwl_mvm_sta_send_to_fw(mvm, ap_sta, false);
         if (ret)
                 return ret;
         rcu_assign_pointer(mvm->fw_id_to_mac_id[mvmvif->ap_sta_id], ap_sta);
@@ -763,6 +763,146 @@ int iwl_mvm_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
         return ret;
 }
 
+static void iwl_mvm_query_wakeup_reasons(struct iwl_mvm *mvm,
+                                         struct ieee80211_vif *vif)
+{
+        u32 base = mvm->error_event_table;
+        struct error_table_start {
+                /* cf. struct iwl_error_event_table */
+                u32 valid;
+                u32 error_id;
+        } err_info;
+        struct cfg80211_wowlan_wakeup wakeup = {
+                .pattern_idx = -1,
+        };
+        struct cfg80211_wowlan_wakeup *wakeup_report = &wakeup;
+        struct iwl_host_cmd cmd = {
+                .id = WOWLAN_GET_STATUSES,
+                .flags = CMD_SYNC | CMD_WANT_SKB,
+        };
+        struct iwl_wowlan_status *status;
+        u32 reasons;
+        int ret, len;
+        bool pkt8023 = false;
+        struct sk_buff *pkt = NULL;
+
+        iwl_trans_read_mem_bytes(mvm->trans, base,
+                                 &err_info, sizeof(err_info));
+
+        if (err_info.valid) {
+                IWL_INFO(mvm, "error table is valid (%d)\n",
+                         err_info.valid);
+                if (err_info.error_id == RF_KILL_INDICATOR_FOR_WOWLAN) {
+                        wakeup.rfkill_release = true;
+                        ieee80211_report_wowlan_wakeup(vif, &wakeup,
+                                                       GFP_KERNEL);
+                }
+                return;
+        }
+
+        /* only for tracing for now */
+        ret = iwl_mvm_send_cmd_pdu(mvm, OFFLOADS_QUERY_CMD, CMD_SYNC, 0, NULL);
+        if (ret)
+                IWL_ERR(mvm, "failed to query offload statistics (%d)\n", ret);
+
+        ret = iwl_mvm_send_cmd(mvm, &cmd);
+        if (ret) {
+                IWL_ERR(mvm, "failed to query status (%d)\n", ret);
+                return;
+        }
+
+        /* RF-kill already asserted again... */
+        if (!cmd.resp_pkt)
+                return;
+
+        len = le32_to_cpu(cmd.resp_pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
+        if (len - sizeof(struct iwl_cmd_header) < sizeof(*status)) {
+                IWL_ERR(mvm, "Invalid WoWLAN status response!\n");
+                goto out;
+        }
+
+        status = (void *)cmd.resp_pkt->data;
+
+        if (len - sizeof(struct iwl_cmd_header) !=
+            sizeof(*status) + le32_to_cpu(status->wake_packet_bufsize)) {
+                IWL_ERR(mvm, "Invalid WoWLAN status response!\n");
+                goto out;
+        }
+
+        reasons = le32_to_cpu(status->wakeup_reasons);
+
+        if (reasons == IWL_WOWLAN_WAKEUP_BY_NON_WIRELESS) {
+                wakeup_report = NULL;
+                goto report;
+        }
+
+        if (reasons & IWL_WOWLAN_WAKEUP_BY_MAGIC_PACKET) {
+                wakeup.magic_pkt = true;
+                pkt8023 = true;
+        }
+
+        if (reasons & IWL_WOWLAN_WAKEUP_BY_PATTERN) {
+                wakeup.pattern_idx =
+                        le16_to_cpu(status->pattern_number);
+                pkt8023 = true;
+        }
+
+        if (reasons & (IWL_WOWLAN_WAKEUP_BY_DISCONNECTION_ON_MISSED_BEACON |
+                       IWL_WOWLAN_WAKEUP_BY_DISCONNECTION_ON_DEAUTH))
+                wakeup.disconnect = true;
+
+        if (reasons & IWL_WOWLAN_WAKEUP_BY_GTK_REKEY_FAILURE) {
+                wakeup.gtk_rekey_failure = true;
+                pkt8023 = true;
+        }
+
+        if (reasons & IWL_WOWLAN_WAKEUP_BY_RFKILL_DEASSERTED) {
+                wakeup.rfkill_release = true;
+                pkt8023 = true;
+        }
+
+        if (reasons & IWL_WOWLAN_WAKEUP_BY_EAPOL_REQUEST) {
+                wakeup.eap_identity_req = true;
+                pkt8023 = true;
+        }
+
+        if (reasons & IWL_WOWLAN_WAKEUP_BY_FOUR_WAY_HANDSHAKE) {
+                wakeup.four_way_handshake = true;
+                pkt8023 = true;
+        }
+
+        if (status->wake_packet_bufsize) {
+                u32 pktsize = le32_to_cpu(status->wake_packet_bufsize);
+                u32 pktlen = le32_to_cpu(status->wake_packet_length);
+
+                if (pkt8023) {
+                        pkt = alloc_skb(pktsize, GFP_KERNEL);
+                        if (!pkt)
+                                goto report;
+                        memcpy(skb_put(pkt, pktsize), status->wake_packet,
+                               pktsize);
+                        if (ieee80211_data_to_8023(pkt, vif->addr, vif->type))
+                                goto report;
+                        wakeup.packet = pkt->data;
+                        wakeup.packet_present_len = pkt->len;
+                        wakeup.packet_len = pkt->len - (pktlen - pktsize);
+                        wakeup.packet_80211 = false;
+                } else {
+                        wakeup.packet = status->wake_packet;
+                        wakeup.packet_present_len = pktsize;
+                        wakeup.packet_len = pktlen;
+                        wakeup.packet_80211 = true;
+                }
+        }
+
+ report:
+        ieee80211_report_wowlan_wakeup(vif, wakeup_report, GFP_KERNEL);
+        kfree_skb(pkt);
+
+ out:
+        iwl_free_resp(&cmd);
+}
+
 int iwl_mvm_resume(struct ieee80211_hw *hw)
 {
         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
@@ -770,14 +910,8 @@ int iwl_mvm_resume(struct ieee80211_hw *hw)
                 .mvm = mvm,
         };
         struct ieee80211_vif *vif = NULL;
-        u32 base;
         int ret;
         enum iwl_d3_status d3_status;
-        struct error_table_start {
-                /* cf. struct iwl_error_event_table */
-                u32 valid;
-                u32 error_id;
-        } err_info;
 
         mutex_lock(&mvm->mutex);
 
@@ -800,27 +934,7 @@ int iwl_mvm_resume(struct ieee80211_hw *hw)
                 goto out_unlock;
         }
 
-        base = mvm->error_event_table;
-
-        iwl_trans_read_mem_bytes(mvm->trans, base,
-                                 &err_info, sizeof(err_info));
-
-        if (err_info.valid) {
-                IWL_INFO(mvm, "error table is valid (%d)\n",
-                         err_info.valid);
-                if (err_info.error_id == RF_KILL_INDICATOR_FOR_WOWLAN)
-                        IWL_ERR(mvm, "this was due to RF-kill\n");
-                goto out_unlock;
-        }
-
-        /* TODO: get status and whatever else ... */
-        ret = iwl_mvm_send_cmd_pdu(mvm, WOWLAN_GET_STATUSES, CMD_SYNC, 0, NULL);
-        if (ret)
-                IWL_ERR(mvm, "failed to query status (%d)\n", ret);
-
-        ret = iwl_mvm_send_cmd_pdu(mvm, OFFLOADS_QUERY_CMD, CMD_SYNC, 0, NULL);
-        if (ret)
-                IWL_ERR(mvm, "failed to query offloads (%d)\n", ret);
+        iwl_mvm_query_wakeup_reasons(mvm, vif);
 
  out_unlock:
         mutex_unlock(&mvm->mutex);
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api.h b/drivers/net/wireless/iwlwifi/mvm/fw-api.h
index 9fd49db32a32..23eebda848b0 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api.h
@@ -633,6 +633,9 @@ struct iwl_binding_cmd {
         __le32 phy;
 } __packed; /* BINDING_CMD_API_S_VER_1 */
 
+/* The maximal number of fragments in the FW's schedule session */
+#define IWL_MVM_MAX_QUOTA 128
+
 /**
  * struct iwl_time_quota_data - configuration of time quota per binding
  * @id_and_color: ID and color of the relevant Binding
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw.c b/drivers/net/wireless/iwlwifi/mvm/fw.c
index 90473c2ba1c7..d3d959db03a9 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/iwlwifi/mvm/fw.c
@@ -621,10 +621,6 @@ int iwl_mvm_rx_card_state_notif(struct iwl_mvm *mvm,
                           (flags & CT_KILL_CARD_DISABLED) ?
                           "Reached" : "Not reached");
 
-        if (flags & CARD_DISABLED_MSK)
-                iwl_write32(mvm->trans, CSR_UCODE_DRV_GP1_SET,
-                            CSR_UCODE_DRV_GP1_BIT_CMD_BLOCKED);
-
         return 0;
 }
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
index c08a17a3cab9..0854dc338881 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
@@ -584,7 +584,11 @@ static void iwl_mvm_mac_ctxt_cmd_fill_sta(struct iwl_mvm *mvm,
                                           struct ieee80211_vif *vif,
                                           struct iwl_mac_data_sta *ctxt_sta)
 {
-        ctxt_sta->is_assoc = cpu_to_le32(vif->bss_conf.assoc ? 1 : 0);
+        /* We need the dtim_period to set the MAC as associated */
+        if (vif->bss_conf.assoc && vif->bss_conf.dtim_period)
+                ctxt_sta->is_assoc = cpu_to_le32(1);
+        else
+                ctxt_sta->is_assoc = cpu_to_le32(0);
 
         ctxt_sta->bi = cpu_to_le32(vif->bss_conf.beacon_int);
         ctxt_sta->bi_reciprocal =
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index a6b05a02cfd4..e27eb9724112 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -113,8 +113,7 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
                     IEEE80211_HW_REPORTS_TX_ACK_STATUS |
                     IEEE80211_HW_QUEUE_CONTROL |
                     IEEE80211_HW_WANT_MONITOR_VIF |
-                    IEEE80211_HW_SCAN_WHILE_IDLE |
-                    IEEE80211_HW_NEED_DTIM_PERIOD |
+                    IEEE80211_HW_NEED_DTIM_BEFORE_ASSOC |
                     IEEE80211_HW_SUPPORTS_PS |
                     IEEE80211_HW_SUPPORTS_DYNAMIC_PS |
                     IEEE80211_HW_AMPDU_AGGREGATION;
@@ -475,7 +474,7 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
         if (mvm->vif_count > 1) {
                 IWL_DEBUG_MAC80211(mvm,
                                    "Disable power on existing interfaces\n");
-                ieee80211_iterate_active_interfaces(
+                ieee80211_iterate_active_interfaces_atomic(
                                             mvm->hw,
                                             IEEE80211_IFACE_ITER_NORMAL,
                                             iwl_mvm_pm_disable_iterator, mvm);
@@ -671,8 +670,6 @@ static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
                                 IWL_ERR(mvm, "failed to update quotas\n");
                                 return;
                         }
-                        iwl_mvm_remove_time_event(mvm, mvmvif,
-                                                  &mvmvif->time_event_data);
                 } else if (mvmvif->ap_sta_id != IWL_MVM_STATION_COUNT) {
                         /* remove AP station now that the MAC is unassoc */
                         ret = iwl_mvm_rm_sta_id(mvm, vif, mvmvif->ap_sta_id);
@@ -684,6 +681,13 @@ static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
                         if (ret)
                                 IWL_ERR(mvm, "failed to update quotas\n");
                 }
+        } else if (changes & BSS_CHANGED_DTIM_PERIOD) {
+                /*
+                 * We received a beacon _after_ association so
+                 * remove the session protection.
+                 */
+                iwl_mvm_remove_time_event(mvm, mvmvif,
+                                          &mvmvif->time_event_data);
         } else if (changes & BSS_CHANGED_PS) {
                 /*
                  * TODO: remove this temporary code.
@@ -922,8 +926,10 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
                 ret = 0;
         } else if (old_state == IEEE80211_STA_AUTH &&
                    new_state == IEEE80211_STA_ASSOC) {
-                iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band);
-                ret = 0;
+                ret = iwl_mvm_update_sta(mvm, vif, sta);
+                if (ret == 0)
+                        iwl_mvm_rs_rate_init(mvm, sta,
+                                             mvmvif->phy_ctxt->channel->band);
         } else if (old_state == IEEE80211_STA_ASSOC &&
                    new_state == IEEE80211_STA_AUTHORIZED) {
                 ret = 0;
diff --git a/drivers/net/wireless/iwlwifi/mvm/ops.c b/drivers/net/wireless/iwlwifi/mvm/ops.c
index 983dca3f888a..aa59adf87db3 100644
--- a/drivers/net/wireless/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/iwlwifi/mvm/ops.c
@@ -536,25 +536,28 @@ static int iwl_mvm_rx_dispatch(struct iwl_op_mode *op_mode,
 
         for (i = 0; i < ARRAY_SIZE(iwl_mvm_rx_handlers); i++) {
                 const struct iwl_rx_handlers *rx_h = &iwl_mvm_rx_handlers[i];
-                if (rx_h->cmd_id == pkt->hdr.cmd) {
-                        struct iwl_async_handler_entry *entry;
-                        if (!rx_h->async)
-                                return rx_h->fn(mvm, rxb, cmd);
-
-                        entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
-                        /* we can't do much... */
-                        if (!entry)
-                                return 0;
-
-                        entry->rxb._page = rxb_steal_page(rxb);
-                        entry->rxb._offset = rxb->_offset;
-                        entry->rxb._rx_page_order = rxb->_rx_page_order;
-                        entry->fn = rx_h->fn;
-                        spin_lock(&mvm->async_handlers_lock);
-                        list_add_tail(&entry->list, &mvm->async_handlers_list);
-                        spin_unlock(&mvm->async_handlers_lock);
-                        schedule_work(&mvm->async_handlers_wk);
-                }
+                struct iwl_async_handler_entry *entry;
+
+                if (rx_h->cmd_id != pkt->hdr.cmd)
+                        continue;
+
+                if (!rx_h->async)
+                        return rx_h->fn(mvm, rxb, cmd);
+
+                entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
+                /* we can't do much... */
+                if (!entry)
+                        return 0;
+
+                entry->rxb._page = rxb_steal_page(rxb);
+                entry->rxb._offset = rxb->_offset;
+                entry->rxb._rx_page_order = rxb->_rx_page_order;
+                entry->fn = rx_h->fn;
+                spin_lock(&mvm->async_handlers_lock);
+                list_add_tail(&entry->list, &mvm->async_handlers_list);
+                spin_unlock(&mvm->async_handlers_lock);
+                schedule_work(&mvm->async_handlers_wk);
+                break;
         }
 
         return 0;
diff --git a/drivers/net/wireless/iwlwifi/mvm/power.c b/drivers/net/wireless/iwlwifi/mvm/power.c
index 63628739cf4a..5a92a4978795 100644
--- a/drivers/net/wireless/iwlwifi/mvm/power.c
+++ b/drivers/net/wireless/iwlwifi/mvm/power.c
@@ -194,7 +194,7 @@ int iwl_mvm_power_disable(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
                         cmd.id_and_color, iwlmvm_mod_params.power_scheme,
                         le16_to_cpu(cmd.flags));
 
-        return iwl_mvm_send_cmd_pdu(mvm, POWER_TABLE_CMD, CMD_SYNC,
+        return iwl_mvm_send_cmd_pdu(mvm, POWER_TABLE_CMD, CMD_ASYNC,
                                     sizeof(cmd), &cmd);
 }
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/quota.c b/drivers/net/wireless/iwlwifi/mvm/quota.c
index 2d4611a563c5..925628468146 100644
--- a/drivers/net/wireless/iwlwifi/mvm/quota.c
+++ b/drivers/net/wireless/iwlwifi/mvm/quota.c
@@ -131,7 +131,7 @@ static void iwl_mvm_quota_iterator(void *_data, u8 *mac,
 int iwl_mvm_update_quotas(struct iwl_mvm *mvm, struct ieee80211_vif *newvif)
 {
         struct iwl_time_quota_cmd cmd;
-        int i, idx, ret;
+        int i, idx, ret, num_active_bindings, quota, quota_rem;
         struct iwl_mvm_quota_iterator_data data = {
                 .n_interfaces = {},
                 .colors = { -1, -1, -1, -1 },
@@ -156,20 +156,39 @@ int iwl_mvm_update_quotas(struct iwl_mvm *mvm, struct ieee80211_vif *newvif)
                 iwl_mvm_quota_iterator(&data, newvif->addr, newvif);
         }
 
+        /*
+         * The FW's scheduling session consists of
+         * IWL_MVM_MAX_QUOTA fragments. Divide these fragments
+         * equally between all the bindings that require quota
+         */
+        num_active_bindings = 0;
+        for (i = 0; i < MAX_BINDINGS; i++) {
+                cmd.quotas[i].id_and_color = cpu_to_le32(FW_CTXT_INVALID);
+                if (data.n_interfaces[i] > 0)
+                        num_active_bindings++;
+        }
+
+        if (!num_active_bindings)
+                goto send_cmd;
+
+        quota = IWL_MVM_MAX_QUOTA / num_active_bindings;
+        quota_rem = IWL_MVM_MAX_QUOTA % num_active_bindings;
+
         for (idx = 0, i = 0; i < MAX_BINDINGS; i++) {
                 if (data.n_interfaces[i] <= 0)
                         continue;
 
                 cmd.quotas[idx].id_and_color =
                         cpu_to_le32(FW_CMD_ID_AND_COLOR(i, data.colors[i]));
-                cmd.quotas[idx].quota = cpu_to_le32(100);
-                cmd.quotas[idx].max_duration = cpu_to_le32(1000);
+                cmd.quotas[idx].quota = cpu_to_le32(quota);
+                cmd.quotas[idx].max_duration = cpu_to_le32(IWL_MVM_MAX_QUOTA);
                 idx++;
         }
 
-        for (i = idx; i < MAX_BINDINGS; i++)
-                cmd.quotas[i].id_and_color = cpu_to_le32(FW_CTXT_INVALID);
+        /* Give the remainder of the session to the first binding */
+        le32_add_cpu(&cmd.quotas[0].quota, quota_rem);
 
+send_cmd:
         ret = iwl_mvm_send_cmd_pdu(mvm, TIME_QUOTA_CMD, CMD_SYNC,
                                    sizeof(cmd), &cmd);
         if (ret)
diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.c b/drivers/net/wireless/iwlwifi/mvm/rs.c
index 60a4291ca221..56b636d9ab30 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/rs.c
@@ -1209,23 +1209,9 @@ static s32 rs_get_best_rate(struct iwl_mvm *mvm,
         return new_rate;
 }
 
-static bool iwl_is_ht40_tx_allowed(struct iwl_mvm *mvm,
-                            struct ieee80211_sta_ht_cap *ht_cap)
+static bool iwl_is_ht40_tx_allowed(struct ieee80211_sta *sta)
 {
-        /*
-         * Remainder of this function checks ht_cap, but if it's
-         * NULL then we can do HT40 (special case for RXON)
-         */
-        if (!ht_cap)
-                return true;
-
-        if (!ht_cap->ht_supported)
-                return false;
-
-        if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40))
-                return false;
-
-        return true;
+        return sta->bandwidth >= IEEE80211_STA_RX_BW_40;
 }
 
 /*
@@ -1243,8 +1229,7 @@ static int rs_switch_to_mimo2(struct iwl_mvm *mvm,
         if (!sta->ht_cap.ht_supported)
                 return -1;
 
-        if (((sta->ht_cap.cap & IEEE80211_HT_CAP_SM_PS) >> 2)
-                                                == WLAN_HT_CAP_SM_PS_STATIC)
+        if (sta->smps_mode == IEEE80211_SMPS_STATIC)
                 return -1;
 
         /* Need both Tx chains/antennas to support MIMO */
@@ -1258,7 +1243,7 @@ static int rs_switch_to_mimo2(struct iwl_mvm *mvm,
         tbl->max_search = IWL_MAX_SEARCH;
         rate_mask = lq_sta->active_mimo2_rate;
 
-        if (iwl_is_ht40_tx_allowed(mvm, &sta->ht_cap))
+        if (iwl_is_ht40_tx_allowed(sta))
                 tbl->is_ht40 = 1;
         else
                 tbl->is_ht40 = 0;
@@ -1296,8 +1281,7 @@ static int rs_switch_to_mimo3(struct iwl_mvm *mvm,
         if (!sta->ht_cap.ht_supported)
                 return -1;
 
-        if (((sta->ht_cap.cap & IEEE80211_HT_CAP_SM_PS) >> 2)
-                                                == WLAN_HT_CAP_SM_PS_STATIC)
+        if (sta->smps_mode == IEEE80211_SMPS_STATIC)
                 return -1;
 
         /* Need both Tx chains/antennas to support MIMO */
@@ -1311,7 +1295,7 @@ static int rs_switch_to_mimo3(struct iwl_mvm *mvm,
         tbl->max_search = IWL_MAX_11N_MIMO3_SEARCH;
         rate_mask = lq_sta->active_mimo3_rate;
 
-        if (iwl_is_ht40_tx_allowed(mvm, &sta->ht_cap))
+        if (iwl_is_ht40_tx_allowed(sta))
                 tbl->is_ht40 = 1;
         else
                 tbl->is_ht40 = 0;
@@ -1356,7 +1340,7 @@ static int rs_switch_to_siso(struct iwl_mvm *mvm,
         tbl->max_search = IWL_MAX_SEARCH;
         rate_mask = lq_sta->active_siso_rate;
 
-        if (iwl_is_ht40_tx_allowed(mvm, &sta->ht_cap))
+        if (iwl_is_ht40_tx_allowed(sta))
                 tbl->is_ht40 = 1;
         else
                 tbl->is_ht40 = 0;
diff --git a/drivers/net/wireless/iwlwifi/mvm/rx.c b/drivers/net/wireless/iwlwifi/mvm/rx.c
index 52da375e5740..3f3ce91ad5c2 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/rx.c
@@ -121,7 +121,7 @@ static void iwl_mvm_pass_packet_to_mac80211(struct iwl_mvm *mvm,
 
         memcpy(IEEE80211_SKB_RXCB(skb), stats, sizeof(*stats));
 
-        ieee80211_rx(mvm->hw, skb);
+        ieee80211_rx_ni(mvm->hw, skb);
 }
 
 /*
diff --git a/drivers/net/wireless/iwlwifi/mvm/sta.c b/drivers/net/wireless/iwlwifi/mvm/sta.c
index 69603c3b2b39..a1eb692d7fad 100644
--- a/drivers/net/wireless/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/mvm/sta.c
@@ -81,8 +81,9 @@ static int iwl_mvm_find_free_sta_id(struct iwl_mvm *mvm)
         return IWL_MVM_STATION_COUNT;
 }
 
-/* add a NEW station to fw */
-int iwl_mvm_sta_add_to_fw(struct iwl_mvm *mvm, struct ieee80211_sta *sta)
+/* send station add/update command to firmware */
+int iwl_mvm_sta_send_to_fw(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+                           bool update)
 {
         struct iwl_mvm_sta *mvm_sta = (void *)sta->drv_priv;
         struct iwl_mvm_add_sta_cmd add_sta_cmd;
@@ -94,8 +95,11 @@ int iwl_mvm_sta_add_to_fw(struct iwl_mvm *mvm, struct ieee80211_sta *sta)
 
         add_sta_cmd.sta_id = mvm_sta->sta_id;
         add_sta_cmd.mac_id_n_color = cpu_to_le32(mvm_sta->mac_id_n_color);
-        add_sta_cmd.tfd_queue_msk = cpu_to_le32(mvm_sta->tfd_queue_msk);
-        memcpy(&add_sta_cmd.addr, sta->addr, ETH_ALEN);
+        if (!update) {
+                add_sta_cmd.tfd_queue_msk = cpu_to_le32(mvm_sta->tfd_queue_msk);
+                memcpy(&add_sta_cmd.addr, sta->addr, ETH_ALEN);
+        }
+        add_sta_cmd.add_modify = update ? 1 : 0;
 
         /* STA_FLG_FAT_EN_MSK ? */
         /* STA_FLG_MIMO_EN_MSK ? */
@@ -181,7 +185,7 @@ int iwl_mvm_add_sta(struct iwl_mvm *mvm,
         /* for HW restart - need to reset the seq_number etc... */
         memset(mvm_sta->tid_data, 0, sizeof(mvm_sta->tid_data));
 
-        ret = iwl_mvm_sta_add_to_fw(mvm, sta);
+        ret = iwl_mvm_sta_send_to_fw(mvm, sta, false);
         if (ret)
                 return ret;
 
@@ -195,6 +199,13 @@ int iwl_mvm_add_sta(struct iwl_mvm *mvm,
         return 0;
 }
 
+int iwl_mvm_update_sta(struct iwl_mvm *mvm,
+                       struct ieee80211_vif *vif,
+                       struct ieee80211_sta *sta)
+{
+        return iwl_mvm_sta_send_to_fw(mvm, sta, true);
+}
+
 int iwl_mvm_drain_sta(struct iwl_mvm *mvm, struct iwl_mvm_sta *mvmsta,
                       bool drain)
 {
@@ -1116,7 +1127,8 @@ int iwl_mvm_remove_sta_key(struct iwl_mvm *mvm,
         if (WARN_ON_ONCE(mvm_sta->vif != vif))
                 return -EINVAL;
 
-        key_flags = cpu_to_le16(keyconf->keyidx & STA_KEY_FLG_KEYID_MSK);
+        key_flags = cpu_to_le16((keyconf->keyidx << STA_KEY_FLG_KEYID_POS) &
+                                 STA_KEY_FLG_KEYID_MSK);
         key_flags |= cpu_to_le16(STA_KEY_FLG_NO_ENC | STA_KEY_FLG_WEP_KEY_MAP);
         key_flags |= cpu_to_le16(STA_KEY_NOT_VALID);
 
@@ -1154,14 +1166,26 @@ void iwl_mvm_update_tkip_key(struct iwl_mvm *mvm,
                              struct ieee80211_sta *sta, u32 iv32,
                              u16 *phase1key)
 {
-        struct iwl_mvm_sta *mvm_sta = (void *)sta->drv_priv;
+        struct iwl_mvm_sta *mvm_sta;
         u8 sta_id = iwl_mvm_get_key_sta_id(vif, sta);
 
-        if (sta_id == IWL_INVALID_STATION)
+        if (WARN_ON_ONCE(sta_id == IWL_INVALID_STATION))
                 return;
 
+        rcu_read_lock();
+
+        if (!sta) {
+                sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_id]);
+                if (WARN_ON(IS_ERR_OR_NULL(sta))) {
+                        rcu_read_unlock();
+                        return;
+                }
+        }
+
+        mvm_sta = (void *)sta->drv_priv;
         iwl_mvm_send_sta_key(mvm, mvm_sta, keyconf, sta_id,
                              iv32, phase1key, CMD_ASYNC);
+        rcu_read_unlock();
 }
 
 void iwl_mvm_sta_modify_ps_wake(struct iwl_mvm *mvm, int sta_id)
diff --git a/drivers/net/wireless/iwlwifi/mvm/sta.h b/drivers/net/wireless/iwlwifi/mvm/sta.h
index 1bf301097984..bdd7c5ed8222 100644
--- a/drivers/net/wireless/iwlwifi/mvm/sta.h
+++ b/drivers/net/wireless/iwlwifi/mvm/sta.h
@@ -309,10 +309,14 @@ struct iwl_mvm_int_sta {
         u32 tfd_queue_msk;
 };
 
-int iwl_mvm_sta_add_to_fw(struct iwl_mvm *mvm, struct ieee80211_sta *sta);
+int iwl_mvm_sta_send_to_fw(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+                           bool update);
 int iwl_mvm_add_sta(struct iwl_mvm *mvm,
                     struct ieee80211_vif *vif,
                     struct ieee80211_sta *sta);
+int iwl_mvm_update_sta(struct iwl_mvm *mvm,
+                       struct ieee80211_vif *vif,
+                       struct ieee80211_sta *sta);
 int iwl_mvm_rm_sta(struct iwl_mvm *mvm,
                    struct ieee80211_vif *vif,
                    struct ieee80211_sta *sta);
diff --git a/drivers/net/wireless/iwlwifi/mvm/time-event.c b/drivers/net/wireless/iwlwifi/mvm/time-event.c
index b9f076f4f17c..c09b71f23759 100644
--- a/drivers/net/wireless/iwlwifi/mvm/time-event.c
+++ b/drivers/net/wireless/iwlwifi/mvm/time-event.c
@@ -76,6 +76,15 @@
 #define TU_TO_JIFFIES(_tu)      (usecs_to_jiffies((_tu) * 1024))
 #define MSEC_TO_TU(_msec)       (_msec*1000/1024)
 
+/* For ROC use a TE type which has priority high enough to be scheduled when
+ * there is a concurrent BSS or GO/AP. Currently, use a TE type that has
+ * priority similar to the TE priority used for action scans by the FW.
+ * TODO: This needs to be changed, based on the reason for the ROC, i.e., use
+ * TE_P2P_DEVICE_DISCOVERABLE for remain on channel without mgmt skb, and use
+ * TE_P2P_DEVICE_ACTION_SCAN
+ */
+#define IWL_MVM_ROC_TE_TYPE TE_P2P_DEVICE_ACTION_SCAN
+
 void iwl_mvm_te_clear_data(struct iwl_mvm *mvm,
                            struct iwl_mvm_time_event_data *te_data)
 {
@@ -175,9 +184,11 @@ static void iwl_mvm_te_handle_notif(struct iwl_mvm *mvm,
                  */
                 if (te_data->vif->type == NL80211_IFTYPE_STATION &&
                     (!te_data->vif->bss_conf.assoc ||
-                     !te_data->vif->bss_conf.dtim_period))
+                     !te_data->vif->bss_conf.dtim_period)) {
                         IWL_ERR(mvm,
                                 "No assocation and the time event is over already...\n");
+                        ieee80211_connection_loss(te_data->vif);
+                }
 
                 iwl_mvm_te_clear_data(mvm, te_data);
         } else if (le32_to_cpu(notif->action) == TE_NOTIF_HOST_START) {
@@ -219,57 +230,86 @@ int iwl_mvm_rx_time_event_notif(struct iwl_mvm *mvm,
         return 0;
 }
 
-static bool iwl_mvm_time_event_notif(struct iwl_notif_wait_data *notif_wait,
-                                     struct iwl_rx_packet *pkt, void *data)
+static bool iwl_mvm_time_event_response(struct iwl_notif_wait_data *notif_wait,
+                                        struct iwl_rx_packet *pkt, void *data)
 {
         struct iwl_mvm *mvm =
                 container_of(notif_wait, struct iwl_mvm, notif_wait);
         struct iwl_mvm_time_event_data *te_data = data;
-        struct ieee80211_vif *vif = te_data->vif;
-        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
-        struct iwl_time_event_notif *notif;
         struct iwl_time_event_resp *resp;
+        int resp_len = le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
 
-        u32 mac_id_n_color = FW_CMD_ID_AND_COLOR(mvmvif->id, mvmvif->color);
+        if (WARN_ON(pkt->hdr.cmd != TIME_EVENT_CMD))
+                return true;
 
-        /* until we do something else */
-        WARN_ON(te_data->id != TE_BSS_STA_AGGRESSIVE_ASSOC);
+        if (WARN_ON_ONCE(resp_len != sizeof(pkt->hdr) + sizeof(*resp))) {
+                IWL_ERR(mvm, "Invalid TIME_EVENT_CMD response\n");
+                return true;
+        }
 
-        switch (pkt->hdr.cmd) {
-        case TIME_EVENT_CMD:
-                resp = (void *)pkt->data;
-                /* TODO: I can't check that since the fw is buggy - it doesn't
-                 * put the right values when we remove a TE. We can be here
-                 * when we remove a TE because the remove TE command is sent in
-                 * ASYNC...
-                 * WARN_ON(mac_id_n_color != le32_to_cpu(resp->id_and_color));
-                 */
-                te_data->uid = le32_to_cpu(resp->unique_id);
-                IWL_DEBUG_TE(mvm, "Got response - UID = 0x%x\n", te_data->uid);
-                return false;
-
-        case TIME_EVENT_NOTIFICATION:
-                notif = (void *)pkt->data;
-                WARN_ON(le32_to_cpu(notif->status) != 1);
-                WARN_ON(mac_id_n_color != le32_to_cpu(notif->id_and_color));
-                /* check if this is our Time Event that is starting */
-                if (le32_to_cpu(notif->unique_id) != te_data->uid)
-                        return false;
-                IWL_DEBUG_TE(mvm, "Event %d is starting - time is %d\n",
-                             te_data->uid, le32_to_cpu(notif->timestamp));
-
-                WARN_ONCE(!le32_to_cpu(notif->status),
-                          "Failed to schedule protected session TE\n");
+        resp = (void *)pkt->data;
+        te_data->uid = le32_to_cpu(resp->unique_id);
+        IWL_DEBUG_TE(mvm, "TIME_EVENT_CMD response - UID = 0x%x\n",
+                     te_data->uid);
+        return true;
+}
 
-                te_data->running = true;
-                te_data->end_jiffies = jiffies +
-                                       TU_TO_JIFFIES(te_data->duration);
-                return true;
+static int iwl_mvm_time_event_send_add(struct iwl_mvm *mvm,
+                                       struct ieee80211_vif *vif,
+                                       struct iwl_mvm_time_event_data *te_data,
+                                       struct iwl_time_event_cmd *te_cmd)
+{
+        static const u8 time_event_response[] = { TIME_EVENT_CMD };
+        struct iwl_notification_wait wait_time_event;
+        int ret;
+
+        lockdep_assert_held(&mvm->mutex);
+
+        spin_lock_bh(&mvm->time_event_lock);
+        if (WARN_ON(te_data->id != TE_MAX)) {
+                spin_unlock_bh(&mvm->time_event_lock);
+                return -EIO;
+        }
+        te_data->vif = vif;
+        te_data->duration = le32_to_cpu(te_cmd->duration);
+        te_data->id = le32_to_cpu(te_cmd->id);
+        list_add_tail(&te_data->list, &mvm->time_event_list);
+        spin_unlock_bh(&mvm->time_event_lock);
+
+        /*
+         * Use a notification wait, which really just processes the
+         * command response and doesn't wait for anything, in order
+         * to be able to process the response and get the UID inside
+         * the RX path. Using CMD_WANT_SKB doesn't work because it
+         * stores the buffer and then wakes up this thread, by which
+         * time another notification (that the time event started)
+         * might already be processed unsuccessfully.
+         */
+        iwl_init_notification_wait(&mvm->notif_wait, &wait_time_event,
+                                   time_event_response,
+                                   ARRAY_SIZE(time_event_response),
+                                   iwl_mvm_time_event_response, te_data);
 
-        default:
-                WARN_ON(1);
-                return false;
-        };
+        ret = iwl_mvm_send_cmd_pdu(mvm, TIME_EVENT_CMD, CMD_SYNC,
+                                   sizeof(*te_cmd), te_cmd);
+        if (ret) {
+                IWL_ERR(mvm, "Couldn't send TIME_EVENT_CMD: %d\n", ret);
+                iwl_remove_notification(&mvm->notif_wait, &wait_time_event);
+                goto out_clear_te;
+        }
+
+        /* No need to wait for anything, so just pass 1 (0 isn't valid) */
+        ret = iwl_wait_notification(&mvm->notif_wait, &wait_time_event, 1);
+        /* should never fail */
+        WARN_ON_ONCE(ret);
+
+        if (ret) {
+ out_clear_te:
+                spin_lock_bh(&mvm->time_event_lock);
+                iwl_mvm_te_clear_data(mvm, te_data);
+                spin_unlock_bh(&mvm->time_event_lock);
+        }
+        return ret;
 }
 
 void iwl_mvm_protect_session(struct iwl_mvm *mvm,
@@ -278,11 +318,7 @@ void iwl_mvm_protect_session(struct iwl_mvm *mvm,
 {
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         struct iwl_mvm_time_event_data *te_data = &mvmvif->time_event_data;
-        static const u8 time_event_notif[] = { TIME_EVENT_CMD,
-                                               TIME_EVENT_NOTIFICATION };
-        struct iwl_notification_wait wait_time_event;
         struct iwl_time_event_cmd time_cmd = {};
-        int ret;
 
         lockdep_assert_held(&mvm->mutex);
 
@@ -309,12 +345,6 @@ void iwl_mvm_protect_session(struct iwl_mvm *mvm,
                 iwl_mvm_stop_session_protection(mvm, vif);
         }
 
-        iwl_init_notification_wait(&mvm->notif_wait, &wait_time_event,
-                                   time_event_notif,
-                                   ARRAY_SIZE(time_event_notif),
-                                   iwl_mvm_time_event_notif,
-                                   &mvmvif->time_event_data);
-
         time_cmd.action = cpu_to_le32(FW_CTXT_ACTION_ADD);
         time_cmd.id_and_color =
                 cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id, mvmvif->color));
@@ -322,6 +352,7 @@ void iwl_mvm_protect_session(struct iwl_mvm *mvm,
 
         time_cmd.apply_time =
                 cpu_to_le32(iwl_read_prph(mvm->trans, DEVICE_SYSTEM_TIME_REG));
+
         time_cmd.dep_policy = TE_INDEPENDENT;
         time_cmd.is_present = cpu_to_le32(1);
         time_cmd.max_frags = cpu_to_le32(TE_FRAG_NONE);
@@ -333,33 +364,7 @@ void iwl_mvm_protect_session(struct iwl_mvm *mvm,
         time_cmd.repeat = cpu_to_le32(1);
         time_cmd.notify = cpu_to_le32(TE_NOTIF_HOST_START | TE_NOTIF_HOST_END);
 
-        te_data->vif = vif;
-        te_data->duration = duration;
-
-        spin_lock_bh(&mvm->time_event_lock);
-        te_data->id = le32_to_cpu(time_cmd.id);
-        list_add_tail(&te_data->list, &mvm->time_event_list);
-        spin_unlock_bh(&mvm->time_event_lock);
-
-        ret = iwl_mvm_send_cmd_pdu(mvm, TIME_EVENT_CMD, CMD_SYNC,
-                                   sizeof(time_cmd), &time_cmd);
-        if (ret) {
-                IWL_ERR(mvm, "Couldn't send TIME_EVENT_CMD: %d\n", ret);
-                goto out_remove_notif;
-        }
-
-        ret = iwl_wait_notification(&mvm->notif_wait, &wait_time_event, 1 * HZ);
-        if (ret) {
-                IWL_ERR(mvm, "%s - failed on timeout\n", __func__);
-                spin_lock_bh(&mvm->time_event_lock);
-                iwl_mvm_te_clear_data(mvm, te_data);
-                spin_unlock_bh(&mvm->time_event_lock);
-        }
-
-        return;
-
-out_remove_notif:
-        iwl_remove_notification(&mvm->notif_wait, &wait_time_event);
+        iwl_mvm_time_event_send_add(mvm, vif, te_data, &time_cmd);
 }
 
 /*
@@ -424,43 +429,12 @@ void iwl_mvm_stop_session_protection(struct iwl_mvm *mvm,
         iwl_mvm_remove_time_event(mvm, mvmvif, te_data);
 }
 
-static bool iwl_mvm_roc_te_notif(struct iwl_notif_wait_data *notif_wait,
-                                 struct iwl_rx_packet *pkt, void *data)
-{
-        struct iwl_mvm *mvm =
-                container_of(notif_wait, struct iwl_mvm, notif_wait);
-        struct iwl_mvm_time_event_data *te_data = data;
-        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(te_data->vif);
-        struct iwl_time_event_resp *resp;
-
-        u32 mac_id_n_color = FW_CMD_ID_AND_COLOR(mvmvif->id, mvmvif->color);
-
-        /* until we do something else */
-        WARN_ON(te_data->id != TE_P2P_DEVICE_DISCOVERABLE);
-
-        switch (pkt->hdr.cmd) {
-        case TIME_EVENT_CMD:
-                resp = (void *)pkt->data;
-                WARN_ON(mac_id_n_color != le32_to_cpu(resp->id_and_color));
-                te_data->uid = le32_to_cpu(resp->unique_id);
-                IWL_DEBUG_TE(mvm, "Got response - UID = 0x%x\n", te_data->uid);
-                return true;
-
-        default:
-                WARN_ON(1);
-                return false;
-        };
-}
-
 int iwl_mvm_start_p2p_roc(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                           int duration)
 {
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         struct iwl_mvm_time_event_data *te_data = &mvmvif->time_event_data;
-        static const u8 roc_te_notif[] = { TIME_EVENT_CMD };
-        struct iwl_notification_wait wait_time_event;
         struct iwl_time_event_cmd time_cmd = {};
-        int ret;
 
         lockdep_assert_held(&mvm->mutex);
         if (te_data->running) {
@@ -474,16 +448,10 @@ int iwl_mvm_start_p2p_roc(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
          */
         flush_work(&mvm->roc_done_wk);
 
-        iwl_init_notification_wait(&mvm->notif_wait, &wait_time_event,
-                                   roc_te_notif,
-                                   ARRAY_SIZE(roc_te_notif),
-                                   iwl_mvm_roc_te_notif,
-                                   &mvmvif->time_event_data);
-
         time_cmd.action = cpu_to_le32(FW_CTXT_ACTION_ADD);
         time_cmd.id_and_color =
                 cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id, mvmvif->color));
-        time_cmd.id = cpu_to_le32(TE_P2P_DEVICE_DISCOVERABLE);
+        time_cmd.id = cpu_to_le32(IWL_MVM_ROC_TE_TYPE);
 
         time_cmd.apply_time = cpu_to_le32(0);
         time_cmd.dep_policy = cpu_to_le32(TE_INDEPENDENT);
@@ -492,7 +460,7 @@ int iwl_mvm_start_p2p_roc(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
         time_cmd.interval = cpu_to_le32(1);
 
         /*
-         * TE_P2P_DEVICE_DISCOVERABLE can have lower priority than other events
+         * IWL_MVM_ROC_TE_TYPE can have lower priority than other events
          * that are being scheduled by the driver/fw, and thus it might not be
          * scheduled. To improve the chances of it being scheduled, allow it to
          * be fragmented.
@@ -505,33 +473,7 @@ int iwl_mvm_start_p2p_roc(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
         time_cmd.repeat = cpu_to_le32(1);
         time_cmd.notify = cpu_to_le32(TE_NOTIF_HOST_START | TE_NOTIF_HOST_END);
 
-        /* Push the te data to the tracked te list */
-        te_data->vif = vif;
-        te_data->duration = MSEC_TO_TU(duration);
-
-        spin_lock_bh(&mvm->time_event_lock);
-        te_data->id = le32_to_cpu(time_cmd.id);
-        list_add_tail(&te_data->list, &mvm->time_event_list);
-        spin_unlock_bh(&mvm->time_event_lock);
-
-        ret = iwl_mvm_send_cmd_pdu(mvm, TIME_EVENT_CMD, CMD_SYNC,
-                                   sizeof(time_cmd), &time_cmd);
-        if (ret) {
-                IWL_ERR(mvm, "Couldn't send TIME_EVENT_CMD: %d\n", ret);
-                goto out_remove_notif;
-        }
-
-        ret = iwl_wait_notification(&mvm->notif_wait, &wait_time_event, 1 * HZ);
-        if (ret) {
-                IWL_ERR(mvm, "%s - failed on timeout\n", __func__);
-                iwl_mvm_te_clear_data(mvm, te_data);
-        }
-
-        return ret;
-
-out_remove_notif:
-        iwl_remove_notification(&mvm->notif_wait, &wait_time_event);
-        return ret;
+        return iwl_mvm_time_event_send_add(mvm, vif, te_data, &time_cmd);
 }
 
 void iwl_mvm_stop_p2p_roc(struct iwl_mvm *mvm)
diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c
index cada8efe0cca..6b67ce3f679c 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
@@ -620,7 +620,7 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
                         seq_ctl = le16_to_cpu(hdr->seq_ctrl);
                 }
 
-                ieee80211_tx_status(mvm->hw, skb);
+                ieee80211_tx_status_ni(mvm->hw, skb);
         }
 
         if (txq_id >= IWL_FIRST_AMPDU_QUEUE) {
@@ -663,12 +663,12 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
                         struct iwl_mvm_tid_data *tid_data =
                                 &mvmsta->tid_data[tid];
 
-                        spin_lock(&mvmsta->lock);
+                        spin_lock_bh(&mvmsta->lock);
                         tid_data->next_reclaimed = next_reclaimed;
                         IWL_DEBUG_TX_REPLY(mvm, "Next reclaimed packet:%d\n",
                                            next_reclaimed);
                         iwl_mvm_check_ratid_empty(mvm, sta, tid);
-                        spin_unlock(&mvmsta->lock);
+                        spin_unlock_bh(&mvmsta->lock);
                 }
 
 #ifdef CONFIG_PM_SLEEP
@@ -832,7 +832,7 @@ int iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
                 return 0;
         }
 
-        spin_lock(&mvmsta->lock);
+        spin_lock_bh(&mvmsta->lock);
 
         __skb_queue_head_init(&reclaimed_skbs);
 
@@ -886,13 +886,13 @@ int iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
                 }
         }
 
-        spin_unlock(&mvmsta->lock);
+        spin_unlock_bh(&mvmsta->lock);
 
         rcu_read_unlock();
 
         while (!skb_queue_empty(&reclaimed_skbs)) {
                 skb = __skb_dequeue(&reclaimed_skbs);
-                ieee80211_tx_status(mvm->hw, skb);
+                ieee80211_tx_status_ni(mvm->hw, skb);
         }
 
         return 0;
diff --git a/drivers/net/wireless/iwlwifi/pcie/internal.h b/drivers/net/wireless/iwlwifi/pcie/internal.h
index 5f6bb4e09d42..aa2a39a637dd 100644
--- a/drivers/net/wireless/iwlwifi/pcie/internal.h
+++ b/drivers/net/wireless/iwlwifi/pcie/internal.h
@@ -249,7 +249,6 @@ struct iwl_trans_pcie {
         int ict_index;
         u32 inta;
         bool use_ict;
-        struct tasklet_struct irq_tasklet;
         struct isr_statistics isr_stats;
 
         spinlock_t irq_lock;
@@ -330,7 +329,7 @@ void iwl_trans_pcie_free(struct iwl_trans *trans);
 * RX
 ******************************************************/
 int iwl_pcie_rx_init(struct iwl_trans *trans);
-void iwl_pcie_tasklet(struct iwl_trans *trans);
+irqreturn_t iwl_pcie_irq_handler(int irq, void *dev_id);
 int iwl_pcie_rx_stop(struct iwl_trans *trans);
 void iwl_pcie_rx_free(struct iwl_trans *trans);
 
diff --git a/drivers/net/wireless/iwlwifi/pcie/rx.c b/drivers/net/wireless/iwlwifi/pcie/rx.c
index a9ca1d35fa93..b0ae06d2456f 100644
--- a/drivers/net/wireless/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/rx.c
@@ -81,10 +81,10 @@
  *   'processed' and 'read' driver indexes as well)
  * + A received packet is processed and handed to the kernel network stack,
  *   detached from the iwl->rxq.  The driver 'processed' index is updated.
- * + The Host/Firmware iwl->rxq is replenished at tasklet time from the rx_free
- *   list. If there are no allocated buffers in iwl->rxq->rx_free, the READ
- *   INDEX is not incremented and iwl->status(RX_STALLED) is set.  If there
- *   were enough free buffers and RX_STALLED is set it is cleared.
+ * + The Host/Firmware iwl->rxq is replenished at irq thread time from the
+ *   rx_free list. If there are no allocated buffers in iwl->rxq->rx_free,
+ *   the READ INDEX is not incremented and iwl->status(RX_STALLED) is set.
+ *   If there were enough free buffers and RX_STALLED is set it is cleared.
  *
  *
  * Driver sequence:
@@ -214,9 +214,9 @@ static void iwl_pcie_rxq_restock(struct iwl_trans *trans)
         /*
          * If the device isn't enabled - not need to try to add buffers...
          * This can happen when we stop the device and still have an interrupt
-         * pending. We stop the APM before we sync the interrupts / tasklets
-         * because we have to (see comment there). On the other hand, since
-         * the APM is stopped, we cannot access the HW (in particular not prph).
+         * pending. We stop the APM before we sync the interrupts because we
+         * have to (see comment there). On the other hand, since the APM is
+         * stopped, we cannot access the HW (in particular not prph).
          * So don't try to restock if the APM has been already stopped.
          */
         if (!test_bit(STATUS_DEVICE_ENABLED, &trans_pcie->status))
@@ -796,11 +796,14 @@ static void iwl_pcie_irq_handle_error(struct iwl_trans *trans)
         clear_bit(STATUS_HCMD_ACTIVE, &trans_pcie->status);
         wake_up(&trans_pcie->wait_command_queue);
 
+        local_bh_disable();
         iwl_op_mode_nic_error(trans->op_mode);
+        local_bh_enable();
 }
 
-void iwl_pcie_tasklet(struct iwl_trans *trans)
+irqreturn_t iwl_pcie_irq_handler(int irq, void *dev_id)
 {
+        struct iwl_trans *trans = dev_id;
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         struct isr_statistics *isr_stats = &trans_pcie->isr_stats;
         u32 inta = 0;
@@ -811,6 +814,8 @@ void iwl_pcie_tasklet(struct iwl_trans *trans)
         u32 inta_mask;
 #endif
 
+        lock_map_acquire(&trans->sync_cmd_lockdep_map);
+
         spin_lock_irqsave(&trans_pcie->irq_lock, flags);
 
         /* Ack/clear/reset pending uCode interrupts.
@@ -855,7 +860,7 @@ void iwl_pcie_tasklet(struct iwl_trans *trans)
 
                 handled |= CSR_INT_BIT_HW_ERR;
 
-                return;
+                goto out;
         }
 
 #ifdef CONFIG_IWLWIFI_DEBUG
@@ -1005,6 +1010,10 @@ void iwl_pcie_tasklet(struct iwl_trans *trans)
         /* Re-enable RF_KILL if it occurred */
         else if (handled & CSR_INT_BIT_RF_KILL)
                 iwl_enable_rfkill_int(trans);
+
+out:
+        lock_map_release(&trans->sync_cmd_lockdep_map);
+        return IRQ_HANDLED;
 }
 
 /******************************************************************************
@@ -1127,7 +1136,7 @@ static irqreturn_t iwl_pcie_isr(int irq, void *data)
 
         /* Disable (but don't clear!) interrupts here to avoid
          *    back-to-back ISRs and sporadic interrupts from our NIC.
-         * If we have something to service, the tasklet will re-enable ints.
+         * If we have something to service, the irq thread will re-enable ints.
          * If we *don't* have something, we'll re-enable before leaving here. */
         inta_mask = iwl_read32(trans, CSR_INT_MASK);
         iwl_write32(trans, CSR_INT_MASK, 0x00000000);
@@ -1167,9 +1176,9 @@ static irqreturn_t iwl_pcie_isr(int irq, void *data)
 #endif
 
         trans_pcie->inta |= inta;
-        /* iwl_pcie_tasklet() will service interrupts and re-enable them */
+        /* the thread will service interrupts and re-enable them */
         if (likely(inta))
-                tasklet_schedule(&trans_pcie->irq_tasklet);
+                return IRQ_WAKE_THREAD;
         else if (test_bit(STATUS_INT_ENABLED, &trans_pcie->status) &&
                  !trans_pcie->inta)
                 iwl_enable_interrupts(trans);
@@ -1277,9 +1286,10 @@ irqreturn_t iwl_pcie_isr_ict(int irq, void *data)
         trans_pcie->inta |= inta;
 
         /* iwl_pcie_tasklet() will service interrupts and re-enable them */
-        if (likely(inta))
-                tasklet_schedule(&trans_pcie->irq_tasklet);
-        else if (test_bit(STATUS_INT_ENABLED, &trans_pcie->status) &&
+        if (likely(inta)) {
+                spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
+                return IRQ_WAKE_THREAD;
+        } else if (test_bit(STATUS_INT_ENABLED, &trans_pcie->status) &&
                  !trans_pcie->inta) {
                 /* Allow interrupt if was disabled by this handler and
                  * no tasklet was schedules, We should not enable interrupt,
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index 56d4f72500bc..17bedc50e753 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -760,7 +760,6 @@ void iwl_trans_pcie_free(struct iwl_trans *trans)
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
 
         synchronize_irq(trans_pcie->pci_dev->irq);
-        tasklet_kill(&trans_pcie->irq_tasklet);
 
         iwl_pcie_tx_free(trans);
         iwl_pcie_rx_free(trans);
@@ -1480,6 +1479,7 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
 
         trans->ops = &trans_ops_pcie;
         trans->cfg = cfg;
+        trans_lockdep_init(trans);
         trans_pcie->trans = trans;
         spin_lock_init(&trans_pcie->irq_lock);
         spin_lock_init(&trans_pcie->reg_lock);
@@ -1567,15 +1567,12 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
 
         trans_pcie->inta_mask = CSR_INI_SET_MASK;
 
-        tasklet_init(&trans_pcie->irq_tasklet, (void (*)(unsigned long))
-                     iwl_pcie_tasklet, (unsigned long)trans);
-
         if (iwl_pcie_alloc_ict(trans))
                 goto out_free_cmd_pool;
 
-        err = request_irq(pdev->irq, iwl_pcie_isr_ict,
-                          IRQF_SHARED, DRV_NAME, trans);
-        if (err) {
+        if (request_threaded_irq(pdev->irq, iwl_pcie_isr_ict,
+                                 iwl_pcie_irq_handler,
+                                 IRQF_SHARED, DRV_NAME, trans)) {
                 IWL_ERR(trans, "Error allocating IRQ %d\n", pdev->irq);
                 goto out_free_ict;
         }
diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c
index 041127ad372a..8e9e3212fe78 100644
--- a/drivers/net/wireless/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
@@ -926,7 +926,7 @@ void iwl_trans_pcie_reclaim(struct iwl_trans *trans, int txq_id, int ssn,
         if (WARN_ON(txq_id == trans_pcie->cmd_queue))
                 return;
 
-        spin_lock(&txq->lock);
+        spin_lock_bh(&txq->lock);
 
         if (txq->q.read_ptr == tfd_num)
                 goto out;
@@ -970,7 +970,7 @@ void iwl_trans_pcie_reclaim(struct iwl_trans *trans, int txq_id, int ssn,
         if (iwl_queue_space(&txq->q) > txq->q.low_mark)
                 iwl_wake_queue(trans, txq);
 out:
-        spin_unlock(&txq->lock);
+        spin_unlock_bh(&txq->lock);
 }
 
 /*
@@ -1371,7 +1371,7 @@ void iwl_pcie_hcmd_complete(struct iwl_trans *trans,
                 return;
         }
 
-        spin_lock(&txq->lock);
+        spin_lock_bh(&txq->lock);
 
         cmd_index = get_cmd_index(&txq->q, index);
         cmd = txq->entries[cmd_index].cmd;
@@ -1405,7 +1405,7 @@ void iwl_pcie_hcmd_complete(struct iwl_trans *trans,
 
         meta->flags = 0;
 
-        spin_unlock(&txq->lock);
+        spin_unlock_bh(&txq->lock);
 }
 
 #define HOST_COMPLETE_TIMEOUT (2 * HZ)
diff --git a/drivers/net/wireless/libertas/cfg.c b/drivers/net/wireless/libertas/cfg.c
index a7dcb2e5eccc..116f4aba08d6 100644
--- a/drivers/net/wireless/libertas/cfg.c
+++ b/drivers/net/wireless/libertas/cfg.c
@@ -657,7 +657,7 @@ static int lbs_ret_scan(struct lbs_private *priv, unsigned long dummy,
                                         capa, intvl, ie, ielen,
                                         LBS_SCAN_RSSI_TO_MBM(rssi),
                                         GFP_KERNEL);
-                                cfg80211_put_bss(bss);
+                                cfg80211_put_bss(wiphy, bss);
                         }
                 } else
                         lbs_deb_scan("scan response: missing BSS channel IE\n");
@@ -1444,7 +1444,7 @@ static int lbs_cfg_connect(struct wiphy *wiphy, struct net_device *dev,
 
  done:
         if (bss)
-                cfg80211_put_bss(bss);
+                cfg80211_put_bss(wiphy, bss);
         lbs_deb_leave_args(LBS_DEB_CFG80211, "ret %d", ret);
         return ret;
 }
@@ -1766,7 +1766,7 @@ static void lbs_join_post(struct lbs_private *priv,
                                   params->beacon_interval,
                                   fake_ie, fake - fake_ie,
                                   0, GFP_KERNEL);
-        cfg80211_put_bss(bss);
+        cfg80211_put_bss(priv->wdev->wiphy, bss);
 
         memcpy(priv->wdev->ssid, params->ssid, params->ssid_len);
         priv->wdev->ssid_len = params->ssid_len;
@@ -2011,7 +2011,7 @@ static int lbs_join_ibss(struct wiphy *wiphy, struct net_device *dev,
 
         if (bss) {
                 ret = lbs_ibss_join_existing(priv, params, bss);
-                cfg80211_put_bss(bss);
+                cfg80211_put_bss(wiphy, bss);
         } else
                 ret = lbs_ibss_start_new(priv, params);
 
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index b73e497fe770..cffdf4fbf161 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -2247,6 +2247,7 @@ static int __init init_mac80211_hwsim(void)
                 /* ask mac80211 to reserve space for magic */
                 hw->vif_data_size = sizeof(struct hwsim_vif_priv);
                 hw->sta_data_size = sizeof(struct hwsim_sta_priv);
+                hw->chanctx_data_size = sizeof(struct hwsim_chanctx_priv);
 
                 memcpy(data->channels_2ghz, hwsim_channels_2ghz,
                         sizeof(hwsim_channels_2ghz));
diff --git a/drivers/net/wireless/mwifiex/Kconfig b/drivers/net/wireless/mwifiex/Kconfig
index b2e27723f801..4f614aad9ded 100644
--- a/drivers/net/wireless/mwifiex/Kconfig
+++ b/drivers/net/wireless/mwifiex/Kconfig
@@ -20,12 +20,12 @@ config MWIFIEX_SDIO
           mwifiex_sdio.
 
 config MWIFIEX_PCIE
-        tristate "Marvell WiFi-Ex Driver for PCIE 8766"
+        tristate "Marvell WiFi-Ex Driver for PCIE 8766/8897"
         depends on MWIFIEX && PCI
         select FW_LOADER
         ---help---
           This adds support for wireless adapters based on Marvell
-          8766 chipset with PCIe interface.
+          8766/8897 chipsets with PCIe interface.
 
           If you choose to build it as a module, it will be called
           mwifiex_pcie.
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index 8ba48192cd2f..dc5357c0098f 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -1430,7 +1430,7 @@ static int mwifiex_cfg80211_inform_ibss_bss(struct mwifiex_private *priv)
         bss = cfg80211_inform_bss(priv->wdev->wiphy, chan,
                                   bss_info.bssid, 0, WLAN_CAPABILITY_IBSS,
                                   0, ie_buf, ie_len, 0, GFP_KERNEL);
-        cfg80211_put_bss(bss);
+        cfg80211_put_bss(priv->wdev->wiphy, bss);
         memcpy(priv->cfg_bssid, bss_info.bssid, ETH_ALEN);
 
         return 0;
diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
index df88e65595c8..492655c048d1 100644
--- a/drivers/net/wireless/mwifiex/pcie.c
+++ b/drivers/net/wireless/mwifiex/pcie.c
@@ -62,6 +62,10 @@ static bool mwifiex_pcie_ok_to_access_hw(struct mwifiex_adapter *adapter)
 {
         u32 *cookie_addr;
         struct pcie_service_card *card = adapter->card;
+        const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
+
+        if (!reg->sleep_cookie)
+                return true;
 
         if (card->sleep_cookie_vbase) {
                 cookie_addr = (u32 *)card->sleep_cookie_vbase;
@@ -94,6 +98,13 @@ static int mwifiex_pcie_probe(struct pci_dev *pdev,
 
         card->dev = pdev;
 
+        if (ent->driver_data) {
+                struct mwifiex_pcie_device *data = (void *)ent->driver_data;
+                card->pcie.firmware = data->firmware;
+                card->pcie.reg = data->reg;
+                card->pcie.blksz_fw_dl = data->blksz_fw_dl;
+        }
+
         if (mwifiex_add_card(card, &add_remove_card_sem, &pcie_ops,
                              MWIFIEX_PCIE)) {
                 pr_err("%s failed\n", __func__);
@@ -230,13 +241,16 @@ static int mwifiex_pcie_resume(struct pci_dev *pdev)
         return 0;
 }
 
-#define PCIE_VENDOR_ID_MARVELL              (0x11ab)
-#define PCIE_DEVICE_ID_MARVELL_88W8766P         (0x2b30)
-
 static DEFINE_PCI_DEVICE_TABLE(mwifiex_ids) = {
         {
                 PCIE_VENDOR_ID_MARVELL, PCIE_DEVICE_ID_MARVELL_88W8766P,
                 PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                .driver_data = (unsigned long) &mwifiex_pcie8766,
+        },
+        {
+                PCIE_VENDOR_ID_MARVELL, PCIE_DEVICE_ID_MARVELL_88W8897,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                .driver_data = (unsigned long) &mwifiex_pcie8897,
         },
         {},
 };
@@ -289,8 +303,10 @@ static int mwifiex_read_reg(struct mwifiex_adapter *adapter, int reg, u32 *data)
 static int mwifiex_pm_wakeup_card(struct mwifiex_adapter *adapter)
 {
         int i = 0;
+        struct pcie_service_card *card = adapter->card;
+        const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
 
-        while (mwifiex_pcie_ok_to_access_hw(adapter)) {
+        while (reg->sleep_cookie && mwifiex_pcie_ok_to_access_hw(adapter)) {
                 i++;
                 usleep_range(10, 20);
                 /* 50ms max wait */
@@ -364,25 +380,268 @@ static int mwifiex_pcie_enable_host_int(struct mwifiex_adapter *adapter)
 }
 
 /*
- * This function creates buffer descriptor ring for TX
+ * This function initializes TX buffer ring descriptors
  */
-static int mwifiex_pcie_create_txbd_ring(struct mwifiex_adapter *adapter)
+static int mwifiex_init_txq_ring(struct mwifiex_adapter *adapter)
+{
+        struct pcie_service_card *card = adapter->card;
+        const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
+        struct mwifiex_pcie_buf_desc *desc;
+        struct mwifiex_pfu_buf_desc *desc2;
+        int i;
+
+        for (i = 0; i < MWIFIEX_MAX_TXRX_BD; i++) {
+                card->tx_buf_list[i] = NULL;
+                if (reg->pfu_enabled) {
+                        card->txbd_ring[i] = (void *)card->txbd_ring_vbase +
+                                             (sizeof(*desc2) * i);
+                        desc2 = card->txbd_ring[i];
+                        memset(desc2, 0, sizeof(*desc2));
+                } else {
+                        card->txbd_ring[i] = (void *)card->txbd_ring_vbase +
+                                             (sizeof(*desc) * i);
+                        desc = card->txbd_ring[i];
+                        memset(desc, 0, sizeof(*desc));
+                }
+        }
+
+        return 0;
+}
+
+/* This function initializes RX buffer ring descriptors. Each SKB is allocated
+ * here and after mapping PCI memory, its physical address is assigned to
+ * PCIE Rx buffer descriptor's physical address.
+ */
+static int mwifiex_init_rxq_ring(struct mwifiex_adapter *adapter)
+{
+        struct pcie_service_card *card = adapter->card;
+        const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
+        struct sk_buff *skb;
+        struct mwifiex_pcie_buf_desc *desc;
+        struct mwifiex_pfu_buf_desc *desc2;
+        dma_addr_t buf_pa;
+        int i;
+
+        for (i = 0; i < MWIFIEX_MAX_TXRX_BD; i++) {
+                /* Allocate skb here so that firmware can DMA data from it */
+                skb = dev_alloc_skb(MWIFIEX_RX_DATA_BUF_SIZE);
+                if (!skb) {
+                        dev_err(adapter->dev,
+                                "Unable to allocate skb for RX ring.\n");
+                        kfree(card->rxbd_ring_vbase);
+                        return -ENOMEM;
+                }
+
+                if (mwifiex_map_pci_memory(adapter, skb,
+                                           MWIFIEX_RX_DATA_BUF_SIZE,
+                                           PCI_DMA_FROMDEVICE))
+                        return -1;
+
+                MWIFIEX_SKB_PACB(skb, &buf_pa);
+
+                dev_dbg(adapter->dev,
+                        "info: RX ring: skb=%p len=%d data=%p buf_pa=%#x:%x\n",
+                        skb, skb->len, skb->data, (u32)buf_pa,
+                        (u32)((u64)buf_pa >> 32));
+
+                card->rx_buf_list[i] = skb;
+                if (reg->pfu_enabled) {
+                        card->rxbd_ring[i] = (void *)card->rxbd_ring_vbase +
+                                             (sizeof(*desc2) * i);
+                        desc2 = card->rxbd_ring[i];
+                        desc2->paddr = buf_pa;
+                        desc2->len = (u16)skb->len;
+                        desc2->frag_len = (u16)skb->len;
+                        desc2->flags = reg->ring_flag_eop | reg->ring_flag_sop;
+                        desc2->offset = 0;
+                } else {
+                        card->rxbd_ring[i] = (void *)(card->rxbd_ring_vbase +
+                                             (sizeof(*desc) * i));
+                        desc = card->rxbd_ring[i];
+                        desc->paddr = buf_pa;
+                        desc->len = (u16)skb->len;
+                        desc->flags = 0;
+                }
+        }
+
+        return 0;
+}
+
+/* This function initializes event buffer ring descriptors. Each SKB is
+ * allocated here and after mapping PCI memory, its physical address is assigned
+ * to PCIE Rx buffer descriptor's physical address
+ */
+static int mwifiex_pcie_init_evt_ring(struct mwifiex_adapter *adapter)
 {
         struct pcie_service_card *card = adapter->card;
+        struct mwifiex_evt_buf_desc *desc;
+        struct sk_buff *skb;
+        dma_addr_t buf_pa;
         int i;
 
+        for (i = 0; i < MWIFIEX_MAX_EVT_BD; i++) {
+                /* Allocate skb here so that firmware can DMA data from it */
+                skb = dev_alloc_skb(MAX_EVENT_SIZE);
+                if (!skb) {
+                        dev_err(adapter->dev,
+                                "Unable to allocate skb for EVENT buf.\n");
+                        kfree(card->evtbd_ring_vbase);
+                        return -ENOMEM;
+                }
+                skb_put(skb, MAX_EVENT_SIZE);
+
+                if (mwifiex_map_pci_memory(adapter, skb, MAX_EVENT_SIZE,
+                                           PCI_DMA_FROMDEVICE))
+                        return -1;
+
+                MWIFIEX_SKB_PACB(skb, &buf_pa);
+
+                dev_dbg(adapter->dev,
+                        "info: EVT ring: skb=%p len=%d data=%p buf_pa=%#x:%x\n",
+                        skb, skb->len, skb->data, (u32)buf_pa,
+                        (u32)((u64)buf_pa >> 32));
+
+                card->evt_buf_list[i] = skb;
+                card->evtbd_ring[i] = (void *)(card->evtbd_ring_vbase +
+                                      (sizeof(*desc) * i));
+                desc = card->evtbd_ring[i];
+                desc->paddr = buf_pa;
+                desc->len = (u16)skb->len;
+                desc->flags = 0;
+        }
+
+        return 0;
+}
+
+/* This function cleans up TX buffer rings. If any of the buffer list has valid
+ * SKB address, associated SKB is freed.
+ */
+static void mwifiex_cleanup_txq_ring(struct mwifiex_adapter *adapter)
+{
+        struct pcie_service_card *card = adapter->card;
+        const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
+        struct sk_buff *skb;
+        struct mwifiex_pcie_buf_desc *desc;
+        struct mwifiex_pfu_buf_desc *desc2;
+        int i;
+
+        for (i = 0; i < MWIFIEX_MAX_TXRX_BD; i++) {
+                if (reg->pfu_enabled) {
+                        desc2 = card->txbd_ring[i];
+                        if (card->tx_buf_list[i]) {
+                                skb = card->tx_buf_list[i];
+                                pci_unmap_single(card->dev, desc2->paddr,
+                                                 skb->len, PCI_DMA_TODEVICE);
+                                dev_kfree_skb_any(skb);
+                        }
+                        memset(desc2, 0, sizeof(*desc2));
+                } else {
+                        desc = card->txbd_ring[i];
+                        if (card->tx_buf_list[i]) {
+                                skb = card->tx_buf_list[i];
+                                pci_unmap_single(card->dev, desc->paddr,
+                                                 skb->len, PCI_DMA_TODEVICE);
+                                dev_kfree_skb_any(skb);
+                        }
+                        memset(desc, 0, sizeof(*desc));
+                }
+                card->tx_buf_list[i] = NULL;
+        }
+
+        return;
+}
+
+/* This function cleans up RX buffer rings. If any of the buffer list has valid
+ * SKB address, associated SKB is freed.
+ */
+static void mwifiex_cleanup_rxq_ring(struct mwifiex_adapter *adapter)
+{
+        struct pcie_service_card *card = adapter->card;
+        const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
+        struct mwifiex_pcie_buf_desc *desc;
+        struct mwifiex_pfu_buf_desc *desc2;
+        struct sk_buff *skb;
+        int i;
+
+        for (i = 0; i < MWIFIEX_MAX_TXRX_BD; i++) {
+                if (reg->pfu_enabled) {
+                        desc2 = card->rxbd_ring[i];
+                        if (card->rx_buf_list[i]) {
+                                skb = card->rx_buf_list[i];
+                                pci_unmap_single(card->dev, desc2->paddr,
+                                                 skb->len, PCI_DMA_TODEVICE);
+                                dev_kfree_skb_any(skb);
+                        }
+                        memset(desc2, 0, sizeof(*desc2));
+                } else {
+                        desc = card->rxbd_ring[i];
+                        if (card->rx_buf_list[i]) {
+                                skb = card->rx_buf_list[i];
+                                pci_unmap_single(card->dev, desc->paddr,
+                                                 skb->len, PCI_DMA_TODEVICE);
+                                dev_kfree_skb_any(skb);
+                        }
+                        memset(desc, 0, sizeof(*desc));
+                }
+                card->rx_buf_list[i] = NULL;
+        }
+
+        return;
+}
+
+/* This function cleans up event buffer rings. If any of the buffer list has
+ * valid SKB address, associated SKB is freed.
+ */
+static void mwifiex_cleanup_evt_ring(struct mwifiex_adapter *adapter)
+{
+        struct pcie_service_card *card = adapter->card;
+        struct mwifiex_evt_buf_desc *desc;
+        struct sk_buff *skb;
+        int i;
+
+        for (i = 0; i < MWIFIEX_MAX_EVT_BD; i++) {
+                desc = card->evtbd_ring[i];
+                if (card->evt_buf_list[i]) {
+                        skb = card->evt_buf_list[i];
+                        pci_unmap_single(card->dev, desc->paddr, MAX_EVENT_SIZE,
+                                         PCI_DMA_FROMDEVICE);
+                        dev_kfree_skb_any(skb);
+                }
+                card->evt_buf_list[i] = NULL;
+                memset(desc, 0, sizeof(*desc));
+        }
+
+        return;
+}
+
+/* This function creates buffer descriptor ring for TX
+ */
+static int mwifiex_pcie_create_txbd_ring(struct mwifiex_adapter *adapter)
+{
+        struct pcie_service_card *card = adapter->card;
+        const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
+
         /*
          * driver maintaines the write pointer and firmware maintaines the read
          * pointer. The write pointer starts at 0 (zero) while the read pointer
          * starts at zero with rollover bit set
          */
         card->txbd_wrptr = 0;
-        card->txbd_rdptr |= MWIFIEX_BD_FLAG_ROLLOVER_IND;
+
+        if (reg->pfu_enabled)
+                card->txbd_rdptr = 0;
+        else
+                card->txbd_rdptr |= reg->tx_rollover_ind;
 
         /* allocate shared memory for the BD ring and divide the same in to
            several descriptors */
-        card->txbd_ring_size = sizeof(struct mwifiex_pcie_buf_desc) *
-                                                        MWIFIEX_MAX_TXRX_BD;
+        if (reg->pfu_enabled)
+                card->txbd_ring_size = sizeof(struct mwifiex_pfu_buf_desc) *
+                                       MWIFIEX_MAX_TXRX_BD;
+        else
+                card->txbd_ring_size = sizeof(struct mwifiex_pcie_buf_desc) *
+                                       MWIFIEX_MAX_TXRX_BD;
+
         dev_dbg(adapter->dev, "info: txbd_ring: Allocating %d bytes\n",
                 card->txbd_ring_size);
         card->txbd_ring_vbase = pci_alloc_consistent(card->dev,
@@ -399,40 +658,15 @@ static int mwifiex_pcie_create_txbd_ring(struct mwifiex_adapter *adapter)
                 card->txbd_ring_vbase, (unsigned int)card->txbd_ring_pbase,
                 (u32)((u64)card->txbd_ring_pbase >> 32), card->txbd_ring_size);
 
-        for (i = 0; i < MWIFIEX_MAX_TXRX_BD; i++) {
-                card->txbd_ring[i] = (struct mwifiex_pcie_buf_desc *)
-                                     (card->txbd_ring_vbase +
-                                      (sizeof(struct mwifiex_pcie_buf_desc)
-                                       * i));
-
-                card->tx_buf_list[i] = NULL;
-                card->txbd_ring[i]->paddr = 0;
-                card->txbd_ring[i]->len = 0;
-                card->txbd_ring[i]->flags = 0;
-        }
-
-        return 0;
+        return mwifiex_init_txq_ring(adapter);
 }
 
 static int mwifiex_pcie_delete_txbd_ring(struct mwifiex_adapter *adapter)
 {
         struct pcie_service_card *card = adapter->card;
-        struct sk_buff *skb;
-        int i;
+        const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
 
-        for (i = 0; i < MWIFIEX_MAX_TXRX_BD; i++) {
-                if (card->tx_buf_list[i]) {
-                        skb = card->tx_buf_list[i];
-                        pci_unmap_single(card->dev, card->txbd_ring[i]->paddr,
-                                         skb->len, PCI_DMA_TODEVICE);
-                        dev_kfree_skb_any(skb);
-                }
-                card->tx_buf_list[i] = NULL;
-                card->txbd_ring[i]->paddr = 0;
-                card->txbd_ring[i]->len = 0;
-                card->txbd_ring[i]->flags = 0;
-                card->txbd_ring[i] = NULL;
-        }
+        mwifiex_cleanup_txq_ring(adapter);
 
         if (card->txbd_ring_vbase)
                 pci_free_consistent(card->dev, card->txbd_ring_size,
@@ -440,7 +674,7 @@ static int mwifiex_pcie_delete_txbd_ring(struct mwifiex_adapter *adapter)
                                     card->txbd_ring_pbase);
         card->txbd_ring_size = 0;
         card->txbd_wrptr = 0;
-        card->txbd_rdptr = 0 | MWIFIEX_BD_FLAG_ROLLOVER_IND;
+        card->txbd_rdptr = 0 | reg->tx_rollover_ind;
         card->txbd_ring_vbase = NULL;
         card->txbd_ring_pbase = 0;
 
@@ -453,9 +687,7 @@ static int mwifiex_pcie_delete_txbd_ring(struct mwifiex_adapter *adapter)
 static int mwifiex_pcie_create_rxbd_ring(struct mwifiex_adapter *adapter)
 {
         struct pcie_service_card *card = adapter->card;
-        struct sk_buff *skb;
-        int i;
-        dma_addr_t buf_pa;
+        const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
 
         /*
          * driver maintaines the read pointer and firmware maintaines the write
@@ -463,10 +695,15 @@ static int mwifiex_pcie_create_rxbd_ring(struct mwifiex_adapter *adapter)
          * starts at zero with rollover bit set
          */
         card->rxbd_wrptr = 0;
-        card->rxbd_rdptr |= MWIFIEX_BD_FLAG_ROLLOVER_IND;
+        card->rxbd_rdptr = reg->rx_rollover_ind;
+
+        if (reg->pfu_enabled)
+                card->rxbd_ring_size = sizeof(struct mwifiex_pfu_buf_desc) *
+                                       MWIFIEX_MAX_TXRX_BD;
+        else
+                card->rxbd_ring_size = sizeof(struct mwifiex_pcie_buf_desc) *
+                                       MWIFIEX_MAX_TXRX_BD;
 
-        card->rxbd_ring_size = sizeof(struct mwifiex_pcie_buf_desc) *
-                                                        MWIFIEX_MAX_TXRX_BD;
         dev_dbg(adapter->dev, "info: rxbd_ring: Allocating %d bytes\n",
                 card->rxbd_ring_size);
         card->rxbd_ring_vbase = pci_alloc_consistent(card->dev,
@@ -485,39 +722,7 @@ static int mwifiex_pcie_create_rxbd_ring(struct mwifiex_adapter *adapter)
                 (u32)((u64)card->rxbd_ring_pbase >> 32),
                 card->rxbd_ring_size);
 
-        for (i = 0; i < MWIFIEX_MAX_TXRX_BD; i++) {
-                card->rxbd_ring[i] = (struct mwifiex_pcie_buf_desc *)
-                                     (card->rxbd_ring_vbase +
-                                      (sizeof(struct mwifiex_pcie_buf_desc)
-                                       * i));
-
-                /* Allocate skb here so that firmware can DMA data from it */
-                skb = dev_alloc_skb(MWIFIEX_RX_DATA_BUF_SIZE);
-                if (!skb) {
-                        dev_err(adapter->dev,
-                                "Unable to allocate skb for RX ring.\n");
-                        kfree(card->rxbd_ring_vbase);
-                        return -ENOMEM;
-                }
-                if (mwifiex_map_pci_memory(adapter, skb,
-                                           MWIFIEX_RX_DATA_BUF_SIZE,
-                                           PCI_DMA_FROMDEVICE))
-                        return -1;
-
-                MWIFIEX_SKB_PACB(skb, &buf_pa);
-
-                dev_dbg(adapter->dev, "info: RX ring: add new skb base: %p, "
-                        "buf_base: %p, buf_pbase: %#x:%x, buf_len: %#x\n",
-                        skb, skb->data, (u32)buf_pa, (u32)((u64)buf_pa >> 32),
-                        skb->len);
-
-                card->rx_buf_list[i] = skb;
-                card->rxbd_ring[i]->paddr = buf_pa;
-                card->rxbd_ring[i]->len = (u16)skb->len;
-                card->rxbd_ring[i]->flags = 0;
-        }
-
-        return 0;
+        return mwifiex_init_rxq_ring(adapter);
 }
 
 /*
@@ -526,23 +731,9 @@ static int mwifiex_pcie_create_rxbd_ring(struct mwifiex_adapter *adapter)
 static int mwifiex_pcie_delete_rxbd_ring(struct mwifiex_adapter *adapter)
 {
         struct pcie_service_card *card = adapter->card;
-        struct sk_buff *skb;
-        int i;
+        const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
 
-        for (i = 0; i < MWIFIEX_MAX_TXRX_BD; i++) {
-                if (card->rx_buf_list[i]) {
-                        skb = card->rx_buf_list[i];
-                        pci_unmap_single(card->dev, card->rxbd_ring[i]->paddr ,
-                                         MWIFIEX_RX_DATA_BUF_SIZE,
-                                         PCI_DMA_FROMDEVICE);
-                        dev_kfree_skb_any(skb);
-                }
-                card->rx_buf_list[i] = NULL;
-                card->rxbd_ring[i]->paddr = 0;
-                card->rxbd_ring[i]->len = 0;
-                card->rxbd_ring[i]->flags = 0;
-                card->rxbd_ring[i] = NULL;
-        }
+        mwifiex_cleanup_rxq_ring(adapter);
 
         if (card->rxbd_ring_vbase)
                 pci_free_consistent(card->dev, card->rxbd_ring_size,
@@ -550,7 +741,7 @@ static int mwifiex_pcie_delete_rxbd_ring(struct mwifiex_adapter *adapter)
                                     card->rxbd_ring_pbase);
         card->rxbd_ring_size = 0;
         card->rxbd_wrptr = 0;
-        card->rxbd_rdptr = 0 | MWIFIEX_BD_FLAG_ROLLOVER_IND;
+        card->rxbd_rdptr = 0 | reg->rx_rollover_ind;
         card->rxbd_ring_vbase = NULL;
         card->rxbd_ring_pbase = 0;
 
@@ -563,9 +754,7 @@ static int mwifiex_pcie_delete_rxbd_ring(struct mwifiex_adapter *adapter)
 static int mwifiex_pcie_create_evtbd_ring(struct mwifiex_adapter *adapter)
 {
         struct pcie_service_card *card = adapter->card;
-        struct sk_buff *skb;
-        int i;
-        dma_addr_t buf_pa;
+        const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
 
         /*
          * driver maintaines the read pointer and firmware maintaines the write
@@ -573,10 +762,11 @@ static int mwifiex_pcie_create_evtbd_ring(struct mwifiex_adapter *adapter)
          * starts at zero with rollover bit set
          */
         card->evtbd_wrptr = 0;
-        card->evtbd_rdptr |= MWIFIEX_BD_FLAG_ROLLOVER_IND;
+        card->evtbd_rdptr = reg->evt_rollover_ind;
+
+        card->evtbd_ring_size = sizeof(struct mwifiex_evt_buf_desc) *
+                                MWIFIEX_MAX_EVT_BD;
 
-        card->evtbd_ring_size = sizeof(struct mwifiex_pcie_buf_desc) *
-                                                        MWIFIEX_MAX_EVT_BD;
         dev_dbg(adapter->dev, "info: evtbd_ring: Allocating %d bytes\n",
                 card->evtbd_ring_size);
         card->evtbd_ring_vbase = pci_alloc_consistent(card->dev,
@@ -595,39 +785,7 @@ static int mwifiex_pcie_create_evtbd_ring(struct mwifiex_adapter *adapter)
                 (u32)((u64)card->evtbd_ring_pbase >> 32),
                 card->evtbd_ring_size);
 
-        for (i = 0; i < MWIFIEX_MAX_EVT_BD; i++) {
-                card->evtbd_ring[i] = (struct mwifiex_pcie_buf_desc *)
-                                      (card->evtbd_ring_vbase +
-                                       (sizeof(struct mwifiex_pcie_buf_desc)
-                                        * i));
-
-                /* Allocate skb here so that firmware can DMA data from it */
-                skb = dev_alloc_skb(MAX_EVENT_SIZE);
-                if (!skb) {
-                        dev_err(adapter->dev,
-                                "Unable to allocate skb for EVENT buf.\n");
-                        kfree(card->evtbd_ring_vbase);
-                        return -ENOMEM;
-                }
-                skb_put(skb, MAX_EVENT_SIZE);
-
-                if (mwifiex_map_pci_memory(adapter, skb, MAX_EVENT_SIZE,
-                                           PCI_DMA_FROMDEVICE))
-                        return -1;
-
-                MWIFIEX_SKB_PACB(skb, &buf_pa);
-                dev_dbg(adapter->dev, "info: Evt ring: add new skb. base: %p, "
-                        "buf_base: %p, buf_pbase: %#x:%x, buf_len: %#x\n",
-                        skb, skb->data, (u32)buf_pa, (u32)((u64)buf_pa >> 32),
-                        skb->len);
-
-                card->evt_buf_list[i] = skb;
-                card->evtbd_ring[i]->paddr = buf_pa;
-                card->evtbd_ring[i]->len = (u16)skb->len;
-                card->evtbd_ring[i]->flags = 0;
-        }
-
-        return 0;
+        return mwifiex_pcie_init_evt_ring(adapter);
 }
 
 /*
@@ -636,29 +794,16 @@ static int mwifiex_pcie_create_evtbd_ring(struct mwifiex_adapter *adapter)
 static int mwifiex_pcie_delete_evtbd_ring(struct mwifiex_adapter *adapter)
 {
         struct pcie_service_card *card = adapter->card;
-        struct sk_buff *skb;
-        int i;
+        const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
 
-        for (i = 0; i < MWIFIEX_MAX_EVT_BD; i++) {
-                if (card->evt_buf_list[i]) {
-                        skb = card->evt_buf_list[i];
-                        pci_unmap_single(card->dev, card->evtbd_ring[i]->paddr,
-                                         MAX_EVENT_SIZE, PCI_DMA_FROMDEVICE);
-                        dev_kfree_skb_any(skb);
-                }
-                card->evt_buf_list[i] = NULL;
-                card->evtbd_ring[i]->paddr = 0;
-                card->evtbd_ring[i]->len = 0;
-                card->evtbd_ring[i]->flags = 0;
-                card->evtbd_ring[i] = NULL;
-        }
+        mwifiex_cleanup_evt_ring(adapter);
 
         if (card->evtbd_ring_vbase)
                 pci_free_consistent(card->dev, card->evtbd_ring_size,
                                     card->evtbd_ring_vbase,
                                     card->evtbd_ring_pbase);
         card->evtbd_wrptr = 0;
-        card->evtbd_rdptr = 0 | MWIFIEX_BD_FLAG_ROLLOVER_IND;
+        card->evtbd_rdptr = 0 | reg->evt_rollover_ind;
         card->evtbd_ring_size = 0;
         card->evtbd_ring_vbase = NULL;
         card->evtbd_ring_pbase = 0;
@@ -771,12 +916,13 @@ static int mwifiex_pcie_delete_sleep_cookie_buf(struct mwifiex_adapter *adapter)
 static int mwifiex_clean_pcie_ring_buf(struct mwifiex_adapter *adapter)
 {
         struct pcie_service_card *card = adapter->card;
+        const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
         u32 rdptr;
 
         /* Read the TX ring read pointer set by firmware */
-        if (mwifiex_read_reg(adapter, REG_TXBD_RDPTR, &rdptr)) {
+        if (mwifiex_read_reg(adapter, reg->tx_rdptr, &rdptr)) {
                 dev_err(adapter->dev,
-                        "Flush TXBD: failed to read REG_TXBD_RDPTR\n");
+                        "Flush TXBD: failed to read reg->tx_rdptr\n");
                 return -1;
         }
 
@@ -800,31 +946,35 @@ static int mwifiex_clean_pcie_ring_buf(struct mwifiex_adapter *adapter)
  */
 static int mwifiex_pcie_send_data_complete(struct mwifiex_adapter *adapter)
 {
-        const u32 num_tx_buffs = MWIFIEX_MAX_TXRX_BD;
         struct sk_buff *skb;
         dma_addr_t buf_pa;
-        u32 wrdoneidx, rdptr, unmap_count = 0;
+        u32 wrdoneidx, rdptr, num_tx_buffs, unmap_count = 0;
+        struct mwifiex_pcie_buf_desc *desc;
+        struct mwifiex_pfu_buf_desc *desc2;
         struct pcie_service_card *card = adapter->card;
+        const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
 
         if (!mwifiex_pcie_ok_to_access_hw(adapter))
                 mwifiex_pm_wakeup_card(adapter);
 
         /* Read the TX ring read pointer set by firmware */
-        if (mwifiex_read_reg(adapter, REG_TXBD_RDPTR, &rdptr)) {
+        if (mwifiex_read_reg(adapter, reg->tx_rdptr, &rdptr)) {
                 dev_err(adapter->dev,
-                        "SEND COMP: failed to read REG_TXBD_RDPTR\n");
+                        "SEND COMP: failed to read reg->tx_rdptr\n");
                 return -1;
         }
 
         dev_dbg(adapter->dev, "SEND COMP: rdptr_prev=0x%x, rdptr=0x%x\n",
                 card->txbd_rdptr, rdptr);
 
