Merge remote-tracking branch 'wireless-next/master' into ath-next

190 files changed, 4382 insertions, 2773 deletions

diff --git a/Documentation/DocBook/80211.tmpl b/Documentation/DocBook/80211.tmpl
index 044b76436e83..d9b9416c989f 100644
--- a/Documentation/DocBook/80211.tmpl
+++ b/Documentation/DocBook/80211.tmpl
@@ -100,6 +100,7 @@
 !Finclude/net/cfg80211.h wdev_priv
 !Finclude/net/cfg80211.h ieee80211_iface_limit
 !Finclude/net/cfg80211.h ieee80211_iface_combination
+!Finclude/net/cfg80211.h cfg80211_check_combinations
       </chapter>
       <chapter>
       <title>Actions and configuration</title>
diff --git a/MAINTAINERS b/MAINTAINERS
index 6dc67b1fdb50..a80a586cbdcd 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -7277,7 +7277,6 @@ F:	drivers/video/aty/aty128fb.c
 RALINK RT2X00 WIRELESS LAN DRIVER
 P:      rt2x00 project
 M:      Ivo van Doorn <IvDoorn@gmail.com>
-M:      Gertjan van Wingerde <gwingerde@gmail.com>
 M:      Helmut Schaa <helmut.schaa@googlemail.com>
 L:      linux-wireless@vger.kernel.org
 L:      users@rt2x00.serialmonkey.com (moderated for non-subscribers)
diff --git a/arch/arm/mach-tegra/board-paz00.c b/arch/arm/mach-tegra/board-paz00.c
index e4dec9fcb084..9c6029ba526f 100644
--- a/arch/arm/mach-tegra/board-paz00.c
+++ b/arch/arm/mach-tegra/board-paz00.c
@@ -23,9 +23,7 @@
 #include "board.h"
 
 static struct rfkill_gpio_platform_data wifi_rfkill_platform_data = {
-        .name           = "wifi_rfkill",
-        .reset_gpio     = 25, /* PD1 */
-        .shutdown_gpio  = 85, /* PK5 */
+        .name   = "wifi_rfkill",
         .type   = RFKILL_TYPE_WLAN,
 };
 
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index be571fef185d..a83b57e57b63 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -82,6 +82,7 @@ static const struct usb_device_id ath3k_table[] = {
         { USB_DEVICE(0x04CA, 0x3004) },
         { USB_DEVICE(0x04CA, 0x3005) },
         { USB_DEVICE(0x04CA, 0x3006) },
+        { USB_DEVICE(0x04CA, 0x3007) },
         { USB_DEVICE(0x04CA, 0x3008) },
         { USB_DEVICE(0x04CA, 0x300b) },
         { USB_DEVICE(0x0930, 0x0219) },
@@ -131,6 +132,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = {
         { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
diff --git a/drivers/bluetooth/btmrvl_drv.h b/drivers/bluetooth/btmrvl_drv.h
index 7399303d7d99..dc79f88f8717 100644
--- a/drivers/bluetooth/btmrvl_drv.h
+++ b/drivers/bluetooth/btmrvl_drv.h
@@ -59,6 +59,8 @@ struct btmrvl_device {
 };
 
 struct btmrvl_adapter {
+        void *hw_regs_buf;
+        u8 *hw_regs;
         u32 int_count;
         struct sk_buff_head tx_queue;
         u8 psmode;
@@ -140,7 +142,7 @@ void btmrvl_interrupt(struct btmrvl_private *priv);
 bool btmrvl_check_evtpkt(struct btmrvl_private *priv, struct sk_buff *skb);
 int btmrvl_process_event(struct btmrvl_private *priv, struct sk_buff *skb);
 
-int btmrvl_send_module_cfg_cmd(struct btmrvl_private *priv, int subcmd);
+int btmrvl_send_module_cfg_cmd(struct btmrvl_private *priv, u8 subcmd);
 int btmrvl_send_hscfg_cmd(struct btmrvl_private *priv);
 int btmrvl_enable_ps(struct btmrvl_private *priv);
 int btmrvl_prepare_command(struct btmrvl_private *priv);
diff --git a/drivers/bluetooth/btmrvl_main.c b/drivers/bluetooth/btmrvl_main.c
index 2c4997ce2484..e9dbddb0b8f1 100644
--- a/drivers/bluetooth/btmrvl_main.c
+++ b/drivers/bluetooth/btmrvl_main.c
@@ -24,6 +24,7 @@
 #include <net/bluetooth/hci_core.h>
 
 #include "btmrvl_drv.h"
+#include "btmrvl_sdio.h"
 
 #define VERSION "1.0"
 
@@ -201,7 +202,7 @@ static int btmrvl_send_sync_cmd(struct btmrvl_private *priv, u16 opcode,
         return 0;
 }
 
-int btmrvl_send_module_cfg_cmd(struct btmrvl_private *priv, int subcmd)
+int btmrvl_send_module_cfg_cmd(struct btmrvl_private *priv, u8 subcmd)
 {
         int ret;
 
@@ -337,10 +338,25 @@ static int btmrvl_tx_pkt(struct btmrvl_private *priv, struct sk_buff *skb)
 
 static void btmrvl_init_adapter(struct btmrvl_private *priv)
 {
+        int buf_size;
+
         skb_queue_head_init(&priv->adapter->tx_queue);
 
         priv->adapter->ps_state = PS_AWAKE;
 