+        num_tx_buffs = MWIFIEX_MAX_TXRX_BD << reg->tx_start_ptr;
         /* free from previous txbd_rdptr to current txbd_rdptr */
-        while (((card->txbd_rdptr & MWIFIEX_TXBD_MASK) !=
-                (rdptr & MWIFIEX_TXBD_MASK)) ||
-               ((card->txbd_rdptr & MWIFIEX_BD_FLAG_ROLLOVER_IND) !=
-                (rdptr & MWIFIEX_BD_FLAG_ROLLOVER_IND))) {
-                wrdoneidx = card->txbd_rdptr & MWIFIEX_TXBD_MASK;
+        while (((card->txbd_rdptr & reg->tx_mask) !=
+                (rdptr & reg->tx_mask)) ||
+               ((card->txbd_rdptr & reg->tx_rollover_ind) !=
+                (rdptr & reg->tx_rollover_ind))) {
+                wrdoneidx = (card->txbd_rdptr & reg->tx_mask) >>
+                            reg->tx_start_ptr;
 
                 skb = card->tx_buf_list[wrdoneidx];
                 if (skb) {
@@ -845,25 +995,38 @@ static int mwifiex_pcie_send_data_complete(struct mwifiex_adapter *adapter)
                 }
 
                 card->tx_buf_list[wrdoneidx] = NULL;
-                card->txbd_ring[wrdoneidx]->paddr = 0;
-                card->txbd_ring[wrdoneidx]->len = 0;
-                card->txbd_ring[wrdoneidx]->flags = 0;
-                card->txbd_rdptr++;
 
-                if ((card->txbd_rdptr & MWIFIEX_TXBD_MASK) == num_tx_buffs)
+                if (reg->pfu_enabled) {
+                        desc2 = (void *)card->txbd_ring[wrdoneidx];
+                        memset(desc2, 0, sizeof(*desc2));
+                } else {
+                        desc = card->txbd_ring[wrdoneidx];
+                        memset(desc, 0, sizeof(*desc));
+                }
+                switch (card->dev->device) {
+                case PCIE_DEVICE_ID_MARVELL_88W8766P:
+                        card->txbd_rdptr++;
+                        break;
+                case PCIE_DEVICE_ID_MARVELL_88W8897:
+                        card->txbd_rdptr += reg->ring_tx_start_ptr;
+                        break;
+                }
+
+
+                if ((card->txbd_rdptr & reg->tx_mask) == num_tx_buffs)
                         card->txbd_rdptr = ((card->txbd_rdptr &
-                                            MWIFIEX_BD_FLAG_ROLLOVER_IND) ^
-                                            MWIFIEX_BD_FLAG_ROLLOVER_IND);
+                                             reg->tx_rollover_ind) ^
+                                             reg->tx_rollover_ind);
         }
 
         if (unmap_count)
                 adapter->data_sent = false;
 
         if (card->txbd_flush) {
-                if (((card->txbd_wrptr & MWIFIEX_TXBD_MASK) ==
-                     (card->txbd_rdptr & MWIFIEX_TXBD_MASK)) &&
-                    ((card->txbd_wrptr & MWIFIEX_BD_FLAG_ROLLOVER_IND) !=
-                     (card->txbd_rdptr & MWIFIEX_BD_FLAG_ROLLOVER_IND)))
+                if (((card->txbd_wrptr & reg->tx_mask) ==
+                     (card->txbd_rdptr & reg->tx_mask)) &&
+                    ((card->txbd_wrptr & reg->tx_rollover_ind) !=
+                     (card->txbd_rdptr & reg->tx_rollover_ind)))
                         card->txbd_flush = 0;
                 else
                         mwifiex_clean_pcie_ring_buf(adapter);
@@ -883,9 +1046,12 @@ mwifiex_pcie_send_data(struct mwifiex_adapter *adapter, struct sk_buff *skb,
                        struct mwifiex_tx_param *tx_param)
 {
         struct pcie_service_card *card = adapter->card;
-        u32 wrindx;
+        const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
+        u32 wrindx, num_tx_buffs, rx_val;
         int ret;
         dma_addr_t buf_pa;
+        struct mwifiex_pcie_buf_desc *desc;
+        struct mwifiex_pfu_buf_desc *desc2;
         __le16 *tmp;
 
         if (!(skb->data && skb->len)) {
@@ -897,6 +1063,7 @@ mwifiex_pcie_send_data(struct mwifiex_adapter *adapter, struct sk_buff *skb,
         if (!mwifiex_pcie_ok_to_access_hw(adapter))
                 mwifiex_pm_wakeup_card(adapter);
 
+        num_tx_buffs = MWIFIEX_MAX_TXRX_BD << reg->tx_start_ptr;
         dev_dbg(adapter->dev, "info: SEND DATA: <Rd: %#x, Wr: %#x>\n",
                 card->txbd_rdptr, card->txbd_wrptr);
         if (mwifiex_pcie_txbd_not_full(card)) {
@@ -913,25 +1080,46 @@ mwifiex_pcie_send_data(struct mwifiex_adapter *adapter, struct sk_buff *skb,
                                            PCI_DMA_TODEVICE))
                         return -1;
 
-                wrindx = card->txbd_wrptr & MWIFIEX_TXBD_MASK;
+                wrindx = (card->txbd_wrptr & reg->tx_mask) >> reg->tx_start_ptr;
                 MWIFIEX_SKB_PACB(skb, &buf_pa);
                 card->tx_buf_list[wrindx] = skb;
-                card->txbd_ring[wrindx]->paddr = buf_pa;
-                card->txbd_ring[wrindx]->len = (u16)skb->len;
-                card->txbd_ring[wrindx]->flags = MWIFIEX_BD_FLAG_FIRST_DESC |
-                                                MWIFIEX_BD_FLAG_LAST_DESC;
 
-                if ((++card->txbd_wrptr & MWIFIEX_TXBD_MASK) ==
-                                                        MWIFIEX_MAX_TXRX_BD)
+                if (reg->pfu_enabled) {
+                        desc2 = (void *)card->txbd_ring[wrindx];
+                        desc2->paddr = buf_pa;
+                        desc2->len = (u16)skb->len;
+                        desc2->frag_len = (u16)skb->len;
+                        desc2->offset = 0;
+                        desc2->flags = MWIFIEX_BD_FLAG_FIRST_DESC |
+                                         MWIFIEX_BD_FLAG_LAST_DESC;
+                } else {
+                        desc = card->txbd_ring[wrindx];
+                        desc->paddr = buf_pa;
+                        desc->len = (u16)skb->len;
+                        desc->flags = MWIFIEX_BD_FLAG_FIRST_DESC |
+                                      MWIFIEX_BD_FLAG_LAST_DESC;
+                }
+
+                switch (card->dev->device) {
+                case PCIE_DEVICE_ID_MARVELL_88W8766P:
+                        card->txbd_wrptr++;
+                        break;
+                case PCIE_DEVICE_ID_MARVELL_88W8897:
+                        card->txbd_wrptr += reg->ring_tx_start_ptr;
+                        break;
+                }
+
+                if ((card->txbd_wrptr & reg->tx_mask) == num_tx_buffs)
                         card->txbd_wrptr = ((card->txbd_wrptr &
-                                                MWIFIEX_BD_FLAG_ROLLOVER_IND) ^
-                                                MWIFIEX_BD_FLAG_ROLLOVER_IND);
+                                                reg->tx_rollover_ind) ^
+                                                reg->tx_rollover_ind);
 
-                /* Write the TX ring write pointer in to REG_TXBD_WRPTR */
-                if (mwifiex_write_reg(adapter, REG_TXBD_WRPTR,
-                                      card->txbd_wrptr)) {
+                rx_val = card->rxbd_rdptr & reg->rx_wrap_mask;
+                /* Write the TX ring write pointer in to reg->tx_wrptr */
+                if (mwifiex_write_reg(adapter, reg->tx_wrptr,
+                                      card->txbd_wrptr | rx_val)) {
                         dev_err(adapter->dev,
-                                "SEND DATA: failed to write REG_TXBD_WRPTR\n");
+                                "SEND DATA: failed to write reg->tx_wrptr\n");
                         ret = -1;
                         goto done_unmap;
                 }
@@ -971,9 +1159,11 @@ done_unmap:
         MWIFIEX_SKB_PACB(skb, &buf_pa);
         pci_unmap_single(card->dev, buf_pa, skb->len, PCI_DMA_TODEVICE);
         card->tx_buf_list[wrindx] = NULL;
-        card->txbd_ring[wrindx]->paddr = 0;
-        card->txbd_ring[wrindx]->len = 0;
-        card->txbd_ring[wrindx]->flags = 0;
+        if (reg->pfu_enabled)
+                memset(desc2, 0, sizeof(*desc2));
+        else
+                memset(desc, 0, sizeof(*desc));
+
         return ret;
 }
 
@@ -984,32 +1174,35 @@ done_unmap:
 static int mwifiex_pcie_process_recv_data(struct mwifiex_adapter *adapter)
 {
         struct pcie_service_card *card = adapter->card;
-        u32 wrptr, rd_index;
+        const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
+        u32 wrptr, rd_index, tx_val;
         dma_addr_t buf_pa;
         int ret = 0;
         struct sk_buff *skb_tmp = NULL;
+        struct mwifiex_pcie_buf_desc *desc;
+        struct mwifiex_pfu_buf_desc *desc2;
 
         if (!mwifiex_pcie_ok_to_access_hw(adapter))
                 mwifiex_pm_wakeup_card(adapter);
 
         /* Read the RX ring Write pointer set by firmware */
-        if (mwifiex_read_reg(adapter, REG_RXBD_WRPTR, &wrptr)) {
+        if (mwifiex_read_reg(adapter, reg->rx_wrptr, &wrptr)) {
                 dev_err(adapter->dev,
-                        "RECV DATA: failed to read REG_TXBD_RDPTR\n");
+                        "RECV DATA: failed to read reg->rx_wrptr\n");
                 ret = -1;
                 goto done;
         }
         card->rxbd_wrptr = wrptr;
 
-        while (((wrptr & MWIFIEX_RXBD_MASK) !=
-                (card->rxbd_rdptr & MWIFIEX_RXBD_MASK)) ||
-               ((wrptr & MWIFIEX_BD_FLAG_ROLLOVER_IND) ==
-                (card->rxbd_rdptr & MWIFIEX_BD_FLAG_ROLLOVER_IND))) {
+        while (((wrptr & reg->rx_mask) !=
+                (card->rxbd_rdptr & reg->rx_mask)) ||
+               ((wrptr & reg->rx_rollover_ind) ==
+                (card->rxbd_rdptr & reg->rx_rollover_ind))) {
                 struct sk_buff *skb_data;
                 u16 rx_len;
                 __le16 pkt_len;
 
-                rd_index = card->rxbd_rdptr & MWIFIEX_RXBD_MASK;
+                rd_index = card->rxbd_rdptr & reg->rx_mask;
                 skb_data = card->rx_buf_list[rd_index];
 
                 MWIFIEX_SKB_PACB(skb_data, &buf_pa);
@@ -1047,32 +1240,44 @@ static int mwifiex_pcie_process_recv_data(struct mwifiex_adapter *adapter)
                         "RECV DATA: Attach new sk_buff %p at rxbd_rdidx=%d\n",
                         skb_tmp, rd_index);
                 card->rx_buf_list[rd_index] = skb_tmp;
-                card->rxbd_ring[rd_index]->paddr = buf_pa;
-                card->rxbd_ring[rd_index]->len = skb_tmp->len;
-                card->rxbd_ring[rd_index]->flags = 0;
 
-                if ((++card->rxbd_rdptr & MWIFIEX_RXBD_MASK) ==
+                if (reg->pfu_enabled) {
+                        desc2 = (void *)card->rxbd_ring[rd_index];
+                        desc2->paddr = buf_pa;
+                        desc2->len = skb_tmp->len;
+                        desc2->frag_len = skb_tmp->len;
+                        desc2->offset = 0;
+                        desc2->flags = reg->ring_flag_sop | reg->ring_flag_eop;
+                } else {
+                        desc = card->rxbd_ring[rd_index];
+                        desc->paddr = buf_pa;
+                        desc->len = skb_tmp->len;
+                        desc->flags = 0;
+                }
+
+                if ((++card->rxbd_rdptr & reg->rx_mask) ==
                                                         MWIFIEX_MAX_TXRX_BD) {
                         card->rxbd_rdptr = ((card->rxbd_rdptr &
-                                             MWIFIEX_BD_FLAG_ROLLOVER_IND) ^
-                                            MWIFIEX_BD_FLAG_ROLLOVER_IND);
+                                             reg->rx_rollover_ind) ^
+                                             reg->rx_rollover_ind);
                 }
                 dev_dbg(adapter->dev, "info: RECV DATA: <Rd: %#x, Wr: %#x>\n",
                         card->rxbd_rdptr, wrptr);
 
-                /* Write the RX ring read pointer in to REG_RXBD_RDPTR */
-                if (mwifiex_write_reg(adapter, REG_RXBD_RDPTR,
-                                      card->rxbd_rdptr)) {
+                tx_val = card->txbd_wrptr & reg->tx_wrap_mask;
+                /* Write the RX ring read pointer in to reg->rx_rdptr */
+                if (mwifiex_write_reg(adapter, reg->rx_rdptr,
+                                      card->rxbd_rdptr | tx_val)) {
                         dev_err(adapter->dev,
-                                "RECV DATA: failed to write REG_RXBD_RDPTR\n");
+                                "RECV DATA: failed to write reg->rx_rdptr\n");
                         ret = -1;
                         goto done;
                 }
 
                 /* Read the RX ring Write pointer set by firmware */
-                if (mwifiex_read_reg(adapter, REG_RXBD_WRPTR, &wrptr)) {
+                if (mwifiex_read_reg(adapter, reg->rx_wrptr, &wrptr)) {
                         dev_err(adapter->dev,
-                                "RECV DATA: failed to read REG_TXBD_RDPTR\n");
+                                "RECV DATA: failed to read reg->rx_wrptr\n");
                         ret = -1;
                         goto done;
                 }
@@ -1093,6 +1298,7 @@ mwifiex_pcie_send_boot_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb)
 {
         dma_addr_t buf_pa;
         struct pcie_service_card *card = adapter->card;
+        const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
 
         if (!(skb->data && skb->len)) {
                 dev_err(adapter->dev,
@@ -1106,9 +1312,10 @@ mwifiex_pcie_send_boot_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb)
 
         MWIFIEX_SKB_PACB(skb, &buf_pa);
 
-        /* Write the lower 32bits of the physical address to scratch
-         * register 0 */
-        if (mwifiex_write_reg(adapter, PCIE_SCRATCH_0_REG, (u32)buf_pa)) {
+        /* Write the lower 32bits of the physical address to low command
+         * address scratch register
+         */
+        if (mwifiex_write_reg(adapter, reg->cmd_addr_lo, (u32)buf_pa)) {
                 dev_err(adapter->dev,
                         "%s: failed to write download command to boot code.\n",
                         __func__);
@@ -1117,9 +1324,10 @@ mwifiex_pcie_send_boot_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb)
                 return -1;
         }
 
-        /* Write the upper 32bits of the physical address to scratch
-         * register 1 */
-        if (mwifiex_write_reg(adapter, PCIE_SCRATCH_1_REG,
+        /* Write the upper 32bits of the physical address to high command
+         * address scratch register
+         */
+        if (mwifiex_write_reg(adapter, reg->cmd_addr_hi,
                               (u32)((u64)buf_pa >> 32))) {
                 dev_err(adapter->dev,
                         "%s: failed to write download command to boot code.\n",
@@ -1129,10 +1337,10 @@ mwifiex_pcie_send_boot_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb)
                 return -1;
         }
 
-        /* Write the command length to scratch register 2 */
-        if (mwifiex_write_reg(adapter, PCIE_SCRATCH_2_REG, skb->len)) {
+        /* Write the command length to cmd_size scratch register */
+        if (mwifiex_write_reg(adapter, reg->cmd_size, skb->len)) {
                 dev_err(adapter->dev,
-                        "%s: failed to write command len to scratch reg 2\n",
+                        "%s: failed to write command len to cmd_size scratch reg\n",
                         __func__);
                 pci_unmap_single(card->dev, buf_pa, MWIFIEX_UPLD_SIZE,
                                  PCI_DMA_TODEVICE);
@@ -1158,11 +1366,14 @@ mwifiex_pcie_send_boot_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb)
 static int mwifiex_pcie_init_fw_port(struct mwifiex_adapter *adapter)
 {
         struct pcie_service_card *card = adapter->card;
+        const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
+        int tx_wrap = card->txbd_wrptr & reg->tx_wrap_mask;
 
-        /* Write the RX ring read pointer in to REG_RXBD_RDPTR */
-        if (mwifiex_write_reg(adapter, REG_RXBD_RDPTR, card->rxbd_rdptr | 0)) {
+        /* Write the RX ring read pointer in to reg->rx_rdptr */
+        if (mwifiex_write_reg(adapter, reg->rx_rdptr, card->rxbd_rdptr |
+                              tx_wrap)) {
                 dev_err(adapter->dev,
-                        "RECV DATA: failed to write REG_RXBD_RDPTR\n");
+                        "RECV DATA: failed to write reg->rx_rdptr\n");
                 return -1;
         }
         return 0;
@@ -1174,6 +1385,7 @@ static int
 mwifiex_pcie_send_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb)
 {
         struct pcie_service_card *card = adapter->card;
+        const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
         int ret = 0;
         dma_addr_t cmd_buf_pa, cmdrsp_buf_pa;
         u8 *payload = (u8 *)skb->data;
@@ -1206,7 +1418,7 @@ mwifiex_pcie_send_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb)
 
         /* To send a command, the driver will:
                 1. Write the 64bit physical address of the data buffer to
-                   SCRATCH1 + SCRATCH0
+                   cmd response address low  + cmd response address high
                 2. Ring the door bell (i.e. set the door bell interrupt)
 
                 In response to door bell interrupt, the firmware will perform
@@ -1218,7 +1430,7 @@ mwifiex_pcie_send_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb)
                 MWIFIEX_SKB_PACB(card->cmdrsp_buf, &cmdrsp_buf_pa);
                 /* Write the lower 32bits of the cmdrsp buffer physical
                    address */
-                if (mwifiex_write_reg(adapter, REG_CMDRSP_ADDR_LO,
+                if (mwifiex_write_reg(adapter, reg->cmdrsp_addr_lo,
                                       (u32)cmdrsp_buf_pa)) {
                         dev_err(adapter->dev,
                                 "Failed to write download cmd to boot code.\n");
@@ -1227,7 +1439,7 @@ mwifiex_pcie_send_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb)
                 }
                 /* Write the upper 32bits of the cmdrsp buffer physical
                    address */
-                if (mwifiex_write_reg(adapter, REG_CMDRSP_ADDR_HI,
+                if (mwifiex_write_reg(adapter, reg->cmdrsp_addr_hi,
                                       (u32)((u64)cmdrsp_buf_pa >> 32))) {
                         dev_err(adapter->dev,
                                 "Failed to write download cmd to boot code.\n");
@@ -1237,15 +1449,16 @@ mwifiex_pcie_send_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb)
         }
 
         MWIFIEX_SKB_PACB(card->cmd_buf, &cmd_buf_pa);
-        /* Write the lower 32bits of the physical address to REG_CMD_ADDR_LO */
-        if (mwifiex_write_reg(adapter, REG_CMD_ADDR_LO, (u32)cmd_buf_pa)) {
+        /* Write the lower 32bits of the physical address to reg->cmd_addr_lo */
+        if (mwifiex_write_reg(adapter, reg->cmd_addr_lo,
+                              (u32)cmd_buf_pa)) {
                 dev_err(adapter->dev,
                         "Failed to write download cmd to boot code.\n");
                 ret = -1;
                 goto done;
         }
-        /* Write the upper 32bits of the physical address to REG_CMD_ADDR_HI */
-        if (mwifiex_write_reg(adapter, REG_CMD_ADDR_HI,
+        /* Write the upper 32bits of the physical address to reg->cmd_addr_hi */
+        if (mwifiex_write_reg(adapter, reg->cmd_addr_hi,
                               (u32)((u64)cmd_buf_pa >> 32))) {
                 dev_err(adapter->dev,
                         "Failed to write download cmd to boot code.\n");
@@ -1253,10 +1466,11 @@ mwifiex_pcie_send_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb)
                 goto done;
         }
 
-        /* Write the command length to REG_CMD_SIZE */
-        if (mwifiex_write_reg(adapter, REG_CMD_SIZE, card->cmd_buf->len)) {
+        /* Write the command length to reg->cmd_size */
+        if (mwifiex_write_reg(adapter, reg->cmd_size,
+                              card->cmd_buf->len)) {
                 dev_err(adapter->dev,
-                        "Failed to write cmd len to REG_CMD_SIZE\n");
+                        "Failed to write cmd len to reg->cmd_size\n");
                 ret = -1;
                 goto done;
         }
@@ -1283,6 +1497,7 @@ done:
 static int mwifiex_pcie_process_cmd_complete(struct mwifiex_adapter *adapter)
 {
         struct pcie_service_card *card = adapter->card;
+        const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
         struct sk_buff *skb = card->cmdrsp_buf;
         int count = 0;
         u16 rx_len;
@@ -1304,8 +1519,8 @@ static int mwifiex_pcie_process_cmd_complete(struct mwifiex_adapter *adapter)
                 if (adapter->ps_state == PS_STATE_SLEEP_CFM) {
                         mwifiex_process_sleep_confirm_resp(adapter, skb->data,
                                                            skb->len);
-                        while (mwifiex_pcie_ok_to_access_hw(adapter) &&
-                                                        (count++ < 10))
+                        while (reg->sleep_cookie && (count++ < 10) &&
+                               mwifiex_pcie_ok_to_access_hw(adapter))
                                 usleep_range(50, 60);
                 } else {
                         dev_err(adapter->dev,
@@ -1328,14 +1543,14 @@ static int mwifiex_pcie_process_cmd_complete(struct mwifiex_adapter *adapter)
                 /* Clear the cmd-rsp buffer address in scratch registers. This
                    will prevent firmware from writing to the same response
                    buffer again. */
-                if (mwifiex_write_reg(adapter, REG_CMDRSP_ADDR_LO, 0)) {
+                if (mwifiex_write_reg(adapter, reg->cmdrsp_addr_lo, 0)) {
                         dev_err(adapter->dev,
                                 "cmd_done: failed to clear cmd_rsp_addr_lo\n");
                         return -1;
                 }
                 /* Write the upper 32bits of the cmdrsp buffer physical
                    address */
-                if (mwifiex_write_reg(adapter, REG_CMDRSP_ADDR_HI, 0)) {
+                if (mwifiex_write_reg(adapter, reg->cmdrsp_addr_hi, 0)) {
                         dev_err(adapter->dev,
                                 "cmd_done: failed to clear cmd_rsp_addr_hi\n");
                         return -1;
@@ -1380,9 +1595,11 @@ static int mwifiex_pcie_cmdrsp_complete(struct mwifiex_adapter *adapter,
 static int mwifiex_pcie_process_event_ready(struct mwifiex_adapter *adapter)
 {
         struct pcie_service_card *card = adapter->card;
+        const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
         u32 rdptr = card->evtbd_rdptr & MWIFIEX_EVTBD_MASK;
         u32 wrptr, event;
         dma_addr_t buf_pa;
+        struct mwifiex_evt_buf_desc *desc;
 
         if (!mwifiex_pcie_ok_to_access_hw(adapter))
                 mwifiex_pm_wakeup_card(adapter);
@@ -1399,9 +1616,9 @@ static int mwifiex_pcie_process_event_ready(struct mwifiex_adapter *adapter)
         }
 
         /* Read the event ring write pointer set by firmware */
-        if (mwifiex_read_reg(adapter, REG_EVTBD_WRPTR, &wrptr)) {
+        if (mwifiex_read_reg(adapter, reg->evt_wrptr, &wrptr)) {
                 dev_err(adapter->dev,
-                        "EventReady: failed to read REG_EVTBD_WRPTR\n");
+                        "EventReady: failed to read reg->evt_wrptr\n");
                 return -1;
         }
 
@@ -1409,8 +1626,8 @@ static int mwifiex_pcie_process_event_ready(struct mwifiex_adapter *adapter)
                 card->evtbd_rdptr, wrptr);
         if (((wrptr & MWIFIEX_EVTBD_MASK) != (card->evtbd_rdptr
                                               & MWIFIEX_EVTBD_MASK)) ||
-            ((wrptr & MWIFIEX_BD_FLAG_ROLLOVER_IND) ==
-             (card->evtbd_rdptr & MWIFIEX_BD_FLAG_ROLLOVER_IND))) {
+            ((wrptr & reg->evt_rollover_ind) ==
+             (card->evtbd_rdptr & reg->evt_rollover_ind))) {
                 struct sk_buff *skb_cmd;
                 __le16 data_len = 0;
                 u16 evt_len;
@@ -1424,9 +1641,8 @@ static int mwifiex_pcie_process_event_ready(struct mwifiex_adapter *adapter)
                 /* Take the pointer and set it to event pointer in adapter
                    and will return back after event handling callback */
                 card->evt_buf_list[rdptr] = NULL;
-                card->evtbd_ring[rdptr]->paddr = 0;
-                card->evtbd_ring[rdptr]->len = 0;
-                card->evtbd_ring[rdptr]->flags = 0;
+                desc = card->evtbd_ring[rdptr];
+                memset(desc, 0, sizeof(*desc));
 
                 event = *(u32 *) &skb_cmd->data[INTF_HEADER_LEN];
                 adapter->event_cause = event;
@@ -1462,10 +1678,12 @@ static int mwifiex_pcie_event_complete(struct mwifiex_adapter *adapter,
                                        struct sk_buff *skb)
 {
         struct pcie_service_card *card = adapter->card;
+        const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
         int ret = 0;
         u32 rdptr = card->evtbd_rdptr & MWIFIEX_EVTBD_MASK;
         u32 wrptr;
         dma_addr_t buf_pa;
+        struct mwifiex_evt_buf_desc *desc;
 
         if (!skb)
                 return 0;
@@ -1477,9 +1695,9 @@ static int mwifiex_pcie_event_complete(struct mwifiex_adapter *adapter,
         }
 
         /* Read the event ring write pointer set by firmware */
-        if (mwifiex_read_reg(adapter, REG_EVTBD_WRPTR, &wrptr)) {
+        if (mwifiex_read_reg(adapter, reg->evt_wrptr, &wrptr)) {
                 dev_err(adapter->dev,
-                        "event_complete: failed to read REG_EVTBD_WRPTR\n");
+                        "event_complete: failed to read reg->evt_wrptr\n");
                 return -1;
         }
 
@@ -1492,9 +1710,10 @@ static int mwifiex_pcie_event_complete(struct mwifiex_adapter *adapter,
                 MWIFIEX_SKB_PACB(skb, &buf_pa);
                 card->evt_buf_list[rdptr] = skb;
                 MWIFIEX_SKB_PACB(skb, &buf_pa);
-                card->evtbd_ring[rdptr]->paddr = buf_pa;
-                card->evtbd_ring[rdptr]->len = (u16)skb->len;
-                card->evtbd_ring[rdptr]->flags = 0;
+                desc = card->evtbd_ring[rdptr];
+                desc->paddr = buf_pa;
+                desc->len = (u16)skb->len;
+                desc->flags = 0;
                 skb = NULL;
         } else {
                 dev_dbg(adapter->dev,
@@ -1504,17 +1723,18 @@ static int mwifiex_pcie_event_complete(struct mwifiex_adapter *adapter,
 
         if ((++card->evtbd_rdptr & MWIFIEX_EVTBD_MASK) == MWIFIEX_MAX_EVT_BD) {
                 card->evtbd_rdptr = ((card->evtbd_rdptr &
-                                        MWIFIEX_BD_FLAG_ROLLOVER_IND) ^
-                                        MWIFIEX_BD_FLAG_ROLLOVER_IND);
+                                        reg->evt_rollover_ind) ^
+                                        reg->evt_rollover_ind);
         }
 
         dev_dbg(adapter->dev, "info: Updated <Rd: 0x%x, Wr: 0x%x>",
                 card->evtbd_rdptr, wrptr);
 
-        /* Write the event ring read pointer in to REG_EVTBD_RDPTR */
-        if (mwifiex_write_reg(adapter, REG_EVTBD_RDPTR, card->evtbd_rdptr)) {
+        /* Write the event ring read pointer in to reg->evt_rdptr */
+        if (mwifiex_write_reg(adapter, reg->evt_rdptr,
+                              card->evtbd_rdptr)) {
                 dev_err(adapter->dev,
-                        "event_complete: failed to read REG_EVTBD_RDPTR\n");
+                        "event_complete: failed to read reg->evt_rdptr\n");
                 return -1;
         }
 
@@ -1543,6 +1763,7 @@ static int mwifiex_prog_fw_w_helper(struct mwifiex_adapter *adapter,
         u32 block_retry_cnt = 0;
         dma_addr_t buf_pa;
         struct pcie_service_card *card = adapter->card;
+        const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
 
         if (!firmware || !firmware_len) {
                 dev_err(adapter->dev,
@@ -1574,7 +1795,7 @@ static int mwifiex_prog_fw_w_helper(struct mwifiex_adapter *adapter,
                         break;
 
                 for (tries = 0; tries < MAX_POLL_TRIES; tries++) {
-                        ret = mwifiex_read_reg(adapter, PCIE_SCRATCH_2_REG,
+                        ret = mwifiex_read_reg(adapter, reg->cmd_size,
                                                &len);
                         if (ret) {
                                 dev_warn(adapter->dev,
@@ -1620,16 +1841,15 @@ static int mwifiex_prog_fw_w_helper(struct mwifiex_adapter *adapter,
 
                         dev_dbg(adapter->dev, ".");
 
-                        tx_blocks = (txlen +
-                                     MWIFIEX_PCIE_BLOCK_SIZE_FW_DNLD - 1) /
-                                     MWIFIEX_PCIE_BLOCK_SIZE_FW_DNLD;
+                        tx_blocks = (txlen + card->pcie.blksz_fw_dl - 1) /
+                                    card->pcie.blksz_fw_dl;
 
                         /* Copy payload to buffer */
                         memmove(skb->data, &firmware[offset], txlen);
                 }
 
                 skb_put(skb, MWIFIEX_UPLD_SIZE - skb->len);
-                skb_trim(skb, tx_blocks * MWIFIEX_PCIE_BLOCK_SIZE_FW_DNLD);
+                skb_trim(skb, tx_blocks * card->pcie.blksz_fw_dl);
 
                 /* Send the boot command to device */
                 if (mwifiex_pcie_send_boot_cmd(adapter, skb)) {
@@ -1682,6 +1902,8 @@ mwifiex_check_fw_status(struct mwifiex_adapter *adapter, u32 poll_num)
 {
         int ret = 0;
         u32 firmware_stat, winner_status;
+        struct pcie_service_card *card = adapter->card;
+        const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
         u32 tries;
 
         /* Mask spurios interrupts */
@@ -1692,7 +1914,8 @@ mwifiex_check_fw_status(struct mwifiex_adapter *adapter, u32 poll_num)
         }
 
         dev_dbg(adapter->dev, "Setting driver ready signature\n");
-        if (mwifiex_write_reg(adapter, REG_DRV_READY, FIRMWARE_READY_PCIE)) {
+        if (mwifiex_write_reg(adapter, reg->drv_rdy,
+                              FIRMWARE_READY_PCIE)) {
                 dev_err(adapter->dev,
                         "Failed to write driver ready signature\n");
                 return -1;
@@ -1700,7 +1923,7 @@ mwifiex_check_fw_status(struct mwifiex_adapter *adapter, u32 poll_num)
 
         /* Wait for firmware initialization event */
         for (tries = 0; tries < poll_num; tries++) {
-                if (mwifiex_read_reg(adapter, PCIE_SCRATCH_3_REG,
+                if (mwifiex_read_reg(adapter, reg->fw_status,
                                      &firmware_stat))
                         ret = -1;
                 else
@@ -1717,7 +1940,7 @@ mwifiex_check_fw_status(struct mwifiex_adapter *adapter, u32 poll_num)
         }
 
         if (ret) {
-                if (mwifiex_read_reg(adapter, PCIE_SCRATCH_3_REG,
+                if (mwifiex_read_reg(adapter, reg->fw_status,
                                      &winner_status))
                         ret = -1;
                 else if (!winner_status) {
@@ -1955,6 +2178,7 @@ static int mwifiex_pcie_init(struct mwifiex_adapter *adapter)
         struct pcie_service_card *card = adapter->card;
         int ret;
         struct pci_dev *pdev = card->dev;
+        const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
 
         pci_set_drvdata(pdev, card);
 
@@ -2017,10 +2241,13 @@ static int mwifiex_pcie_init(struct mwifiex_adapter *adapter)
         ret = mwifiex_pcie_alloc_cmdrsp_buf(adapter);
         if (ret)
                 goto err_alloc_cmdbuf;
-        ret = mwifiex_pcie_alloc_sleep_cookie_buf(adapter);
-        if (ret)
-                goto err_alloc_cookie;
-
+        if (reg->sleep_cookie) {
+                ret = mwifiex_pcie_alloc_sleep_cookie_buf(adapter);
+                if (ret)
+                        goto err_alloc_cookie;
+        } else {
+                card->sleep_cookie_vbase = NULL;
+        }
         return ret;
 
 err_alloc_cookie:
@@ -2061,10 +2288,11 @@ static void mwifiex_pcie_cleanup(struct mwifiex_adapter *adapter)
 {
         struct pcie_service_card *card = adapter->card;
         struct pci_dev *pdev = card->dev;
+        const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
 
         if (user_rmmod) {
                 dev_dbg(adapter->dev, "Clearing driver ready signature\n");
-                if (mwifiex_write_reg(adapter, REG_DRV_READY, 0x00000000))
+                if (mwifiex_write_reg(adapter, reg->drv_rdy, 0x00000000))
                         dev_err(adapter->dev,
                                 "Failed to write driver not-ready signature\n");
         }
@@ -2102,7 +2330,7 @@ static int mwifiex_register_dev(struct mwifiex_adapter *adapter)
         }
 
         adapter->dev = &pdev->dev;
-        strcpy(adapter->fw_name, PCIE8766_DEFAULT_FW_NAME);
+        strcpy(adapter->fw_name, card->pcie.firmware);
 
         return 0;
 }
@@ -2116,12 +2344,16 @@ static int mwifiex_register_dev(struct mwifiex_adapter *adapter)
 static void mwifiex_unregister_dev(struct mwifiex_adapter *adapter)
 {
         struct pcie_service_card *card = adapter->card;
+        const struct mwifiex_pcie_card_reg *reg;
 
         if (card) {
                 dev_dbg(adapter->dev, "%s(): calling free_irq()\n", __func__);
                 free_irq(card->dev->irq, card->dev);
 
-                mwifiex_pcie_delete_sleep_cookie_buf(adapter);
+                reg = card->pcie.reg;
+                if (reg->sleep_cookie)
+                        mwifiex_pcie_delete_sleep_cookie_buf(adapter);
+
                 mwifiex_pcie_delete_cmdrsp_buf(adapter);
                 mwifiex_pcie_delete_evtbd_ring(adapter);
                 mwifiex_pcie_delete_rxbd_ring(adapter);
@@ -2162,7 +2394,7 @@ static int mwifiex_pcie_init_module(void)
 {
         int ret;
 
-        pr_debug("Marvell 8766 PCIe Driver\n");
+        pr_debug("Marvell PCIe Driver\n");
 
         sema_init(&add_remove_card_sem, 1);
 
@@ -2205,4 +2437,5 @@ MODULE_AUTHOR("Marvell International Ltd.");
 MODULE_DESCRIPTION("Marvell WiFi-Ex PCI-Express Driver version " PCIE_VERSION);
 MODULE_VERSION(PCIE_VERSION);
 MODULE_LICENSE("GPL v2");
-MODULE_FIRMWARE("mrvl/pcie8766_uapsta.bin");
+MODULE_FIRMWARE(PCIE8766_DEFAULT_FW_NAME);
+MODULE_FIRMWARE(PCIE8897_DEFAULT_FW_NAME);
diff --git a/drivers/net/wireless/mwifiex/pcie.h b/drivers/net/wireless/mwifiex/pcie.h
index 37eeb2ca6b29..d322ab8604ea 100644
--- a/drivers/net/wireless/mwifiex/pcie.h
+++ b/drivers/net/wireless/mwifiex/pcie.h
@@ -29,6 +29,11 @@
 #include    "main.h"
 
 #define PCIE8766_DEFAULT_FW_NAME "mrvl/pcie8766_uapsta.bin"
+#define PCIE8897_DEFAULT_FW_NAME "mrvl/pcie8897_uapsta.bin"
+
+#define PCIE_VENDOR_ID_MARVELL              (0x11ab)
+#define PCIE_DEVICE_ID_MARVELL_88W8766P         (0x2b30)
+#define PCIE_DEVICE_ID_MARVELL_88W8897          (0x2b38)
 
 /* Constants for Buffer Descriptor (BD) rings */
 #define MWIFIEX_MAX_TXRX_BD                     0x20
@@ -57,6 +62,8 @@
 #define PCIE_SCRATCH_10_REG                             0xCE8
 #define PCIE_SCRATCH_11_REG                             0xCEC
 #define PCIE_SCRATCH_12_REG                             0xCF0
+#define PCIE_RD_DATA_PTR_Q0_Q1                          0xC08C
+#define PCIE_WR_DATA_PTR_Q0_Q1                          0xC05C
 
 #define CPU_INTR_DNLD_RDY                               BIT(0)
 #define CPU_INTR_DOOR_BELL                              BIT(1)
@@ -75,27 +82,14 @@
 #define MWIFIEX_BD_FLAG_ROLLOVER_IND                    BIT(7)
 #define MWIFIEX_BD_FLAG_FIRST_DESC                      BIT(0)
 #define MWIFIEX_BD_FLAG_LAST_DESC                       BIT(1)
-#define REG_CMD_ADDR_LO                                 PCIE_SCRATCH_0_REG
-#define REG_CMD_ADDR_HI                                 PCIE_SCRATCH_1_REG
-#define REG_CMD_SIZE                                    PCIE_SCRATCH_2_REG
-
-#define REG_CMDRSP_ADDR_LO                              PCIE_SCRATCH_4_REG
-#define REG_CMDRSP_ADDR_HI                              PCIE_SCRATCH_5_REG
-
-/* TX buffer description read pointer */
-#define REG_TXBD_RDPTR                                  PCIE_SCRATCH_6_REG
-/* TX buffer description write pointer */
-#define REG_TXBD_WRPTR                                  PCIE_SCRATCH_7_REG
-/* RX buffer description read pointer */
-#define REG_RXBD_RDPTR                                  PCIE_SCRATCH_8_REG
-/* RX buffer description write pointer */
-#define REG_RXBD_WRPTR                                  PCIE_SCRATCH_9_REG
-/* Event buffer description read pointer */
-#define REG_EVTBD_RDPTR                                 PCIE_SCRATCH_10_REG
-/* Event buffer description write pointer */
-#define REG_EVTBD_WRPTR                                 PCIE_SCRATCH_11_REG
-/* Driver ready signature write pointer */
-#define REG_DRV_READY                                   PCIE_SCRATCH_12_REG
+#define MWIFIEX_BD_FLAG_SOP                             BIT(0)
+#define MWIFIEX_BD_FLAG_EOP                             BIT(1)
+#define MWIFIEX_BD_FLAG_XS_SOP                          BIT(2)
+#define MWIFIEX_BD_FLAG_XS_EOP                          BIT(3)
+#define MWIFIEX_BD_FLAG_EVT_ROLLOVER_IND                BIT(7)
+#define MWIFIEX_BD_FLAG_RX_ROLLOVER_IND                 BIT(10)
+#define MWIFIEX_BD_FLAG_TX_START_PTR                    BIT(16)
+#define MWIFIEX_BD_FLAG_TX_ROLLOVER_IND                 BIT(26)
 
 /* Max retry number of command write */
 #define MAX_WRITE_IOMEM_RETRY                           2
@@ -104,15 +98,142 @@
 /* FW awake cookie after FW ready */
 #define FW_AWAKE_COOKIE                                         (0xAA55AA55)
 
+struct mwifiex_pcie_card_reg {
+        u16 cmd_addr_lo;
+        u16 cmd_addr_hi;
+        u16 fw_status;
+        u16 cmd_size;
+        u16 cmdrsp_addr_lo;
+        u16 cmdrsp_addr_hi;
+        u16 tx_rdptr;
+        u16 tx_wrptr;
+        u16 rx_rdptr;
+        u16 rx_wrptr;
+        u16 evt_rdptr;
+        u16 evt_wrptr;
+        u16 drv_rdy;
+        u16 tx_start_ptr;
+        u32 tx_mask;
+        u32 tx_wrap_mask;
+        u32 rx_mask;
+        u32 rx_wrap_mask;
+        u32 tx_rollover_ind;
+        u32 rx_rollover_ind;
+        u32 evt_rollover_ind;
+        u8 ring_flag_sop;
+        u8 ring_flag_eop;
+        u8 ring_flag_xs_sop;
+        u8 ring_flag_xs_eop;
+        u32 ring_tx_start_ptr;
+        u8 pfu_enabled;
+        u8 sleep_cookie;
+};
+
+static const struct mwifiex_pcie_card_reg mwifiex_reg_8766 = {
+        .cmd_addr_lo = PCIE_SCRATCH_0_REG,
+        .cmd_addr_hi = PCIE_SCRATCH_1_REG,
+        .cmd_size = PCIE_SCRATCH_2_REG,
+        .fw_status = PCIE_SCRATCH_3_REG,
+        .cmdrsp_addr_lo = PCIE_SCRATCH_4_REG,
+        .cmdrsp_addr_hi = PCIE_SCRATCH_5_REG,
+        .tx_rdptr = PCIE_SCRATCH_6_REG,
+        .tx_wrptr = PCIE_SCRATCH_7_REG,
+        .rx_rdptr = PCIE_SCRATCH_8_REG,
+        .rx_wrptr = PCIE_SCRATCH_9_REG,
+        .evt_rdptr = PCIE_SCRATCH_10_REG,
+        .evt_wrptr = PCIE_SCRATCH_11_REG,
+        .drv_rdy = PCIE_SCRATCH_12_REG,
+        .tx_start_ptr = 0,
+        .tx_mask = MWIFIEX_TXBD_MASK,
+        .tx_wrap_mask = 0,
+        .rx_mask = MWIFIEX_RXBD_MASK,
+        .rx_wrap_mask = 0,
+        .tx_rollover_ind = MWIFIEX_BD_FLAG_ROLLOVER_IND,
+        .rx_rollover_ind = MWIFIEX_BD_FLAG_ROLLOVER_IND,
+        .evt_rollover_ind = MWIFIEX_BD_FLAG_ROLLOVER_IND,
+        .ring_flag_sop = 0,
+        .ring_flag_eop = 0,
+        .ring_flag_xs_sop = 0,
+        .ring_flag_xs_eop = 0,
+        .ring_tx_start_ptr = 0,
+        .pfu_enabled = 0,
+        .sleep_cookie = 1,
+};
+
+static const struct mwifiex_pcie_card_reg mwifiex_reg_8897 = {
+        .cmd_addr_lo = PCIE_SCRATCH_0_REG,
+        .cmd_addr_hi = PCIE_SCRATCH_1_REG,
+        .cmd_size = PCIE_SCRATCH_2_REG,
+        .fw_status = PCIE_SCRATCH_3_REG,
+        .cmdrsp_addr_lo = PCIE_SCRATCH_4_REG,
+        .cmdrsp_addr_hi = PCIE_SCRATCH_5_REG,
+        .tx_rdptr = PCIE_RD_DATA_PTR_Q0_Q1,
+        .tx_wrptr = PCIE_WR_DATA_PTR_Q0_Q1,
+        .rx_rdptr = PCIE_WR_DATA_PTR_Q0_Q1,
+        .rx_wrptr = PCIE_RD_DATA_PTR_Q0_Q1,
+        .evt_rdptr = PCIE_SCRATCH_10_REG,
+        .evt_wrptr = PCIE_SCRATCH_11_REG,
+        .drv_rdy = PCIE_SCRATCH_12_REG,
+        .tx_start_ptr = 16,
+        .tx_mask = 0x03FF0000,
+        .tx_wrap_mask = 0x07FF0000,
+        .rx_mask = 0x000003FF,
+        .rx_wrap_mask = 0x000007FF,
+        .tx_rollover_ind = MWIFIEX_BD_FLAG_TX_ROLLOVER_IND,
+        .rx_rollover_ind = MWIFIEX_BD_FLAG_RX_ROLLOVER_IND,
+        .evt_rollover_ind = MWIFIEX_BD_FLAG_EVT_ROLLOVER_IND,
+        .ring_flag_sop = MWIFIEX_BD_FLAG_SOP,
+        .ring_flag_eop = MWIFIEX_BD_FLAG_EOP,
+        .ring_flag_xs_sop = MWIFIEX_BD_FLAG_XS_SOP,
+        .ring_flag_xs_eop = MWIFIEX_BD_FLAG_XS_EOP,
+        .ring_tx_start_ptr = MWIFIEX_BD_FLAG_TX_START_PTR,
+        .pfu_enabled = 1,
+        .sleep_cookie = 0,
+};
+
+struct mwifiex_pcie_device {
+        const char *firmware;
+        const struct mwifiex_pcie_card_reg *reg;
+        u16 blksz_fw_dl;
+};
+
+static const struct mwifiex_pcie_device mwifiex_pcie8766 = {
+        .firmware       = PCIE8766_DEFAULT_FW_NAME,
+        .reg            = &mwifiex_reg_8766,
+        .blksz_fw_dl = MWIFIEX_PCIE_BLOCK_SIZE_FW_DNLD,
+};
+
+static const struct mwifiex_pcie_device mwifiex_pcie8897 = {
+        .firmware       = PCIE8897_DEFAULT_FW_NAME,
+        .reg            = &mwifiex_reg_8897,
+        .blksz_fw_dl = MWIFIEX_PCIE_BLOCK_SIZE_FW_DNLD,
+};
+
+struct mwifiex_evt_buf_desc {
+        u64 paddr;
+        u16 len;
+        u16 flags;
+} __packed;
+
 struct mwifiex_pcie_buf_desc {
         u64 paddr;
         u16 len;
         u16 flags;
 } __packed;
 
+struct mwifiex_pfu_buf_desc {
+        u16 flags;
+        u16 offset;
+        u16 frag_len;
+        u16 len;
+        u64 paddr;
+        u32 reserved;
+} __packed;
+
 struct pcie_service_card {
         struct pci_dev *dev;
         struct mwifiex_adapter *adapter;
+        struct mwifiex_pcie_device pcie;
 
         u8 txbd_flush;
         u32 txbd_wrptr;
@@ -120,7 +241,7 @@ struct pcie_service_card {
         u32 txbd_ring_size;
         u8 *txbd_ring_vbase;
         dma_addr_t txbd_ring_pbase;
-        struct mwifiex_pcie_buf_desc *txbd_ring[MWIFIEX_MAX_TXRX_BD];
+        void *txbd_ring[MWIFIEX_MAX_TXRX_BD];
         struct sk_buff *tx_buf_list[MWIFIEX_MAX_TXRX_BD];
 
         u32 rxbd_wrptr;
@@ -128,7 +249,7 @@ struct pcie_service_card {
         u32 rxbd_ring_size;
         u8 *rxbd_ring_vbase;
         dma_addr_t rxbd_ring_pbase;
-        struct mwifiex_pcie_buf_desc *rxbd_ring[MWIFIEX_MAX_TXRX_BD];
+        void *rxbd_ring[MWIFIEX_MAX_TXRX_BD];
         struct sk_buff *rx_buf_list[MWIFIEX_MAX_TXRX_BD];
 
         u32 evtbd_wrptr;
@@ -136,7 +257,7 @@ struct pcie_service_card {
         u32 evtbd_ring_size;
         u8 *evtbd_ring_vbase;
         dma_addr_t evtbd_ring_pbase;
-        struct mwifiex_pcie_buf_desc *evtbd_ring[MWIFIEX_MAX_EVT_BD];
+        void *evtbd_ring[MWIFIEX_MAX_EVT_BD];
         struct sk_buff *evt_buf_list[MWIFIEX_MAX_EVT_BD];
 
         struct sk_buff *cmd_buf;
@@ -150,11 +271,24 @@ struct pcie_service_card {
 static inline int
 mwifiex_pcie_txbd_empty(struct pcie_service_card *card, u32 rdptr)
 {
-        if (((card->txbd_wrptr & MWIFIEX_TXBD_MASK) ==
-                        (rdptr & MWIFIEX_TXBD_MASK)) &&
-            ((card->txbd_wrptr & MWIFIEX_BD_FLAG_ROLLOVER_IND) !=
-                        (rdptr & MWIFIEX_BD_FLAG_ROLLOVER_IND)))
-                return 1;
+        const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
+
+        switch (card->dev->device) {
+        case PCIE_DEVICE_ID_MARVELL_88W8766P:
+                if (((card->txbd_wrptr & reg->tx_mask) ==
+                     (rdptr & reg->tx_mask)) &&
+                    ((card->txbd_wrptr & reg->tx_rollover_ind) !=
+                     (rdptr & reg->tx_rollover_ind)))
+                        return 1;
+                break;
+        case PCIE_DEVICE_ID_MARVELL_88W8897:
+                if (((card->txbd_wrptr & reg->tx_mask) ==
+                     (rdptr & reg->tx_mask)) &&
+                    ((card->txbd_wrptr & reg->tx_rollover_ind) ==
+                        (rdptr & reg->tx_rollover_ind)))
+                        return 1;
+                break;
+        }
 
         return 0;
 }
@@ -162,11 +296,24 @@ mwifiex_pcie_txbd_empty(struct pcie_service_card *card, u32 rdptr)
 static inline int
 mwifiex_pcie_txbd_not_full(struct pcie_service_card *card)
 {
-        if (((card->txbd_wrptr & MWIFIEX_TXBD_MASK) !=
-             (card->txbd_rdptr & MWIFIEX_TXBD_MASK)) ||
-            ((card->txbd_wrptr & MWIFIEX_BD_FLAG_ROLLOVER_IND) !=
-             (card->txbd_rdptr & MWIFIEX_BD_FLAG_ROLLOVER_IND)))
-                return 1;
+        const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
+
+        switch (card->dev->device) {
+        case PCIE_DEVICE_ID_MARVELL_88W8766P:
+                if (((card->txbd_wrptr & reg->tx_mask) !=
+                     (card->txbd_rdptr & reg->tx_mask)) ||
+                    ((card->txbd_wrptr & reg->tx_rollover_ind) !=
+                     (card->txbd_rdptr & reg->tx_rollover_ind)))
+                        return 1;
+                break;
+        case PCIE_DEVICE_ID_MARVELL_88W8897:
+                if (((card->txbd_wrptr & reg->tx_mask) !=
+                     (card->txbd_rdptr & reg->tx_mask)) ||
+                    ((card->txbd_wrptr & reg->tx_rollover_ind) ==
+                     (card->txbd_rdptr & reg->tx_rollover_ind)))
+                        return 1;
+                break;
+        }
 
         return 0;
 }
diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
index d41f0e647280..e0cce1b52d55 100644
--- a/drivers/net/wireless/mwifiex/scan.c
+++ b/drivers/net/wireless/mwifiex/scan.c
@@ -1741,7 +1741,7 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
                                             .mac_address, ETH_ALEN))
                                         mwifiex_update_curr_bss_params(priv,
                                                                        bss);
-                                cfg80211_put_bss(bss);
+                                cfg80211_put_bss(priv->wdev->wiphy, bss);
                         }
                 } else {
                         dev_dbg(adapter->dev, "missing BSS channel IE\n");
diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c
index b8fa76a2b953..7eef74564a92 100644
--- a/drivers/net/wireless/mwifiex/sta_ioctl.c
+++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
@@ -162,13 +162,9 @@ int mwifiex_fill_new_bss_desc(struct mwifiex_private *priv,
 
         rcu_read_lock();
         ies = rcu_dereference(bss->ies);
-        if (WARN_ON(!ies)) {
-                /* should never happen */
-                rcu_read_unlock();
-                return -EINVAL;
-        }
         beacon_ie = kmemdup(ies->data, ies->len, GFP_ATOMIC);
         beacon_ie_len = ies->len;
+        bss_desc->timestamp = ies->tsf;
         rcu_read_unlock();
 
         if (!beacon_ie) {
@@ -184,7 +180,6 @@ int mwifiex_fill_new_bss_desc(struct mwifiex_private *priv,
         bss_desc->cap_info_bitmap = bss->capability;
         bss_desc->bss_band = bss_priv->band;
         bss_desc->fw_tsf = bss_priv->fw_tsf;
-        bss_desc->timestamp = bss->tsf;
         if (bss_desc->cap_info_bitmap & WLAN_CAPABILITY_PRIVACY) {
                 dev_dbg(priv->adapter->dev, "info: InterpretIE: AP WEP enabled\n");
                 bss_desc->privacy = MWIFIEX_802_11_PRIV_FILTER_8021X_WEP;
@@ -322,7 +317,7 @@ int mwifiex_bss_start(struct mwifiex_private *priv, struct cfg80211_bss *bss,
                 }
 
                 if (bss)
-                        cfg80211_put_bss(bss);
+                        cfg80211_put_bss(priv->adapter->wiphy, bss);
         } else {
                 /* Adhoc mode */
                 /* If the requested SSID matches current SSID, return */
@@ -352,7 +347,7 @@ int mwifiex_bss_start(struct mwifiex_private *priv, struct cfg80211_bss *bss,
                                                         " list. Joining...\n");
                         ret = mwifiex_adhoc_join(priv, bss_desc);
                         if (bss)
-                                cfg80211_put_bss(bss);
+                                cfg80211_put_bss(priv->adapter->wiphy, bss);
                 } else {
                         dev_dbg(adapter->dev, "info: Network not found in "
                                 "the list, creating adhoc with ssid = %s\n",
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index c86e4573798f..091d9a64080a 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -5471,6 +5471,8 @@ static DEFINE_PCI_DEVICE_TABLE(mwl8k_pci_id_table) = {
         { PCI_VDEVICE(MARVELL, 0x2a2b), .driver_data = MWL8687, },
         { PCI_VDEVICE(MARVELL, 0x2a30), .driver_data = MWL8687, },
         { PCI_VDEVICE(MARVELL, 0x2a40), .driver_data = MWL8366, },
+        { PCI_VDEVICE(MARVELL, 0x2a41), .driver_data = MWL8366, },
+        { PCI_VDEVICE(MARVELL, 0x2a42), .driver_data = MWL8366, },
         { PCI_VDEVICE(MARVELL, 0x2a43), .driver_data = MWL8366, },
         { },
 };
diff --git a/drivers/net/wireless/orinoco/scan.c b/drivers/net/wireless/orinoco/scan.c
index 96e39edfec77..e8c5714bfd11 100644
--- a/drivers/net/wireless/orinoco/scan.c
+++ b/drivers/net/wireless/orinoco/scan.c
@@ -125,7 +125,7 @@ static void orinoco_add_hostscan_result(struct orinoco_private *priv,
         cbss = cfg80211_inform_bss(wiphy, channel, bss->a.bssid, timestamp,
                                    capability, beacon_interval, ie_buf, ie_len,
                                    signal, GFP_KERNEL);
-        cfg80211_put_bss(cbss);
+        cfg80211_put_bss(wiphy, cbss);
 }
 
 void orinoco_add_extscan_result(struct orinoco_private *priv,
@@ -158,7 +158,7 @@ void orinoco_add_extscan_result(struct orinoco_private *priv,
         cbss = cfg80211_inform_bss(wiphy, channel, bss->bssid, timestamp,
                                    capability, beacon_interval, ie, ie_len,
                                    signal, GFP_KERNEL);
-        cfg80211_put_bss(cbss);
+        cfg80211_put_bss(wiphy, cbss);
 }
 
 void orinoco_add_hostscan_results(struct orinoco_private *priv,
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index 62ac60737531..b9deef66cf4b 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -84,8 +84,8 @@ static struct usb_device_id p54u_table[] = {
         {USB_DEVICE(0x06b9, 0x0121)},   /* Thomson SpeedTouch 121g */
         {USB_DEVICE(0x0707, 0xee13)},   /* SMC 2862W-G version 2 */
         {USB_DEVICE(0x0803, 0x4310)},   /* Zoom 4410a */
-        {USB_DEVICE(0x083a, 0x4503)},   /* T-Com Sinus 154 data II */
         {USB_DEVICE(0x083a, 0x4521)},   /* Siemens Gigaset USB Adapter 54 version 2 */
+        {USB_DEVICE(0x083a, 0x4531)},   /* T-Com Sinus 154 data II */
         {USB_DEVICE(0x083a, 0xc501)},   /* Zoom Wireless-G 4410 */
         {USB_DEVICE(0x083a, 0xf503)},   /* Accton FD7050E ver 1010ec  */
         {USB_DEVICE(0x0846, 0x4240)},   /* Netgear WG111 (v2) */
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index 9bb3f22b3669..525fd7521dff 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -2026,7 +2026,7 @@ static bool rndis_bss_info_update(struct usbnet *usbdev,
         bss = cfg80211_inform_bss(priv->wdev.wiphy, channel, bssid->mac,
                 timestamp, capability, beacon_interval, ie, ie_len, signal,
                 GFP_KERNEL);
-        cfg80211_put_bss(bss);
+        cfg80211_put_bss(priv->wdev.wiphy, bss);
 
         return (bss != NULL);
 }
@@ -2715,7 +2715,7 @@ static void rndis_wlan_craft_connected_bss(struct usbnet *usbdev, u8 *bssid,
         bss = cfg80211_inform_bss(priv->wdev.wiphy, channel, bssid,
                 timestamp, capability, beacon_period, ie_buf, ie_len,
                 signal, GFP_KERNEL);
-        cfg80211_put_bss(bss);
+        cfg80211_put_bss(priv->wdev.wiphy, bss);
 }
 
 /*
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.c b/drivers/net/wireless/rt2x00/rt2400pci.c
index a2d2bc2c7b3d..221beaaa83f1 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.c
+++ b/drivers/net/wireless/rt2x00/rt2400pci.c
@@ -1185,8 +1185,14 @@ static void rt2400pci_write_beacon(struct queue_entry *entry,
         rt2x00_set_field32(&reg, CSR14_BEACON_GEN, 0);
         rt2x00pci_register_write(rt2x00dev, CSR14, reg);
 
-        rt2x00queue_map_txskb(entry);
-
+        if (rt2x00queue_map_txskb(entry)) {
+                ERROR(rt2x00dev, "Fail to map beacon, aborting\n");
+                goto out;
+        }
+        /*
+         * Enable beaconing again.
+         */
+        rt2x00_set_field32(&reg, CSR14_BEACON_GEN, 1);
         /*
          * Write the TX descriptor for the beacon.
          */
@@ -1196,7 +1202,7 @@ static void rt2400pci_write_beacon(struct queue_entry *entry,
          * Dump beacon to userspace through debugfs.
          */
         rt2x00debug_dump_frame(rt2x00dev, DUMP_FRAME_BEACON, entry->skb);
-
+out:
         /*
          * Enable beaconing again.
          */
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index 9bea10f53f0a..39edc59e8d03 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -1338,7 +1338,10 @@ static void rt2500pci_write_beacon(struct queue_entry *entry,
         rt2x00_set_field32(&reg, CSR14_BEACON_GEN, 0);
         rt2x00pci_register_write(rt2x00dev, CSR14, reg);
 
-        rt2x00queue_map_txskb(entry);
+        if (rt2x00queue_map_txskb(entry)) {
+                ERROR(rt2x00dev, "Fail to map beacon, aborting\n");
+                goto out;
+        }
 
         /*
          * Write the TX descriptor for the beacon.
@@ -1349,7 +1352,7 @@ static void rt2500pci_write_beacon(struct queue_entry *entry,
          * Dump beacon to userspace through debugfs.
          */
         rt2x00debug_dump_frame(rt2x00dev, DUMP_FRAME_BEACON, entry->skb);
-
+out:
         /*
          * Enable beaconing again.
          */
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index 42b5b659af16..098613ed93fb 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -1099,9 +1099,11 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x15a9, 0x0006) },
         /* Sweex */
         { USB_DEVICE(0x177f, 0x0153) },
+        { USB_DEVICE(0x177f, 0x0164) },
         { USB_DEVICE(0x177f, 0x0302) },
         { USB_DEVICE(0x177f, 0x0313) },
         { USB_DEVICE(0x177f, 0x0323) },
+        { USB_DEVICE(0x177f, 0x0324) },
         /* U-Media */
         { USB_DEVICE(0x157e, 0x300e) },
         { USB_DEVICE(0x157e, 0x3013) },
@@ -1133,6 +1135,9 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x148f, 0x8070) },
         /* Sitecom */
         { USB_DEVICE(0x0df6, 0x0050) },
+        /* Sweex */
+        { USB_DEVICE(0x177f, 0x0163) },
+        { USB_DEVICE(0x177f, 0x0165) },
 #endif
 #ifdef CONFIG_RT2800USB_RT35XX
         /* Allwin */
@@ -1214,10 +1219,15 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x0b05, 0x1760) },
         { USB_DEVICE(0x0b05, 0x1761) },
         { USB_DEVICE(0x0b05, 0x1790) },
+        { USB_DEVICE(0x0b05, 0x17a7) },
         /* AzureWave */
         { USB_DEVICE(0x13d3, 0x3262) },
         { USB_DEVICE(0x13d3, 0x3284) },
         { USB_DEVICE(0x13d3, 0x3322) },
+        { USB_DEVICE(0x13d3, 0x3340) },
+        { USB_DEVICE(0x13d3, 0x3399) },
+        { USB_DEVICE(0x13d3, 0x3400) },
+        { USB_DEVICE(0x13d3, 0x3401) },
         /* Belkin */
         { USB_DEVICE(0x050d, 0x1003) },
         /* Buffalo */
@@ -1232,10 +1242,15 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x07d1, 0x3c0b) },
         /* Encore */
         { USB_DEVICE(0x203d, 0x14a1) },
+        /* EnGenius */
+        { USB_DEVICE(0x1740, 0x0600) },
+        { USB_DEVICE(0x1740, 0x0602) },
         /* Gemtek */
         { USB_DEVICE(0x15a9, 0x0010) },
         /* Gigabyte */
         { USB_DEVICE(0x1044, 0x800c) },
+        /* Hercules */
+        { USB_DEVICE(0x06f8, 0xe036) },
         /* Huawei */
         { USB_DEVICE(0x148f, 0xf101) },
         /* I-O DATA */
@@ -1262,11 +1277,17 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x0df6, 0x004a) },
         { USB_DEVICE(0x0df6, 0x004d) },
         { USB_DEVICE(0x0df6, 0x0053) },
+        { USB_DEVICE(0x0df6, 0x0069) },
+        { USB_DEVICE(0x0df6, 0x006f) },
         /* SMC */
         { USB_DEVICE(0x083a, 0xa512) },
         { USB_DEVICE(0x083a, 0xc522) },
         { USB_DEVICE(0x083a, 0xd522) },
         { USB_DEVICE(0x083a, 0xf511) },
+        /* Sweex */
+        { USB_DEVICE(0x177f, 0x0254) },
+        /* TP-LINK */
+        { USB_DEVICE(0xf201, 0x5370) },
 #endif
         { 0, }
 };
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index 9a3f31a543ce..086abb403a4f 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -1169,8 +1169,10 @@ static inline bool rt2x00_is_soc(struct rt2x00_dev *rt2x00dev)
 /**
  * rt2x00queue_map_txskb - Map a skb into DMA for TX purposes.
  * @entry: Pointer to &struct queue_entry
+ *
+ * Returns -ENOMEM if mapping fail, 0 otherwise.
  */
-void rt2x00queue_map_txskb(struct queue_entry *entry);
+int rt2x00queue_map_txskb(struct queue_entry *entry);
 
 /**
  * rt2x00queue_unmap_skb - Unmap a skb from DMA.
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index f35d85a71bbc..4d91795dc6a2 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -87,24 +87,35 @@ struct sk_buff *rt2x00queue_alloc_rxskb(struct queue_entry *entry, gfp_t gfp)
         skbdesc->entry = entry;
 
         if (test_bit(REQUIRE_DMA, &rt2x00dev->cap_flags)) {
-                skbdesc->skb_dma = dma_map_single(rt2x00dev->dev,
-                                                  skb->data,
-                                                  skb->len,
-                                                  DMA_FROM_DEVICE);
+                dma_addr_t skb_dma;
+
+                skb_dma = dma_map_single(rt2x00dev->dev, skb->data, skb->len,
+                                         DMA_FROM_DEVICE);
+                if (unlikely(dma_mapping_error(rt2x00dev->dev, skb_dma))) {
+                        dev_kfree_skb_any(skb);
+                        return NULL;
+                }
+
+                skbdesc->skb_dma = skb_dma;
                 skbdesc->flags |= SKBDESC_DMA_MAPPED_RX;
         }
 
         return skb;
 }
 
-void rt2x00queue_map_txskb(struct queue_entry *entry)
+int rt2x00queue_map_txskb(struct queue_entry *entry)
 {
         struct device *dev = entry->queue->rt2x00dev->dev;
         struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
 
         skbdesc->skb_dma =
             dma_map_single(dev, entry->skb->data, entry->skb->len, DMA_TO_DEVICE);
+
+        if (unlikely(dma_mapping_error(dev, skbdesc->skb_dma)))
+                return -ENOMEM;
+
         skbdesc->flags |= SKBDESC_DMA_MAPPED_TX;
+        return 0;
 }
 EXPORT_SYMBOL_GPL(rt2x00queue_map_txskb);
 
@@ -343,10 +354,7 @@ static void rt2x00queue_create_tx_descriptor_ht(struct rt2x00_dev *rt2x00dev,
                  * when using more then one tx stream (>MCS7).
                  */
                 if (sta && txdesc->u.ht.mcs > 7 &&
-                    ((sta->ht_cap.cap &
-                      IEEE80211_HT_CAP_SM_PS) >>
-                     IEEE80211_HT_CAP_SM_PS_SHIFT) ==
-                    WLAN_HT_CAP_SM_PS_DYNAMIC)
+                    sta->smps_mode == IEEE80211_SMPS_DYNAMIC)
                         __set_bit(ENTRY_TXD_HT_MIMO_PS, &txdesc->flags);
         } else {
                 txdesc->u.ht.mcs = rt2x00_get_rate_mcs(hwrate->mcs);
@@ -545,8 +553,9 @@ static int rt2x00queue_write_tx_data(struct queue_entry *entry,
         /*
          * Map the skb to DMA.
          */
-        if (test_bit(REQUIRE_DMA, &rt2x00dev->cap_flags))
-                rt2x00queue_map_txskb(entry);
+        if (test_bit(REQUIRE_DMA, &rt2x00dev->cap_flags) &&
+            rt2x00queue_map_txskb(entry))
+                return -ENOMEM;
 
         return 0;
 }
diff --git a/drivers/net/wireless/rtlwifi/Kconfig b/drivers/net/wireless/rtlwifi/Kconfig
index b80bc4612581..b6aa0c40658f 100644
--- a/drivers/net/wireless/rtlwifi/Kconfig
+++ b/drivers/net/wireless/rtlwifi/Kconfig
@@ -1,8 +1,26 @@
+config RTLWIFI
+        tristate "Realtek wireless card support"
+        depends on MAC80211
+        select FW_LOADER
+        ---help---
+          This is common code for RTL8192CE/RTL8192CU/RTL8192SE/RTL8723AE
+          drivers.  This module does nothing by itself - the various front-end
+          drivers need to be enabled to support any desired devices.
+
+          If you choose to build as a module, it'll be called rtlwifi.
+
+config RTLWIFI_DEBUG
+        bool "Debugging output for rtlwifi driver family"
+        depends on RTLWIFI
+        default y
+        ---help---
+        To use the module option that sets the dynamic-debugging level for,
+        the front-end driver, this parameter must be "Y". For memory-limited
+        systems, choose "N". If in doubt, choose "Y".
+
 config RTL8192CE
         tristate "Realtek RTL8192CE/RTL8188CE Wireless Network Adapter"
-        depends on MAC80211 && PCI
-        select FW_LOADER
-        select RTLWIFI
+        depends on RTLWIFI && PCI
         select RTL8192C_COMMON
         ---help---
         This is the driver for Realtek RTL8192CE/RTL8188CE 802.11n PCIe
@@ -12,9 +30,7 @@ config RTL8192CE
 
 config RTL8192SE
         tristate "Realtek RTL8192SE/RTL8191SE PCIe Wireless Network Adapter"
-        depends on MAC80211 && PCI
-        select FW_LOADER
-        select RTLWIFI
+        depends on RTLWIFI && PCI
         ---help---
         This is the driver for Realtek RTL8192SE/RTL8191SE 802.11n PCIe
         wireless network adapters.
@@ -23,9 +39,7 @@ config RTL8192SE
 
 config RTL8192DE
         tristate "Realtek RTL8192DE/RTL8188DE PCIe Wireless Network Adapter"
-        depends on MAC80211 && PCI
-        select FW_LOADER
-        select RTLWIFI
+        depends on RTLWIFI && PCI
         ---help---
         This is the driver for Realtek RTL8192DE/RTL8188DE 802.11n PCIe
         wireless network adapters.
@@ -34,9 +48,7 @@ config RTL8192DE
 
 config RTL8723AE
         tristate "Realtek RTL8723AE PCIe Wireless Network Adapter"
-        depends on MAC80211 && PCI && EXPERIMENTAL
-        select FW_LOADER
-        select RTLWIFI
+        depends on RTLWIFI && PCI
         ---help---
         This is the driver for Realtek RTL8723AE 802.11n PCIe
         wireless network adapters.
@@ -45,9 +57,7 @@ config RTL8723AE
 
 config RTL8192CU
         tristate "Realtek RTL8192CU/RTL8188CU USB Wireless Network Adapter"
-        depends on MAC80211 && USB
-        select FW_LOADER
-        select RTLWIFI
+        depends on RTLWIFI && USB
         select RTL8192C_COMMON
         ---help---
         This is the driver for Realtek RTL8192CU/RTL8188CU 802.11n USB
@@ -55,16 +65,6 @@ config RTL8192CU
 
         If you choose to build it as a module, it will be called rtl8192cu
 
-config RTLWIFI
-        tristate
-        depends on RTL8192CE || RTL8192CU || RTL8192SE || RTL8192DE || RTL8723AE
-        default m
-
-config RTLWIFI_DEBUG
-        bool "Additional debugging output"
-        depends on RTL8192CE || RTL8192CU || RTL8192SE || RTL8192DE || RTL8723AE
-        default y
-
 config RTL8192C_COMMON
         tristate
         depends on RTL8192CE || RTL8192CU
diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
index 0f8b05185eda..99c5cea3fe21 100644
--- a/drivers/net/wireless/rtlwifi/base.c
+++ b/drivers/net/wireless/rtlwifi/base.c
@@ -523,8 +523,8 @@ static void _rtl_query_shortgi(struct ieee80211_hw *hw,
         if (mac->opmode == NL80211_IFTYPE_STATION)
                 bw_40 = mac->bw_40;
         else if (mac->opmode == NL80211_IFTYPE_AP ||
-                mac->opmode == NL80211_IFTYPE_ADHOC)
-                bw_40 = sta->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+                 mac->opmode == NL80211_IFTYPE_ADHOC)
+                bw_40 = sta->bandwidth >= IEEE80211_STA_RX_BW_40;
 
         if (bw_40 && sgi_40)
                 tcb_desc->use_shortgi = true;
@@ -634,8 +634,7 @@ static void _rtl_query_bandwidth_mode(struct ieee80211_hw *hw,
                 return;
         if (mac->opmode == NL80211_IFTYPE_AP ||
             mac->opmode == NL80211_IFTYPE_ADHOC) {
-                if (!(sta->ht_cap.ht_supported) ||
-                    !(sta->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40))
+                if (sta->bandwidth == IEEE80211_STA_RX_BW_20)
                         return;
         } else if (mac->opmode == NL80211_IFTYPE_STATION) {
                 if (!mac->bw_40 || !(sta->ht_cap.ht_supported))
diff --git a/drivers/net/wireless/rtlwifi/rc.c b/drivers/net/wireless/rtlwifi/rc.c
index 204f46c4510d..f9f059dadb73 100644
--- a/drivers/net/wireless/rtlwifi/rc.c
+++ b/drivers/net/wireless/rtlwifi/rc.c
@@ -116,9 +116,8 @@ static void _rtl_rc_rate_set_series(struct rtl_priv *rtlpriv,
                 if (txrc->short_preamble)
                         rate->flags |= IEEE80211_TX_RC_USE_SHORT_PREAMBLE;
                 if (mac->opmode == NL80211_IFTYPE_AP ||
-                        mac->opmode == NL80211_IFTYPE_ADHOC) {
-                        if (sta && (sta->ht_cap.cap &
-                            IEEE80211_HT_CAP_SUP_WIDTH_20_40))
+                    mac->opmode == NL80211_IFTYPE_ADHOC) {
+                        if (sta && (sta->bandwidth >= IEEE80211_STA_RX_BW_40))
                                 rate->flags |= IEEE80211_TX_RC_40_MHZ_WIDTH;
                 } else {
                         if (mac->bw_40)
@@ -217,6 +216,12 @@ static void rtl_tx_status(void *ppriv,
         }
 }
 
+static void rtl_rate_init(void *ppriv,
+                          struct ieee80211_supported_band *sband,
+                          struct ieee80211_sta *sta, void *priv_sta)
+{
+}
+
 static void *rtl_rate_alloc(struct ieee80211_hw *hw,
                 struct dentry *debugfsdir)
 {
@@ -261,6 +266,7 @@ static struct rate_control_ops rtl_rate_ops = {
         .free = rtl_rate_free,
         .alloc_sta = rtl_rate_alloc_sta,
         .free_sta = rtl_rate_free_sta,
+        .rate_init = rtl_rate_init,
         .tx_status = rtl_tx_status,
         .get_rate = rtl_get_rate,
 };
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
index d1f34f6ffbdf..1b65db7fd651 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
@@ -1846,9 +1846,9 @@ static void rtl92ce_update_hal_rate_mask(struct ieee80211_hw *hw,
         struct rtl_sta_info *sta_entry = NULL;
         u32 ratr_bitmap;
         u8 ratr_index;
-        u8 curtxbw_40mhz = (sta->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40)
-                                ? 1 : 0;
-        u8 curshortgi_40mhz = (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40) ?
+        u8 curtxbw_40mhz = (sta->bandwidth >= IEEE80211_STA_RX_BW_40) ? 1 : 0;
+        u8 curshortgi_40mhz = curtxbw_40mhz &&
+                              (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40) ?
                                 1 : 0;
         u8 curshortgi_20mhz = (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20) ?
                                 1 : 0;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c b/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
index c31795e379f7..b9b1a6e0b16e 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
@@ -488,7 +488,7 @@ static void _rtl92ce_translate_rx_signal_stuff(struct ieee80211_hw *hw,
         u8 *praddr;
         __le16 fc;
         u16 type, c_fc;
-        bool packet_matchbssid, packet_toself, packet_beacon;
+        bool packet_matchbssid, packet_toself, packet_beacon = false;
 
         tmp_buf = skb->data + pstats->rx_drvinfo_size + pstats->rx_bufshift;
 
@@ -626,8 +626,7 @@ void rtl92ce_tx_fill_desc(struct ieee80211_hw *hw,
         } else if (mac->opmode == NL80211_IFTYPE_AP ||
                 mac->opmode == NL80211_IFTYPE_ADHOC) {
                 if (sta)
-                        bw_40 = sta->ht_cap.cap &
-                                IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+                        bw_40 = sta->bandwidth >= IEEE80211_STA_RX_BW_40;
         }
 
         seq_number = (le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_SEQ) >> 4;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c b/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c
index 32ff959a0251..85b6bdb163c0 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c
@@ -1084,7 +1084,7 @@ void rtl92c_translate_rx_signal_stuff(struct ieee80211_hw *hw,
         u8 *praddr;
         __le16 fc;
         u16 type, cpu_fc;
-        bool packet_matchbssid, packet_toself, packet_beacon;
+        bool packet_matchbssid, packet_toself, packet_beacon = false;
 
         tmp_buf = skb->data + pstats->rx_drvinfo_size + pstats->rx_bufshift;
         hdr = (struct ieee80211_hdr *)tmp_buf;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
index d9e659f92767..a73a17bc56dd 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
@@ -285,6 +285,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
         {RTL_USB_DEVICE(USB_VENDER_ID_REALTEK, 0x817f, rtl92cu_hal_cfg)},
         /* RTL8188CUS-VL */
         {RTL_USB_DEVICE(USB_VENDER_ID_REALTEK, 0x818a, rtl92cu_hal_cfg)},
+        {RTL_USB_DEVICE(USB_VENDER_ID_REALTEK, 0x819a, rtl92cu_hal_cfg)},
         /* 8188 Combo for BC4 */
         {RTL_USB_DEVICE(USB_VENDER_ID_REALTEK, 0x8754, rtl92cu_hal_cfg)},
 
@@ -363,9 +364,15 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
 
 MODULE_DEVICE_TABLE(usb, rtl8192c_usb_ids);
 
+static int rtl8192cu_probe(struct usb_interface *intf,
+                           const struct usb_device_id *id)
+{
+        return rtl_usb_probe(intf, id, &rtl92cu_hal_cfg);
+}
+
 static struct usb_driver rtl8192cu_driver = {
         .name = "rtl8192cu",
-        .probe = rtl_usb_probe,
+        .probe = rtl8192cu_probe,
         .disconnect = rtl_usb_disconnect,
         .id_table = rtl8192c_usb_ids,
 
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/hw.c b/drivers/net/wireless/rtlwifi/rtl8192de/hw.c
index f4051f4f0390..aa5b42521bb4 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/hw.c
@@ -1970,8 +1970,7 @@ static void rtl92de_update_hal_rate_mask(struct ieee80211_hw *hw,
         struct rtl_sta_info *sta_entry = NULL;
         u32 ratr_bitmap;
         u8 ratr_index;
-        u8 curtxbw_40mhz = (sta->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40)
-                                                        ? 1 : 0;
+        u8 curtxbw_40mhz = (sta->bandwidth >= IEEE80211_STA_RX_BW_40) ? 1 : 0;
         u8 curshortgi_40mhz = (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40) ?
                                                         1 : 0;
         u8 curshortgi_20mhz = (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20) ?
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/trx.c b/drivers/net/wireless/rtlwifi/rtl8192de/trx.c
index cdb570ffb4b5..941080e03c06 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/trx.c
@@ -574,8 +574,7 @@ void rtl92de_tx_fill_desc(struct ieee80211_hw *hw,
         } else if (mac->opmode == NL80211_IFTYPE_AP ||
                 mac->opmode == NL80211_IFTYPE_ADHOC) {
                 if (sta)
-                        bw_40 = sta->ht_cap.cap &
-                                IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+                        bw_40 = sta->bandwidth >= IEEE80211_STA_RX_BW_40;
         }
         seq_number = (le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_SEQ) >> 4;
         rtl_get_tcb_desc(hw, info, sta, skb, ptcb_desc);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/hw.c b/drivers/net/wireless/rtlwifi/rtl8192se/hw.c
index 28526a7361f5..084e7773bce2 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/hw.c
@@ -2085,8 +2085,7 @@ static void rtl92se_update_hal_rate_mask(struct ieee80211_hw *hw,
         struct rtl_sta_info *sta_entry = NULL;
         u32 ratr_bitmap;
         u8 ratr_index = 0;
-        u8 curtxbw_40mhz = (sta->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40)
-                                ? 1 : 0;
+        u8 curtxbw_40mhz = (sta->bandwidth >= IEEE80211_STA_RX_BW_40) ? 1 : 0;
         u8 curshortgi_40mhz = (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40) ?
                                 1 : 0;
         u8 curshortgi_20mhz = (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20) ?
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
index f8431a3c2c9d..7b0a2e75b8b8 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
@@ -621,8 +621,7 @@ void rtl92se_tx_fill_desc(struct ieee80211_hw *hw,
         } else if (mac->opmode == NL80211_IFTYPE_AP ||
                 mac->opmode == NL80211_IFTYPE_ADHOC) {
                 if (sta)
-                        bw_40 = sta->ht_cap.cap &
-                                    IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+                        bw_40 = sta->bandwidth >= IEEE80211_STA_RX_BW_40;
         }
 
         seq_number = (le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_SEQ) >> 4;
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c b/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c
index 149804816ac4..9a0c71c2e15e 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c
@@ -1866,8 +1866,7 @@ static void rtl8723ae_update_hal_rate_mask(struct ieee80211_hw *hw,
         struct rtl_sta_info *sta_entry = NULL;
         u32 ratr_bitmap;
         u8 ratr_index;
-        u8 curtxbw_40mhz = (sta->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40)
-                                ? 1 : 0;
+        u8 curtxbw_40mhz = (sta->bandwidth >= IEEE80211_STA_RX_BW_40) ? 1 : 0;
         u8 curshortgi_40mhz = (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40) ?
                                 1 : 0;
         u8 curshortgi_20mhz = (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20) ?
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/trx.c b/drivers/net/wireless/rtlwifi/rtl8723ae/trx.c
index b1fd2b328abf..ac081297db50 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/trx.c
@@ -395,8 +395,7 @@ void rtl8723ae_tx_fill_desc(struct ieee80211_hw *hw,
         } else if (mac->opmode == NL80211_IFTYPE_AP ||
                 mac->opmode == NL80211_IFTYPE_ADHOC) {
                 if (sta)
-                        bw_40 = sta->ht_cap.cap &
-                                IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+                        bw_40 = sta->bandwidth >= IEEE80211_STA_RX_BW_40;
         }
 
         seq_number = (le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_SEQ) >> 4;
diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
index d42bbe21ba6e..476eaef5e4a9 100644
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -937,7 +937,8 @@ static struct rtl_intf_ops rtl_usb_ops = {
 };
 
 int rtl_usb_probe(struct usb_interface *intf,
-                        const struct usb_device_id *id)
+                  const struct usb_device_id *id,
+                  struct rtl_hal_cfg *rtl_hal_cfg)
 {
         int err;
         struct ieee80211_hw *hw = NULL;
@@ -972,7 +973,7 @@ int rtl_usb_probe(struct usb_interface *intf,
         usb_set_intfdata(intf, hw);
         /* init cfg & intf_ops */
         rtlpriv->rtlhal.interface = INTF_USB;
-        rtlpriv->cfg = (struct rtl_hal_cfg *)(id->driver_info);
+        rtlpriv->cfg = rtl_hal_cfg;
         rtlpriv->intf_ops = &rtl_usb_ops;
         rtl_dbgp_flag_init(hw);
         /* Init IO handler */
diff --git a/drivers/net/wireless/rtlwifi/usb.h b/drivers/net/wireless/rtlwifi/usb.h
index 5235136f6dd2..fb986f98d1df 100644
--- a/drivers/net/wireless/rtlwifi/usb.h
+++ b/drivers/net/wireless/rtlwifi/usb.h
@@ -157,7 +157,8 @@ struct rtl_usb_priv {
 
 
 int rtl_usb_probe(struct usb_interface *intf,
-                            const struct usb_device_id *id);
+                  const struct usb_device_id *id,
+                  struct rtl_hal_cfg *rtl92cu_hal_cfg);
 void rtl_usb_disconnect(struct usb_interface *intf);
 int rtl_usb_suspend(struct usb_interface *pusb_intf, pm_message_t message);
 int rtl_usb_resume(struct usb_interface *pusb_intf);
diff --git a/drivers/net/wireless/ti/Kconfig b/drivers/net/wireless/ti/Kconfig
index be800119d0a3..cbe1e7fef61b 100644
--- a/drivers/net/wireless/ti/Kconfig
+++ b/drivers/net/wireless/ti/Kconfig
@@ -12,4 +12,13 @@ source "drivers/net/wireless/ti/wl18xx/Kconfig"
 
 # keep last for automatic dependencies
 source "drivers/net/wireless/ti/wlcore/Kconfig"
+
+config WILINK_PLATFORM_DATA
+        bool "TI WiLink platform data"
+        depends on WLCORE_SDIO || WL1251_SDIO
+        default y
+        ---help---
+        Small platform data bit needed to pass data to the sdio modules.
+
+
 endif # WL_TI
diff --git a/drivers/net/wireless/ti/Makefile b/drivers/net/wireless/ti/Makefile
index 4d6823983c04..af14231aeede 100644
--- a/drivers/net/wireless/ti/Makefile
+++ b/drivers/net/wireless/ti/Makefile
@@ -1,5 +1,7 @@
 obj-$(CONFIG_WLCORE)                    += wlcore/
 obj-$(CONFIG_WL12XX)                    += wl12xx/
-obj-$(CONFIG_WL12XX_PLATFORM_DATA)      += wlcore/
 obj-$(CONFIG_WL1251)                    += wl1251/
 obj-$(CONFIG_WL18XX)                    += wl18xx/
+
+# small builtin driver bit
+obj-$(CONFIG_WILINK_PLATFORM_DATA)      += wilink_platform_data.o
diff --git a/drivers/net/wireless/ti/wlcore/wl12xx_platform_data.c b/drivers/net/wireless/ti/wilink_platform_data.c
index 998e95895f9d..998e95895f9d 100644
--- a/drivers/net/wireless/ti/wlcore/wl12xx_platform_data.c
+++ b/drivers/net/wireless/ti/wilink_platform_data.c
diff --git a/drivers/net/wireless/ti/wl1251/event.c b/drivers/net/wireless/ti/wl1251/event.c
index 5ec50a476a69..74ae8e1c2e33 100644
--- a/drivers/net/wireless/ti/wl1251/event.c
+++ b/drivers/net/wireless/ti/wl1251/event.c
@@ -29,6 +29,8 @@
 static int wl1251_event_scan_complete(struct wl1251 *wl,
                                       struct event_mailbox *mbox)
 {
+        int ret = 0;
+
         wl1251_debug(DEBUG_EVENT, "status: 0x%x, channels: %d",
                      mbox->scheduled_scan_status,
                      mbox->scheduled_scan_channels);
@@ -37,9 +39,11 @@ static int wl1251_event_scan_complete(struct wl1251 *wl,
                 ieee80211_scan_completed(wl->hw, false);
                 wl1251_debug(DEBUG_MAC80211, "mac80211 hw scan completed");
                 wl->scanning = false;
+                if (wl->hw->conf.flags & IEEE80211_CONF_IDLE)
+                        ret = wl1251_ps_set_mode(wl, STATION_IDLE);
         }
 
-        return 0;
+        return ret;
 }
 
 static void wl1251_event_mbox_dump(struct event_mailbox *mbox)
diff --git a/drivers/net/wireless/ti/wl1251/main.c b/drivers/net/wireless/ti/wl1251/main.c
index f47e8b0482ad..bbbf68cf50a7 100644
--- a/drivers/net/wireless/ti/wl1251/main.c
+++ b/drivers/net/wireless/ti/wl1251/main.c
@@ -623,7 +623,7 @@ static int wl1251_op_config(struct ieee80211_hw *hw, u32 changed)
                 }
         }
 
-        if (changed & IEEE80211_CONF_CHANGE_IDLE) {
+        if (changed & IEEE80211_CONF_CHANGE_IDLE && !wl->scanning) {
                 if (conf->flags & IEEE80211_CONF_IDLE) {
                         ret = wl1251_ps_set_mode(wl, STATION_IDLE);
                         if (ret < 0)
@@ -895,11 +895,21 @@ static int wl1251_op_hw_scan(struct ieee80211_hw *hw,
         if (ret < 0)
                 goto out;
 
+        if (hw->conf.flags & IEEE80211_CONF_IDLE) {
+                ret = wl1251_ps_set_mode(wl, STATION_ACTIVE_MODE);
+                if (ret < 0)
+                        goto out_sleep;
+                ret = wl1251_join(wl, wl->bss_type, wl->channel,
+                                  wl->beacon_int, wl->dtim_period);
+                if (ret < 0)
+                        goto out_sleep;
+        }
+
         skb = ieee80211_probereq_get(wl->hw, wl->vif, ssid, ssid_len,
                                      req->ie_len);
         if (!skb) {
                 ret = -ENOMEM;
-                goto out;
+                goto out_idle;
         }
         if (req->ie_len)
                 memcpy(skb_put(skb, req->ie_len), req->ie, req->ie_len);
@@ -908,11 +918,11 @@ static int wl1251_op_hw_scan(struct ieee80211_hw *hw,
                                       skb->len);
         dev_kfree_skb(skb);
         if (ret < 0)
-                goto out_sleep;
+                goto out_idle;
 
         ret = wl1251_cmd_trigger_scan_to(wl, 0);
         if (ret < 0)
-                goto out_sleep;
+                goto out_idle;
 
         wl->scanning = true;
 
@@ -920,9 +930,13 @@ static int wl1251_op_hw_scan(struct ieee80211_hw *hw,
                               req->n_channels, WL1251_SCAN_NUM_PROBES);
         if (ret < 0) {
                 wl->scanning = false;
-                goto out_sleep;
+                goto out_idle;
         }
+        goto out_sleep;
 
+out_idle:
+        if (hw->conf.flags & IEEE80211_CONF_IDLE)
+                ret = wl1251_ps_set_mode(wl, STATION_IDLE);
 out_sleep:
         wl1251_ps_elp_sleep(wl);
 
diff --git a/drivers/net/wireless/ti/wl12xx/main.c b/drivers/net/wireless/ti/wl12xx/main.c
index 3254bfc81a2a..09694e39bb14 100644
--- a/drivers/net/wireless/ti/wl12xx/main.c
+++ b/drivers/net/wireless/ti/wl12xx/main.c
@@ -1703,7 +1703,8 @@ static struct ieee80211_sta_ht_cap wl12xx_ht_cap = {
 static int wl12xx_setup(struct wl1271 *wl)
 {
         struct wl12xx_priv *priv = wl->priv;
-        struct wl12xx_platform_data *pdata = wl->pdev->dev.platform_data;
+        struct wlcore_platdev_data *pdev_data = wl->pdev->dev.platform_data;
+        struct wl12xx_platform_data *pdata = pdev_data->pdata;
 
         wl->rtable = wl12xx_rtable;
         wl->num_tx_desc = WL12XX_NUM_TX_DESCRIPTORS;
diff --git a/drivers/net/wireless/ti/wl18xx/conf.h b/drivers/net/wireless/ti/wl18xx/conf.h
index b5f114857191..e34302e3b51d 100644
--- a/drivers/net/wireless/ti/wl18xx/conf.h
+++ b/drivers/net/wireless/ti/wl18xx/conf.h
@@ -23,7 +23,7 @@
 #define __WL18XX_CONF_H__
 
 #define WL18XX_CONF_MAGIC       0x10e100ca
-#define WL18XX_CONF_VERSION     (WLCORE_CONF_VERSION | 0x0005)
+#define WL18XX_CONF_VERSION     (WLCORE_CONF_VERSION | 0x0006)
 #define WL18XX_CONF_MASK        0x0000ffff
 #define WL18XX_CONF_SIZE        (WLCORE_CONF_SIZE + \
                                  sizeof(struct wl18xx_priv_conf))
@@ -70,8 +70,9 @@ struct wl18xx_mac_and_phy_params {
         u8 pwr_limit_reference_11_abg;
         u8 per_chan_pwr_limit_arr_11p[NUM_OF_CHANNELS_11_P];
         u8 pwr_limit_reference_11p;
-        u8 spare1[9];
-        u8 spare2[9];
+        u8 spare1;
+        u8 per_chan_bo_mode_11_abg[13];
+        u8 per_chan_bo_mode_11_p[4];
         u8 primary_clock_setting_time;
         u8 clock_valid_on_wake_up;
         u8 secondary_clock_setting_time;
diff --git a/drivers/net/wireless/ti/wl18xx/main.c b/drivers/net/wireless/ti/wl18xx/main.c
index 0be1cfc17a86..da3ef1b10a9c 100644
--- a/drivers/net/wireless/ti/wl18xx/main.c
+++ b/drivers/net/wireless/ti/wl18xx/main.c
@@ -547,6 +547,11 @@ static struct wl18xx_priv_conf wl18xx_default_priv_conf = {
                         0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
                         0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
                 .pwr_limit_reference_11p        = 0x64,
+                .per_chan_bo_mode_11_abg        = { 0x00, 0x00, 0x00, 0x00,
+                                                    0x00, 0x00, 0x00, 0x00,
+                                                    0x00, 0x00, 0x00, 0x00,
+                                                    0x00 },
+                .per_chan_bo_mode_11_p          = { 0x00, 0x00, 0x00, 0x00 },
                 .per_chan_pwr_limit_arr_11p     = { 0xff, 0xff, 0xff, 0xff,
                                                     0xff, 0xff, 0xff },
                 .psat                           = 0,
@@ -1369,7 +1374,7 @@ static void wl18xx_sta_rc_update(struct wl1271 *wl,
                                  struct ieee80211_sta *sta,
                                  u32 changed)
 {
-        bool wide = sta->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+        bool wide = sta->bandwidth >= IEEE80211_STA_RX_BW_40;
 
         wl1271_debug(DEBUG_MAC80211, "mac80211 sta_rc_update wide %d", wide);
 
diff --git a/drivers/net/wireless/ti/wlcore/Kconfig b/drivers/net/wireless/ti/wlcore/Kconfig
index d7b907e67170..2b832825c3d4 100644
--- a/drivers/net/wireless/ti/wlcore/Kconfig
+++ b/drivers/net/wireless/ti/wlcore/Kconfig
@@ -33,8 +33,3 @@ config WLCORE_SDIO
 
           If you choose to build a module, it'll be called wlcore_sdio.
           Say N if unsure.
-
-config WL12XX_PLATFORM_DATA
-        bool
-        depends on WLCORE_SDIO != n || WL1251_SDIO != n
-        default y
diff --git a/drivers/net/wireless/ti/wlcore/Makefile b/drivers/net/wireless/ti/wlcore/Makefile
index d9fba9e32130..b21398f6c3ec 100644
--- a/drivers/net/wireless/ti/wlcore/Makefile
+++ b/drivers/net/wireless/ti/wlcore/Makefile
@@ -9,7 +9,4 @@ obj-$(CONFIG_WLCORE)			+= wlcore.o
 obj-$(CONFIG_WLCORE_SPI)                += wlcore_spi.o
 obj-$(CONFIG_WLCORE_SDIO)               += wlcore_sdio.o
 
-# small builtin driver bit
-obj-$(CONFIG_WL12XX_PLATFORM_DATA)      += wl12xx_platform_data.o
-
 ccflags-y += -D__CHECK_ENDIAN__
diff --git a/drivers/net/wireless/ti/wlcore/boot.c b/drivers/net/wireless/ti/wlcore/boot.c
index b58ae5fc1487..77752b03f189 100644
--- a/drivers/net/wireless/ti/wlcore/boot.c
+++ b/drivers/net/wireless/ti/wlcore/boot.c
@@ -84,8 +84,8 @@ out:
 static int wlcore_validate_fw_ver(struct wl1271 *wl)
 {
         unsigned int *fw_ver = wl->chip.fw_ver;
-        unsigned int *min_ver = (wl->fw_type == WL12XX_FW_TYPE_NORMAL) ?
-                wl->min_sr_fw_ver : wl->min_mr_fw_ver;
+        unsigned int *min_ver = (wl->fw_type == WL12XX_FW_TYPE_MULTI) ?
+                wl->min_mr_fw_ver : wl->min_sr_fw_ver;
         char min_fw_str[32] = "";
         int i;
 
diff --git a/drivers/net/wireless/ti/wlcore/cmd.c b/drivers/net/wireless/ti/wlcore/cmd.c
index 1201aca9c89a..6331f9e1cb39 100644
--- a/drivers/net/wireless/ti/wlcore/cmd.c
+++ b/drivers/net/wireless/ti/wlcore/cmd.c
@@ -510,10 +510,12 @@ int wl12xx_cmd_role_start_sta(struct wl1271 *wl, struct wl12xx_vif *wlvif)
         cmd->sta.hlid = wlvif->sta.hlid;
         cmd->sta.session = wl->session_ids[wlvif->sta.hlid];
         /*
-         * We don't have the correct remote rates in this stage. the rates
-         * will be reconfigured later, after authorization.
+         * We don't have the correct remote rates in this stage.  The
+         * rates will be reconfigured later, after association, if the
+         * firmware supports ACX_PEER_CAP.  Otherwise, there's nothing
+         * we can do, so use all supported_rates here.
          */
-        cmd->sta.remote_rates = cpu_to_le32(wlvif->rate_set);
+        cmd->sta.remote_rates = cpu_to_le32(supported_rates);
 
         wl1271_debug(DEBUG_CMD, "role start: roleid=%d, hlid=%d, session=%d "
                      "basic_rate_set: 0x%x, remote_rates: 0x%x",
diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
index e1dfdf94d0f7..2c2ff3e1f849 100644
--- a/drivers/net/wireless/ti/wlcore/main.c
+++ b/drivers/net/wireless/ti/wlcore/main.c
@@ -2162,7 +2162,7 @@ static int wl12xx_init_vif_data(struct wl1271 *wl, struct ieee80211_vif *vif)
         return 0;
 }
 
-static bool wl12xx_init_fw(struct wl1271 *wl)
+static int wl12xx_init_fw(struct wl1271 *wl)
 {
         int retries = WL1271_BOOT_RETRIES;
         bool booted = false;
@@ -2228,7 +2228,7 @@ power_off:
 
         wl->state = WLCORE_STATE_ON;
 out:
-        return booted;
+        return ret;
 }
 
 static bool wl12xx_dev_role_started(struct wl12xx_vif *wlvif)
@@ -2371,7 +2371,6 @@ static int wl1271_op_add_interface(struct ieee80211_hw *hw,
         struct vif_counter_data vif_count;
         int ret = 0;
         u8 role_type;
-        bool booted = false;
 
         vif->driver_flags |= IEEE80211_VIF_BEACON_FILTER |
                              IEEE80211_VIF_SUPPORTS_CQM_RSSI;
@@ -2432,11 +2431,9 @@ static int wl1271_op_add_interface(struct ieee80211_hw *hw,
                  */
                 memcpy(wl->addresses[0].addr, vif->addr, ETH_ALEN);
 
-                booted = wl12xx_init_fw(wl);
-                if (!booted) {
-                        ret = -EINVAL;
+                ret = wl12xx_init_fw(wl);
+                if (ret < 0)
                         goto out;
-                }
         }
 
         ret = wl12xx_cmd_role_enable(wl, vif->addr,
@@ -5639,7 +5636,6 @@ static int wl1271_init_ieee80211(struct wl1271 *wl)
                 IEEE80211_HW_AP_LINK_PS |
                 IEEE80211_HW_AMPDU_AGGREGATION |
                 IEEE80211_HW_TX_AMPDU_SETUP_IN_HW |
-                IEEE80211_HW_SCAN_WHILE_IDLE |
                 IEEE80211_HW_QUEUE_CONTROL;
 
         wl->hw->wiphy->cipher_suites = cipher_suites;
@@ -5966,7 +5962,8 @@ static void wlcore_nvs_cb(const struct firmware *fw, void *context)
 {
         struct wl1271 *wl = context;
         struct platform_device *pdev = wl->pdev;
-        struct wl12xx_platform_data *pdata = pdev->dev.platform_data;
+        struct wlcore_platdev_data *pdev_data = pdev->dev.platform_data;
+        struct wl12xx_platform_data *pdata = pdev_data->pdata;
         unsigned long irqflags;
         int ret;
 
@@ -5995,8 +5992,7 @@ static void wlcore_nvs_cb(const struct firmware *fw, void *context)
 
         wl->irq = platform_get_irq(pdev, 0);
         wl->platform_quirks = pdata->platform_quirks;
-        wl->set_power = pdata->set_power;
-        wl->if_ops = pdata->ops;
+        wl->if_ops = pdev_data->if_ops;
 
         if (wl->platform_quirks & WL12XX_PLATFORM_QUIRK_EDGE_IRQ)
                 irqflags = IRQF_TRIGGER_RISING;
diff --git a/drivers/net/wireless/ti/wlcore/sdio.c b/drivers/net/wireless/ti/wlcore/sdio.c
index 75622f6f3e6c..29ef2492951f 100644
--- a/drivers/net/wireless/ti/wlcore/sdio.c
+++ b/drivers/net/wireless/ti/wlcore/sdio.c
@@ -217,7 +217,7 @@ static struct wl1271_if_operations sdio_ops = {
 static int wl1271_probe(struct sdio_func *func,
                                   const struct sdio_device_id *id)
 {
-        struct wl12xx_platform_data *wlan_data;
+        struct wlcore_platdev_data *pdev_data;
         struct wl12xx_sdio_glue *glue;
         struct resource res[1];
         mmc_pm_flag_t mmcflags;
@@ -228,10 +228,18 @@ static int wl1271_probe(struct sdio_func *func,
         if (func->num != 0x02)
                 return -ENODEV;
 
-        glue = kzalloc(sizeof(*glue), GFP_KERNEL);
-        if (!glue)
+        pdev_data = kzalloc(sizeof(*pdev_data), GFP_KERNEL);
+        if (!pdev_data)
                 goto out;
 
+        pdev_data->if_ops = &sdio_ops;
+
+        glue = kzalloc(sizeof(*glue), GFP_KERNEL);
+        if (!glue) {
+                dev_err(&func->dev, "can't allocate glue\n");
+                goto out_free_pdev_data;
+        }
+
         glue->dev = &func->dev;
 
         /* Grab access to FN0 for ELP reg. */
@@ -240,9 +248,9 @@ static int wl1271_probe(struct sdio_func *func,
         /* Use block mode for transferring over one block size of data */
         func->card->quirks |= MMC_QUIRK_BLKSZ_FOR_BYTE_MODE;
 
-        wlan_data = wl12xx_get_platform_data();
-        if (IS_ERR(wlan_data)) {
-                ret = PTR_ERR(wlan_data);
+        pdev_data->pdata = wl12xx_get_platform_data();
+        if (IS_ERR(pdev_data->pdata)) {
+                ret = PTR_ERR(pdev_data->pdata);
                 dev_err(glue->dev, "missing wlan platform data: %d\n", ret);
                 goto out_free_glue;
         }
@@ -252,9 +260,7 @@ static int wl1271_probe(struct sdio_func *func,
         dev_dbg(glue->dev, "sdio PM caps = 0x%x\n", mmcflags);
 
         if (mmcflags & MMC_PM_KEEP_POWER)
-                wlan_data->pwr_in_suspend = true;
-
-        wlan_data->ops = &sdio_ops;
+                pdev_data->pdata->pwr_in_suspend = true;
 
         sdio_set_drvdata(func, glue);
 
@@ -272,7 +278,7 @@ static int wl1271_probe(struct sdio_func *func,
         else
                 chip_family = "wl12xx";
 
-        glue->core = platform_device_alloc(chip_family, -1);
+        glue->core = platform_device_alloc(chip_family, PLATFORM_DEVID_AUTO);
         if (!glue->core) {
                 dev_err(glue->dev, "can't allocate platform_device");
                 ret = -ENOMEM;
@@ -283,7 +289,7 @@ static int wl1271_probe(struct sdio_func *func,
 
         memset(res, 0x00, sizeof(res));
 
-        res[0].start = wlan_data->irq;
+        res[0].start = pdev_data->pdata->irq;
         res[0].flags = IORESOURCE_IRQ;
         res[0].name = "irq";
 
@@ -293,8 +299,8 @@ static int wl1271_probe(struct sdio_func *func,
                 goto out_dev_put;
         }
 
-        ret = platform_device_add_data(glue->core, wlan_data,
-                                       sizeof(*wlan_data));
+        ret = platform_device_add_data(glue->core, pdev_data,
+                                       sizeof(*pdev_data));
         if (ret) {
                 dev_err(glue->dev, "can't add platform data\n");
                 goto out_dev_put;
@@ -313,6 +319,9 @@ out_dev_put:
 out_free_glue:
         kfree(glue);
 
+out_free_pdev_data:
+        kfree(pdev_data);
+
 out:
         return ret;
 }
diff --git a/drivers/net/wireless/ti/wlcore/spi.c b/drivers/net/wireless/ti/wlcore/spi.c
index 53790d1d0d27..e26447832683 100644
--- a/drivers/net/wireless/ti/wlcore/spi.c
+++ b/drivers/net/wireless/ti/wlcore/spi.c
@@ -87,8 +87,11 @@ static void wl12xx_spi_reset(struct device *child)
         struct spi_message m;
 
         cmd = kzalloc(WSPI_INIT_CMD_LEN, GFP_KERNEL);
-        if (!cmd)
+        if (!cmd) {
+                dev_err(child->parent,
+                        "could not allocate cmd for spi reset\n");
                 return;
+        }
 
         memset(&t, 0, sizeof(t));
         spi_message_init(&m);
@@ -112,8 +115,11 @@ static void wl12xx_spi_init(struct device *child)
         struct spi_message m;
 
         cmd = kzalloc(WSPI_INIT_CMD_LEN, GFP_KERNEL);
-        if (!cmd)
+        if (!cmd) {
+                dev_err(child->parent,
+                        "could not allocate cmd for spi init\n");
                 return;
+        }
 
         memset(crc, 0, sizeof(crc));
         memset(&t, 0, sizeof(t));
@@ -321,21 +327,28 @@ static struct wl1271_if_operations spi_ops = {
 static int wl1271_probe(struct spi_device *spi)
 {
         struct wl12xx_spi_glue *glue;
-        struct wl12xx_platform_data *pdata;
+        struct wlcore_platdev_data *pdev_data;
         struct resource res[1];
         int ret = -ENOMEM;
 
-        pdata = spi->dev.platform_data;
-        if (!pdata) {
+        pdev_data = kzalloc(sizeof(*pdev_data), GFP_KERNEL);
+        if (!pdev_data)
+                goto out;
+
+        pdev_data->pdata = spi->dev.platform_data;
+        if (!pdev_data->pdata) {
                 dev_err(&spi->dev, "no platform data\n");
-                return -ENODEV;
+                ret = -ENODEV;
+                goto out_free_pdev_data;
         }
 
-        pdata->ops = &spi_ops;
+        pdev_data->if_ops = &spi_ops;
 
         glue = kzalloc(sizeof(*glue), GFP_KERNEL);
-        if (!glue)
-                goto out;
+        if (!glue) {
+                dev_err(&spi->dev, "can't allocate glue\n");
+                goto out_free_pdev_data;
+        }
 
         glue->dev = &spi->dev;
 
@@ -351,7 +364,7 @@ static int wl1271_probe(struct spi_device *spi)
                 goto out_free_glue;
         }
 
-        glue->core = platform_device_alloc("wl12xx", -1);
+        glue->core = platform_device_alloc("wl12xx", PLATFORM_DEVID_AUTO);
         if (!glue->core) {
                 dev_err(glue->dev, "can't allocate platform_device\n");
                 ret = -ENOMEM;
@@ -372,7 +385,8 @@ static int wl1271_probe(struct spi_device *spi)
                 goto out_dev_put;
         }
 
-        ret = platform_device_add_data(glue->core, pdata, sizeof(*pdata));
+        ret = platform_device_add_data(glue->core, pdev_data,
+                                       sizeof(*pdev_data));
         if (ret) {
                 dev_err(glue->dev, "can't add platform data\n");
                 goto out_dev_put;
@@ -391,6 +405,10 @@ out_dev_put:
 
 out_free_glue:
         kfree(glue);
+
+out_free_pdev_data:
+        kfree(pdev_data);
+
 out:
         return ret;
 }
diff --git a/drivers/net/wireless/ti/wlcore/wlcore.h b/drivers/net/wireless/ti/wlcore/wlcore.h
index ebd8c6fad7cd..af9fecaefc30 100644
--- a/drivers/net/wireless/ti/wlcore/wlcore.h
+++ b/drivers/net/wireless/ti/wlcore/wlcore.h
@@ -183,7 +183,6 @@ struct wl1271 {
 
         struct wl1271_if_operations *if_ops;
 
-        void (*set_power)(bool enable);
         int irq;
 
         spinlock_t wl_lock;
diff --git a/drivers/net/wireless/ti/wlcore/wlcore_i.h b/drivers/net/wireless/ti/wlcore/wlcore_i.h
index 910f8e2e556a..508f5b0f8a70 100644
--- a/drivers/net/wireless/ti/wlcore/wlcore_i.h
+++ b/drivers/net/wireless/ti/wlcore/wlcore_i.h
@@ -206,6 +206,11 @@ struct wl1271_if_operations {
         void (*set_block_size) (struct device *child, unsigned int blksz);
 };
 
+struct wlcore_platdev_data {
+        struct wl12xx_platform_data *pdata;
+        struct wl1271_if_operations *if_ops;
+};
+
 #define MAX_NUM_KEYS 14
 #define MAX_KEY_SIZE 32
 
diff --git a/drivers/nfc/Kconfig b/drivers/nfc/Kconfig
index 80c728b28828..e57034971ccc 100644
--- a/drivers/nfc/Kconfig
+++ b/drivers/nfc/Kconfig
@@ -27,5 +27,6 @@ config NFC_WILINK
           into the kernel or say M to compile it as module.
 
 source "drivers/nfc/pn544/Kconfig"
+source "drivers/nfc/microread/Kconfig"
 
 endmenu
diff --git a/drivers/nfc/Makefile b/drivers/nfc/Makefile
index 574bbc04d97a..a189ada0926a 100644
--- a/drivers/nfc/Makefile
+++ b/drivers/nfc/Makefile
@@ -3,6 +3,7 @@
 #
 
 obj-$(CONFIG_NFC_PN544)         += pn544/
+obj-$(CONFIG_NFC_MICROREAD)     += microread/
 obj-$(CONFIG_NFC_PN533)         += pn533.o
 obj-$(CONFIG_NFC_WILINK)        += nfcwilink.o
 
diff --git a/drivers/nfc/microread/Kconfig b/drivers/nfc/microread/Kconfig
new file mode 100644
index 000000000000..572305be6e37
--- /dev/null
+++ b/drivers/nfc/microread/Kconfig
@@ -0,0 +1,35 @@
+config NFC_MICROREAD
+        tristate "Inside Secure microread NFC driver"
+        depends on NFC_HCI
+        select CRC_CCITT
+        default n
+        ---help---
+          This module contains the main code for Inside Secure microread
+          NFC chipsets. It implements the chipset HCI logic and hooks into
+          the NFC kernel APIs. Physical layers will register against it.
+
+          To compile this driver as a module, choose m here. The module will
+          be called microread.
+          Say N if unsure.
+
+config NFC_MICROREAD_I2C
+        tristate "NFC Microread i2c support"
+        depends on NFC_MICROREAD && I2C && NFC_SHDLC
+        ---help---
+          This module adds support for the i2c interface of adapters using
+          Inside microread chipsets.  Select this if your platform is using
+          the i2c bus.
+
+          If you choose to build a module, it'll be called microread_i2c.
+          Say N if unsure.
+
+config NFC_MICROREAD_MEI
+        tristate "NFC Microread MEI support"
+        depends on NFC_MICROREAD && INTEL_MEI_BUS_NFC
+        ---help---
+          This module adds support for the mei interface of adapters using
+          Inside microread chipsets.  Select this if your microread chipset
+          is handled by Intel's Management Engine Interface on your platform.
+
+          If you choose to build a module, it'll be called microread_mei.
+          Say N if unsure.
diff --git a/drivers/nfc/microread/Makefile b/drivers/nfc/microread/Makefile
new file mode 100644
index 000000000000..755c24cba253
--- /dev/null
+++ b/drivers/nfc/microread/Makefile
@@ -0,0 +1,10 @@
+#
+# Makefile for Microread HCI based NFC driver
+#
+
+microread_i2c-objs  = i2c.o
+microread_mei-objs  = mei.o
+
+obj-$(CONFIG_NFC_MICROREAD)     += microread.o
+obj-$(CONFIG_NFC_MICROREAD_I2C) += microread_i2c.o
+obj-$(CONFIG_NFC_MICROREAD_MEI) += microread_mei.o
diff --git a/drivers/nfc/microread/i2c.c b/drivers/nfc/microread/i2c.c
new file mode 100644
index 000000000000..101089495bf8
--- /dev/null
+++ b/drivers/nfc/microread/i2c.c
@@ -0,0 +1,340 @@
+/*
+ * HCI based Driver for Inside Secure microread NFC Chip - i2c layer
+ *
+ * Copyright (C) 2013 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the
+ * Free Software Foundation, Inc.,
+ * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+#include <linux/module.h>
+#include <linux/i2c.h>
+#include <linux/delay.h>
+#include <linux/slab.h>
+#include <linux/interrupt.h>
+#include <linux/gpio.h>
+
+#include <linux/nfc.h>
+#include <net/nfc/hci.h>
+#include <net/nfc/llc.h>
+
+#include "microread.h"
+
+#define MICROREAD_I2C_DRIVER_NAME "microread"
+
+#define MICROREAD_I2C_FRAME_HEADROOM 1
+#define MICROREAD_I2C_FRAME_TAILROOM 1
+
+/* framing in HCI mode */
+#define MICROREAD_I2C_LLC_LEN           1
+#define MICROREAD_I2C_LLC_CRC           1
+#define MICROREAD_I2C_LLC_LEN_CRC       (MICROREAD_I2C_LLC_LEN + \
+                                        MICROREAD_I2C_LLC_CRC)
+#define MICROREAD_I2C_LLC_MIN_SIZE      (1 + MICROREAD_I2C_LLC_LEN_CRC)
+#define MICROREAD_I2C_LLC_MAX_PAYLOAD   29
+#define MICROREAD_I2C_LLC_MAX_SIZE      (MICROREAD_I2C_LLC_LEN_CRC + 1 + \
+                                        MICROREAD_I2C_LLC_MAX_PAYLOAD)
+
+struct microread_i2c_phy {
+        struct i2c_client *i2c_dev;
+        struct nfc_hci_dev *hdev;
+
+        int irq;
+
+        int hard_fault;         /*
+                                 * < 0 if hardware error occured (e.g. i2c err)
+                                 * and prevents normal operation.
+                                 */
+};
+
+#define I2C_DUMP_SKB(info, skb)                                 \
+do {                                                            \
+        pr_debug("%s:\n", info);                                \
+        print_hex_dump(KERN_DEBUG, "i2c: ", DUMP_PREFIX_OFFSET, \
+                       16, 1, (skb)->data, (skb)->len, 0);      \
+} while (0)
+
+static void microread_i2c_add_len_crc(struct sk_buff *skb)
+{
+        int i;
+        u8 crc = 0;
+        int len;
+
+        len = skb->len;
+        *skb_push(skb, 1) = len;
+
+        for (i = 0; i < skb->len; i++)
+                crc = crc ^ skb->data[i];
+
+        *skb_put(skb, 1) = crc;
+}
+
+static void microread_i2c_remove_len_crc(struct sk_buff *skb)
+{
+        skb_pull(skb, MICROREAD_I2C_FRAME_HEADROOM);
+        skb_trim(skb, MICROREAD_I2C_FRAME_TAILROOM);
+}
+
+static int check_crc(struct sk_buff *skb)
+{
+        int i;
+        u8 crc = 0;
+
+        for (i = 0; i < skb->len - 1; i++)
+                crc = crc ^ skb->data[i];
+
+        if (crc != skb->data[skb->len-1]) {
+                pr_err(MICROREAD_I2C_DRIVER_NAME
+                       ": CRC error 0x%x != 0x%x\n",
+                       crc, skb->data[skb->len-1]);
+
+                pr_info(DRIVER_DESC ": %s : BAD CRC\n", __func__);
+
+                return -EPERM;
+        }
+
+        return 0;
+}
+
+static int microread_i2c_enable(void *phy_id)
+{
+        return 0;
+}
+
+static void microread_i2c_disable(void *phy_id)
+{
+        return;
+}
+
+static int microread_i2c_write(void *phy_id, struct sk_buff *skb)
+{
+        int r;
+        struct microread_i2c_phy *phy = phy_id;
+        struct i2c_client *client = phy->i2c_dev;
+
+        if (phy->hard_fault != 0)
+                return phy->hard_fault;
+
+        usleep_range(3000, 6000);
+
+        microread_i2c_add_len_crc(skb);
+
+        I2C_DUMP_SKB("i2c frame written", skb);
+
+        r = i2c_master_send(client, skb->data, skb->len);
+
+        if (r == -EREMOTEIO) {  /* Retry, chip was in standby */
+                usleep_range(6000, 10000);
+                r = i2c_master_send(client, skb->data, skb->len);
+        }
+
+        if (r >= 0) {
+                if (r != skb->len)
+                        r = -EREMOTEIO;
+                else
+                        r = 0;
+        }
+
+        microread_i2c_remove_len_crc(skb);
+
+        return r;
+}
+
+
+static int microread_i2c_read(struct microread_i2c_phy *phy,
+                              struct sk_buff **skb)
+{
+        int r;
+        u8 len;
+        u8 tmp[MICROREAD_I2C_LLC_MAX_SIZE - 1];
+        struct i2c_client *client = phy->i2c_dev;
+
+        pr_debug("%s\n", __func__);
+
+        r = i2c_master_recv(client, &len, 1);
+        if (r != 1) {
+                dev_err(&client->dev, "cannot read len byte\n");
+                return -EREMOTEIO;
+        }
+
+        if ((len < MICROREAD_I2C_LLC_MIN_SIZE) ||
+            (len > MICROREAD_I2C_LLC_MAX_SIZE)) {
+                dev_err(&client->dev, "invalid len byte\n");
+                pr_err("invalid len byte\n");
+                r = -EBADMSG;
+                goto flush;
+        }
+
+        *skb = alloc_skb(1 + len, GFP_KERNEL);
+        if (*skb == NULL) {
+                r = -ENOMEM;
+                goto flush;
+        }
+
+        *skb_put(*skb, 1) = len;
+
+        r = i2c_master_recv(client, skb_put(*skb, len), len);
+        if (r != len) {
+                kfree_skb(*skb);
+                return -EREMOTEIO;
+        }
+
+        I2C_DUMP_SKB("cc frame read", *skb);
+
+        r = check_crc(*skb);
+        if (r != 0) {
+                kfree_skb(*skb);
+                r = -EBADMSG;
+                goto flush;
+        }
+
+        skb_pull(*skb, 1);
+        skb_trim(*skb, (*skb)->len - MICROREAD_I2C_FRAME_TAILROOM);
+
+        usleep_range(3000, 6000);
+
+        return 0;
+
+flush:
+        if (i2c_master_recv(client, tmp, sizeof(tmp)) < 0)
+                r = -EREMOTEIO;
+
+        usleep_range(3000, 6000);
+
+        return r;
+}
+
+static irqreturn_t microread_i2c_irq_thread_fn(int irq, void *phy_id)
+{
+        struct microread_i2c_phy *phy = phy_id;
+        struct i2c_client *client;
+        struct sk_buff *skb = NULL;
+        int r;
+
+        if (!phy || irq != phy->i2c_dev->irq) {
+                WARN_ON_ONCE(1);
+                return IRQ_NONE;
+        }
+
+        client = phy->i2c_dev;
+        dev_dbg(&client->dev, "IRQ\n");
+
+        if (phy->hard_fault != 0)
+                return IRQ_HANDLED;
+
+        r = microread_i2c_read(phy, &skb);
+        if (r == -EREMOTEIO) {
+                phy->hard_fault = r;
+
+                nfc_hci_recv_frame(phy->hdev, NULL);
+
+                return IRQ_HANDLED;
+        } else if ((r == -ENOMEM) || (r == -EBADMSG)) {
+                return IRQ_HANDLED;
+        }
+
+        nfc_hci_recv_frame(phy->hdev, skb);
+
+        return IRQ_HANDLED;
+}
+
+static struct nfc_phy_ops i2c_phy_ops = {
+        .write = microread_i2c_write,
+        .enable = microread_i2c_enable,
+        .disable = microread_i2c_disable,
+};
+
+static int microread_i2c_probe(struct i2c_client *client,
+                               const struct i2c_device_id *id)
+{
+        struct microread_i2c_phy *phy;
+        struct microread_nfc_platform_data *pdata =
+                dev_get_platdata(&client->dev);
+        int r;
+
+        dev_dbg(&client->dev, "client %p", client);
+
+        if (!pdata) {
+                dev_err(&client->dev, "client %p: missing platform data",
+                        client);
+                return -EINVAL;
+        }
+
+        phy = devm_kzalloc(&client->dev, sizeof(struct microread_i2c_phy),
+                           GFP_KERNEL);
+        if (!phy) {
+                dev_err(&client->dev, "Can't allocate microread phy");
+                return -ENOMEM;
+        }
+
+        i2c_set_clientdata(client, phy);
+        phy->i2c_dev = client;
+
+        r = request_threaded_irq(client->irq, NULL, microread_i2c_irq_thread_fn,
+                                 IRQF_TRIGGER_RISING | IRQF_ONESHOT,
+                                 MICROREAD_I2C_DRIVER_NAME, phy);
+        if (r) {
+                dev_err(&client->dev, "Unable to register IRQ handler");
+                return r;
+        }
+
+        r = microread_probe(phy, &i2c_phy_ops, LLC_SHDLC_NAME,
+                            MICROREAD_I2C_FRAME_HEADROOM,
+                            MICROREAD_I2C_FRAME_TAILROOM,
+                            MICROREAD_I2C_LLC_MAX_PAYLOAD, &phy->hdev);
+        if (r < 0)
+                goto err_irq;
+
+        dev_info(&client->dev, "Probed");
+
+        return 0;
+
+err_irq:
+        free_irq(client->irq, phy);
+
+        return r;
+}
+
+static int microread_i2c_remove(struct i2c_client *client)
+{
+        struct microread_i2c_phy *phy = i2c_get_clientdata(client);
+
+        dev_dbg(&client->dev, "%s\n", __func__);
+
+        microread_remove(phy->hdev);
+
+        free_irq(client->irq, phy);
+
+        return 0;
+}
+
+static struct i2c_device_id microread_i2c_id[] = {
+        { MICROREAD_I2C_DRIVER_NAME, 0},
+        { }
+};
+MODULE_DEVICE_TABLE(i2c, microread_i2c_id);
+
+static struct i2c_driver microread_i2c_driver = {
+        .driver = {
+                .name = MICROREAD_I2C_DRIVER_NAME,
+        },
+        .probe          = microread_i2c_probe,
+        .remove         = microread_i2c_remove,
+        .id_table       = microread_i2c_id,
+};
+
+module_i2c_driver(microread_i2c_driver);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION(DRIVER_DESC);
diff --git a/drivers/nfc/microread/mei.c b/drivers/nfc/microread/mei.c
new file mode 100644
index 000000000000..eef38cfd812e
--- /dev/null
+++ b/drivers/nfc/microread/mei.c
@@ -0,0 +1,246 @@
+/*
+ * HCI based Driver for Inside Secure microread NFC Chip
+ *
+ * Copyright (C) 2013  Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the
+ * Free Software Foundation, Inc.,
+ * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/interrupt.h>
+#include <linux/gpio.h>
+#include <linux/mei_bus.h>
+
+#include <linux/nfc.h>
+#include <net/nfc/hci.h>
+#include <net/nfc/llc.h>
+
+#include "microread.h"
+
+#define MICROREAD_DRIVER_NAME "microread"
+
+#define MICROREAD_UUID UUID_LE(0x0bb17a78, 0x2a8e, 0x4c50, 0x94, \
+                               0xd4, 0x50, 0x26, 0x67, 0x23, 0x77, 0x5c)
+
+struct mei_nfc_hdr {
+        u8 cmd;
+        u8 status;
+        u16 req_id;
+        u32 reserved;
+        u16 data_size;
+} __attribute__((packed));
+
+#define MEI_NFC_HEADER_SIZE 10
+#define MEI_NFC_MAX_HCI_PAYLOAD 300
+#define MEI_NFC_MAX_READ (MEI_NFC_HEADER_SIZE + MEI_NFC_MAX_HCI_PAYLOAD)
+
+struct microread_mei_phy {
+        struct mei_device *mei_device;
+        struct nfc_hci_dev *hdev;
+
+        int powered;
+
+        int hard_fault;         /*
+                                 * < 0 if hardware error occured (e.g. i2c err)
+                                 * and prevents normal operation.
+                                 */
+};
+
+#define MEI_DUMP_SKB_IN(info, skb)                                      \
+do {                                                            \
+        pr_debug("%s:\n", info);                                \
+        print_hex_dump(KERN_DEBUG, "mei in : ", DUMP_PREFIX_OFFSET,     \
+                       16, 1, (skb)->data, (skb)->len, 0);      \
+} while (0)
+
+#define MEI_DUMP_SKB_OUT(info, skb)                                     \
+do {                                                            \
+        pr_debug("%s:\n", info);                                \
+        print_hex_dump(KERN_DEBUG, "mei out: ", DUMP_PREFIX_OFFSET,     \
+                       16, 1, (skb)->data, (skb)->len, 0);      \
+} while (0)
+
+static int microread_mei_enable(void *phy_id)
+{
+        struct microread_mei_phy *phy = phy_id;
+
+        pr_info(DRIVER_DESC ": %s\n", __func__);
+
+        phy->powered = 1;
+
+        return 0;
+}
+
+static void microread_mei_disable(void *phy_id)
+{
+        struct microread_mei_phy *phy = phy_id;
+
+        pr_info(DRIVER_DESC ": %s\n", __func__);
+
+        phy->powered = 0;
+}
+
+/*
+ * Writing a frame must not return the number of written bytes.
+ * It must return either zero for success, or <0 for error.
+ * In addition, it must not alter the skb
+ */
+static int microread_mei_write(void *phy_id, struct sk_buff *skb)
+{
+        struct microread_mei_phy *phy = phy_id;
+        int r;
+
+        MEI_DUMP_SKB_OUT("mei frame sent", skb);
+
+        r = mei_send(phy->device, skb->data, skb->len);
+        if (r > 0)
+                r = 0;
+
+        return r;
+}
+
+static void microread_event_cb(struct mei_device *device, u32 events,
+                               void *context)
+{
+        struct microread_mei_phy *phy = context;
+
+        if (phy->hard_fault != 0)
+                return;
+
+        if (events & BIT(MEI_EVENT_RX)) {
+                struct sk_buff *skb;
+                int reply_size;
+
+                skb = alloc_skb(MEI_NFC_MAX_READ, GFP_KERNEL);
+                if (!skb)
+                        return;
+
+                reply_size = mei_recv(device, skb->data, MEI_NFC_MAX_READ);
+                if (reply_size < MEI_NFC_HEADER_SIZE) {
+                        kfree(skb);
+                        return;
+                }
+
+                skb_put(skb, reply_size);
+                skb_pull(skb, MEI_NFC_HEADER_SIZE);
+
+                MEI_DUMP_SKB_IN("mei frame read", skb);
+
+                nfc_hci_recv_frame(phy->hdev, skb);
+        }
+}
+
+static struct nfc_phy_ops mei_phy_ops = {
+        .write = microread_mei_write,
+        .enable = microread_mei_enable,
+        .disable = microread_mei_disable,
+};
+
+static int microread_mei_probe(struct mei_device *device,
+                               const struct mei_id *id)
+{
+        struct microread_mei_phy *phy;
+        int r;
+
+        pr_info("Probing NFC microread\n");
+
+        phy = kzalloc(sizeof(struct microread_mei_phy), GFP_KERNEL);
+        if (!phy) {
+                pr_err("Cannot allocate memory for microread mei phy.\n");
+                return -ENOMEM;
+        }
+
+        phy->device = device;
+        mei_set_clientdata(device, phy);
+
+        r = mei_register_event_cb(device, microread_event_cb, phy);
+        if (r) {
+                pr_err(MICROREAD_DRIVER_NAME ": event cb registration failed\n");
+                goto err_out;
+        }
+
+        r = microread_probe(phy, &mei_phy_ops, LLC_NOP_NAME,
+                            MEI_NFC_HEADER_SIZE, 0, MEI_NFC_MAX_HCI_PAYLOAD,
+                            &phy->hdev);
+        if (r < 0)
+                goto err_out;
+
+        return 0;
+
+err_out:
+        kfree(phy);
+
+        return r;
+}
+
+static int microread_mei_remove(struct mei_device *device)
+{
+        struct microread_mei_phy *phy = mei_get_clientdata(device);
+
+        pr_info("Removing microread\n");
+
+        microread_remove(phy->hdev);
+
+        if (phy->powered)
+                microread_mei_disable(phy);
+
+        kfree(phy);
+
+        return 0;
+}
+
+static struct mei_id microread_mei_tbl[] = {
+        { MICROREAD_DRIVER_NAME, MICROREAD_UUID },
+
+        /* required last entry */
+        { }
+};
+
+MODULE_DEVICE_TABLE(mei, microread_mei_tbl);
+
+static struct mei_driver microread_driver = {
+        .id_table = microread_mei_tbl,
+        .name = MICROREAD_DRIVER_NAME,
+
+        .probe = microread_mei_probe,
+        .remove = microread_mei_remove,
+};
+
+static int microread_mei_init(void)
+{
+        int r;
+
+        pr_debug(DRIVER_DESC ": %s\n", __func__);
+
+        r = mei_driver_register(&microread_driver);
+        if (r) {
+                pr_err(MICROREAD_DRIVER_NAME ": driver registration failed\n");
+                return r;
+        }
+
+        return 0;
+}
+
+static void microread_mei_exit(void)
+{
+        mei_driver_unregister(&microread_driver);
+}
+
+module_init(microread_mei_init);
+module_exit(microread_mei_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION(DRIVER_DESC);
diff --git a/drivers/nfc/microread/microread.c b/drivers/nfc/microread/microread.c
new file mode 100644
index 000000000000..3420d833db17
--- /dev/null
+++ b/drivers/nfc/microread/microread.c
@@ -0,0 +1,728 @@
+/*
+ * HCI based Driver for Inside Secure microread NFC Chip
+ *
+ * Copyright (C) 2013  Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the
+ * Free Software Foundation, Inc.,
+ * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+#include <linux/module.h>
+#include <linux/delay.h>
+#include <linux/slab.h>
+#include <linux/crc-ccitt.h>
+
+#include <linux/nfc.h>
+#include <net/nfc/nfc.h>
+#include <net/nfc/hci.h>
+#include <net/nfc/llc.h>
+
+#include "microread.h"
+
+/* Proprietary gates, events, commands and registers */
+/* Admin */
+#define MICROREAD_GATE_ID_ADM NFC_HCI_ADMIN_GATE
+#define MICROREAD_GATE_ID_MGT 0x01
+#define MICROREAD_GATE_ID_OS 0x02
+#define MICROREAD_GATE_ID_TESTRF 0x03
+#define MICROREAD_GATE_ID_LOOPBACK NFC_HCI_LOOPBACK_GATE
+#define MICROREAD_GATE_ID_IDT NFC_HCI_ID_MGMT_GATE
+#define MICROREAD_GATE_ID_LMS NFC_HCI_LINK_MGMT_GATE
+
+/* Reader */
+#define MICROREAD_GATE_ID_MREAD_GEN 0x10
+#define MICROREAD_GATE_ID_MREAD_ISO_B NFC_HCI_RF_READER_B_GATE
+#define MICROREAD_GATE_ID_MREAD_NFC_T1 0x12
+#define MICROREAD_GATE_ID_MREAD_ISO_A NFC_HCI_RF_READER_A_GATE
+#define MICROREAD_GATE_ID_MREAD_NFC_T3 0x14
+#define MICROREAD_GATE_ID_MREAD_ISO_15_3 0x15
+#define MICROREAD_GATE_ID_MREAD_ISO_15_2 0x16
+#define MICROREAD_GATE_ID_MREAD_ISO_B_3 0x17
+#define MICROREAD_GATE_ID_MREAD_BPRIME 0x18
+#define MICROREAD_GATE_ID_MREAD_ISO_A_3 0x19
+
+/* Card */
+#define MICROREAD_GATE_ID_MCARD_GEN 0x20
+#define MICROREAD_GATE_ID_MCARD_ISO_B 0x21
+#define MICROREAD_GATE_ID_MCARD_BPRIME 0x22
+#define MICROREAD_GATE_ID_MCARD_ISO_A 0x23
+#define MICROREAD_GATE_ID_MCARD_NFC_T3 0x24
+#define MICROREAD_GATE_ID_MCARD_ISO_15_3 0x25
+#define MICROREAD_GATE_ID_MCARD_ISO_15_2 0x26
+#define MICROREAD_GATE_ID_MCARD_ISO_B_2 0x27
+#define MICROREAD_GATE_ID_MCARD_ISO_CUSTOM 0x28
+#define MICROREAD_GATE_ID_SECURE_ELEMENT 0x2F
+
+/* P2P */
+#define MICROREAD_GATE_ID_P2P_GEN 0x30
+#define MICROREAD_GATE_ID_P2P_TARGET 0x31
+#define MICROREAD_PAR_P2P_TARGET_MODE 0x01
+#define MICROREAD_PAR_P2P_TARGET_GT 0x04
+#define MICROREAD_GATE_ID_P2P_INITIATOR 0x32
+#define MICROREAD_PAR_P2P_INITIATOR_GI 0x01
+#define MICROREAD_PAR_P2P_INITIATOR_GT 0x03
+
+/* Those pipes are created/opened by default in the chip */
+#define MICROREAD_PIPE_ID_LMS 0x00
+#define MICROREAD_PIPE_ID_ADMIN 0x01
+#define MICROREAD_PIPE_ID_MGT 0x02
+#define MICROREAD_PIPE_ID_OS 0x03
+#define MICROREAD_PIPE_ID_HDS_LOOPBACK 0x04
+#define MICROREAD_PIPE_ID_HDS_IDT 0x05
+#define MICROREAD_PIPE_ID_HDS_MCARD_ISO_B 0x08
+#define MICROREAD_PIPE_ID_HDS_MCARD_ISO_BPRIME 0x09
+#define MICROREAD_PIPE_ID_HDS_MCARD_ISO_A 0x0A
+#define MICROREAD_PIPE_ID_HDS_MCARD_ISO_15_3 0x0B
+#define MICROREAD_PIPE_ID_HDS_MCARD_ISO_15_2 0x0C
+#define MICROREAD_PIPE_ID_HDS_MCARD_NFC_T3 0x0D
+#define MICROREAD_PIPE_ID_HDS_MCARD_ISO_B_2 0x0E
+#define MICROREAD_PIPE_ID_HDS_MCARD_CUSTOM 0x0F
+#define MICROREAD_PIPE_ID_HDS_MREAD_ISO_B 0x10
+#define MICROREAD_PIPE_ID_HDS_MREAD_NFC_T1 0x11
+#define MICROREAD_PIPE_ID_HDS_MREAD_ISO_A 0x12
+#define MICROREAD_PIPE_ID_HDS_MREAD_ISO_15_3 0x13
+#define MICROREAD_PIPE_ID_HDS_MREAD_ISO_15_2 0x14
+#define MICROREAD_PIPE_ID_HDS_MREAD_NFC_T3 0x15
+#define MICROREAD_PIPE_ID_HDS_MREAD_ISO_B_3 0x16
+#define MICROREAD_PIPE_ID_HDS_MREAD_BPRIME 0x17
+#define MICROREAD_PIPE_ID_HDS_MREAD_ISO_A_3 0x18
+#define MICROREAD_PIPE_ID_HDS_MREAD_GEN 0x1B
+#define MICROREAD_PIPE_ID_HDS_STACKED_ELEMENT 0x1C
+#define MICROREAD_PIPE_ID_HDS_INSTANCES 0x1D
+#define MICROREAD_PIPE_ID_HDS_TESTRF 0x1E
+#define MICROREAD_PIPE_ID_HDS_P2P_TARGET 0x1F
+#define MICROREAD_PIPE_ID_HDS_P2P_INITIATOR 0x20
+
+/* Events */
+#define MICROREAD_EVT_MREAD_DISCOVERY_OCCURED NFC_HCI_EVT_TARGET_DISCOVERED
+#define MICROREAD_EVT_MREAD_CARD_FOUND 0x3D
+#define MICROREAD_EMCF_A_ATQA 0
+#define MICROREAD_EMCF_A_SAK 2
+#define MICROREAD_EMCF_A_LEN 3
+#define MICROREAD_EMCF_A_UID 4
+#define MICROREAD_EMCF_A3_ATQA 0
+#define MICROREAD_EMCF_A3_SAK 2
+#define MICROREAD_EMCF_A3_LEN 3
+#define MICROREAD_EMCF_A3_UID 4
+#define MICROREAD_EMCF_B_UID 0
+#define MICROREAD_EMCF_T1_ATQA 0
+#define MICROREAD_EMCF_T1_UID 4
+#define MICROREAD_EMCF_T3_UID 0
+#define MICROREAD_EVT_MREAD_DISCOVERY_START NFC_HCI_EVT_READER_REQUESTED
+#define MICROREAD_EVT_MREAD_DISCOVERY_START_SOME 0x3E
+#define MICROREAD_EVT_MREAD_DISCOVERY_STOP NFC_HCI_EVT_END_OPERATION
+#define MICROREAD_EVT_MREAD_SIM_REQUESTS 0x3F
+#define MICROREAD_EVT_MCARD_EXCHANGE NFC_HCI_EVT_TARGET_DISCOVERED
+#define MICROREAD_EVT_P2P_INITIATOR_EXCHANGE_TO_RF 0x20
+#define MICROREAD_EVT_P2P_INITIATOR_EXCHANGE_FROM_RF 0x21
+#define MICROREAD_EVT_MCARD_FIELD_ON 0x11
+#define MICROREAD_EVT_P2P_TARGET_ACTIVATED 0x13
+#define MICROREAD_EVT_P2P_TARGET_DEACTIVATED 0x12
+#define MICROREAD_EVT_MCARD_FIELD_OFF 0x14
+
+/* Commands */
+#define MICROREAD_CMD_MREAD_EXCHANGE 0x10
+#define MICROREAD_CMD_MREAD_SUBSCRIBE 0x3F
+
+/* Hosts IDs */
+#define MICROREAD_ELT_ID_HDS NFC_HCI_TERMINAL_HOST_ID
+#define MICROREAD_ELT_ID_SIM NFC_HCI_UICC_HOST_ID
+#define MICROREAD_ELT_ID_SE1 0x03
+#define MICROREAD_ELT_ID_SE2 0x04
+#define MICROREAD_ELT_ID_SE3 0x05
+
+static struct nfc_hci_gate microread_gates[] = {
+        {MICROREAD_GATE_ID_ADM, MICROREAD_PIPE_ID_ADMIN},
+        {MICROREAD_GATE_ID_LOOPBACK, MICROREAD_PIPE_ID_HDS_LOOPBACK},
+        {MICROREAD_GATE_ID_IDT, MICROREAD_PIPE_ID_HDS_IDT},
+        {MICROREAD_GATE_ID_LMS, MICROREAD_PIPE_ID_LMS},
+        {MICROREAD_GATE_ID_MREAD_ISO_B, MICROREAD_PIPE_ID_HDS_MREAD_ISO_B},
+        {MICROREAD_GATE_ID_MREAD_ISO_A, MICROREAD_PIPE_ID_HDS_MREAD_ISO_A},
+        {MICROREAD_GATE_ID_MREAD_ISO_A_3, MICROREAD_PIPE_ID_HDS_MREAD_ISO_A_3},
+        {MICROREAD_GATE_ID_MGT, MICROREAD_PIPE_ID_MGT},
+        {MICROREAD_GATE_ID_OS, MICROREAD_PIPE_ID_OS},
+        {MICROREAD_GATE_ID_MREAD_NFC_T1, MICROREAD_PIPE_ID_HDS_MREAD_NFC_T1},
+        {MICROREAD_GATE_ID_MREAD_NFC_T3, MICROREAD_PIPE_ID_HDS_MREAD_NFC_T3},
+        {MICROREAD_GATE_ID_P2P_TARGET, MICROREAD_PIPE_ID_HDS_P2P_TARGET},
+        {MICROREAD_GATE_ID_P2P_INITIATOR, MICROREAD_PIPE_ID_HDS_P2P_INITIATOR}
+};
+
+/* Largest headroom needed for outgoing custom commands */
+#define MICROREAD_CMDS_HEADROOM 2
+#define MICROREAD_CMD_TAILROOM  2
+
+struct microread_info {
+        struct nfc_phy_ops *phy_ops;
+        void *phy_id;
+
+        struct nfc_hci_dev *hdev;
+
+        int async_cb_type;
+        data_exchange_cb_t async_cb;
+        void *async_cb_context;
+};
+
+static int microread_open(struct nfc_hci_dev *hdev)
+{
+        struct microread_info *info = nfc_hci_get_clientdata(hdev);
+
+        return info->phy_ops->enable(info->phy_id);
+}
+
+static void microread_close(struct nfc_hci_dev *hdev)
+{
+        struct microread_info *info = nfc_hci_get_clientdata(hdev);
+
+        info->phy_ops->disable(info->phy_id);
+}
+
+static int microread_hci_ready(struct nfc_hci_dev *hdev)
+{
+        int r;
+        u8 param[4];
+
+        param[0] = 0x03;
+        r = nfc_hci_send_cmd(hdev, MICROREAD_GATE_ID_MREAD_ISO_A,
+                             MICROREAD_CMD_MREAD_SUBSCRIBE, param, 1, NULL);
+        if (r)
+                return r;
+
+        r = nfc_hci_send_cmd(hdev, MICROREAD_GATE_ID_MREAD_ISO_A_3,
+                             MICROREAD_CMD_MREAD_SUBSCRIBE, NULL, 0, NULL);
+        if (r)
+                return r;
+
+        param[0] = 0x00;
+        param[1] = 0x03;
+        param[2] = 0x00;
+        r = nfc_hci_send_cmd(hdev, MICROREAD_GATE_ID_MREAD_ISO_B,
+                             MICROREAD_CMD_MREAD_SUBSCRIBE, param, 3, NULL);
+        if (r)
+                return r;
+
+        r = nfc_hci_send_cmd(hdev, MICROREAD_GATE_ID_MREAD_NFC_T1,
+                             MICROREAD_CMD_MREAD_SUBSCRIBE, NULL, 0, NULL);
+        if (r)
+                return r;
+
+        param[0] = 0xFF;
+        param[1] = 0xFF;
+        param[2] = 0x00;
+        param[3] = 0x00;
+        r = nfc_hci_send_cmd(hdev, MICROREAD_GATE_ID_MREAD_NFC_T3,
+                             MICROREAD_CMD_MREAD_SUBSCRIBE, param, 4, NULL);
+
+        return r;
+}
+
+static int microread_xmit(struct nfc_hci_dev *hdev, struct sk_buff *skb)
+{
+        struct microread_info *info = nfc_hci_get_clientdata(hdev);
+
+        return info->phy_ops->write(info->phy_id, skb);
+}
+
+static int microread_start_poll(struct nfc_hci_dev *hdev,
+                                u32 im_protocols, u32 tm_protocols)
+{
+        int r;
+
+        u8 param[2];
+        u8 mode;
+
+        param[0] = 0x00;
+        param[1] = 0x00;
+
+        if (im_protocols & NFC_PROTO_ISO14443_MASK)
+                param[0] |= (1 << 2);
+
+        if (im_protocols & NFC_PROTO_ISO14443_B_MASK)
+                param[0] |= 1;
+
+        if (im_protocols & NFC_PROTO_MIFARE_MASK)
+                param[1] |= 1;
+
+        if (im_protocols & NFC_PROTO_JEWEL_MASK)
+                param[0] |= (1 << 1);
+
+        if (im_protocols & NFC_PROTO_FELICA_MASK)
+                param[0] |= (1 << 5);
+
+        if (im_protocols & NFC_PROTO_NFC_DEP_MASK)
+                param[1] |= (1 << 1);
+
+        if ((im_protocols | tm_protocols) & NFC_PROTO_NFC_DEP_MASK) {
+                hdev->gb = nfc_get_local_general_bytes(hdev->ndev,
+                                                       &hdev->gb_len);
+                if (hdev->gb == NULL || hdev->gb_len == 0) {
+                        im_protocols &= ~NFC_PROTO_NFC_DEP_MASK;
+                        tm_protocols &= ~NFC_PROTO_NFC_DEP_MASK;
+                }
+        }
+
+        r = nfc_hci_send_event(hdev, MICROREAD_GATE_ID_MREAD_ISO_A,
+                               MICROREAD_EVT_MREAD_DISCOVERY_STOP, NULL, 0);
+        if (r)
+                return r;
+
+        mode = 0xff;
+        r = nfc_hci_set_param(hdev, MICROREAD_GATE_ID_P2P_TARGET,
+                              MICROREAD_PAR_P2P_TARGET_MODE, &mode, 1);
+        if (r)
+                return r;
+
+        if (im_protocols & NFC_PROTO_NFC_DEP_MASK) {
+                r = nfc_hci_set_param(hdev, MICROREAD_GATE_ID_P2P_INITIATOR,
+                                      MICROREAD_PAR_P2P_INITIATOR_GI,
+                                      hdev->gb, hdev->gb_len);
+                if (r)
+                        return r;
+        }
+
+        if (tm_protocols & NFC_PROTO_NFC_DEP_MASK) {
+                r = nfc_hci_set_param(hdev, MICROREAD_GATE_ID_P2P_TARGET,
+                                      MICROREAD_PAR_P2P_TARGET_GT,
+                                      hdev->gb, hdev->gb_len);
+                if (r)
+                        return r;
+
+                mode = 0x02;
+                r = nfc_hci_set_param(hdev, MICROREAD_GATE_ID_P2P_TARGET,
+                                      MICROREAD_PAR_P2P_TARGET_MODE, &mode, 1);
+                if (r)
+                        return r;
+        }
+
+        return nfc_hci_send_event(hdev, MICROREAD_GATE_ID_MREAD_ISO_A,
+                                  MICROREAD_EVT_MREAD_DISCOVERY_START_SOME,
+                                  param, 2);
+}
+
+static int microread_dep_link_up(struct nfc_hci_dev *hdev,
+                                struct nfc_target *target, u8 comm_mode,
+                                u8 *gb, size_t gb_len)
+{
+        struct sk_buff *rgb_skb = NULL;
+        int r;
+
+        r = nfc_hci_get_param(hdev, target->hci_reader_gate,
+                              MICROREAD_PAR_P2P_INITIATOR_GT, &rgb_skb);
+        if (r < 0)
+                return r;
+
+        if (rgb_skb->len == 0 || rgb_skb->len > NFC_GB_MAXSIZE) {
+                r = -EPROTO;
+                goto exit;
+        }
+
+        r = nfc_set_remote_general_bytes(hdev->ndev, rgb_skb->data,
+                                         rgb_skb->len);
+        if (r == 0)
+                r = nfc_dep_link_is_up(hdev->ndev, target->idx, comm_mode,
+                                       NFC_RF_INITIATOR);
+exit:
+        kfree_skb(rgb_skb);
+
+        return r;
+}
+
+static int microread_dep_link_down(struct nfc_hci_dev *hdev)
+{
+        return nfc_hci_send_event(hdev, MICROREAD_GATE_ID_P2P_INITIATOR,
+                                  MICROREAD_EVT_MREAD_DISCOVERY_STOP, NULL, 0);
+}
+
+static int microread_target_from_gate(struct nfc_hci_dev *hdev, u8 gate,
+                                      struct nfc_target *target)
+{
+        switch (gate) {
+        case MICROREAD_GATE_ID_P2P_INITIATOR:
+                target->supported_protocols = NFC_PROTO_NFC_DEP_MASK;
+                break;
+        default:
+                return -EPROTO;
+        }
+
+        return 0;
+}
+
+static int microread_complete_target_discovered(struct nfc_hci_dev *hdev,
+                                                u8 gate,
+                                                struct nfc_target *target)
+{
+        return 0;
+}
+
+#define MICROREAD_CB_TYPE_READER_ALL 1
+
+static void microread_im_transceive_cb(void *context, struct sk_buff *skb,
+                                       int err)
+{
+        struct microread_info *info = context;
+
+        switch (info->async_cb_type) {
+        case MICROREAD_CB_TYPE_READER_ALL:
+                if (err == 0) {
+                        if (skb->len == 0) {
+                                err = -EPROTO;
+                                kfree_skb(skb);
+                                info->async_cb(info->async_cb_context, NULL,
+                                               -EPROTO);
+                                return;
+                        }
+
+                        if (skb->data[skb->len - 1] != 0) {
+                                err = nfc_hci_result_to_errno(
+                                                       skb->data[skb->len - 1]);
+                                kfree_skb(skb);
+                                info->async_cb(info->async_cb_context, NULL,
+                                               err);
+                                return;
+                        }
+
+                        skb_trim(skb, skb->len - 1);    /* RF Error ind. */
+                }
+                info->async_cb(info->async_cb_context, skb, err);
+                break;
+        default:
+                if (err == 0)
+                        kfree_skb(skb);
+                break;
+        }
+}
+
+/*
+ * Returns:
+ * <= 0: driver handled the data exchange
+ *    1: driver doesn't especially handle, please do standard processing
+ */
+static int microread_im_transceive(struct nfc_hci_dev *hdev,
+                                   struct nfc_target *target,
+                                   struct sk_buff *skb, data_exchange_cb_t cb,
+                                   void *cb_context)
+{
+        struct microread_info *info = nfc_hci_get_clientdata(hdev);
+        u8 control_bits;
+        u16 crc;
+
+        pr_info("data exchange to gate 0x%x\n", target->hci_reader_gate);
+
+        if (target->hci_reader_gate == MICROREAD_GATE_ID_P2P_INITIATOR) {
+                *skb_push(skb, 1) = 0;
+
+                return nfc_hci_send_event(hdev, target->hci_reader_gate,
+                                     MICROREAD_EVT_P2P_INITIATOR_EXCHANGE_TO_RF,
+                                     skb->data, skb->len);
+        }
+
+        switch (target->hci_reader_gate) {
+        case MICROREAD_GATE_ID_MREAD_ISO_A:
+                control_bits = 0xCB;
+                break;
+        case MICROREAD_GATE_ID_MREAD_ISO_A_3:
+                control_bits = 0xCB;
+                break;
+        case MICROREAD_GATE_ID_MREAD_ISO_B:
+                control_bits = 0xCB;
+                break;
+        case MICROREAD_GATE_ID_MREAD_NFC_T1:
+                control_bits = 0x1B;
+
+                crc = crc_ccitt(0xffff, skb->data, skb->len);
+                crc = ~crc;
+                *skb_put(skb, 1) = crc & 0xff;
+                *skb_put(skb, 1) = crc >> 8;
+                break;
+        case MICROREAD_GATE_ID_MREAD_NFC_T3:
+                control_bits = 0xDB;
+                break;
+        default:
+                pr_info("Abort im_transceive to invalid gate 0x%x\n",
+                        target->hci_reader_gate);
+                return 1;
+        }
+
+        *skb_push(skb, 1) = control_bits;
+
+        info->async_cb_type = MICROREAD_CB_TYPE_READER_ALL;
+        info->async_cb = cb;
+        info->async_cb_context = cb_context;
+
+        return nfc_hci_send_cmd_async(hdev, target->hci_reader_gate,
+                                      MICROREAD_CMD_MREAD_EXCHANGE,
+                                      skb->data, skb->len,
+                                      microread_im_transceive_cb, info);
+}
+
+static int microread_tm_send(struct nfc_hci_dev *hdev, struct sk_buff *skb)
+{
+        int r;
+
+        r = nfc_hci_send_event(hdev, MICROREAD_GATE_ID_P2P_TARGET,
+                               MICROREAD_EVT_MCARD_EXCHANGE,
+                               skb->data, skb->len);
+
+        kfree_skb(skb);
+
+        return r;
+}
+
+static void microread_target_discovered(struct nfc_hci_dev *hdev, u8 gate,
+                                        struct sk_buff *skb)
+{
+        struct nfc_target *targets;
+        int r = 0;
+
+        pr_info("target discovered to gate 0x%x\n", gate);
+
+        targets = kzalloc(sizeof(struct nfc_target), GFP_KERNEL);
+        if (targets == NULL) {
+                r = -ENOMEM;
+                goto exit;
+        }
+
+        targets->hci_reader_gate = gate;
+
+        switch (gate) {
+        case MICROREAD_GATE_ID_MREAD_ISO_A:
+                targets->supported_protocols =
+                      nfc_hci_sak_to_protocol(skb->data[MICROREAD_EMCF_A_SAK]);
+                targets->sens_res =
+                         be16_to_cpu(*(u16 *)&skb->data[MICROREAD_EMCF_A_ATQA]);
+                targets->sel_res = skb->data[MICROREAD_EMCF_A_SAK];
+                memcpy(targets->nfcid1, &skb->data[MICROREAD_EMCF_A_UID],
+                       skb->data[MICROREAD_EMCF_A_LEN]);
+                targets->nfcid1_len = skb->data[MICROREAD_EMCF_A_LEN];
+                break;
+        case MICROREAD_GATE_ID_MREAD_ISO_A_3:
+                targets->supported_protocols =
+                      nfc_hci_sak_to_protocol(skb->data[MICROREAD_EMCF_A3_SAK]);
+                targets->sens_res =
+                         be16_to_cpu(*(u16 *)&skb->data[MICROREAD_EMCF_A3_ATQA]);
+                targets->sel_res = skb->data[MICROREAD_EMCF_A3_SAK];
+                memcpy(targets->nfcid1, &skb->data[MICROREAD_EMCF_A3_UID],
+                       skb->data[MICROREAD_EMCF_A3_LEN]);
+                targets->nfcid1_len = skb->data[MICROREAD_EMCF_A3_LEN];
+                break;
+        case MICROREAD_GATE_ID_MREAD_ISO_B:
+                targets->supported_protocols = NFC_PROTO_ISO14443_B_MASK;
+                memcpy(targets->nfcid1, &skb->data[MICROREAD_EMCF_B_UID], 4);
+                targets->nfcid1_len = 4;
+                break;
+        case MICROREAD_GATE_ID_MREAD_NFC_T1:
+                targets->supported_protocols = NFC_PROTO_JEWEL_MASK;
+                targets->sens_res =
+                        le16_to_cpu(*(u16 *)&skb->data[MICROREAD_EMCF_T1_ATQA]);
+                memcpy(targets->nfcid1, &skb->data[MICROREAD_EMCF_T1_UID], 4);
+                targets->nfcid1_len = 4;
+                break;
+        case MICROREAD_GATE_ID_MREAD_NFC_T3:
+                targets->supported_protocols = NFC_PROTO_FELICA_MASK;
+                memcpy(targets->nfcid1, &skb->data[MICROREAD_EMCF_T3_UID], 8);
+                targets->nfcid1_len = 8;
+                break;
+        default:
+                pr_info("discard target discovered to gate 0x%x\n", gate);
+                goto exit_free;
+        }
+
+        r = nfc_targets_found(hdev->ndev, targets, 1);
+
+exit_free:
+        kfree(targets);
+
+exit:
+        kfree_skb(skb);
+
+        if (r)
+                pr_err("Failed to handle discovered target err=%d", r);
+}
+
+static int microread_event_received(struct nfc_hci_dev *hdev, u8 gate,
+                                     u8 event, struct sk_buff *skb)
+{
+        int r;
+        u8 mode;
+
+        pr_info("Microread received event 0x%x to gate 0x%x\n", event, gate);
+
+        switch (event) {
+        case MICROREAD_EVT_MREAD_CARD_FOUND:
+                microread_target_discovered(hdev, gate, skb);
+                return 0;
+
+        case MICROREAD_EVT_P2P_INITIATOR_EXCHANGE_FROM_RF:
+                if (skb->len < 1) {
+                        kfree_skb(skb);
+                        return -EPROTO;
+                }
+
+                if (skb->data[skb->len - 1]) {
+                        kfree_skb(skb);
+                        return -EIO;
+                }
+
+                skb_trim(skb, skb->len - 1);
+
+                r = nfc_tm_data_received(hdev->ndev, skb);
+                break;
+
+        case MICROREAD_EVT_MCARD_FIELD_ON:
+        case MICROREAD_EVT_MCARD_FIELD_OFF:
+                kfree_skb(skb);
+                return 0;
+
+        case MICROREAD_EVT_P2P_TARGET_ACTIVATED:
+                r = nfc_tm_activated(hdev->ndev, NFC_PROTO_NFC_DEP_MASK,
+                                     NFC_COMM_PASSIVE, skb->data,
+                                     skb->len);
+
+                kfree_skb(skb);
+                break;
+
+        case MICROREAD_EVT_MCARD_EXCHANGE:
+                if (skb->len < 1) {
+                        kfree_skb(skb);
+                        return -EPROTO;
+                }
+
+                if (skb->data[skb->len-1]) {
+                        kfree_skb(skb);
+                        return -EIO;
+                }
+
+                skb_trim(skb, skb->len - 1);
+
+                r = nfc_tm_data_received(hdev->ndev, skb);
+                break;
+
+        case MICROREAD_EVT_P2P_TARGET_DEACTIVATED:
+                kfree_skb(skb);
+
+                mode = 0xff;
+                r = nfc_hci_set_param(hdev, MICROREAD_GATE_ID_P2P_TARGET,
+                                      MICROREAD_PAR_P2P_TARGET_MODE, &mode, 1);
+                if (r)
+                        break;
+
+                r = nfc_hci_send_event(hdev, gate,
+                                       MICROREAD_EVT_MREAD_DISCOVERY_STOP, NULL,
+                                       0);
+                break;
+
+        default:
+                return 1;
+        }
+
+        return r;
+}
+
+static struct nfc_hci_ops microread_hci_ops = {
+        .open = microread_open,
+        .close = microread_close,
+        .hci_ready = microread_hci_ready,
+        .xmit = microread_xmit,
+        .start_poll = microread_start_poll,
+        .dep_link_up = microread_dep_link_up,
+        .dep_link_down = microread_dep_link_down,
+        .target_from_gate = microread_target_from_gate,
+        .complete_target_discovered = microread_complete_target_discovered,
+        .im_transceive = microread_im_transceive,
+        .tm_send = microread_tm_send,
+        .check_presence = NULL,
+        .event_received = microread_event_received,
+};
+
+int microread_probe(void *phy_id, struct nfc_phy_ops *phy_ops, char *llc_name,
+                    int phy_headroom, int phy_tailroom, int phy_payload,
+                    struct nfc_hci_dev **hdev)
+{
+        struct microread_info *info;
+        unsigned long quirks = 0;
+        u32 protocols, se;
+        struct nfc_hci_init_data init_data;
+        int r;
+
+        info = kzalloc(sizeof(struct microread_info), GFP_KERNEL);
+        if (!info) {
+                pr_err("Cannot allocate memory for microread_info.\n");
+                r = -ENOMEM;
+                goto err_info_alloc;
+        }
+
+        info->phy_ops = phy_ops;
+        info->phy_id = phy_id;
+
+        init_data.gate_count = ARRAY_SIZE(microread_gates);
+        memcpy(init_data.gates, microread_gates, sizeof(microread_gates));
+
+        strcpy(init_data.session_id, "MICROREA");
+
+        set_bit(NFC_HCI_QUIRK_SHORT_CLEAR, &quirks);
+
+        protocols = NFC_PROTO_JEWEL_MASK |
+                    NFC_PROTO_MIFARE_MASK |
+                    NFC_PROTO_FELICA_MASK |
+                    NFC_PROTO_ISO14443_MASK |
+                    NFC_PROTO_ISO14443_B_MASK |
+                    NFC_PROTO_NFC_DEP_MASK;
+
+        se = NFC_SE_UICC | NFC_SE_EMBEDDED;
+
+        info->hdev = nfc_hci_allocate_device(&microread_hci_ops, &init_data,
+                                             quirks, protocols, se, llc_name,
+                                             phy_headroom +
+                                             MICROREAD_CMDS_HEADROOM,
+                                             phy_tailroom +
+                                             MICROREAD_CMD_TAILROOM,
+                                             phy_payload);
+        if (!info->hdev) {
+                pr_err("Cannot allocate nfc hdev.\n");
+                r = -ENOMEM;
+                goto err_alloc_hdev;
+        }
+
+        nfc_hci_set_clientdata(info->hdev, info);
+
+        r = nfc_hci_register_device(info->hdev);
+        if (r)
+                goto err_regdev;
+
+        *hdev = info->hdev;
+
+        return 0;
+
+err_regdev:
+        nfc_hci_free_device(info->hdev);
+
+err_alloc_hdev:
+        kfree(info);
+
+err_info_alloc:
+        return r;
+}
+EXPORT_SYMBOL(microread_probe);
+
+void microread_remove(struct nfc_hci_dev *hdev)
+{
+        struct microread_info *info = nfc_hci_get_clientdata(hdev);
+
+        nfc_hci_unregister_device(hdev);
+        nfc_hci_free_device(hdev);
+        kfree(info);
+}
+EXPORT_SYMBOL(microread_remove);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION(DRIVER_DESC);
diff --git a/drivers/nfc/microread/microread.h b/drivers/nfc/microread/microread.h
new file mode 100644
index 000000000000..64b447a1c5bf
--- /dev/null
+++ b/drivers/nfc/microread/microread.h
@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2011 - 2012  Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the
+ * Free Software Foundation, Inc.,
+ * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+#ifndef __LOCAL_MICROREAD_H_
+#define __LOCAL_MICROREAD_H_
+
+#include <net/nfc/hci.h>
+
+#define DRIVER_DESC "NFC driver for microread"
+
+int microread_probe(void *phy_id, struct nfc_phy_ops *phy_ops, char *llc_name,
+                    int phy_headroom, int phy_tailroom, int phy_payload,
+                    struct nfc_hci_dev **hdev);
+
+void microread_remove(struct nfc_hci_dev *hdev);
+
+#endif /* __LOCAL_MICROREAD_H_ */
diff --git a/drivers/nfc/pn533.c b/drivers/nfc/pn533.c
index f696318cfb51..f0f6763d67ae 100644
--- a/drivers/nfc/pn533.c
+++ b/drivers/nfc/pn533.c
@@ -219,7 +219,7 @@ struct pn533_poll_modulations {
         u8 len;
 };
 
-const struct pn533_poll_modulations poll_mod[] = {
+static const struct pn533_poll_modulations poll_mod[] = {
         [PN533_POLL_MOD_106KBPS_A] = {
                 .data = {
                         .maxtg = 1,
@@ -485,7 +485,7 @@ static u8 pn533_get_cmd_code(void *frame)
         return PN533_FRAME_CMD(f);
 }
 
-struct pn533_frame_ops pn533_std_frame_ops = {
+static struct pn533_frame_ops pn533_std_frame_ops = {
         .tx_frame_init = pn533_tx_frame_init,
         .tx_frame_finish = pn533_tx_frame_finish,
         .tx_update_payload_len = pn533_tx_update_payload_len,
@@ -532,7 +532,6 @@ static void pn533_recv_response(struct urb *urb)
                             urb->status);
                 dev->wq_in_error = urb->status;
                 goto sched_wq;
-                break;
         case -ESHUTDOWN:
         default:
                 nfc_dev_err(&dev->interface->dev,
@@ -589,7 +588,6 @@ static void pn533_recv_ack(struct urb *urb)
                             urb->status);
                 dev->wq_in_error = urb->status;
                 goto sched_wq;
-                break;
         case -ESHUTDOWN:
         default:
                 nfc_dev_err(&dev->interface->dev,
@@ -1380,7 +1378,7 @@ static struct sk_buff *pn533_alloc_poll_tg_frame(struct pn533 *dev)
                 return NULL;
 
         /* DEP support only */
-        *skb_put(skb, 1) |= PN533_INIT_TARGET_DEP;
+        *skb_put(skb, 1) = PN533_INIT_TARGET_DEP;
 
         /* MIFARE params */
         memcpy(skb_put(skb, 6), mifare_params, 6);
diff --git a/drivers/staging/wlan-ng/cfg80211.c b/drivers/staging/wlan-ng/cfg80211.c
index 1d31eab19d16..f1bce18ea828 100644
--- a/drivers/staging/wlan-ng/cfg80211.c
+++ b/drivers/staging/wlan-ng/cfg80211.c
@@ -424,7 +424,7 @@ int prism2_scan(struct wiphy *wiphy, struct cfg80211_scan_request *request)
                         goto exit;
                 }
 
-                cfg80211_put_bss(bss);
+                cfg80211_put_bss(wiphy, bss);
         }
 
         if (result)
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index 11c8bc87fdcb..7e24fe0cfbcd 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -151,6 +151,11 @@
 /* Mesh Control 802.11s */
 #define IEEE80211_QOS_CTL_MESH_CONTROL_PRESENT  0x0100
 
+/* Mesh Power Save Level */
+#define IEEE80211_QOS_CTL_MESH_PS_LEVEL         0x0200
+/* Mesh Receiver Service Period Initiated */
+#define IEEE80211_QOS_CTL_RSPI                  0x0400
+
 /* U-APSD queue for WMM IEs sent by AP */
 #define IEEE80211_WMM_IE_AP_QOSINFO_UAPSD       (1<<7)
 #define IEEE80211_WMM_IE_AP_QOSINFO_PARAM_SET_CNT_MASK  0x0f
@@ -675,11 +680,14 @@ struct ieee80211_meshconf_ie {
  * @IEEE80211_MESHCONF_CAPAB_FORWARDING: the STA forwards MSDUs
  * @IEEE80211_MESHCONF_CAPAB_TBTT_ADJUSTING: TBTT adjustment procedure
  *      is ongoing
+ * @IEEE80211_MESHCONF_CAPAB_POWER_SAVE_LEVEL: STA is in deep sleep mode or has
+ *      neighbors in deep sleep mode
  */
 enum mesh_config_capab_flags {
         IEEE80211_MESHCONF_CAPAB_ACCEPT_PLINKS          = 0x01,
         IEEE80211_MESHCONF_CAPAB_FORWARDING             = 0x08,
         IEEE80211_MESHCONF_CAPAB_TBTT_ADJUSTING         = 0x20,
+        IEEE80211_MESHCONF_CAPAB_POWER_SAVE_LEVEL       = 0x40,
 };
 
 /**
@@ -706,6 +714,30 @@ enum ieee80211_ht_chanwidth_values {
         IEEE80211_HT_CHANWIDTH_ANY = 1,
 };
 
+/**
+ * enum ieee80211_opmode_bits - VHT operating mode field bits
+ * @IEEE80211_OPMODE_NOTIF_CHANWIDTH_MASK: channel width mask
+ * @IEEE80211_OPMODE_NOTIF_CHANWIDTH_20MHZ: 20 MHz channel width
+ * @IEEE80211_OPMODE_NOTIF_CHANWIDTH_40MHZ: 40 MHz channel width
+ * @IEEE80211_OPMODE_NOTIF_CHANWIDTH_80MHZ: 80 MHz channel width
+ * @IEEE80211_OPMODE_NOTIF_CHANWIDTH_160MHZ: 160 MHz or 80+80 MHz channel width
+ * @IEEE80211_OPMODE_NOTIF_RX_NSS_MASK: number of spatial streams mask
+ *      (the NSS value is the value of this field + 1)
+ * @IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT: number of spatial streams shift
+ * @IEEE80211_OPMODE_NOTIF_RX_NSS_TYPE_BF: indicates streams in SU-MIMO PPDU
+ *      using a beamforming steering matrix
+ */
+enum ieee80211_vht_opmode_bits {
+        IEEE80211_OPMODE_NOTIF_CHANWIDTH_MASK   = 3,
+        IEEE80211_OPMODE_NOTIF_CHANWIDTH_20MHZ  = 0,
+        IEEE80211_OPMODE_NOTIF_CHANWIDTH_40MHZ  = 1,
+        IEEE80211_OPMODE_NOTIF_CHANWIDTH_80MHZ  = 2,
+        IEEE80211_OPMODE_NOTIF_CHANWIDTH_160MHZ = 3,
+        IEEE80211_OPMODE_NOTIF_RX_NSS_MASK      = 0x70,
+        IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT     = 4,
+        IEEE80211_OPMODE_NOTIF_RX_NSS_TYPE_BF   = 0x80,
+};
+
 #define WLAN_SA_QUERY_TR_ID_LEN 2
 
 struct ieee80211_mgmt {
@@ -836,6 +868,10 @@ struct ieee80211_mgmt {
                                         __le16 capability;
                                         u8 variable[0];
                                 } __packed tdls_discover_resp;
+                                struct {
+                                        u8 action_code;
+                                        u8 operating_mode;
+                                } __packed vht_opmode_notif;
                         } u;
                 } __packed action;
         } u;
@@ -1265,6 +1301,7 @@ struct ieee80211_vht_operation {
 #define IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454                 0x00000002
 #define IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ                0x00000004
 #define IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ       0x00000008
+#define IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK                  0x0000000C
 #define IEEE80211_VHT_CAP_RXLDPC                                0x00000010
 #define IEEE80211_VHT_CAP_SHORT_GI_80                           0x00000020
 #define IEEE80211_VHT_CAP_SHORT_GI_160                          0x00000040
@@ -1590,6 +1627,7 @@ enum ieee80211_eid {
 
         WLAN_EID_VHT_CAPABILITY = 191,
         WLAN_EID_VHT_OPERATION = 192,
+        WLAN_EID_OPMODE_NOTIF = 199,
 
         /* 802.11ad */
         WLAN_EID_NON_TX_BSSID_CAP =  83,
@@ -1644,6 +1682,7 @@ enum ieee80211_category {
         WLAN_CATEGORY_WMM = 17,
         WLAN_CATEGORY_FST = 18,
         WLAN_CATEGORY_UNPROT_DMG = 20,
+        WLAN_CATEGORY_VHT = 21,
         WLAN_CATEGORY_VENDOR_SPECIFIC_PROTECTED = 126,
         WLAN_CATEGORY_VENDOR_SPECIFIC = 127,
 };
@@ -1669,6 +1708,13 @@ enum ieee80211_ht_actioncode {
         WLAN_HT_ACTION_ASEL_IDX_FEEDBACK = 7,
 };
 
+/* VHT action codes */
+enum ieee80211_vht_actioncode {
+        WLAN_VHT_ACTION_COMPRESSED_BF = 0,
+        WLAN_VHT_ACTION_GROUPID_MGMT = 1,
+        WLAN_VHT_ACTION_OPMODE_NOTIF = 2,
+};
+
 /* Self Protected Action codes */
 enum ieee80211_self_protected_actioncode {
         WLAN_SP_RESERVED = 0,
@@ -1730,6 +1776,8 @@ enum ieee80211_tdls_actioncode {
 #define WLAN_EXT_CAPA5_TDLS_ENABLED     BIT(5)
 #define WLAN_EXT_CAPA5_TDLS_PROHIBITED  BIT(6)
 
+#define WLAN_EXT_CAPA8_OPMODE_NOTIF     BIT(6)
+
 /* TDLS specific payload type in the LLC/SNAP header */
 #define WLAN_TDLS_SNAP_RFTYPE   0x2
 
@@ -2106,7 +2154,7 @@ static inline unsigned long ieee80211_tu_to_usec(unsigned long tu)
  * @tim_len: length of the TIM IE
  * @aid: the AID to look for
  */
-static inline bool ieee80211_check_tim(struct ieee80211_tim_ie *tim,
+static inline bool ieee80211_check_tim(const struct ieee80211_tim_ie *tim,
                                        u8 tim_len, u16 aid)
 {
         u8 mask;
diff --git a/include/linux/platform_data/microread.h b/include/linux/platform_data/microread.h
new file mode 100644
index 000000000000..cfda59b226ee
--- /dev/null
+++ b/include/linux/platform_data/microread.h
@@ -0,0 +1,35 @@
+/*
+ * Driver include for the PN544 NFC chip.
+ *
+ * Copyright (C) 2011 Tieto Poland
+ * Copyright (C) 2012 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
+#ifndef _MICROREAD_H
+#define _MICROREAD_H
+
+#include <linux/i2c.h>
+
+#define MICROREAD_DRIVER_NAME   "microread"
+
+/* board config platform data for microread */
+struct microread_nfc_platform_data {
+        unsigned int rst_gpio;
+        unsigned int irq_gpio;
+        unsigned int ioh_gpio;
+};
+
+#endif /* _MICROREAD_H */
diff --git a/include/linux/wl12xx.h b/include/linux/wl12xx.h
index 0d6373195d32..a54fe82e704b 100644
--- a/include/linux/wl12xx.h
+++ b/include/linux/wl12xx.h
@@ -24,6 +24,8 @@
 #ifndef _LINUX_WL12XX_H
 #define _LINUX_WL12XX_H
 
+#include <linux/err.h>
+
 /* Reference clock values */
 enum {
         WL12XX_REFCLOCK_19      = 0, /* 19.2 MHz */
@@ -55,17 +57,17 @@ struct wl12xx_platform_data {
         int board_tcxo_clock;
         unsigned long platform_quirks;
         bool pwr_in_suspend;
-
-        struct wl1271_if_operations *ops;
 };
 
 /* Platform does not support level trigger interrupts */
 #define WL12XX_PLATFORM_QUIRK_EDGE_IRQ  BIT(0)
 
-#ifdef CONFIG_WL12XX_PLATFORM_DATA
+#ifdef CONFIG_WILINK_PLATFORM_DATA
 
 int wl12xx_set_platform_data(const struct wl12xx_platform_data *data);
 
+struct wl12xx_platform_data *wl12xx_get_platform_data(void);
+
 #else
 
 static inline
@@ -74,8 +76,12 @@ int wl12xx_set_platform_data(const struct wl12xx_platform_data *data)
         return -ENOSYS;
 }
 
-#endif
+static inline
+struct wl12xx_platform_data *wl12xx_get_platform_data(void)
+{
+        return ERR_PTR(-ENODATA);
+}
 
-struct wl12xx_platform_data *wl12xx_get_platform_data(void);
+#endif
 
 #endif
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index f9df20028bbd..d581c6de5d64 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -19,6 +19,7 @@
 #include <linux/nl80211.h>
 #include <linux/if_ether.h>
 #include <linux/ieee80211.h>
+#include <linux/net.h>
 #include <net/regulatory.h>
 
 /**
@@ -99,6 +100,16 @@ enum ieee80211_band {
  * @IEEE80211_CHAN_NO_HT40MINUS: extension channel below this channel
  *      is not permitted.
  * @IEEE80211_CHAN_NO_OFDM: OFDM is not allowed on this channel.
+ * @IEEE80211_CHAN_NO_80MHZ: If the driver supports 80 MHz on the band,
+ *      this flag indicates that an 80 MHz channel cannot use this
+ *      channel as the control or any of the secondary channels.
+ *      This may be due to the driver or due to regulatory bandwidth
+ *      restrictions.
+ * @IEEE80211_CHAN_NO_160MHZ: If the driver supports 160 MHz on the band,
+ *      this flag indicates that an 160 MHz channel cannot use this
+ *      channel as the control or any of the secondary channels.
+ *      This may be due to the driver or due to regulatory bandwidth
+ *      restrictions.
  */
 enum ieee80211_channel_flags {
         IEEE80211_CHAN_DISABLED         = 1<<0,
@@ -108,11 +119,16 @@ enum ieee80211_channel_flags {
         IEEE80211_CHAN_NO_HT40PLUS      = 1<<4,
         IEEE80211_CHAN_NO_HT40MINUS     = 1<<5,
         IEEE80211_CHAN_NO_OFDM          = 1<<6,
+        IEEE80211_CHAN_NO_80MHZ         = 1<<7,
+        IEEE80211_CHAN_NO_160MHZ        = 1<<8,
 };
 
 #define IEEE80211_CHAN_NO_HT40 \
         (IEEE80211_CHAN_NO_HT40PLUS | IEEE80211_CHAN_NO_HT40MINUS)
 
+#define IEEE80211_DFS_MIN_CAC_TIME_MS           60000
+#define IEEE80211_DFS_MIN_NOP_TIME_MS           (30 * 60 * 1000)
+
 /**
  * struct ieee80211_channel - channel definition
  *
@@ -133,6 +149,9 @@ enum ieee80211_channel_flags {
  *      to enable this, this is useful only on 5 GHz band.
  * @orig_mag: internal use
  * @orig_mpwr: internal use
+ * @dfs_state: current state of this channel. Only relevant if radar is required
+ *      on this channel.
+ * @dfs_state_entered: timestamp (jiffies) when the dfs state was entered.
  */
 struct ieee80211_channel {
         enum ieee80211_band band;
@@ -145,6 +164,8 @@ struct ieee80211_channel {
         bool beacon_found;
         u32 orig_flags;
         int orig_mag, orig_mpwr;
+        enum nl80211_dfs_state dfs_state;
+        unsigned long dfs_state_entered;
 };
 
 /**
@@ -535,7 +556,7 @@ struct mac_address {
  * struct cfg80211_acl_data - Access control list data
  *
  * @acl_policy: ACL policy to be applied on the station's
-        entry specified by mac_addr
+ *      entry specified by mac_addr
  * @n_acl_entries: Number of MAC address entries passed
  * @mac_addrs: List of MAC addresses of stations to be used for ACL
  */
@@ -568,6 +589,7 @@ struct cfg80211_acl_data {
  * @p2p_opp_ps: P2P opportunistic PS
  * @acl: ACL configuration used by the drivers which has support for
  *      MAC address based access control
+ * @radar_required: set if radar detection is required
  */
 struct cfg80211_ap_settings {
         struct cfg80211_chan_def chandef;
@@ -585,6 +607,7 @@ struct cfg80211_ap_settings {
         u8 p2p_ctwindow;
         bool p2p_opp_ps;
         const struct cfg80211_acl_data *acl;
+        bool radar_required;
 };
 