+        buf_size = ALIGN_SZ(SDIO_BLOCK_SIZE, BTSDIO_DMA_ALIGN);
+        priv->adapter->hw_regs_buf = kzalloc(buf_size, GFP_KERNEL);
+        if (!priv->adapter->hw_regs_buf) {
+                priv->adapter->hw_regs = NULL;
+                BT_ERR("Unable to allocate buffer for hw_regs.");
+        } else {
+                priv->adapter->hw_regs =
+                        (u8 *)ALIGN_ADDR(priv->adapter->hw_regs_buf,
+                                         BTSDIO_DMA_ALIGN);
+                BT_DBG("hw_regs_buf=%p hw_regs=%p",
+                       priv->adapter->hw_regs_buf, priv->adapter->hw_regs);
+        }
+
         init_waitqueue_head(&priv->adapter->cmd_wait_q);
 }
 
@@ -348,6 +364,7 @@ static void btmrvl_free_adapter(struct btmrvl_private *priv)
 {
         skb_queue_purge(&priv->adapter->tx_queue);
 
+        kfree(priv->adapter->hw_regs_buf);
         kfree(priv->adapter);
 
         priv->adapter = NULL;
diff --git a/drivers/bluetooth/btmrvl_sdio.c b/drivers/bluetooth/btmrvl_sdio.c
index 1b52c9f5230d..9dedca516ff5 100644
--- a/drivers/bluetooth/btmrvl_sdio.c
+++ b/drivers/bluetooth/btmrvl_sdio.c
@@ -64,6 +64,7 @@ static const struct btmrvl_sdio_card_reg btmrvl_reg_8688 = {
         .io_port_0 = 0x00,
         .io_port_1 = 0x01,
         .io_port_2 = 0x02,
+        .int_read_to_clear = false,
 };
 static const struct btmrvl_sdio_card_reg btmrvl_reg_87xx = {
         .cfg = 0x00,
@@ -80,6 +81,7 @@ static const struct btmrvl_sdio_card_reg btmrvl_reg_87xx = {
         .io_port_0 = 0x78,
         .io_port_1 = 0x79,
         .io_port_2 = 0x7a,
+        .int_read_to_clear = false,
 };
 
 static const struct btmrvl_sdio_card_reg btmrvl_reg_88xx = {
@@ -97,6 +99,9 @@ static const struct btmrvl_sdio_card_reg btmrvl_reg_88xx = {
         .io_port_0 = 0xd8,
         .io_port_1 = 0xd9,
         .io_port_2 = 0xda,
+        .int_read_to_clear = true,
+        .host_int_rsr = 0x01,
+        .card_misc_cfg = 0xcc,
 };
 
 static const struct btmrvl_sdio_device btmrvl_sdio_sd8688 = {
@@ -667,46 +672,78 @@ static int btmrvl_sdio_process_int_status(struct btmrvl_private *priv)
         return 0;
 }
 
-static void btmrvl_sdio_interrupt(struct sdio_func *func)
+static int btmrvl_sdio_read_to_clear(struct btmrvl_sdio_card *card, u8 *ireg)
 {
-        struct btmrvl_private *priv;
-        struct btmrvl_sdio_card *card;
-        ulong flags;
-        u8 ireg = 0;
+        struct btmrvl_adapter *adapter = card->priv->adapter;
         int ret;
 
-        card = sdio_get_drvdata(func);
-        if (!card || !card->priv) {
-                BT_ERR("sbi_interrupt(%p) card or priv is "
-                                "NULL, card=%p\n", func, card);
-                return;
+        ret = sdio_readsb(card->func, adapter->hw_regs, 0, SDIO_BLOCK_SIZE);
+        if (ret) {
+                BT_ERR("sdio_readsb: read int hw_regs failed: %d", ret);
+                return ret;
         }
 
-        priv = card->priv;
+        *ireg = adapter->hw_regs[card->reg->host_intstatus];
+        BT_DBG("hw_regs[%#x]=%#x", card->reg->host_intstatus, *ireg);
+
+        return 0;
+}
 
-        ireg = sdio_readb(card->func, card->reg->host_intstatus, &ret);
+static int btmrvl_sdio_write_to_clear(struct btmrvl_sdio_card *card, u8 *ireg)
+{
+        int ret;
+
+        *ireg = sdio_readb(card->func, card->reg->host_intstatus, &ret);
         if (ret) {
-                BT_ERR("sdio_readb: read int status register failed");
-                return;
+                BT_ERR("sdio_readb: read int status failed: %d", ret);
+                return ret;
         }
 
-        if (ireg != 0) {
+        if (*ireg) {
                 /*
                  * DN_LD_HOST_INT_STATUS and/or UP_LD_HOST_INT_STATUS
                  * Clear the interrupt status register and re-enable the
                  * interrupt.
                  */
-                BT_DBG("ireg = 0x%x", ireg);
+                BT_DBG("int_status = 0x%x", *ireg);
 
-                sdio_writeb(card->func, ~(ireg) & (DN_LD_HOST_INT_STATUS |
-