 /**
@@ -603,12 +626,14 @@ enum plink_actions {
 /**
  * enum station_parameters_apply_mask - station parameter values to apply
  * @STATION_PARAM_APPLY_UAPSD: apply new uAPSD parameters (uapsd_queues, max_sp)
+ * @STATION_PARAM_APPLY_CAPABILITY: apply new capability
  *
  * Not all station parameters have in-band "no change" signalling,
  * for those that don't these flags will are used.
  */
 enum station_parameters_apply_mask {
         STATION_PARAM_APPLY_UAPSD = BIT(0),
+        STATION_PARAM_APPLY_CAPABILITY = BIT(1),
 };
 
 /**
@@ -639,6 +664,9 @@ enum station_parameters_apply_mask {
  *      see &enum station_parameters_apply_mask
  * @local_pm: local link-specific mesh power save mode (no change when set
  *      to unknown)
+ * @capability: station capability
+ * @ext_capab: extended capabilities of the station
+ * @ext_capab_len: number of extended capabilities
  */
 struct station_parameters {
         u8 *supported_rates;
@@ -655,6 +683,9 @@ struct station_parameters {
         u8 uapsd_queues;
         u8 max_sp;
         enum nl80211_mesh_power_mode local_pm;
+        u16 capability;
+        u8 *ext_capab;
+        u8 ext_capab_len;
 };
 
 /**
@@ -666,14 +697,16 @@ struct station_parameters {
  * @STATION_INFO_INACTIVE_TIME: @inactive_time filled
  * @STATION_INFO_RX_BYTES: @rx_bytes filled
  * @STATION_INFO_TX_BYTES: @tx_bytes filled
+ * @STATION_INFO_RX_BYTES64: @rx_bytes filled with 64-bit value
+ * @STATION_INFO_TX_BYTES64: @tx_bytes filled with 64-bit value
  * @STATION_INFO_LLID: @llid filled
  * @STATION_INFO_PLID: @plid filled
  * @STATION_INFO_PLINK_STATE: @plink_state filled
  * @STATION_INFO_SIGNAL: @signal filled
  * @STATION_INFO_TX_BITRATE: @txrate fields are filled
  *  (tx_bitrate, tx_bitrate_flags and tx_bitrate_mcs)
- * @STATION_INFO_RX_PACKETS: @rx_packets filled
- * @STATION_INFO_TX_PACKETS: @tx_packets filled
+ * @STATION_INFO_RX_PACKETS: @rx_packets filled with 32-bit value
+ * @STATION_INFO_TX_PACKETS: @tx_packets filled with 32-bit value
  * @STATION_INFO_TX_RETRIES: @tx_retries filled
  * @STATION_INFO_TX_FAILED: @tx_failed filled
  * @STATION_INFO_RX_DROP_MISC: @rx_dropped_misc filled
@@ -714,6 +747,8 @@ enum station_info_flags {
         STATION_INFO_LOCAL_PM           = 1<<21,
         STATION_INFO_PEER_PM            = 1<<22,
         STATION_INFO_NONPEER_PM         = 1<<23,
+        STATION_INFO_RX_BYTES64         = 1<<24,
+        STATION_INFO_TX_BYTES64         = 1<<25,
 };
 
 /**
@@ -835,8 +870,8 @@ struct station_info {
         u32 filled;
         u32 connected_time;
         u32 inactive_time;
-        u32 rx_bytes;
-        u32 tx_bytes;
+        u64 rx_bytes;
+        u64 tx_bytes;
         u16 llid;
         u16 plid;
         u8 plink_state;
@@ -1222,6 +1257,7 @@ struct cfg80211_match_set {
  * @n_match_sets: number of match sets
  * @wiphy: the wiphy this was for
  * @dev: the interface
+ * @scan_start: start time of the scheduled scan
  * @channels: channels to scan
  * @rssi_thold: don't report scan results below this threshold (in s32 dBm)
  */
@@ -1261,11 +1297,13 @@ enum cfg80211_signal_type {
 
 /**
  * struct cfg80211_bss_ie_data - BSS entry IE data
+ * @tsf: TSF contained in the frame that carried these IEs
  * @rcu_head: internal use, for freeing
  * @len: length of the IEs
  * @data: IE data
  */
 struct cfg80211_bss_ies {
+        u64 tsf;
         struct rcu_head rcu_head;
         int len;
         u8 data[];
@@ -1279,29 +1317,32 @@ struct cfg80211_bss_ies {
  *
  * @channel: channel this BSS is on
  * @bssid: BSSID of the BSS
- * @tsf: timestamp of last received update
  * @beacon_interval: the beacon interval as from the frame
  * @capability: the capability field in host byte order
- * @ies: the information elements (Note that there
- *      is no guarantee that these are well-formed!); this is a pointer to
- *      either the beacon_ies or proberesp_ies depending on whether Probe
- *      Response frame has been received
+ * @ies: the information elements (Note that there is no guarantee that these
+ *      are well-formed!); this is a pointer to either the beacon_ies or
+ *      proberesp_ies depending on whether Probe Response frame has been
+ *      received. It is always non-%NULL.
  * @beacon_ies: the information elements from the last Beacon frame
+ *      (implementation note: if @hidden_beacon_bss is set this struct doesn't
+ *      own the beacon_ies, but they're just pointers to the ones from the
+ *      @hidden_beacon_bss struct)
  * @proberesp_ies: the information elements from the last Probe Response frame
+ * @hidden_beacon_bss: in case this BSS struct represents a probe response from
+ *      a BSS that hides the SSID in its beacon, this points to the BSS struct
+ *      that holds the beacon data. @beacon_ies is still valid, of course, and
+ *      points to the same data as hidden_beacon_bss->beacon_ies in that case.
  * @signal: signal strength value (type depends on the wiphy's signal_type)
- * @free_priv: function pointer to free private data
  * @priv: private area for driver use, has at least wiphy->bss_priv_size bytes
  */
 struct cfg80211_bss {
-        u64 tsf;
-
         struct ieee80211_channel *channel;
 
         const struct cfg80211_bss_ies __rcu *ies;
         const struct cfg80211_bss_ies __rcu *beacon_ies;
         const struct cfg80211_bss_ies __rcu *proberesp_ies;
 
-        void (*free_priv)(struct cfg80211_bss *bss);
+        struct cfg80211_bss *hidden_beacon_bss;
 
         s32 signal;
 
@@ -1403,6 +1444,8 @@ struct cfg80211_assoc_request {
  * @ie: Extra IEs to add to Deauthentication frame or %NULL
  * @ie_len: Length of ie buffer in octets
  * @reason_code: The reason code for the deauthentication
+ * @local_state_change: if set, change local state only and
+ *      do not set a deauth frame
  */
 struct cfg80211_deauth_request {
         const u8 *bssid;
@@ -1564,6 +1607,7 @@ struct cfg80211_pmksa {
  *      one bit per byte, in same format as nl80211
  * @pattern: bytes to match where bitmask is 1
  * @pattern_len: length of pattern (in bytes)
+ * @pkt_offset: packet offset (in bytes)
  *
  * Internal note: @mask and @pattern are allocated in one chunk of
  * memory, free @mask only!
@@ -1571,6 +1615,42 @@ struct cfg80211_pmksa {
 struct cfg80211_wowlan_trig_pkt_pattern {
         u8 *mask, *pattern;
         int pattern_len;
+        int pkt_offset;
+};
+
+/**
+ * struct cfg80211_wowlan_tcp - TCP connection parameters
+ *
+ * @sock: (internal) socket for source port allocation
+ * @src: source IP address
+ * @dst: destination IP address
+ * @dst_mac: destination MAC address
+ * @src_port: source port
+ * @dst_port: destination port
+ * @payload_len: data payload length
+ * @payload: data payload buffer
+ * @payload_seq: payload sequence stamping configuration
+ * @data_interval: interval at which to send data packets
+ * @wake_len: wakeup payload match length
+ * @wake_data: wakeup payload match data
+ * @wake_mask: wakeup payload match mask
+ * @tokens_size: length of the tokens buffer
+ * @payload_tok: payload token usage configuration
+ */
+struct cfg80211_wowlan_tcp {
+        struct socket *sock;
+        __be32 src, dst;
+        u16 src_port, dst_port;
+        u8 dst_mac[ETH_ALEN];
+        int payload_len;
+        const u8 *payload;
+        struct nl80211_wowlan_tcp_data_seq payload_seq;
+        u32 data_interval;
+        u32 wake_len;
+        const u8 *wake_data, *wake_mask;
+        u32 tokens_size;
+        /* must be last, variable member */
+        struct nl80211_wowlan_tcp_data_token payload_tok;
 };
 
 /**
@@ -1587,16 +1667,49 @@ struct cfg80211_wowlan_trig_pkt_pattern {
  * @eap_identity_req: wake up on EAP identity request packet
  * @four_way_handshake: wake up on 4-way handshake
  * @rfkill_release: wake up when rfkill is released
+ * @tcp: TCP connection establishment/wakeup parameters, see nl80211.h.
+ *      NULL if not configured.
  */
 struct cfg80211_wowlan {
         bool any, disconnect, magic_pkt, gtk_rekey_failure,
              eap_identity_req, four_way_handshake,
              rfkill_release;
         struct cfg80211_wowlan_trig_pkt_pattern *patterns;
+        struct cfg80211_wowlan_tcp *tcp;
         int n_patterns;
 };
 
 /**
+ * struct cfg80211_wowlan_wakeup - wakeup report
+ * @disconnect: woke up by getting disconnected
+ * @magic_pkt: woke up by receiving magic packet
+ * @gtk_rekey_failure: woke up by GTK rekey failure
+ * @eap_identity_req: woke up by EAP identity request packet
+ * @four_way_handshake: woke up by 4-way handshake
+ * @rfkill_release: woke up by rfkill being released
+ * @pattern_idx: pattern that caused wakeup, -1 if not due to pattern
+ * @packet_present_len: copied wakeup packet data
+ * @packet_len: original wakeup packet length
+ * @packet: The packet causing the wakeup, if any.
+ * @packet_80211:  For pattern match, magic packet and other data
+ *      frame triggers an 802.3 frame should be reported, for
+ *      disconnect due to deauth 802.11 frame. This indicates which
+ *      it is.
+ * @tcp_match: TCP wakeup packet received
+ * @tcp_connlost: TCP connection lost or failed to establish
+ * @tcp_nomoretokens: TCP data ran out of tokens
+ */
+struct cfg80211_wowlan_wakeup {
+        bool disconnect, magic_pkt, gtk_rekey_failure,
+             eap_identity_req, four_way_handshake,
+             rfkill_release, packet_80211,
+             tcp_match, tcp_connlost, tcp_nomoretokens;
+        s32 pattern_idx;
+        u32 packet_present_len, packet_len;
+        const void *packet;
+};
+
+/**
  * struct cfg80211_gtk_rekey_data - rekey data
  * @kek: key encryption key
  * @kck: key confirmation key
@@ -1826,6 +1939,8 @@ struct cfg80211_gtk_rekey_data {
  *      this new list replaces the existing one. Driver has to clear its ACL
  *      when number of MAC addresses entries is passed as 0. Drivers which
  *      advertise the support for MAC based ACL have to implement this callback.
+ *
+ * @start_radar_detection: Start radar detection in the driver.
  */
 struct cfg80211_ops {
         int     (*suspend)(struct wiphy *wiphy, struct cfg80211_wowlan *wow);
@@ -2049,6 +2164,10 @@ struct cfg80211_ops {
 
         int     (*set_mac_acl)(struct wiphy *wiphy, struct net_device *dev,
                                const struct cfg80211_acl_data *params);
+
+        int     (*start_radar_detection)(struct wiphy *wiphy,
+                                         struct net_device *dev,
+                                         struct cfg80211_chan_def *chandef);
 };
 
 /*
@@ -2245,6 +2364,14 @@ enum wiphy_wowlan_support_flags {
         WIPHY_WOWLAN_RFKILL_RELEASE     = BIT(7),
 };
 
+struct wiphy_wowlan_tcp_support {
+        const struct nl80211_wowlan_tcp_data_token_feature *tok;
+        u32 data_payload_max;
+        u32 data_interval_max;
+        u32 wake_payload_max;
+        bool seq;
+};
+
 /**
  * struct wiphy_wowlan_support - WoWLAN support data
  * @flags: see &enum wiphy_wowlan_support_flags
@@ -2252,12 +2379,16 @@ enum wiphy_wowlan_support_flags {
  *      (see nl80211.h for the pattern definition)
  * @pattern_max_len: maximum length of each pattern
  * @pattern_min_len: minimum length of each pattern
+ * @max_pkt_offset: maximum Rx packet offset
+ * @tcp: TCP wakeup support information
  */
 struct wiphy_wowlan_support {
         u32 flags;
         int n_patterns;
         int pattern_max_len;
         int pattern_min_len;
+        int max_pkt_offset;
+        const struct wiphy_wowlan_tcp_support *tcp;
 };
 
 /**
@@ -2357,6 +2488,14 @@ struct wiphy_wowlan_support {
  *
  * @max_acl_mac_addrs: Maximum number of MAC addresses that the device
  *      supports for ACL.
+ *
+ * @extended_capabilities: extended capabilities supported by the driver,
+ *      additional capabilities might be supported by userspace; these are
+ *      the 802.11 extended capabilities ("Extended Capabilities element")
+ *      and are in the same format as in the information element. See
+ *      802.11-2012 8.4.2.29 for the defined fields.
+ * @extended_capabilities_mask: mask of the valid values
+ * @extended_capabilities_len: length of the extended capabilities
  */
 struct wiphy {
         /* assign these fields before you register the wiphy */
@@ -2423,6 +2562,9 @@ struct wiphy {
          */
         u32 probe_resp_offload;
 
+        const u8 *extended_capabilities, *extended_capabilities_mask;
+        u8 extended_capabilities_len;
+
         /* If multiple wiphys are registered and you're handed e.g.
          * a regular netdev with assigned ieee80211_ptr, you won't
          * know whether it points to a wiphy your driver has registered
@@ -2602,7 +2744,6 @@ struct cfg80211_cached_keys;
  *      the user-set AP, monitor and WDS channel
  * @preset_chan: (private) Used by the internal configuration code to
  *      track the channel to be used for AP later
- * @preset_chantype: (private) the corresponding channel type
  * @bssid: (private) Used by the internal configuration code
  * @ssid: (private) Used by the internal configuration code
  * @ssid_len: (private) Used by the internal configuration code
@@ -2621,6 +2762,8 @@ struct cfg80211_cached_keys;
  *      beacons, 0 when not valid
  * @address: The address for this device, valid only if @netdev is %NULL
  * @p2p_started: true if this is a P2P Device that has been started
+ * @cac_started: true if DFS channel availability check has been started
+ * @cac_start_time: timestamp (jiffies) when the dfs state was entered.
  */
 struct wireless_dev {
         struct wiphy *wiphy;
@@ -2672,6 +2815,9 @@ struct wireless_dev {
 
         u32 ap_unexpected_nlportid;
 
+        bool cac_started;
+        unsigned long cac_start_time;
+
 #ifdef CONFIG_CFG80211_WEXT
         /* wext data */
         struct {
@@ -3137,25 +3283,23 @@ cfg80211_get_ibss(struct wiphy *wiphy,
                                 WLAN_CAPABILITY_IBSS, WLAN_CAPABILITY_IBSS);
 }
 
-struct cfg80211_bss *cfg80211_get_mesh(struct wiphy *wiphy,
-                                       struct ieee80211_channel *channel,
-                                       const u8 *meshid, size_t meshidlen,
-                                       const u8 *meshcfg);
 /**
  * cfg80211_ref_bss - reference BSS struct
+ * @wiphy: the wiphy this BSS struct belongs to
  * @bss: the BSS struct to reference
  *
  * Increments the refcount of the given BSS struct.
  */
-void cfg80211_ref_bss(struct cfg80211_bss *bss);
+void cfg80211_ref_bss(struct wiphy *wiphy, struct cfg80211_bss *bss);
 
 /**
  * cfg80211_put_bss - unref BSS struct
+ * @wiphy: the wiphy this BSS struct belongs to
  * @bss: the BSS struct
  *
  * Decrements the refcount of the given BSS struct.
  */
-void cfg80211_put_bss(struct cfg80211_bss *bss);
+void cfg80211_put_bss(struct wiphy *wiphy, struct cfg80211_bss *bss);
 
 /**
  * cfg80211_unlink_bss - unlink BSS from internal data structures
@@ -3663,6 +3807,31 @@ void cfg80211_cqm_rssi_notify(struct net_device *dev,
                               gfp_t gfp);
 
 /**
+ * cfg80211_radar_event - radar detection event
+ * @wiphy: the wiphy
+ * @chandef: chandef for the current channel
+ * @gfp: context flags
+ *
+ * This function is called when a radar is detected on the current chanenl.
+ */
+void cfg80211_radar_event(struct wiphy *wiphy,
+                          struct cfg80211_chan_def *chandef, gfp_t gfp);
+
+/**
+ * cfg80211_cac_event - Channel availability check (CAC) event
+ * @netdev: network device
+ * @event: type of event
+ * @gfp: context flags
+ *
+ * This function is called when a Channel availability check (CAC) is finished
+ * or aborted. This must be called to notify the completion of a CAC process,
+ * also by full-MAC drivers.
+ */
+void cfg80211_cac_event(struct net_device *netdev,
+                        enum nl80211_radar_event event, gfp_t gfp);
+
+
+/**
  * cfg80211_cqm_pktloss_notify - notify userspace about packetloss to peer
  * @dev: network device
  * @peer: peer's MAC address
@@ -3852,6 +4021,21 @@ int cfg80211_get_p2p_attr(const u8 *ies, unsigned int len,
                           enum ieee80211_p2p_attr_id attr,
                           u8 *buf, unsigned int bufsize);
 
+/**
+ * cfg80211_report_wowlan_wakeup - report wakeup from WoWLAN
+ * @wdev: the wireless device reporting the wakeup
+ * @wakeup: the wakeup report
+ * @gfp: allocation flags
+ *
+ * This function reports that the given device woke up. If it
+ * caused the wakeup, report the reason(s), otherwise you may
+ * pass %NULL as the @wakeup parameter to advertise that something
+ * else caused the wakeup.
+ */
+void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
+                                   struct cfg80211_wowlan_wakeup *wakeup,
+                                   gfp_t gfp);
+
 /* Logging, debugging and troubleshooting/diagnostic helpers. */
 
 /* wiphy_printk helpers, similar to dev_printk */
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 5c98d654fc75..f7eba1300d82 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -147,10 +147,12 @@ struct ieee80211_low_level_stats {
  * enum ieee80211_chanctx_change - change flag for channel context
  * @IEEE80211_CHANCTX_CHANGE_WIDTH: The channel width changed
  * @IEEE80211_CHANCTX_CHANGE_RX_CHAINS: The number of RX chains changed
+ * @IEEE80211_CHANCTX_CHANGE_RADAR: radar detection flag changed
  */
 enum ieee80211_chanctx_change {
         IEEE80211_CHANCTX_CHANGE_WIDTH          = BIT(0),
         IEEE80211_CHANCTX_CHANGE_RX_CHAINS      = BIT(1),
+        IEEE80211_CHANCTX_CHANGE_RADAR          = BIT(2),
 };
 
 /**
@@ -165,6 +167,7 @@ enum ieee80211_chanctx_change {
  * @rx_chains_dynamic: The number of RX chains that must be enabled
  *      after RTS/CTS handshake to receive SMPS MIMO transmissions;
  *      this will always be >= @rx_chains_static.
+ * @radar_enabled: whether radar detection is enabled on this channel.
  * @drv_priv: data area for driver use, will always be aligned to
  *      sizeof(void *), size is determined in hw information.
  */
@@ -173,6 +176,8 @@ struct ieee80211_chanctx_conf {
 
         u8 rx_chains_static, rx_chains_dynamic;
 
+        bool radar_enabled;
+
         u8 drv_priv[0] __aligned(sizeof(void *));
 };
 
@@ -208,6 +213,11 @@ struct ieee80211_chanctx_conf {
  * @BSS_CHANGED_TXPOWER: TX power setting changed for this interface
  * @BSS_CHANGED_P2P_PS: P2P powersave settings (CTWindow, opportunistic PS)
  *      changed (currently only in P2P client mode, GO mode will be later)
+ * @BSS_CHANGED_DTIM_PERIOD: the DTIM period value was changed (set when
+ *      it becomes valid, managed mode only)
+ * @BSS_CHANGED_BANDWIDTH: The bandwidth used by this interface changed,
+ *      note that this is only called when it changes after the channel
+ *      context had been assigned.
  */
 enum ieee80211_bss_change {
         BSS_CHANGED_ASSOC               = 1<<0,
@@ -230,6 +240,8 @@ enum ieee80211_bss_change {
         BSS_CHANGED_PS                  = 1<<17,
         BSS_CHANGED_TXPOWER             = 1<<18,
         BSS_CHANGED_P2P_PS              = 1<<19,
+        BSS_CHANGED_DTIM_PERIOD         = 1<<20,
+        BSS_CHANGED_BANDWIDTH           = 1<<21,
 
         /* when adding here, make sure to change ieee80211_reconfig */
 };
@@ -271,13 +283,19 @@ enum ieee80211_rssi_event {
  *      if the hardware cannot handle this it must set the
  *      IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE hardware flag
  * @dtim_period: num of beacons before the next DTIM, for beaconing,
- *      valid in station mode only while @assoc is true and if also
- *      requested by %IEEE80211_HW_NEED_DTIM_PERIOD (cf. also hw conf
- *      @ps_dtim_period)
+ *      valid in station mode only if after the driver was notified
+ *      with the %BSS_CHANGED_DTIM_PERIOD flag, will be non-zero then.
  * @sync_tsf: last beacon's/probe response's TSF timestamp (could be old
- *      as it may have been received during scanning long ago)
+ *      as it may have been received during scanning long ago). If the
+ *      HW flag %IEEE80211_HW_TIMING_BEACON_ONLY is set, then this can
+ *      only come from a beacon, but might not become valid until after
+ *      association when a beacon is received (which is notified with the
+ *      %BSS_CHANGED_DTIM flag.)
  * @sync_device_ts: the device timestamp corresponding to the sync_tsf,
  *      the driver/device can use this to calculate synchronisation
+ *      (see @sync_tsf)
+ * @sync_dtim_count: Only valid when %IEEE80211_HW_TIMING_BEACON_ONLY
+ *      is requested, see @sync_tsf/@sync_device_ts.
  * @beacon_int: beacon interval
  * @assoc_capability: capabilities taken from assoc resp
  * @basic_rates: bitmap of basic rates, each bit stands for an
@@ -329,6 +347,7 @@ struct ieee80211_bss_conf {
         u16 assoc_capability;
         u64 sync_tsf;
         u32 sync_device_ts;
+        u8 sync_dtim_count;
         u32 basic_rates;
         int mcast_rate[IEEE80211_NUM_BANDS];
         u16 ht_operation_mode;
@@ -389,6 +408,9 @@ struct ieee80211_bss_conf {
  * @IEEE80211_TX_CTL_RATE_CTRL_PROBE: internal to mac80211, can be
  *      set by rate control algorithms to indicate probe rate, will
  *      be cleared for fragmented frames (except on the last fragment)
+ * @IEEE80211_TX_INTFL_OFFCHAN_TX_OK: Internal to mac80211. Used to indicate
+ *      that a frame can be transmitted while the queues are stopped for
+ *      off-channel operation.
  * @IEEE80211_TX_INTFL_NEED_TXPROCESSING: completely internal to mac80211,
  *      used to indicate that a pending frame requires TX processing before
  *      it can be sent out.
@@ -406,6 +428,9 @@ struct ieee80211_bss_conf {
  * @IEEE80211_TX_INTFL_RETRANSMISSION: This frame is being retransmitted
  *      after TX status because the destination was asleep, it must not
  *      be modified again (no seqno assignment, crypto, etc.)
+ * @IEEE80211_TX_INTFL_MLME_CONN_TX: This frame was transmitted by the MLME
+ *      code for connection establishment, this indicates that its status
+ *      should kick the MLME state machine.
  * @IEEE80211_TX_INTFL_NL80211_FRAME_TX: Frame was requested through nl80211
  *      MLME command (internal to mac80211 to figure out whether to send TX
  *      status to user space)
@@ -451,13 +476,14 @@ enum mac80211_tx_control_flags {
         IEEE80211_TX_STAT_AMPDU                 = BIT(10),
         IEEE80211_TX_STAT_AMPDU_NO_BACK         = BIT(11),
         IEEE80211_TX_CTL_RATE_CTRL_PROBE        = BIT(12),
+        IEEE80211_TX_INTFL_OFFCHAN_TX_OK        = BIT(13),
         IEEE80211_TX_INTFL_NEED_TXPROCESSING    = BIT(14),
         IEEE80211_TX_INTFL_RETRIED              = BIT(15),
         IEEE80211_TX_INTFL_DONT_ENCRYPT         = BIT(16),
         IEEE80211_TX_CTL_NO_PS_BUFFER           = BIT(17),
         IEEE80211_TX_CTL_MORE_FRAMES            = BIT(18),
         IEEE80211_TX_INTFL_RETRANSMISSION       = BIT(19),
-        /* hole at 20, use later */
+        IEEE80211_TX_INTFL_MLME_CONN_TX         = BIT(20),
         IEEE80211_TX_INTFL_NL80211_FRAME_TX     = BIT(21),
         IEEE80211_TX_CTL_LDPC                   = BIT(22),
         IEEE80211_TX_CTL_STBC                   = BIT(23) | BIT(24),
@@ -950,6 +976,7 @@ enum ieee80211_smps_mode {
  *
  * @channel: the channel to tune to
  * @channel_type: the channel (HT) type
+ * @radar_enabled: whether radar detection is enabled
  *
  * @long_frame_max_tx_count: Maximum number of transmissions for a "long" frame
  *    (a frame not RTS protected), called "dot11LongRetryLimit" in 802.11,
@@ -976,6 +1003,7 @@ struct ieee80211_conf {
 
         struct ieee80211_channel *channel;
         enum nl80211_channel_type channel_type;
+        bool radar_enabled;
         enum ieee80211_smps_mode smps_mode;
 };
 
@@ -1173,6 +1201,24 @@ enum ieee80211_sta_state {
 };
 
 /**
+ * enum ieee80211_sta_rx_bandwidth - station RX bandwidth
+ * @IEEE80211_STA_RX_BW_20: station can only receive 20 MHz
+ * @IEEE80211_STA_RX_BW_40: station can receive up to 40 MHz
+ * @IEEE80211_STA_RX_BW_80: station can receive up to 80 MHz
+ * @IEEE80211_STA_RX_BW_160: station can receive up to 160 MHz
+ *      (including 80+80 MHz)
+ *
+ * Implementation note: 20 must be zero to be initialized
+ *      correctly, the values must be sorted.
+ */
+enum ieee80211_sta_rx_bandwidth {
+        IEEE80211_STA_RX_BW_20 = 0,
+        IEEE80211_STA_RX_BW_40,
+        IEEE80211_STA_RX_BW_80,
+        IEEE80211_STA_RX_BW_160,
+};
+
+/**
  * struct ieee80211_sta - station table entry
  *
  * A station table entry represents a station we are possibly
@@ -1194,6 +1240,12 @@ enum ieee80211_sta_state {
  * @uapsd_queues: bitmap of queues configured for uapsd. Only valid
  *      if wme is supported.
  * @max_sp: max Service Period. Only valid if wme is supported.
+ * @bandwidth: current bandwidth the station can receive with
+ * @rx_nss: in HT/VHT, the maximum number of spatial streams the
+ *      station can receive at the moment, changed by operating mode
+ *      notifications and capabilities. The value is only valid after
+ *      the station moves to associated state.
+ * @smps_mode: current SMPS mode (off, static or dynamic)
  */
 struct ieee80211_sta {
         u32 supp_rates[IEEE80211_NUM_BANDS];
@@ -1204,6 +1256,9 @@ struct ieee80211_sta {
         bool wme;
         u8 uapsd_queues;
         u8 max_sp;
+        u8 rx_nss;
+        enum ieee80211_sta_rx_bandwidth bandwidth;
+        enum ieee80211_smps_mode smps_mode;
 
         /* must be last */
         u8 drv_priv[0] __aligned(sizeof(void *));
@@ -1328,9 +1383,9 @@ struct ieee80211_tx_control {
  *      When this flag is set, signaling beacon-loss will cause an immediate
  *      change to disassociated state.
  *
- * @IEEE80211_HW_NEED_DTIM_PERIOD:
- *      This device needs to know the DTIM period for the BSS before
- *      associating.
+ * @IEEE80211_HW_NEED_DTIM_BEFORE_ASSOC:
+ *      This device needs to get data from beacon before association (i.e.
+ *      dtim_period).
  *
  * @IEEE80211_HW_SUPPORTS_PER_STA_GTK: The device's crypto engine supports
  *      per-station GTKs as used by IBSS RSN or during fast transition. If
@@ -1350,10 +1405,6 @@ struct ieee80211_tx_control {
  *      setup strictly in HW. mac80211 should not attempt to do this in
  *      software.
  *
- * @IEEE80211_HW_SCAN_WHILE_IDLE: The device can do hw scan while
- *      being idle (i.e. mac80211 doesn't have to go idle-off during the
- *      the scan).
- *
  * @IEEE80211_HW_WANT_MONITOR_VIF: The driver would like to be informed of
  *      a virtual monitor interface when monitor interfaces are the only
  *      active interfaces.
@@ -1367,9 +1418,8 @@ struct ieee80211_tx_control {
  *      P2P Interface. This will be honoured even if more than one interface
  *      is supported.
  *
- * @IEEE80211_HW_TEARDOWN_AGGR_ON_BAR_FAIL: On this hardware TX BA session
- *      should be tear down once BAR frame will not be acked.
- *
+ * @IEEE80211_HW_TIMING_BEACON_ONLY: Use sync timing from beacon frames
+ *      only, to allow getting TBTT of a DTIM beacon.
  */
 enum ieee80211_hw_flags {
         IEEE80211_HW_HAS_RATE_CONTROL                   = 1<<0,
@@ -1379,7 +1429,7 @@ enum ieee80211_hw_flags {
         IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE      = 1<<4,
         IEEE80211_HW_SIGNAL_UNSPEC                      = 1<<5,
         IEEE80211_HW_SIGNAL_DBM                         = 1<<6,
-        IEEE80211_HW_NEED_DTIM_PERIOD                   = 1<<7,
+        IEEE80211_HW_NEED_DTIM_BEFORE_ASSOC             = 1<<7,
         IEEE80211_HW_SPECTRUM_MGMT                      = 1<<8,
         IEEE80211_HW_AMPDU_AGGREGATION                  = 1<<9,
         IEEE80211_HW_SUPPORTS_PS                        = 1<<10,
@@ -1396,9 +1446,8 @@ enum ieee80211_hw_flags {
         IEEE80211_HW_SUPPORTS_PER_STA_GTK               = 1<<21,
         IEEE80211_HW_AP_LINK_PS                         = 1<<22,
         IEEE80211_HW_TX_AMPDU_SETUP_IN_HW               = 1<<23,
-        IEEE80211_HW_SCAN_WHILE_IDLE                    = 1<<24,
         IEEE80211_HW_P2P_DEV_ADDR_FOR_INTF              = 1<<25,
-        IEEE80211_HW_TEARDOWN_AGGR_ON_BAR_FAIL          = 1<<26,
+        IEEE80211_HW_TIMING_BEACON_ONLY                 = 1<<26,
 };
 
 /**
@@ -1683,15 +1732,6 @@ void ieee80211_free_txskb(struct ieee80211_hw *hw, struct sk_buff *skb);
  * dynamic PS feature in stack and will just keep %IEEE80211_CONF_PS
  * enabled whenever user has enabled powersave.
  *
- * Some hardware need to toggle a single shared antenna between WLAN and
- * Bluetooth to facilitate co-existence. These types of hardware set
- * limitations on the use of host controlled dynamic powersave whenever there
- * is simultaneous WLAN and Bluetooth traffic. For these types of hardware, the
- * driver may request temporarily going into full power save, in order to
- * enable toggling the antenna between BT and WLAN. If the driver requests
- * disabling dynamic powersave, the @dynamic_ps_timeout value will be
- * temporarily set to zero until the driver re-enables dynamic powersave.
- *
  * Driver informs U-APSD client support by enabling
  * %IEEE80211_HW_SUPPORTS_UAPSD flag. The mode is configured through the
  * uapsd paramater in conf_tx() operation. Hardware needs to send the QoS
@@ -2077,16 +2117,21 @@ enum ieee80211_frame_release_type {
  * enum ieee80211_rate_control_changed - flags to indicate what changed
  *
  * @IEEE80211_RC_BW_CHANGED: The bandwidth that can be used to transmit
- *      to this station changed.
+ *      to this station changed. The actual bandwidth is in the station
+ *      information -- for HT20/40 the IEEE80211_HT_CAP_SUP_WIDTH_20_40
+ *      flag changes, for HT and VHT the bandwidth field changes.
  * @IEEE80211_RC_SMPS_CHANGED: The SMPS state of the station changed.
  * @IEEE80211_RC_SUPP_RATES_CHANGED: The supported rate set of this peer
  *      changed (in IBSS mode) due to discovering more information about
  *      the peer.
+ * @IEEE80211_RC_NSS_CHANGED: N_SS (number of spatial streams) was changed
+ *      by the peer
  */
 enum ieee80211_rate_control_changed {
         IEEE80211_RC_BW_CHANGED         = BIT(0),
         IEEE80211_RC_SMPS_CHANGED       = BIT(1),
         IEEE80211_RC_SUPP_RATES_CHANGED = BIT(2),
+        IEEE80211_RC_NSS_CHANGED        = BIT(3),
 };
 
 /**
@@ -2167,6 +2212,18 @@ enum ieee80211_rate_control_changed {
  *      MAC address of the device going away.
  *      Hence, this callback must be implemented. It can sleep.
  *
+ * @add_interface_debugfs: Drivers can use this callback to add debugfs files
+ *      when a vif is added to mac80211. This callback and
+ *      @remove_interface_debugfs should be within a CONFIG_MAC80211_DEBUGFS
+ *      conditional. @remove_interface_debugfs must be provided for cleanup.
+ *      This callback can sleep.
+ *
+ * @remove_interface_debugfs: Remove the debugfs files which were added using
+ *      @add_interface_debugfs. This callback must remove all debugfs entries
+ *      that were added because mac80211 only removes interface debugfs when the
+ *      interface is destroyed, not when it is removed from the driver.
+ *      This callback can sleep.
+ *
  * @config: Handler for configuration requests. IEEE 802.11 code calls this
  *      function to change hardware configuration, e.g., channel.
  *      This function should never fail but returns a negative error code
@@ -2580,6 +2637,12 @@ struct ieee80211_ops {
                                    struct ieee80211_vif *vif,
                                    struct ieee80211_sta *sta,
                                    struct dentry *dir);
+        void (*add_interface_debugfs)(struct ieee80211_hw *hw,
+                                      struct ieee80211_vif *vif,
+                                      struct dentry *dir);
+        void (*remove_interface_debugfs)(struct ieee80211_hw *hw,
+                                         struct ieee80211_vif *vif,
+                                         struct dentry *dir);
 #endif
         void (*sta_notify)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                         enum sta_notify_cmd, struct ieee80211_sta *sta);
@@ -3877,6 +3940,8 @@ void ieee80211_beacon_loss(struct ieee80211_vif *vif);
  * When beacon filtering is enabled with %IEEE80211_VIF_BEACON_FILTER, and
  * %IEEE80211_CONF_PS and %IEEE80211_HW_CONNECTION_MONITOR are set, the driver
  * needs to inform if the connection to the AP has been lost.
+ * The function may also be called if the connection needs to be terminated
+ * for some other reason, even if %IEEE80211_HW_CONNECTION_MONITOR isn't set.
  *
  * This function will cause immediate change to disassociated state,
  * without connection recovery attempts.
@@ -3907,36 +3972,6 @@ void ieee80211_connection_loss(struct ieee80211_vif *vif);
 void ieee80211_resume_disconnect(struct ieee80211_vif *vif);
 
 /**
- * ieee80211_disable_dyn_ps - force mac80211 to temporarily disable dynamic psm
- *
- * @vif: &struct ieee80211_vif pointer from the add_interface callback.
- *
- * Some hardware require full power save to manage simultaneous BT traffic
- * on the WLAN frequency. Full PSM is required periodically, whenever there are
- * burst of BT traffic. The hardware gets information of BT traffic via
- * hardware co-existence lines, and consequentially requests mac80211 to
- * (temporarily) enter full psm.
- * This function will only temporarily disable dynamic PS, not enable PSM if
- * it was not already enabled.
- * The driver must make sure to re-enable dynamic PS using
- * ieee80211_enable_dyn_ps() if the driver has disabled it.
- *
- */
-void ieee80211_disable_dyn_ps(struct ieee80211_vif *vif);
-
-/**
- * ieee80211_enable_dyn_ps - restore dynamic psm after being disabled
- *
- * @vif: &struct ieee80211_vif pointer from the add_interface callback.
- *
- * This function restores dynamic PS after being temporarily disabled via
- * ieee80211_disable_dyn_ps(). Each ieee80211_disable_dyn_ps() call must
- * be coupled with an eventual call to this function.
- *
- */
-void ieee80211_enable_dyn_ps(struct ieee80211_vif *vif);
-
-/**
  * ieee80211_cqm_rssi_notify - inform a configured connection quality monitoring
  *      rssi threshold triggered
  *
@@ -3953,6 +3988,13 @@ void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
                                gfp_t gfp);
 
 /**
+ * ieee80211_radar_detected - inform that a radar was detected
+ *
+ * @hw: pointer as obtained from ieee80211_alloc_hw()
+ */
+void ieee80211_radar_detected(struct ieee80211_hw *hw);
+
+/**
  * ieee80211_chswitch_done - Complete channel switch process
  * @vif: &struct ieee80211_vif pointer from the add_interface callback.
  * @success: make the channel switch successful or not
@@ -4211,4 +4253,16 @@ void ieee80211_disable_rssi_reports(struct ieee80211_vif *vif);
  */
 int ieee80211_ave_rssi(struct ieee80211_vif *vif);
 
+/**
+ * ieee80211_report_wowlan_wakeup - report WoWLAN wakeup
+ * @vif: virtual interface
+ * @wakeup: wakeup reason(s)
+ * @gfp: allocation flags
+ *
+ * See cfg80211_report_wowlan_wakeup().
+ */
+void ieee80211_report_wowlan_wakeup(struct ieee80211_vif *vif,
+                                    struct cfg80211_wowlan_wakeup *wakeup,
+                                    gfp_t gfp);
+
 #endif /* MAC80211_H */
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index 5b7dbc1ea966..c46bb016f4e4 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -513,6 +513,12 @@
  *      command with the %NL80211_ATTR_WOWLAN_TRIGGERS attribute. For
  *      more background information, see
  *      http://wireless.kernel.org/en/users/Documentation/WoWLAN.
+ *      The @NL80211_CMD_SET_WOWLAN command can also be used as a notification
+ *      from the driver reporting the wakeup reason. In this case, the
+ *      @NL80211_ATTR_WOWLAN_TRIGGERS attribute will contain the reason
+ *      for the wakeup, if it was caused by wireless. If it is not present
+ *      in the wakeup notification, the wireless device didn't cause the
+ *      wakeup but reports that it was woken up.
  *
  * @NL80211_CMD_SET_REKEY_OFFLOAD: This command is used give the driver
  *      the necessary information for supporting GTK rekey offload. This
@@ -597,6 +603,14 @@
  *      command is used in AP/P2P GO mode. Driver has to make sure to clear its
  *      ACL list during %NL80211_CMD_STOP_AP.
  *
+ * @NL80211_CMD_RADAR_DETECT: Start a Channel availability check (CAC). Once
+ *      a radar is detected or the channel availability scan (CAC) has finished
+ *      or was aborted, or a radar was detected, usermode will be notified with
+ *      this event. This command is also used to notify userspace about radars
+ *      while operating on this channel.
+ *      %NL80211_ATTR_RADAR_EVENT is used to inform about the type of the
+ *      event.
+ *
  * @NL80211_CMD_MAX: highest used command number
  * @__NL80211_CMD_AFTER_LAST: internal use
  */
@@ -749,6 +763,8 @@ enum nl80211_commands {
 
         NL80211_CMD_SET_MAC_ACL,
 
+        NL80211_CMD_RADAR_DETECT,
+
         /* add new commands above here */
 
         /* used to define NL80211_CMD_MAX below */
@@ -1336,6 +1352,22 @@ enum nl80211_commands {
  *      number of MAC addresses that a device can support for MAC
  *      ACL.
  *
+ * @NL80211_ATTR_RADAR_EVENT: Type of radar event for notification to userspace,
+ *      contains a value of enum nl80211_radar_event (u32).
+ *
+ * @NL80211_ATTR_EXT_CAPA: 802.11 extended capabilities that the kernel driver
+ *      has and handles. The format is the same as the IE contents. See
+ *      802.11-2012 8.4.2.29 for more information.
+ * @NL80211_ATTR_EXT_CAPA_MASK: Extended capabilities that the kernel driver
+ *      has set in the %NL80211_ATTR_EXT_CAPA value, for multibit fields.
+ *
+ * @NL80211_ATTR_STA_CAPABILITY: Station capabilities (u16) are advertised to
+ *      the driver, e.g., to enable TDLS power save (PU-APSD).
+ *
+ * @NL80211_ATTR_STA_EXT_CAPABILITY: Station extended capabilities are
+ *      advertised to the driver, e.g., to enable TDLS off channel operations
+ *      and PU-APSD.
+ *
  * @NL80211_ATTR_MAX: highest attribute number currently defined
  * @__NL80211_ATTR_AFTER_LAST: internal use
  */
@@ -1614,6 +1646,14 @@ enum nl80211_attrs {
 
         NL80211_ATTR_MAC_ACL_MAX,
 
+        NL80211_ATTR_RADAR_EVENT,
+
+        NL80211_ATTR_EXT_CAPA,
+        NL80211_ATTR_EXT_CAPA_MASK,
+
+        NL80211_ATTR_STA_CAPABILITY,
+        NL80211_ATTR_STA_EXT_CAPABILITY,
+
         /* add attributes here, update the policy in nl80211.c */
 
         __NL80211_ATTR_AFTER_LAST,
@@ -1851,6 +1891,8 @@ enum nl80211_sta_bss_param {
  * @NL80211_STA_INFO_INACTIVE_TIME: time since last activity (u32, msecs)
  * @NL80211_STA_INFO_RX_BYTES: total received bytes (u32, from this station)
  * @NL80211_STA_INFO_TX_BYTES: total transmitted bytes (u32, to this station)
+ * @NL80211_STA_INFO_RX_BYTES64: total received bytes (u64, from this station)
+ * @NL80211_STA_INFO_TX_BYTES64: total transmitted bytes (u64, to this station)
  * @NL80211_STA_INFO_SIGNAL: signal strength of last received PPDU (u8, dBm)
  * @NL80211_STA_INFO_TX_BITRATE: current unicast tx rate, nested attribute
  *      containing info as possible, see &enum nl80211_rate_info
@@ -1903,6 +1945,8 @@ enum nl80211_sta_info {
         NL80211_STA_INFO_LOCAL_PM,
         NL80211_STA_INFO_PEER_PM,
         NL80211_STA_INFO_NONPEER_PM,
+        NL80211_STA_INFO_RX_BYTES64,
+        NL80211_STA_INFO_TX_BYTES64,
 
         /* keep last */
         __NL80211_STA_INFO_AFTER_LAST,
@@ -2012,6 +2056,20 @@ enum nl80211_band_attr {
  *      on this channel in current regulatory domain.
  * @NL80211_FREQUENCY_ATTR_MAX_TX_POWER: Maximum transmission power in mBm
  *      (100 * dBm).
+ * @NL80211_FREQUENCY_ATTR_DFS_STATE: current state for DFS
+ *      (enum nl80211_dfs_state)
+ * @NL80211_FREQUENCY_ATTR_DFS_TIME: time in miliseconds for how long
+ *      this channel is in this DFS state.
+ * @NL80211_FREQUENCY_ATTR_NO_HT40_MINUS: HT40- isn't possible with this
+ *      channel as the control channel
+ * @NL80211_FREQUENCY_ATTR_NO_HT40_PLUS: HT40+ isn't possible with this
+ *      channel as the control channel
+ * @NL80211_FREQUENCY_ATTR_NO_80MHZ: any 80 MHz channel using this channel
+ *      as the primary or any of the secondary channels isn't possible,
+ *      this includes 80+80 channels
+ * @NL80211_FREQUENCY_ATTR_NO_160MHZ: any 160 MHz (but not 80+80) channel
+ *      using this channel as the primary or any of the secondary channels
+ *      isn't possible
  * @NL80211_FREQUENCY_ATTR_MAX: highest frequency attribute number
  *      currently defined
  * @__NL80211_FREQUENCY_ATTR_AFTER_LAST: internal use
@@ -2024,6 +2082,12 @@ enum nl80211_frequency_attr {
         NL80211_FREQUENCY_ATTR_NO_IBSS,
         NL80211_FREQUENCY_ATTR_RADAR,
         NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
+        NL80211_FREQUENCY_ATTR_DFS_STATE,
+        NL80211_FREQUENCY_ATTR_DFS_TIME,
+        NL80211_FREQUENCY_ATTR_NO_HT40_MINUS,
+        NL80211_FREQUENCY_ATTR_NO_HT40_PLUS,
+        NL80211_FREQUENCY_ATTR_NO_80MHZ,
+        NL80211_FREQUENCY_ATTR_NO_160MHZ,
 
         /* keep last */
         __NL80211_FREQUENCY_ATTR_AFTER_LAST,
@@ -2896,10 +2960,12 @@ enum nl80211_tx_power_setting {
  *      corresponds to the lowest-order bit in the second byte of the mask.
  *      For example: The match 00:xx:00:00:xx:00:00:00:00:xx:xx:xx (where
  *      xx indicates "don't care") would be represented by a pattern of
- *      twelve zero bytes, and a mask of "0xed,0x07".
+ *      twelve zero bytes, and a mask of "0xed,0x01".
  *      Note that the pattern matching is done as though frames were not
  *      802.11 frames but 802.3 frames, i.e. the frame is fully unpacked
  *      first (including SNAP header unpacking) and then matched.
+ * @NL80211_WOWLAN_PKTPAT_OFFSET: packet offset, pattern is matched after
+ *      these fixed number of bytes of received packet
  * @NUM_NL80211_WOWLAN_PKTPAT: number of attributes
  * @MAX_NL80211_WOWLAN_PKTPAT: max attribute number
  */
@@ -2907,6 +2973,7 @@ enum nl80211_wowlan_packet_pattern_attr {
         __NL80211_WOWLAN_PKTPAT_INVALID,
         NL80211_WOWLAN_PKTPAT_MASK,
         NL80211_WOWLAN_PKTPAT_PATTERN,
+        NL80211_WOWLAN_PKTPAT_OFFSET,
 
         NUM_NL80211_WOWLAN_PKTPAT,
         MAX_NL80211_WOWLAN_PKTPAT = NUM_NL80211_WOWLAN_PKTPAT - 1,
@@ -2917,6 +2984,7 @@ enum nl80211_wowlan_packet_pattern_attr {
  * @max_patterns: maximum number of patterns supported
  * @min_pattern_len: minimum length of each pattern
  * @max_pattern_len: maximum length of each pattern
+ * @max_pkt_offset: maximum Rx packet offset
  *
  * This struct is carried in %NL80211_WOWLAN_TRIG_PKT_PATTERN when
  * that is part of %NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED in the
@@ -2926,6 +2994,7 @@ struct nl80211_wowlan_pattern_support {
         __u32 max_patterns;
         __u32 min_pattern_len;
         __u32 max_pattern_len;
+        __u32 max_pkt_offset;
 } __attribute__((packed));
 
 /**
@@ -2941,12 +3010,17 @@ struct nl80211_wowlan_pattern_support {
  * @NL80211_WOWLAN_TRIG_PKT_PATTERN: wake up on the specified packet patterns
  *      which are passed in an array of nested attributes, each nested attribute
  *      defining a with attributes from &struct nl80211_wowlan_trig_pkt_pattern.
- *      Each pattern defines a wakeup packet. The matching is done on the MSDU,
- *      i.e. as though the packet was an 802.3 packet, so the pattern matching
- *      is done after the packet is converted to the MSDU.
+ *      Each pattern defines a wakeup packet. Packet offset is associated with
+ *      each pattern which is used while matching the pattern. The matching is
+ *      done on the MSDU, i.e. as though the packet was an 802.3 packet, so the
+ *      pattern matching is done after the packet is converted to the MSDU.
  *
  *      In %NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED, it is a binary attribute
  *      carrying a &struct nl80211_wowlan_pattern_support.
+ *
+ *      When reporting wakeup. it is a u32 attribute containing the 0-based
+ *      index of the pattern that caused the wakeup, in the patterns passed
+ *      to the kernel when configuring.
  * @NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED: Not a real trigger, and cannot be
  *      used when setting, used only to indicate that GTK rekeying is supported
  *      by the device (flag)
@@ -2957,8 +3031,36 @@ struct nl80211_wowlan_pattern_support {
  * @NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE: wake up on 4-way handshake (flag)
  * @NL80211_WOWLAN_TRIG_RFKILL_RELEASE: wake up when rfkill is released
  *      (on devices that have rfkill in the device) (flag)
+ * @NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211: For wakeup reporting only, contains
+ *      the 802.11 packet that caused the wakeup, e.g. a deauth frame. The frame
+ *      may be truncated, the @NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN
+ *      attribute contains the original length.
+ * @NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN: Original length of the 802.11
+ *      packet, may be bigger than the @NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211
+ *      attribute if the packet was truncated somewhere.
+ * @NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023: For wakeup reporting only, contains the
+ *      802.11 packet that caused the wakeup, e.g. a magic packet. The frame may
+ *      be truncated, the @NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN attribute
+ *      contains the original length.
+ * @NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN: Original length of the 802.3
+ *      packet, may be bigger than the @NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023
+ *      attribute if the packet was truncated somewhere.
+ * @NL80211_WOWLAN_TRIG_TCP_CONNECTION: TCP connection wake, see DOC section
+ *      "TCP connection wakeup" for more details. This is a nested attribute
+ *      containing the exact information for establishing and keeping alive
+ *      the TCP connection.
+ * @NL80211_WOWLAN_TRIG_TCP_WAKEUP_MATCH: For wakeup reporting only, the
+ *      wakeup packet was received on the TCP connection
+ * @NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST: For wakeup reporting only, the
+ *      TCP connection was lost or failed to be established
+ * @NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS: For wakeup reporting only,
+ *      the TCP connection ran out of tokens to use for data to send to the
+ *      service
  * @NUM_NL80211_WOWLAN_TRIG: number of wake on wireless triggers
  * @MAX_NL80211_WOWLAN_TRIG: highest wowlan trigger attribute number
+ *
+ * These nested attributes are used to configure the wakeup triggers and
+ * to report the wakeup reason(s).
  */
 enum nl80211_wowlan_triggers {
         __NL80211_WOWLAN_TRIG_INVALID,
@@ -2971,6 +3073,14 @@ enum nl80211_wowlan_triggers {
         NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST,
         NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE,
         NL80211_WOWLAN_TRIG_RFKILL_RELEASE,
+        NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211,
+        NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN,
+        NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023,
+        NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN,
+        NL80211_WOWLAN_TRIG_TCP_CONNECTION,
+        NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH,
+        NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST,
+        NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS,
 
         /* keep last */
         NUM_NL80211_WOWLAN_TRIG,
@@ -2978,6 +3088,116 @@ enum nl80211_wowlan_triggers {
 };
 
 /**
+ * DOC: TCP connection wakeup
+ *
+ * Some devices can establish a TCP connection in order to be woken up by a
+ * packet coming in from outside their network segment, or behind NAT. If
+ * configured, the device will establish a TCP connection to the given
+ * service, and periodically send data to that service. The first data
+ * packet is usually transmitted after SYN/ACK, also ACKing the SYN/ACK.
+ * The data packets can optionally include a (little endian) sequence
+ * number (in the TCP payload!) that is generated by the device, and, also
+ * optionally, a token from a list of tokens. This serves as a keep-alive
+ * with the service, and for NATed connections, etc.
+ *
+ * During this keep-alive period, the server doesn't send any data to the
+ * client. When receiving data, it is compared against the wakeup pattern
+ * (and mask) and if it matches, the host is woken up. Similarly, if the
+ * connection breaks or cannot be established to start with, the host is
+ * also woken up.
+ *
+ * Developer's note: ARP offload is required for this, otherwise TCP
+ * response packets might not go through correctly.
+ */
+
+/**
+ * struct nl80211_wowlan_tcp_data_seq - WoWLAN TCP data sequence
+ * @start: starting value
+ * @offset: offset of sequence number in packet
+ * @len: length of the sequence value to write, 1 through 4
+ *
+ * Note: don't confuse with the TCP sequence number(s), this is for the
+ * keepalive packet payload. The actual value is written into the packet
+ * in little endian.
+ */
+struct nl80211_wowlan_tcp_data_seq {
+        __u32 start, offset, len;
+};
+
+/**
+ * struct nl80211_wowlan_tcp_data_token - WoWLAN TCP data token config
+ * @offset: offset of token in packet
+ * @len: length of each token
+ * @token_stream: stream of data to be used for the tokens, the length must
+ *      be a multiple of @len for this to make sense
+ */
+struct nl80211_wowlan_tcp_data_token {
+        __u32 offset, len;
+        __u8 token_stream[];
+};
+
+/**
+ * struct nl80211_wowlan_tcp_data_token_feature - data token features
+ * @min_len: minimum token length
+ * @max_len: maximum token length
+ * @bufsize: total available token buffer size (max size of @token_stream)
+ */
+struct nl80211_wowlan_tcp_data_token_feature {
+        __u32 min_len, max_len, bufsize;
+};
+
+/**
+ * enum nl80211_wowlan_tcp_attrs - WoWLAN TCP connection parameters
+ * @__NL80211_WOWLAN_TCP_INVALID: invalid number for nested attributes
+ * @NL80211_WOWLAN_TCP_SRC_IPV4: source IPv4 address (in network byte order)
+ * @NL80211_WOWLAN_TCP_DST_IPV4: destination IPv4 address
+ *      (in network byte order)
+ * @NL80211_WOWLAN_TCP_DST_MAC: destination MAC address, this is given because
+ *      route lookup when configured might be invalid by the time we suspend,
+ *      and doing a route lookup when suspending is no longer possible as it
+ *      might require ARP querying.
+ * @NL80211_WOWLAN_TCP_SRC_PORT: source port (u16); optional, if not given a
+ *      socket and port will be allocated
+ * @NL80211_WOWLAN_TCP_DST_PORT: destination port (u16)
+ * @NL80211_WOWLAN_TCP_DATA_PAYLOAD: data packet payload, at least one byte.
+ *      For feature advertising, a u32 attribute holding the maximum length
+ *      of the data payload.
+ * @NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ: data packet sequence configuration
+ *      (if desired), a &struct nl80211_wowlan_tcp_data_seq. For feature
+ *      advertising it is just a flag
+ * @NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN: data packet token configuration,
+ *      see &struct nl80211_wowlan_tcp_data_token and for advertising see
+ *      &struct nl80211_wowlan_tcp_data_token_feature.
+ * @NL80211_WOWLAN_TCP_DATA_INTERVAL: data interval in seconds, maximum
+ *      interval in feature advertising (u32)
+ * @NL80211_WOWLAN_TCP_WAKE_PAYLOAD: wake packet payload, for advertising a
+ *      u32 attribute holding the maximum length
+ * @NL80211_WOWLAN_TCP_WAKE_MASK: Wake packet payload mask, not used for
+ *      feature advertising. The mask works like @NL80211_WOWLAN_PKTPAT_MASK
+ *      but on the TCP payload only.
+ * @NUM_NL80211_WOWLAN_TCP: number of TCP attributes
+ * @MAX_NL80211_WOWLAN_TCP: highest attribute number
+ */
+enum nl80211_wowlan_tcp_attrs {
+        __NL80211_WOWLAN_TCP_INVALID,
+        NL80211_WOWLAN_TCP_SRC_IPV4,
+        NL80211_WOWLAN_TCP_DST_IPV4,
+        NL80211_WOWLAN_TCP_DST_MAC,
+        NL80211_WOWLAN_TCP_SRC_PORT,
+        NL80211_WOWLAN_TCP_DST_PORT,
+        NL80211_WOWLAN_TCP_DATA_PAYLOAD,
+        NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
+        NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
+        NL80211_WOWLAN_TCP_DATA_INTERVAL,
+        NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
+        NL80211_WOWLAN_TCP_WAKE_MASK,
+
+        /* keep last */
+        NUM_NL80211_WOWLAN_TCP,
+        MAX_NL80211_WOWLAN_TCP = NUM_NL80211_WOWLAN_TCP - 1
+};
+
+/**
  * enum nl80211_iface_limit_attrs - limit attributes
  * @NL80211_IFACE_LIMIT_UNSPEC: (reserved)
  * @NL80211_IFACE_LIMIT_MAX: maximum number of interfaces that
@@ -3234,6 +3454,8 @@ enum nl80211_ap_sme_features {
  *      Note that even for drivers that support this, the default is to add
  *      stations in authenticated/associated state, so to add unauthenticated
  *      stations the authenticated/associated bits have to be set in the mask.
+ * @NL80211_FEATURE_ADVERTISE_CHAN_LIMITS: cfg80211 advertises channel limits
+ *      (HT40, VHT 80/160 MHz) if this flag is set
  */
 enum nl80211_feature_flags {
         NL80211_FEATURE_SK_TX_STATUS                    = 1 << 0,
@@ -3249,7 +3471,9 @@ enum nl80211_feature_flags {
         NL80211_FEATURE_NEED_OBSS_SCAN                  = 1 << 10,
         NL80211_FEATURE_P2P_GO_CTWIN                    = 1 << 11,
         NL80211_FEATURE_P2P_GO_OPPPS                    = 1 << 12,
-        NL80211_FEATURE_FULL_AP_CLIENT_STATE            = 1 << 13,
+        /* bit 13 is reserved */
+        NL80211_FEATURE_ADVERTISE_CHAN_LIMITS           = 1 << 14,
+        NL80211_FEATURE_FULL_AP_CLIENT_STATE            = 1 << 15,
 };
 
 /**
@@ -3323,4 +3547,44 @@ enum nl80211_acl_policy {
         NL80211_ACL_POLICY_DENY_UNLESS_LISTED,
 };
 
+/**
+ * enum nl80211_radar_event - type of radar event for DFS operation
+ *
+ * Type of event to be used with NL80211_ATTR_RADAR_EVENT to inform userspace
+ * about detected radars or success of the channel available check (CAC)
+ *
+ * @NL80211_RADAR_DETECTED: A radar pattern has been detected. The channel is
+ *      now unusable.
+ * @NL80211_RADAR_CAC_FINISHED: Channel Availability Check has been finished,
+ *      the channel is now available.
+ * @NL80211_RADAR_CAC_ABORTED: Channel Availability Check has been aborted, no
+ *      change to the channel status.
+ * @NL80211_RADAR_NOP_FINISHED: The Non-Occupancy Period for this channel is
+ *      over, channel becomes usable.
+ */
+enum nl80211_radar_event {
+        NL80211_RADAR_DETECTED,
+        NL80211_RADAR_CAC_FINISHED,
+        NL80211_RADAR_CAC_ABORTED,
+        NL80211_RADAR_NOP_FINISHED,
+};
+
+/**
+ * enum nl80211_dfs_state - DFS states for channels
+ *
+ * Channel states used by the DFS code.
+ *
+ * @IEEE80211_DFS_USABLE: The channel can be used, but channel availability
+ *      check (CAC) must be performed before using it for AP or IBSS.
+ * @IEEE80211_DFS_UNAVAILABLE: A radar has been detected on this channel, it
+ *      is therefore marked as not available.
+ * @IEEE80211_DFS_AVAILABLE: The channel has been CAC checked and is available.
+ */
+
+enum nl80211_dfs_state {
+        NL80211_DFS_USABLE,
+        NL80211_DFS_UNAVAILABLE,
+        NL80211_DFS_AVAILABLE,
+};
+
 #endif /* __LINUX_NL80211_H */
diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index b4ecf267a34b..0ecf947ad378 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -258,6 +258,17 @@ config MAC80211_MESH_SYNC_DEBUG
 
           Do not select this option.
 
+config MAC80211_MESH_PS_DEBUG
+        bool "Verbose mesh powersave debugging"
+        depends on MAC80211_DEBUG_MENU
+        depends on MAC80211_MESH
+        ---help---
+          Selecting this option causes mac80211 to print out very verbose mesh
+          powersave debugging messages (when mac80211 is taking part in a
+          mesh network).
+
+          Do not select this option.
+
 config MAC80211_TDLS_DEBUG
         bool "Verbose TDLS debugging"
         depends on MAC80211_DEBUG_MENU
diff --git a/net/mac80211/Makefile b/net/mac80211/Makefile
index 4911202334d9..9d7d840aac6d 100644
--- a/net/mac80211/Makefile
+++ b/net/mac80211/Makefile
@@ -39,7 +39,8 @@ mac80211-$(CONFIG_MAC80211_MESH) += \
         mesh_pathtbl.o \
         mesh_plink.o \
         mesh_hwmp.o \
-        mesh_sync.o
+        mesh_sync.o \
+        mesh_ps.o
 
 mac80211-$(CONFIG_PM) += pm.o
 
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 15d886c639e9..179dcbd8be1c 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -492,7 +492,10 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
 #ifdef CONFIG_MAC80211_MESH
                 sinfo->filled |= STATION_INFO_LLID |
                                  STATION_INFO_PLID |
-                                 STATION_INFO_PLINK_STATE;
+                                 STATION_INFO_PLINK_STATE |
+                                 STATION_INFO_LOCAL_PM |
+                                 STATION_INFO_PEER_PM |
+                                 STATION_INFO_NONPEER_PM;
 
                 sinfo->llid = le16_to_cpu(sta->llid);
                 sinfo->plid = le16_to_cpu(sta->plid);
@@ -501,6 +504,9 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
                         sinfo->filled |= STATION_INFO_T_OFFSET;
                         sinfo->t_offset = sta->t_offset;
                 }
+                sinfo->local_pm = sta->local_pm;
+                sinfo->peer_pm = sta->peer_pm;
+                sinfo->nonpeer_pm = sta->nonpeer_pm;
 #endif
         }
 
@@ -922,11 +928,13 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
         /* TODO: make hostapd tell us what it wants */
         sdata->smps_mode = IEEE80211_SMPS_OFF;
         sdata->needed_rx_chains = sdata->local->rx_chains;
+        sdata->radar_required = params->radar_required;
 
         err = ieee80211_vif_use_channel(sdata, &params->chandef,
                                         IEEE80211_CHANCTX_SHARED);
         if (err)
                 return err;
+        ieee80211_vif_copy_chanctx_to_vlans(sdata, false);
 
         /*
          * Apply control port protocol, this allows us to
@@ -1041,6 +1049,7 @@ static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
         local->total_ps_buffered -= skb_queue_len(&sdata->u.ap.ps.bc_buf);
         skb_queue_purge(&sdata->u.ap.ps.bc_buf);
 
+        ieee80211_vif_copy_chanctx_to_vlans(sdata, true);
         ieee80211_vif_release_channel(sdata);
 
         return 0;
@@ -1243,25 +1252,26 @@ static int sta_apply_parameters(struct ieee80211_local *local,
 
         if (params->ht_capa)
                 ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
-                                                  params->ht_capa,
-                                                  &sta->sta.ht_cap);
+                                                  params->ht_capa, sta);
 
         if (params->vht_capa)
                 ieee80211_vht_cap_ie_to_sta_vht_cap(sdata, sband,
-                                                    params->vht_capa,
-                                                    &sta->sta.vht_cap);
+                                                    params->vht_capa, sta);
 
         if (ieee80211_vif_is_mesh(&sdata->vif)) {
 #ifdef CONFIG_MAC80211_MESH
+                u32 changed = 0;
                 if (sdata->u.mesh.security & IEEE80211_MESH_SEC_SECURED) {
-                        u32 changed = 0;
-
                         switch (params->plink_state) {
                         case NL80211_PLINK_ESTAB:
                                 if (sta->plink_state != NL80211_PLINK_ESTAB)
                                         changed = mesh_plink_inc_estab_count(
                                                         sdata);
                                 sta->plink_state = params->plink_state;
+
+                                ieee80211_mps_sta_status_update(sta);
+                                changed |= ieee80211_mps_set_sta_local_pm(sta,
+                                              sdata->u.mesh.mshcfg.power_mode);
                                 break;
                         case NL80211_PLINK_LISTEN:
                         case NL80211_PLINK_BLOCKED:
@@ -1273,22 +1283,31 @@ static int sta_apply_parameters(struct ieee80211_local *local,
                                         changed = mesh_plink_dec_estab_count(
                                                         sdata);
                                 sta->plink_state = params->plink_state;
+
+                                ieee80211_mps_sta_status_update(sta);
+                                changed |=
+                                      ieee80211_mps_local_status_update(sdata);
                                 break;
                         default:
                                 /*  nothing  */
                                 break;
                         }
-                        ieee80211_bss_info_change_notify(sdata, changed);
                 } else {
                         switch (params->plink_action) {
                         case PLINK_ACTION_OPEN:
-                                mesh_plink_open(sta);
+                                changed |= mesh_plink_open(sta);
                                 break;
                         case PLINK_ACTION_BLOCK:
-                                mesh_plink_block(sta);
+                                changed |= mesh_plink_block(sta);
                                 break;
                         }
                 }
+
+                if (params->local_pm)
+                        changed |=
+                              ieee80211_mps_set_sta_local_pm(sta,
+                                                             params->local_pm);
+                ieee80211_bss_info_change_notify(sdata, changed);
 #endif
         }
 
@@ -1393,9 +1412,11 @@ static int ieee80211_change_station(struct wiphy *wiphy,
                 return -ENOENT;
         }
 
-        /* in station mode, supported rates are only valid with TDLS */
+        /* in station mode, some updates are only valid with TDLS */
         if (sdata->vif.type == NL80211_IFTYPE_STATION &&
-            params->supported_rates &&
+            (params->supported_rates || params->ht_capa || params->vht_capa ||
+             params->sta_modify_mask ||
+             (params->sta_flags_mask & BIT(NL80211_STA_FLAG_WME))) &&
             !test_sta_flag(sta, WLAN_STA_TDLS_PEER)) {
                 mutex_unlock(&local->sta_mtx);
                 return -EINVAL;
@@ -1777,6 +1798,14 @@ static int ieee80211_update_mesh_config(struct wiphy *wiphy,
         if (_chg_mesh_attr(NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL, mask))
                 conf->dot11MeshHWMPconfirmationInterval =
                         nconf->dot11MeshHWMPconfirmationInterval;
+        if (_chg_mesh_attr(NL80211_MESHCONF_POWER_MODE, mask)) {
+                conf->power_mode = nconf->power_mode;
+                ieee80211_mps_local_status_update(sdata);
+        }
+        if (_chg_mesh_attr(NL80211_MESHCONF_AWAKE_WINDOW, mask))
+                conf->dot11MeshAwakeWindowDuration =
+                        nconf->dot11MeshAwakeWindowDuration;
+        ieee80211_mbss_info_change_notify(sdata, BSS_CHANGED_BEACON);
         return 0;
 }
 
@@ -1802,9 +1831,7 @@ static int ieee80211_join_mesh(struct wiphy *wiphy, struct net_device *dev,
         if (err)
                 return err;
 
-        ieee80211_start_mesh(sdata);
-
-        return 0;
+        return ieee80211_start_mesh(sdata);
 }
 
 static int ieee80211_leave_mesh(struct wiphy *wiphy, struct net_device *dev)
@@ -2369,7 +2396,8 @@ static int ieee80211_start_roc_work(struct ieee80211_local *local,
         INIT_LIST_HEAD(&roc->dependents);
 
         /* if there's one pending or we're scanning, queue this one */
-        if (!list_empty(&local->roc_list) || local->scanning)
+        if (!list_empty(&local->roc_list) ||
+            local->scanning || local->radar_detect_enabled)
                 goto out_check_combine;
 
         /* if not HW assist, just queue & schedule work */
@@ -2619,6 +2647,37 @@ static int ieee80211_cancel_remain_on_channel(struct wiphy *wiphy,
         return ieee80211_cancel_roc(local, cookie, false);
 }
 
+static int ieee80211_start_radar_detection(struct wiphy *wiphy,
+                                           struct net_device *dev,
+                                           struct cfg80211_chan_def *chandef)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = sdata->local;
+        unsigned long timeout;
+        int err;
+
+        if (!list_empty(&local->roc_list) || local->scanning)
+                return -EBUSY;
+
+        /* whatever, but channel contexts should not complain about that one */
+        sdata->smps_mode = IEEE80211_SMPS_OFF;
+        sdata->needed_rx_chains = local->rx_chains;
+        sdata->radar_required = true;
+
+        mutex_lock(&local->iflist_mtx);
+        err = ieee80211_vif_use_channel(sdata, chandef,
+                                        IEEE80211_CHANCTX_SHARED);
+        mutex_unlock(&local->iflist_mtx);
+        if (err)
+                return err;
+
+        timeout = msecs_to_jiffies(IEEE80211_DFS_MIN_CAC_TIME_MS);
+        ieee80211_queue_delayed_work(&sdata->local->hw,
+                                     &sdata->dfs_cac_timer_work, timeout);
+
+        return 0;
+}
+
 static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
                              struct ieee80211_channel *chan, bool offchan,
                              unsigned int wait, const u8 *buf, size_t len,
@@ -2723,7 +2782,8 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
                 goto out_unlock;
         }
 
-        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_TX_OFFCHAN;
+        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_TX_OFFCHAN |
+                                        IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
         if (local->hw.flags & IEEE80211_HW_QUEUE_CONTROL)
                 IEEE80211_SKB_CB(skb)->hw_queue =
                         local->hw.offchannel_tx_hw_queue;
@@ -3323,4 +3383,5 @@ struct cfg80211_ops mac80211_config_ops = {
         .get_et_stats = ieee80211_get_et_stats,
         .get_et_strings = ieee80211_get_et_strings,
         .get_channel = ieee80211_cfg_get_channel,
+        .start_radar_detection = ieee80211_start_radar_detection,
 };
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index 1bfe0a8b19d2..78c0d90dd641 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -9,7 +9,7 @@
 #include "ieee80211_i.h"
 #include "driver-ops.h"
 
-static void ieee80211_change_chandef(struct ieee80211_local *local,
+static void ieee80211_change_chanctx(struct ieee80211_local *local,
                                      struct ieee80211_chanctx *ctx,
                                      const struct cfg80211_chan_def *chandef)
 {
@@ -49,7 +49,7 @@ ieee80211_find_chanctx(struct ieee80211_local *local,
                 if (!compat)
                         continue;
 
-                ieee80211_change_chandef(local, ctx, compat);
+                ieee80211_change_chanctx(local, ctx, compat);
 
                 return ctx;
         }
@@ -91,6 +91,10 @@ ieee80211_new_chanctx(struct ieee80211_local *local,
 
         list_add_rcu(&ctx->list, &local->chanctx_list);
 
+        mutex_lock(&local->mtx);
+        ieee80211_recalc_idle(local);
+        mutex_unlock(&local->mtx);
+
         return ctx;
 }
 
@@ -110,6 +114,10 @@ static void ieee80211_free_chanctx(struct ieee80211_local *local,
 
         list_del_rcu(&ctx->list);
         kfree_rcu(ctx, rcu_head);
+
+        mutex_lock(&local->mtx);
+        ieee80211_recalc_idle(local);
+        mutex_unlock(&local->mtx);
 }
 
 static int ieee80211_assign_vif_chanctx(struct ieee80211_sub_if_data *sdata,
@@ -128,6 +136,11 @@ static int ieee80211_assign_vif_chanctx(struct ieee80211_sub_if_data *sdata,
         ctx->refcount++;
 
         ieee80211_recalc_txpower(sdata);
+        sdata->vif.bss_conf.idle = false;
+
+        if (sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE &&
+            sdata->vif.type != NL80211_IFTYPE_MONITOR)
+                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_IDLE);
 
         return 0;
 }
@@ -162,7 +175,7 @@ static void ieee80211_recalc_chanctx_chantype(struct ieee80211_local *local,
         if (WARN_ON_ONCE(!compat))
                 return;
 
-        ieee80211_change_chandef(local, ctx, compat);
+        ieee80211_change_chanctx(local, ctx, compat);
 }
 
 static void ieee80211_unassign_vif_chanctx(struct ieee80211_sub_if_data *sdata,
@@ -175,11 +188,18 @@ static void ieee80211_unassign_vif_chanctx(struct ieee80211_sub_if_data *sdata,
         ctx->refcount--;
         rcu_assign_pointer(sdata->vif.chanctx_conf, NULL);
 
+        sdata->vif.bss_conf.idle = true;
+
+        if (sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE &&
+            sdata->vif.type != NL80211_IFTYPE_MONITOR)
+                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_IDLE);
+
         drv_unassign_vif_chanctx(local, sdata, ctx);
 
         if (ctx->refcount > 0) {
                 ieee80211_recalc_chanctx_chantype(sdata->local, ctx);
                 ieee80211_recalc_smps_chanctx(local, ctx);
+                ieee80211_recalc_radar_chanctx(local, ctx);
         }
 }
 
@@ -198,20 +218,42 @@ static void __ieee80211_vif_release_channel(struct ieee80211_sub_if_data *sdata)
 
         ctx = container_of(conf, struct ieee80211_chanctx, conf);
 
-        if (sdata->vif.type == NL80211_IFTYPE_AP) {
-                struct ieee80211_sub_if_data *vlan;
-
-                /* for the VLAN list */
-                ASSERT_RTNL();
-                list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
-                        rcu_assign_pointer(vlan->vif.chanctx_conf, NULL);
-        }
-
         ieee80211_unassign_vif_chanctx(sdata, ctx);
         if (ctx->refcount == 0)
                 ieee80211_free_chanctx(local, ctx);
 }
 
+void ieee80211_recalc_radar_chanctx(struct ieee80211_local *local,
+                                    struct ieee80211_chanctx *chanctx)
+{
+        struct ieee80211_sub_if_data *sdata;
+        bool radar_enabled = false;
+
+        lockdep_assert_held(&local->chanctx_mtx);
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+                if (sdata->radar_required) {
+                        radar_enabled = true;
+                        break;
+                }
+        }
+        rcu_read_unlock();
+
+        if (radar_enabled == chanctx->conf.radar_enabled)
+                return;
+
+        chanctx->conf.radar_enabled = radar_enabled;
+        local->radar_detect_enabled = chanctx->conf.radar_enabled;
+
+        if (!local->use_chanctx) {
+                local->hw.conf.radar_enabled = chanctx->conf.radar_enabled;
+                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
+        }
+
+        drv_change_chanctx(local, chanctx, IEEE80211_CHANCTX_CHANGE_RADAR);
+}
+
 void ieee80211_recalc_smps_chanctx(struct ieee80211_local *local,
                                    struct ieee80211_chanctx *chanctx)
 {
@@ -326,16 +368,57 @@ int ieee80211_vif_use_channel(struct ieee80211_sub_if_data *sdata,
                 goto out;
         }
 
-        if (sdata->vif.type == NL80211_IFTYPE_AP) {
-                struct ieee80211_sub_if_data *vlan;
+        ieee80211_recalc_smps_chanctx(local, ctx);
+        ieee80211_recalc_radar_chanctx(local, ctx);
+ out:
+        mutex_unlock(&local->chanctx_mtx);
+        return ret;
+}
+
+int ieee80211_vif_change_bandwidth(struct ieee80211_sub_if_data *sdata,
+                                   const struct cfg80211_chan_def *chandef,
+                                   u32 *changed)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_chanctx_conf *conf;
+        struct ieee80211_chanctx *ctx;
+        int ret;
+
+        if (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
+                                     IEEE80211_CHAN_DISABLED))
+                return -EINVAL;
+
+        mutex_lock(&local->chanctx_mtx);
+        if (cfg80211_chandef_identical(chandef, &sdata->vif.bss_conf.chandef)) {
+                ret = 0;
+                goto out;
+        }
+
+        if (chandef->width == NL80211_CHAN_WIDTH_20_NOHT ||
+            sdata->vif.bss_conf.chandef.width == NL80211_CHAN_WIDTH_20_NOHT) {
+                ret = -EINVAL;
+                goto out;
+        }
 
-                /* for the VLAN list */
-                ASSERT_RTNL();
-                list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
-                        rcu_assign_pointer(vlan->vif.chanctx_conf, &ctx->conf);
+        conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
+                                         lockdep_is_held(&local->chanctx_mtx));
+        if (!conf) {
+                ret = -EINVAL;
+                goto out;
         }
 
-        ieee80211_recalc_smps_chanctx(local, ctx);
+        ctx = container_of(conf, struct ieee80211_chanctx, conf);
+        if (!cfg80211_chandef_compatible(&conf->def, chandef)) {
+                ret = -EINVAL;
+                goto out;
+        }
+
+        sdata->vif.bss_conf.chandef = *chandef;
+
+        ieee80211_recalc_chanctx_chantype(local, ctx);
+
+        *changed |= BSS_CHANGED_BANDWIDTH;
+        ret = 0;
  out:
         mutex_unlock(&local->chanctx_mtx);
         return ret;
@@ -369,6 +452,40 @@ void ieee80211_vif_vlan_copy_chanctx(struct ieee80211_sub_if_data *sdata)
         mutex_unlock(&local->chanctx_mtx);
 }
 
+void ieee80211_vif_copy_chanctx_to_vlans(struct ieee80211_sub_if_data *sdata,
+                                         bool clear)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_sub_if_data *vlan;
+        struct ieee80211_chanctx_conf *conf;
+
+        ASSERT_RTNL();
+
+        if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_AP))
+                return;
+
+        mutex_lock(&local->chanctx_mtx);
+
+        /*
+         * Check that conf exists, even when clearing this function
+         * must be called with the AP's channel context still there
+         * as it would otherwise cause VLANs to have an invalid
+         * channel context pointer for a while, possibly pointing
+         * to a channel context that has already been freed.
+         */
+        conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
+                                lockdep_is_held(&local->chanctx_mtx));
+        WARN_ON(!conf);
+
+        if (clear)
+                conf = NULL;
+
+        list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
+                rcu_assign_pointer(vlan->vif.chanctx_conf, conf);
+
+        mutex_unlock(&local->chanctx_mtx);
+}
+
 void ieee80211_iter_chan_contexts_atomic(
         struct ieee80211_hw *hw,
         void (*iter)(struct ieee80211_hw *hw,
diff --git a/net/mac80211/debug.h b/net/mac80211/debug.h
index 8f383a576016..4ccc5ed6237d 100644
--- a/net/mac80211/debug.h
+++ b/net/mac80211/debug.h
@@ -44,6 +44,12 @@
 #define MAC80211_MESH_SYNC_DEBUG 0
 #endif
 
+#ifdef CONFIG_MAC80211_MESH_PS_DEBUG
+#define MAC80211_MESH_PS_DEBUG 1
+#else
+#define MAC80211_MESH_PS_DEBUG 0
+#endif
+
 #ifdef CONFIG_MAC80211_TDLS_DEBUG
 #define MAC80211_TDLS_DEBUG 1
 #else
@@ -151,6 +157,10 @@ do {									\
         _sdata_dbg(MAC80211_MESH_SYNC_DEBUG,                            \
                    sdata, fmt, ##__VA_ARGS__)
 
+#define mps_dbg(sdata, fmt, ...)                                        \
+        _sdata_dbg(MAC80211_MESH_PS_DEBUG,                              \
+                   sdata, fmt, ##__VA_ARGS__)
+
 #define tdls_dbg(sdata, fmt, ...)                                       \
         _sdata_dbg(MAC80211_TDLS_DEBUG,                                 \
                    sdata, fmt, ##__VA_ARGS__)
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index 466f4b45dd94..b0e32d628114 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -121,8 +121,8 @@ static ssize_t hwflags_read(struct file *file, char __user *user_buf,
                 sf += snprintf(buf + sf, mxln - sf, "SIGNAL_UNSPEC\n");
         if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
                 sf += snprintf(buf + sf, mxln - sf, "SIGNAL_DBM\n");
-        if (local->hw.flags & IEEE80211_HW_NEED_DTIM_PERIOD)
-                sf += snprintf(buf + sf, mxln - sf, "NEED_DTIM_PERIOD\n");
+        if (local->hw.flags & IEEE80211_HW_NEED_DTIM_BEFORE_ASSOC)
+                sf += snprintf(buf + sf, mxln - sf, "NEED_DTIM_BEFORE_ASSOC\n");
         if (local->hw.flags & IEEE80211_HW_SPECTRUM_MGMT)
                 sf += snprintf(buf + sf, mxln - sf, "SPECTRUM_MGMT\n");
         if (local->hw.flags & IEEE80211_HW_AMPDU_AGGREGATION)
@@ -151,8 +151,6 @@ static ssize_t hwflags_read(struct file *file, char __user *user_buf,
                 sf += snprintf(buf + sf, mxln - sf, "AP_LINK_PS\n");
         if (local->hw.flags & IEEE80211_HW_TX_AMPDU_SETUP_IN_HW)
                 sf += snprintf(buf + sf, mxln - sf, "TX_AMPDU_SETUP_IN_HW\n");
-        if (local->hw.flags & IEEE80211_HW_SCAN_WHILE_IDLE)
-                sf += snprintf(buf + sf, mxln - sf, "SCAN_WHILE_IDLE\n");
 
         rv = simple_read_from_buffer(user_buf, count, ppos, buf, strlen(buf));
         kfree(buf);
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index cbde5cc49a40..059bbb82e84f 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -515,6 +515,9 @@ IEEE80211_IF_FILE(dot11MeshHWMProotInterval,
                   u.mesh.mshcfg.dot11MeshHWMProotInterval, DEC);
 IEEE80211_IF_FILE(dot11MeshHWMPconfirmationInterval,
                   u.mesh.mshcfg.dot11MeshHWMPconfirmationInterval, DEC);
+IEEE80211_IF_FILE(power_mode, u.mesh.mshcfg.power_mode, DEC);
+IEEE80211_IF_FILE(dot11MeshAwakeWindowDuration,
+                  u.mesh.mshcfg.dot11MeshAwakeWindowDuration, DEC);
 #endif
 
 #define DEBUGFS_ADD_MODE(name, mode) \
@@ -620,6 +623,8 @@ static void add_mesh_config(struct ieee80211_sub_if_data *sdata)
         MESHPARAMS_ADD(dot11MeshHWMPactivePathToRootTimeout);
         MESHPARAMS_ADD(dot11MeshHWMProotInterval);
         MESHPARAMS_ADD(dot11MeshHWMPconfirmationInterval);
+        MESHPARAMS_ADD(power_mode);
+        MESHPARAMS_ADD(dot11MeshAwakeWindowDuration);
 #undef MESHPARAMS_ADD
 }
 #endif
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index 6fb1168b9f16..c7591f73dbc3 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -65,7 +65,7 @@ static ssize_t sta_flags_read(struct file *file, char __user *userbuf,
         test_sta_flag(sta, WLAN_STA_##flg) ? #flg "\n" : ""
 
         int res = scnprintf(buf, sizeof(buf),
-                            "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
+                            "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
                             TEST(AUTH), TEST(ASSOC), TEST(PS_STA),
                             TEST(PS_DRIVER), TEST(AUTHORIZED),
                             TEST(SHORT_PREAMBLE),
@@ -74,7 +74,8 @@ static ssize_t sta_flags_read(struct file *file, char __user *userbuf,
                             TEST(UAPSD), TEST(SP), TEST(TDLS_PEER),
                             TEST(TDLS_PEER_AUTH), TEST(4ADDR_EVENT),
                             TEST(INSERTED), TEST(RATE_CONTROL),
-                            TEST(TOFFSET_KNOWN));
+                            TEST(TOFFSET_KNOWN), TEST(MPSP_OWNER),
+                            TEST(MPSP_RECIPIENT));
 #undef TEST
         return simple_read_from_buffer(userbuf, count, ppos, buf, res);
 }
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 434b3c4f31b5..ee56d0779d8b 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -207,13 +207,16 @@ static inline void drv_bss_info_changed(struct ieee80211_local *local,
 {
         might_sleep();
 
-        WARN_ON_ONCE(changed & (BSS_CHANGED_BEACON |
-                                BSS_CHANGED_BEACON_ENABLED) &&
-                     sdata->vif.type != NL80211_IFTYPE_AP &&
-                     sdata->vif.type != NL80211_IFTYPE_ADHOC &&
-                     sdata->vif.type != NL80211_IFTYPE_MESH_POINT);
-        WARN_ON_ONCE(sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE &&
-                     changed & ~BSS_CHANGED_IDLE);
+        if (WARN_ON_ONCE(changed & (BSS_CHANGED_BEACON |
+                                    BSS_CHANGED_BEACON_ENABLED) &&
+                         sdata->vif.type != NL80211_IFTYPE_AP &&
+                         sdata->vif.type != NL80211_IFTYPE_ADHOC &&
+                         sdata->vif.type != NL80211_IFTYPE_MESH_POINT))
+                return;
+
+        if (WARN_ON_ONCE(sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE ||
+                         sdata->vif.type == NL80211_IFTYPE_MONITOR))
+                return;
 
         check_sdata_in_driver(sdata);
 
@@ -528,6 +531,43 @@ static inline void drv_sta_remove_debugfs(struct ieee80211_local *local,
                 local->ops->sta_remove_debugfs(&local->hw, &sdata->vif,
                                                sta, dir);
 }
+
+static inline
+void drv_add_interface_debugfs(struct ieee80211_local *local,
+                               struct ieee80211_sub_if_data *sdata)
+{
+        might_sleep();
+
+        check_sdata_in_driver(sdata);
+
+        if (!local->ops->add_interface_debugfs)
+                return;
+
+        local->ops->add_interface_debugfs(&local->hw, &sdata->vif,
+                                          sdata->debugfs.dir);
+}
+
+static inline
+void drv_remove_interface_debugfs(struct ieee80211_local *local,
+                                  struct ieee80211_sub_if_data *sdata)
+{
+        might_sleep();
+
+        check_sdata_in_driver(sdata);
+
+        if (!local->ops->remove_interface_debugfs)
+                return;
+
+        local->ops->remove_interface_debugfs(&local->hw, &sdata->vif,
+                                             sdata->debugfs.dir);
+}
+#else
+static inline
+void drv_add_interface_debugfs(struct ieee80211_local *local,
+                               struct ieee80211_sub_if_data *sdata) {}
+static inline
+void drv_remove_interface_debugfs(struct ieee80211_local *local,
+                                  struct ieee80211_sub_if_data *sdata) {}
 #endif
 
 static inline __must_check
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index 61ac7c48ac0c..0db25d4bb223 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -37,6 +37,9 @@ void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
         u8 *smask = (u8 *)(&sdata->u.mgd.ht_capa_mask.mcs.rx_mask);
         int i;
 
+        if (!ht_cap->ht_supported)
+                return;
+
         if (sdata->vif.type != NL80211_IFTYPE_STATION) {
                 /* AP interfaces call this code when adding new stations,
                  * so just silently ignore non station interfaces.
@@ -89,22 +92,24 @@ void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
 }
 
 
-void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_sub_if_data *sdata,
+bool ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_sub_if_data *sdata,
                                        struct ieee80211_supported_band *sband,
-                                       struct ieee80211_ht_cap *ht_cap_ie,
-                                       struct ieee80211_sta_ht_cap *ht_cap)
+                                       const struct ieee80211_ht_cap *ht_cap_ie,
+                                       struct sta_info *sta)
 {
+        struct ieee80211_sta_ht_cap ht_cap;
         u8 ampdu_info, tx_mcs_set_cap;
         int i, max_tx_streams;
+        bool changed;
+        enum ieee80211_sta_rx_bandwidth bw;
+        enum ieee80211_smps_mode smps_mode;
 
-        BUG_ON(!ht_cap);
-
-        memset(ht_cap, 0, sizeof(*ht_cap));
+        memset(&ht_cap, 0, sizeof(ht_cap));
 
         if (!ht_cap_ie || !sband->ht_cap.ht_supported)
-                return;
+                goto apply;
 
-        ht_cap->ht_supported = true;
+        ht_cap.ht_supported = true;
 
         /*
          * The bits listed in this expression should be
@@ -112,7 +117,7 @@ void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_sub_if_data *sdata,
          * advertises more then we can't use those thus
          * we mask them out.
          */
-        ht_cap->cap = le16_to_cpu(ht_cap_ie->cap_info) &
+        ht_cap.cap = le16_to_cpu(ht_cap_ie->cap_info) &
                 (sband->ht_cap.cap |
                  ~(IEEE80211_HT_CAP_LDPC_CODING |
                    IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
@@ -121,44 +126,30 @@ void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_sub_if_data *sdata,
                    IEEE80211_HT_CAP_SGI_40 |
                    IEEE80211_HT_CAP_DSSSCCK40));
 
-        /* Unset 40 MHz if we're not using a 40 MHz channel */
-        switch (sdata->vif.bss_conf.chandef.width) {
-        case NL80211_CHAN_WIDTH_20_NOHT:
-        case NL80211_CHAN_WIDTH_20:
-                ht_cap->cap &= ~IEEE80211_HT_CAP_SGI_40;
-                ht_cap->cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
-                break;
-        case NL80211_CHAN_WIDTH_40:
-        case NL80211_CHAN_WIDTH_80:
-        case NL80211_CHAN_WIDTH_80P80:
-        case NL80211_CHAN_WIDTH_160:
-                break;
-        }
-
         /*
          * The STBC bits are asymmetric -- if we don't have
          * TX then mask out the peer's RX and vice versa.
          */
         if (!(sband->ht_cap.cap & IEEE80211_HT_CAP_TX_STBC))
-                ht_cap->cap &= ~IEEE80211_HT_CAP_RX_STBC;
+                ht_cap.cap &= ~IEEE80211_HT_CAP_RX_STBC;
         if (!(sband->ht_cap.cap & IEEE80211_HT_CAP_RX_STBC))
-                ht_cap->cap &= ~IEEE80211_HT_CAP_TX_STBC;
+                ht_cap.cap &= ~IEEE80211_HT_CAP_TX_STBC;
 
         ampdu_info = ht_cap_ie->ampdu_params_info;
-        ht_cap->ampdu_factor =
+        ht_cap.ampdu_factor =
                 ampdu_info & IEEE80211_HT_AMPDU_PARM_FACTOR;
-        ht_cap->ampdu_density =
+        ht_cap.ampdu_density =
                 (ampdu_info & IEEE80211_HT_AMPDU_PARM_DENSITY) >> 2;
 
         /* own MCS TX capabilities */
         tx_mcs_set_cap = sband->ht_cap.mcs.tx_params;
 
         /* Copy peer MCS TX capabilities, the driver might need them. */
-        ht_cap->mcs.tx_params = ht_cap_ie->mcs.tx_params;
+        ht_cap.mcs.tx_params = ht_cap_ie->mcs.tx_params;
 
         /* can we TX with MCS rates? */
         if (!(tx_mcs_set_cap & IEEE80211_HT_MCS_TX_DEFINED))
-                return;
+                goto apply;
 
         /* Counting from 0, therefore +1 */
         if (tx_mcs_set_cap & IEEE80211_HT_MCS_TX_RX_DIFF)
@@ -176,25 +167,75 @@ void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_sub_if_data *sdata,
          * - remainder are multiple spatial streams using unequal modulation
          */
         for (i = 0; i < max_tx_streams; i++)
-                ht_cap->mcs.rx_mask[i] =
+                ht_cap.mcs.rx_mask[i] =
                         sband->ht_cap.mcs.rx_mask[i] & ht_cap_ie->mcs.rx_mask[i];
 
         if (tx_mcs_set_cap & IEEE80211_HT_MCS_TX_UNEQUAL_MODULATION)
                 for (i = IEEE80211_HT_MCS_UNEQUAL_MODULATION_START_BYTE;
                      i < IEEE80211_HT_MCS_MASK_LEN; i++)
-                        ht_cap->mcs.rx_mask[i] =
+                        ht_cap.mcs.rx_mask[i] =
                                 sband->ht_cap.mcs.rx_mask[i] &
                                         ht_cap_ie->mcs.rx_mask[i];
 
         /* handle MCS rate 32 too */
         if (sband->ht_cap.mcs.rx_mask[32/8] & ht_cap_ie->mcs.rx_mask[32/8] & 1)
-                ht_cap->mcs.rx_mask[32/8] |= 1;
+                ht_cap.mcs.rx_mask[32/8] |= 1;
 
+ apply:
         /*
          * If user has specified capability over-rides, take care
          * of that here.
          */
-        ieee80211_apply_htcap_overrides(sdata, ht_cap);
+        ieee80211_apply_htcap_overrides(sdata, &ht_cap);
+
+        changed = memcmp(&sta->sta.ht_cap, &ht_cap, sizeof(ht_cap));
+
+        memcpy(&sta->sta.ht_cap, &ht_cap, sizeof(ht_cap));
+
+        switch (sdata->vif.bss_conf.chandef.width) {
+        default:
+                WARN_ON_ONCE(1);
+                /* fall through */
+        case NL80211_CHAN_WIDTH_20_NOHT:
+        case NL80211_CHAN_WIDTH_20:
+                bw = IEEE80211_STA_RX_BW_20;
+                break;
+        case NL80211_CHAN_WIDTH_40:
+        case NL80211_CHAN_WIDTH_80:
+        case NL80211_CHAN_WIDTH_80P80:
+        case NL80211_CHAN_WIDTH_160:
+                bw = ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40 ?
+                                IEEE80211_STA_RX_BW_40 : IEEE80211_STA_RX_BW_20;
+                break;
+        }
+
+        if (bw != sta->sta.bandwidth)
+                changed = true;
+        sta->sta.bandwidth = bw;
+
+        sta->cur_max_bandwidth =
+                ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40 ?
+                                IEEE80211_STA_RX_BW_40 : IEEE80211_STA_RX_BW_20;
+
+        switch ((ht_cap.cap & IEEE80211_HT_CAP_SM_PS)
+                        >> IEEE80211_HT_CAP_SM_PS_SHIFT) {
+        case WLAN_HT_CAP_SM_PS_INVALID:
+        case WLAN_HT_CAP_SM_PS_STATIC:
+                smps_mode = IEEE80211_SMPS_STATIC;
+                break;
+        case WLAN_HT_CAP_SM_PS_DYNAMIC:
+                smps_mode = IEEE80211_SMPS_DYNAMIC;
+                break;
+        case WLAN_HT_CAP_SM_PS_DISABLED:
+                smps_mode = IEEE80211_SMPS_OFF;
+                break;
+        }
+
+        if (smps_mode != sta->sta.smps_mode)
+                changed = true;
+        sta->sta.smps_mode = smps_mode;
+
+        return changed;
 }
 
 void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta,
@@ -406,6 +447,9 @@ void ieee80211_request_smps(struct ieee80211_vif *vif,
         if (WARN_ON(smps_mode == IEEE80211_SMPS_OFF))
                 smps_mode = IEEE80211_SMPS_AUTOMATIC;
 
+        if (sdata->u.mgd.driver_smps_mode == smps_mode)
+                return;
+
         sdata->u.mgd.driver_smps_mode = smps_mode;
 
         ieee80211_queue_work(&sdata->local->hw,
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index b4b866f41919..40b71dfcc79d 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -228,7 +228,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
 
         bss = cfg80211_inform_bss_frame(local->hw.wiphy, chan,
                                         mgmt, skb->len, 0, GFP_KERNEL);
-        cfg80211_put_bss(bss);
+        cfg80211_put_bss(local->hw.wiphy, bss);
         netif_carrier_on(sdata->dev);
         cfg80211_ibss_joined(sdata->dev, ifibss->bssid, GFP_KERNEL);
 }
@@ -242,6 +242,8 @@ static void ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         u32 basic_rates;
         int i, j;
         u16 beacon_int = cbss->beacon_interval;
+        const struct cfg80211_bss_ies *ies;
+        u64 tsf;
 
         lockdep_assert_held(&sdata->u.ibss.mtx);
 
@@ -265,13 +267,17 @@ static void ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
                 }
         }
 
+        rcu_read_lock();
+        ies = rcu_dereference(cbss->ies);
+        tsf = ies->tsf;
+        rcu_read_unlock();
+
         __ieee80211_sta_join_ibss(sdata, cbss->bssid,
                                   beacon_int,
                                   cbss->channel,
                                   basic_rates,
                                   cbss->capability,
-                                  cbss->tsf,
-                                  false);
+                                  tsf, false);
 }
 
 static struct sta_info *ieee80211_ibss_finish_sta(struct sta_info *sta,
@@ -302,7 +308,7 @@ static struct sta_info *ieee80211_ibss_finish_sta(struct sta_info *sta,
                          "TX Auth SA=%pM DA=%pM BSSID=%pM (auth_transaction=1)\n",
                          sdata->vif.addr, addr, sdata->u.ibss.bssid);
                 ieee80211_send_auth(sdata, 1, WLAN_AUTH_OPEN, 0, NULL, 0,
-                                    addr, sdata->u.ibss.bssid, NULL, 0, 0);
+                                    addr, sdata->u.ibss.bssid, NULL, 0, 0, 0);
         }
         return sta;
 }
@@ -422,7 +428,7 @@ static void ieee80211_rx_mgmt_auth_ibss(struct ieee80211_sub_if_data *sdata,
          * has actually implemented this.
          */
         ieee80211_send_auth(sdata, 2, WLAN_AUTH_OPEN, 0, NULL, 0,
-                            mgmt->sa, sdata->u.ibss.bssid, NULL, 0, 0);
+                            mgmt->sa, sdata->u.ibss.bssid, NULL, 0, 0, 0);
 }
 
 static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
@@ -490,33 +496,26 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                 if (sta && elems->ht_operation && elems->ht_cap_elem &&
                     sdata->u.ibss.channel_type != NL80211_CHAN_NO_HT) {
                         /* we both use HT */
-                        struct ieee80211_sta_ht_cap sta_ht_cap_new;
+                        struct ieee80211_ht_cap htcap_ie;
                         struct cfg80211_chan_def chandef;
 
                         ieee80211_ht_oper_to_chandef(channel,
                                                      elems->ht_operation,
                                                      &chandef);
 
-                        ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
-                                                          elems->ht_cap_elem,
-                                                          &sta_ht_cap_new);
+                        memcpy(&htcap_ie, elems->ht_cap_elem, sizeof(htcap_ie));
 
                         /*
                          * fall back to HT20 if we don't use or use
                          * the other extension channel
                          */
-                        if (chandef.width != NL80211_CHAN_WIDTH_40 ||
-                            cfg80211_get_chandef_type(&chandef) !=
+                        if (cfg80211_get_chandef_type(&chandef) !=
                                                 sdata->u.ibss.channel_type)
-                                sta_ht_cap_new.cap &=
-                                        ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
-
-                        if (memcmp(&sta->sta.ht_cap, &sta_ht_cap_new,
-                                   sizeof(sta_ht_cap_new))) {
-                                memcpy(&sta->sta.ht_cap, &sta_ht_cap_new,
-                                       sizeof(sta_ht_cap_new));
-                                rates_updated = true;
-                        }
+                                htcap_ie.cap_info &=
+                                        cpu_to_le16(~IEEE80211_HT_CAP_SUP_WIDTH_20_40);
+
+                        rates_updated |= ieee80211_ht_cap_ie_to_sta_ht_cap(
+                                                sdata, sband, &htcap_ie, sta);
                 }
 
                 if (sta && rates_updated) {
@@ -535,8 +534,8 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
 
         cbss = container_of((void *)bss, struct cfg80211_bss, priv);
 
-        /* was just updated in ieee80211_bss_info_update */
-        beacon_timestamp = cbss->tsf;
+        /* same for beacon and probe response */
+        beacon_timestamp = le64_to_cpu(mgmt->u.beacon.timestamp);
 
         /* check if we need to merge IBSS */
 
@@ -1102,10 +1101,6 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
 
         mutex_unlock(&sdata->u.ibss.mtx);
 
-        mutex_lock(&sdata->local->mtx);
-        ieee80211_recalc_idle(sdata->local);
-        mutex_unlock(&sdata->local->mtx);
-
         /*
          * 802.11n-2009 9.13.3.1: In an IBSS, the HT Protection field is
          * reserved, but an HT STA shall protect HT transmissions as though
@@ -1159,7 +1154,7 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
 
                 if (cbss) {
                         cfg80211_unlink_bss(local->hw.wiphy, cbss);
-                        cfg80211_put_bss(cbss);
+                        cfg80211_put_bss(local->hw.wiphy, cbss);
                 }
         }
 
@@ -1203,9 +1198,5 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
 
         mutex_unlock(&sdata->u.ibss.mtx);
 
-        mutex_lock(&local->mtx);
-        ieee80211_recalc_idle(sdata->local);
-        mutex_unlock(&local->mtx);
-
         return 0;
 }
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 5fba867d9e2e..388580a1bada 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -86,23 +86,11 @@ struct ieee80211_fragment_entry {
 
 
 struct ieee80211_bss {
-        /* don't want to look up all the time */
-        size_t ssid_len;
-        u8 ssid[IEEE80211_MAX_SSID_LEN];
-
-        u32 device_ts;
+        u32 device_ts_beacon, device_ts_presp;
 
         bool wmm_used;
         bool uapsd_supported;
 
-        unsigned long last_probe_resp;
-
-#ifdef CONFIG_MAC80211_MESH
-        u8 *mesh_id;
-        size_t mesh_id_len;
-        u8 *mesh_cfg;
-#endif
-
 #define IEEE80211_MAX_SUPP_RATES 32
         u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
         size_t supp_rates_len;
@@ -153,31 +141,6 @@ enum ieee80211_bss_valid_data_flags {
         IEEE80211_BSS_VALID_ERP                 = BIT(3)
 };
 
-static inline u8 *bss_mesh_cfg(struct ieee80211_bss *bss)
-{
-#ifdef CONFIG_MAC80211_MESH
-        return bss->mesh_cfg;
-#endif
-        return NULL;
-}
-
-static inline u8 *bss_mesh_id(struct ieee80211_bss *bss)
-{
-#ifdef CONFIG_MAC80211_MESH
-        return bss->mesh_id;
-#endif
-        return NULL;
-}
-
-static inline u8 bss_mesh_id_len(struct ieee80211_bss *bss)
-{
-#ifdef CONFIG_MAC80211_MESH
-        return bss->mesh_id_len;
-#endif
-        return 0;
-}
-
-
 typedef unsigned __bitwise__ ieee80211_tx_result;
 #define TX_CONTINUE     ((__force ieee80211_tx_result) 0u)
 #define TX_DROP         ((__force ieee80211_tx_result) 1u)
@@ -380,6 +343,7 @@ struct ieee80211_mgd_auth_data {
         u8 key[WLAN_KEY_LEN_WEP104];
         u8 key_len, key_idx;
         bool done;
+        bool timeout_started;
 
         u16 sae_trans, sae_status;
         size_t data_len;
@@ -399,9 +363,9 @@ struct ieee80211_mgd_assoc_data {
         u8 ssid_len;
         u8 supp_rates_len;
         bool wmm, uapsd;
-        bool have_beacon;
-        bool sent_assoc;
+        bool have_beacon, need_beacon;
         bool synced;
+        bool timeout_started;
 
         u8 ap_ht_param;
 
@@ -425,6 +389,7 @@ struct ieee80211_if_managed {
         unsigned long probe_timeout;
         int probe_send_count;
         bool nullfunc_failed;
+        bool connection_loss;
 
         struct mutex mtx;
         struct cfg80211_bss *associated;
@@ -449,6 +414,10 @@ struct ieee80211_if_managed {
         bool beacon_crc_valid;
         u32 beacon_crc;
 
+        bool status_acked;
+        bool status_received;
+        __le16 status_fc;
+
         enum {
                 IEEE80211_MFP_DISABLED,
                 IEEE80211_MFP_OPTIONAL,
@@ -611,6 +580,9 @@ struct ieee80211_if_mesh {
         u32 mesh_seqnum;
         bool accepting_plinks;
         int num_gates;
+        struct beacon_data __rcu *beacon;
+        /* just protects beacon updates for now */
+        struct mutex mtx;
         const u8 *ie;
         u8 ie_len;
         enum {
@@ -623,6 +595,11 @@ struct ieee80211_if_mesh {
         s64 sync_offset_clockdrift_max;
         spinlock_t sync_offset_lock;
         bool adjusting_tbtt;
+        /* mesh power save */
+        enum nl80211_mesh_power_mode nonpeer_pm;
+        int ps_peers_light_sleep;
+        int ps_peers_deep_sleep;
+        struct ps_data ps;
 };
 
 #ifdef CONFIG_MAC80211_MESH
@@ -717,9 +694,6 @@ struct ieee80211_sub_if_data {
 
         char name[IFNAMSIZ];
 
-        /* to detect idle changes */
-        bool old_idle;
-
         /* Fragment table for host-based reassembly */
         struct ieee80211_fragment_entry fragments[IEEE80211_FRAGMENT_MAX];
         unsigned int fragment_next;
@@ -753,6 +727,9 @@ struct ieee80211_sub_if_data {
         int user_power_level; /* in dBm */
         int ap_power_level; /* in dBm */
 
+        bool radar_required;
+        struct delayed_work dfs_cac_timer_work;
+
         /*
          * AP this belongs to: self in AP mode and
          * corresponding AP in VLAN mode, NULL for
@@ -840,6 +817,7 @@ enum queue_stop_reason {
         IEEE80211_QUEUE_STOP_REASON_AGGREGATION,
         IEEE80211_QUEUE_STOP_REASON_SUSPEND,
         IEEE80211_QUEUE_STOP_REASON_SKB_ADD,
+        IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL,
 };
 
 #ifdef CONFIG_MAC80211_LEDS
@@ -972,6 +950,10 @@ struct ieee80211_local {
         /* wowlan is enabled -- don't reconfig on resume */
         bool wowlan;
 
+        /* DFS/radar detection is enabled */
+        bool radar_detect_enabled;
+        struct work_struct radar_detected_work;
+
         /* number of RX chains the hardware has */
         u8 rx_chains;
 
@@ -986,14 +968,7 @@ struct ieee80211_local {
         struct sk_buff_head skb_queue;
         struct sk_buff_head skb_queue_unreliable;
 
-        /*
-         * Internal FIFO queue which is shared between multiple rx path
-         * stages. Its main task is to provide a serialization mechanism,
-         * so all rx handlers can enjoy having exclusive access to their
-         * private data structures.
-         */
-        struct sk_buff_head rx_skb_queue;
-        bool running_rx_handler;        /* protected by rx_skb_queue.lock */
+        spinlock_t rx_path_lock;
 
         /* Station data */
         /*
@@ -1134,8 +1109,6 @@ struct ieee80211_local {
          * this will override whatever chosen by mac80211 internally.
          */
         int dynamic_ps_forced_timeout;
-        int dynamic_ps_user_timeout;
-        bool disable_dynamic_ps;
 
         int user_power_level; /* in dBm, for all interfaces */
 
@@ -1193,40 +1166,41 @@ struct ieee80211_ra_tid {
 
 /* Parsed Information Elements */
 struct ieee802_11_elems {
-        u8 *ie_start;
+        const u8 *ie_start;
         size_t total_len;
 
         /* pointers to IEs */
-        u8 *ssid;
-        u8 *supp_rates;
-        u8 *fh_params;
-        u8 *ds_params;
-        u8 *cf_params;
-        struct ieee80211_tim_ie *tim;
-        u8 *ibss_params;
-        u8 *challenge;
-        u8 *wpa;
-        u8 *rsn;
-        u8 *erp_info;
-        u8 *ext_supp_rates;
-        u8 *wmm_info;
-        u8 *wmm_param;
-        struct ieee80211_ht_cap *ht_cap_elem;
-        struct ieee80211_ht_operation *ht_operation;
-        struct ieee80211_vht_cap *vht_cap_elem;
-        struct ieee80211_vht_operation *vht_operation;
-        struct ieee80211_meshconf_ie *mesh_config;
-        u8 *mesh_id;
-        u8 *peering;
-        u8 *preq;
-        u8 *prep;
-        u8 *perr;
-        struct ieee80211_rann_ie *rann;
-        struct ieee80211_channel_sw_ie *ch_switch_ie;
-        u8 *country_elem;
-        u8 *pwr_constr_elem;
-        u8 *quiet_elem; /* first quite element */
-        u8 *timeout_int;
+        const u8 *ssid;
+        const u8 *supp_rates;
+        const u8 *fh_params;
+        const u8 *ds_params;
+        const u8 *cf_params;
+        const struct ieee80211_tim_ie *tim;
+        const u8 *ibss_params;
+        const u8 *challenge;
+        const u8 *rsn;
+        const u8 *erp_info;
+        const u8 *ext_supp_rates;
+        const u8 *wmm_info;
+        const u8 *wmm_param;
+        const struct ieee80211_ht_cap *ht_cap_elem;
+        const struct ieee80211_ht_operation *ht_operation;
+        const struct ieee80211_vht_cap *vht_cap_elem;
+        const struct ieee80211_vht_operation *vht_operation;
+        const struct ieee80211_meshconf_ie *mesh_config;
+        const u8 *mesh_id;
+        const u8 *peering;
+        const __le16 *awake_window;
+        const u8 *preq;
+        const u8 *prep;
+        const u8 *perr;
+        const struct ieee80211_rann_ie *rann;
+        const struct ieee80211_channel_sw_ie *ch_switch_ie;
+        const u8 *country_elem;
+        const u8 *pwr_constr_elem;
+        const u8 *quiet_elem;   /* first quite element */
+        const u8 *timeout_int;
+        const u8 *opmode_notif;
 
         /* length of them, respectively */
         u8 ssid_len;
@@ -1237,7 +1211,6 @@ struct ieee802_11_elems {
         u8 tim_len;
         u8 ibss_params_len;
         u8 challenge_len;
-        u8 wpa_len;
         u8 rsn_len;
         u8 erp_info_len;
         u8 ext_supp_rates_len;
@@ -1306,10 +1279,10 @@ void ieee80211_recalc_ps_vif(struct ieee80211_sub_if_data *sdata);
 int ieee80211_max_network_latency(struct notifier_block *nb,
                                   unsigned long data, void *dummy);
 int ieee80211_set_arp_filter(struct ieee80211_sub_if_data *sdata);
-void ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
-                                      struct ieee80211_channel_sw_ie *sw_elem,
-                                      struct ieee80211_bss *bss,
-                                      u64 timestamp);
+void
+ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
+                                 const struct ieee80211_channel_sw_ie *sw_elem,
+                                 struct ieee80211_bss *bss, u64 timestamp);
 void ieee80211_sta_quiesce(struct ieee80211_sub_if_data *sdata);
 void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata);
 void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata);
@@ -1318,6 +1291,8 @@ void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
 void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata);
 void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata);
 void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata);
+void ieee80211_mgd_conn_tx_status(struct ieee80211_sub_if_data *sdata,
+                                  __le16 fc, bool acked);
 
 /* IBSS code */
 void ieee80211_ibss_notify_scan_completed(struct ieee80211_local *local);
@@ -1413,10 +1388,10 @@ void ieee80211_purge_tx_queue(struct ieee80211_hw *hw,
 /* HT */
 void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
                                      struct ieee80211_sta_ht_cap *ht_cap);
-void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_sub_if_data *sdata,
+bool ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_sub_if_data *sdata,
                                        struct ieee80211_supported_band *sband,
-                                       struct ieee80211_ht_cap *ht_cap_ie,
-                                       struct ieee80211_sta_ht_cap *ht_cap);
+                                       const struct ieee80211_ht_cap *ht_cap_ie,
+                                       struct sta_info *sta);
 void ieee80211_send_delba(struct ieee80211_sub_if_data *sdata,
                           const u8 *da, u16 tid,
                           u16 initiator, u16 reason_code);
@@ -1456,10 +1431,17 @@ void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid);
 u8 ieee80211_mcs_to_chains(const struct ieee80211_mcs_info *mcs);
 
 /* VHT */
-void ieee80211_vht_cap_ie_to_sta_vht_cap(struct ieee80211_sub_if_data *sdata,
-                                         struct ieee80211_supported_band *sband,
-                                         struct ieee80211_vht_cap *vht_cap_ie,
-                                         struct ieee80211_sta_vht_cap *vht_cap);
+void
+ieee80211_vht_cap_ie_to_sta_vht_cap(struct ieee80211_sub_if_data *sdata,
+                                    struct ieee80211_supported_band *sband,
+                                    const struct ieee80211_vht_cap *vht_cap_ie,
+                                    struct sta_info *sta);
+enum ieee80211_sta_rx_bandwidth ieee80211_sta_cur_vht_bw(struct sta_info *sta);
+void ieee80211_sta_set_rx_nss(struct sta_info *sta);
+void ieee80211_vht_handle_opmode(struct ieee80211_sub_if_data *sdata,
+                                 struct sta_info *sta, u8 opmode,
+                                 enum ieee80211_band band, bool nss_only);
+
 /* Spectrum management */
 void ieee80211_process_measurement_req(struct ieee80211_sub_if_data *sdata,
                                        struct ieee80211_mgmt *mgmt,
@@ -1577,8 +1559,9 @@ static inline void ieee80211_add_pending_skbs(struct ieee80211_local *local,
 
 void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
                          u16 transaction, u16 auth_alg, u16 status,
-                         u8 *extra, size_t extra_len, const u8 *bssid,
-                         const u8 *da, const u8 *key, u8 key_len, u8 key_idx);
+                         const u8 *extra, size_t extra_len, const u8 *bssid,
+                         const u8 *da, const u8 *key, u8 key_len, u8 key_idx,
+                         u32 tx_flags);
 void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
                                     const u8 *bssid, u16 stype, u16 reason,
                                     bool send_frame, u8 *frame_buf);
@@ -1595,7 +1578,7 @@ struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
 void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
                               const u8 *ssid, size_t ssid_len,
                               const u8 *ie, size_t ie_len,
-                              u32 ratemask, bool directed, bool no_cck,
+                              u32 ratemask, bool directed, u32 tx_flags,
                               struct ieee80211_channel *channel, bool scan);
 
 void ieee80211_sta_def_wmm_params(struct ieee80211_sub_if_data *sdata,
@@ -1627,18 +1610,31 @@ int ieee80211_add_ext_srates_ie(struct ieee80211_sub_if_data *sdata,
 
 /* channel management */
 void ieee80211_ht_oper_to_chandef(struct ieee80211_channel *control_chan,
-                                  struct ieee80211_ht_operation *ht_oper,
+                                  const struct ieee80211_ht_operation *ht_oper,
                                   struct cfg80211_chan_def *chandef);
 
 int __must_check
 ieee80211_vif_use_channel(struct ieee80211_sub_if_data *sdata,
                           const struct cfg80211_chan_def *chandef,
                           enum ieee80211_chanctx_mode mode);
+int __must_check
+ieee80211_vif_change_bandwidth(struct ieee80211_sub_if_data *sdata,
+                               const struct cfg80211_chan_def *chandef,
+                               u32 *changed);
 void ieee80211_vif_release_channel(struct ieee80211_sub_if_data *sdata);
 void ieee80211_vif_vlan_copy_chanctx(struct ieee80211_sub_if_data *sdata);
+void ieee80211_vif_copy_chanctx_to_vlans(struct ieee80211_sub_if_data *sdata,
+                                         bool clear);
 
 void ieee80211_recalc_smps_chanctx(struct ieee80211_local *local,
                                    struct ieee80211_chanctx *chanctx);
+void ieee80211_recalc_radar_chanctx(struct ieee80211_local *local,
+                                    struct ieee80211_chanctx *chanctx);
+
+void ieee80211_dfs_cac_timer(unsigned long data);
+void ieee80211_dfs_cac_timer_work(struct work_struct *work);
+void ieee80211_dfs_cac_cancel(struct ieee80211_local *local);
+void ieee80211_dfs_radar_detected_work(struct work_struct *work);
 
 #ifdef CONFIG_MAC80211_NOINLINE
 #define debug_noinline noinline
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 0a36dc6346bb..86c83084542a 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -78,8 +78,7 @@ void ieee80211_recalc_txpower(struct ieee80211_sub_if_data *sdata)
                 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_TXPOWER);
 }
 
-static u32 ieee80211_idle_off(struct ieee80211_local *local,
-                              const char *reason)
+static u32 ieee80211_idle_off(struct ieee80211_local *local)
 {
         if (!(local->hw.conf.flags & IEEE80211_CONF_IDLE))
                 return 0;
@@ -99,110 +98,45 @@ static u32 ieee80211_idle_on(struct ieee80211_local *local)
         return IEEE80211_CONF_CHANGE_IDLE;
 }
 
-static u32 __ieee80211_recalc_idle(struct ieee80211_local *local)
+void ieee80211_recalc_idle(struct ieee80211_local *local)
 {
-        struct ieee80211_sub_if_data *sdata;
-        int count = 0;
-        bool working = false, scanning = false;
+        bool working = false, scanning, active;
         unsigned int led_trig_start = 0, led_trig_stop = 0;
         struct ieee80211_roc_work *roc;
+        u32 change;
 
-#ifdef CONFIG_PROVE_LOCKING
-        WARN_ON(debug_locks && !lockdep_rtnl_is_held() &&
-                !lockdep_is_held(&local->iflist_mtx));
-#endif
         lockdep_assert_held(&local->mtx);
 
-        list_for_each_entry(sdata, &local->interfaces, list) {
-                if (!ieee80211_sdata_running(sdata)) {
-                        sdata->vif.bss_conf.idle = true;
-                        continue;
-                }
-
-                sdata->old_idle = sdata->vif.bss_conf.idle;
-
-                /* do not count disabled managed interfaces */
-                if (sdata->vif.type == NL80211_IFTYPE_STATION &&
-                    !sdata->u.mgd.associated &&
-                    !sdata->u.mgd.auth_data &&
-                    !sdata->u.mgd.assoc_data) {
-                        sdata->vif.bss_conf.idle = true;
-                        continue;
-                }
-                /* do not count unused IBSS interfaces */
-                if (sdata->vif.type == NL80211_IFTYPE_ADHOC &&
-                    !sdata->u.ibss.ssid_len) {
-                        sdata->vif.bss_conf.idle = true;
-                        continue;
-                }
-
-                if (sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE)
-                        continue;
-
-                /* count everything else */
-                sdata->vif.bss_conf.idle = false;
-                count++;
-        }
+        active = !list_empty(&local->chanctx_list);
 
         if (!local->ops->remain_on_channel) {
                 list_for_each_entry(roc, &local->roc_list, list) {
                         working = true;
-                        roc->sdata->vif.bss_conf.idle = false;
+                        break;
                 }
         }
 
-        sdata = rcu_dereference_protected(local->scan_sdata,
-                                          lockdep_is_held(&local->mtx));
-        if (sdata && !(local->hw.flags & IEEE80211_HW_SCAN_WHILE_IDLE)) {
-                scanning = true;
-                sdata->vif.bss_conf.idle = false;
-        }
-
-        list_for_each_entry(sdata, &local->interfaces, list) {
-                if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
-                    sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
-                    sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE)
-                        continue;
-                if (sdata->old_idle == sdata->vif.bss_conf.idle)
-                        continue;
-                if (!ieee80211_sdata_running(sdata))
-                        continue;
-                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_IDLE);
-        }
+        scanning = test_bit(SCAN_SW_SCANNING, &local->scanning) ||
+                   test_bit(SCAN_ONCHANNEL_SCANNING, &local->scanning);
 
         if (working || scanning)
                 led_trig_start |= IEEE80211_TPT_LEDTRIG_FL_WORK;
         else
                 led_trig_stop |= IEEE80211_TPT_LEDTRIG_FL_WORK;
 
-        if (count)
+        if (active)
                 led_trig_start |= IEEE80211_TPT_LEDTRIG_FL_CONNECTED;
         else
                 led_trig_stop |= IEEE80211_TPT_LEDTRIG_FL_CONNECTED;
 
         ieee80211_mod_tpt_led_trig(local, led_trig_start, led_trig_stop);
 
-        if (working)
-                return ieee80211_idle_off(local, "working");
-        if (scanning)
-                return ieee80211_idle_off(local, "scanning");
-        if (!count)
-                return ieee80211_idle_on(local);
+        if (working || scanning || active)
+                change = ieee80211_idle_off(local);
         else
-                return ieee80211_idle_off(local, "in use");
-
-        return 0;
-}
-
-void ieee80211_recalc_idle(struct ieee80211_local *local)
-{
-        u32 chg;
-
-        mutex_lock(&local->iflist_mtx);
-        chg = __ieee80211_recalc_idle(local);
-        mutex_unlock(&local->iflist_mtx);
-        if (chg)
-                ieee80211_hw_config(local, chg);
+                change = ieee80211_idle_on(local);
+        if (change)
+                ieee80211_hw_config(local, change);
 }
 
 static int ieee80211_change_mtu(struct net_device *dev, int new_mtu)
@@ -621,6 +555,8 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
                                 goto err_del_interface;
                 }
 
+                drv_add_interface_debugfs(local, sdata);
+
                 if (sdata->vif.type == NL80211_IFTYPE_AP) {
                         local->fif_pspoll++;
                         local->fif_probe_req++;
@@ -694,10 +630,6 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
         if (sdata->flags & IEEE80211_SDATA_PROMISC)
                 atomic_inc(&local->iff_promiscs);
 
-        mutex_lock(&local->mtx);
-        hw_reconf_flags |= __ieee80211_recalc_idle(local);
-        mutex_unlock(&local->mtx);
-
         if (coming_up)
                 local->open_count++;
 
@@ -748,6 +680,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
         struct sk_buff *skb, *tmp;
         u32 hw_reconf_flags = 0;
         int i, flushed;
+        struct ps_data *ps;
 
         clear_bit(SDATA_STATE_RUNNING, &sdata->state);
 
@@ -817,6 +750,16 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
 
         cancel_work_sync(&sdata->recalc_smps);
 
+        cancel_delayed_work_sync(&sdata->dfs_cac_timer_work);
+
+        if (sdata->wdev.cac_started) {
+                mutex_lock(&local->iflist_mtx);
+                ieee80211_vif_release_channel(sdata);
+                mutex_unlock(&local->iflist_mtx);
+                cfg80211_cac_event(sdata->dev, NL80211_RADAR_CAC_ABORTED,
+                                   GFP_KERNEL);
+        }
+
         /* APs need special treatment */
         if (sdata->vif.type == NL80211_IFTYPE_AP) {
                 struct ieee80211_sub_if_data *vlan, *tmpsdata;
@@ -826,6 +769,19 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                                          u.vlan.list)
                         dev_close(vlan->dev);
                 WARN_ON(!list_empty(&sdata->u.ap.vlans));
+        } else if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
+                /* remove all packets in parent bc_buf pointing to this dev */
+                ps = &sdata->bss->ps;
+
+                spin_lock_irqsave(&ps->bc_buf.lock, flags);
+                skb_queue_walk_safe(&ps->bc_buf, skb, tmp) {
+                        if (skb->dev == sdata->dev) {
+                                __skb_unlink(skb, &ps->bc_buf);
+                                local->total_ps_buffered--;
+                                ieee80211_free_txskb(&local->hw, skb);
+                        }
+                }
+                spin_unlock_irqrestore(&ps->bc_buf.lock, flags);
         } else if (sdata->vif.type == NL80211_IFTYPE_STATION) {
                 ieee80211_mgd_stop(sdata);
         }
@@ -882,16 +838,14 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                  */
                 ieee80211_free_keys(sdata);
 
+                drv_remove_interface_debugfs(local, sdata);
+
                 if (going_down)
                         drv_remove_interface(local, sdata);
         }
 
         sdata->bss = NULL;
 
-        mutex_lock(&local->mtx);
-        hw_reconf_flags |= __ieee80211_recalc_idle(local);
-        mutex_unlock(&local->mtx);
-
         ieee80211_recalc_ps(local, -1);
 
         if (local->open_count == 0) {
@@ -1583,6 +1537,8 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
         spin_lock_init(&sdata->cleanup_stations_lock);
         INIT_LIST_HEAD(&sdata->cleanup_stations);
         INIT_WORK(&sdata->cleanup_stations_wk, ieee80211_cleanup_sdata_stas_wk);
+        INIT_DELAYED_WORK(&sdata->dfs_cac_timer_work,
+                          ieee80211_dfs_cac_timer_work);
 
         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
                 struct ieee80211_supported_band *sband;
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 2bdd454e8bcf..f9747689d604 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -34,8 +34,6 @@
 #include "cfg.h"
 #include "debugfs.h"
 
-static struct lock_class_key ieee80211_rx_skb_queue_class;
-
 void ieee80211_configure_filter(struct ieee80211_local *local)
 {
         u64 mc;
@@ -503,6 +501,11 @@ static const struct ieee80211_ht_cap mac80211_ht_capa_mod_mask = {
         },
 };
 
+static const u8 extended_capabilities[] = {
+        0, 0, 0, 0, 0, 0, 0,
+        WLAN_EXT_CAPA8_OPMODE_NOTIF,
+};
+
 struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
                                         const struct ieee80211_ops *ops)
 {
@@ -559,14 +562,17 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
                         WIPHY_FLAG_REPORTS_OBSS |
                         WIPHY_FLAG_OFFCHAN_TX;
 
+        wiphy->extended_capabilities = extended_capabilities;
+        wiphy->extended_capabilities_mask = extended_capabilities;
+        wiphy->extended_capabilities_len = ARRAY_SIZE(extended_capabilities);
+
         if (ops->remain_on_channel)
                 wiphy->flags |= WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
 
         wiphy->features |= NL80211_FEATURE_SK_TX_STATUS |
                            NL80211_FEATURE_SAE |
                            NL80211_FEATURE_HT_IBSS |
-                           NL80211_FEATURE_VIF_TXPOWER |
-                           NL80211_FEATURE_FULL_AP_CLIENT_STATE;
+                           NL80211_FEATURE_VIF_TXPOWER;
 
         if (!ops->hw_scan)
                 wiphy->features |= NL80211_FEATURE_LOW_PRIORITY_SCAN |
@@ -613,25 +619,19 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
 
         mutex_init(&local->key_mtx);
         spin_lock_init(&local->filter_lock);
+        spin_lock_init(&local->rx_path_lock);
         spin_lock_init(&local->queue_stop_reason_lock);
 
         INIT_LIST_HEAD(&local->chanctx_list);
         mutex_init(&local->chanctx_mtx);
 
-        /*
-         * The rx_skb_queue is only accessed from tasklets,
-         * but other SKB queues are used from within IRQ
-         * context. Therefore, this one needs a different
-         * locking class so our direct, non-irq-safe use of
-         * the queue's lock doesn't throw lockdep warnings.
-         */
-        skb_queue_head_init_class(&local->rx_skb_queue,
-                                  &ieee80211_rx_skb_queue_class);
-
         INIT_DELAYED_WORK(&local->scan_work, ieee80211_scan_work);
 
         INIT_WORK(&local->restart_work, ieee80211_restart_work);
 
+        INIT_WORK(&local->radar_detected_work,
+                  ieee80211_dfs_radar_detected_work);
+
         INIT_WORK(&local->reconfig_filter, ieee80211_reconfig_filter);
         local->smps_mode = IEEE80211_SMPS_OFF;
 
@@ -707,9 +707,6 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                 return -EINVAL;
 #endif
 
-        if ((hw->flags & IEEE80211_HW_SCAN_WHILE_IDLE) && !local->ops->hw_scan)
-                return -EINVAL;
-
         if (!local->use_chanctx) {
                 for (i = 0; i < local->hw.wiphy->n_iface_combinations; i++) {
                         const struct ieee80211_iface_combination *comb;
@@ -727,6 +724,16 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                  */
                 if (local->hw.wiphy->interface_modes & BIT(NL80211_IFTYPE_WDS))
                         return -EINVAL;
+
+                /* DFS currently not supported with channel context drivers */
+                for (i = 0; i < local->hw.wiphy->n_iface_combinations; i++) {
+                        const struct ieee80211_iface_combination *comb;
+
+                        comb = &local->hw.wiphy->iface_combinations[i];
+
+                        if (comb->radar_detect_widths)
+                                return -EINVAL;
+                }
         }
 
         /* Only HW csum features are currently compatible with mac80211 */
@@ -1089,7 +1096,6 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
                 wiphy_warn(local->hw.wiphy, "skb_queue not empty\n");
         skb_queue_purge(&local->skb_queue);
         skb_queue_purge(&local->skb_queue_unreliable);
-        skb_queue_purge(&local->rx_skb_queue);
 
         destroy_workqueue(local->workqueue);
         wiphy_unregister(local->hw.wiphy);
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 694e27376afa..a77d40ed4e61 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -149,6 +149,31 @@ u32 mesh_accept_plinks_update(struct ieee80211_sub_if_data *sdata)
         return changed;
 }
 
+/*
+ * mesh_sta_cleanup - clean up any mesh sta state
+ *
+ * @sta: mesh sta to clean up.
+ */
+void mesh_sta_cleanup(struct sta_info *sta)
+{
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
+        u32 changed;
+
+        /*
+         * maybe userspace handles peer allocation and peering, but in either
+         * case the beacon is still generated by the kernel and we might need
+         * an update.
+         */
+        changed = mesh_accept_plinks_update(sdata);
+        if (sdata->u.mesh.security == IEEE80211_MESH_SEC_NONE) {
+                changed |= mesh_plink_deactivate(sta);
+                del_timer_sync(&sta->plink_timer);
+        }
+
+        if (changed)
+                ieee80211_mbss_info_change_notify(sdata, changed);
+}
+
 int mesh_rmc_init(struct ieee80211_sub_if_data *sdata)
 {
         int i;
@@ -261,6 +286,9 @@ mesh_add_meshconf_ie(struct sk_buff *skb, struct ieee80211_sub_if_data *sdata)
         *pos = IEEE80211_MESHCONF_CAPAB_FORWARDING;
         *pos |= ifmsh->accepting_plinks ?
             IEEE80211_MESHCONF_CAPAB_ACCEPT_PLINKS : 0x00;
+        /* Mesh PS mode. See IEEE802.11-2012 8.4.2.100.8 */
+        *pos |= ifmsh->ps_peers_deep_sleep ?
+            IEEE80211_MESHCONF_CAPAB_POWER_SAVE_LEVEL : 0x00;
         *pos++ |= ifmsh->adjusting_tbtt ?
             IEEE80211_MESHCONF_CAPAB_TBTT_ADJUSTING : 0x00;
         *pos++ = 0x00;
@@ -286,6 +314,29 @@ mesh_add_meshid_ie(struct sk_buff *skb, struct ieee80211_sub_if_data *sdata)
         return 0;
 }
 
+int mesh_add_awake_window_ie(struct sk_buff *skb,
+                             struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        u8 *pos;
+
+        /* see IEEE802.11-2012 13.14.6 */
+        if (ifmsh->ps_peers_light_sleep == 0 &&
+            ifmsh->ps_peers_deep_sleep == 0 &&
+            ifmsh->nonpeer_pm == NL80211_MESH_POWER_ACTIVE)
+                return 0;
+
+        if (skb_tailroom(skb) < 4)
+                return -ENOMEM;
+
+        pos = skb_put(skb, 2 + 2);
+        *pos++ = WLAN_EID_MESH_AWAKE_WINDOW;
+        *pos++ = 2;
+        put_unaligned_le16(ifmsh->mshcfg.dot11MeshAwakeWindowDuration, pos);
+
+        return 0;
+}
+
 int
 mesh_add_vendor_ies(struct sk_buff *skb, struct ieee80211_sub_if_data *sdata)
 {
@@ -342,8 +393,6 @@ mesh_add_rsn_ie(struct sk_buff *skb, struct ieee80211_sub_if_data *sdata)
 int mesh_add_ds_params_ie(struct sk_buff *skb,
                           struct ieee80211_sub_if_data *sdata)
 {
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_supported_band *sband;
         struct ieee80211_chanctx_conf *chanctx_conf;
         struct ieee80211_channel *chan;
         u8 *pos;
@@ -360,13 +409,10 @@ int mesh_add_ds_params_ie(struct sk_buff *skb,
         chan = chanctx_conf->def.chan;
         rcu_read_unlock();
 
-        sband = local->hw.wiphy->bands[chan->band];
-        if (sband->band == IEEE80211_BAND_2GHZ) {
-                pos = skb_put(skb, 2 + 1);
-                *pos++ = WLAN_EID_DS_PARAMS;
-                *pos++ = 1;
-                *pos++ = ieee80211_frequency_to_channel(chan->center_freq);
-        }
+        pos = skb_put(skb, 2 + 1);
+        *pos++ = WLAN_EID_DS_PARAMS;
+        *pos++ = 1;
+        *pos++ = ieee80211_frequency_to_channel(chan->center_freq);
 
         return 0;
 }
@@ -547,7 +593,7 @@ static void ieee80211_mesh_housekeeping(struct ieee80211_sub_if_data *sdata,
         mesh_path_expire(sdata);
 
         changed = mesh_accept_plinks_update(sdata);
-        ieee80211_bss_info_change_notify(sdata, changed);
+        ieee80211_mbss_info_change_notify(sdata, changed);
 
         mod_timer(&ifmsh->housekeeping_timer,
                   round_jiffies(jiffies + IEEE80211_MESH_HOUSEKEEPING_INTERVAL));
@@ -598,7 +644,140 @@ void ieee80211_mesh_restart(struct ieee80211_sub_if_data *sdata)
 }
 #endif
 
-void ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
+static int
+ieee80211_mesh_build_beacon(struct ieee80211_if_mesh *ifmsh)
+{
+        struct beacon_data *bcn;
+        int head_len, tail_len;
+        struct sk_buff *skb;
+        struct ieee80211_mgmt *mgmt;
+        struct ieee80211_chanctx_conf *chanctx_conf;
+        enum ieee80211_band band;
+        u8 *pos;
+        struct ieee80211_sub_if_data *sdata;
+        int hdr_len = offsetof(struct ieee80211_mgmt, u.beacon) +
+                      sizeof(mgmt->u.beacon);
+
+        sdata = container_of(ifmsh, struct ieee80211_sub_if_data, u.mesh);
+        rcu_read_lock();
+        chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
+        band = chanctx_conf->def.chan->band;
+        rcu_read_unlock();
+
+        head_len = hdr_len +
+                   2 + /* NULL SSID */
+                   2 + 8 + /* supported rates */
+                   2 + 3; /* DS params */
+        tail_len = 2 + (IEEE80211_MAX_SUPP_RATES - 8) +
+                   2 + sizeof(struct ieee80211_ht_cap) +
+                   2 + sizeof(struct ieee80211_ht_operation) +
+                   2 + ifmsh->mesh_id_len +
+                   2 + sizeof(struct ieee80211_meshconf_ie) +
+                   2 + sizeof(__le16) + /* awake window */
+                   ifmsh->ie_len;
+
+        bcn = kzalloc(sizeof(*bcn) + head_len + tail_len, GFP_KERNEL);
+        /* need an skb for IE builders to operate on */
+        skb = dev_alloc_skb(max(head_len, tail_len));
+
+        if (!bcn || !skb)
+                goto out_free;
+
+        /*
+         * pointers go into the block we allocated,
+         * memory is | beacon_data | head | tail |
+         */
+        bcn->head = ((u8 *) bcn) + sizeof(*bcn);
+
+        /* fill in the head */
+        mgmt = (struct ieee80211_mgmt *) skb_put(skb, hdr_len);
+        memset(mgmt, 0, hdr_len);
+        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                          IEEE80211_STYPE_BEACON);
+        eth_broadcast_addr(mgmt->da);
+        memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
+        memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
+        ieee80211_mps_set_frame_flags(sdata, NULL, (void *) mgmt);
+        mgmt->u.beacon.beacon_int =
+                cpu_to_le16(sdata->vif.bss_conf.beacon_int);
+        mgmt->u.beacon.capab_info |= cpu_to_le16(
+                sdata->u.mesh.security ? WLAN_CAPABILITY_PRIVACY : 0);
+
+        pos = skb_put(skb, 2);
+        *pos++ = WLAN_EID_SSID;
+        *pos++ = 0x0;
+
+        if (ieee80211_add_srates_ie(sdata, skb, true, band) ||
+            mesh_add_ds_params_ie(skb, sdata))
+                goto out_free;
+
+        bcn->head_len = skb->len;
+        memcpy(bcn->head, skb->data, bcn->head_len);
+
+        /* now the tail */
+        skb_trim(skb, 0);
+        bcn->tail = bcn->head + bcn->head_len;
+
+        if (ieee80211_add_ext_srates_ie(sdata, skb, true, band) ||
+            mesh_add_rsn_ie(skb, sdata) ||
+            mesh_add_ht_cap_ie(skb, sdata) ||
+            mesh_add_ht_oper_ie(skb, sdata) ||
+            mesh_add_meshid_ie(skb, sdata) ||
+            mesh_add_meshconf_ie(skb, sdata) ||
+            mesh_add_awake_window_ie(skb, sdata) ||
+            mesh_add_vendor_ies(skb, sdata))
+                goto out_free;
+
+        bcn->tail_len = skb->len;
+        memcpy(bcn->tail, skb->data, bcn->tail_len);
+
+        dev_kfree_skb(skb);
+        rcu_assign_pointer(ifmsh->beacon, bcn);
+        return 0;
+out_free:
+        kfree(bcn);
+        dev_kfree_skb(skb);
+        return -ENOMEM;
+}
+
+static int
+ieee80211_mesh_rebuild_beacon(struct ieee80211_if_mesh *ifmsh)
+{
+        struct ieee80211_sub_if_data *sdata;
+        struct beacon_data *old_bcn;
+        int ret;
+        sdata = container_of(ifmsh, struct ieee80211_sub_if_data, u.mesh);
+
+        mutex_lock(&ifmsh->mtx);
+
+        old_bcn = rcu_dereference_protected(ifmsh->beacon,
+                                            lockdep_is_held(&ifmsh->mtx));
+        ret = ieee80211_mesh_build_beacon(ifmsh);
+        if (ret)
+                /* just reuse old beacon */
+                goto out;
+
+        if (old_bcn)
+                kfree_rcu(old_bcn, rcu_head);
+out:
+        mutex_unlock(&ifmsh->mtx);
+        return ret;
+}
+
+void ieee80211_mbss_info_change_notify(struct ieee80211_sub_if_data *sdata,
+                                       u32 changed)
+{
+        if (sdata->vif.bss_conf.enable_beacon &&
+            (changed & (BSS_CHANGED_BEACON |
+                        BSS_CHANGED_HT |
+                        BSS_CHANGED_BASIC_RATES |
+                        BSS_CHANGED_BEACON_INT)))
+                if (ieee80211_mesh_rebuild_beacon(&sdata->u.mesh))
+                        return;
+        ieee80211_bss_info_change_notify(sdata, changed);
+}
+
+int ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct ieee80211_local *local = sdata->local;
@@ -629,20 +808,24 @@ void ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
         sdata->vif.bss_conf.basic_rates =
                 ieee80211_mandatory_rates(local, band);
 
-        if (band == IEEE80211_BAND_5GHZ) {
-                sdata->vif.bss_conf.use_short_slot = true;
-                changed |= BSS_CHANGED_ERP_SLOT;
+        changed |= ieee80211_mps_local_status_update(sdata);
+
+        if (ieee80211_mesh_build_beacon(ifmsh)) {
+                ieee80211_stop_mesh(sdata);
+                return -ENOMEM;
         }
 
         ieee80211_bss_info_change_notify(sdata, changed);
 
         netif_carrier_on(sdata->dev);
+        return 0;
 }
 
 void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        struct beacon_data *bcn;
 
         netif_carrier_off(sdata->dev);
 
@@ -651,11 +834,21 @@ void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
         sdata->vif.bss_conf.enable_beacon = false;
         clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, &sdata->state);
         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED);
+        mutex_lock(&ifmsh->mtx);
+        bcn = rcu_dereference_protected(ifmsh->beacon,
+                                        lockdep_is_held(&ifmsh->mtx));
+        rcu_assign_pointer(ifmsh->beacon, NULL);
+        kfree_rcu(bcn, rcu_head);
+        mutex_unlock(&ifmsh->mtx);
 
         /* flush STAs and mpaths on this iface */
         sta_info_flush(sdata);
         mesh_path_flush_by_iface(sdata);
 
+        /* free all potentially still buffered group-addressed frames */
+        local->total_ps_buffered -= skb_queue_len(&ifmsh->ps.bc_buf);
+        skb_queue_purge(&ifmsh->ps.bc_buf);
+
         del_timer_sync(&sdata->u.mesh.housekeeping_timer);
         del_timer_sync(&sdata->u.mesh.mesh_path_root_timer);
         del_timer_sync(&sdata->u.mesh.mesh_path_timer);
@@ -675,6 +868,63 @@ void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
         sdata->u.mesh.timers_running = 0;
 }
 
+static void
+ieee80211_mesh_rx_probe_req(struct ieee80211_sub_if_data *sdata,
+                            struct ieee80211_mgmt *mgmt, size_t len)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        struct sk_buff *presp;
+        struct beacon_data *bcn;
+        struct ieee80211_mgmt *hdr;
+        struct ieee802_11_elems elems;
+        size_t baselen;
+        u8 *pos, *end;
+
+        end = ((u8 *) mgmt) + len;
+        pos = mgmt->u.probe_req.variable;
+        baselen = (u8 *) pos - (u8 *) mgmt;
+        if (baselen > len)
+                return;
+
+        ieee802_11_parse_elems(pos, len - baselen, &elems);
+
+        /* 802.11-2012 10.1.4.3.2 */
+        if ((!ether_addr_equal(mgmt->da, sdata->vif.addr) &&
+             !is_broadcast_ether_addr(mgmt->da)) ||
+            elems.ssid_len != 0)
+                return;
+
+        if (elems.mesh_id_len != 0 &&
+            (elems.mesh_id_len != ifmsh->mesh_id_len ||
+             memcmp(elems.mesh_id, ifmsh->mesh_id, ifmsh->mesh_id_len)))
+                return;
+
+        rcu_read_lock();
+        bcn = rcu_dereference(ifmsh->beacon);
+
+        if (!bcn)
+                goto out;
+
+        presp = dev_alloc_skb(local->tx_headroom +
+                              bcn->head_len + bcn->tail_len);
+        if (!presp)
+                goto out;
+
+        skb_reserve(presp, local->tx_headroom);
+        memcpy(skb_put(presp, bcn->head_len), bcn->head, bcn->head_len);
+        memcpy(skb_put(presp, bcn->tail_len), bcn->tail, bcn->tail_len);
+        hdr = (struct ieee80211_mgmt *) presp->data;
+        hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                         IEEE80211_STYPE_PROBE_RESP);
+        memcpy(hdr->da, mgmt->sa, ETH_ALEN);
+        mpl_dbg(sdata, "sending probe resp. to %pM\n", hdr->da);
+        IEEE80211_SKB_CB(presp)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+        ieee80211_tx_skb(sdata, presp);
+out:
+        rcu_read_unlock();
+}
+
 static void ieee80211_mesh_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
                                         u16 stype,
                                         struct ieee80211_mgmt *mgmt,
@@ -764,6 +1014,9 @@ void ieee80211_mesh_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                 ieee80211_mesh_rx_bcn_presp(sdata, stype, mgmt, skb->len,
                                             rx_status);
                 break;
+        case IEEE80211_STYPE_PROBE_REQ:
+                ieee80211_mesh_rx_probe_req(sdata, mgmt, skb->len);
+                break;
         case IEEE80211_STYPE_ACTION:
                 ieee80211_mesh_rx_mgmt_action(sdata, mgmt, skb->len, rx_status);
                 break;
@@ -833,8 +1086,11 @@ void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata)
                     ieee80211_mesh_path_root_timer,
                     (unsigned long) sdata);
         INIT_LIST_HEAD(&ifmsh->preq_queue.list);
+        skb_queue_head_init(&ifmsh->ps.bc_buf);
         spin_lock_init(&ifmsh->mesh_preq_queue_lock);
         spin_lock_init(&ifmsh->sync_offset_lock);
+        RCU_INIT_POINTER(ifmsh->beacon, NULL);
+        mutex_init(&ifmsh->mtx);
 
         sdata->vif.bss_conf.bssid = zero_addr;
 }
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index aff301544c7f..1a1da877b1d2 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -222,6 +222,8 @@ int mesh_add_meshid_ie(struct sk_buff *skb,
                        struct ieee80211_sub_if_data *sdata);
 int mesh_add_rsn_ie(struct sk_buff *skb,
                     struct ieee80211_sub_if_data *sdata);
+int mesh_add_awake_window_ie(struct sk_buff *skb,
+                             struct ieee80211_sub_if_data *sdata);
 int mesh_add_vendor_ies(struct sk_buff *skb,
                         struct ieee80211_sub_if_data *sdata);
 int mesh_add_ds_params_ie(struct sk_buff *skb,
@@ -237,10 +239,28 @@ void ieee80211s_update_metric(struct ieee80211_local *local,
                 struct sta_info *sta, struct sk_buff *skb);
 void ieee80211s_stop(void);
 void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata);
-void ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata);
+int ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata);
 void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata);
 void ieee80211_mesh_root_setup(struct ieee80211_if_mesh *ifmsh);
 const struct ieee80211_mesh_sync_ops *ieee80211_mesh_sync_ops_get(u8 method);
+/* wrapper for ieee80211_bss_info_change_notify() */
+void ieee80211_mbss_info_change_notify(struct ieee80211_sub_if_data *sdata,
+                                       u32 changed);
+
+/* mesh power save */
+u32 ieee80211_mps_local_status_update(struct ieee80211_sub_if_data *sdata);
+u32 ieee80211_mps_set_sta_local_pm(struct sta_info *sta,
+                                   enum nl80211_mesh_power_mode pm);
+void ieee80211_mps_set_frame_flags(struct ieee80211_sub_if_data *sdata,
+                                   struct sta_info *sta,
+                                   struct ieee80211_hdr *hdr);
+void ieee80211_mps_sta_status_update(struct sta_info *sta);
+void ieee80211_mps_rx_h_sta_process(struct sta_info *sta,
+                                    struct ieee80211_hdr *hdr);
+void ieee80211_mpsp_trigger_process(u8 *qc, struct sta_info *sta,
+                                    bool tx, bool acked);
+void ieee80211_mps_frame_release(struct sta_info *sta,
+                                 struct ieee802_11_elems *elems);
 
 /* Mesh paths */
 int mesh_nexthop_lookup(struct sk_buff *skb,
@@ -248,8 +268,8 @@ int mesh_nexthop_lookup(struct sk_buff *skb,
 int mesh_nexthop_resolve(struct sk_buff *skb,
                          struct ieee80211_sub_if_data *sdata);
 void mesh_path_start_discovery(struct ieee80211_sub_if_data *sdata);
-struct mesh_path *mesh_path_lookup(u8 *dst,
-                struct ieee80211_sub_if_data *sdata);
+struct mesh_path *mesh_path_lookup(const u8 *dst,
+                                   struct ieee80211_sub_if_data *sdata);
 struct mesh_path *mpp_path_lookup(u8 *dst,
                                   struct ieee80211_sub_if_data *sdata);
 int mpp_path_add(u8 *dst, u8 *mpp, struct ieee80211_sub_if_data *sdata);
@@ -259,7 +279,7 @@ void mesh_path_fix_nexthop(struct mesh_path *mpath, struct sta_info *next_hop);
 void mesh_path_expire(struct ieee80211_sub_if_data *sdata);
 void mesh_rx_path_sel_frame(struct ieee80211_sub_if_data *sdata,
                 struct ieee80211_mgmt *mgmt, size_t len);
-int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata);
+int mesh_path_add(const u8 *dst, struct ieee80211_sub_if_data *sdata);
 
 int mesh_path_add_gate(struct mesh_path *mpath);
 int mesh_path_send_to_gates(struct mesh_path *mpath);
@@ -271,20 +291,22 @@ void mesh_neighbour_update(struct ieee80211_sub_if_data *sdata,
 bool mesh_peer_accepts_plinks(struct ieee802_11_elems *ie);
 u32 mesh_accept_plinks_update(struct ieee80211_sub_if_data *sdata);
 void mesh_plink_broken(struct sta_info *sta);
-void mesh_plink_deactivate(struct sta_info *sta);
-int mesh_plink_open(struct sta_info *sta);
-void mesh_plink_block(struct sta_info *sta);
+u32 mesh_plink_deactivate(struct sta_info *sta);
+u32 mesh_plink_open(struct sta_info *sta);
+u32 mesh_plink_block(struct sta_info *sta);
 void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata,
                          struct ieee80211_mgmt *mgmt, size_t len,
                          struct ieee80211_rx_status *rx_status);
+void mesh_sta_cleanup(struct sta_info *sta);
 
 /* Private interfaces */
 /* Mesh tables */
 void mesh_mpath_table_grow(void);
 void mesh_mpp_table_grow(void);
 /* Mesh paths */
-int mesh_path_error_tx(u8 ttl, u8 *target, __le32 target_sn, __le16 target_rcode,
-                       const u8 *ra, struct ieee80211_sub_if_data *sdata);
+int mesh_path_error_tx(u8 ttl, const u8 *target, __le32 target_sn,
+                       __le16 target_rcode, const u8 *ra,
+                       struct ieee80211_sub_if_data *sdata);
 void mesh_path_assign_nexthop(struct mesh_path *mpath, struct sta_info *sta);
 void mesh_path_flush_pending(struct mesh_path *mpath);
 void mesh_path_tx_pending(struct mesh_path *mpath);
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 6b4603a90031..585c1e26cca8 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -30,14 +30,14 @@
 
 static void mesh_queue_preq(struct mesh_path *, u8);
 
-static inline u32 u32_field_get(u8 *preq_elem, int offset, bool ae)
+static inline u32 u32_field_get(const u8 *preq_elem, int offset, bool ae)
 {
         if (ae)
                 offset += 6;
         return get_unaligned_le32(preq_elem + offset);
 }
 
-static inline u32 u16_field_get(u8 *preq_elem, int offset, bool ae)
+static inline u32 u16_field_get(const u8 *preq_elem, int offset, bool ae)
 {
         if (ae)
                 offset += 6;
@@ -102,10 +102,13 @@ enum mpath_frame_type {
 static const u8 broadcast_addr[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
 
 static int mesh_path_sel_frame_tx(enum mpath_frame_type action, u8 flags,
-                u8 *orig_addr, __le32 orig_sn, u8 target_flags, u8 *target,
-                __le32 target_sn, const u8 *da, u8 hop_count, u8 ttl,
-                __le32 lifetime, __le32 metric, __le32 preq_id,
-                struct ieee80211_sub_if_data *sdata)
+                                  const u8 *orig_addr, __le32 orig_sn,
+                                  u8 target_flags, const u8 *target,
+                                  __le32 target_sn, const u8 *da,
+                                  u8 hop_count, u8 ttl,
+                                  __le32 lifetime, __le32 metric,
+                                  __le32 preq_id,
+                                  struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb;
@@ -205,6 +208,7 @@ static void prepare_frame_for_deferred_tx(struct ieee80211_sub_if_data *sdata,
                 struct sk_buff *skb)
 {
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
 
         skb_set_mac_header(skb, 0);
         skb_set_network_header(skb, 0);
@@ -217,6 +221,7 @@ static void prepare_frame_for_deferred_tx(struct ieee80211_sub_if_data *sdata,
         info->control.vif = &sdata->vif;
         info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
         ieee80211_set_qos_hdr(sdata, skb);
+        ieee80211_mps_set_frame_flags(sdata, NULL, hdr);
 }
 
 /**
@@ -233,7 +238,7 @@ static void prepare_frame_for_deferred_tx(struct ieee80211_sub_if_data *sdata,
  * also acquires in the TX path.  To avoid a deadlock we don't transmit the
  * frame directly but add it to the pending queue instead.
  */
-int mesh_path_error_tx(u8 ttl, u8 *target, __le32 target_sn,
+int mesh_path_error_tx(u8 ttl, const u8 *target, __le32 target_sn,
                        __le16 target_rcode, const u8 *ra,
                        struct ieee80211_sub_if_data *sdata)
 {
@@ -367,14 +372,14 @@ static u32 airtime_link_metric_get(struct ieee80211_local *local,
  * path routing information is updated.
  */
 static u32 hwmp_route_info_get(struct ieee80211_sub_if_data *sdata,
-                            struct ieee80211_mgmt *mgmt,
-                            u8 *hwmp_ie, enum mpath_frame_type action)
+                               struct ieee80211_mgmt *mgmt,
+                               const u8 *hwmp_ie, enum mpath_frame_type action)
 {
         struct ieee80211_local *local = sdata->local;
         struct mesh_path *mpath;
         struct sta_info *sta;
         bool fresh_info;
-        u8 *orig_addr, *ta;
+        const u8 *orig_addr, *ta;
         u32 orig_sn, orig_metric;
         unsigned long orig_lifetime, exp_time;
         u32 last_hop_metric, new_metric;
@@ -509,11 +514,11 @@ static u32 hwmp_route_info_get(struct ieee80211_sub_if_data *sdata,
 
 static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
                                     struct ieee80211_mgmt *mgmt,
-                                    u8 *preq_elem, u32 metric)
+                                    const u8 *preq_elem, u32 metric)
 {
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct mesh_path *mpath = NULL;
-        u8 *target_addr, *orig_addr;
+        const u8 *target_addr, *orig_addr;
         const u8 *da;
         u8 target_flags, ttl, flags;
         u32 orig_sn, target_sn, lifetime, orig_metric;
@@ -646,11 +651,11 @@ next_hop_deref_protected(struct mesh_path *mpath)
 
 static void hwmp_prep_frame_process(struct ieee80211_sub_if_data *sdata,
                                     struct ieee80211_mgmt *mgmt,
-                                    u8 *prep_elem, u32 metric)
+                                    const u8 *prep_elem, u32 metric)
 {
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct mesh_path *mpath;
-        u8 *target_addr, *orig_addr;
+        const u8 *target_addr, *orig_addr;
         u8 ttl, hopcount, flags;
         u8 next_hop[ETH_ALEN];
         u32 target_sn, orig_sn, lifetime;
@@ -709,12 +714,13 @@ fail:
 }
 
 static void hwmp_perr_frame_process(struct ieee80211_sub_if_data *sdata,
-                             struct ieee80211_mgmt *mgmt, u8 *perr_elem)
+                                    struct ieee80211_mgmt *mgmt,
+                                    const u8 *perr_elem)
 {
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct mesh_path *mpath;
         u8 ttl;
-        u8 *ta, *target_addr;
+        const u8 *ta, *target_addr;
         u32 target_sn;
         u16 target_rcode;
 
@@ -756,15 +762,15 @@ endperr:
 }
 
 static void hwmp_rann_frame_process(struct ieee80211_sub_if_data *sdata,
-                                struct ieee80211_mgmt *mgmt,
-                                struct ieee80211_rann_ie *rann)
+                                    struct ieee80211_mgmt *mgmt,
+                                    const struct ieee80211_rann_ie *rann)
 {
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
         struct mesh_path *mpath;
         u8 ttl, flags, hopcount;
-        u8 *orig_addr;
+        const u8 *orig_addr;
         u32 orig_sn, metric, metric_txsta, interval;
         bool root_is_gate;
 
@@ -1080,6 +1086,10 @@ int mesh_nexthop_resolve(struct sk_buff *skb,
         u8 *target_addr = hdr->addr3;
         int err = 0;
 
+        /* Nulls are only sent to peers for PS and should be pre-addressed */
+        if (ieee80211_is_qos_nullfunc(hdr->frame_control))
+                return 0;
+
         rcu_read_lock();
         err = mesh_nexthop_lookup(skb, sdata);
         if (!err)
@@ -1151,6 +1161,7 @@ int mesh_nexthop_lookup(struct sk_buff *skb,
         if (next_hop) {
                 memcpy(hdr->addr1, next_hop->sta.addr, ETH_ALEN);
                 memcpy(hdr->addr2, sdata->vif.addr, ETH_ALEN);
+                ieee80211_mps_set_frame_flags(sdata, next_hop, hdr);
                 err = 0;
         }
 
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index aa749818860e..2ce4c4023a97 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -181,7 +181,7 @@ errcopy:
         return -ENOMEM;
 }
 
-static u32 mesh_table_hash(u8 *addr, struct ieee80211_sub_if_data *sdata,
+static u32 mesh_table_hash(const u8 *addr, struct ieee80211_sub_if_data *sdata,
                            struct mesh_table *tbl)
 {
         /* Use last four bytes of hw addr and interface index as hash index */
@@ -212,6 +212,7 @@ void mesh_path_assign_nexthop(struct mesh_path *mpath, struct sta_info *sta)
                 hdr = (struct ieee80211_hdr *) skb->data;
                 memcpy(hdr->addr1, sta->sta.addr, ETH_ALEN);
                 memcpy(hdr->addr2, mpath->sdata->vif.addr, ETH_ALEN);
+                ieee80211_mps_set_frame_flags(sta->sdata, sta, hdr);
         }
 
         spin_unlock_irqrestore(&mpath->frame_queue.lock, flags);
@@ -325,8 +326,8 @@ static void mesh_path_move_to_queue(struct mesh_path *gate_mpath,
 }
 
 
-static struct mesh_path *mpath_lookup(struct mesh_table *tbl, u8 *dst,
-                                          struct ieee80211_sub_if_data *sdata)
+static struct mesh_path *mpath_lookup(struct mesh_table *tbl, const u8 *dst,
+                                      struct ieee80211_sub_if_data *sdata)
 {
         struct mesh_path *mpath;
         struct hlist_node *n;
@@ -358,7 +359,8 @@ static struct mesh_path *mpath_lookup(struct mesh_table *tbl, u8 *dst,
  *
  * Locking: must be called within a read rcu section.
  */
-struct mesh_path *mesh_path_lookup(u8 *dst, struct ieee80211_sub_if_data *sdata)
+struct mesh_path *mesh_path_lookup(const u8 *dst,
+                                   struct ieee80211_sub_if_data *sdata)
 {
         return mpath_lookup(rcu_dereference(mesh_paths), dst, sdata);
 }
@@ -493,7 +495,7 @@ int mesh_gate_num(struct ieee80211_sub_if_data *sdata)
  *
  * State: the initial state of the new path is set to 0
  */
-int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata)
+int mesh_path_add(const u8 *dst, struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct ieee80211_local *local = sdata->local;
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index 81e612682bc3..f7526e509aa8 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -55,6 +55,66 @@ static inline void mesh_plink_fsm_restart(struct sta_info *sta)
         sta->plink_retries = 0;
 }
 
+/*
+ * mesh_set_short_slot_time - enable / disable ERP short slot time.
+ *
+ * The standard indirectly mandates mesh STAs to turn off short slot time by
+ * disallowing advertising this (802.11-2012 8.4.1.4), but that doesn't mean we
+ * can't be sneaky about it. Enable short slot time if all mesh STAs in the
+ * MBSS support ERP rates.
+ *
+ * Returns BSS_CHANGED_ERP_SLOT or 0 for no change.
+ */
+static u32 mesh_set_short_slot_time(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+        enum ieee80211_band band = ieee80211_get_sdata_band(sdata);
+        struct ieee80211_supported_band *sband = local->hw.wiphy->bands[band];
+        struct sta_info *sta;
+        u32 erp_rates = 0, changed = 0;
+        int i;
+        bool short_slot = false;
+
+        if (band == IEEE80211_BAND_5GHZ) {
+                /* (IEEE 802.11-2012 19.4.5) */
+                short_slot = true;
+                goto out;
+        } else if (band != IEEE80211_BAND_2GHZ ||
+                   (band == IEEE80211_BAND_2GHZ &&
+                    local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE))
+                goto out;
+
+        for (i = 0; i < sband->n_bitrates; i++)
+                if (sband->bitrates[i].flags & IEEE80211_RATE_ERP_G)
+                        erp_rates |= BIT(i);
+
+        if (!erp_rates)
+                goto out;
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(sta, &local->sta_list, list) {
+                if (sdata != sta->sdata ||
+                    sta->plink_state != NL80211_PLINK_ESTAB)
+                        continue;
+
+                short_slot = false;
+                if (erp_rates & sta->sta.supp_rates[band])
+                        short_slot = true;
+                 else
+                        break;
+        }
+        rcu_read_unlock();
+
+out:
+        if (sdata->vif.bss_conf.use_short_slot != short_slot) {
+                sdata->vif.bss_conf.use_short_slot = short_slot;
+                changed = BSS_CHANGED_ERP_SLOT;
+                mpl_dbg(sdata, "mesh_plink %pM: ERP short slot time %d\n",
+                        sdata->vif.addr, short_slot);
+        }
+        return changed;
+}
+
 /**
  * mesh_set_ht_prot_mode - set correct HT protection mode
  *
@@ -141,6 +201,9 @@ static u32 __mesh_plink_deactivate(struct sta_info *sta)
         sta->plink_state = NL80211_PLINK_BLOCKED;
         mesh_path_flush_by_nexthop(sta);
 
+        ieee80211_mps_sta_status_update(sta);
+        changed |= ieee80211_mps_local_status_update(sdata);
+
         return changed;
 }
 
@@ -151,7 +214,7 @@ static u32 __mesh_plink_deactivate(struct sta_info *sta)
  *
  * All mesh paths with this peer as next hop will be flushed
  */
-void mesh_plink_deactivate(struct sta_info *sta)
+u32 mesh_plink_deactivate(struct sta_info *sta)
 {
         struct ieee80211_sub_if_data *sdata = sta->sdata;
         u32 changed;
@@ -164,7 +227,7 @@ void mesh_plink_deactivate(struct sta_info *sta)
                             sta->reason);
         spin_unlock_bh(&sta->lock);
 
-        ieee80211_bss_info_change_notify(sdata, changed);
+        return changed;
 }
 
 static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
@@ -310,8 +373,7 @@ static void mesh_sta_info_init(struct ieee80211_sub_if_data *sdata,
         if (elems->ht_cap_elem &&
             sdata->vif.bss_conf.chandef.width != NL80211_CHAN_WIDTH_20_NOHT)
                 ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
-                                                  elems->ht_cap_elem,
-                                                  &sta->sta.ht_cap);
+                                                  elems->ht_cap_elem, sta);
         else
                 memset(&sta->sta.ht_cap, 0, sizeof(sta->sta.ht_cap));
 
@@ -320,8 +382,7 @@ static void mesh_sta_info_init(struct ieee80211_sub_if_data *sdata,
 
                 if (!(elems->ht_operation->ht_param &
                       IEEE80211_HT_PARAM_CHAN_WIDTH_ANY))
-                        sta->sta.ht_cap.cap &=
-                                            ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+                        sta->sta.bandwidth = IEEE80211_STA_RX_BW_20;
                 ieee80211_ht_oper_to_chandef(sdata->vif.bss_conf.chandef.chan,
                                              elems->ht_operation, &chandef);
                 if (sta->ch_width != chandef.width)
@@ -431,6 +492,7 @@ void mesh_neighbour_update(struct ieee80211_sub_if_data *sdata,
                            struct ieee802_11_elems *elems)
 {
         struct sta_info *sta;
+        u32 changed = 0;
 
         sta = mesh_sta_info_get(sdata, hw_addr, elems);
         if (!sta)
@@ -441,10 +503,12 @@ void mesh_neighbour_update(struct ieee80211_sub_if_data *sdata,
             sdata->u.mesh.accepting_plinks &&
             sdata->u.mesh.mshcfg.auto_open_plinks &&
             rssi_threshold_check(sta, sdata))
-                mesh_plink_open(sta);
+                changed = mesh_plink_open(sta);
 
+        ieee80211_mps_frame_release(sta, elems);
 out:
         rcu_read_unlock();
+        ieee80211_mbss_info_change_notify(sdata, changed);
 }
 
 static void mesh_plink_timer(unsigned long data)
@@ -528,6 +592,13 @@ static void mesh_plink_timer(unsigned long data)
 #ifdef CONFIG_PM
 void mesh_plink_quiesce(struct sta_info *sta)
 {
+        if (!ieee80211_vif_is_mesh(&sta->sdata->vif))
+                return;
+
+        /* no kernel mesh sta timers have been initialized */
+        if (sta->sdata->u.mesh.security != IEEE80211_MESH_SEC_NONE)
+                return;
+
         if (del_timer_sync(&sta->plink_timer))
                 sta->plink_timer_was_running = true;
 }
@@ -550,13 +621,14 @@ static inline void mesh_plink_timer_set(struct sta_info *sta, int timeout)
         add_timer(&sta->plink_timer);
 }
 
-int mesh_plink_open(struct sta_info *sta)
+u32 mesh_plink_open(struct sta_info *sta)
 {
         __le16 llid;
         struct ieee80211_sub_if_data *sdata = sta->sdata;
+        u32 changed;
 
         if (!test_sta_flag(sta, WLAN_STA_AUTH))
-                return -EPERM;
+                return 0;
 
         spin_lock_bh(&sta->lock);
         get_random_bytes(&llid, 2);
@@ -564,7 +636,7 @@ int mesh_plink_open(struct sta_info *sta)
         if (sta->plink_state != NL80211_PLINK_LISTEN &&
             sta->plink_state != NL80211_PLINK_BLOCKED) {
                 spin_unlock_bh(&sta->lock);
-                return -EBUSY;
+                return 0;
         }
         sta->plink_state = NL80211_PLINK_OPN_SNT;
         mesh_plink_timer_set(sta, sdata->u.mesh.mshcfg.dot11MeshRetryTimeout);
@@ -573,13 +645,16 @@ int mesh_plink_open(struct sta_info *sta)
                 "Mesh plink: starting establishment with %pM\n",
                 sta->sta.addr);
 
-        return mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_OPEN,
-                                   sta->sta.addr, llid, 0, 0);
+        /* set the non-peer mode to active during peering */
+        changed = ieee80211_mps_local_status_update(sdata);
+
+        mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_OPEN,
+                            sta->sta.addr, llid, 0, 0);
+        return changed;
 }
 
-void mesh_plink_block(struct sta_info *sta)
+u32 mesh_plink_block(struct sta_info *sta)
 {
-        struct ieee80211_sub_if_data *sdata = sta->sdata;
         u32 changed;
 
         spin_lock_bh(&sta->lock);
@@ -587,7 +662,7 @@ void mesh_plink_block(struct sta_info *sta)
         sta->plink_state = NL80211_PLINK_BLOCKED;
         spin_unlock_bh(&sta->lock);
 
-        ieee80211_bss_info_change_notify(sdata, changed);
+        return changed;
 }
 
 
@@ -806,6 +881,10 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                         sta->llid = llid;
                         mesh_plink_timer_set(sta,
                                              mshcfg->dot11MeshRetryTimeout);
+
+                        /* set the non-peer mode to active during peering */
+                        changed |= ieee80211_mps_local_status_update(sdata);
+
                         spin_unlock_bh(&sta->lock);
                         mesh_plink_frame_tx(sdata,
                                             WLAN_SP_MESH_PEERING_OPEN,
@@ -896,8 +975,12 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                         spin_unlock_bh(&sta->lock);
                         changed |= mesh_plink_inc_estab_count(sdata);
                         changed |= mesh_set_ht_prot_mode(sdata);
+                        changed |= mesh_set_short_slot_time(sdata);
                         mpl_dbg(sdata, "Mesh plink with %pM ESTABLISHED\n",
                                 sta->sta.addr);
+                        ieee80211_mps_sta_status_update(sta);
+                        changed |= ieee80211_mps_set_sta_local_pm(sta,
+                                                       mshcfg->power_mode);
                         break;
                 default:
                         spin_unlock_bh(&sta->lock);
@@ -931,11 +1014,15 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                         spin_unlock_bh(&sta->lock);
                         changed |= mesh_plink_inc_estab_count(sdata);
                         changed |= mesh_set_ht_prot_mode(sdata);
+                        changed |= mesh_set_short_slot_time(sdata);
                         mpl_dbg(sdata, "Mesh plink with %pM ESTABLISHED\n",
                                 sta->sta.addr);
                         mesh_plink_frame_tx(sdata,
                                             WLAN_SP_MESH_PEERING_CONFIRM,
                                             sta->sta.addr, llid, plid, 0);
+                        ieee80211_mps_sta_status_update(sta);
+                        changed |= ieee80211_mps_set_sta_local_pm(sta,
+                                                        mshcfg->power_mode);
                         break;
                 default:
                         spin_unlock_bh(&sta->lock);
@@ -954,6 +1041,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                         mod_plink_timer(sta, mshcfg->dot11MeshHoldingTimeout);
                         spin_unlock_bh(&sta->lock);
                         changed |= mesh_set_ht_prot_mode(sdata);
+                        changed |= mesh_set_short_slot_time(sdata);
                         mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE,
                                             sta->sta.addr, llid, plid, reason);
                         break;
@@ -1002,5 +1090,5 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
         rcu_read_unlock();
 
         if (changed)
-                ieee80211_bss_info_change_notify(sdata, changed);
+                ieee80211_mbss_info_change_notify(sdata, changed);
 }
diff --git a/net/mac80211/mesh_ps.c b/net/mac80211/mesh_ps.c
new file mode 100644
index 000000000000..3b7bfc01ee36
--- /dev/null
+++ b/net/mac80211/mesh_ps.c
@@ -0,0 +1,598 @@
+/*
+ * Copyright 2012-2013, Marco Porsch <marco.porsch@s2005.tu-chemnitz.de>
+ * Copyright 2012-2013, cozybit Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include "mesh.h"
+#include "wme.h"
+
+
+/* mesh PS management */
+
+/**
+ * mps_qos_null_get - create pre-addressed QoS Null frame for mesh powersave
+ */
+static struct sk_buff *mps_qos_null_get(struct sta_info *sta)
+{
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_hdr *nullfunc; /* use 4addr header */
+        struct sk_buff *skb;
+        int size = sizeof(*nullfunc);
+        __le16 fc;
+
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom + size + 2);
+        if (!skb)
+                return NULL;
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+
+        nullfunc = (struct ieee80211_hdr *) skb_put(skb, size);
+        fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_QOS_NULLFUNC);
+        ieee80211_fill_mesh_addresses(nullfunc, &fc, sta->sta.addr,
+                                      sdata->vif.addr);
+        nullfunc->frame_control = fc;
+        nullfunc->duration_id = 0;
+        /* no address resolution for this frame -> set addr 1 immediately */
+        memcpy(nullfunc->addr1, sta->sta.addr, ETH_ALEN);
+        memset(skb_put(skb, 2), 0, 2); /* append QoS control field */
+        ieee80211_mps_set_frame_flags(sdata, sta, nullfunc);
+
+        return skb;
+}
+
+/**
+ * mps_qos_null_tx - send a QoS Null to indicate link-specific power mode
+ */
+static void mps_qos_null_tx(struct sta_info *sta)
+{
+        struct sk_buff *skb;
+
+        skb = mps_qos_null_get(sta);
+        if (!skb)
+                return;
+
+        mps_dbg(sta->sdata, "announcing peer-specific power mode to %pM\n",
+                sta->sta.addr);
+
+        /* don't unintentionally start a MPSP */
+        if (!test_sta_flag(sta, WLAN_STA_PS_STA)) {
+                u8 *qc = ieee80211_get_qos_ctl((void *) skb->data);
+
+                qc[0] |= IEEE80211_QOS_CTL_EOSP;
+        }
+
+        ieee80211_tx_skb(sta->sdata, skb);
+}
+
+/**
+ * ieee80211_mps_local_status_update - track status of local link-specific PMs
+ *
+ * @sdata: local mesh subif
+ *
+ * sets the non-peer power mode and triggers the driver PS (re-)configuration
+ * Return BSS_CHANGED_BEACON if a beacon update is necessary.
+ */
+u32 ieee80211_mps_local_status_update(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        struct sta_info *sta;
+        bool peering = false;
+        int light_sleep_cnt = 0;
+        int deep_sleep_cnt = 0;
+        u32 changed = 0;
+        enum nl80211_mesh_power_mode nonpeer_pm;
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(sta, &sdata->local->sta_list, list) {
+                if (sdata != sta->sdata)
+                        continue;
+
+                switch (sta->plink_state) {
+                case NL80211_PLINK_OPN_SNT:
+                case NL80211_PLINK_OPN_RCVD:
+                case NL80211_PLINK_CNF_RCVD:
+                        peering = true;
+                        break;
+                case NL80211_PLINK_ESTAB:
+                        if (sta->local_pm == NL80211_MESH_POWER_LIGHT_SLEEP)
+                                light_sleep_cnt++;
+                        else if (sta->local_pm == NL80211_MESH_POWER_DEEP_SLEEP)
+                                deep_sleep_cnt++;
+                        break;
+                default:
+                        break;
+                }
+        }
+        rcu_read_unlock();
+
+        /*
+         * Set non-peer mode to active during peering/scanning/authentication
+         * (see IEEE802.11-2012 13.14.8.3). The non-peer mesh power mode is
+         * deep sleep if the local STA is in light or deep sleep towards at
+         * least one mesh peer (see 13.14.3.1). Otherwise, set it to the
+         * user-configured default value.
+         */
+        if (peering) {
+                mps_dbg(sdata, "setting non-peer PM to active for peering\n");
+                nonpeer_pm = NL80211_MESH_POWER_ACTIVE;
+        } else if (light_sleep_cnt || deep_sleep_cnt) {
+                mps_dbg(sdata, "setting non-peer PM to deep sleep\n");
+                nonpeer_pm = NL80211_MESH_POWER_DEEP_SLEEP;
+        } else {
+                mps_dbg(sdata, "setting non-peer PM to user value\n");
+                nonpeer_pm = ifmsh->mshcfg.power_mode;
+        }
+
+        /* need update if sleep counts move between 0 and non-zero */
+        if (ifmsh->nonpeer_pm != nonpeer_pm ||
+            !ifmsh->ps_peers_light_sleep != !light_sleep_cnt ||
+            !ifmsh->ps_peers_deep_sleep != !deep_sleep_cnt)
+                changed = BSS_CHANGED_BEACON;
+
+        ifmsh->nonpeer_pm = nonpeer_pm;
+        ifmsh->ps_peers_light_sleep = light_sleep_cnt;
+        ifmsh->ps_peers_deep_sleep = deep_sleep_cnt;
+
+        return changed;
+}
+
+/**
+ * ieee80211_mps_set_sta_local_pm - set local PM towards a mesh STA
+ *
+ * @sta: mesh STA
+ * @pm: the power mode to set
+ * Return BSS_CHANGED_BEACON if a beacon update is in order.
+ */
+u32 ieee80211_mps_set_sta_local_pm(struct sta_info *sta,
+                                   enum nl80211_mesh_power_mode pm)
+{
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
+
+        mps_dbg(sdata, "local STA operates in mode %d with %pM\n",
+                pm, sta->sta.addr);
+
+        sta->local_pm = pm;
+
+        /*
+         * announce peer-specific power mode transition
+         * (see IEEE802.11-2012 13.14.3.2 and 13.14.3.3)
+         */
+        if (sta->plink_state == NL80211_PLINK_ESTAB)
+                mps_qos_null_tx(sta);
+
+        return ieee80211_mps_local_status_update(sdata);
+}
+
+/**
+ * ieee80211_mps_set_frame_flags - set mesh PS flags in FC (and QoS Control)
+ *
+ * @sdata: local mesh subif
+ * @sta: mesh STA
+ * @hdr: 802.11 frame header
+ *
+ * see IEEE802.11-2012 8.2.4.1.7 and 8.2.4.5.11
+ *
+ * NOTE: sta must be given when an individually-addressed QoS frame header
+ * is handled, for group-addressed and management frames it is not used
+ */
+void ieee80211_mps_set_frame_flags(struct ieee80211_sub_if_data *sdata,
+                                   struct sta_info *sta,
+                                   struct ieee80211_hdr *hdr)
+{
+        enum nl80211_mesh_power_mode pm;
+        u8 *qc;
+
+        if (WARN_ON(is_unicast_ether_addr(hdr->addr1) &&
+                    ieee80211_is_data_qos(hdr->frame_control) &&
+                    !sta))
+                return;
+
+        if (is_unicast_ether_addr(hdr->addr1) &&
+            ieee80211_is_data_qos(hdr->frame_control) &&
+            sta->plink_state == NL80211_PLINK_ESTAB)
+                pm = sta->local_pm;
+        else
+                pm = sdata->u.mesh.nonpeer_pm;
+
+        if (pm == NL80211_MESH_POWER_ACTIVE)
+                hdr->frame_control &= cpu_to_le16(~IEEE80211_FCTL_PM);
+        else
+                hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
+
+        if (!ieee80211_is_data_qos(hdr->frame_control))
+                return;
+
+        qc = ieee80211_get_qos_ctl(hdr);
+
+        if ((is_unicast_ether_addr(hdr->addr1) &&
+             pm == NL80211_MESH_POWER_DEEP_SLEEP) ||
+            (is_multicast_ether_addr(hdr->addr1) &&
+             sdata->u.mesh.ps_peers_deep_sleep > 0))
+                qc[1] |= (IEEE80211_QOS_CTL_MESH_PS_LEVEL >> 8);
+        else
+                qc[1] &= ~(IEEE80211_QOS_CTL_MESH_PS_LEVEL >> 8);
+}
+
+/**
+ * ieee80211_mps_sta_status_update - update buffering status of neighbor STA
+ *
+ * @sta: mesh STA
+ *
+ * called after change of peering status or non-peer/peer-specific power mode
+ */
+void ieee80211_mps_sta_status_update(struct sta_info *sta)
+{
+        enum nl80211_mesh_power_mode pm;
+        bool do_buffer;
+
+        /*
+         * use peer-specific power mode if peering is established and the
+         * peer's power mode is known
+         */
+        if (sta->plink_state == NL80211_PLINK_ESTAB &&
+            sta->peer_pm != NL80211_MESH_POWER_UNKNOWN)
+                pm = sta->peer_pm;
+        else
+                pm = sta->nonpeer_pm;
+
+        do_buffer = (pm != NL80211_MESH_POWER_ACTIVE);
+
+        /* Don't let the same PS state be set twice */
+        if (test_sta_flag(sta, WLAN_STA_PS_STA) == do_buffer)
+                return;
+
+        if (do_buffer) {
+                set_sta_flag(sta, WLAN_STA_PS_STA);
+                atomic_inc(&sta->sdata->u.mesh.ps.num_sta_ps);
+                mps_dbg(sta->sdata, "start PS buffering frames towards %pM\n",
+                        sta->sta.addr);
+        } else {
+                ieee80211_sta_ps_deliver_wakeup(sta);
+        }
+
+        /* clear the MPSP flags for non-peers or active STA */
+        if (sta->plink_state != NL80211_PLINK_ESTAB) {
+                clear_sta_flag(sta, WLAN_STA_MPSP_OWNER);
+                clear_sta_flag(sta, WLAN_STA_MPSP_RECIPIENT);
+        } else if (!do_buffer) {
+                clear_sta_flag(sta, WLAN_STA_MPSP_OWNER);
+        }
+}
+
+static void mps_set_sta_peer_pm(struct sta_info *sta,
+                                struct ieee80211_hdr *hdr)
+{
+        enum nl80211_mesh_power_mode pm;
+        u8 *qc = ieee80211_get_qos_ctl(hdr);
+
+        /*
+         * Test Power Management field of frame control (PW) and
+         * mesh power save level subfield of QoS control field (PSL)
+         *
+         * | PM | PSL| Mesh PM |
+         * +----+----+---------+
+         * | 0  |Rsrv|  Active |
+         * | 1  | 0  |  Light  |
+         * | 1  | 1  |  Deep   |
+         */
+        if (ieee80211_has_pm(hdr->frame_control)) {
+                if (qc[1] & (IEEE80211_QOS_CTL_MESH_PS_LEVEL >> 8))
+                        pm = NL80211_MESH_POWER_DEEP_SLEEP;
+                else
+                        pm = NL80211_MESH_POWER_LIGHT_SLEEP;
+        } else {
+                pm = NL80211_MESH_POWER_ACTIVE;
+        }
+
+        if (sta->peer_pm == pm)
+                return;
+
+        mps_dbg(sta->sdata, "STA %pM enters mode %d\n",
+                sta->sta.addr, pm);
+
+        sta->peer_pm = pm;
+
+        ieee80211_mps_sta_status_update(sta);
+}
+
+static void mps_set_sta_nonpeer_pm(struct sta_info *sta,
+                                   struct ieee80211_hdr *hdr)
+{
+        enum nl80211_mesh_power_mode pm;
+
+        if (ieee80211_has_pm(hdr->frame_control))
+                pm = NL80211_MESH_POWER_DEEP_SLEEP;
+        else
+                pm = NL80211_MESH_POWER_ACTIVE;
+
+        if (sta->nonpeer_pm == pm)
+                return;
+
+        mps_dbg(sta->sdata, "STA %pM sets non-peer mode to %d\n",
+                sta->sta.addr, pm);
+
+        sta->nonpeer_pm = pm;
+
+        ieee80211_mps_sta_status_update(sta);
+}
+
+/**
+ * ieee80211_mps_rx_h_sta_process - frame receive handler for mesh powersave
+ *
+ * @sta: STA info that transmitted the frame
+ * @hdr: IEEE 802.11 (QoS) Header
+ */
+void ieee80211_mps_rx_h_sta_process(struct sta_info *sta,
+                                    struct ieee80211_hdr *hdr)
+{
+        if (is_unicast_ether_addr(hdr->addr1) &&
+            ieee80211_is_data_qos(hdr->frame_control)) {
+                /*
+                 * individually addressed QoS Data/Null frames contain
+                 * peer link-specific PS mode towards the local STA
+                 */
+                mps_set_sta_peer_pm(sta, hdr);
+
+                /* check for mesh Peer Service Period trigger frames */
+                ieee80211_mpsp_trigger_process(ieee80211_get_qos_ctl(hdr),
+                                               sta, false, false);
+        } else {
+                /*
+                 * can only determine non-peer PS mode
+                 * (see IEEE802.11-2012 8.2.4.1.7)
+                 */
+                mps_set_sta_nonpeer_pm(sta, hdr);
+        }
+}
+
+
+/* mesh PS frame release */
+
+static void mpsp_trigger_send(struct sta_info *sta, bool rspi, bool eosp)
+{
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
+        struct sk_buff *skb;
+        struct ieee80211_hdr *nullfunc;
+        struct ieee80211_tx_info *info;
+        u8 *qc;
+
+        skb = mps_qos_null_get(sta);
+        if (!skb)
+                return;
+
+        nullfunc = (struct ieee80211_hdr *) skb->data;
+        if (!eosp)
+                nullfunc->frame_control |=
+                                cpu_to_le16(IEEE80211_FCTL_MOREDATA);
+        /*
+         * | RSPI | EOSP |  MPSP triggering   |
+         * +------+------+--------------------+
+         * |  0   |  0   | local STA is owner |
+         * |  0   |  1   | no MPSP (MPSP end) |
+         * |  1   |  0   | both STA are owner |
+         * |  1   |  1   | peer STA is owner  | see IEEE802.11-2012 13.14.9.2
+         */
+        qc = ieee80211_get_qos_ctl(nullfunc);
+        if (rspi)
+                qc[1] |= (IEEE80211_QOS_CTL_RSPI >> 8);
+        if (eosp)
+                qc[0] |= IEEE80211_QOS_CTL_EOSP;
+
+        info = IEEE80211_SKB_CB(skb);
+
+        info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER |
+                       IEEE80211_TX_CTL_REQ_TX_STATUS;
+
+        mps_dbg(sdata, "sending MPSP trigger%s%s to %pM\n",
+                rspi ? " RSPI" : "", eosp ? " EOSP" : "", sta->sta.addr);
+
+        ieee80211_tx_skb(sdata, skb);
+}
+
+/**
+ * mpsp_qos_null_append - append QoS Null frame to MPSP skb queue if needed
+ *
+ * To properly end a mesh MPSP the last transmitted frame has to set the EOSP
+ * flag in the QoS Control field. In case the current tailing frame is not a
+ * QoS Data frame, append a QoS Null to carry the flag.
+ */
+static void mpsp_qos_null_append(struct sta_info *sta,
+                                 struct sk_buff_head *frames)
+{
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
+        struct sk_buff *new_skb, *skb = skb_peek_tail(frames);
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        struct ieee80211_tx_info *info;
+
+        if (ieee80211_is_data_qos(hdr->frame_control))
+                return;
+
+        new_skb = mps_qos_null_get(sta);
+        if (!new_skb)
+                return;
+
+        mps_dbg(sdata, "appending QoS Null in MPSP towards %pM\n",
+                sta->sta.addr);
+        /*
+         * This frame has to be transmitted last. Assign lowest priority to
+         * make sure it cannot pass other frames when releasing multiple ACs.
+         */
+        new_skb->priority = 1;
+        skb_set_queue_mapping(new_skb, IEEE80211_AC_BK);
+        ieee80211_set_qos_hdr(sdata, new_skb);
+
+        info = IEEE80211_SKB_CB(new_skb);
+        info->control.vif = &sdata->vif;
+        info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
+
+        __skb_queue_tail(frames, new_skb);
+}
+
+/**
+ * mps_frame_deliver - transmit frames during mesh powersave
+ *
+ * @sta: STA info to transmit to
+ * @n_frames: number of frames to transmit. -1 for all
+ */
+static void mps_frame_deliver(struct sta_info *sta, int n_frames)
+{
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
+        struct ieee80211_local *local = sdata->local;
+        int ac;
+        struct sk_buff_head frames;
+        struct sk_buff *skb;
+        bool more_data = false;
+
+        skb_queue_head_init(&frames);
+
+        /* collect frame(s) from buffers */
+        for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+                while (n_frames != 0) {
+                        skb = skb_dequeue(&sta->tx_filtered[ac]);
+                        if (!skb) {
+                                skb = skb_dequeue(
+                                        &sta->ps_tx_buf[ac]);
+                                if (skb)
+                                        local->total_ps_buffered--;
+                        }
+                        if (!skb)
+                                break;
+                        n_frames--;
+                        __skb_queue_tail(&frames, skb);
+                }
+
+                if (!skb_queue_empty(&sta->tx_filtered[ac]) ||
+                    !skb_queue_empty(&sta->ps_tx_buf[ac]))
+                        more_data = true;
+        }
+
+        /* nothing to send? -> EOSP */
+        if (skb_queue_empty(&frames)) {
+                mpsp_trigger_send(sta, false, true);
+                return;
+        }
+
+        /* in a MPSP make sure the last skb is a QoS Data frame */
+        if (test_sta_flag(sta, WLAN_STA_MPSP_OWNER))
+                mpsp_qos_null_append(sta, &frames);
+
+        mps_dbg(sta->sdata, "sending %d frames to PS STA %pM\n",
+                skb_queue_len(&frames), sta->sta.addr);
+
+        /* prepare collected frames for transmission */
+        skb_queue_walk(&frames, skb) {
+                struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+                struct ieee80211_hdr *hdr = (void *) skb->data;
+
+                /*
+                 * Tell TX path to send this frame even though the
+                 * STA may still remain is PS mode after this frame
+                 * exchange.
+                 */
+                info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER;
+
+                if (more_data || !skb_queue_is_last(&frames, skb))
+                        hdr->frame_control |=
+                                cpu_to_le16(IEEE80211_FCTL_MOREDATA);
+                else
+                        hdr->frame_control &=
+                                cpu_to_le16(~IEEE80211_FCTL_MOREDATA);
+
+                if (skb_queue_is_last(&frames, skb) &&
+                    ieee80211_is_data_qos(hdr->frame_control)) {
+                        u8 *qoshdr = ieee80211_get_qos_ctl(hdr);
+
+                        /* MPSP trigger frame ends service period */
+                        *qoshdr |= IEEE80211_QOS_CTL_EOSP;
+                        info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
+                }
+        }
+
+        ieee80211_add_pending_skbs(local, &frames);
+        sta_info_recalc_tim(sta);
+}
+
+/**
+ * ieee80211_mpsp_trigger_process - track status of mesh Peer Service Periods
+ *
+ * @qc: QoS Control field
+ * @sta: peer to start a MPSP with
+ * @tx: frame was transmitted by the local STA
+ * @acked: frame has been transmitted successfully
+ *
+ * NOTE: active mode STA may only serve as MPSP owner
+ */
+void ieee80211_mpsp_trigger_process(u8 *qc, struct sta_info *sta,
+                                    bool tx, bool acked)
+{
+        u8 rspi = qc[1] & (IEEE80211_QOS_CTL_RSPI >> 8);
+        u8 eosp = qc[0] & IEEE80211_QOS_CTL_EOSP;
+
+        if (tx) {
+                if (rspi && acked)
+                        set_sta_flag(sta, WLAN_STA_MPSP_RECIPIENT);
+
+                if (eosp)
+                        clear_sta_flag(sta, WLAN_STA_MPSP_OWNER);
+                else if (acked &&
+                         test_sta_flag(sta, WLAN_STA_PS_STA) &&
+                         !test_and_set_sta_flag(sta, WLAN_STA_MPSP_OWNER))
+                        mps_frame_deliver(sta, -1);
+        } else {
+                if (eosp)
+                        clear_sta_flag(sta, WLAN_STA_MPSP_RECIPIENT);
+                else if (sta->local_pm != NL80211_MESH_POWER_ACTIVE)
+                        set_sta_flag(sta, WLAN_STA_MPSP_RECIPIENT);
+
+                if (rspi && !test_and_set_sta_flag(sta, WLAN_STA_MPSP_OWNER))
+                        mps_frame_deliver(sta, -1);
+        }
+}
+
+/**
+ * ieee80211_mps_frame_release - release buffered frames in response to beacon
+ *
+ * @sta: mesh STA
+ * @elems: beacon IEs
+ *
+ * For peers if we have individually-addressed frames buffered or the peer
+ * indicates buffered frames, send a corresponding MPSP trigger frame. Since
+ * we do not evaluate the awake window duration, QoS Nulls are used as MPSP
+ * trigger frames. If the neighbour STA is not a peer, only send single frames.
+ */
+void ieee80211_mps_frame_release(struct sta_info *sta,
+                                 struct ieee802_11_elems *elems)
+{
+        int ac, buffer_local = 0;
+        bool has_buffered = false;
+
+        /* TIM map only for LLID <= IEEE80211_MAX_AID */
+        if (sta->plink_state == NL80211_PLINK_ESTAB)
+                has_buffered = ieee80211_check_tim(elems->tim, elems->tim_len,
+                                le16_to_cpu(sta->llid) % IEEE80211_MAX_AID);
+
+        if (has_buffered)
+                mps_dbg(sta->sdata, "%pM indicates buffered frames\n",
+                        sta->sta.addr);
+
+        /* only transmit to PS STA with announced, non-zero awake window */
+        if (test_sta_flag(sta, WLAN_STA_PS_STA) &&
+            (!elems->awake_window || !le16_to_cpu(*elems->awake_window)))
+                return;
+
+        for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
+                buffer_local += skb_queue_len(&sta->ps_tx_buf[ac]) +
+                                skb_queue_len(&sta->tx_filtered[ac]);
+
+        if (!has_buffered && !buffer_local)
+                return;
+
+        if (sta->plink_state == NL80211_PLINK_ESTAB)
+                mpsp_trigger_send(sta, has_buffered, !buffer_local);
+        else
+                mps_frame_deliver(sta, 1);
+}
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 72924399077e..9f6464f3e05f 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -30,11 +30,13 @@
 #include "rate.h"
 #include "led.h"
 
-#define IEEE80211_AUTH_TIMEOUT (HZ / 5)
-#define IEEE80211_AUTH_MAX_TRIES 3
-#define IEEE80211_AUTH_WAIT_ASSOC (HZ * 5)
-#define IEEE80211_ASSOC_TIMEOUT (HZ / 5)
-#define IEEE80211_ASSOC_MAX_TRIES 3
+#define IEEE80211_AUTH_TIMEOUT          (HZ / 5)
+#define IEEE80211_AUTH_TIMEOUT_SHORT    (HZ / 10)
+#define IEEE80211_AUTH_MAX_TRIES        3
+#define IEEE80211_AUTH_WAIT_ASSOC       (HZ * 5)
+#define IEEE80211_ASSOC_TIMEOUT         (HZ / 5)
+#define IEEE80211_ASSOC_TIMEOUT_SHORT   (HZ / 10)
+#define IEEE80211_ASSOC_MAX_TRIES       3
 
 static int max_nullfunc_tries = 2;
 module_param(max_nullfunc_tries, int, 0644);
@@ -112,6 +114,9 @@ enum rx_mgmt_action {
 
         /* caller must call cfg80211_send_assoc_timeout() */
         RX_MGMT_CFG80211_ASSOC_TIMEOUT,
+
+        /* used when a processed beacon causes a deauth */
+        RX_MGMT_CFG80211_TX_DEAUTH,
 };
 
 /* utils */
@@ -172,79 +177,331 @@ static int ecw2cw(int ecw)
         return (1 << ecw) - 1;
 }
 
-static u32 ieee80211_config_ht_tx(struct ieee80211_sub_if_data *sdata,
-                                  struct ieee80211_ht_operation *ht_oper,
-                                  const u8 *bssid, bool reconfig)
+static u32 chandef_downgrade(struct cfg80211_chan_def *c)
+{
+        u32 ret;
+        int tmp;
+
+        switch (c->width) {
+        case NL80211_CHAN_WIDTH_20:
+                c->width = NL80211_CHAN_WIDTH_20_NOHT;
+                ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
+                break;
+        case NL80211_CHAN_WIDTH_40:
+                c->width = NL80211_CHAN_WIDTH_20;
+                c->center_freq1 = c->chan->center_freq;
+                ret = IEEE80211_STA_DISABLE_40MHZ |
+                      IEEE80211_STA_DISABLE_VHT;
+                break;
+        case NL80211_CHAN_WIDTH_80:
+                tmp = (30 + c->chan->center_freq - c->center_freq1)/20;
+                /* n_P40 */
+                tmp /= 2;
+                /* freq_P40 */
+                c->center_freq1 = c->center_freq1 - 20 + 40 * tmp;
+                c->width = NL80211_CHAN_WIDTH_40;
+                ret = IEEE80211_STA_DISABLE_VHT;
+                break;
+        case NL80211_CHAN_WIDTH_80P80:
+                c->center_freq2 = 0;
+                c->width = NL80211_CHAN_WIDTH_80;
+                ret = IEEE80211_STA_DISABLE_80P80MHZ |
+                      IEEE80211_STA_DISABLE_160MHZ;
+                break;
+        case NL80211_CHAN_WIDTH_160:
+                /* n_P20 */
+                tmp = (70 + c->chan->center_freq - c->center_freq1)/20;
+                /* n_P80 */
+                tmp /= 4;
+                c->center_freq1 = c->center_freq1 - 40 + 80 * tmp;
+                c->width = NL80211_CHAN_WIDTH_80;
+                ret = IEEE80211_STA_DISABLE_80P80MHZ |
+                      IEEE80211_STA_DISABLE_160MHZ;
+                break;
+        default:
+        case NL80211_CHAN_WIDTH_20_NOHT:
+                WARN_ON_ONCE(1);
+                c->width = NL80211_CHAN_WIDTH_20_NOHT;
+                ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
+                break;
+        }
+
+        WARN_ON_ONCE(!cfg80211_chandef_valid(c));
+
+        return ret;
+}
+
+static u32
+ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
+                             struct ieee80211_supported_band *sband,
+                             struct ieee80211_channel *channel,
+                             const struct ieee80211_ht_operation *ht_oper,
+                             const struct ieee80211_vht_operation *vht_oper,
+                             struct cfg80211_chan_def *chandef, bool verbose)
+{
+        struct cfg80211_chan_def vht_chandef;
+        u32 ht_cfreq, ret;
+
+        chandef->chan = channel;
+        chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
+        chandef->center_freq1 = channel->center_freq;
+        chandef->center_freq2 = 0;
+
+        if (!ht_oper || !sband->ht_cap.ht_supported) {
+                ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
+                goto out;
+        }
+
+        chandef->width = NL80211_CHAN_WIDTH_20;
+
+        ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
+                                                  channel->band);
+        /* check that channel matches the right operating channel */
+        if (channel->center_freq != ht_cfreq) {
+                /*
+                 * It's possible that some APs are confused here;
+                 * Netgear WNDR3700 sometimes reports 4 higher than
+                 * the actual channel in association responses, but
+                 * since we look at probe response/beacon data here
+                 * it should be OK.
+                 */
+                if (verbose)
+                        sdata_info(sdata,
+                                   "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
+                                   channel->center_freq, ht_cfreq,
+                                   ht_oper->primary_chan, channel->band);
+                ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
+                goto out;
+        }
+
+        /* check 40 MHz support, if we have it */
+        if (sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
+                switch (ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
+                case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
+                        chandef->width = NL80211_CHAN_WIDTH_40;
+                        chandef->center_freq1 += 10;
+                        break;
+                case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
+                        chandef->width = NL80211_CHAN_WIDTH_40;
+                        chandef->center_freq1 -= 10;
+                        break;
+                }
+        } else {
+                /* 40 MHz (and 80 MHz) must be supported for VHT */
+                ret = IEEE80211_STA_DISABLE_VHT;
+                goto out;
+        }
+
+        if (!vht_oper || !sband->vht_cap.vht_supported) {
+                ret = IEEE80211_STA_DISABLE_VHT;
+                goto out;
+        }
+
+        vht_chandef.chan = channel;
+        vht_chandef.center_freq1 =
+                ieee80211_channel_to_frequency(vht_oper->center_freq_seg1_idx,
+                                               channel->band);
+        vht_chandef.center_freq2 = 0;
+
+        if (vht_oper->center_freq_seg2_idx)
+                vht_chandef.center_freq2 =
+                        ieee80211_channel_to_frequency(
+                                vht_oper->center_freq_seg2_idx,
+                                channel->band);
+
+        switch (vht_oper->chan_width) {
+        case IEEE80211_VHT_CHANWIDTH_USE_HT:
+                vht_chandef.width = chandef->width;
+                break;
+        case IEEE80211_VHT_CHANWIDTH_80MHZ:
+                vht_chandef.width = NL80211_CHAN_WIDTH_80;
+                break;
+        case IEEE80211_VHT_CHANWIDTH_160MHZ:
+                vht_chandef.width = NL80211_CHAN_WIDTH_160;
+                break;
+        case IEEE80211_VHT_CHANWIDTH_80P80MHZ:
+                vht_chandef.width = NL80211_CHAN_WIDTH_80P80;
+                break;
+        default:
+                if (verbose)
+                        sdata_info(sdata,
+                                   "AP VHT operation IE has invalid channel width (%d), disable VHT\n",
+                                   vht_oper->chan_width);
+                ret = IEEE80211_STA_DISABLE_VHT;
+                goto out;
+        }
+
+        if (!cfg80211_chandef_valid(&vht_chandef)) {
+                if (verbose)
+                        sdata_info(sdata,
+                                   "AP VHT information is invalid, disable VHT\n");
+                ret = IEEE80211_STA_DISABLE_VHT;
+                goto out;
+        }
+
+        if (cfg80211_chandef_identical(chandef, &vht_chandef)) {
+                ret = 0;
+                goto out;
+        }
+
+        if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
+                if (verbose)
+                        sdata_info(sdata,
+                                   "AP VHT information doesn't match HT, disable VHT\n");
+                ret = IEEE80211_STA_DISABLE_VHT;
+                goto out;
+        }
+
+        *chandef = vht_chandef;
+
+        ret = 0;
+
+out:
+        /* don't print the message below for VHT mismatch if VHT is disabled */
+        if (ret & IEEE80211_STA_DISABLE_VHT)
+                vht_chandef = *chandef;
+
+        while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
+                                        IEEE80211_CHAN_DISABLED)) {
+                if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
+                        ret = IEEE80211_STA_DISABLE_HT |
+                              IEEE80211_STA_DISABLE_VHT;
+                        goto out;
+                }
+
+                ret |= chandef_downgrade(chandef);
+        }
+
+        if (chandef->width != vht_chandef.width && verbose)
+                sdata_info(sdata,
+                           "capabilities/regulatory prevented using AP HT/VHT configuration, downgraded\n");
+
+        WARN_ON_ONCE(!cfg80211_chandef_valid(chandef));
+        return ret;
+}
+
+static int ieee80211_config_bw(struct ieee80211_sub_if_data *sdata,
+                               struct sta_info *sta,
+                               const struct ieee80211_ht_operation *ht_oper,
+                               const struct ieee80211_vht_operation *vht_oper,
+                               const u8 *bssid, u32 *changed)
 {
         struct ieee80211_local *local = sdata->local;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_supported_band *sband;
-        struct ieee80211_chanctx_conf *chanctx_conf;
         struct ieee80211_channel *chan;
-        struct sta_info *sta;
-        u32 changed = 0;
+        struct cfg80211_chan_def chandef;
         u16 ht_opmode;
-        bool disable_40 = false;
+        u32 flags;
+        enum ieee80211_sta_rx_bandwidth new_sta_bw;
+        int ret;
 
-        rcu_read_lock();
-        chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
-        if (WARN_ON(!chanctx_conf)) {
-                rcu_read_unlock();
+        /* if HT was/is disabled, don't track any bandwidth changes */
+        if (ifmgd->flags & IEEE80211_STA_DISABLE_HT || !ht_oper)
                 return 0;
-        }
-        chan = chanctx_conf->def.chan;
-        rcu_read_unlock();
+
+        /* don't check VHT if we associated as non-VHT station */
+        if (ifmgd->flags & IEEE80211_STA_DISABLE_VHT)
+                vht_oper = NULL;
+
+        if (WARN_ON_ONCE(!sta))
+                return -EINVAL;
+
+        chan = sdata->vif.bss_conf.chandef.chan;
         sband = local->hw.wiphy->bands[chan->band];
 
-        switch (sdata->vif.bss_conf.chandef.width) {
+        /* calculate new channel (type) based on HT/VHT operation IEs */
+        flags = ieee80211_determine_chantype(sdata, sband, chan, ht_oper,
+                                             vht_oper, &chandef, false);
+
+        /*
+         * Downgrade the new channel if we associated with restricted
+         * capabilities. For example, if we associated as a 20 MHz STA
+         * to a 40 MHz AP (due to regulatory, capabilities or config
+         * reasons) then switching to a 40 MHz channel now won't do us
+         * any good -- we couldn't use it with the AP.
+         */
+        if (ifmgd->flags & IEEE80211_STA_DISABLE_80P80MHZ &&
+            chandef.width == NL80211_CHAN_WIDTH_80P80)
+                flags |= chandef_downgrade(&chandef);
+        if (ifmgd->flags & IEEE80211_STA_DISABLE_160MHZ &&
+            chandef.width == NL80211_CHAN_WIDTH_160)
+                flags |= chandef_downgrade(&chandef);
+        if (ifmgd->flags & IEEE80211_STA_DISABLE_40MHZ &&
+            chandef.width > NL80211_CHAN_WIDTH_20)
+                flags |= chandef_downgrade(&chandef);
+
+        if (cfg80211_chandef_identical(&chandef, &sdata->vif.bss_conf.chandef))
+                return 0;
+
+        sdata_info(sdata,
+                   "AP %pM changed bandwidth, new config is %d MHz, width %d (%d/%d MHz)\n",
+                   ifmgd->bssid, chandef.chan->center_freq, chandef.width,
+                   chandef.center_freq1, chandef.center_freq2);
+
+        if (flags != (ifmgd->flags & (IEEE80211_STA_DISABLE_HT |
+                                      IEEE80211_STA_DISABLE_VHT |
+                                      IEEE80211_STA_DISABLE_40MHZ |
+                                      IEEE80211_STA_DISABLE_80P80MHZ |
+                                      IEEE80211_STA_DISABLE_160MHZ)) ||
+            !cfg80211_chandef_valid(&chandef)) {
+                sdata_info(sdata,
+                           "AP %pM changed bandwidth in a way we can't support - disconnect\n",
+                           ifmgd->bssid);
+                return -EINVAL;
+        }
+
+        switch (chandef.width) {
+        case NL80211_CHAN_WIDTH_20_NOHT:
+        case NL80211_CHAN_WIDTH_20:
+                new_sta_bw = IEEE80211_STA_RX_BW_20;
+                break;
         case NL80211_CHAN_WIDTH_40:
-                if (sdata->vif.bss_conf.chandef.chan->center_freq >
-                                sdata->vif.bss_conf.chandef.center_freq1 &&
-                    chan->flags & IEEE80211_CHAN_NO_HT40MINUS)
-                        disable_40 = true;
-                if (sdata->vif.bss_conf.chandef.chan->center_freq <
-                                sdata->vif.bss_conf.chandef.center_freq1 &&
-                    chan->flags & IEEE80211_CHAN_NO_HT40PLUS)
-                        disable_40 = true;
+                new_sta_bw = IEEE80211_STA_RX_BW_40;
                 break;
-        default:
+        case NL80211_CHAN_WIDTH_80:
+                new_sta_bw = IEEE80211_STA_RX_BW_80;
+                break;
+        case NL80211_CHAN_WIDTH_80P80:
+        case NL80211_CHAN_WIDTH_160:
+                new_sta_bw = IEEE80211_STA_RX_BW_160;
                 break;
+        default:
+                return -EINVAL;
         }
 
-        /* This can change during the lifetime of the BSS */
-        if (!(ht_oper->ht_param & IEEE80211_HT_PARAM_CHAN_WIDTH_ANY))
-                disable_40 = true;
-
-        mutex_lock(&local->sta_mtx);
-        sta = sta_info_get(sdata, bssid);
-
-        WARN_ON_ONCE(!sta);
-
-        if (sta && !sta->supports_40mhz)
-                disable_40 = true;
+        if (new_sta_bw > sta->cur_max_bandwidth)
+                new_sta_bw = sta->cur_max_bandwidth;
 
-        if (sta && (!reconfig ||
-                    (disable_40 != !(sta->sta.ht_cap.cap &
-                                        IEEE80211_HT_CAP_SUP_WIDTH_20_40)))) {
+        if (new_sta_bw < sta->sta.bandwidth) {
+                sta->sta.bandwidth = new_sta_bw;
+                rate_control_rate_update(local, sband, sta,
+                                         IEEE80211_RC_BW_CHANGED);
+        }
 
-                if (disable_40)
-                        sta->sta.ht_cap.cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
-                else
-                        sta->sta.ht_cap.cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+        ret = ieee80211_vif_change_bandwidth(sdata, &chandef, changed);
+        if (ret) {
+                sdata_info(sdata,
+                           "AP %pM changed bandwidth to incompatible one - disconnect\n",
+                           ifmgd->bssid);
+                return ret;
+        }
 
+        if (new_sta_bw > sta->sta.bandwidth) {
+                sta->sta.bandwidth = new_sta_bw;
                 rate_control_rate_update(local, sband, sta,
                                          IEEE80211_RC_BW_CHANGED);
         }
-        mutex_unlock(&local->sta_mtx);
 
         ht_opmode = le16_to_cpu(ht_oper->operation_mode);
 
         /* if bss configuration changed store the new one */
-        if (!reconfig || (sdata->vif.bss_conf.ht_operation_mode != ht_opmode)) {
-                changed |= BSS_CHANGED_HT;
+        if (sdata->vif.bss_conf.ht_operation_mode != ht_opmode) {
+                *changed |= BSS_CHANGED_HT;
                 sdata->vif.bss_conf.ht_operation_mode = ht_opmode;
         }
 
-        return changed;
+        return 0;
 }
 
 /* frame sending functions */
@@ -644,6 +901,9 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
         drv_mgd_prepare_tx(local, sdata);
 
         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+        if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
+                IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS |
+                                                IEEE80211_TX_INTFL_MLME_CONN_TX;
         ieee80211_tx_skb(sdata, skb);
 }
 
@@ -680,7 +940,8 @@ void ieee80211_send_nullfunc(struct ieee80211_local *local,
         if (powersave)
                 nullfunc->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
 
-        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
+                                        IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
         if (ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
                             IEEE80211_STA_CONNECTION_POLL))
                 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_USE_MINRATE;
@@ -784,10 +1045,10 @@ static void ieee80211_chswitch_timer(unsigned long data)
         ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
 }
 
-void ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
-                                      struct ieee80211_channel_sw_ie *sw_elem,
-                                      struct ieee80211_bss *bss,
-                                      u64 timestamp)
+void
+ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
+                                 const struct ieee80211_channel_sw_ie *sw_elem,
+                                 struct ieee80211_bss *bss, u64 timestamp)
 {
         struct cfg80211_bss *cbss =
                 container_of((void *)bss, struct cfg80211_bss, priv);
@@ -946,39 +1207,6 @@ static u32 ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
         return 0;
 }
 
-void ieee80211_enable_dyn_ps(struct ieee80211_vif *vif)
-{
-        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_conf *conf = &local->hw.conf;
-
-        WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION ||
-                !(local->hw.flags & IEEE80211_HW_SUPPORTS_PS) ||
-                (local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS));
-
-        local->disable_dynamic_ps = false;
-        conf->dynamic_ps_timeout = local->dynamic_ps_user_timeout;
-}
-EXPORT_SYMBOL(ieee80211_enable_dyn_ps);
-
-void ieee80211_disable_dyn_ps(struct ieee80211_vif *vif)
-{
-        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_conf *conf = &local->hw.conf;
-
-        WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION ||
-                !(local->hw.flags & IEEE80211_HW_SUPPORTS_PS) ||
-                (local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS));
-
-        local->disable_dynamic_ps = true;
-        conf->dynamic_ps_timeout = 0;
-        del_timer_sync(&local->dynamic_ps_timer);
-        ieee80211_queue_work(&local->hw,
-                             &local->dynamic_ps_enable_work);
-}
-EXPORT_SYMBOL(ieee80211_disable_dyn_ps);
-
 /* powersave */
 static void ieee80211_enable_ps(struct ieee80211_local *local,
                                 struct ieee80211_sub_if_data *sdata)
@@ -1081,7 +1309,6 @@ void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency)
         }
 
         if (count == 1 && ieee80211_powersave_allowed(found)) {
-                struct ieee80211_conf *conf = &local->hw.conf;
                 s32 beaconint_us;
 
                 if (latency < 0)
@@ -1105,10 +1332,7 @@ void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency)
                         else
                                 timeout = 100;
                 }
-                local->dynamic_ps_user_timeout = timeout;
-                if (!local->disable_dynamic_ps)
-                        conf->dynamic_ps_timeout =
-                                local->dynamic_ps_user_timeout;
+                local->hw.conf.dynamic_ps_timeout = timeout;
 
                 if (beaconint_us > latency) {
                         local->ps_sdata = NULL;
@@ -1178,8 +1402,7 @@ void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
         if (local->hw.conf.flags & IEEE80211_CONF_PS)
                 return;
 
-        if (!local->disable_dynamic_ps &&
-            local->hw.conf.dynamic_ps_timeout > 0) {
+        if (local->hw.conf.dynamic_ps_timeout > 0) {
                 /* don't enter PS if TX frames are pending */
                 if (drv_tx_frames_pending(local)) {
                         mod_timer(&local->dynamic_ps_timer, jiffies +
@@ -1244,16 +1467,30 @@ void ieee80211_dynamic_ps_timer(unsigned long data)
         ieee80211_queue_work(&local->hw, &local->dynamic_ps_enable_work);
 }
 
+void ieee80211_dfs_cac_timer_work(struct work_struct *work)
+{
+        struct delayed_work *delayed_work =
+                container_of(work, struct delayed_work, work);
+        struct ieee80211_sub_if_data *sdata =
+                container_of(delayed_work, struct ieee80211_sub_if_data,
+                             dfs_cac_timer_work);
+
+        ieee80211_vif_release_channel(sdata);
+
+        cfg80211_cac_event(sdata->dev, NL80211_RADAR_CAC_FINISHED, GFP_KERNEL);
+}
+
 /* MLME */
 static bool ieee80211_sta_wmm_params(struct ieee80211_local *local,
                                      struct ieee80211_sub_if_data *sdata,
-                                     u8 *wmm_param, size_t wmm_param_len)
+                                     const u8 *wmm_param, size_t wmm_param_len)
 {
         struct ieee80211_tx_queue_params params;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         size_t left;
         int count;
-        u8 *pos, uapsd_queues = 0;
+        const u8 *pos;
+        u8 uapsd_queues = 0;
 
         if (!local->ops->conf_tx)
                 return false;
@@ -1445,7 +1682,7 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
 
         ieee80211_led_assoc(local, 1);
 
-        if (local->hw.flags & IEEE80211_HW_NEED_DTIM_PERIOD) {
+        if (sdata->u.mgd.assoc_data->have_beacon) {
                 /*
                  * If the AP is buggy we may get here with no DTIM period
                  * known, so assume it's 1 which is the only safe assumption
@@ -1453,6 +1690,7 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
                  * probably just won't work at all.
                  */
                 bss_conf->dtim_period = sdata->u.mgd.dtim_period ?: 1;
+                bss_info_changed |= BSS_CHANGED_DTIM_PERIOD;
         } else {
                 bss_conf->dtim_period = 0;
         }
@@ -1655,17 +1893,18 @@ void ieee80211_sta_tx_notify(struct ieee80211_sub_if_data *sdata,
         if (!ieee80211_is_data(hdr->frame_control))
             return;
 
-        if (ack)
-                ieee80211_sta_reset_conn_monitor(sdata);
-
         if (ieee80211_is_nullfunc(hdr->frame_control) &&
             sdata->u.mgd.probe_send_count > 0) {
                 if (ack)
-                        sdata->u.mgd.probe_send_count = 0;
+                        ieee80211_sta_reset_conn_monitor(sdata);
                 else
                         sdata->u.mgd.nullfunc_failed = true;
                 ieee80211_queue_work(&sdata->local->hw, &sdata->work);
+                return;
         }
+
+        if (ack)
+                ieee80211_sta_reset_conn_monitor(sdata);
 }
 
 static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
@@ -1706,7 +1945,7 @@ static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
                         ssid_len = ssid[1];
 
                 ieee80211_send_probe_req(sdata, dst, ssid + 2, ssid_len, NULL,
-                                         0, (u32) -1, true, false,
+                                         0, (u32) -1, true, 0,
                                          ifmgd->associated->channel, false);
                 rcu_read_unlock();
         }
@@ -1740,7 +1979,7 @@ static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
 
         if (beacon)
                 mlme_dbg_ratelimited(sdata,
-                                     "detected beacon loss from AP - sending probe request\n");
+                                     "detected beacon loss from AP - probing\n");
 
         ieee80211_cqm_rssi_notify(&sdata->vif,
                 NL80211_CQM_RSSI_BEACON_LOSS_EVENT, GFP_KERNEL);
@@ -1821,11 +2060,9 @@ struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
 }
 EXPORT_SYMBOL(ieee80211_ap_probereq_get);
 
-static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata,
-                                   bool transmit_frame)
+static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        struct ieee80211_local *local = sdata->local;
         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
 
         mutex_lock(&ifmgd->mtx);
@@ -1836,8 +2073,10 @@ static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata,
 
         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
                                WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
-                               transmit_frame, frame_buf);
+                               true, frame_buf);
         ifmgd->flags &= ~IEEE80211_STA_CSA_RECEIVED;
+        ieee80211_wake_queues_by_reason(&sdata->local->hw,
+                                        IEEE80211_QUEUE_STOP_REASON_CSA);
         mutex_unlock(&ifmgd->mtx);
 
         /*
@@ -1845,10 +2084,6 @@ static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata,
          * but that's not a problem.
          */
         cfg80211_send_deauth(sdata->dev, frame_buf, IEEE80211_DEAUTH_FRAME_LEN);
-
-        mutex_lock(&local->mtx);
-        ieee80211_recalc_idle(local);
-        mutex_unlock(&local->mtx);
 }
 
 static void ieee80211_beacon_connection_loss_work(struct work_struct *work)
@@ -1867,10 +2102,10 @@ static void ieee80211_beacon_connection_loss_work(struct work_struct *work)
                 rcu_read_unlock();
         }
 
-        if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR) {
+        if (ifmgd->connection_loss) {
                 sdata_info(sdata, "Connection to AP %pM lost\n",
                            ifmgd->bssid);
-                __ieee80211_disconnect(sdata, false);
+                __ieee80211_disconnect(sdata);
         } else {
                 ieee80211_mgd_probe_ap(sdata, true);
         }
@@ -1882,9 +2117,7 @@ static void ieee80211_csa_connection_drop_work(struct work_struct *work)
                 container_of(work, struct ieee80211_sub_if_data,
                              u.mgd.csa_connection_drop_work);
 
-        ieee80211_wake_queues_by_reason(&sdata->local->hw,
-                                        IEEE80211_QUEUE_STOP_REASON_CSA);
-        __ieee80211_disconnect(sdata, true);
+        __ieee80211_disconnect(sdata);
 }
 
 void ieee80211_beacon_loss(struct ieee80211_vif *vif)
@@ -1895,6 +2128,7 @@ void ieee80211_beacon_loss(struct ieee80211_vif *vif)
         trace_api_beacon_loss(sdata);
 
         WARN_ON(hw->flags & IEEE80211_HW_CONNECTION_MONITOR);
+        sdata->u.mgd.connection_loss = false;
         ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
 }
 EXPORT_SYMBOL(ieee80211_beacon_loss);
@@ -1906,7 +2140,7 @@ void ieee80211_connection_loss(struct ieee80211_vif *vif)
 
         trace_api_connection_loss(sdata);
 
-        WARN_ON(!(hw->flags & IEEE80211_HW_CONNECTION_MONITOR));
+        sdata->u.mgd.connection_loss = true;
         ieee80211_queue_work(hw, &sdata->u.mgd.beacon_connection_loss_work);
 }
 EXPORT_SYMBOL(ieee80211_connection_loss);
@@ -1928,7 +2162,7 @@ static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata,
                 ieee80211_vif_release_channel(sdata);
         }
 
-        cfg80211_put_bss(auth_data->bss);
+        cfg80211_put_bss(sdata->local->hw.wiphy, auth_data->bss);
         kfree(auth_data);
         sdata->u.mgd.auth_data = NULL;
 }
@@ -1936,9 +2170,11 @@ static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata,
 static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
                                      struct ieee80211_mgmt *mgmt, size_t len)
 {
+        struct ieee80211_local *local = sdata->local;
         struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
         u8 *pos;
         struct ieee802_11_elems elems;
+        u32 tx_flags = 0;
 
         pos = mgmt->u.auth.variable;
         ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
@@ -1946,11 +2182,14 @@ static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
                 return;
         auth_data->expected_transaction = 4;
         drv_mgd_prepare_tx(sdata->local, sdata);
+        if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
+                tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
+                           IEEE80211_TX_INTFL_MLME_CONN_TX;
         ieee80211_send_auth(sdata, 3, auth_data->algorithm, 0,
                             elems.challenge - 2, elems.challenge_len + 2,
                             auth_data->bss->bssid, auth_data->bss->bssid,
                             auth_data->key, auth_data->key_len,
-                            auth_data->key_idx);
+                            auth_data->key_idx, tx_flags);
 }
 
 static enum rx_mgmt_action __must_check
@@ -2017,6 +2256,7 @@ ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
         sdata_info(sdata, "authenticated\n");
         ifmgd->auth_data->done = true;
         ifmgd->auth_data->timeout = jiffies + IEEE80211_AUTH_WAIT_ASSOC;
+        ifmgd->auth_data->timeout_started = true;
         run_again(ifmgd, ifmgd->auth_data->timeout);
 
         if (ifmgd->auth_data->algorithm == WLAN_AUTH_SAE &&
@@ -2075,10 +2315,6 @@ ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
 
         ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
 
-        mutex_lock(&sdata->local->mtx);
-        ieee80211_recalc_idle(sdata->local);
-        mutex_unlock(&sdata->local->mtx);
-
         return RX_MGMT_CFG80211_DEAUTH;
 }
 
@@ -2106,10 +2342,6 @@ ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
 
         ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
 
-        mutex_lock(&sdata->local->mtx);
-        ieee80211_recalc_idle(sdata->local);
-        mutex_unlock(&sdata->local->mtx);
-
         return RX_MGMT_CFG80211_DISASSOC;
 }
 
@@ -2219,6 +2451,24 @@ static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
 
         ifmgd->aid = aid;
 
+        /*
+         * We previously checked these in the beacon/probe response, so
+         * they should be present here. This is just a safety net.
+         */
+        if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
+            (!elems.wmm_param || !elems.ht_cap_elem || !elems.ht_operation)) {
+                sdata_info(sdata,
+                           "HT AP is missing WMM params or HT capability/operation in AssocResp\n");
+                return false;
+        }
+
+        if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
+            (!elems.vht_cap_elem || !elems.vht_operation)) {
+                sdata_info(sdata,
+                           "VHT AP is missing VHT capability/operation in AssocResp\n");
+                return false;
+        }
+
         mutex_lock(&sdata->local->sta_mtx);
         /*
          * station info was already allocated and inserted before
@@ -2232,17 +2482,36 @@ static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
 
         sband = local->hw.wiphy->bands[ieee80211_get_sdata_band(sdata)];
 
+        /* Set up internal HT/VHT capabilities */
         if (elems.ht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
                 ieee80211_ht_cap_ie_to_sta_ht_cap(sdata, sband,
-                                elems.ht_cap_elem, &sta->sta.ht_cap);
-
-        sta->supports_40mhz =
-                sta->sta.ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+                                                  elems.ht_cap_elem, sta);
 
         if (elems.vht_cap_elem && !(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
                 ieee80211_vht_cap_ie_to_sta_vht_cap(sdata, sband,
-                                                    elems.vht_cap_elem,
-                                                    &sta->sta.vht_cap);
+                                                    elems.vht_cap_elem, sta);
+
+        /*
+         * Some APs, e.g. Netgear WNDR3700, report invalid HT operation data
+         * in their association response, so ignore that data for our own
+         * configuration. If it changed since the last beacon, we'll get the
+         * next beacon and update then.
+         */
+
+        /*
+         * If an operating mode notification IE is present, override the
+         * NSS calculation (that would be done in rate_control_rate_init())
+         * and use the # of streams from that element.
+         */
+        if (elems.opmode_notif &&
+            !(*elems.opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_TYPE_BF)) {
+                u8 nss;
+
+                nss = *elems.opmode_notif & IEEE80211_OPMODE_NOTIF_RX_NSS_MASK;
+                nss >>= IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
+                nss += 1;
+                sta->sta.rx_nss = nss;
+        }
 
         rate_control_rate_init(sta);
 
@@ -2252,9 +2521,7 @@ static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
         if (elems.wmm_param)
                 set_sta_flag(sta, WLAN_STA_WME);
 
-        err = sta_info_move_state(sta, IEEE80211_STA_AUTH);
-        if (!err)
-                err = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
+        err = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
         if (!err && !(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
                 err = sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
         if (err) {
@@ -2283,11 +2550,6 @@ static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
                 ieee80211_set_wmm_default(sdata, false);
         changed |= BSS_CHANGED_QOS;
 
-        if (elems.ht_operation && elems.wmm_param &&
-            !(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
-                changed |= ieee80211_config_ht_tx(sdata, elems.ht_operation,
-                                                  cbss->bssid, false);
-
         /* set AID and assoc capability,
          * ieee80211_set_associated() will tell the driver */
         bss_conf->aid = aid;
@@ -2361,6 +2623,7 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
                            "%pM rejected association temporarily; comeback duration %u TU (%u ms)\n",
                            mgmt->sa, tu, ms);
                 assoc_data->timeout = jiffies + msecs_to_jiffies(ms);
+                assoc_data->timeout_started = true;
                 if (ms > IEEE80211_ASSOC_TIMEOUT)
                         run_again(ifmgd, assoc_data->timeout);
                 return RX_MGMT_NONE;
@@ -2376,7 +2639,7 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
                 if (!ieee80211_assoc_success(sdata, *bss, mgmt, len)) {
                         /* oops -- internal error -- send timeout for now */
                         ieee80211_destroy_assoc_data(sdata, false);
-                        cfg80211_put_bss(*bss);
+                        cfg80211_put_bss(sdata->local->hw.wiphy, *bss);
                         return RX_MGMT_CFG80211_ASSOC_TIMEOUT;
                 }
                 sdata_info(sdata, "associated\n");
@@ -2412,7 +2675,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                 need_ps = sdata->u.mgd.associated && !sdata->u.mgd.dtim_period;
 
                 if (elems->tim && !elems->parse_error) {
-                        struct ieee80211_tim_ie *tim_ie = elems->tim;
+                        const struct ieee80211_tim_ie *tim_ie = elems->tim;
                         sdata->u.mgd.dtim_period = tim_ie->dtim_period;
                 }
         }
@@ -2484,6 +2747,7 @@ static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
                 sdata_info(sdata, "direct probe responded\n");
                 ifmgd->auth_data->tries = 0;
                 ifmgd->auth_data->timeout = jiffies;
+                ifmgd->auth_data->timeout_started = true;
                 run_again(ifmgd, ifmgd->auth_data->timeout);
         }
 }
@@ -2509,10 +2773,10 @@ static const u64 care_about_ies =
         (1ULL << WLAN_EID_HT_CAPABILITY) |
         (1ULL << WLAN_EID_HT_OPERATION);
 
-static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
-                                     struct ieee80211_mgmt *mgmt,
-                                     size_t len,
-                                     struct ieee80211_rx_status *rx_status)
+static enum rx_mgmt_action
+ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
+                         struct ieee80211_mgmt *mgmt, size_t len,
+                         u8 *deauth_buf, struct ieee80211_rx_status *rx_status)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
@@ -2521,6 +2785,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_chanctx_conf *chanctx_conf;
         struct ieee80211_channel *chan;
+        struct sta_info *sta;
         u32 changed = 0;
         bool erp_valid;
         u8 erp_value = 0;
@@ -2532,39 +2797,51 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
         /* Process beacon from the current BSS */
         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
         if (baselen > len)
-                return;
+                return RX_MGMT_NONE;
 
         rcu_read_lock();
         chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
         if (!chanctx_conf) {
                 rcu_read_unlock();
-                return;
+                return RX_MGMT_NONE;
         }
 
         if (rx_status->freq != chanctx_conf->def.chan->center_freq) {
                 rcu_read_unlock();
-                return;
+                return RX_MGMT_NONE;
         }
         chan = chanctx_conf->def.chan;
         rcu_read_unlock();
 
-        if (ifmgd->assoc_data && !ifmgd->assoc_data->have_beacon &&
+        if (ifmgd->assoc_data && ifmgd->assoc_data->need_beacon &&
             ether_addr_equal(mgmt->bssid, ifmgd->assoc_data->bss->bssid)) {
                 ieee802_11_parse_elems(mgmt->u.beacon.variable,
                                        len - baselen, &elems);
 
                 ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
                 ifmgd->assoc_data->have_beacon = true;
-                ifmgd->assoc_data->sent_assoc = false;
+                ifmgd->assoc_data->need_beacon = false;
+                if (local->hw.flags & IEEE80211_HW_TIMING_BEACON_ONLY) {
+                        sdata->vif.bss_conf.sync_tsf =
+                                le64_to_cpu(mgmt->u.beacon.timestamp);
+                        sdata->vif.bss_conf.sync_device_ts =
+                                rx_status->device_timestamp;
+                        if (elems.tim)
+                                sdata->vif.bss_conf.sync_dtim_count =
+                                        elems.tim->dtim_count;
+                        else
+                                sdata->vif.bss_conf.sync_dtim_count = 0;
+                }
                 /* continue assoc process */
                 ifmgd->assoc_data->timeout = jiffies;
+                ifmgd->assoc_data->timeout_started = true;
                 run_again(ifmgd, ifmgd->assoc_data->timeout);
-                return;
+                return RX_MGMT_NONE;
         }
 
         if (!ifmgd->associated ||
             !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
-                return;
+                return RX_MGMT_NONE;
         bssid = ifmgd->associated->bssid;
 
         /* Track average RSSI from the Beacon frames of the current AP */
@@ -2630,7 +2907,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
 
         if (ifmgd->flags & IEEE80211_STA_BEACON_POLL) {
                 mlme_dbg_ratelimited(sdata,
-                                     "cancelling probereq poll due to a received beacon\n");
+                                     "cancelling AP probe due to a received beacon\n");
                 mutex_lock(&local->mtx);
                 ifmgd->flags &= ~IEEE80211_STA_BEACON_POLL;
                 ieee80211_run_deferred_scan(local);
@@ -2702,7 +2979,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
         }
 
         if (ncrc == ifmgd->beacon_crc && ifmgd->beacon_crc_valid)
-                return;
+                return RX_MGMT_NONE;
         ifmgd->beacon_crc = ncrc;
         ifmgd->beacon_crc_valid = true;
 
@@ -2712,6 +2989,32 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                                      elems.wmm_param_len))
                 changed |= BSS_CHANGED_QOS;
 
+        /*
+         * If we haven't had a beacon before, tell the driver about the
+         * DTIM period (and beacon timing if desired) now.
+         */
+        if (!bss_conf->dtim_period) {
+                /* a few bogus AP send dtim_period = 0 or no TIM IE */
+                if (elems.tim)
+                        bss_conf->dtim_period = elems.tim->dtim_period ?: 1;
+                else
+                        bss_conf->dtim_period = 1;
+
+                if (local->hw.flags & IEEE80211_HW_TIMING_BEACON_ONLY) {
+                        sdata->vif.bss_conf.sync_tsf =
+                                le64_to_cpu(mgmt->u.beacon.timestamp);
+                        sdata->vif.bss_conf.sync_device_ts =
+                                rx_status->device_timestamp;
+                        if (elems.tim)
+                                sdata->vif.bss_conf.sync_dtim_count =
+                                        elems.tim->dtim_count;
+                        else
+                                sdata->vif.bss_conf.sync_dtim_count = 0;
+                }
+
+                changed |= BSS_CHANGED_DTIM_PERIOD;
+        }
+
         if (elems.erp_info && elems.erp_info_len >= 1) {
                 erp_valid = true;
                 erp_value = elems.erp_info[0];
@@ -2722,11 +3025,22 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                         le16_to_cpu(mgmt->u.beacon.capab_info),
                         erp_valid, erp_value);
 
+        mutex_lock(&local->sta_mtx);
+        sta = sta_info_get(sdata, bssid);
 
-        if (elems.ht_cap_elem && elems.ht_operation && elems.wmm_param &&
-            !(ifmgd->flags & IEEE80211_STA_DISABLE_HT))
-                changed |= ieee80211_config_ht_tx(sdata, elems.ht_operation,
-                                                  bssid, true);
+        if (ieee80211_config_bw(sdata, sta, elems.ht_operation,
+                                elems.vht_operation, bssid, &changed)) {
+                mutex_unlock(&local->sta_mtx);
+                ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
+                                       WLAN_REASON_DEAUTH_LEAVING,
+                                       true, deauth_buf);
+                return RX_MGMT_CFG80211_TX_DEAUTH;
+        }
+
+        if (sta && elems.opmode_notif)
+                ieee80211_vht_handle_opmode(sdata, sta, *elems.opmode_notif,
+                                            rx_status->band, true);
+        mutex_unlock(&local->sta_mtx);
 
         if (elems.country_elem && elems.pwr_constr_elem &&
             mgmt->u.probe_resp.capab_info &
@@ -2737,6 +3051,8 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                                                        elems.pwr_constr_elem);
 
         ieee80211_bss_info_change_notify(sdata, changed);
+
+        return RX_MGMT_NONE;
 }
 
 void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
@@ -2747,6 +3063,7 @@ void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_mgmt *mgmt;
         struct cfg80211_bss *bss = NULL;
         enum rx_mgmt_action rma = RX_MGMT_NONE;
+        u8 deauth_buf[IEEE80211_DEAUTH_FRAME_LEN];
         u16 fc;
 
         rx_status = (struct ieee80211_rx_status *) skb->cb;
@@ -2757,7 +3074,8 @@ void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
 
         switch (fc & IEEE80211_FCTL_STYPE) {
         case IEEE80211_STYPE_BEACON:
-                ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len, rx_status);
+                rma = ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len,
+                                               deauth_buf, rx_status);
                 break;
         case IEEE80211_STYPE_PROBE_RESP:
                 ieee80211_rx_mgmt_probe_resp(sdata, skb);
@@ -2806,6 +3124,10 @@ void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
         case RX_MGMT_CFG80211_ASSOC_TIMEOUT:
                 cfg80211_send_assoc_timeout(sdata->dev, mgmt->bssid);
                 break;
+        case RX_MGMT_CFG80211_TX_DEAUTH:
+                cfg80211_send_deauth(sdata->dev, deauth_buf,
+                                     sizeof(deauth_buf));
+                break;
         default:
                 WARN(1, "unexpected: %d", rma);
         }
@@ -2827,14 +3149,13 @@ static void ieee80211_sta_timer(unsigned long data)
 }
 
 static void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
-                                          u8 *bssid, u8 reason)
+                                          u8 *bssid, u8 reason, bool tx)
 {
-        struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
 
         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, reason,
-                               false, frame_buf);
+                               tx, frame_buf);
         mutex_unlock(&ifmgd->mtx);
 
         /*
@@ -2843,10 +3164,6 @@ static void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
          */
         cfg80211_send_deauth(sdata->dev, frame_buf, IEEE80211_DEAUTH_FRAME_LEN);
 
-        mutex_lock(&local->mtx);
-        ieee80211_recalc_idle(local);
-        mutex_unlock(&local->mtx);
-
         mutex_lock(&ifmgd->mtx);
 }
 
@@ -2855,12 +3172,17 @@ static int ieee80211_probe_auth(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_mgd_auth_data *auth_data = ifmgd->auth_data;
+        u32 tx_flags = 0;
 
         lockdep_assert_held(&ifmgd->mtx);
 
         if (WARN_ON_ONCE(!auth_data))
                 return -EINVAL;
 
+        if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
+                tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
+                           IEEE80211_TX_INTFL_MLME_CONN_TX;
+
         auth_data->tries++;
 
         if (auth_data->tries > IEEE80211_AUTH_MAX_TRIES) {
@@ -2897,7 +3219,8 @@ static int ieee80211_probe_auth(struct ieee80211_sub_if_data *sdata)
                 ieee80211_send_auth(sdata, trans, auth_data->algorithm, status,
                                     auth_data->data, auth_data->data_len,
                                     auth_data->bss->bssid,
-                                    auth_data->bss->bssid, NULL, 0, 0);
+                                    auth_data->bss->bssid, NULL, 0, 0,
+                                    tx_flags);
         } else {
                 const u8 *ssidie;
 
@@ -2916,13 +3239,18 @@ static int ieee80211_probe_auth(struct ieee80211_sub_if_data *sdata)
                  * will not answer to direct packet in unassociated state.
                  */
                 ieee80211_send_probe_req(sdata, NULL, ssidie + 2, ssidie[1],
-                                         NULL, 0, (u32) -1, true, false,
+                                         NULL, 0, (u32) -1, true, tx_flags,
                                          auth_data->bss->channel, false);
                 rcu_read_unlock();
         }
 
-        auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
-        run_again(ifmgd, auth_data->timeout);
+        if (!(local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)) {
+                auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
+                ifmgd->auth_data->timeout_started = true;
+                run_again(ifmgd, auth_data->timeout);
+        } else {
+                auth_data->timeout_started = false;
+        }
 
         return 0;
 }
@@ -2953,12 +3281,29 @@ static int ieee80211_do_assoc(struct ieee80211_sub_if_data *sdata)
                    IEEE80211_ASSOC_MAX_TRIES);
         ieee80211_send_assoc(sdata);
 
-        assoc_data->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT;
-        run_again(&sdata->u.mgd, assoc_data->timeout);
+        if (!(local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)) {
+                assoc_data->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT;
+                assoc_data->timeout_started = true;
+                run_again(&sdata->u.mgd, assoc_data->timeout);
+        } else {
+                assoc_data->timeout_started = false;
+        }
 
         return 0;
 }
 
+void ieee80211_mgd_conn_tx_status(struct ieee80211_sub_if_data *sdata,
+                                  __le16 fc, bool acked)
+{
+        struct ieee80211_local *local = sdata->local;
+
+        sdata->u.mgd.status_fc = fc;
+        sdata->u.mgd.status_acked = acked;
+        sdata->u.mgd.status_received = true;
+
+        ieee80211_queue_work(&local->hw, &sdata->work);
+}
+
 void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_local *local = sdata->local;
@@ -2966,7 +3311,36 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
 
         mutex_lock(&ifmgd->mtx);
 
-        if (ifmgd->auth_data &&
+        if (ifmgd->status_received) {
+                __le16 fc = ifmgd->status_fc;
+                bool status_acked = ifmgd->status_acked;
+
+                ifmgd->status_received = false;
+                if (ifmgd->auth_data &&
+                    (ieee80211_is_probe_req(fc) || ieee80211_is_auth(fc))) {
+                        if (status_acked) {
+                                ifmgd->auth_data->timeout =
+                                        jiffies + IEEE80211_AUTH_TIMEOUT_SHORT;
+                                run_again(ifmgd, ifmgd->auth_data->timeout);
+                        } else {
+                                ifmgd->auth_data->timeout = jiffies - 1;
+                        }
+                        ifmgd->auth_data->timeout_started = true;
+                } else if (ifmgd->assoc_data &&
+                           (ieee80211_is_assoc_req(fc) ||
+                            ieee80211_is_reassoc_req(fc))) {
+                        if (status_acked) {
+                                ifmgd->assoc_data->timeout =
+                                        jiffies + IEEE80211_ASSOC_TIMEOUT_SHORT;
+                                run_again(ifmgd, ifmgd->assoc_data->timeout);
+                        } else {
+                                ifmgd->assoc_data->timeout = jiffies - 1;
+                        }
+                        ifmgd->assoc_data->timeout_started = true;
+                }
+        }
+
+        if (ifmgd->auth_data && ifmgd->auth_data->timeout_started &&
             time_after(jiffies, ifmgd->auth_data->timeout)) {
                 if (ifmgd->auth_data->done) {
                         /*
@@ -2985,12 +3359,13 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
                         cfg80211_send_auth_timeout(sdata->dev, bssid);
                         mutex_lock(&ifmgd->mtx);
                 }
-        } else if (ifmgd->auth_data)
+        } else if (ifmgd->auth_data && ifmgd->auth_data->timeout_started)
                 run_again(ifmgd, ifmgd->auth_data->timeout);
 
-        if (ifmgd->assoc_data &&
+        if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started &&
             time_after(jiffies, ifmgd->assoc_data->timeout)) {
-                if (!ifmgd->assoc_data->have_beacon ||
+                if ((ifmgd->assoc_data->need_beacon &&
+                     !ifmgd->assoc_data->have_beacon) ||
                     ieee80211_do_assoc(sdata)) {
                         u8 bssid[ETH_ALEN];
 
@@ -3002,7 +3377,7 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
                         cfg80211_send_assoc_timeout(sdata->dev, bssid);
                         mutex_lock(&ifmgd->mtx);
                 }
-        } else if (ifmgd->assoc_data)
+        } else if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started)
                 run_again(ifmgd, ifmgd->assoc_data->timeout);
 
         if (ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
@@ -3033,7 +3408,8 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
                                          "No ack for nullfunc frame to AP %pM, disconnecting.\n",
                                          bssid);
                                 ieee80211_sta_connection_lost(sdata, bssid,
-                                        WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY);
+                                        WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
+                                        false);
                         }
                 } else if (time_is_after_jiffies(ifmgd->probe_timeout))
                         run_again(ifmgd, ifmgd->probe_timeout);
@@ -3042,7 +3418,7 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
                                  "Failed to send nullfunc to AP %pM after %dms, disconnecting\n",
                                  bssid, probe_wait_ms);
                         ieee80211_sta_connection_lost(sdata, bssid,
-                                WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY);
+                                WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
                 } else if (ifmgd->probe_send_count < max_tries) {
                         mlme_dbg(sdata,
                                  "No probe response from AP %pM after %dms, try %d/%i\n",
@@ -3061,15 +3437,11 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
                                     bssid, probe_wait_ms);
 
                         ieee80211_sta_connection_lost(sdata, bssid,
-                                WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY);
+                                WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY, false);
                 }
         }
 
         mutex_unlock(&ifmgd->mtx);
-
-        mutex_lock(&local->mtx);
-        ieee80211_recalc_idle(local);
-        mutex_unlock(&local->mtx);
 }
 
 static void ieee80211_sta_bcn_mon_timer(unsigned long data)
@@ -3081,6 +3453,7 @@ static void ieee80211_sta_bcn_mon_timer(unsigned long data)
         if (local->quiescing)
                 return;
 
+        sdata->u.mgd.connection_loss = false;
         ieee80211_queue_work(&sdata->local->hw,
                              &sdata->u.mgd.beacon_connection_loss_work);
 }
@@ -3167,7 +3540,8 @@ void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
                 mlme_dbg(sdata, "driver requested disconnect after resume\n");
                 ieee80211_sta_connection_lost(sdata,
                                               ifmgd->associated->bssid,
-                                              WLAN_REASON_UNSPECIFIED);
+                                              WLAN_REASON_UNSPECIFIED,
+                                              true);
                 mutex_unlock(&ifmgd->mtx);
                 return;
         }
@@ -3247,201 +3621,6 @@ int ieee80211_max_network_latency(struct notifier_block *nb,
         return 0;
 }
 
-static u32 chandef_downgrade(struct cfg80211_chan_def *c)
-{
-        u32 ret;
-        int tmp;
-
-        switch (c->width) {
-        case NL80211_CHAN_WIDTH_20:
-                c->width = NL80211_CHAN_WIDTH_20_NOHT;
-                ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
-                break;
-        case NL80211_CHAN_WIDTH_40:
-                c->width = NL80211_CHAN_WIDTH_20;
-                c->center_freq1 = c->chan->center_freq;
-                ret = IEEE80211_STA_DISABLE_40MHZ |
-                      IEEE80211_STA_DISABLE_VHT;
-                break;
-        case NL80211_CHAN_WIDTH_80:
-                tmp = (30 + c->chan->center_freq - c->center_freq1)/20;
-                /* n_P40 */
-                tmp /= 2;
-                /* freq_P40 */
-                c->center_freq1 = c->center_freq1 - 20 + 40 * tmp;
-                c->width = NL80211_CHAN_WIDTH_40;
-                ret = IEEE80211_STA_DISABLE_VHT;
-                break;
-        case NL80211_CHAN_WIDTH_80P80:
-                c->center_freq2 = 0;
-                c->width = NL80211_CHAN_WIDTH_80;
-                ret = IEEE80211_STA_DISABLE_80P80MHZ |
-                      IEEE80211_STA_DISABLE_160MHZ;
-                break;
-        case NL80211_CHAN_WIDTH_160:
-                /* n_P20 */
-                tmp = (70 + c->chan->center_freq - c->center_freq1)/20;
-                /* n_P80 */
-                tmp /= 4;
-                c->center_freq1 = c->center_freq1 - 40 + 80 * tmp;
-                c->width = NL80211_CHAN_WIDTH_80;
-                ret = IEEE80211_STA_DISABLE_80P80MHZ |
-                      IEEE80211_STA_DISABLE_160MHZ;
-                break;
-        default:
-        case NL80211_CHAN_WIDTH_20_NOHT:
-                WARN_ON_ONCE(1);
-                c->width = NL80211_CHAN_WIDTH_20_NOHT;
-                ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
-                break;
-        }
-
-        WARN_ON_ONCE(!cfg80211_chandef_valid(c));
-
-        return ret;
-}
-
-static u32
-ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
-                             struct ieee80211_supported_band *sband,
-                             struct ieee80211_channel *channel,
-                             const struct ieee80211_ht_operation *ht_oper,
-                             const struct ieee80211_vht_operation *vht_oper,
-                             struct cfg80211_chan_def *chandef)
-{
-        struct cfg80211_chan_def vht_chandef;
-        u32 ht_cfreq, ret;
-
-        chandef->chan = channel;
-        chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
-        chandef->center_freq1 = channel->center_freq;
-        chandef->center_freq2 = 0;
-
-        if (!ht_oper || !sband->ht_cap.ht_supported) {
-                ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
-                goto out;
-        }
-
-        chandef->width = NL80211_CHAN_WIDTH_20;
-
-        ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
-                                                  channel->band);
-        /* check that channel matches the right operating channel */
-        if (channel->center_freq != ht_cfreq) {
-                /*
-                 * It's possible that some APs are confused here;
-                 * Netgear WNDR3700 sometimes reports 4 higher than
-                 * the actual channel in association responses, but
-                 * since we look at probe response/beacon data here
-                 * it should be OK.
-                 */
-                sdata_info(sdata,
-                           "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
-                           channel->center_freq, ht_cfreq,
-                           ht_oper->primary_chan, channel->band);
-                ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
-                goto out;
-        }
-
-        /* check 40 MHz support, if we have it */
-        if (sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
-                switch (ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
-                case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
-                        chandef->width = NL80211_CHAN_WIDTH_40;
-                        chandef->center_freq1 += 10;
-                        break;
-                case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
-                        chandef->width = NL80211_CHAN_WIDTH_40;
-                        chandef->center_freq1 -= 10;
-                        break;
-                }
-        } else {
-                /* 40 MHz (and 80 MHz) must be supported for VHT */
-                ret = IEEE80211_STA_DISABLE_VHT;
-                goto out;
-        }
-
-        if (!vht_oper || !sband->vht_cap.vht_supported) {
-                ret = IEEE80211_STA_DISABLE_VHT;
-                goto out;
-        }
-
-        vht_chandef.chan = channel;
-        vht_chandef.center_freq1 =
-                ieee80211_channel_to_frequency(vht_oper->center_freq_seg1_idx,
-                                               channel->band);
-        vht_chandef.center_freq2 = 0;
-
-        if (vht_oper->center_freq_seg2_idx)
-                vht_chandef.center_freq2 =
-                        ieee80211_channel_to_frequency(
-                                vht_oper->center_freq_seg2_idx,
-                                channel->band);
-
-        switch (vht_oper->chan_width) {
-        case IEEE80211_VHT_CHANWIDTH_USE_HT:
-                vht_chandef.width = chandef->width;
-                break;
-        case IEEE80211_VHT_CHANWIDTH_80MHZ:
-                vht_chandef.width = NL80211_CHAN_WIDTH_80;
-                break;
-        case IEEE80211_VHT_CHANWIDTH_160MHZ:
-                vht_chandef.width = NL80211_CHAN_WIDTH_160;
-                break;
-        case IEEE80211_VHT_CHANWIDTH_80P80MHZ:
-                vht_chandef.width = NL80211_CHAN_WIDTH_80P80;
-                break;
-        default:
-                sdata_info(sdata,
-                           "AP VHT operation IE has invalid channel width (%d), disable VHT\n",
-                           vht_oper->chan_width);
-                ret = IEEE80211_STA_DISABLE_VHT;
-                goto out;
-        }
-
-        if (!cfg80211_chandef_valid(&vht_chandef)) {
-                sdata_info(sdata,
-                           "AP VHT information is invalid, disable VHT\n");
-                ret = IEEE80211_STA_DISABLE_VHT;
-                goto out;
-        }
-
-        if (cfg80211_chandef_identical(chandef, &vht_chandef)) {
-                ret = 0;
-                goto out;
-        }
-
-        if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
-                sdata_info(sdata,
-                           "AP VHT information doesn't match HT, disable VHT\n");
-                ret = IEEE80211_STA_DISABLE_VHT;
-                goto out;
-        }
-
-        *chandef = vht_chandef;
-
-        ret = 0;
-
-out:
-        while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
-                                        IEEE80211_CHAN_DISABLED)) {
-                if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
-                        ret = IEEE80211_STA_DISABLE_HT |
-                              IEEE80211_STA_DISABLE_VHT;
-                        goto out;
-                }
-
-                ret |= chandef_downgrade(chandef);
-        }
-
-        if (chandef->width != vht_chandef.width)
-                sdata_info(sdata,
-                           "capabilities/regulatory prevented using AP HT/VHT configuration, downgraded\n");
-
-        WARN_ON_ONCE(!cfg80211_chandef_valid(chandef));
-        return ret;
-}
-
 static u8 ieee80211_ht_vht_rx_chains(struct ieee80211_sub_if_data *sdata,
                                      struct cfg80211_bss *cbss)
 {
@@ -3507,16 +3686,22 @@ static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
 
         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
             sband->ht_cap.ht_supported) {
-                const u8 *ht_oper_ie;
+                const u8 *ht_oper_ie, *ht_cap;
 
                 ht_oper_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_OPERATION);
                 if (ht_oper_ie && ht_oper_ie[1] >= sizeof(*ht_oper))
                         ht_oper = (void *)(ht_oper_ie + 2);
+
+                ht_cap = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
+                if (!ht_cap || ht_cap[1] < sizeof(struct ieee80211_ht_cap)) {
+                        ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
+                        ht_oper = NULL;
+                }
         }
 
         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT) &&
             sband->vht_cap.vht_supported) {
-                const u8 *vht_oper_ie;
+                const u8 *vht_oper_ie, *vht_cap;
 
                 vht_oper_ie = ieee80211_bss_get_ie(cbss,
                                                    WLAN_EID_VHT_OPERATION);
@@ -3526,15 +3711,21 @@ static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
                         vht_oper = NULL;
                         sdata_info(sdata,
                                    "AP advertised VHT without HT, disabling both\n");
-                        sdata->flags |= IEEE80211_STA_DISABLE_HT;
-                        sdata->flags |= IEEE80211_STA_DISABLE_VHT;
+                        ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
+                        ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
+                }
+
+                vht_cap = ieee80211_bss_get_ie(cbss, WLAN_EID_VHT_CAPABILITY);
+                if (!vht_cap || vht_cap[1] < sizeof(struct ieee80211_vht_cap)) {
+                        ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
+                        vht_oper = NULL;
                 }
         }
 
         ifmgd->flags |= ieee80211_determine_chantype(sdata, sband,
                                                      cbss->channel,
                                                      ht_oper, vht_oper,
-                                                     &chandef);
+                                                     &chandef, true);
 
         sdata->needed_rx_chains = min(ieee80211_ht_vht_rx_chains(sdata, cbss),
                                       local->rx_chains);
@@ -3584,15 +3775,12 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
                         return -ENOMEM;
         }
 
-        mutex_lock(&local->mtx);
-        ieee80211_recalc_idle(sdata->local);
-        mutex_unlock(&local->mtx);
-
         if (new_sta) {
                 u32 rates = 0, basic_rates = 0;
                 bool have_higher_than_11mbit;
                 int min_rate = INT_MAX, min_rate_index = -1;
                 struct ieee80211_supported_band *sband;
+                const struct cfg80211_bss_ies *ies;
 
                 sband = local->hw.wiphy->bands[cbss->channel->band];
 
@@ -3636,8 +3824,34 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
 
                 /* set timing information */
                 sdata->vif.bss_conf.beacon_int = cbss->beacon_interval;
-                sdata->vif.bss_conf.sync_tsf = cbss->tsf;
-                sdata->vif.bss_conf.sync_device_ts = bss->device_ts;
+                rcu_read_lock();
+                ies = rcu_dereference(cbss->beacon_ies);
+                if (ies) {
+                        const u8 *tim_ie;
+
+                        sdata->vif.bss_conf.sync_tsf = ies->tsf;
+                        sdata->vif.bss_conf.sync_device_ts =
+                                bss->device_ts_beacon;
+                        tim_ie = cfg80211_find_ie(WLAN_EID_TIM,
+                                                  ies->data, ies->len);
+                        if (tim_ie && tim_ie[1] >= 2)
+                                sdata->vif.bss_conf.sync_dtim_count = tim_ie[2];
+                        else
+                                sdata->vif.bss_conf.sync_dtim_count = 0;
+                } else if (!(local->hw.flags &
+                                        IEEE80211_HW_TIMING_BEACON_ONLY)) {
+                        ies = rcu_dereference(cbss->proberesp_ies);
+                        /* must be non-NULL since beacon IEs were NULL */
+                        sdata->vif.bss_conf.sync_tsf = ies->tsf;
+                        sdata->vif.bss_conf.sync_device_ts =
+                                bss->device_ts_presp;
+                        sdata->vif.bss_conf.sync_dtim_count = 0;
+                } else {
+                        sdata->vif.bss_conf.sync_tsf = 0;
+                        sdata->vif.bss_conf.sync_device_ts = 0;
+                        sdata->vif.bss_conf.sync_dtim_count = 0;
+                }
+                rcu_read_unlock();
 
                 /* tell driver about BSSID, basic rates and timing */
                 ieee80211_bss_info_change_notify(sdata,
@@ -3757,7 +3971,7 @@ int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
         }
 
         /* hold our own reference */
-        cfg80211_ref_bss(auth_data->bss);
+        cfg80211_ref_bss(local->hw.wiphy, auth_data->bss);
         err = 0;
         goto out_unlock;
 
@@ -3780,6 +3994,7 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_bss *bss = (void *)req->bss->priv;
         struct ieee80211_mgd_assoc_data *assoc_data;
+        const struct cfg80211_bss_ies *beacon_ies;
         struct ieee80211_supported_band *sband;
         const u8 *ssidie, *ht_ie, *vht_ie;
         int i, err;
@@ -3945,40 +4160,48 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
         if (err)
                 goto err_clear;
 
-        if (sdata->local->hw.flags & IEEE80211_HW_NEED_DTIM_PERIOD) {
-                const struct cfg80211_bss_ies *beacon_ies;
+        rcu_read_lock();
+        beacon_ies = rcu_dereference(req->bss->beacon_ies);
 
-                rcu_read_lock();
-                beacon_ies = rcu_dereference(req->bss->beacon_ies);
-                if (!beacon_ies) {
-                        /*
-                         * Wait up to one beacon interval ...
-                         * should this be more if we miss one?
-                         */
-                        sdata_info(sdata, "waiting for beacon from %pM\n",
-                                   ifmgd->bssid);
-                        assoc_data->timeout =
-                                TU_TO_EXP_TIME(req->bss->beacon_interval);
-                } else {
-                        const u8 *tim_ie = cfg80211_find_ie(WLAN_EID_TIM,
-                                                            beacon_ies->data,
-                                                            beacon_ies->len);
-                        if (tim_ie && tim_ie[1] >=
-                                        sizeof(struct ieee80211_tim_ie)) {
-                                const struct ieee80211_tim_ie *tim;
-                                tim = (void *)(tim_ie + 2);
-                                ifmgd->dtim_period = tim->dtim_period;
-                        }
-                        assoc_data->have_beacon = true;
-                        assoc_data->sent_assoc = false;
-                        assoc_data->timeout = jiffies;
+        if (sdata->local->hw.flags & IEEE80211_HW_NEED_DTIM_BEFORE_ASSOC &&
+            !beacon_ies) {
+                /*
+                 * Wait up to one beacon interval ...
+                 * should this be more if we miss one?
+                 */
+                sdata_info(sdata, "waiting for beacon from %pM\n",
+                           ifmgd->bssid);
+                assoc_data->timeout = TU_TO_EXP_TIME(req->bss->beacon_interval);
+                assoc_data->timeout_started = true;
+                assoc_data->need_beacon = true;
+        } else if (beacon_ies) {
+                const u8 *tim_ie = cfg80211_find_ie(WLAN_EID_TIM,
+                                                    beacon_ies->data,
+                                                    beacon_ies->len);
+                u8 dtim_count = 0;
+
+                if (tim_ie && tim_ie[1] >= sizeof(struct ieee80211_tim_ie)) {
+                        const struct ieee80211_tim_ie *tim;
+                        tim = (void *)(tim_ie + 2);
+                        ifmgd->dtim_period = tim->dtim_period;
+                        dtim_count = tim->dtim_count;
                 }
-                rcu_read_unlock();
-        } else {
                 assoc_data->have_beacon = true;
-                assoc_data->sent_assoc = false;
                 assoc_data->timeout = jiffies;
+                assoc_data->timeout_started = true;
+
+                if (local->hw.flags & IEEE80211_HW_TIMING_BEACON_ONLY) {
+                        sdata->vif.bss_conf.sync_tsf = beacon_ies->tsf;
+                        sdata->vif.bss_conf.sync_device_ts =
+                                bss->device_ts_beacon;
+                        sdata->vif.bss_conf.sync_dtim_count = dtim_count;
+                }
+        } else {
+                assoc_data->timeout = jiffies;
+                assoc_data->timeout_started = true;
         }
+        rcu_read_unlock();
+
         run_again(ifmgd, assoc_data->timeout);
 
         if (bss->corrupt_data) {
@@ -4045,10 +4268,6 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
         mutex_unlock(&ifmgd->mtx);
 
  out:
-        mutex_lock(&sdata->local->mtx);
-        ieee80211_recalc_idle(sdata->local);
-        mutex_unlock(&sdata->local->mtx);
-
         if (sent_frame)
                 __cfg80211_send_deauth(sdata->dev, frame_buf,
                                        IEEE80211_DEAUTH_FRAME_LEN);
@@ -4089,10 +4308,6 @@ int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
         __cfg80211_send_disassoc(sdata->dev, frame_buf,
                                  IEEE80211_DEAUTH_FRAME_LEN);
 
-        mutex_lock(&sdata->local->mtx);
-        ieee80211_recalc_idle(sdata->local);
-        mutex_unlock(&sdata->local->mtx);
-
         return 0;
 }
 
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index 82baf5b6ecf4..cc79b4a2e821 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -113,6 +113,15 @@ void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local)
          * notify the AP about us leaving the channel and stop all
          * STA interfaces.
          */
+
+        /*
+         * Stop queues and transmit all frames queued by the driver
+         * before sending nullfunc to enable powersave at the AP.
+         */
+        ieee80211_stop_queues_by_reason(&local->hw,
+                                        IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL);
+        drv_flush(local, false);
+
         mutex_lock(&local->iflist_mtx);
         list_for_each_entry(sdata, &local->interfaces, list) {
                 if (!ieee80211_sdata_running(sdata))
@@ -133,12 +142,9 @@ void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local)
                                 sdata, BSS_CHANGED_BEACON_ENABLED);
                 }
 
-                if (sdata->vif.type != NL80211_IFTYPE_MONITOR) {
-                        netif_tx_stop_all_queues(sdata->dev);
-                        if (sdata->vif.type == NL80211_IFTYPE_STATION &&
-                            sdata->u.mgd.associated)
-                                ieee80211_offchannel_ps_enable(sdata);
-                }
+                if (sdata->vif.type == NL80211_IFTYPE_STATION &&
+                    sdata->u.mgd.associated)
+                        ieee80211_offchannel_ps_enable(sdata);
         }
         mutex_unlock(&local->iflist_mtx);
 }
@@ -166,20 +172,6 @@ void ieee80211_offchannel_return(struct ieee80211_local *local)
                     sdata->u.mgd.associated)
                         ieee80211_offchannel_ps_disable(sdata);
 
-                if (sdata->vif.type != NL80211_IFTYPE_MONITOR) {
-                        /*
-                         * This may wake up queues even though the driver
-                         * currently has them stopped. This is not very
-                         * likely, since the driver won't have gotten any
-                         * (or hardly any) new packets while we weren't
-                         * on the right channel, and even if it happens
-                         * it will at most lead to queueing up one more
-                         * packet per queue in mac80211 rather than on
-                         * the interface qdisc.
-                         */
-                        netif_tx_wake_all_queues(sdata->dev);
-                }
-
                 if (test_and_clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED,
                                        &sdata->state)) {
                         sdata->vif.bss_conf.enable_beacon = true;
@@ -188,6 +180,9 @@ void ieee80211_offchannel_return(struct ieee80211_local *local)
                 }
         }
         mutex_unlock(&local->iflist_mtx);
+
+        ieee80211_wake_queues_by_reason(&local->hw,
+                                        IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL);
 }
 
 void ieee80211_handle_roc_started(struct ieee80211_roc_work *roc)
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index e45b83610e85..d0275f34bf70 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -38,6 +38,8 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
 
         ieee80211_scan_cancel(local);
 
+        ieee80211_dfs_cac_cancel(local);
+
         if (hw->flags & IEEE80211_HW_AMPDU_AGGREGATION) {
                 mutex_lock(&local->sta_mtx);
                 list_for_each_entry(sta, &local->sta_list, list) {
@@ -228,3 +230,13 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
  * ieee80211_reconfig(), which is also needed for hardware
  * hang/firmware failure/etc. recovery.
  */
+
+void ieee80211_report_wowlan_wakeup(struct ieee80211_vif *vif,
+                                    struct cfg80211_wowlan_wakeup *wakeup,
+                                    gfp_t gfp)
+{
+        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+
+        cfg80211_report_wowlan_wakeup(&sdata->wdev, wakeup, gfp);
+}
+EXPORT_SYMBOL(ieee80211_report_wowlan_wakeup);
diff --git a/net/mac80211/rate.h b/net/mac80211/rate.h
index 301386dabf88..d35a5dd3fb13 100644
--- a/net/mac80211/rate.h
+++ b/net/mac80211/rate.h
@@ -68,6 +68,8 @@ static inline void rate_control_rate_init(struct sta_info *sta)
         sband = local->hw.wiphy->bands[chanctx_conf->def.chan->band];
         rcu_read_unlock();
 
+        ieee80211_sta_set_rx_nss(sta);
+
         ref->ops->rate_init(ref->priv, sband, ista, priv_sta);
         set_sta_flag(sta, WLAN_STA_RATE_CONTROL);
 }
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index 8c5acdc06226..eea45a2c7c35 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -494,6 +494,33 @@ minstrel_free_sta(void *priv, struct ieee80211_sta *sta, void *priv_sta)
         kfree(mi);
 }
 
+static void
+minstrel_init_cck_rates(struct minstrel_priv *mp)
+{
+        static const int bitrates[4] = { 10, 20, 55, 110 };
+        struct ieee80211_supported_band *sband;
+        int i, j;
+
+        sband = mp->hw->wiphy->bands[IEEE80211_BAND_2GHZ];
+        if (!sband)
+                return;
+
+        for (i = 0, j = 0; i < sband->n_bitrates; i++) {
+                struct ieee80211_rate *rate = &sband->bitrates[i];
+
+                if (rate->flags & IEEE80211_RATE_ERP_G)
+                        continue;
+
+                for (j = 0; j < ARRAY_SIZE(bitrates); j++) {
+                        if (rate->bitrate != bitrates[j])
+                                continue;
+
+                        mp->cck_rates[j] = i;
+                        break;
+                }
+        }
+}
+
 static void *
 minstrel_alloc(struct ieee80211_hw *hw, struct dentry *debugfsdir)
 {
@@ -539,6 +566,8 @@ minstrel_alloc(struct ieee80211_hw *hw, struct dentry *debugfsdir)
                         S_IRUGO | S_IWUGO, debugfsdir, &mp->fixed_rate_idx);
 #endif
 
+        minstrel_init_cck_rates(mp);
+
         return mp;
 }
 
diff --git a/net/mac80211/rc80211_minstrel.h b/net/mac80211/rc80211_minstrel.h
index 5d278eccaef0..5ecf757817f2 100644
--- a/net/mac80211/rc80211_minstrel.h
+++ b/net/mac80211/rc80211_minstrel.h
@@ -79,6 +79,8 @@ struct minstrel_priv {
         unsigned int lookaround_rate;
         unsigned int lookaround_rate_mrr;
 
+        u8 cck_rates[4];
+
 #ifdef CONFIG_MAC80211_DEBUGFS
         /*
          * enable fixed rate processing per RC
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index 9f9c453bc45d..3af141c69712 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Felix Fietkau <nbd@openwrt.org>
+ * Copyright (C) 2010-2013 Felix Fietkau <nbd@openwrt.org>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -63,6 +63,30 @@
         }                                                               \
 }
 
+#define CCK_DURATION(_bitrate, _short, _len)            \
+        (10 /* SIFS */ +                                \
+         (_short ? 72 + 24 : 144 + 48 ) +               \
+         (8 * (_len + 4) * 10) / (_bitrate))
+
+#define CCK_ACK_DURATION(_bitrate, _short)                      \
+        (CCK_DURATION((_bitrate > 10 ? 20 : 10), false, 60) +   \
+         CCK_DURATION(_bitrate, _short, AVG_PKT_SIZE))
+
+#define CCK_DURATION_LIST(_short)                       \
+        CCK_ACK_DURATION(10, _short),                   \
+        CCK_ACK_DURATION(20, _short),                   \
+        CCK_ACK_DURATION(55, _short),                   \
+        CCK_ACK_DURATION(110, _short)
+
+#define CCK_GROUP                                               \
+        [MINSTREL_MAX_STREAMS * MINSTREL_STREAM_GROUPS] = {     \
+                .streams = 0,                                   \
+                .duration = {                                   \
+                        CCK_DURATION_LIST(false),               \
+                        CCK_DURATION_LIST(true)                 \
+                }                                               \
+        }
+
 /*
  * To enable sufficiently targeted rate sampling, MCS rates are divided into
  * groups, based on the number of streams and flags (HT40, SGI) that they
@@ -95,8 +119,13 @@ const struct mcs_group minstrel_mcs_groups[] = {
 #if MINSTREL_MAX_STREAMS >= 3
         MCS_GROUP(3, 1, 1),
 #endif
+
+        /* must be last */
+        CCK_GROUP
 };
 
+#define MINSTREL_CCK_GROUP      (ARRAY_SIZE(minstrel_mcs_groups) - 1)
+
 static u8 sample_table[SAMPLE_COLUMNS][MCS_GROUP_RATES];
 
 /*
@@ -119,6 +148,29 @@ minstrel_ht_get_group_idx(struct ieee80211_tx_rate *rate)
                          !!(rate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH));
 }
 
+static struct minstrel_rate_stats *
+minstrel_ht_get_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
+                      struct ieee80211_tx_rate *rate)
+{
+        int group, idx;
+
+        if (rate->flags & IEEE80211_TX_RC_MCS) {
+                group = minstrel_ht_get_group_idx(rate);
+                idx = rate->idx % MCS_GROUP_RATES;
+        } else {
+                group = MINSTREL_CCK_GROUP;
+
+                for (idx = 0; idx < ARRAY_SIZE(mp->cck_rates); idx++)
+                        if (rate->idx == mp->cck_rates[idx])
+                                break;
+
+                /* short preamble */
+                if (!(mi->groups[group].supported & BIT(idx)))
+                        idx += 4;
+        }
+        return &mi->groups[group].rates[idx];
+}
+
 static inline struct minstrel_rate_stats *
 minstrel_get_ratestats(struct minstrel_ht_sta *mi, int index)
 {
@@ -159,7 +211,7 @@ static void
 minstrel_ht_calc_tp(struct minstrel_ht_sta *mi, int group, int rate)
 {
         struct minstrel_rate_stats *mr;
-        unsigned int usecs;
+        unsigned int usecs = 0;
 
         mr = &mi->groups[group].rates[rate];
 
@@ -168,7 +220,9 @@ minstrel_ht_calc_tp(struct minstrel_ht_sta *mi, int group, int rate)
                 return;
         }
 
-        usecs = mi->overhead / MINSTREL_TRUNC(mi->avg_ampdu_len);
+        if (group != MINSTREL_CCK_GROUP)
+                usecs = mi->overhead / MINSTREL_TRUNC(mi->avg_ampdu_len);
+
         usecs += minstrel_mcs_groups[group].duration[rate];
         mr->cur_tp = MINSTREL_TRUNC((1000000 / usecs) * mr->probability);
 }
@@ -231,10 +285,6 @@ minstrel_ht_update_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
                         if (!mr->cur_tp)
                                 continue;
 
-                        /* ignore the lowest rate of each single-stream group */
-                        if (!i && minstrel_mcs_groups[group].streams == 1)
-                                continue;
-
                         if ((mr->cur_tp > cur_prob_tp && mr->probability >
                              MINSTREL_FRAC(3, 4)) || mr->probability > cur_prob) {
                                 mg->max_prob_rate = index;
@@ -297,7 +347,7 @@ minstrel_ht_update_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
 }
 
 static bool
-minstrel_ht_txstat_valid(struct ieee80211_tx_rate *rate)
+minstrel_ht_txstat_valid(struct minstrel_priv *mp, struct ieee80211_tx_rate *rate)
 {
         if (rate->idx < 0)
                 return false;
@@ -305,7 +355,13 @@ minstrel_ht_txstat_valid(struct ieee80211_tx_rate *rate)
         if (!rate->count)
                 return false;
 
-        return !!(rate->flags & IEEE80211_TX_RC_MCS);
+        if (rate->flags & IEEE80211_TX_RC_MCS)
+                return true;
+
+        return rate->idx == mp->cck_rates[0] ||
+               rate->idx == mp->cck_rates[1] ||
+               rate->idx == mp->cck_rates[2] ||
+               rate->idx == mp->cck_rates[3];
 }
 
 static void
@@ -390,7 +446,6 @@ minstrel_ht_tx_status(void *priv, struct ieee80211_supported_band *sband,
         struct minstrel_rate_stats *rate, *rate2;
         struct minstrel_priv *mp = priv;
         bool last;
-        int group;
         int i;
 
         if (!msp->is_ht)
@@ -419,13 +474,12 @@ minstrel_ht_tx_status(void *priv, struct ieee80211_supported_band *sband,
         if (info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE)
                 mi->sample_packets += info->status.ampdu_len;
 
-        last = !minstrel_ht_txstat_valid(&ar[0]);
+        last = !minstrel_ht_txstat_valid(mp, &ar[0]);
         for (i = 0; !last; i++) {
                 last = (i == IEEE80211_TX_MAX_RATES - 1) ||
-                       !minstrel_ht_txstat_valid(&ar[i + 1]);
+                       !minstrel_ht_txstat_valid(mp, &ar[i + 1]);
 
-                group = minstrel_ht_get_group_idx(&ar[i]);
-                rate = &mi->groups[group].rates[ar[i].idx % 8];
+                rate = minstrel_ht_get_stats(mp, mi, &ar[i]);
 
                 if (last)
                         rate->success += info->status.ampdu_ack_len;
@@ -451,7 +505,8 @@ minstrel_ht_tx_status(void *priv, struct ieee80211_supported_band *sband,
 
         if (time_after(jiffies, mi->stats_update + (mp->update_interval / 2 * HZ) / 1000)) {
                 minstrel_ht_update_stats(mp, mi);
-                if (!(info->flags & IEEE80211_TX_CTL_AMPDU))
+                if (!(info->flags & IEEE80211_TX_CTL_AMPDU) &&
+                    mi->max_prob_rate / MCS_GROUP_RATES != MINSTREL_CCK_GROUP)
                         minstrel_aggr_check(sta, skb);
         }
 }
@@ -467,6 +522,7 @@ minstrel_calc_retransmit(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
         unsigned int ctime = 0;
         unsigned int t_slot = 9; /* FIXME */
         unsigned int ampdu_len = MINSTREL_TRUNC(mi->avg_ampdu_len);
+        unsigned int overhead = 0, overhead_rtscts = 0;
 
         mr = minstrel_get_ratestats(mi, index);
         if (mr->probability < MINSTREL_FRAC(1, 10)) {
@@ -488,9 +544,14 @@ minstrel_calc_retransmit(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
         ctime += (t_slot * cw) >> 1;
         cw = min((cw << 1) | 1, mp->cw_max);
 
+        if (index / MCS_GROUP_RATES != MINSTREL_CCK_GROUP) {
+                overhead = mi->overhead;
+                overhead_rtscts = mi->overhead_rtscts;
+        }
+
         /* Total TX time for data and Contention after first 2 tries */
-        tx_time = ctime + 2 * (mi->overhead + tx_time_data);
-        tx_time_rtscts = ctime + 2 * (mi->overhead_rtscts + tx_time_data);
+        tx_time = ctime + 2 * (overhead + tx_time_data);
+        tx_time_rtscts = ctime + 2 * (overhead_rtscts + tx_time_data);
 
         /* See how many more tries we can fit inside segment size */
         do {
@@ -499,8 +560,8 @@ minstrel_calc_retransmit(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
                 cw = min((cw << 1) | 1, mp->cw_max);
 
                 /* Total TX time after this try */
-                tx_time += ctime + mi->overhead + tx_time_data;
-                tx_time_rtscts += ctime + mi->overhead_rtscts + tx_time_data;
+                tx_time += ctime + overhead + tx_time_data;
+                tx_time_rtscts += ctime + overhead_rtscts + tx_time_data;
 
                 if (tx_time_rtscts < mp->segment_size)
                         mr->retry_count_rtscts++;
@@ -530,9 +591,16 @@ minstrel_ht_set_rate(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
         else
                 rate->count = mr->retry_count;
 
-        rate->flags = IEEE80211_TX_RC_MCS | group->flags;
+        rate->flags = 0;
         if (rtscts)
                 rate->flags |= IEEE80211_TX_RC_USE_RTS_CTS;
+
+        if (index / MCS_GROUP_RATES == MINSTREL_CCK_GROUP) {
+                rate->idx = mp->cck_rates[index % ARRAY_SIZE(mp->cck_rates)];
+                return;
+        }
+
+        rate->flags |= IEEE80211_TX_RC_MCS | group->flags;
         rate->idx = index % MCS_GROUP_RATES + (group->streams - 1) * MCS_GROUP_RATES;
 }
 
@@ -596,6 +664,22 @@ minstrel_get_sample_rate(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
 }
 
 static void
+minstrel_ht_check_cck_shortpreamble(struct minstrel_priv *mp,
+                                    struct minstrel_ht_sta *mi, bool val)
+{
+        u8 supported = mi->groups[MINSTREL_CCK_GROUP].supported;
+
+        if (!supported || !mi->cck_supported_short)
+                return;
+
+        if (supported & (mi->cck_supported_short << (val * 4)))
+                return;
+
+        supported ^= mi->cck_supported_short | (mi->cck_supported_short << 4);
+        mi->groups[MINSTREL_CCK_GROUP].supported = supported;
+}
+
+static void
 minstrel_ht_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
                      struct ieee80211_tx_rate_control *txrc)
 {
@@ -614,6 +698,7 @@ minstrel_ht_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
                 return mac80211_minstrel.get_rate(priv, sta, &msp->legacy, txrc);
 
         info->flags |= mi->tx_flags;
+        minstrel_ht_check_cck_shortpreamble(mp, mi, txrc->short_preamble);
 
         /* Don't use EAPOL frames for sampling on non-mrr hw */
         if (mp->hw->max_rates == 1 &&
@@ -687,6 +772,30 @@ minstrel_ht_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
 }
 
 static void
+minstrel_ht_update_cck(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
+                       struct ieee80211_supported_band *sband,
+                       struct ieee80211_sta *sta)
+{
+        int i;
+
+        if (sband->band != IEEE80211_BAND_2GHZ)
+                return;
+
+        mi->cck_supported = 0;
+        mi->cck_supported_short = 0;
+        for (i = 0; i < 4; i++) {
+                if (!rate_supported(sta, sband->band, mp->cck_rates[i]))
+                        continue;
+
+                mi->cck_supported |= BIT(i);
+                if (sband->bitrates[i].flags & IEEE80211_RATE_SHORT_PREAMBLE)
+                        mi->cck_supported_short |= BIT(i);
+        }
+
+        mi->groups[MINSTREL_CCK_GROUP].supported = mi->cck_supported;
+}
+
+static void
 minstrel_ht_update_caps(void *priv, struct ieee80211_supported_band *sband,
                         struct ieee80211_sta *sta, void *priv_sta)
 {
@@ -699,14 +808,13 @@ minstrel_ht_update_caps(void *priv, struct ieee80211_supported_band *sband,
         int ack_dur;
         int stbc;
         int i;
-        unsigned int smps;
 
         /* fall back to the old minstrel for legacy stations */
         if (!sta->ht_cap.ht_supported)
                 goto use_legacy;
 
         BUILD_BUG_ON(ARRAY_SIZE(minstrel_mcs_groups) !=
-                MINSTREL_MAX_STREAMS * MINSTREL_STREAM_GROUPS);
+                MINSTREL_MAX_STREAMS * MINSTREL_STREAM_GROUPS + 1);
 
         msp->is_ht = true;
         memset(mi, 0, sizeof(*mi));
@@ -735,28 +843,29 @@ minstrel_ht_update_caps(void *priv, struct ieee80211_supported_band *sband,
         if (sta_cap & IEEE80211_HT_CAP_LDPC_CODING)
                 mi->tx_flags |= IEEE80211_TX_CTL_LDPC;
 
-        smps = (sta_cap & IEEE80211_HT_CAP_SM_PS) >>
-                IEEE80211_HT_CAP_SM_PS_SHIFT;
-
         for (i = 0; i < ARRAY_SIZE(mi->groups); i++) {
-                u16 req = 0;
-
                 mi->groups[i].supported = 0;
-                if (minstrel_mcs_groups[i].flags & IEEE80211_TX_RC_SHORT_GI) {
-                        if (minstrel_mcs_groups[i].flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
-                                req |= IEEE80211_HT_CAP_SGI_40;
-                        else
-                                req |= IEEE80211_HT_CAP_SGI_20;
+                if (i == MINSTREL_CCK_GROUP) {
+                        minstrel_ht_update_cck(mp, mi, sband, sta);
+                        continue;
                 }
 
-                if (minstrel_mcs_groups[i].flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
-                        req |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+                if (minstrel_mcs_groups[i].flags & IEEE80211_TX_RC_SHORT_GI) {
+                        if (minstrel_mcs_groups[i].flags & IEEE80211_TX_RC_40_MHZ_WIDTH) {
+                                if (!(sta_cap & IEEE80211_HT_CAP_SGI_40))
+                                        continue;
+                        } else {
+                                if (!(sta_cap & IEEE80211_HT_CAP_SGI_20))
+                                        continue;
+                        }
+                }
 
-                if ((sta_cap & req) != req)
+                if (minstrel_mcs_groups[i].flags & IEEE80211_TX_RC_40_MHZ_WIDTH &&
+                    sta->bandwidth < IEEE80211_STA_RX_BW_40)
                         continue;
 
                 /* Mark MCS > 7 as unsupported if STA is in static SMPS mode */
-                if (smps == WLAN_HT_CAP_SM_PS_STATIC &&
+                if (sta->smps_mode == IEEE80211_SMPS_STATIC &&
                     minstrel_mcs_groups[i].streams > 1)
                         continue;
 
diff --git a/net/mac80211/rc80211_minstrel_ht.h b/net/mac80211/rc80211_minstrel_ht.h
index 462d2b227ed5..302dbd52180d 100644
--- a/net/mac80211/rc80211_minstrel_ht.h
+++ b/net/mac80211/rc80211_minstrel_ht.h
@@ -107,8 +107,11 @@ struct minstrel_ht_sta {
         /* current MCS group to be sampled */
         u8 sample_group;
 
+        u8 cck_supported;
+        u8 cck_supported_short;
+
         /* MCS rate group info and statistics */
-        struct minstrel_mcs_group_data groups[MINSTREL_MAX_STREAMS * MINSTREL_STREAM_GROUPS];
+        struct minstrel_mcs_group_data groups[MINSTREL_MAX_STREAMS * MINSTREL_STREAM_GROUPS + 1];
 };
 
 struct minstrel_ht_sta_priv {
diff --git a/net/mac80211/rc80211_minstrel_ht_debugfs.c b/net/mac80211/rc80211_minstrel_ht_debugfs.c
index e788f76a1dfe..df44a5ad8270 100644
--- a/net/mac80211/rc80211_minstrel_ht_debugfs.c
+++ b/net/mac80211/rc80211_minstrel_ht_debugfs.c
@@ -15,13 +15,76 @@
 #include "rc80211_minstrel.h"
 #include "rc80211_minstrel_ht.h"
 
+static char *
+minstrel_ht_stats_dump(struct minstrel_ht_sta *mi, int i, char *p)
+{
+        unsigned int max_mcs = MINSTREL_MAX_STREAMS * MINSTREL_STREAM_GROUPS;
+        const struct mcs_group *mg;
+        unsigned int j, tp, prob, eprob;
+        char htmode = '2';
+        char gimode = 'L';
+
+        if (!mi->groups[i].supported)
+                return p;
+
+        mg = &minstrel_mcs_groups[i];
+        if (mg->flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
+                htmode = '4';
+        if (mg->flags & IEEE80211_TX_RC_SHORT_GI)
+                gimode = 'S';
+
+        for (j = 0; j < MCS_GROUP_RATES; j++) {
+                struct minstrel_rate_stats *mr = &mi->groups[i].rates[j];
+                static const int bitrates[4] = { 10, 20, 55, 110 };
+                int idx = i * MCS_GROUP_RATES + j;
+
+                if (!(mi->groups[i].supported & BIT(j)))
+                        continue;
+
+                if (i == max_mcs)
+                        p += sprintf(p, "CCK/%cP   ", j < 4 ? 'L' : 'S');
+                else
+                        p += sprintf(p, "HT%c0/%cGI ", htmode, gimode);
+
+                *(p++) = (idx == mi->max_tp_rate) ? 'T' : ' ';
+                *(p++) = (idx == mi->max_tp_rate2) ? 't' : ' ';
+                *(p++) = (idx == mi->max_prob_rate) ? 'P' : ' ';
+
+                if (i == max_mcs) {
+                        int r = bitrates[j % 4];
+                        p += sprintf(p, " %2u.%1uM", r / 10, r % 10);
+                } else {
+                        p += sprintf(p, " MCS%-2u", (mg->streams - 1) *
+                                         MCS_GROUP_RATES + j);
+                }
+
+                tp = mr->cur_tp / 10;
+                prob = MINSTREL_TRUNC(mr->cur_prob * 1000);
+                eprob = MINSTREL_TRUNC(mr->probability * 1000);
+
+                p += sprintf(p, "      %6u.%1u   %6u.%1u    %6u.%1u    "
+                                "%3u            %3u(%3u)  %8llu    %8llu\n",
+                                tp / 10, tp % 10,
+                                eprob / 10, eprob % 10,
+                                prob / 10, prob % 10,
+                                mr->retry_count,
+                                mr->last_success,
+                                mr->last_attempts,
+                                (unsigned long long)mr->succ_hist,
+                                (unsigned long long)mr->att_hist);
+        }
+
+        return p;
+}
+
 static int
 minstrel_ht_stats_open(struct inode *inode, struct file *file)
 {
         struct minstrel_ht_sta_priv *msp = inode->i_private;
         struct minstrel_ht_sta *mi = &msp->ht;
         struct minstrel_debugfs_info *ms;
-        unsigned int i, j, tp, prob, eprob;
+        unsigned int i;
+        unsigned int max_mcs = MINSTREL_MAX_STREAMS * MINSTREL_STREAM_GROUPS;
         char *p;
         int ret;
 
@@ -38,50 +101,13 @@ minstrel_ht_stats_open(struct inode *inode, struct file *file)
 
         file->private_data = ms;
         p = ms->buf;
-        p += sprintf(p, "type      rate     throughput  ewma prob   this prob  "
-                        "this succ/attempt   success    attempts\n");
-        for (i = 0; i < MINSTREL_MAX_STREAMS * MINSTREL_STREAM_GROUPS; i++) {
-                char htmode = '2';
-                char gimode = 'L';
-
-                if (!mi->groups[i].supported)
-                        continue;
-
-                if (minstrel_mcs_groups[i].flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
-                        htmode = '4';
-                if (minstrel_mcs_groups[i].flags & IEEE80211_TX_RC_SHORT_GI)
-                        gimode = 'S';
+        p += sprintf(p, "type         rate     throughput  ewma prob   this prob  "
+                        "retry   this succ/attempt   success    attempts\n");
 
-                for (j = 0; j < MCS_GROUP_RATES; j++) {
-                        struct minstrel_rate_stats *mr = &mi->groups[i].rates[j];
-                        int idx = i * MCS_GROUP_RATES + j;
+        p = minstrel_ht_stats_dump(mi, max_mcs, p);
+        for (i = 0; i < max_mcs; i++)
+                p = minstrel_ht_stats_dump(mi, i, p);
 
-                        if (!(mi->groups[i].supported & BIT(j)))
-                                continue;
-
-                        p += sprintf(p, "HT%c0/%cGI ", htmode, gimode);
-
-                        *(p++) = (idx == mi->max_tp_rate) ? 'T' : ' ';
-                        *(p++) = (idx == mi->max_tp_rate2) ? 't' : ' ';
-                        *(p++) = (idx == mi->max_prob_rate) ? 'P' : ' ';
-                        p += sprintf(p, "MCS%-2u", (minstrel_mcs_groups[i].streams - 1) *
-                                        MCS_GROUP_RATES + j);
-
-                        tp = mr->cur_tp / 10;
-                        prob = MINSTREL_TRUNC(mr->cur_prob * 1000);
-                        eprob = MINSTREL_TRUNC(mr->probability * 1000);
-
-                        p += sprintf(p, "  %6u.%1u   %6u.%1u   %6u.%1u        "
-                                        "%3u(%3u)   %8llu    %8llu\n",
-                                        tp / 10, tp % 10,
-                                        eprob / 10, eprob % 10,
-                                        prob / 10, prob % 10,
-                                        mr->last_success,
-                                        mr->last_attempts,
-                                        (unsigned long long)mr->succ_hist,
-                                        (unsigned long long)mr->att_hist);
-                }
-        }
         p += sprintf(p, "\nTotal packet count::    ideal %d      "
                         "lookaround %d\n",
                         max(0, (int) mi->total_packets - (int) mi->sample_packets),
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index a19089565c4b..3acb70b73e22 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -668,9 +668,9 @@ static inline u16 seq_sub(u16 sq1, u16 sq2)
 
 static void ieee80211_release_reorder_frame(struct ieee80211_sub_if_data *sdata,
                                             struct tid_ampdu_rx *tid_agg_rx,
-                                            int index)
+                                            int index,
+                                            struct sk_buff_head *frames)
 {
-        struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb = tid_agg_rx->reorder_buf[index];
         struct ieee80211_rx_status *status;
 
@@ -684,7 +684,7 @@ static void ieee80211_release_reorder_frame(struct ieee80211_sub_if_data *sdata,
         tid_agg_rx->reorder_buf[index] = NULL;
         status = IEEE80211_SKB_RXCB(skb);
         status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE;
-        skb_queue_tail(&local->rx_skb_queue, skb);
+        __skb_queue_tail(frames, skb);
 
 no_frame:
         tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
@@ -692,7 +692,8 @@ no_frame:
 
 static void ieee80211_release_reorder_frames(struct ieee80211_sub_if_data *sdata,
                                              struct tid_ampdu_rx *tid_agg_rx,
-                                             u16 head_seq_num)
+                                             u16 head_seq_num,
+                                             struct sk_buff_head *frames)
 {
         int index;
 
@@ -701,7 +702,8 @@ static void ieee80211_release_reorder_frames(struct ieee80211_sub_if_data *sdata
         while (seq_less(tid_agg_rx->head_seq_num, head_seq_num)) {
                 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
                                                         tid_agg_rx->buf_size;
-                ieee80211_release_reorder_frame(sdata, tid_agg_rx, index);
+                ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
+                                                frames);
         }
 }
 
@@ -717,7 +719,8 @@ static void ieee80211_release_reorder_frames(struct ieee80211_sub_if_data *sdata
 #define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)
 
 static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata,
-                                          struct tid_ampdu_rx *tid_agg_rx)
+                                          struct tid_ampdu_rx *tid_agg_rx,
+                                          struct sk_buff_head *frames)
 {
         int index, j;
 
@@ -746,7 +749,8 @@ static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata,
 
                         ht_dbg_ratelimited(sdata,
                                            "release an RX reorder frame due to timeout on earlier frames\n");
-                        ieee80211_release_reorder_frame(sdata, tid_agg_rx, j);
+                        ieee80211_release_reorder_frame(sdata, tid_agg_rx, j,
+                                                        frames);
 
                         /*
                          * Increment the head seq# also for the skipped slots.
@@ -756,7 +760,8 @@ static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata,
                         skipped = 0;
                 }
         } else while (tid_agg_rx->reorder_buf[index]) {
-                ieee80211_release_reorder_frame(sdata, tid_agg_rx, index);
+                ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
+                                                frames);
                 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
                                                         tid_agg_rx->buf_size;
         }
@@ -788,7 +793,8 @@ static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata,
  */
 static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata,
                                              struct tid_ampdu_rx *tid_agg_rx,
-                                             struct sk_buff *skb)
+                                             struct sk_buff *skb,
+                                             struct sk_buff_head *frames)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
         u16 sc = le16_to_cpu(hdr->seq_ctrl);
@@ -816,7 +822,7 @@ static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata
                 head_seq_num = seq_inc(seq_sub(mpdu_seq_num, buf_size));
                 /* release stored frames up to new head to stack */
                 ieee80211_release_reorder_frames(sdata, tid_agg_rx,
-                                                 head_seq_num);
+                                                 head_seq_num, frames);
         }
 
         /* Now the new frame is always in the range of the reordering buffer */
@@ -846,7 +852,7 @@ static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata
         tid_agg_rx->reorder_buf[index] = skb;
         tid_agg_rx->reorder_time[index] = jiffies;
         tid_agg_rx->stored_mpdu_num++;
-        ieee80211_sta_reorder_release(sdata, tid_agg_rx);
+        ieee80211_sta_reorder_release(sdata, tid_agg_rx, frames);
 
  out:
         spin_unlock(&tid_agg_rx->reorder_lock);
@@ -857,7 +863,8 @@ static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata
  * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns
  * true if the MPDU was buffered, false if it should be processed.
  */
-static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx)
+static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx,
+                                       struct sk_buff_head *frames)
 {
         struct sk_buff *skb = rx->skb;
         struct ieee80211_local *local = rx->local;
@@ -922,11 +929,12 @@ static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx)
          * sure that we cannot get to it any more before doing
          * anything with it.
          */
-        if (ieee80211_sta_manage_reorder_buf(rx->sdata, tid_agg_rx, skb))
+        if (ieee80211_sta_manage_reorder_buf(rx->sdata, tid_agg_rx, skb,
+                                             frames))
                 return;
 
  dont_reorder:
-        skb_queue_tail(&local->rx_skb_queue, skb);
+        __skb_queue_tail(frames, skb);
 }
 
 static ieee80211_rx_result debug_noinline
@@ -1452,6 +1460,10 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
                 }
         }
 
+        /* mesh power save support */
+        if (ieee80211_vif_is_mesh(&rx->sdata->vif))
+                ieee80211_mps_rx_h_sta_process(sta, hdr);
+
         /*
          * Drop (qos-)data::nullfunc frames silently, since they
          * are used only to control station power saving mode.
@@ -2090,7 +2102,10 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
         if (is_multicast_ether_addr(fwd_hdr->addr1)) {
                 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast);
                 memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
+                /* update power mode indication when forwarding */
+                ieee80211_mps_set_frame_flags(sdata, NULL, fwd_hdr);
         } else if (!mesh_nexthop_lookup(fwd_skb, sdata)) {
+                /* mesh power mode flags updated in mesh_nexthop_lookup */
                 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
         } else {
                 /* unable to resolve next hop */
@@ -2177,7 +2192,7 @@ ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
 }
 
 static ieee80211_rx_result debug_noinline
-ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
+ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames)
 {
         struct sk_buff *skb = rx->skb;
         struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
@@ -2216,7 +2231,7 @@ ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
                 spin_lock(&tid_agg_rx->reorder_lock);
                 /* release stored frames up to start of BAR */
                 ieee80211_release_reorder_frames(rx->sdata, tid_agg_rx,
-                                                 start_seq_num);
+                                                 start_seq_num, frames);
                 spin_unlock(&tid_agg_rx->reorder_lock);
 
                 kfree_skb(skb);
@@ -2360,31 +2375,27 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                 switch (mgmt->u.action.u.ht_smps.action) {
                 case WLAN_HT_ACTION_SMPS: {
                         struct ieee80211_supported_band *sband;
-                        u8 smps;
+                        enum ieee80211_smps_mode smps_mode;
 
                         /* convert to HT capability */
                         switch (mgmt->u.action.u.ht_smps.smps_control) {
                         case WLAN_HT_SMPS_CONTROL_DISABLED:
-                                smps = WLAN_HT_CAP_SM_PS_DISABLED;
+                                smps_mode = IEEE80211_SMPS_OFF;
                                 break;
                         case WLAN_HT_SMPS_CONTROL_STATIC:
-                                smps = WLAN_HT_CAP_SM_PS_STATIC;
+                                smps_mode = IEEE80211_SMPS_STATIC;
                                 break;
                         case WLAN_HT_SMPS_CONTROL_DYNAMIC:
-                                smps = WLAN_HT_CAP_SM_PS_DYNAMIC;
+                                smps_mode = IEEE80211_SMPS_DYNAMIC;
                                 break;
                         default:
                                 goto invalid;
                         }
-                        smps <<= IEEE80211_HT_CAP_SM_PS_SHIFT;
 
                         /* if no change do nothing */
-                        if ((rx->sta->sta.ht_cap.cap &
-                                        IEEE80211_HT_CAP_SM_PS) == smps)
+                        if (rx->sta->sta.smps_mode == smps_mode)
                                 goto handled;
-
-                        rx->sta->sta.ht_cap.cap &= ~IEEE80211_HT_CAP_SM_PS;
-                        rx->sta->sta.ht_cap.cap |= smps;
+                        rx->sta->sta.smps_mode = smps_mode;
 
                         sband = rx->local->hw.wiphy->bands[status->band];
 
@@ -2395,26 +2406,21 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                 case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: {
                         struct ieee80211_supported_band *sband;
                         u8 chanwidth = mgmt->u.action.u.ht_notify_cw.chanwidth;
-                        bool old_40mhz, new_40mhz;
+                        enum ieee80211_sta_rx_bandwidth new_bw;
 
                         /* If it doesn't support 40 MHz it can't change ... */
-                        if (!rx->sta->supports_40mhz)
+                        if (!(rx->sta->sta.ht_cap.cap &
+                                        IEEE80211_HT_CAP_SUP_WIDTH_20_40))
                                 goto handled;
 
-                        old_40mhz = rx->sta->sta.ht_cap.cap &
-                                        IEEE80211_HT_CAP_SUP_WIDTH_20_40;
-                        new_40mhz = chanwidth == IEEE80211_HT_CHANWIDTH_ANY;
+                        if (chanwidth == IEEE80211_HT_CHANWIDTH_20MHZ)
+                                new_bw = IEEE80211_STA_RX_BW_20;
+                        else
+                                new_bw = ieee80211_sta_cur_vht_bw(rx->sta);
 
-                        if (old_40mhz == new_40mhz)
+                        if (rx->sta->sta.bandwidth == new_bw)
                                 goto handled;
 
-                        if (new_40mhz)
-                                rx->sta->sta.ht_cap.cap |=
-                                        IEEE80211_HT_CAP_SUP_WIDTH_20_40;
-                        else
-                                rx->sta->sta.ht_cap.cap &=
-                                        ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
-
                         sband = rx->local->hw.wiphy->bands[status->band];
 
                         rate_control_rate_update(local, sband, rx->sta,
@@ -2426,6 +2432,37 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                 }
 
                 break;
+        case WLAN_CATEGORY_VHT:
+                if (sdata->vif.type != NL80211_IFTYPE_STATION &&
+                    sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
+                    sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
+                    sdata->vif.type != NL80211_IFTYPE_AP &&
+                    sdata->vif.type != NL80211_IFTYPE_ADHOC)
+                        break;
+
+                /* verify action code is present */
+                if (len < IEEE80211_MIN_ACTION_SIZE + 1)
+                        goto invalid;
+
+                switch (mgmt->u.action.u.vht_opmode_notif.action_code) {
+                case WLAN_VHT_ACTION_OPMODE_NOTIF: {
+                        u8 opmode;
+
+                        /* verify opmode is present */
+                        if (len < IEEE80211_MIN_ACTION_SIZE + 2)
+                                goto invalid;
+
+                        opmode = mgmt->u.action.u.vht_opmode_notif.operating_mode;
+
+                        ieee80211_vht_handle_opmode(rx->sdata, rx->sta,
+                                                    opmode, status->band,
+                                                    false);
+                        goto handled;
+                }
+                default:
+                        break;
+                }
+                break;
         case WLAN_CATEGORY_BACK:
                 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
                     sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
@@ -2677,8 +2714,9 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
                         return RX_DROP_MONITOR;
                 break;
         case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ):
-                /* process only for ibss */
-                if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
+                /* process only for ibss and mesh */
+                if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
+                    sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
                         return RX_DROP_MONITOR;
                 break;
         default:
@@ -2801,7 +2839,8 @@ static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx,
         }
 }
 
-static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx)
+static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx,
+                                  struct sk_buff_head *frames)
 {
         ieee80211_rx_result res = RX_DROP_MONITOR;
         struct sk_buff *skb;
@@ -2813,15 +2852,9 @@ static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx)
                         goto rxh_next;  \
         } while (0);
 
-        spin_lock(&rx->local->rx_skb_queue.lock);
-        if (rx->local->running_rx_handler)
-                goto unlock;
-
-        rx->local->running_rx_handler = true;
-
-        while ((skb = __skb_dequeue(&rx->local->rx_skb_queue))) {
-                spin_unlock(&rx->local->rx_skb_queue.lock);
+        spin_lock_bh(&rx->local->rx_path_lock);
 
+        while ((skb = __skb_dequeue(frames))) {
                 /*
                  * all the other fields are valid across frames
                  * that belong to an aMPDU since they are on the
@@ -2842,7 +2875,12 @@ static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx)
 #endif
                 CALL_RXH(ieee80211_rx_h_amsdu)
                 CALL_RXH(ieee80211_rx_h_data)
-                CALL_RXH(ieee80211_rx_h_ctrl);
+
+                /* special treatment -- needs the queue */
+                res = ieee80211_rx_h_ctrl(rx, frames);
+                if (res != RX_CONTINUE)
+                        goto rxh_next;
+
                 CALL_RXH(ieee80211_rx_h_mgmt_check)
                 CALL_RXH(ieee80211_rx_h_action)
                 CALL_RXH(ieee80211_rx_h_userspace_mgmt)
@@ -2851,20 +2889,20 @@ static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx)
 
  rxh_next:
                 ieee80211_rx_handlers_result(rx, res);
-                spin_lock(&rx->local->rx_skb_queue.lock);
+
 #undef CALL_RXH
         }
 
-        rx->local->running_rx_handler = false;
-
- unlock:
-        spin_unlock(&rx->local->rx_skb_queue.lock);
+        spin_unlock_bh(&rx->local->rx_path_lock);
 }
 
 static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
 {
+        struct sk_buff_head reorder_release;
         ieee80211_rx_result res = RX_DROP_MONITOR;
 
+        __skb_queue_head_init(&reorder_release);
+
 #define CALL_RXH(rxh)                   \
         do {                            \
                 res = rxh(rx);          \
@@ -2874,9 +2912,9 @@ static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
 
         CALL_RXH(ieee80211_rx_h_check)
 
-        ieee80211_rx_reorder_ampdu(rx);
+        ieee80211_rx_reorder_ampdu(rx, &reorder_release);
 
-        ieee80211_rx_handlers(rx);
+        ieee80211_rx_handlers(rx, &reorder_release);
         return;
 
  rxh_next:
@@ -2891,6 +2929,7 @@ static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
  */
 void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
 {
+        struct sk_buff_head frames;
         struct ieee80211_rx_data rx = {
                 .sta = sta,
                 .sdata = sta->sdata,
@@ -2906,11 +2945,13 @@ void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
         if (!tid_agg_rx)
                 return;
 
+        __skb_queue_head_init(&frames);
+
         spin_lock(&tid_agg_rx->reorder_lock);
-        ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx);
+        ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames);
         spin_unlock(&tid_agg_rx->reorder_lock);
 
-        ieee80211_rx_handlers(&rx);
+        ieee80211_rx_handlers(&rx, &frames);
 }
 
 /* main receive path */
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 607684c47d55..43a45cf00e06 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -27,22 +27,15 @@
 
 #define IEEE80211_PROBE_DELAY (HZ / 33)
 #define IEEE80211_CHANNEL_TIME (HZ / 33)
-#define IEEE80211_PASSIVE_CHANNEL_TIME (HZ / 8)
-
-static void ieee80211_rx_bss_free(struct cfg80211_bss *cbss)
-{
-        struct ieee80211_bss *bss = (void *)cbss->priv;
-
-        kfree(bss_mesh_id(bss));
-        kfree(bss_mesh_cfg(bss));
-}
+#define IEEE80211_PASSIVE_CHANNEL_TIME (HZ / 9)
 
 void ieee80211_rx_bss_put(struct ieee80211_local *local,
                           struct ieee80211_bss *bss)
 {
         if (!bss)
                 return;
-        cfg80211_put_bss(container_of((void *)bss, struct cfg80211_bss, priv));
+        cfg80211_put_bss(local->hw.wiphy,
+                         container_of((void *)bss, struct cfg80211_bss, priv));
 }
 
 static bool is_uapsd_supported(struct ieee802_11_elems *elems)
@@ -85,10 +78,12 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
         if (!cbss)
                 return NULL;
 
-        cbss->free_priv = ieee80211_rx_bss_free;
         bss = (void *)cbss->priv;
 
-        bss->device_ts = rx_status->device_timestamp;
+        if (beacon)
+                bss->device_ts_beacon = rx_status->device_timestamp;
+        else
+                bss->device_ts_presp = rx_status->device_timestamp;
 
         if (elems->parse_error) {
                 if (beacon)
@@ -146,9 +141,6 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
                         bss->valid_data |= IEEE80211_BSS_VALID_WMM;
         }
 
-        if (!beacon)
-                bss->last_probe_resp = jiffies;
-
         return bss;
 }
 
@@ -342,6 +334,9 @@ static int ieee80211_start_sw_scan(struct ieee80211_local *local)
 
         ieee80211_offchannel_stop_vifs(local);
 
+        /* ensure nullfunc is transmitted before leaving operating channel */
+        drv_flush(local, false);
+
         ieee80211_configure_filter(local);
 
         /* We need to set power level at maximum rate for scanning. */
@@ -356,6 +351,9 @@ static int ieee80211_start_sw_scan(struct ieee80211_local *local)
 static bool ieee80211_can_scan(struct ieee80211_local *local,
                                struct ieee80211_sub_if_data *sdata)
 {
+        if (local->radar_detect_enabled)
+                return false;
+
         if (!list_empty(&local->roc_list))
                 return false;
 
@@ -390,6 +388,11 @@ static void ieee80211_scan_state_send_probe(struct ieee80211_local *local,
         int i;
         struct ieee80211_sub_if_data *sdata;
         enum ieee80211_band band = local->hw.conf.channel->band;
+        u32 tx_flags;
+
+        tx_flags = IEEE80211_TX_INTFL_OFFCHAN_TX_OK;
+        if (local->scan_req->no_cck)
+                tx_flags |= IEEE80211_TX_CTL_NO_CCK_RATE;
 
         sdata = rcu_dereference_protected(local->scan_sdata,
                                           lockdep_is_held(&local->mtx));
@@ -401,8 +404,7 @@ static void ieee80211_scan_state_send_probe(struct ieee80211_local *local,
                         local->scan_req->ssids[i].ssid_len,
                         local->scan_req->ie, local->scan_req->ie_len,
                         local->scan_req->rates[band], false,
-                        local->scan_req->no_cck,
-                        local->hw.conf.channel, true);
+                        tx_flags, local->hw.conf.channel, true);
 
         /*
          * After sending probe requests, wait for probe responses
@@ -546,8 +548,6 @@ static void ieee80211_scan_state_decision(struct ieee80211_local *local,
         bool associated = false;
         bool tx_empty = true;
         bool bad_latency;
-        bool listen_int_exceeded;
-        unsigned long min_beacon_int = 0;
         struct ieee80211_sub_if_data *sdata;
         struct ieee80211_channel *next_chan;
         enum mac80211_scan_state next_scan_state;
@@ -566,11 +566,6 @@ static void ieee80211_scan_state_decision(struct ieee80211_local *local,
                         if (sdata->u.mgd.associated) {
                                 associated = true;
 
-                                if (sdata->vif.bss_conf.beacon_int <
-                                    min_beacon_int || min_beacon_int == 0)
-                                        min_beacon_int =
-                                                sdata->vif.bss_conf.beacon_int;
-
                                 if (!qdisc_all_tx_empty(sdata->dev)) {
                                         tx_empty = false;
                                         break;
@@ -587,34 +582,19 @@ static void ieee80211_scan_state_decision(struct ieee80211_local *local,
          * see if we can scan another channel without interfering
          * with the current traffic situation.
          *
-         * Since we don't know if the AP has pending frames for us
-         * we can only check for our tx queues and use the current
-         * pm_qos requirements for rx. Hence, if no tx traffic occurs
-         * at all we will scan as many channels in a row as the pm_qos
-         * latency allows us to. Additionally we also check for the
-         * currently negotiated listen interval to prevent losing
-         * frames unnecessarily.
-         *
-         * Otherwise switch back to the operating channel.
+         * Keep good latency, do not stay off-channel more than 125 ms.
          */
 
         bad_latency = time_after(jiffies +
-                        ieee80211_scan_get_channel_time(next_chan),
-                        local->leave_oper_channel_time +
-                        usecs_to_jiffies(pm_qos_request(PM_QOS_NETWORK_LATENCY)));
-
-        listen_int_exceeded = time_after(jiffies +
-                        ieee80211_scan_get_channel_time(next_chan),
-                        local->leave_oper_channel_time +
-                        usecs_to_jiffies(min_beacon_int * 1024) *
-                        local->hw.conf.listen_interval);
+                                 ieee80211_scan_get_channel_time(next_chan),
+                                 local->leave_oper_channel_time + HZ / 8);
 
         if (associated && !tx_empty) {
                 if (local->scan_req->flags & NL80211_SCAN_FLAG_LOW_PRIORITY)
                         next_scan_state = SCAN_ABORT;
                 else
                         next_scan_state = SCAN_SUSPEND;
-        } else if (associated && (bad_latency || listen_int_exceeded)) {
+        } else if (associated && bad_latency) {
                 next_scan_state = SCAN_SUSPEND;
         } else {
                 next_scan_state = SCAN_SET_CHANNEL;
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 227233c3ff7f..a79ce820cb50 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -120,6 +120,8 @@ static void cleanup_single_sta(struct sta_info *sta)
                 if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
                     sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
                         ps = &sdata->bss->ps;
+                else if (ieee80211_vif_is_mesh(&sdata->vif))
+                        ps = &sdata->u.mesh.ps;
                 else
                         return;
 
@@ -135,13 +137,8 @@ static void cleanup_single_sta(struct sta_info *sta)
                 ieee80211_purge_tx_queue(&local->hw, &sta->tx_filtered[ac]);
         }
 
-#ifdef CONFIG_MAC80211_MESH
-        if (ieee80211_vif_is_mesh(&sdata->vif)) {
-                mesh_accept_plinks_update(sdata);
-                mesh_plink_deactivate(sta);
-                del_timer_sync(&sta->plink_timer);
-        }
-#endif
+        if (ieee80211_vif_is_mesh(&sdata->vif))
+                mesh_sta_cleanup(sta);
 
         cancel_work_sync(&sta->drv_unblock_wk);
 
@@ -378,6 +375,8 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
         for (i = 0; i < IEEE80211_NUM_TIDS; i++)
                 sta->last_seq_ctrl[i] = cpu_to_le16(USHRT_MAX);
 
+        sta->sta.smps_mode = IEEE80211_SMPS_OFF;
+
         sta_dbg(sdata, "Allocated STA %pM\n", sta->sta.addr);
 
         return sta;
@@ -574,7 +573,6 @@ void sta_info_recalc_tim(struct sta_info *sta)
 {
         struct ieee80211_local *local = sta->local;
         struct ps_data *ps;
-        unsigned long flags;
         bool indicate_tim = false;
         u8 ignore_for_tim = sta->sta.uapsd_queues;
         int ac;
@@ -587,6 +585,12 @@ void sta_info_recalc_tim(struct sta_info *sta)
 
                 ps = &sta->sdata->bss->ps;
                 id = sta->sta.aid;
+#ifdef CONFIG_MAC80211_MESH
+        } else if (ieee80211_vif_is_mesh(&sta->sdata->vif)) {
+                ps = &sta->sdata->u.mesh.ps;
+                /* TIM map only for PLID <= IEEE80211_MAX_AID */
+                id = le16_to_cpu(sta->plid) % IEEE80211_MAX_AID;
+#endif
         } else {
                 return;
         }
@@ -625,7 +629,7 @@ void sta_info_recalc_tim(struct sta_info *sta)
         }
 
  done:
-        spin_lock_irqsave(&local->tim_lock, flags);
+        spin_lock_bh(&local->tim_lock);
 
         if (indicate_tim)
                 __bss_tim_set(ps->tim, id);
@@ -638,7 +642,7 @@ void sta_info_recalc_tim(struct sta_info *sta)
                 local->tim_in_locked_section = false;
         }
 
-        spin_unlock_irqrestore(&local->tim_lock, flags);
+        spin_unlock_bh(&local->tim_lock);
 }
 
 static bool sta_info_buffer_expired(struct sta_info *sta, struct sk_buff *skb)
@@ -745,8 +749,9 @@ static bool sta_info_cleanup_expire_buffered(struct ieee80211_local *local,
         bool have_buffered = false;
         int ac;
 
-        /* This is only necessary for stations on BSS interfaces */
-        if (!sta->sdata->bss)
+        /* This is only necessary for stations on BSS/MBSS interfaces */
+        if (!sta->sdata->bss &&
+            !ieee80211_vif_is_mesh(&sta->sdata->vif))
                 return false;
 
         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
@@ -934,6 +939,11 @@ void ieee80211_sta_expire(struct ieee80211_sub_if_data *sdata,
                 if (time_after(jiffies, sta->last_rx + exp_time)) {
                         sta_dbg(sta->sdata, "expiring inactive STA %pM\n",
                                 sta->sta.addr);
+
+                        if (ieee80211_vif_is_mesh(&sdata->vif) &&
+                            test_sta_flag(sta, WLAN_STA_PS_STA))
+                                atomic_dec(&sdata->u.mesh.ps.num_sta_ps);
+
                         WARN_ON(__sta_info_destroy(sta));
                 }
         }
@@ -992,6 +1002,8 @@ static void clear_sta_ps_flags(void *_sta)
         if (sdata->vif.type == NL80211_IFTYPE_AP ||
             sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
                 ps = &sdata->bss->ps;
+        else if (ieee80211_vif_is_mesh(&sdata->vif))
+                ps = &sdata->u.mesh.ps;
         else
                 return;
 
@@ -1109,6 +1121,8 @@ static void ieee80211_send_null_response(struct ieee80211_sub_if_data *sdata,
 
         drv_allow_buffered_frames(local, sta, BIT(tid), 1, reason, false);
 
+        skb->dev = sdata->dev;
+
         rcu_read_lock();
         chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
         if (WARN_ON(!chanctx_conf)) {
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index af7d78aa5523..63dfdb5e91da 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -56,6 +56,8 @@
  * @WLAN_STA_INSERTED: This station is inserted into the hash table.
  * @WLAN_STA_RATE_CONTROL: rate control was initialized for this station.
  * @WLAN_STA_TOFFSET_KNOWN: toffset calculated for this station is valid.
+ * @WLAN_STA_MPSP_OWNER: local STA is owner of a mesh Peer Service Period.
+ * @WLAN_STA_MPSP_RECIPIENT: local STA is recipient of a MPSP.
  */
 enum ieee80211_sta_info_flags {
         WLAN_STA_AUTH,
@@ -78,6 +80,8 @@ enum ieee80211_sta_info_flags {
         WLAN_STA_INSERTED,
         WLAN_STA_RATE_CONTROL,
         WLAN_STA_TOFFSET_KNOWN,
+        WLAN_STA_MPSP_OWNER,
+        WLAN_STA_MPSP_RECIPIENT,
 };
 
 #define ADDBA_RESP_INTERVAL HZ
@@ -282,6 +286,9 @@ struct sta_ampdu_mlme {
  * @t_offset_setpoint: reference timing offset of this sta to be used when
  *      calculating clockdrift
  * @ch_width: peer's channel width
+ * @local_pm: local link-specific power save mode
+ * @peer_pm: peer-specific power save mode towards local STA
+ * @nonpeer_pm: STA power save mode towards non-peer neighbors
  * @debugfs: debug filesystem info
  * @dead: set to true when sta is unlinked
  * @uploaded: set to true when sta is uploaded to the driver
@@ -289,8 +296,9 @@ struct sta_ampdu_mlme {
  * @sta: station information we share with the driver
  * @sta_state: duplicates information about station state (for debug)
  * @beacon_loss_count: number of times beacon loss has triggered
- * @supports_40mhz: tracks whether the station advertised 40 MHz support
- *      as we overwrite its HT parameters with the currently used value
+ * @rcu_head: RCU head used for freeing this station struct
+ * @cur_max_bandwidth: maximum bandwidth to use for TX to the station,
+ *      taken from HT/VHT capabilities or VHT operating mode notification
  */
 struct sta_info {
         /* General information, mostly static */
@@ -379,6 +387,10 @@ struct sta_info {
         s64 t_offset;
         s64 t_offset_setpoint;
         enum nl80211_chan_width ch_width;
+        /* mesh power save */
+        enum nl80211_mesh_power_mode local_pm;
+        enum nl80211_mesh_power_mode peer_pm;
+        enum nl80211_mesh_power_mode nonpeer_pm;
 #endif
 
 #ifdef CONFIG_MAC80211_DEBUGFS
@@ -388,11 +400,11 @@ struct sta_info {
         } debugfs;
 #endif
 
+        enum ieee80211_sta_rx_bandwidth cur_max_bandwidth;
+
         unsigned int lost_packets;
         unsigned int beacon_loss_count;
 
-        bool supports_40mhz;
-
         /* keep last! */
         struct ieee80211_sta sta;
 };
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 07d99578a2b1..43439203f4e4 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -335,7 +335,8 @@ static void ieee80211_report_used_skb(struct ieee80211_local *local,
         if (dropped)
                 acked = false;
 
-        if (info->flags & IEEE80211_TX_INTFL_NL80211_FRAME_TX) {
+        if (info->flags & (IEEE80211_TX_INTFL_NL80211_FRAME_TX |
+                           IEEE80211_TX_INTFL_MLME_CONN_TX)) {
                 struct ieee80211_sub_if_data *sdata = NULL;
                 struct ieee80211_sub_if_data *iter_sdata;
                 u64 cookie = (unsigned long)skb;
@@ -357,10 +358,13 @@ static void ieee80211_report_used_skb(struct ieee80211_local *local,
                         sdata = rcu_dereference(local->p2p_sdata);
                 }
 
-                if (!sdata)
+                if (!sdata) {
                         skb->dev = NULL;
-                else if (ieee80211_is_nullfunc(hdr->frame_control) ||
-                         ieee80211_is_qos_nullfunc(hdr->frame_control)) {
+                } else if (info->flags & IEEE80211_TX_INTFL_MLME_CONN_TX) {
+                        ieee80211_mgd_conn_tx_status(sdata, hdr->frame_control,
+                                                     acked);
+                } else if (ieee80211_is_nullfunc(hdr->frame_control) ||
+                           ieee80211_is_qos_nullfunc(hdr->frame_control)) {
                         cfg80211_probe_status(sdata->dev, hdr->addr1,
                                               cookie, acked, GFP_ATOMIC);
                 } else {
@@ -468,6 +472,13 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                         return;
                 }
 
+                /* mesh Peer Service Period support */
+                if (ieee80211_vif_is_mesh(&sta->sdata->vif) &&
+                    ieee80211_is_data_qos(fc))
+                        ieee80211_mpsp_trigger_process(
+                                        ieee80211_get_qos_ctl(hdr),
+                                        sta, true, acked);
+
                 if ((local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL) &&
                     (rates_idx != -1))
                         sta->last_tx_rate = info->status.rates[rates_idx];
@@ -502,11 +513,7 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                                        IEEE80211_BAR_CTRL_TID_INFO_MASK) >>
                                       IEEE80211_BAR_CTRL_TID_INFO_SHIFT;
 
-                                if (local->hw.flags &
-                                    IEEE80211_HW_TEARDOWN_AGGR_ON_BAR_FAIL)
-                                        ieee80211_stop_tx_ba_session(&sta->sta, tid);
-                                else
-                                        ieee80211_set_bar_pending(sta, tid, ssn);
+                                ieee80211_set_bar_pending(sta, tid, ssn);
                         }
                 }
 
diff --git a/net/mac80211/tkip.c b/net/mac80211/tkip.c
index 57e14d59e12f..3ed801d90f1e 100644
--- a/net/mac80211/tkip.c
+++ b/net/mac80211/tkip.c
@@ -177,12 +177,11 @@ void ieee80211_get_tkip_p1k_iv(struct ieee80211_key_conf *keyconf,
         struct ieee80211_key *key = (struct ieee80211_key *)
                         container_of(keyconf, struct ieee80211_key, conf);
         struct tkip_ctx *ctx = &key->u.tkip.tx;
-        unsigned long flags;
 
-        spin_lock_irqsave(&key->u.tkip.txlock, flags);
+        spin_lock_bh(&key->u.tkip.txlock);
         ieee80211_compute_tkip_p1k(key, iv32);
         memcpy(p1k, ctx->p1k, sizeof(ctx->p1k));
-        spin_unlock_irqrestore(&key->u.tkip.txlock, flags);
+        spin_unlock_bh(&key->u.tkip.txlock);
 }
 EXPORT_SYMBOL(ieee80211_get_tkip_p1k_iv);
 
@@ -208,12 +207,11 @@ void ieee80211_get_tkip_p2k(struct ieee80211_key_conf *keyconf,
         const u8 *data = (u8 *)hdr + ieee80211_hdrlen(hdr->frame_control);
         u32 iv32 = get_unaligned_le32(&data[4]);
         u16 iv16 = data[2] | (data[0] << 8);
-        unsigned long flags;
 
-        spin_lock_irqsave(&key->u.tkip.txlock, flags);
+        spin_lock_bh(&key->u.tkip.txlock);
         ieee80211_compute_tkip_p1k(key, iv32);
         tkip_mixing_phase2(tk, ctx, iv16, p2k);
-        spin_unlock_irqrestore(&key->u.tkip.txlock, flags);
+        spin_unlock_bh(&key->u.tkip.txlock);
 }
 EXPORT_SYMBOL(ieee80211_get_tkip_p2k);
 
diff --git a/net/mac80211/trace.h b/net/mac80211/trace.h
index 6ca53d64cb28..1183c4a4fee5 100644
--- a/net/mac80211/trace.h
+++ b/net/mac80211/trace.h
@@ -36,7 +36,7 @@
                         __entry->control_freq = (c)->chan->center_freq;         \
                         __entry->chan_width = (c)->width;                       \
                         __entry->center_freq1 = (c)->center_freq1;              \
-                        __entry->center_freq1 = (c)->center_freq2;
+                        __entry->center_freq2 = (c)->center_freq2;
 #define CHANDEF_PR_FMT  " control:%d MHz width:%d center: %d/%d MHz"
 #define CHANDEF_PR_ARG  __entry->control_freq, __entry->chan_width,             \
                         __entry->center_freq1, __entry->center_freq2
@@ -340,6 +340,7 @@ TRACE_EVENT(drv_bss_info_changed,
                 __field(u16, assoc_cap)
                 __field(u64, sync_tsf)
                 __field(u32, sync_device_ts)
+                __field(u8, sync_dtim_count)
                 __field(u32, basic_rates)
                 __array(int, mcast_rate, IEEE80211_NUM_BANDS)
                 __field(u16, ht_operation_mode)
@@ -379,6 +380,7 @@ TRACE_EVENT(drv_bss_info_changed,
                 __entry->assoc_cap = info->assoc_capability;
                 __entry->sync_tsf = info->sync_tsf;
                 __entry->sync_device_ts = info->sync_device_ts;
+                __entry->sync_dtim_count = info->sync_dtim_count;
                 __entry->basic_rates = info->basic_rates;
                 memcpy(__entry->mcast_rate, info->mcast_rate,
                        sizeof(__entry->mcast_rate));
@@ -1860,6 +1862,25 @@ TRACE_EVENT(drv_set_default_unicast_key,
                   LOCAL_PR_ARG, VIF_PR_ARG, __entry->key_idx)
 );
 
+TRACE_EVENT(api_radar_detected,
+        TP_PROTO(struct ieee80211_local *local),
+
+        TP_ARGS(local),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT " radar detected",
+                LOCAL_PR_ARG
+        )
+);
+
 #ifdef CONFIG_MAC80211_MESSAGE_TRACING
 #undef TRACE_SYSTEM
 #define TRACE_SYSTEM mac80211_msg
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index a2cb6a302cc7..fe644f91ae05 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -329,6 +329,8 @@ static void purge_old_ps_buffers(struct ieee80211_local *local)
 
                 if (sdata->vif.type == NL80211_IFTYPE_AP)
                         ps = &sdata->u.ap.ps;
+                else if (ieee80211_vif_is_mesh(&sdata->vif))
+                        ps = &sdata->u.mesh.ps;
                 else
                         continue;
 
@@ -372,18 +374,20 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
         /*
          * broadcast/multicast frame
          *
-         * If any of the associated stations is in power save mode,
+         * If any of the associated/peer stations is in power save mode,
          * the frame is buffered to be sent after DTIM beacon frame.
          * This is done either by the hardware or us.
          */
 
-        /* powersaving STAs currently only in AP/VLAN mode */
+        /* powersaving STAs currently only in AP/VLAN/mesh mode */
         if (tx->sdata->vif.type == NL80211_IFTYPE_AP ||
             tx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
                 if (!tx->sdata->bss)
                         return TX_CONTINUE;
 
                 ps = &tx->sdata->bss->ps;
+        } else if (ieee80211_vif_is_mesh(&tx->sdata->vif)) {
+                ps = &tx->sdata->u.mesh.ps;
         } else {
                 return TX_CONTINUE;
         }
@@ -594,7 +598,8 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
                         break;
                 }
 
-                if (unlikely(tx->key && tx->key->flags & KEY_FLAG_TAINTED))
+                if (unlikely(tx->key && tx->key->flags & KEY_FLAG_TAINTED &&
+                             !ieee80211_is_deauth(hdr->frame_control)))
                         return TX_DROP;
 
                 if (!skip_hw && tx->key &&
@@ -1225,6 +1230,21 @@ static bool ieee80211_tx_frags(struct ieee80211_local *local,
                 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
                 if (local->queue_stop_reasons[q] ||
                     (!txpending && !skb_queue_empty(&local->pending[q]))) {
+                        if (unlikely(info->flags &
+                                        IEEE80211_TX_INTFL_OFFCHAN_TX_OK &&
+                                     local->queue_stop_reasons[q] &
+                                        ~BIT(IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL))) {
+                                /*
+                                 * Drop off-channel frames if queues are stopped
+                                 * for any reason other than off-channel
+                                 * operation. Never queue them.
+                                 */
+                                spin_unlock_irqrestore(
+                                        &local->queue_stop_reason_lock, flags);
+                                ieee80211_purge_tx_queue(&local->hw, skbs);
+                                return true;
+                        }
+
                         /*
                          * Since queue is stopped, queue up frames for later
                          * transmission from the tx-pending tasklet when the
@@ -1472,12 +1492,14 @@ void ieee80211_xmit(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
         hdr = (struct ieee80211_hdr *) skb->data;
         info->control.vif = &sdata->vif;
 
-        if (ieee80211_vif_is_mesh(&sdata->vif) &&
-            ieee80211_is_data(hdr->frame_control) &&
-            !is_multicast_ether_addr(hdr->addr1) &&
-            mesh_nexthop_resolve(skb, sdata)) {
-                /* skb queued: don't free */
-                return;
+        if (ieee80211_vif_is_mesh(&sdata->vif)) {
+                if (ieee80211_is_data(hdr->frame_control) &&
+                    is_unicast_ether_addr(hdr->addr1)) {
+                        if (mesh_nexthop_resolve(skb, sdata))
+                                return; /* skb queued: don't free */
+                } else {
+                        ieee80211_mps_set_frame_flags(sdata, NULL, hdr);
+                }
         }
 
         ieee80211_set_qos_hdr(sdata, skb);
@@ -2342,11 +2364,9 @@ static int ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata,
         if (local->tim_in_locked_section) {
                 __ieee80211_beacon_add_tim(sdata, ps, skb);
         } else {
-                unsigned long flags;
-
-                spin_lock_irqsave(&local->tim_lock, flags);
+                spin_lock(&local->tim_lock);
                 __ieee80211_beacon_add_tim(sdata, ps, skb);
-                spin_unlock_irqrestore(&local->tim_lock, flags);
+                spin_unlock(&local->tim_lock);
         }
 
         return 0;
@@ -2424,66 +2444,26 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                 hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                                  IEEE80211_STYPE_BEACON);
         } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
-                struct ieee80211_mgmt *mgmt;
                 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
-                u8 *pos;
-                int hdr_len = offsetof(struct ieee80211_mgmt, u.beacon) +
-                              sizeof(mgmt->u.beacon);
+                struct beacon_data *bcn = rcu_dereference(ifmsh->beacon);
 
-#ifdef CONFIG_MAC80211_MESH
-                if (!sdata->u.mesh.mesh_id_len)
+                if (!bcn)
                         goto out;
-#endif
 
                 if (ifmsh->sync_ops)
                         ifmsh->sync_ops->adjust_tbtt(
                                                 sdata);
 
                 skb = dev_alloc_skb(local->tx_headroom +
-                                    hdr_len +
-                                    2 + /* NULL SSID */
-                                    2 + 8 + /* supported rates */
-                                    2 + 3 + /* DS params */
-                                    2 + (IEEE80211_MAX_SUPP_RATES - 8) +
-                                    2 + sizeof(struct ieee80211_ht_cap) +
-                                    2 + sizeof(struct ieee80211_ht_operation) +
-                                    2 + sdata->u.mesh.mesh_id_len +
-                                    2 + sizeof(struct ieee80211_meshconf_ie) +
-                                    sdata->u.mesh.ie_len);
+                                    bcn->head_len +
+                                    256 + /* TIM IE */
+                                    bcn->tail_len);
                 if (!skb)
                         goto out;
-
-                skb_reserve(skb, local->hw.extra_tx_headroom);
-                mgmt = (struct ieee80211_mgmt *) skb_put(skb, hdr_len);
-                memset(mgmt, 0, hdr_len);
-                mgmt->frame_control =
-                    cpu_to_le16(IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_BEACON);
-                eth_broadcast_addr(mgmt->da);
-                memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
-                memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
-                mgmt->u.beacon.beacon_int =
-                        cpu_to_le16(sdata->vif.bss_conf.beacon_int);
-                mgmt->u.beacon.capab_info |= cpu_to_le16(
-                        sdata->u.mesh.security ? WLAN_CAPABILITY_PRIVACY : 0);
-
-                pos = skb_put(skb, 2);
-                *pos++ = WLAN_EID_SSID;
-                *pos++ = 0x0;
-
-                band = chanctx_conf->def.chan->band;
-
-                if (ieee80211_add_srates_ie(sdata, skb, true, band) ||
-                    mesh_add_ds_params_ie(skb, sdata) ||
-                    ieee80211_add_ext_srates_ie(sdata, skb, true, band) ||
-                    mesh_add_rsn_ie(skb, sdata) ||
-                    mesh_add_ht_cap_ie(skb, sdata) ||
-                    mesh_add_ht_oper_ie(skb, sdata) ||
-                    mesh_add_meshid_ie(skb, sdata) ||
-                    mesh_add_meshconf_ie(skb, sdata) ||
-                    mesh_add_vendor_ies(skb, sdata)) {
-                        pr_err("o11s: couldn't add ies!\n");
-                        goto out;
-                }
+                skb_reserve(skb, local->tx_headroom);
+                memcpy(skb_put(skb, bcn->head_len), bcn->head, bcn->head_len);
+                ieee80211_beacon_add_tim(sdata, &ifmsh->ps, skb);
+                memcpy(skb_put(skb, bcn->tail_len), bcn->tail, bcn->tail_len);
         } else {
                 WARN_ON(1);
                 goto out;
@@ -2733,6 +2713,8 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
                         goto out;
 
                 ps = &sdata->u.ap.ps;
+        } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
+                ps = &sdata->u.mesh.ps;
         } else {
                 goto out;
         }
@@ -2756,6 +2738,7 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
                                 cpu_to_le16(IEEE80211_FCTL_MOREDATA);
                 }
 
+                sdata = IEEE80211_DEV_TO_SUB_IF(skb->dev);
                 if (!ieee80211_tx_prepare(sdata, &tx, skb))
                         break;
                 dev_kfree_skb_any(skb);
@@ -2788,6 +2771,8 @@ void __ieee80211_tx_skb_tid_band(struct ieee80211_sub_if_data *sdata,
         skb_set_queue_mapping(skb, ac);
         skb->priority = tid;
 
+        skb->dev = sdata->dev;
+
         /*
          * The other path calling ieee80211_xmit is from the tasklet,
          * and while we can handle concurrent transmissions locking
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 7519018ff71a..0f38f43ac62e 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -739,11 +739,7 @@ u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
                                 if (calc_crc)
                                         crc = crc32_be(crc, pos - 2, elen + 2);
 
-                                if (pos[3] == 1) {
-                                        /* OUI Type 1 - WPA IE */
-                                        elems->wpa = pos;
-                                        elems->wpa_len = elen;
-                                } else if (elen >= 5 && pos[3] == 2) {
+                                if (elen >= 5 && pos[3] == 2) {
                                         /* OUI Type 2 - WMM IE */
                                         if (pos[4] == 0) {
                                                 elems->wmm_info = pos;
@@ -791,6 +787,12 @@ u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
                         else
                                 elem_parse_failed = true;
                         break;
+                case WLAN_EID_OPMODE_NOTIF:
+                        if (elen > 0)
+                                elems->opmode_notif = pos;
+                        else
+                                elem_parse_failed = true;
+                        break;
                 case WLAN_EID_MESH_ID:
                         elems->mesh_id = pos;
                         elems->mesh_id_len = elen;
@@ -805,6 +807,10 @@ u32 ieee802_11_parse_elems_crc(u8 *start, size_t len,
                         elems->peering = pos;
                         elems->peering_len = elen;
                         break;
+                case WLAN_EID_MESH_AWAKE_WINDOW:
+                        if (elen >= 2)
+                                elems->awake_window = (void *)pos;
+                        break;
                 case WLAN_EID_PREQ:
                         elems->preq = pos;
                         elems->preq_len = elen;
@@ -1029,8 +1035,9 @@ u32 ieee80211_mandatory_rates(struct ieee80211_local *local,
 
 void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
                          u16 transaction, u16 auth_alg, u16 status,
-                         u8 *extra, size_t extra_len, const u8 *da,
-                         const u8 *bssid, const u8 *key, u8 key_len, u8 key_idx)
+                         const u8 *extra, size_t extra_len, const u8 *da,
+                         const u8 *bssid, const u8 *key, u8 key_len, u8 key_idx,
+                         u32 tx_flags)
 {
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb;
@@ -1063,7 +1070,8 @@ void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
                 WARN_ON(err);
         }
 
-        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
+                                        tx_flags;
         ieee80211_tx_skb(sdata, skb);
 }
 
@@ -1277,7 +1285,7 @@ struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
 void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
                               const u8 *ssid, size_t ssid_len,
                               const u8 *ie, size_t ie_len,
-                              u32 ratemask, bool directed, bool no_cck,
+                              u32 ratemask, bool directed, u32 tx_flags,
                               struct ieee80211_channel *channel, bool scan)
 {
         struct sk_buff *skb;
@@ -1286,9 +1294,7 @@ void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
                                         ssid, ssid_len,
                                         ie, ie_len, directed);
         if (skb) {
-                if (no_cck)
-                        IEEE80211_SKB_CB(skb)->flags |=
-                                IEEE80211_TX_CTL_NO_CCK_RATE;
+                IEEE80211_SKB_CB(skb)->flags |= tx_flags;
                 if (scan)
                         ieee80211_tx_skb_tid_band(sdata, skb, 7, channel->band);
                 else
@@ -1538,6 +1544,10 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                         changed |= BSS_CHANGED_ASSOC |
                                    BSS_CHANGED_ARP_FILTER |
                                    BSS_CHANGED_PS;
+
+                        if (sdata->u.mgd.dtim_period)
+                                changed |= BSS_CHANGED_DTIM_PERIOD;
+
                         mutex_lock(&sdata->u.mgd.mtx);
                         ieee80211_bss_info_change_notify(sdata, changed);
                         mutex_unlock(&sdata->u.mgd.mtx);
@@ -1937,7 +1947,7 @@ u8 *ieee80211_ie_build_ht_oper(u8 *pos, struct ieee80211_sta_ht_cap *ht_cap,
 }
 
 void ieee80211_ht_oper_to_chandef(struct ieee80211_channel *control_chan,
-                                  struct ieee80211_ht_operation *ht_oper,
+                                  const struct ieee80211_ht_operation *ht_oper,
                                   struct cfg80211_chan_def *chandef)
 {
         enum nl80211_channel_type channel_type;
@@ -2125,3 +2135,49 @@ u64 ieee80211_calculate_rx_timestamp(struct ieee80211_local *local,
 
         return ts;
 }
+
+void ieee80211_dfs_cac_cancel(struct ieee80211_local *local)
+{
+        struct ieee80211_sub_if_data *sdata;
+
+        mutex_lock(&local->iflist_mtx);
+        list_for_each_entry(sdata, &local->interfaces, list) {
+                cancel_delayed_work_sync(&sdata->dfs_cac_timer_work);
+
+                if (sdata->wdev.cac_started) {
+                        ieee80211_vif_release_channel(sdata);
+                        cfg80211_cac_event(sdata->dev,
+                                           NL80211_RADAR_CAC_ABORTED,
+                                           GFP_KERNEL);
+                }
+        }
+        mutex_unlock(&local->iflist_mtx);
+}
+
+void ieee80211_dfs_radar_detected_work(struct work_struct *work)
+{
+        struct ieee80211_local *local =
+                container_of(work, struct ieee80211_local, radar_detected_work);
+        struct cfg80211_chan_def chandef;
+
+        ieee80211_dfs_cac_cancel(local);
+
+        if (local->use_chanctx)
+                /* currently not handled */
+                WARN_ON(1);
+        else {
+                cfg80211_chandef_create(&chandef, local->hw.conf.channel,
+                                        local->hw.conf.channel_type);
+                cfg80211_radar_event(local->hw.wiphy, &chandef, GFP_KERNEL);
+        }
+}
+
+void ieee80211_radar_detected(struct ieee80211_hw *hw)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+
+        trace_api_radar_detected(local);
+
+        ieee80211_queue_work(hw, &local->radar_detected_work);
+}
+EXPORT_SYMBOL(ieee80211_radar_detected);
diff --git a/net/mac80211/vht.c b/net/mac80211/vht.c
index f311388aeedf..a2c2258bc84e 100644
--- a/net/mac80211/vht.c
+++ b/net/mac80211/vht.c
@@ -10,21 +10,29 @@
 #include <linux/export.h>
 #include <net/mac80211.h>
 #include "ieee80211_i.h"
+#include "rate.h"
 
 
-void ieee80211_vht_cap_ie_to_sta_vht_cap(struct ieee80211_sub_if_data *sdata,
-                                         struct ieee80211_supported_band *sband,
-                                         struct ieee80211_vht_cap *vht_cap_ie,
-                                         struct ieee80211_sta_vht_cap *vht_cap)
+void
+ieee80211_vht_cap_ie_to_sta_vht_cap(struct ieee80211_sub_if_data *sdata,
+                                    struct ieee80211_supported_band *sband,
+                                    const struct ieee80211_vht_cap *vht_cap_ie,
+                                    struct sta_info *sta)
 {
-        if (WARN_ON_ONCE(!vht_cap))
-                return;
+        struct ieee80211_sta_vht_cap *vht_cap = &sta->sta.vht_cap;
 
         memset(vht_cap, 0, sizeof(*vht_cap));
 
+        if (!sta->sta.ht_cap.ht_supported)
+                return;
+
         if (!vht_cap_ie || !sband->vht_cap.vht_supported)
                 return;
 
+        /* A VHT STA must support 40 MHz */
+        if (!(sta->sta.ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40))
+                return;
+
         vht_cap->vht_supported = true;
 
         vht_cap->cap = le32_to_cpu(vht_cap_ie->vht_cap_info);
@@ -32,4 +40,156 @@ void ieee80211_vht_cap_ie_to_sta_vht_cap(struct ieee80211_sub_if_data *sdata,
         /* Copy peer MCS info, the driver might need them. */
         memcpy(&vht_cap->vht_mcs, &vht_cap_ie->supp_mcs,
                sizeof(struct ieee80211_vht_mcs_info));
+
+        switch (vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK) {
+        case IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ:
+        case IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ:
+                sta->cur_max_bandwidth = IEEE80211_STA_RX_BW_160;
+                break;
+        default:
+                sta->cur_max_bandwidth = IEEE80211_STA_RX_BW_80;
+        }
+
+        sta->sta.bandwidth = ieee80211_sta_cur_vht_bw(sta);
+}
+
+enum ieee80211_sta_rx_bandwidth ieee80211_sta_cur_vht_bw(struct sta_info *sta)
+{
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
+        u32 cap = sta->sta.vht_cap.cap;
+        enum ieee80211_sta_rx_bandwidth bw;
+
+        if (!sta->sta.vht_cap.vht_supported) {
+                bw = sta->sta.ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40 ?
+                                IEEE80211_STA_RX_BW_40 : IEEE80211_STA_RX_BW_20;
+                goto check_max;
+        }
+
+        switch (sdata->vif.bss_conf.chandef.width) {
+        default:
+                WARN_ON_ONCE(1);
+                /* fall through */
+        case NL80211_CHAN_WIDTH_20_NOHT:
+        case NL80211_CHAN_WIDTH_20:
+        case NL80211_CHAN_WIDTH_40:
+                bw = sta->sta.ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40 ?
+                                IEEE80211_STA_RX_BW_40 : IEEE80211_STA_RX_BW_20;
+                break;
+        case NL80211_CHAN_WIDTH_160:
+                if ((cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK) ==
+                                IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ) {
+                        bw = IEEE80211_STA_RX_BW_160;
+                        break;
+                }
+                /* fall through */
+        case NL80211_CHAN_WIDTH_80P80:
+                if ((cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK) ==
+                                IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ) {
+                        bw = IEEE80211_STA_RX_BW_160;
+                        break;
+                }
+                /* fall through */
+        case NL80211_CHAN_WIDTH_80:
+                bw = IEEE80211_STA_RX_BW_80;
+        }
+
+ check_max:
+        if (bw > sta->cur_max_bandwidth)
+                bw = sta->cur_max_bandwidth;
+        return bw;
+}
+
+void ieee80211_sta_set_rx_nss(struct sta_info *sta)
+{
+        u8 ht_rx_nss = 0, vht_rx_nss = 0;
+
+        /* if we received a notification already don't overwrite it */
+        if (sta->sta.rx_nss)
+                return;
+
+        if (sta->sta.ht_cap.ht_supported) {
+                if (sta->sta.ht_cap.mcs.rx_mask[0])
+                        ht_rx_nss++;
+                if (sta->sta.ht_cap.mcs.rx_mask[1])
+                        ht_rx_nss++;
+                if (sta->sta.ht_cap.mcs.rx_mask[2])
+                        ht_rx_nss++;
+                if (sta->sta.ht_cap.mcs.rx_mask[3])
+                        ht_rx_nss++;
+                /* FIXME: consider rx_highest? */
+        }
+
+        if (sta->sta.vht_cap.vht_supported) {
+                int i;
+                u16 rx_mcs_map;
+
+                rx_mcs_map = le16_to_cpu(sta->sta.vht_cap.vht_mcs.rx_mcs_map);
+
+                for (i = 7; i >= 0; i--) {
+                        u8 mcs = (rx_mcs_map >> (2 * i)) & 3;
+
+                        if (mcs != IEEE80211_VHT_MCS_NOT_SUPPORTED) {
+                                vht_rx_nss = i + 1;
+                                break;
+                        }
+                }
+                /* FIXME: consider rx_highest? */
+        }
+
+        ht_rx_nss = max(ht_rx_nss, vht_rx_nss);
+        sta->sta.rx_nss = max_t(u8, 1, ht_rx_nss);
+}
+
+void ieee80211_vht_handle_opmode(struct ieee80211_sub_if_data *sdata,
+                                 struct sta_info *sta, u8 opmode,
+                                 enum ieee80211_band band, bool nss_only)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_supported_band *sband;
+        enum ieee80211_sta_rx_bandwidth new_bw;
+        u32 changed = 0;
+        u8 nss;
+
+        sband = local->hw.wiphy->bands[band];
+
+        /* ignore - no support for BF yet */
+        if (opmode & IEEE80211_OPMODE_NOTIF_RX_NSS_TYPE_BF)
+                return;
+
+        nss = opmode & IEEE80211_OPMODE_NOTIF_RX_NSS_MASK;
+        nss >>= IEEE80211_OPMODE_NOTIF_RX_NSS_SHIFT;
+        nss += 1;
+
+        if (sta->sta.rx_nss != nss) {
+                sta->sta.rx_nss = nss;
+                changed |= IEEE80211_RC_NSS_CHANGED;
+        }
+
+        if (nss_only)
+                goto change;
+
+        switch (opmode & IEEE80211_OPMODE_NOTIF_CHANWIDTH_MASK) {
+        case IEEE80211_OPMODE_NOTIF_CHANWIDTH_20MHZ:
+                sta->cur_max_bandwidth = IEEE80211_STA_RX_BW_20;
+                break;
+        case IEEE80211_OPMODE_NOTIF_CHANWIDTH_40MHZ:
+                sta->cur_max_bandwidth = IEEE80211_STA_RX_BW_40;
+                break;
+        case IEEE80211_OPMODE_NOTIF_CHANWIDTH_80MHZ:
+                sta->cur_max_bandwidth = IEEE80211_STA_RX_BW_80;
+                break;
+        case IEEE80211_OPMODE_NOTIF_CHANWIDTH_160MHZ:
+                sta->cur_max_bandwidth = IEEE80211_STA_RX_BW_160;
+                break;
+        }
+
+        new_bw = ieee80211_sta_cur_vht_bw(sta);
+        if (new_bw != sta->sta.bandwidth) {
+                sta->sta.bandwidth = new_bw;
+                changed |= IEEE80211_RC_NSS_CHANGED;
+        }
+
+ change:
+        if (changed)
+                rate_control_rate_update(local, sband, sta, changed);
 }
diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c
index 906f00cd6d2f..afba19cb6f87 100644
--- a/net/mac80211/wme.c
+++ b/net/mac80211/wme.c
@@ -191,6 +191,15 @@ void ieee80211_set_qos_hdr(struct ieee80211_sub_if_data *sdata,
 
         /* qos header is 2 bytes */
         *p++ = ack_policy | tid;
-        *p = ieee80211_vif_is_mesh(&sdata->vif) ?
-                (IEEE80211_QOS_CTL_MESH_CONTROL_PRESENT >> 8) : 0;
+        if (ieee80211_vif_is_mesh(&sdata->vif)) {
+                /* preserve RSPI and Mesh PS Level bit */
+                *p &= ((IEEE80211_QOS_CTL_RSPI |
+                        IEEE80211_QOS_CTL_MESH_PS_LEVEL) >> 8);
+
+                /* Nulls don't have a mesh header (frame body) */
+                if (!ieee80211_is_qos_nullfunc(hdr->frame_control))
+                        *p |= (IEEE80211_QOS_CTL_MESH_CONTROL_PRESENT >> 8);
+        } else {
+                *p = 0;
+        }
 }
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index c175ee866ff4..c7c6d644486f 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -181,7 +181,6 @@ static int tkip_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
         struct ieee80211_key *key = tx->key;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        unsigned long flags;
         unsigned int hdrlen;
         int len, tail;
         u8 *pos;
@@ -216,12 +215,12 @@ static int tkip_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
                 return 0;
 
         /* Increase IV for the frame */
-        spin_lock_irqsave(&key->u.tkip.txlock, flags);
+        spin_lock(&key->u.tkip.txlock);
         key->u.tkip.tx.iv16++;
         if (key->u.tkip.tx.iv16 == 0)
                 key->u.tkip.tx.iv32++;
         pos = ieee80211_tkip_add_iv(pos, key);
-        spin_unlock_irqrestore(&key->u.tkip.txlock, flags);
+        spin_unlock(&key->u.tkip.txlock);
 
         /* hwaccel - with software IV */
         if (info->control.hw_key)
diff --git a/net/nfc/llcp/llcp.c b/net/nfc/llcp/llcp.c
index 85bc75c38dea..746f5a2f9804 100644
--- a/net/nfc/llcp/llcp.c
+++ b/net/nfc/llcp/llcp.c
@@ -549,14 +549,13 @@ int nfc_llcp_set_remote_gb(struct nfc_dev *dev, u8 *gb, u8 gb_len)
                 pr_err("No LLCP device\n");
                 return -ENODEV;
         }
+        if (gb_len < 3)
+                return -EINVAL;
 
         memset(local->remote_gb, 0, NFC_MAX_GT_LEN);
         memcpy(local->remote_gb, gb, gb_len);
         local->remote_gb_len = gb_len;
 
-        if (local->remote_gb == NULL || local->remote_gb_len == 0)
-                return -ENODEV;
-
         if (memcmp(local->remote_gb, llcp_magic, 3)) {
                 pr_err("MAC does not support LLCP\n");
                 return -EINVAL;
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index 396373f3ec26..fd556ac05fdb 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -147,6 +147,32 @@ static void chandef_primary_freqs(const struct cfg80211_chan_def *c,
         }
 }
 
+static int cfg80211_chandef_get_width(const struct cfg80211_chan_def *c)
+{
+        int width;
+
+        switch (c->width) {
+        case NL80211_CHAN_WIDTH_20:
+        case NL80211_CHAN_WIDTH_20_NOHT:
+                width = 20;
+                break;
+        case NL80211_CHAN_WIDTH_40:
+                width = 40;
+                break;
+        case NL80211_CHAN_WIDTH_80P80:
+        case NL80211_CHAN_WIDTH_80:
+                width = 80;
+                break;
+        case NL80211_CHAN_WIDTH_160:
+                width = 160;
+                break;
+        default:
+                WARN_ON_ONCE(1);
+                return -1;
+        }
+        return width;
+}
+
 const struct cfg80211_chan_def *
 cfg80211_chandef_compatible(const struct cfg80211_chan_def *c1,
                             const struct cfg80211_chan_def *c2)
@@ -192,6 +218,93 @@ cfg80211_chandef_compatible(const struct cfg80211_chan_def *c1,
 }
 EXPORT_SYMBOL(cfg80211_chandef_compatible);
 
+static void cfg80211_set_chans_dfs_state(struct wiphy *wiphy, u32 center_freq,
+                                         u32 bandwidth,
+                                         enum nl80211_dfs_state dfs_state)
+{
+        struct ieee80211_channel *c;
+        u32 freq;
+
+        for (freq = center_freq - bandwidth/2 + 10;
+             freq <= center_freq + bandwidth/2 - 10;
+             freq += 20) {
+                c = ieee80211_get_channel(wiphy, freq);
+                if (!c || !(c->flags & IEEE80211_CHAN_RADAR))
+                        continue;
+
+                c->dfs_state = dfs_state;
+                c->dfs_state_entered = jiffies;
+        }
+}
+
+void cfg80211_set_dfs_state(struct wiphy *wiphy,
+                            const struct cfg80211_chan_def *chandef,
+                            enum nl80211_dfs_state dfs_state)
+{
+        int width;
+
+        if (WARN_ON(!cfg80211_chandef_valid(chandef)))
+                return;
+
+        width = cfg80211_chandef_get_width(chandef);
+        if (width < 0)
+                return;
+
+        cfg80211_set_chans_dfs_state(wiphy, chandef->center_freq1,
+                                     width, dfs_state);
+
+        if (!chandef->center_freq2)
+                return;
+        cfg80211_set_chans_dfs_state(wiphy, chandef->center_freq2,
+                                     width, dfs_state);
+}
+
+static int cfg80211_get_chans_dfs_required(struct wiphy *wiphy,
+                                            u32 center_freq,
+                                            u32 bandwidth)
+{
+        struct ieee80211_channel *c;
+        u32 freq;
+
+        for (freq = center_freq - bandwidth/2 + 10;
+             freq <= center_freq + bandwidth/2 - 10;
+             freq += 20) {
+                c = ieee80211_get_channel(wiphy, freq);
+                if (!c)
+                        return -EINVAL;
+
+                if (c->flags & IEEE80211_CHAN_RADAR)
+                        return 1;
+        }
+        return 0;
+}
+
+
+int cfg80211_chandef_dfs_required(struct wiphy *wiphy,
+                                  const struct cfg80211_chan_def *chandef)
+{
+        int width;
+        int r;
+
+        if (WARN_ON(!cfg80211_chandef_valid(chandef)))
+                return -EINVAL;
+
+        width = cfg80211_chandef_get_width(chandef);
+        if (width < 0)
+                return -EINVAL;
+
+        r = cfg80211_get_chans_dfs_required(wiphy, chandef->center_freq1,
+                                            width);
+        if (r)
+                return r;
+
+        if (!chandef->center_freq2)
+                return 0;
+
+        return cfg80211_get_chans_dfs_required(wiphy, chandef->center_freq2,
+                                               width);
+}
+
 static bool cfg80211_secondary_chans_ok(struct wiphy *wiphy,
                                         u32 center_freq, u32 bandwidth,
                                         u32 prohibited_flags)
@@ -203,7 +316,16 @@ static bool cfg80211_secondary_chans_ok(struct wiphy *wiphy,
              freq <= center_freq + bandwidth/2 - 10;
              freq += 20) {
                 c = ieee80211_get_channel(wiphy, freq);
-                if (!c || c->flags & prohibited_flags)
+                if (!c)
+                        return false;
+
+                /* check for radar flags */
+                if ((prohibited_flags & c->flags & IEEE80211_CHAN_RADAR) &&
+                    (c->dfs_state != NL80211_DFS_AVAILABLE))
+                        return false;
+
+                /* check for the other flags */
+                if (c->flags & prohibited_flags & ~IEEE80211_CHAN_RADAR)
                         return false;
         }
 
@@ -253,6 +375,7 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy,
         case NL80211_CHAN_WIDTH_80:
                 if (!vht_cap->vht_supported)
                         return false;
+                prohibited_flags |= IEEE80211_CHAN_NO_80MHZ;
                 width = 80;
                 break;
         case NL80211_CHAN_WIDTH_160:
@@ -260,6 +383,7 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy,
                         return false;
                 if (!(vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ))
                         return false;
+                prohibited_flags |= IEEE80211_CHAN_NO_160MHZ;
                 width = 160;
                 break;
         default:
@@ -267,7 +391,16 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy,
                 return false;
         }
 
-        /* TODO: missing regulatory check on 80/160 bandwidth */
+        /*
+         * TODO: What if there are only certain 80/160/80+80 MHz channels
+         *       allowed by the driver, or only certain combinations?
+         *       For 40 MHz the driver can set the NO_HT40 flags, but for
+         *       80/160 MHz and in particular 80+80 MHz this isn't really
+         *       feasible and we only have NO_80MHZ/NO_160MHZ so far but
+         *       no way to cover 80+80 MHz or more complex restrictions.
+         *       Note that such restrictions also need to be advertised to
+         *       userspace, for example for P2P channel selection.
+         */
 
         if (width > 20)
                 prohibited_flags |= IEEE80211_CHAN_NO_OFDM;
@@ -344,7 +477,10 @@ cfg80211_get_chan_state(struct wireless_dev *wdev,
                 break;
         case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_P2P_GO:
-                if (wdev->beacon_interval) {
+                if (wdev->cac_started) {
+                        *chan = wdev->channel;
+                        *chanmode = CHAN_MODE_SHARED;
+                } else if (wdev->beacon_interval) {
                         *chan = wdev->channel;
                         *chanmode = CHAN_MODE_SHARED;
                 }
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 40dbe37cfbf6..5ffff039b017 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -324,6 +324,8 @@ struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv)
         INIT_LIST_HEAD(&rdev->bss_list);
         INIT_WORK(&rdev->scan_done_wk, __cfg80211_scan_done);
         INIT_WORK(&rdev->sched_scan_results_wk, __cfg80211_sched_scan_results);
+        INIT_DELAYED_WORK(&rdev->dfs_update_channels_wk,
+                          cfg80211_dfs_channels_update_work);
 #ifdef CONFIG_CFG80211_WEXT
         rdev->wiphy.wext = &cfg80211_wext_handler;
 #endif
@@ -365,7 +367,8 @@ struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv)
         rdev->wiphy.rts_threshold = (u32) -1;
         rdev->wiphy.coverage_class = 0;
 
-        rdev->wiphy.features = NL80211_FEATURE_SCAN_FLUSH;
+        rdev->wiphy.features = NL80211_FEATURE_SCAN_FLUSH |
+                               NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
 
         return &rdev->wiphy;
 }
@@ -695,6 +698,7 @@ void wiphy_unregister(struct wiphy *wiphy)
         flush_work(&rdev->scan_done_wk);
         cancel_work_sync(&rdev->conn_work);
         flush_work(&rdev->event_work);
+        cancel_delayed_work_sync(&rdev->dfs_update_channels_wk);
 
         if (rdev->wowlan && rdev->ops->set_wakeup)
                 rdev_set_wakeup(rdev, false);
@@ -715,7 +719,7 @@ void cfg80211_dev_free(struct cfg80211_registered_device *rdev)
                 kfree(reg);
         }
         list_for_each_entry_safe(scan, tmp, &rdev->bss_list, list)
-                cfg80211_put_bss(&scan->pub);
+                cfg80211_put_bss(&rdev->wiphy, &scan->pub);
         kfree(rdev);
 }
 
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 8396f7671c8d..3aec0e429d8a 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -8,7 +8,6 @@
 #include <linux/mutex.h>
 #include <linux/list.h>
 #include <linux/netdevice.h>
-#include <linux/kref.h>
 #include <linux/rbtree.h>
 #include <linux/debugfs.h>
 #include <linux/rfkill.h>
@@ -87,6 +86,8 @@ struct cfg80211_registered_device {
 
         struct cfg80211_wowlan *wowlan;
 
+        struct delayed_work dfs_update_channels_wk;
+
         /* must be last because of the way we do wiphy_priv(),
          * and it should at least be aligned to NETDEV_ALIGN */
         struct wiphy wiphy __aligned(NETDEV_ALIGN);
@@ -109,6 +110,9 @@ cfg80211_rdev_free_wowlan(struct cfg80211_registered_device *rdev)
         for (i = 0; i < rdev->wowlan->n_patterns; i++)
                 kfree(rdev->wowlan->patterns[i].mask);
         kfree(rdev->wowlan->patterns);
+        if (rdev->wowlan->tcp && rdev->wowlan->tcp->sock)
+                sock_release(rdev->wowlan->tcp->sock);
+        kfree(rdev->wowlan->tcp);
         kfree(rdev->wowlan);
 }
 
@@ -124,9 +128,10 @@ static inline void assert_cfg80211_lock(void)
 
 struct cfg80211_internal_bss {
         struct list_head list;
+        struct list_head hidden_list;
         struct rb_node rbn;
         unsigned long ts;
-        struct kref ref;
+        unsigned long refcount;
         atomic_t hold;
 
         /* must be last because of priv member */
@@ -428,6 +433,22 @@ int cfg80211_can_use_iftype_chan(struct cfg80211_registered_device *rdev,
                                  enum cfg80211_chan_mode chanmode,
                                  u8 radar_detect);
 
+/**
+ * cfg80211_chandef_dfs_required - checks if radar detection is required
+ * @wiphy: the wiphy to validate against
+ * @chandef: the channel definition to check
+ * Return: 1 if radar detection is required, 0 if it is not, < 0 on error
+ */
+int cfg80211_chandef_dfs_required(struct wiphy *wiphy,
+                                  const struct cfg80211_chan_def *c);
+
+void cfg80211_set_dfs_state(struct wiphy *wiphy,
+                            const struct cfg80211_chan_def *chandef,
+                            enum nl80211_dfs_state dfs_state);
+
+void cfg80211_dfs_channels_update_work(struct work_struct *work);
+
+
 static inline int
 cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
                               struct wireless_dev *wdev,
@@ -454,6 +475,16 @@ cfg80211_can_use_chan(struct cfg80211_registered_device *rdev,
                                             chan, chanmode, 0);
 }
 
+static inline unsigned int elapsed_jiffies_msecs(unsigned long start)
+{
+        unsigned long end = jiffies;
+
+        if (end >= start)
+                return jiffies_to_msecs(end - start);
+
+        return jiffies_to_msecs(end + (MAX_JIFFY_OFFSET - start) + 1);
+}
+
 void
 cfg80211_get_chan_state(struct wireless_dev *wdev,
                         struct ieee80211_channel **chan,
diff --git a/net/wireless/ibss.c b/net/wireless/ibss.c
index 9b9551e4a6f9..d80e47194d49 100644
--- a/net/wireless/ibss.c
+++ b/net/wireless/ibss.c
@@ -37,7 +37,7 @@ void __cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid)
 
         if (wdev->current_bss) {
                 cfg80211_unhold_bss(wdev->current_bss);
-                cfg80211_put_bss(&wdev->current_bss->pub);
+                cfg80211_put_bss(wdev->wiphy, &wdev->current_bss->pub);
         }
 
         cfg80211_hold_bss(bss_from_pub(bss));
@@ -182,7 +182,7 @@ static void __cfg80211_clear_ibss(struct net_device *dev, bool nowext)
 
         if (wdev->current_bss) {
                 cfg80211_unhold_bss(wdev->current_bss);
-                cfg80211_put_bss(&wdev->current_bss->pub);
+                cfg80211_put_bss(wdev->wiphy, &wdev->current_bss->pub);
         }
 
         wdev->current_bss = NULL;
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 461e692cdfec..caddca35d686 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -58,7 +58,7 @@ void cfg80211_send_rx_assoc(struct net_device *dev, struct cfg80211_bss *bss,
          */
         if (status_code != WLAN_STATUS_SUCCESS && wdev->conn &&
             cfg80211_sme_failed_reassoc(wdev)) {
-                cfg80211_put_bss(bss);
+                cfg80211_put_bss(wiphy, bss);
                 goto out;
         }
 
@@ -70,7 +70,7 @@ void cfg80211_send_rx_assoc(struct net_device *dev, struct cfg80211_bss *bss,
                  * do not call connect_result() now because the
                  * sme will schedule work that does it later.
                  */
-                cfg80211_put_bss(bss);
+                cfg80211_put_bss(wiphy, bss);
                 goto out;
         }
 
@@ -108,7 +108,7 @@ void __cfg80211_send_deauth(struct net_device *dev,
         if (wdev->current_bss &&
             ether_addr_equal(wdev->current_bss->pub.bssid, bssid)) {
                 cfg80211_unhold_bss(wdev->current_bss);
-                cfg80211_put_bss(&wdev->current_bss->pub);
+                cfg80211_put_bss(wiphy, &wdev->current_bss->pub);
                 wdev->current_bss = NULL;
                 was_current = true;
         }
@@ -164,7 +164,7 @@ void __cfg80211_send_disassoc(struct net_device *dev,
             ether_addr_equal(wdev->current_bss->pub.bssid, bssid)) {
                 cfg80211_sme_disassoc(dev, wdev->current_bss);
                 cfg80211_unhold_bss(wdev->current_bss);
-                cfg80211_put_bss(&wdev->current_bss->pub);
+                cfg80211_put_bss(wiphy, &wdev->current_bss->pub);
                 wdev->current_bss = NULL;
         } else
                 WARN_ON(1);
@@ -324,7 +324,7 @@ int __cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
         err = rdev_auth(rdev, dev, &req);
 
 out:
-        cfg80211_put_bss(req.bss);
+        cfg80211_put_bss(&rdev->wiphy, req.bss);
         return err;
 }
 
@@ -432,7 +432,7 @@ out:
         if (err) {
                 if (was_connected)
                         wdev->sme_state = CFG80211_SME_CONNECTED;
-                cfg80211_put_bss(req.bss);
+                cfg80211_put_bss(&rdev->wiphy, req.bss);
         }
 
         return err;
@@ -514,7 +514,7 @@ static int __cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
         if (wdev->sme_state != CFG80211_SME_CONNECTED)
                 return -ENOTCONN;
 
-        if (WARN_ON(!wdev->current_bss))
+        if (WARN(!wdev->current_bss, "sme_state=%d\n", wdev->sme_state))
                 return -ENOTCONN;
 
         memset(&req, 0, sizeof(req));
@@ -572,7 +572,7 @@ void cfg80211_mlme_down(struct cfg80211_registered_device *rdev,
 
         if (wdev->current_bss) {
                 cfg80211_unhold_bss(wdev->current_bss);
-                cfg80211_put_bss(&wdev->current_bss->pub);
+                cfg80211_put_bss(&rdev->wiphy, &wdev->current_bss->pub);
                 wdev->current_bss = NULL;
         }
 }
@@ -987,3 +987,123 @@ void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
 }
 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
+
+void cfg80211_dfs_channels_update_work(struct work_struct *work)
+{
+        struct delayed_work *delayed_work;
+        struct cfg80211_registered_device *rdev;
+        struct cfg80211_chan_def chandef;
+        struct ieee80211_supported_band *sband;
+        struct ieee80211_channel *c;
+        struct wiphy *wiphy;
+        bool check_again = false;
+        unsigned long timeout, next_time = 0;
+        int bandid, i;
+
+        delayed_work = container_of(work, struct delayed_work, work);
+        rdev = container_of(delayed_work, struct cfg80211_registered_device,
+                            dfs_update_channels_wk);
+        wiphy = &rdev->wiphy;
+
+        mutex_lock(&cfg80211_mutex);
+        for (bandid = 0; bandid < IEEE80211_NUM_BANDS; bandid++) {
+                sband = wiphy->bands[bandid];
+                if (!sband)
+                        continue;
+
+                for (i = 0; i < sband->n_channels; i++) {
+                        c = &sband->channels[i];
+
+                        if (c->dfs_state != NL80211_DFS_UNAVAILABLE)
+                                continue;
+
+                        timeout = c->dfs_state_entered +
+                                  IEEE80211_DFS_MIN_NOP_TIME_MS;
+
+                        if (time_after_eq(jiffies, timeout)) {
+                                c->dfs_state = NL80211_DFS_USABLE;
+                                cfg80211_chandef_create(&chandef, c,
+                                                        NL80211_CHAN_NO_HT);
+
+                                nl80211_radar_notify(rdev, &chandef,
+                                                     NL80211_RADAR_NOP_FINISHED,
+                                                     NULL, GFP_ATOMIC);
+                                continue;
+                        }
+
+                        if (!check_again)
+                                next_time = timeout - jiffies;
+                        else
+                                next_time = min(next_time, timeout - jiffies);
+                        check_again = true;
+                }
+        }
+        mutex_unlock(&cfg80211_mutex);
+
+        /* reschedule if there are other channels waiting to be cleared again */
+        if (check_again)
+                queue_delayed_work(cfg80211_wq, &rdev->dfs_update_channels_wk,
+                                   next_time);
+}
+
+
+void cfg80211_radar_event(struct wiphy *wiphy,
+                          struct cfg80211_chan_def *chandef,
+                          gfp_t gfp)
+{
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        unsigned long timeout;
+
+        trace_cfg80211_radar_event(wiphy, chandef);
+
+        /* only set the chandef supplied channel to unavailable, in
+         * case the radar is detected on only one of multiple channels
+         * spanned by the chandef.
+         */
+        cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_UNAVAILABLE);
+
+        timeout = msecs_to_jiffies(IEEE80211_DFS_MIN_NOP_TIME_MS);
+        queue_delayed_work(cfg80211_wq, &rdev->dfs_update_channels_wk,
+                           timeout);
+
+        nl80211_radar_notify(rdev, chandef, NL80211_RADAR_DETECTED, NULL, gfp);
+}
+EXPORT_SYMBOL(cfg80211_radar_event);
+
+void cfg80211_cac_event(struct net_device *netdev,
+                        enum nl80211_radar_event event, gfp_t gfp)
+{
+        struct wireless_dev *wdev = netdev->ieee80211_ptr;
+        struct wiphy *wiphy = wdev->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct cfg80211_chan_def chandef;
+        unsigned long timeout;
+
+        trace_cfg80211_cac_event(netdev, event);
+
+        if (WARN_ON(!wdev->cac_started))
+                return;
+
+        if (WARN_ON(!wdev->channel))
+                return;
+
+        cfg80211_chandef_create(&chandef, wdev->channel, NL80211_CHAN_NO_HT);
+
+        switch (event) {
+        case NL80211_RADAR_CAC_FINISHED:
+                timeout = wdev->cac_start_time +
+                          msecs_to_jiffies(IEEE80211_DFS_MIN_CAC_TIME_MS);
+                WARN_ON(!time_after_eq(jiffies, timeout));
+                cfg80211_set_dfs_state(wiphy, &chandef, NL80211_DFS_AVAILABLE);
+                break;
+        case NL80211_RADAR_CAC_ABORTED:
+                break;
+        default:
+                WARN_ON(1);
+                return;
+        }
+        wdev->cac_started = false;
+
+        nl80211_radar_notify(rdev, &chandef, event, netdev, gfp);
+}
+EXPORT_SYMBOL(cfg80211_cac_event);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index b5978ab4ad7a..580ffeaef3d5 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -19,6 +19,7 @@
 #include <net/genetlink.h>
 #include <net/cfg80211.h>
 #include <net/sock.h>
+#include <net/inet_connection_sock.h>
 #include "core.h"
 #include "nl80211.h"
 #include "reg.h"
@@ -367,6 +368,8 @@ static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
+        [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
+        [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 };
 
 /* policy for the key attributes */
@@ -399,6 +402,26 @@ nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
+        [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
+};
+
+static const struct nla_policy
+nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
+        [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
+        [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
+        [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
+        [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
+        [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
+        [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
+        [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
+                .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
+        },
+        [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
+                .len = sizeof(struct nl80211_wowlan_tcp_data_token)
+        },
+        [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
+        [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
+        [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 };
 
 /* policy for GTK rekey offload attributes */
@@ -531,8 +554,27 @@ static int nl80211_msg_put_channel(struct sk_buff *msg,
         if ((chan->flags & IEEE80211_CHAN_NO_IBSS) &&
             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IBSS))
                 goto nla_put_failure;
-        if ((chan->flags & IEEE80211_CHAN_RADAR) &&
-            nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
+        if (chan->flags & IEEE80211_CHAN_RADAR) {
+                u32 time = elapsed_jiffies_msecs(chan->dfs_state_entered);
+                if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
+                        goto nla_put_failure;
+                if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
+                                chan->dfs_state))
+                        goto nla_put_failure;
+                if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME, time))
+                        goto nla_put_failure;
+        }
+        if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
+            nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
+                goto nla_put_failure;
+        if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
+            nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
+                goto nla_put_failure;
+        if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
+            nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
+                goto nla_put_failure;
+        if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
+            nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
                 goto nla_put_failure;
 
         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
@@ -872,6 +914,48 @@ nla_put_failure:
         return -ENOBUFS;
 }
 
+#ifdef CONFIG_PM
+static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
+                                        struct sk_buff *msg)
+{
+        const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan.tcp;
+        struct nlattr *nl_tcp;
+
+        if (!tcp)
+                return 0;
+
+        nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
+        if (!nl_tcp)
+                return -ENOBUFS;
+
+        if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
+                        tcp->data_payload_max))
+                return -ENOBUFS;
+
+        if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
+                        tcp->data_payload_max))
+                return -ENOBUFS;
+
+        if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
+                return -ENOBUFS;
+
+        if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
+                                sizeof(*tcp->tok), tcp->tok))
+                return -ENOBUFS;
+
+        if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
+                        tcp->data_interval_max))
+                return -ENOBUFS;
+
+        if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
+                        tcp->wake_payload_max))
+                return -ENOBUFS;
+
+        nla_nest_end(msg, nl_tcp);
+        return 0;
+}
+#endif
+
 static int nl80211_send_wiphy(struct sk_buff *msg, u32 portid, u32 seq, int flags,
                               struct cfg80211_registered_device *dev)
 {
@@ -1238,12 +1322,17 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 portid, u32 seq, int flag
                                         dev->wiphy.wowlan.pattern_min_len,
                                 .max_pattern_len =
                                         dev->wiphy.wowlan.pattern_max_len,
+                                .max_pkt_offset =
+                                        dev->wiphy.wowlan.max_pkt_offset,
                         };
                         if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
                                     sizeof(pat), &pat))
                                 goto nla_put_failure;
                 }
 
+                if (nl80211_send_wowlan_tcp_caps(dev, msg))
+                        goto nla_put_failure;
+
                 nla_nest_end(msg, nl_wowlan);
         }
 #endif
@@ -1276,6 +1365,15 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 portid, u32 seq, int flag
                         dev->wiphy.max_acl_mac_addrs))
                 goto nla_put_failure;
 
+        if (dev->wiphy.extended_capabilities &&
+            (nla_put(msg, NL80211_ATTR_EXT_CAPA,
+                     dev->wiphy.extended_capabilities_len,
+                     dev->wiphy.extended_capabilities) ||
+             nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
+                     dev->wiphy.extended_capabilities_len,
+                     dev->wiphy.extended_capabilities_mask)))
+                goto nla_put_failure;
+
         return genlmsg_end(msg, hdr);
 
  nla_put_failure:
@@ -2707,6 +2805,7 @@ static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_ap_settings params;
         int err;
+        u8 radar_detect_width = 0;
 
         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
@@ -2825,9 +2924,19 @@ static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef))
                 return -EINVAL;
 
+        err = cfg80211_chandef_dfs_required(wdev->wiphy, &params.chandef);
+        if (err < 0)
+                return err;
+        if (err) {
+                radar_detect_width = BIT(params.chandef.width);
+                params.radar_required = true;
+        }
+
         mutex_lock(&rdev->devlist_mtx);
-        err = cfg80211_can_use_chan(rdev, wdev, params.chandef.chan,
-                                    CHAN_MODE_SHARED);
+        err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
+                                           params.chandef.chan,
+                                           CHAN_MODE_SHARED,
+                                           radar_detect_width);
         mutex_unlock(&rdev->devlist_mtx);
 
         if (err)
@@ -3057,12 +3166,22 @@ static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
             nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
                         sinfo->inactive_time))
                 goto nla_put_failure;
-        if ((sinfo->filled & STATION_INFO_RX_BYTES) &&
+        if ((sinfo->filled & (STATION_INFO_RX_BYTES |
+                              STATION_INFO_RX_BYTES64)) &&
             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
-                        sinfo->rx_bytes))
+                        (u32)sinfo->rx_bytes))
                 goto nla_put_failure;
-        if ((sinfo->filled & STATION_INFO_TX_BYTES) &&
+        if ((sinfo->filled & (STATION_INFO_TX_BYTES |
+                              NL80211_STA_INFO_TX_BYTES64)) &&
             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
+                        (u32)sinfo->tx_bytes))
+                goto nla_put_failure;
+        if ((sinfo->filled & STATION_INFO_RX_BYTES64) &&
+            nla_put_u64(msg, NL80211_STA_INFO_RX_BYTES64,
+                        sinfo->rx_bytes))
+                goto nla_put_failure;
+        if ((sinfo->filled & STATION_INFO_TX_BYTES64) &&
+            nla_put_u64(msg, NL80211_STA_INFO_TX_BYTES64,
                         sinfo->tx_bytes))
                 goto nla_put_failure;
         if ((sinfo->filled & STATION_INFO_LLID) &&
@@ -3290,6 +3409,63 @@ static struct net_device *get_vlan(struct genl_info *info,
         return ERR_PTR(ret);
 }
 
+static struct nla_policy
+nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
+        [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
+        [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
+};
+
+static int nl80211_set_station_tdls(struct genl_info *info,
+                                    struct station_parameters *params)
+{
+        struct cfg80211_registered_device *rdev = info->user_ptr[0];
+        struct nlattr *tb[NL80211_STA_WME_MAX + 1];
+        struct nlattr *nla;
+        int err;
+
+        /* Can only set if TDLS ... */
+        if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
+                return -EOPNOTSUPP;
+
+        /* ... with external setup is supported */
+        if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
+                return -EOPNOTSUPP;
+
+        /* Dummy STA entry gets updated once the peer capabilities are known */
+        if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
+                params->ht_capa =
+                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
+        if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
+                params->vht_capa =
+                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
+
+        /* parse WME attributes if present */
+        if (!info->attrs[NL80211_ATTR_STA_WME])
+                return 0;
+
+        nla = info->attrs[NL80211_ATTR_STA_WME];
+        err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
+                               nl80211_sta_wme_policy);
+        if (err)
+                return err;
+
+        if (tb[NL80211_STA_WME_UAPSD_QUEUES])
+                params->uapsd_queues = nla_get_u8(
+                        tb[NL80211_STA_WME_UAPSD_QUEUES]);
+        if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
+                return -EINVAL;
+
+        if (tb[NL80211_STA_WME_MAX_SP])
+                params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
+
+        if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
+                return -EINVAL;
+
+        params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
+
+        return 0;
+}
+
 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
 {
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
@@ -3318,8 +3494,20 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
         }
 
-        if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL] ||
-            info->attrs[NL80211_ATTR_HT_CAPABILITY])
+        if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
+                params.capability =
+                        nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
+                params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
+        }
+
+        if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
+                params.ext_capab =
+                        nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
+                params.ext_capab_len =
+                        nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
+        }
+
+        if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
                 return -EINVAL;
 
         if (!rdev->ops->change_station)
@@ -3388,6 +3576,13 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
                 /* reject other things that can't change */
                 if (params.supported_rates)
                         return -EINVAL;
+                if (info->attrs[NL80211_ATTR_STA_CAPABILITY])
+                        return -EINVAL;
+                if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY])
+                        return -EINVAL;
+                if (info->attrs[NL80211_ATTR_HT_CAPABILITY] ||
+                    info->attrs[NL80211_ATTR_VHT_CAPABILITY])
+                        return -EINVAL;
 
                 /* must be last in here for error handling */
                 params.vlan = get_vlan(info, rdev);
@@ -3403,13 +3598,29 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
                  * to change the flag.
                  */
                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
-                /* fall through */
+                /* Include parameters for TDLS peer (driver will check) */
+                err = nl80211_set_station_tdls(info, &params);
+                if (err)
+                        return err;
+                /* disallow things sta doesn't support */
+                if (params.plink_action)
+                        return -EINVAL;
+                if (params.local_pm)
+                        return -EINVAL;
+                /* reject any changes other than AUTHORIZED or WME (for TDLS) */
+                if (params.sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
+                                              BIT(NL80211_STA_FLAG_WME)))
+                        return -EINVAL;
+                break;
         case NL80211_IFTYPE_ADHOC:
                 /* disallow things sta doesn't support */
                 if (params.plink_action)
                         return -EINVAL;
                 if (params.local_pm)
                         return -EINVAL;
+                if (info->attrs[NL80211_ATTR_HT_CAPABILITY] ||
+                    info->attrs[NL80211_ATTR_VHT_CAPABILITY])
+                        return -EINVAL;
                 /* reject any changes other than AUTHORIZED */
                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
                         return -EINVAL;
@@ -3420,6 +3631,13 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
                         return -EINVAL;
                 if (params.supported_rates)
                         return -EINVAL;
+                if (info->attrs[NL80211_ATTR_STA_CAPABILITY])
+                        return -EINVAL;
+                if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY])
+                        return -EINVAL;
+                if (info->attrs[NL80211_ATTR_HT_CAPABILITY] ||
+                    info->attrs[NL80211_ATTR_VHT_CAPABILITY])
+                        return -EINVAL;
                 /*
                  * No special handling for TDLS here -- the userspace
                  * mesh code doesn't have this bug.
@@ -3444,12 +3662,6 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
         return err;
 }
 
-static struct nla_policy
-nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
-        [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
-        [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
-};
-
 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
 {
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
@@ -3484,6 +3696,19 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
         if (!params.aid || params.aid > IEEE80211_MAX_AID)
                 return -EINVAL;
 
+        if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
+                params.capability =
+                        nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
+                params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
+        }
+
+        if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
+                params.ext_capab =
+                        nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
+                params.ext_capab_len =
+                        nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
+        }
+
         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
                 params.ht_capa =
                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
@@ -4977,6 +5202,54 @@ static int nl80211_stop_sched_scan(struct sk_buff *skb,
         return err;
 }
 
+static int nl80211_start_radar_detection(struct sk_buff *skb,
+                                         struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev = info->user_ptr[0];
+        struct net_device *dev = info->user_ptr[1];
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_chan_def chandef;
+        int err;
+
+        err = nl80211_parse_chandef(rdev, info, &chandef);
+        if (err)
+                return err;
+
+        if (wdev->cac_started)
+                return -EBUSY;
+
+        err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef);
+        if (err < 0)
+                return err;
+
+        if (err == 0)
+                return -EINVAL;
+
+        if (chandef.chan->dfs_state != NL80211_DFS_USABLE)
+                return -EINVAL;
+
+        if (!rdev->ops->start_radar_detection)
+                return -EOPNOTSUPP;
+
+        mutex_lock(&rdev->devlist_mtx);
+        err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
+                                           chandef.chan, CHAN_MODE_SHARED,
+                                           BIT(chandef.width));
+        if (err)
+                goto err_locked;
+
+        err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef);
+        if (!err) {
+                wdev->channel = chandef.chan;
+                wdev->cac_started = true;
+                wdev->cac_start_time = jiffies;
+        }
+err_locked:
+        mutex_unlock(&rdev->devlist_mtx);
+
+        return err;
+}
+
 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
                             u32 seq, int flags,
                             struct cfg80211_registered_device *rdev,
@@ -4987,6 +5260,7 @@ static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
         const struct cfg80211_bss_ies *ies;
         void *hdr;
         struct nlattr *bss;
+        bool tsf = false;
 
         ASSERT_WDEV_LOCK(wdev);
 
@@ -5010,22 +5284,24 @@ static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
 
         rcu_read_lock();
         ies = rcu_dereference(res->ies);
-        if (ies && ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
-                                       ies->len, ies->data)) {
-                rcu_read_unlock();
-                goto nla_put_failure;
+        if (ies) {
+                if (nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
+                        goto fail_unlock_rcu;
+                tsf = true;
+                if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
+                                        ies->len, ies->data))
+                        goto fail_unlock_rcu;
         }
         ies = rcu_dereference(res->beacon_ies);
-        if (ies && ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
-                                       ies->len, ies->data)) {
-                rcu_read_unlock();
-                goto nla_put_failure;
+        if (ies) {
+                if (!tsf && nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
+                        goto fail_unlock_rcu;
+                if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
+                                        ies->len, ies->data))
+                        goto fail_unlock_rcu;
         }
         rcu_read_unlock();
 
-        if (res->tsf &&
-            nla_put_u64(msg, NL80211_BSS_TSF, res->tsf))
-                goto nla_put_failure;
         if (res->beacon_interval &&
             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
                 goto nla_put_failure;
@@ -5070,6 +5346,8 @@ static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
 
         return genlmsg_end(msg, hdr);
 
+ fail_unlock_rcu:
+        rcu_read_unlock();
  nla_put_failure:
         genlmsg_cancel(msg, hdr);
         return -EMSGSIZE;
@@ -6880,16 +7158,100 @@ static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
 }
 
 #ifdef CONFIG_PM
+static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
+                                        struct cfg80211_registered_device *rdev)
+{
+        struct nlattr *nl_pats, *nl_pat;
+        int i, pat_len;
+
+        if (!rdev->wowlan->n_patterns)
+                return 0;
+
+        nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
+        if (!nl_pats)
+                return -ENOBUFS;
+
+        for (i = 0; i < rdev->wowlan->n_patterns; i++) {
+                nl_pat = nla_nest_start(msg, i + 1);
+                if (!nl_pat)
+                        return -ENOBUFS;
+                pat_len = rdev->wowlan->patterns[i].pattern_len;
+                if (nla_put(msg, NL80211_WOWLAN_PKTPAT_MASK,
+                            DIV_ROUND_UP(pat_len, 8),
+                            rdev->wowlan->patterns[i].mask) ||
+                    nla_put(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
+                            pat_len, rdev->wowlan->patterns[i].pattern) ||
+                    nla_put_u32(msg, NL80211_WOWLAN_PKTPAT_OFFSET,
+                                rdev->wowlan->patterns[i].pkt_offset))
+                        return -ENOBUFS;
+                nla_nest_end(msg, nl_pat);
+        }
+        nla_nest_end(msg, nl_pats);
+
+        return 0;
+}
+
+static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
+                                   struct cfg80211_wowlan_tcp *tcp)
+{
+        struct nlattr *nl_tcp;
+
+        if (!tcp)
+                return 0;
+
+        nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
+        if (!nl_tcp)
+                return -ENOBUFS;
+
+        if (nla_put_be32(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
+            nla_put_be32(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
+            nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
+            nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
+            nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
+            nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
+                    tcp->payload_len, tcp->payload) ||
+            nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
+                        tcp->data_interval) ||
+            nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
+                    tcp->wake_len, tcp->wake_data) ||
+            nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
+                    DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
+                return -ENOBUFS;
+
+        if (tcp->payload_seq.len &&
+            nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
+                    sizeof(tcp->payload_seq), &tcp->payload_seq))
+                return -ENOBUFS;
+
+        if (tcp->payload_tok.len &&
+            nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
+                    sizeof(tcp->payload_tok) + tcp->tokens_size,
+                    &tcp->payload_tok))
+                return -ENOBUFS;
+
+        return 0;
+}
+
 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
 {
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
         struct sk_buff *msg;
         void *hdr;
+        u32 size = NLMSG_DEFAULT_SIZE;
 
-        if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns)
+        if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns &&
+            !rdev->wiphy.wowlan.tcp)
                 return -EOPNOTSUPP;
 
-        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+        if (rdev->wowlan && rdev->wowlan->tcp) {
+                /* adjust size to have room for all the data */
+                size += rdev->wowlan->tcp->tokens_size +
+                        rdev->wowlan->tcp->payload_len +
+                        rdev->wowlan->tcp->wake_len +
+                        rdev->wowlan->tcp->wake_len / 8;
+        }
+
+        msg = nlmsg_new(size, GFP_KERNEL);
         if (!msg)
                 return -ENOMEM;
 
@@ -6920,31 +7282,12 @@ static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
                     (rdev->wowlan->rfkill_release &&
                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
                         goto nla_put_failure;
-                if (rdev->wowlan->n_patterns) {
-                        struct nlattr *nl_pats, *nl_pat;
-                        int i, pat_len;
 
-                        nl_pats = nla_nest_start(msg,
-                                        NL80211_WOWLAN_TRIG_PKT_PATTERN);
-                        if (!nl_pats)
-                                goto nla_put_failure;
+                if (nl80211_send_wowlan_patterns(msg, rdev))
+                        goto nla_put_failure;
 
-                        for (i = 0; i < rdev->wowlan->n_patterns; i++) {
-                                nl_pat = nla_nest_start(msg, i + 1);
-                                if (!nl_pat)
-                                        goto nla_put_failure;
-                                pat_len = rdev->wowlan->patterns[i].pattern_len;
-                                if (nla_put(msg, NL80211_WOWLAN_PKTPAT_MASK,
-                                            DIV_ROUND_UP(pat_len, 8),
-                                            rdev->wowlan->patterns[i].mask) ||
-                                    nla_put(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
-                                            pat_len,
-                                            rdev->wowlan->patterns[i].pattern))
-                                        goto nla_put_failure;
-                                nla_nest_end(msg, nl_pat);
-                        }
-                        nla_nest_end(msg, nl_pats);
-                }
+                if (nl80211_send_wowlan_tcp(msg, rdev->wowlan->tcp))
+                        goto nla_put_failure;
 
                 nla_nest_end(msg, nl_wowlan);
         }
@@ -6957,6 +7300,150 @@ nla_put_failure:
         return -ENOBUFS;
 }
 
+static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
+                                    struct nlattr *attr,
+                                    struct cfg80211_wowlan *trig)
+{
+        struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
+        struct cfg80211_wowlan_tcp *cfg;
+        struct nl80211_wowlan_tcp_data_token *tok = NULL;
+        struct nl80211_wowlan_tcp_data_seq *seq = NULL;
+        u32 size;
+        u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
+        int err, port;
+
+        if (!rdev->wiphy.wowlan.tcp)
+                return -EINVAL;
+
+        err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
+                        nla_data(attr), nla_len(attr),
+                        nl80211_wowlan_tcp_policy);
+        if (err)
+                return err;
+
+        if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
+            !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
+            !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
+            !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
+            !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
+            !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
+            !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
+            !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
+                return -EINVAL;
+
+        data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
+        if (data_size > rdev->wiphy.wowlan.tcp->data_payload_max)
+                return -EINVAL;
+
+        if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
+                        rdev->wiphy.wowlan.tcp->data_interval_max)
+                return -EINVAL;
+
+        wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
+        if (wake_size > rdev->wiphy.wowlan.tcp->wake_payload_max)
+                return -EINVAL;
+
+        wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
+        if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
+                return -EINVAL;
+
+        if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
+                u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
+
+                tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
+                tokens_size = tokln - sizeof(*tok);
+
+                if (!tok->len || tokens_size % tok->len)
+                        return -EINVAL;
+                if (!rdev->wiphy.wowlan.tcp->tok)
+                        return -EINVAL;
+                if (tok->len > rdev->wiphy.wowlan.tcp->tok->max_len)
+                        return -EINVAL;
+                if (tok->len < rdev->wiphy.wowlan.tcp->tok->min_len)
+                        return -EINVAL;
+                if (tokens_size > rdev->wiphy.wowlan.tcp->tok->bufsize)
+                        return -EINVAL;
+                if (tok->offset + tok->len > data_size)
+                        return -EINVAL;
+        }
+
+        if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
+                seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
+                if (!rdev->wiphy.wowlan.tcp->seq)
+                        return -EINVAL;
+                if (seq->len == 0 || seq->len > 4)
+                        return -EINVAL;
+                if (seq->len + seq->offset > data_size)
+                        return -EINVAL;
+        }
+
+        size = sizeof(*cfg);
+        size += data_size;
+        size += wake_size + wake_mask_size;
+        size += tokens_size;
+
+        cfg = kzalloc(size, GFP_KERNEL);
+        if (!cfg)
+                return -ENOMEM;
+        cfg->src = nla_get_be32(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
+        cfg->dst = nla_get_be32(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
+        memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
+               ETH_ALEN);
+        if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
+                port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
+        else
+                port = 0;
+#ifdef CONFIG_INET
+        /* allocate a socket and port for it and use it */
+        err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
+                            IPPROTO_TCP, &cfg->sock, 1);
+        if (err) {
+                kfree(cfg);
+                return err;
+        }
+        if (inet_csk_get_port(cfg->sock->sk, port)) {
+                sock_release(cfg->sock);
+                kfree(cfg);
+                return -EADDRINUSE;
+        }
+        cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
+#else
+        if (!port) {
+                kfree(cfg);
+                return -EINVAL;
+        }
+        cfg->src_port = port;
+#endif
+
+        cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
+        cfg->payload_len = data_size;
+        cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
+        memcpy((void *)cfg->payload,
+               nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
+               data_size);
+        if (seq)
+                cfg->payload_seq = *seq;
+        cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
+        cfg->wake_len = wake_size;
+        cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
+        memcpy((void *)cfg->wake_data,
+               nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
+               wake_size);
+        cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
+                         data_size + wake_size;
+        memcpy((void *)cfg->wake_mask,
+               nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
+               wake_mask_size);
+        if (tok) {
+                cfg->tokens_size = tokens_size;
+                memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
+        }
+
+        trig->tcp = cfg;
+
+        return 0;
+}
+
 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
 {
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
@@ -6967,7 +7454,8 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
         int err, i;
         bool prev_enabled = rdev->wowlan;
 
-        if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns)
+        if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns &&
+            !rdev->wiphy.wowlan.tcp)
                 return -EOPNOTSUPP;
 
         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
@@ -7031,7 +7519,7 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
                 struct nlattr *pat;
                 int n_patterns = 0;
-                int rem, pat_len, mask_len;
+                int rem, pat_len, mask_len, pkt_offset;
                 struct nlattr *pat_tb[NUM_NL80211_WOWLAN_PKTPAT];
 
                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
@@ -7066,6 +7554,15 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
                             pat_len < wowlan->pattern_min_len)
                                 goto error;
 
+                        if (!pat_tb[NL80211_WOWLAN_PKTPAT_OFFSET])
+                                pkt_offset = 0;
+                        else
+                                pkt_offset = nla_get_u32(
+                                        pat_tb[NL80211_WOWLAN_PKTPAT_OFFSET]);
+                        if (pkt_offset > wowlan->max_pkt_offset)
+                                goto error;
+                        new_triggers.patterns[i].pkt_offset = pkt_offset;
+
                         new_triggers.patterns[i].mask =
                                 kmalloc(mask_len + pat_len, GFP_KERNEL);
                         if (!new_triggers.patterns[i].mask) {
@@ -7085,6 +7582,14 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
                 }
         }
 
+        if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
+                err = nl80211_parse_wowlan_tcp(
+                        rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
+                        &new_triggers);
+                if (err)
+                        goto error;
+        }
+
         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
         if (!ntrig) {
                 err = -ENOMEM;
@@ -7102,6 +7607,9 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
         for (i = 0; i < new_triggers.n_patterns; i++)
                 kfree(new_triggers.patterns[i].mask);
         kfree(new_triggers.patterns);
+        if (new_triggers.tcp && new_triggers.tcp->sock)
+                sock_release(new_triggers.tcp->sock);
+        kfree(new_triggers.tcp);
         return err;
 }
 #endif
@@ -7992,6 +8500,14 @@ static struct genl_ops nl80211_ops[] = {
                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
                                   NL80211_FLAG_NEED_RTNL,
         },
+        {
+                .cmd = NL80211_CMD_RADAR_DETECT,
+                .doit = nl80211_start_radar_detection,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
+                                  NL80211_FLAG_NEED_RTNL,
+        },
 };
 
 static struct genl_multicast_group nl80211_mlme_mcgrp = {
@@ -9189,6 +9705,57 @@ nl80211_send_cqm_txe_notify(struct cfg80211_registered_device *rdev,
 }
 
 void
+nl80211_radar_notify(struct cfg80211_registered_device *rdev,
+                     struct cfg80211_chan_def *chandef,
+                     enum nl80211_radar_event event,
+                     struct net_device *netdev, gfp_t gfp)
+{
+        struct sk_buff *msg;
+        void *hdr;
+
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
+        if (!msg)
+                return;
+
+        hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
+        if (!hdr) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
+                goto nla_put_failure;
+
+        /* NOP and radar events don't need a netdev parameter */
+        if (netdev) {
+                struct wireless_dev *wdev = netdev->ieee80211_ptr;
+
+                if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
+                    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
+                        goto nla_put_failure;
+        }
+
+        if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
+                goto nla_put_failure;
+
+        if (nl80211_send_chandef(msg, chandef))
+                goto nla_put_failure;
+
+        if (genlmsg_end(msg, hdr) < 0) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+                                nl80211_mlme_mcgrp.id, gfp);
+        return;
+
+ nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        nlmsg_free(msg);
+}
+
+void
 nl80211_send_cqm_pktloss_notify(struct cfg80211_registered_device *rdev,
                                 struct net_device *netdev, const u8 *peer,
                                 u32 num_packets, gfp_t gfp)
@@ -9323,6 +9890,114 @@ void cfg80211_report_obss_beacon(struct wiphy *wiphy,
 }
 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
 
+#ifdef CONFIG_PM
+void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
+                                   struct cfg80211_wowlan_wakeup *wakeup,
+                                   gfp_t gfp)
+{
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct sk_buff *msg;
+        void *hdr;
+        int err, size = 200;
+
+        trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
+
+        if (wakeup)
+                size += wakeup->packet_present_len;
+
+        msg = nlmsg_new(size, gfp);
+        if (!msg)
+                return;
+
+        hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
+        if (!hdr)
+                goto free_msg;
+
+        if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
+            nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
+                goto free_msg;
+
+        if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
+                                        wdev->netdev->ifindex))
+                goto free_msg;
+
+        if (wakeup) {
+                struct nlattr *reasons;
+
+                reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
+
+                if (wakeup->disconnect &&
+                    nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
+                        goto free_msg;
+                if (wakeup->magic_pkt &&
+                    nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
+                        goto free_msg;
+                if (wakeup->gtk_rekey_failure &&
+                    nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
+                        goto free_msg;
+                if (wakeup->eap_identity_req &&
+                    nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
+                        goto free_msg;
+                if (wakeup->four_way_handshake &&
+                    nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
+                        goto free_msg;
+                if (wakeup->rfkill_release &&
+                    nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
+                        goto free_msg;
+
+                if (wakeup->pattern_idx >= 0 &&
+                    nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
+                                wakeup->pattern_idx))
+                        goto free_msg;
+
+                if (wakeup->tcp_match)
+                        nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH);
+
+                if (wakeup->tcp_connlost)
+                        nla_put_flag(msg,
+                                     NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST);
+
+                if (wakeup->tcp_nomoretokens)
+                        nla_put_flag(msg,
+                                NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS);
+
+                if (wakeup->packet) {
+                        u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
+                        u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
+
+                        if (!wakeup->packet_80211) {
+                                pkt_attr =
+                                        NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
+                                len_attr =
+                                        NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
+                        }
+
+                        if (wakeup->packet_len &&
+                            nla_put_u32(msg, len_attr, wakeup->packet_len))
+                                goto free_msg;
+
+                        if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
+                                    wakeup->packet))
+                                goto free_msg;
+                }
+
+                nla_nest_end(msg, reasons);
+        }
+
+        err = genlmsg_end(msg, hdr);
+        if (err < 0)
+                goto free_msg;
+
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+                                nl80211_mlme_mcgrp.id, gfp);
+        return;
+
+ free_msg:
+        nlmsg_free(msg);
+}
+EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
+#endif
+
 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
                                 enum nl80211_tdls_operation oper,
                                 u16 reason_code, gfp_t gfp)
diff --git a/net/wireless/nl80211.h b/net/wireless/nl80211.h
index 2acba8477e9d..b061da4919e1 100644
--- a/net/wireless/nl80211.h
+++ b/net/wireless/nl80211.h
@@ -108,6 +108,13 @@ nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
                              struct net_device *netdev,
                              enum nl80211_cqm_rssi_threshold_event rssi_event,
                              gfp_t gfp);
+
+void
+nl80211_radar_notify(struct cfg80211_registered_device *rdev,
+                     struct cfg80211_chan_def *chandef,
+                     enum nl80211_radar_event event,
+                     struct net_device *netdev, gfp_t gfp);
+
 void
 nl80211_send_cqm_pktloss_notify(struct cfg80211_registered_device *rdev,
                                 struct net_device *netdev, const u8 *peer,
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index de02d633c212..98532c00242d 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -866,6 +866,10 @@ static void handle_channel(struct wiphy *wiphy,
 
         if (freq_range->max_bandwidth_khz < MHZ_TO_KHZ(40))
                 bw_flags = IEEE80211_CHAN_NO_HT40;
+        if (freq_range->max_bandwidth_khz < MHZ_TO_KHZ(80))
+                bw_flags |= IEEE80211_CHAN_NO_80MHZ;
+        if (freq_range->max_bandwidth_khz < MHZ_TO_KHZ(160))
+                bw_flags |= IEEE80211_CHAN_NO_160MHZ;
 
         if (lr->initiator == NL80211_REGDOM_SET_BY_DRIVER &&
             request_wiphy && request_wiphy == wiphy &&
@@ -884,6 +888,9 @@ static void handle_channel(struct wiphy *wiphy,
                 return;
         }
 
+        chan->dfs_state = NL80211_DFS_USABLE;
+        chan->dfs_state_entered = jiffies;
+
         chan->beacon_found = false;
         chan->flags = flags | bw_flags | map_regdom_flags(reg_rule->flags);
         chan->max_antenna_gain =
@@ -1261,6 +1268,10 @@ static void handle_channel_custom(struct wiphy *wiphy,
 
         if (freq_range->max_bandwidth_khz < MHZ_TO_KHZ(40))
                 bw_flags = IEEE80211_CHAN_NO_HT40;
+        if (freq_range->max_bandwidth_khz < MHZ_TO_KHZ(80))
+                bw_flags |= IEEE80211_CHAN_NO_80MHZ;
+        if (freq_range->max_bandwidth_khz < MHZ_TO_KHZ(160))
+                bw_flags |= IEEE80211_CHAN_NO_160MHZ;
 
         chan->flags |= map_regdom_flags(reg_rule->flags) | bw_flags;
         chan->max_antenna_gain = (int) MBI_TO_DBI(power_rule->max_antenna_gain);
@@ -2189,10 +2200,15 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
                  * However if a driver requested this specific regulatory
                  * domain we keep it for its private use
                  */
-                if (lr->initiator == NL80211_REGDOM_SET_BY_DRIVER)
+                if (lr->initiator == NL80211_REGDOM_SET_BY_DRIVER) {
+                        const struct ieee80211_regdomain *tmp;
+
+                        tmp = get_wiphy_regdom(request_wiphy);
                         rcu_assign_pointer(request_wiphy->regd, rd);
-                else
+                        rcu_free_regdom(tmp);
+                } else {
                         kfree(rd);
+                }
 
                 rd = NULL;
 
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 45f1618c8e23..674aadca0079 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -19,55 +19,142 @@
 #include "wext-compat.h"
 #include "rdev-ops.h"
 
+/**
+ * DOC: BSS tree/list structure
+ *
+ * At the top level, the BSS list is kept in both a list in each
+ * registered device (@bss_list) as well as an RB-tree for faster
+ * lookup. In the RB-tree, entries can be looked up using their
+ * channel, MESHID, MESHCONF (for MBSSes) or channel, BSSID, SSID
+ * for other BSSes.
+ *
+ * Due to the possibility of hidden SSIDs, there's a second level
+ * structure, the "hidden_list" and "hidden_beacon_bss" pointer.
+ * The hidden_list connects all BSSes belonging to a single AP
+ * that has a hidden SSID, and connects beacon and probe response
+ * entries. For a probe response entry for a hidden SSID, the
+ * hidden_beacon_bss pointer points to the BSS struct holding the
+ * beacon's information.
+ *
+ * Reference counting is done for all these references except for
+ * the hidden_list, so that a beacon BSS struct that is otherwise
+ * not referenced has one reference for being on the bss_list and
+ * one for each probe response entry that points to it using the
+ * hidden_beacon_bss pointer. When a BSS struct that has such a
+ * pointer is get/put, the refcount update is also propagated to
+ * the referenced struct, this ensure that it cannot get removed
+ * while somebody is using the probe response version.
+ *
+ * Note that the hidden_beacon_bss pointer never changes, due to
+ * the reference counting. Therefore, no locking is needed for
+ * it.
+ *
+ * Also note that the hidden_beacon_bss pointer is only relevant
+ * if the driver uses something other than the IEs, e.g. private
+ * data stored stored in the BSS struct, since the beacon IEs are
+ * also linked into the probe response struct.
+ */
+
 #define IEEE80211_SCAN_RESULT_EXPIRE    (30 * HZ)
 
-static void bss_release(struct kref *ref)
+static void bss_free(struct cfg80211_internal_bss *bss)
 {
         struct cfg80211_bss_ies *ies;
-        struct cfg80211_internal_bss *bss;
-
-        bss = container_of(ref, struct cfg80211_internal_bss, ref);
 
         if (WARN_ON(atomic_read(&bss->hold)))
                 return;
 
-        if (bss->pub.free_priv)
-                bss->pub.free_priv(&bss->pub);
-
         ies = (void *)rcu_access_pointer(bss->pub.beacon_ies);
-        if (ies)
+        if (ies && !bss->pub.hidden_beacon_bss)
                 kfree_rcu(ies, rcu_head);
         ies = (void *)rcu_access_pointer(bss->pub.proberesp_ies);
         if (ies)
                 kfree_rcu(ies, rcu_head);
 
+        /*
+         * This happens when the module is removed, it doesn't
+         * really matter any more save for completeness
+         */
+        if (!list_empty(&bss->hidden_list))
+                list_del(&bss->hidden_list);
+
         kfree(bss);
 }
 
-/* must hold dev->bss_lock! */
-static void __cfg80211_unlink_bss(struct cfg80211_registered_device *dev,
+static inline void bss_ref_get(struct cfg80211_registered_device *dev,
+                               struct cfg80211_internal_bss *bss)
+{
+        lockdep_assert_held(&dev->bss_lock);
+
+        bss->refcount++;
+        if (bss->pub.hidden_beacon_bss) {
+                bss = container_of(bss->pub.hidden_beacon_bss,
+                                   struct cfg80211_internal_bss,
+                                   pub);
+                bss->refcount++;
+        }
+}
+
+static inline void bss_ref_put(struct cfg80211_registered_device *dev,
+                               struct cfg80211_internal_bss *bss)
+{
+        lockdep_assert_held(&dev->bss_lock);
+
+        if (bss->pub.hidden_beacon_bss) {
+                struct cfg80211_internal_bss *hbss;
+                hbss = container_of(bss->pub.hidden_beacon_bss,
+                                    struct cfg80211_internal_bss,
+                                    pub);
+                hbss->refcount--;
+                if (hbss->refcount == 0)
+                        bss_free(hbss);
+        }
+        bss->refcount--;
+        if (bss->refcount == 0)
+                bss_free(bss);
+}
+
+static bool __cfg80211_unlink_bss(struct cfg80211_registered_device *dev,
                                   struct cfg80211_internal_bss *bss)
 {
+        lockdep_assert_held(&dev->bss_lock);
+
+        if (!list_empty(&bss->hidden_list)) {
+                /*
+                 * don't remove the beacon entry if it has
+                 * probe responses associated with it
+                 */
+                if (!bss->pub.hidden_beacon_bss)
+                        return false;
+                /*
+                 * if it's a probe response entry break its
+                 * link to the other entries in the group
+                 */
+                list_del_init(&bss->hidden_list);
+        }
+
         list_del_init(&bss->list);
         rb_erase(&bss->rbn, &dev->bss_tree);
-        kref_put(&bss->ref, bss_release);
+        bss_ref_put(dev, bss);
+        return true;
 }
 
-/* must hold dev->bss_lock! */
 static void __cfg80211_bss_expire(struct cfg80211_registered_device *dev,
                                   unsigned long expire_time)
 {
         struct cfg80211_internal_bss *bss, *tmp;
         bool expired = false;
 
+        lockdep_assert_held(&dev->bss_lock);
+
         list_for_each_entry_safe(bss, tmp, &dev->bss_list, list) {
                 if (atomic_read(&bss->hold))
                         continue;
                 if (!time_after(expire_time, bss->ts))
                         continue;
 
-                __cfg80211_unlink_bss(dev, bss);
-                expired = true;
+                if (__cfg80211_unlink_bss(dev, bss))
+                        expired = true;
         }
 
         if (expired)
@@ -234,15 +321,16 @@ int __cfg80211_stop_sched_scan(struct cfg80211_registered_device *rdev,
         return 0;
 }
 
-/* must hold dev->bss_lock! */
 void cfg80211_bss_age(struct cfg80211_registered_device *dev,
                       unsigned long age_secs)
 {
         struct cfg80211_internal_bss *bss;
         unsigned long age_jiffies = msecs_to_jiffies(age_secs * MSEC_PER_SEC);
 
+        spin_lock_bh(&dev->bss_lock);
         list_for_each_entry(bss, &dev->bss_list, list)
                 bss->ts -= age_jiffies;
+        spin_unlock_bh(&dev->bss_lock);
 }
 
 void cfg80211_bss_expire(struct cfg80211_registered_device *dev)
@@ -277,40 +365,24 @@ const u8 *cfg80211_find_vendor_ie(unsigned int oui, u8 oui_type,
                 if (!pos)
                         return NULL;
 
-                if (end - pos < sizeof(*ie))
-                        return NULL;
-
                 ie = (struct ieee80211_vendor_ie *)pos;
+
+                /* make sure we can access ie->len */
+                BUILD_BUG_ON(offsetof(struct ieee80211_vendor_ie, len) != 1);
+
+                if (ie->len < sizeof(*ie))
+                        goto cont;
+
                 ie_oui = ie->oui[0] << 16 | ie->oui[1] << 8 | ie->oui[2];
                 if (ie_oui == oui && ie->oui_type == oui_type)
                         return pos;
-
+cont:
                 pos += 2 + ie->len;
         }
         return NULL;
 }
 EXPORT_SYMBOL(cfg80211_find_vendor_ie);
 
-static int cmp_ies(u8 num, const u8 *ies1, int len1, const u8 *ies2, int len2)
-{
-        const u8 *ie1 = cfg80211_find_ie(num, ies1, len1);
-        const u8 *ie2 = cfg80211_find_ie(num, ies2, len2);
-
-        /* equal if both missing */
-        if (!ie1 && !ie2)
-                return 0;
-        /* sort missing IE before (left of) present IE */
-        if (!ie1)
-                return -1;
-        if (!ie2)
-                return 1;
-
-        /* sort by length first, then by contents */
-        if (ie1[1] != ie2[1])
-                return ie2[1] - ie1[1];
-        return memcmp(ie1 + 2, ie2 + 2, ie1[1]);
-}
-
 static bool is_bss(struct cfg80211_bss *a, const u8 *bssid,
                    const u8 *ssid, size_t ssid_len)
 {
@@ -334,109 +406,30 @@ static bool is_bss(struct cfg80211_bss *a, const u8 *bssid,
         return memcmp(ssidie + 2, ssid, ssid_len) == 0;
 }
 
-static bool is_mesh_bss(struct cfg80211_bss *a)
-{
-        const struct cfg80211_bss_ies *ies;
-        const u8 *ie;
-
-        if (!WLAN_CAPABILITY_IS_STA_BSS(a->capability))
-                return false;
-
-        ies = rcu_access_pointer(a->ies);
-        if (!ies)
-                return false;
-
-        ie = cfg80211_find_ie(WLAN_EID_MESH_ID, ies->data, ies->len);
-        if (!ie)
-                return false;
-
-        ie = cfg80211_find_ie(WLAN_EID_MESH_CONFIG, ies->data, ies->len);
-        if (!ie)
-                return false;
-
-        return true;
-}
-
-static bool is_mesh(struct cfg80211_bss *a,
-                    const u8 *meshid, size_t meshidlen,
-                    const u8 *meshcfg)
-{
-        const struct cfg80211_bss_ies *ies;
-        const u8 *ie;
-
-        if (!WLAN_CAPABILITY_IS_STA_BSS(a->capability))
-                return false;
-
-        ies = rcu_access_pointer(a->ies);
-        if (!ies)
-                return false;
-
-        ie = cfg80211_find_ie(WLAN_EID_MESH_ID, ies->data, ies->len);
-        if (!ie)
-                return false;
-        if (ie[1] != meshidlen)
-                return false;
-        if (memcmp(ie + 2, meshid, meshidlen))
-                return false;
-
-        ie = cfg80211_find_ie(WLAN_EID_MESH_CONFIG, ies->data, ies->len);
-        if (!ie)
-                return false;
-        if (ie[1] != sizeof(struct ieee80211_meshconf_ie))
-                return false;
-
-        /*
-         * Ignore mesh capability (last two bytes of the IE) when
-         * comparing since that may differ between stations taking
-         * part in the same mesh.
-         */
-        return memcmp(ie + 2, meshcfg,
-                      sizeof(struct ieee80211_meshconf_ie) - 2) == 0;
-}
+/**
+ * enum bss_compare_mode - BSS compare mode
+ * @BSS_CMP_REGULAR: regular compare mode (for insertion and normal find)
+ * @BSS_CMP_HIDE_ZLEN: find hidden SSID with zero-length mode
+ * @BSS_CMP_HIDE_NUL: find hidden SSID with NUL-ed out mode
+ */
+enum bss_compare_mode {
+        BSS_CMP_REGULAR,
+        BSS_CMP_HIDE_ZLEN,
+        BSS_CMP_HIDE_NUL,
+};
 
-static int cmp_bss_core(struct cfg80211_bss *a, struct cfg80211_bss *b)
+static int cmp_bss(struct cfg80211_bss *a,
+                   struct cfg80211_bss *b,
+                   enum bss_compare_mode mode)
 {
         const struct cfg80211_bss_ies *a_ies, *b_ies;
-        int r;
+        const u8 *ie1 = NULL;
+        const u8 *ie2 = NULL;
+        int i, r;
 
         if (a->channel != b->channel)
                 return b->channel->center_freq - a->channel->center_freq;
 
-        if (is_mesh_bss(a) && is_mesh_bss(b)) {
-                a_ies = rcu_access_pointer(a->ies);
-                if (!a_ies)
-                        return -1;
-                b_ies = rcu_access_pointer(b->ies);
-                if (!b_ies)
-                        return 1;
-
-                r = cmp_ies(WLAN_EID_MESH_ID,
-                            a_ies->data, a_ies->len,
-                            b_ies->data, b_ies->len);
-                if (r)
-                        return r;
-                return cmp_ies(WLAN_EID_MESH_CONFIG,
-                               a_ies->data, a_ies->len,
-                               b_ies->data, b_ies->len);
-        }
-
-        /*
-         * we can't use compare_ether_addr here since we need a < > operator.
-         * The binary return value of compare_ether_addr isn't enough
-         */
-        return memcmp(a->bssid, b->bssid, sizeof(a->bssid));
-}
-
-static int cmp_bss(struct cfg80211_bss *a,
-                   struct cfg80211_bss *b)
-{
-        const struct cfg80211_bss_ies *a_ies, *b_ies;
-        int r;
-
-        r = cmp_bss_core(a, b);
-        if (r)
-                return r;
-
         a_ies = rcu_access_pointer(a->ies);
         if (!a_ies)
                 return -1;
@@ -444,42 +437,51 @@ static int cmp_bss(struct cfg80211_bss *a,
         if (!b_ies)
                 return 1;
 
-        return cmp_ies(WLAN_EID_SSID,
-                       a_ies->data, a_ies->len,
-                       b_ies->data, b_ies->len);
-}
-
-static int cmp_hidden_bss(struct cfg80211_bss *a, struct cfg80211_bss *b)
-{
-        const struct cfg80211_bss_ies *a_ies, *b_ies;
-        const u8 *ie1;
-        const u8 *ie2;
-        int i;
-        int r;
+        if (WLAN_CAPABILITY_IS_STA_BSS(a->capability))
+                ie1 = cfg80211_find_ie(WLAN_EID_MESH_ID,
+                                       a_ies->data, a_ies->len);
+        if (WLAN_CAPABILITY_IS_STA_BSS(b->capability))
+                ie2 = cfg80211_find_ie(WLAN_EID_MESH_ID,
+                                       b_ies->data, b_ies->len);
+        if (ie1 && ie2) {
+                int mesh_id_cmp;
+
+                if (ie1[1] == ie2[1])
+                        mesh_id_cmp = memcmp(ie1 + 2, ie2 + 2, ie1[1]);
+                else
+                        mesh_id_cmp = ie2[1] - ie1[1];
+
+                ie1 = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
+                                       a_ies->data, a_ies->len);
+                ie2 = cfg80211_find_ie(WLAN_EID_MESH_CONFIG,
+                                       b_ies->data, b_ies->len);
+                if (ie1 && ie2) {
+                        if (mesh_id_cmp)
+                                return mesh_id_cmp;
+                        if (ie1[1] != ie2[1])
+                                return ie2[1] - ie1[1];
+                        return memcmp(ie1 + 2, ie2 + 2, ie1[1]);
+                }
+        }
 
-        r = cmp_bss_core(a, b);
+        /*
+         * we can't use compare_ether_addr here since we need a < > operator.
+         * The binary return value of compare_ether_addr isn't enough
+         */
+        r = memcmp(a->bssid, b->bssid, sizeof(a->bssid));
         if (r)
                 return r;
 
-        a_ies = rcu_access_pointer(a->ies);
-        if (!a_ies)
-                return -1;
-        b_ies = rcu_access_pointer(b->ies);
-        if (!b_ies)
-                return 1;
-
         ie1 = cfg80211_find_ie(WLAN_EID_SSID, a_ies->data, a_ies->len);
         ie2 = cfg80211_find_ie(WLAN_EID_SSID, b_ies->data, b_ies->len);
 
+        if (!ie1 && !ie2)
+                return 0;
+
         /*
-         * Key comparator must use same algorithm in any rb-tree
-         * search function (order is important), otherwise ordering
-         * of items in the tree is broken and search gives incorrect
-         * results. This code uses same order as cmp_ies() does.
-         *
-         * Note that due to the differring behaviour with hidden SSIDs
-         * this function only works when "b" is the tree element and
-         * "a" is the key we're looking for.
+         * Note that with "hide_ssid", the function returns a match if
+         * the already-present BSS ("b") is a hidden SSID beacon for
+         * the new BSS ("a").
          */
 
         /* sort missing IE before (left of) present IE */
@@ -488,24 +490,36 @@ static int cmp_hidden_bss(struct cfg80211_bss *a, struct cfg80211_bss *b)
         if (!ie2)
                 return 1;
 
-        /* zero-size SSID is used as an indication of the hidden bss */
-        if (!ie2[1])
+        switch (mode) {
+        case BSS_CMP_HIDE_ZLEN:
+                /*
+                 * In ZLEN mode we assume the BSS entry we're
+                 * looking for has a zero-length SSID. So if
+                 * the one we're looking at right now has that,
+                 * return 0. Otherwise, return the difference
+                 * in length, but since we're looking for the
+                 * 0-length it's really equivalent to returning
+                 * the length of the one we're looking at.
+                 *
+                 * No content comparison is needed as we assume
+                 * the content length is zero.
+                 */
+                return ie2[1];
+        case BSS_CMP_REGULAR:
+        default:
+                /* sort by length first, then by contents */
+                if (ie1[1] != ie2[1])
+                        return ie2[1] - ie1[1];
+                return memcmp(ie1 + 2, ie2 + 2, ie1[1]);
+        case BSS_CMP_HIDE_NUL:
+                if (ie1[1] != ie2[1])
+                        return ie2[1] - ie1[1];
+                /* this is equivalent to memcmp(zeroes, ie2 + 2, len) */
+                for (i = 0; i < ie2[1]; i++)
+                        if (ie2[i + 2])
+                                return -1;
                 return 0;
-
-        /* sort by length first, then by contents */
-        if (ie1[1] != ie2[1])
-                return ie2[1] - ie1[1];
-
-        /*
-         * zeroed SSID ie is another indication of a hidden bss;
-         * if it isn't zeroed just return the regular sort value
-         * to find the next candidate
-         */
-        for (i = 0; i < ie2[1]; i++)
-                if (ie2[i + 2])
-                        return memcmp(ie1 + 2, ie2 + 2, ie1[1]);
-
-        return 0;
+        }
 }
 
 struct cfg80211_bss *cfg80211_get_bss(struct wiphy *wiphy,
@@ -534,7 +548,7 @@ struct cfg80211_bss *cfg80211_get_bss(struct wiphy *wiphy,
                         continue;
                 if (is_bss(&bss->pub, bssid, ssid, ssid_len)) {
                         res = bss;
-                        kref_get(&res->ref);
+                        bss_ref_get(dev, res);
                         break;
                 }
         }
@@ -547,34 +561,6 @@ struct cfg80211_bss *cfg80211_get_bss(struct wiphy *wiphy,
 }
 EXPORT_SYMBOL(cfg80211_get_bss);
 
-struct cfg80211_bss *cfg80211_get_mesh(struct wiphy *wiphy,
-                                       struct ieee80211_channel *channel,
-                                       const u8 *meshid, size_t meshidlen,
-                                       const u8 *meshcfg)
-{
-        struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
-        struct cfg80211_internal_bss *bss, *res = NULL;
-
-        spin_lock_bh(&dev->bss_lock);
-
-        list_for_each_entry(bss, &dev->bss_list, list) {
-                if (channel && bss->pub.channel != channel)
-                        continue;
-                if (is_mesh(&bss->pub, meshid, meshidlen, meshcfg)) {
-                        res = bss;
-                        kref_get(&res->ref);
-                        break;
-                }
-        }
-
-        spin_unlock_bh(&dev->bss_lock);
-        if (!res)
-                return NULL;
-        return &res->pub;
-}
-EXPORT_SYMBOL(cfg80211_get_mesh);
-
-
 static void rb_insert_bss(struct cfg80211_registered_device *dev,
                           struct cfg80211_internal_bss *bss)
 {
@@ -587,7 +573,7 @@ static void rb_insert_bss(struct cfg80211_registered_device *dev,
                 parent = *p;
                 tbss = rb_entry(parent, struct cfg80211_internal_bss, rbn);
 
-                cmp = cmp_bss(&bss->pub, &tbss->pub);
+                cmp = cmp_bss(&bss->pub, &tbss->pub, BSS_CMP_REGULAR);
 
                 if (WARN_ON(!cmp)) {
                         /* will sort of leak this BSS */
@@ -606,7 +592,8 @@ static void rb_insert_bss(struct cfg80211_registered_device *dev,
 
 static struct cfg80211_internal_bss *
 rb_find_bss(struct cfg80211_registered_device *dev,
-            struct cfg80211_internal_bss *res)
+            struct cfg80211_internal_bss *res,
+            enum bss_compare_mode mode)
 {
         struct rb_node *n = dev->bss_tree.rb_node;
         struct cfg80211_internal_bss *bss;
@@ -614,7 +601,7 @@ rb_find_bss(struct cfg80211_registered_device *dev,
 
         while (n) {
                 bss = rb_entry(n, struct cfg80211_internal_bss, rbn);
-                r = cmp_bss(&res->pub, &bss->pub);
+                r = cmp_bss(&res->pub, &bss->pub, mode);
 
                 if (r == 0)
                         return bss;
@@ -627,46 +614,67 @@ rb_find_bss(struct cfg80211_registered_device *dev,
         return NULL;
 }
 
-static struct cfg80211_internal_bss *
-rb_find_hidden_bss(struct cfg80211_registered_device *dev,
-                   struct cfg80211_internal_bss *res)
+static bool cfg80211_combine_bsses(struct cfg80211_registered_device *dev,
+                                   struct cfg80211_internal_bss *new)
 {
-        struct rb_node *n = dev->bss_tree.rb_node;
+        const struct cfg80211_bss_ies *ies;
         struct cfg80211_internal_bss *bss;
-        int r;
+        const u8 *ie;
+        int i, ssidlen;
+        u8 fold = 0;
 
-        while (n) {
-                bss = rb_entry(n, struct cfg80211_internal_bss, rbn);
-                r = cmp_hidden_bss(&res->pub, &bss->pub);
+        ies = rcu_access_pointer(new->pub.beacon_ies);
+        if (WARN_ON(!ies))
+                return false;
 
-                if (r == 0)
-                        return bss;
-                else if (r < 0)
-                        n = n->rb_left;
-                else
-                        n = n->rb_right;
+        ie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
+        if (!ie) {
+                /* nothing to do */
+                return true;
         }
 
-        return NULL;
-}
+        ssidlen = ie[1];
+        for (i = 0; i < ssidlen; i++)
+                fold |= ie[2 + i];
 
-static void
-copy_hidden_ies(struct cfg80211_internal_bss *res,
-                struct cfg80211_internal_bss *hidden)
-{
-        const struct cfg80211_bss_ies *ies;
+        if (fold) {
+                /* not a hidden SSID */
+                return true;
+        }
 
-        if (rcu_access_pointer(res->pub.beacon_ies))
-                return;
+        /* This is the bad part ... */
 
-        ies = rcu_access_pointer(hidden->pub.beacon_ies);
-        if (WARN_ON(!ies))
-                return;
+        list_for_each_entry(bss, &dev->bss_list, list) {
+                if (!ether_addr_equal(bss->pub.bssid, new->pub.bssid))
+                        continue;
+                if (bss->pub.channel != new->pub.channel)
+                        continue;
+                if (rcu_access_pointer(bss->pub.beacon_ies))
+                        continue;
+                ies = rcu_access_pointer(bss->pub.ies);
+                if (!ies)
+                        continue;
+                ie = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
+                if (!ie)
+                        continue;
+                if (ssidlen && ie[1] != ssidlen)
+                        continue;
+                /* that would be odd ... */
+                if (bss->pub.beacon_ies)
+                        continue;
+                if (WARN_ON_ONCE(bss->pub.hidden_beacon_bss))
+                        continue;
+                if (WARN_ON_ONCE(!list_empty(&bss->hidden_list)))
+                        list_del(&bss->hidden_list);
+                /* combine them */
+                list_add(&bss->hidden_list, &new->hidden_list);
+                bss->pub.hidden_beacon_bss = &new->pub;
+                new->refcount += bss->refcount;
+                rcu_assign_pointer(bss->pub.beacon_ies,
+                                   new->pub.beacon_ies);
+        }
 
-        ies = kmemdup(ies, sizeof(*ies) + ies->len, GFP_ATOMIC);
-        if (unlikely(!ies))
-                return;
-        rcu_assign_pointer(res->pub.beacon_ies, ies);
+        return true;
 }
 
 static struct cfg80211_internal_bss *
@@ -687,11 +695,10 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
                 return NULL;
         }
 
-        found = rb_find_bss(dev, tmp);
+        found = rb_find_bss(dev, tmp, BSS_CMP_REGULAR);
 
         if (found) {
                 found->pub.beacon_interval = tmp->pub.beacon_interval;
-                found->pub.tsf = tmp->pub.tsf;
                 found->pub.signal = tmp->pub.signal;
                 found->pub.capability = tmp->pub.capability;
                 found->ts = tmp->ts;
@@ -711,19 +718,45 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
                                 kfree_rcu((struct cfg80211_bss_ies *)old,
                                           rcu_head);
                 } else if (rcu_access_pointer(tmp->pub.beacon_ies)) {
-                        const struct cfg80211_bss_ies *old, *ies;
+                        const struct cfg80211_bss_ies *old;
+                        struct cfg80211_internal_bss *bss;
+
+                        if (found->pub.hidden_beacon_bss &&
+                            !list_empty(&found->hidden_list)) {
+                                /*
+                                 * The found BSS struct is one of the probe
+                                 * response members of a group, but we're
+                                 * receiving a beacon (beacon_ies in the tmp
+                                 * bss is used). This can only mean that the
+                                 * AP changed its beacon from not having an
+                                 * SSID to showing it, which is confusing so
+                                 * drop this information.
+                                 */
+                                goto drop;
+                        }
 
                         old = rcu_access_pointer(found->pub.beacon_ies);
-                        ies = rcu_access_pointer(found->pub.ies);
 
                         rcu_assign_pointer(found->pub.beacon_ies,
                                            tmp->pub.beacon_ies);
 
                         /* Override IEs if they were from a beacon before */
-                        if (old == ies)
+                        if (old == rcu_access_pointer(found->pub.ies))
                                 rcu_assign_pointer(found->pub.ies,
                                                    tmp->pub.beacon_ies);
 
+                        /* Assign beacon IEs to all sub entries */
+                        list_for_each_entry(bss, &found->hidden_list,
+                                            hidden_list) {
+                                const struct cfg80211_bss_ies *ies;
+
+                                ies = rcu_access_pointer(bss->pub.beacon_ies);
+                                WARN_ON(ies != old);
+
+                                rcu_assign_pointer(bss->pub.beacon_ies,
+                                                   tmp->pub.beacon_ies);
+                        }
+
                         if (old)
                                 kfree_rcu((struct cfg80211_bss_ies *)old,
                                           rcu_head);
@@ -733,19 +766,6 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
                 struct cfg80211_internal_bss *hidden;
                 struct cfg80211_bss_ies *ies;
 
-                /* First check if the beacon is a probe response from
-                 * a hidden bss. If so, copy beacon ies (with nullified
-                 * ssid) into the probe response bss entry (with real ssid).
-                 * It is required basically for PSM implementation
-                 * (probe responses do not contain tim ie) */
-
-                /* TODO: The code is not trying to update existing probe
-                 * response bss entries when beacon ies are
-                 * getting changed. */
-                hidden = rb_find_hidden_bss(dev, tmp);
-                if (hidden)
-                        copy_hidden_ies(tmp, hidden);
-
                 /*
                  * create a copy -- the "res" variable that is passed in
                  * is allocated on the stack since it's not needed in the
@@ -760,21 +780,51 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
                         ies = (void *)rcu_dereference(tmp->pub.proberesp_ies);
                         if (ies)
                                 kfree_rcu(ies, rcu_head);
-                        spin_unlock_bh(&dev->bss_lock);
-                        return NULL;
+                        goto drop;
                 }
                 memcpy(new, tmp, sizeof(*new));
-                kref_init(&new->ref);
+                new->refcount = 1;
+                INIT_LIST_HEAD(&new->hidden_list);
+
+                if (rcu_access_pointer(tmp->pub.proberesp_ies)) {
+                        hidden = rb_find_bss(dev, tmp, BSS_CMP_HIDE_ZLEN);
+                        if (!hidden)
+                                hidden = rb_find_bss(dev, tmp,
+                                                     BSS_CMP_HIDE_NUL);
+                        if (hidden) {
+                                new->pub.hidden_beacon_bss = &hidden->pub;
+                                list_add(&new->hidden_list,
+                                         &hidden->hidden_list);
+                                hidden->refcount++;
+                                rcu_assign_pointer(new->pub.beacon_ies,
+                                                   hidden->pub.beacon_ies);
+                        }
+                } else {
+                        /*
+                         * Ok so we found a beacon, and don't have an entry. If
+                         * it's a beacon with hidden SSID, we might be in for an
+                         * expensive search for any probe responses that should
+                         * be grouped with this beacon for updates ...
+                         */
+                        if (!cfg80211_combine_bsses(dev, new)) {
+                                kfree(new);
+                                goto drop;
+                        }
+                }
+
                 list_add_tail(&new->list, &dev->bss_list);
                 rb_insert_bss(dev, new);
                 found = new;
         }
 
         dev->bss_generation++;
+        bss_ref_get(dev, found);
         spin_unlock_bh(&dev->bss_lock);
 
-        kref_get(&found->ref);
         return found;
+ drop:
+        spin_unlock_bh(&dev->bss_lock);
+        return NULL;
 }
 
 static struct ieee80211_channel *
@@ -833,7 +883,6 @@ cfg80211_inform_bss(struct wiphy *wiphy,
         memcpy(tmp.pub.bssid, bssid, ETH_ALEN);
         tmp.pub.channel = channel;
         tmp.pub.signal = signal;
-        tmp.pub.tsf = tsf;
         tmp.pub.beacon_interval = beacon_interval;
         tmp.pub.capability = capability;
         /*
@@ -841,16 +890,14 @@ cfg80211_inform_bss(struct wiphy *wiphy,
          * Response frame, we need to pick one of the options and only use it
          * with the driver that does not provide the full Beacon/Probe Response
          * frame. Use Beacon frame pointer to avoid indicating that this should
-         * override the iies pointer should we have received an earlier
+         * override the IEs pointer should we have received an earlier
          * indication of Probe Response data.
-         *
-         * The initial buffer for the IEs is allocated with the BSS entry and
-         * is located after the private area.
          */
         ies = kmalloc(sizeof(*ies) + ielen, gfp);
         if (!ies)
                 return NULL;
         ies->len = ielen;
+        ies->tsf = tsf;
         memcpy(ies->data, ie, ielen);
 
         rcu_assign_pointer(tmp.pub.beacon_ies, ies);
@@ -907,6 +954,7 @@ cfg80211_inform_bss_frame(struct wiphy *wiphy,
         if (!ies)
                 return NULL;
         ies->len = ielen;
+        ies->tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
         memcpy(ies->data, mgmt->u.probe_resp.variable, ielen);
 
         if (ieee80211_is_probe_resp(mgmt->frame_control))
@@ -918,7 +966,6 @@ cfg80211_inform_bss_frame(struct wiphy *wiphy,
         memcpy(tmp.pub.bssid, mgmt->bssid, ETH_ALEN);
         tmp.pub.channel = channel;
         tmp.pub.signal = signal;
-        tmp.pub.tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
         tmp.pub.beacon_interval = le16_to_cpu(mgmt->u.probe_resp.beacon_int);
         tmp.pub.capability = le16_to_cpu(mgmt->u.probe_resp.capab_info);
 
@@ -935,27 +982,35 @@ cfg80211_inform_bss_frame(struct wiphy *wiphy,
 }
 EXPORT_SYMBOL(cfg80211_inform_bss_frame);
 
-void cfg80211_ref_bss(struct cfg80211_bss *pub)
+void cfg80211_ref_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
 {
+        struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
         struct cfg80211_internal_bss *bss;
 
         if (!pub)
                 return;
 
         bss = container_of(pub, struct cfg80211_internal_bss, pub);
-        kref_get(&bss->ref);
+
+        spin_lock_bh(&dev->bss_lock);
+        bss_ref_get(dev, bss);
+        spin_unlock_bh(&dev->bss_lock);
 }
 EXPORT_SYMBOL(cfg80211_ref_bss);
 
-void cfg80211_put_bss(struct cfg80211_bss *pub)
+void cfg80211_put_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
 {
+        struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
         struct cfg80211_internal_bss *bss;
 
         if (!pub)
                 return;
 
         bss = container_of(pub, struct cfg80211_internal_bss, pub);
-        kref_put(&bss->ref, bss_release);
+
+        spin_lock_bh(&dev->bss_lock);
+        bss_ref_put(dev, bss);
+        spin_unlock_bh(&dev->bss_lock);
 }
 EXPORT_SYMBOL(cfg80211_put_bss);
 
@@ -971,8 +1026,8 @@ void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
 
         spin_lock_bh(&dev->bss_lock);
         if (!list_empty(&bss->list)) {
-                __cfg80211_unlink_bss(dev, bss);
-                dev->bss_generation++;
+                if (__cfg80211_unlink_bss(dev, bss))
+                        dev->bss_generation++;
         }
         spin_unlock_bh(&dev->bss_lock);
 }
@@ -1155,16 +1210,6 @@ static void ieee80211_scan_add_ies(struct iw_request_info *info,
         }
 }
 
-static inline unsigned int elapsed_jiffies_msecs(unsigned long start)
-{
-        unsigned long end = jiffies;
-
-        if (end >= start)
-                return jiffies_to_msecs(end - start);
-
-        return jiffies_to_msecs(end + (MAX_JIFFY_OFFSET - start) + 1);
-}
-
 static char *
 ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
               struct cfg80211_internal_bss *bss, char *current_ev,
@@ -1241,15 +1286,10 @@ ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
 
         rcu_read_lock();
         ies = rcu_dereference(bss->pub.ies);
-        if (ies) {
-                rem = ies->len;
-                ie = ies->data;
-        } else {
-                rem = 0;
-                ie = NULL;
-        }
+        rem = ies->len;
+        ie = ies->data;
 
-        while (ies && rem >= 2) {
+        while (rem >= 2) {
                 /* invalid data */
                 if (ie[1] > rem - 2)
                         break;
@@ -1362,7 +1402,7 @@ ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
         if (buf) {
                 memset(&iwe, 0, sizeof(iwe));
                 iwe.cmd = IWEVCUSTOM;
-                sprintf(buf, "tsf=%016llx", (unsigned long long)(bss->pub.tsf));
+                sprintf(buf, "tsf=%016llx", (unsigned long long)(ies->tsf));
                 iwe.u.data.length = strlen(buf);
                 current_ev = iwe_stream_add_point(info, current_ev, end_buf,
                                                   &iwe, buf);
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index a825dfe12cf7..f432bd3755b1 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -301,7 +301,7 @@ static void __cfg80211_sme_scan_done(struct net_device *dev)
 
         bss = cfg80211_get_conn_bss(wdev);
         if (bss) {
-                cfg80211_put_bss(bss);
+                cfg80211_put_bss(&rdev->wiphy, bss);
         } else {
                 /* not found */
                 if (wdev->conn->state == CFG80211_CONN_SCAN_AGAIN)
@@ -464,7 +464,7 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
 
         if (wdev->current_bss) {
                 cfg80211_unhold_bss(wdev->current_bss);
-                cfg80211_put_bss(&wdev->current_bss->pub);
+                cfg80211_put_bss(wdev->wiphy, &wdev->current_bss->pub);
                 wdev->current_bss = NULL;
         }
 
@@ -480,7 +480,7 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
                 kfree(wdev->connect_keys);
                 wdev->connect_keys = NULL;
                 wdev->ssid_len = 0;
-                cfg80211_put_bss(bss);
+                cfg80211_put_bss(wdev->wiphy, bss);
                 return;
         }
 
@@ -586,7 +586,7 @@ void __cfg80211_roamed(struct wireless_dev *wdev,
         }
 
         cfg80211_unhold_bss(wdev->current_bss);
-        cfg80211_put_bss(&wdev->current_bss->pub);
+        cfg80211_put_bss(wdev->wiphy, &wdev->current_bss->pub);
         wdev->current_bss = NULL;
 
         cfg80211_hold_bss(bss_from_pub(bss));
@@ -621,7 +621,7 @@ void __cfg80211_roamed(struct wireless_dev *wdev,
 
         return;
 out:
-        cfg80211_put_bss(bss);
+        cfg80211_put_bss(wdev->wiphy, bss);
 }
 
 void cfg80211_roamed(struct net_device *dev,
@@ -663,7 +663,7 @@ void cfg80211_roamed_bss(struct net_device *dev,
 
         ev = kzalloc(sizeof(*ev) + req_ie_len + resp_ie_len, gfp);
         if (!ev) {
-                cfg80211_put_bss(bss);
+                cfg80211_put_bss(wdev->wiphy, bss);
                 return;
         }
 
@@ -704,7 +704,7 @@ void __cfg80211_disconnected(struct net_device *dev, const u8 *ie,
 
         if (wdev->current_bss) {
                 cfg80211_unhold_bss(wdev->current_bss);
-                cfg80211_put_bss(&wdev->current_bss->pub);
+                cfg80211_put_bss(wdev->wiphy, &wdev->current_bss->pub);
         }
 
         wdev->current_bss = NULL;
@@ -875,7 +875,7 @@ int __cfg80211_connect(struct cfg80211_registered_device *rdev,
                 if (bss) {
                         wdev->conn->state = CFG80211_CONN_AUTHENTICATE_NEXT;
                         err = cfg80211_conn_do_work(wdev);
-                        cfg80211_put_bss(bss);
+                        cfg80211_put_bss(wdev->wiphy, bss);
                 } else {
                         /* otherwise we'll need to scan for the AP first */
                         err = cfg80211_conn_scan(wdev);
diff --git a/net/wireless/sysfs.c b/net/wireless/sysfs.c
index 1f6f01e2dc4c..238ee49b3868 100644
--- a/net/wireless/sysfs.c
+++ b/net/wireless/sysfs.c
@@ -106,9 +106,7 @@ static int wiphy_resume(struct device *dev)
         int ret = 0;
 
         /* Age scan results with time spent in suspend */
-        spin_lock_bh(&rdev->bss_lock);
         cfg80211_bss_age(rdev, get_seconds() - rdev->suspend_at);
-        spin_unlock_bh(&rdev->bss_lock);
 
         if (rdev->ops->resume) {
                 rtnl_lock();
diff --git a/net/wireless/trace.h b/net/wireless/trace.h
index 8bc553199686..b7a531380e19 100644
--- a/net/wireless/trace.h
+++ b/net/wireless/trace.h
@@ -2051,6 +2051,21 @@ TRACE_EVENT(cfg80211_reg_can_beacon,
                   WIPHY_PR_ARG, CHAN_DEF_PR_ARG)
 );
 
+TRACE_EVENT(cfg80211_chandef_dfs_required,
+        TP_PROTO(struct wiphy *wiphy, struct cfg80211_chan_def *chandef),
+        TP_ARGS(wiphy, chandef),
+        TP_STRUCT__entry(
+                WIPHY_ENTRY
+                CHAN_DEF_ENTRY
+        ),
+        TP_fast_assign(
+                WIPHY_ASSIGN;
+                CHAN_DEF_ASSIGN(chandef);
+        ),
+        TP_printk(WIPHY_PR_FMT ", " CHAN_DEF_PR_FMT,
+                  WIPHY_PR_ARG, CHAN_DEF_PR_ARG)
+);
+
 TRACE_EVENT(cfg80211_ch_switch_notify,
         TP_PROTO(struct net_device *netdev,
                  struct cfg80211_chan_def *chandef),
@@ -2067,6 +2082,36 @@ TRACE_EVENT(cfg80211_ch_switch_notify,
                   NETDEV_PR_ARG, CHAN_DEF_PR_ARG)
 );
 
+TRACE_EVENT(cfg80211_radar_event,
+        TP_PROTO(struct wiphy *wiphy, struct cfg80211_chan_def *chandef),
+        TP_ARGS(wiphy, chandef),
+        TP_STRUCT__entry(
+                WIPHY_ENTRY
+                CHAN_DEF_ENTRY
+        ),
+        TP_fast_assign(
+                WIPHY_ASSIGN;
+                CHAN_DEF_ASSIGN(chandef);
+        ),
+        TP_printk(WIPHY_PR_FMT ", " CHAN_DEF_PR_FMT,
+                  WIPHY_PR_ARG, CHAN_DEF_PR_ARG)
+);
+
+TRACE_EVENT(cfg80211_cac_event,
+        TP_PROTO(struct net_device *netdev, enum nl80211_radar_event evt),
+        TP_ARGS(netdev, evt),
+        TP_STRUCT__entry(
+                NETDEV_ENTRY
+                __field(enum nl80211_radar_event, evt)
+        ),
+        TP_fast_assign(
+                NETDEV_ASSIGN;
+                __entry->evt = evt;
+        ),
+        TP_printk(NETDEV_PR_FMT ",  event: %d",
+                  NETDEV_PR_ARG, __entry->evt)
+);
+
 DECLARE_EVENT_CLASS(cfg80211_rx_evt,
         TP_PROTO(struct net_device *netdev, const u8 *addr),
         TP_ARGS(netdev, addr),
@@ -2333,6 +2378,41 @@ TRACE_EVENT(cfg80211_return_u32,
         TP_printk("ret: %u", __entry->ret)
 );
 
+TRACE_EVENT(cfg80211_report_wowlan_wakeup,
+        TP_PROTO(struct wiphy *wiphy, struct wireless_dev *wdev,
+                 struct cfg80211_wowlan_wakeup *wakeup),
+        TP_ARGS(wiphy, wdev, wakeup),
+        TP_STRUCT__entry(
+                WIPHY_ENTRY
+                WDEV_ENTRY
+                __field(bool, disconnect)
+                __field(bool, magic_pkt)
+                __field(bool, gtk_rekey_failure)
+                __field(bool, eap_identity_req)
+                __field(bool, four_way_handshake)
+                __field(bool, rfkill_release)
+                __field(s32, pattern_idx)
+                __field(u32, packet_len)
+                __dynamic_array(u8, packet, wakeup->packet_present_len)
+        ),
+        TP_fast_assign(
+                WIPHY_ASSIGN;
+                WDEV_ASSIGN;
+                __entry->disconnect = wakeup->disconnect;
+                __entry->magic_pkt = wakeup->magic_pkt;
+                __entry->gtk_rekey_failure = wakeup->gtk_rekey_failure;
+                __entry->eap_identity_req = wakeup->eap_identity_req;
+                __entry->four_way_handshake = wakeup->four_way_handshake;
+                __entry->rfkill_release = wakeup->rfkill_release;
+                __entry->pattern_idx = wakeup->pattern_idx;
+                __entry->packet_len = wakeup->packet_len;
+                if (wakeup->packet && wakeup->packet_present_len)
+                        memcpy(__get_dynamic_array(packet), wakeup->packet,
+                               wakeup->packet_present_len);
+        ),
+        TP_printk(WIPHY_PR_FMT ", " WDEV_PR_FMT, WIPHY_PR_ARG, WDEV_PR_ARG)
+);
+
 #endif /* !__RDEV_OPS_TRACE || TRACE_HEADER_MULTI_READ */
 
 #undef TRACE_INCLUDE_PATH
diff --git a/net/wireless/util.c b/net/wireless/util.c
index d7873c7ae0ec..37a56ee1e1ed 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -1217,10 +1217,10 @@ int cfg80211_can_use_iftype_chan(struct cfg80211_registered_device *rdev,
                 break;
         case NL80211_IFTYPE_P2P_CLIENT:
         case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_P2P_DEVICE:
         case NL80211_IFTYPE_MONITOR:
                 radar_required = false;
                 break;
-        case NL80211_IFTYPE_P2P_DEVICE:
         case NUM_NL80211_IFTYPES:
         case NL80211_IFTYPE_UNSPECIFIED:
         default: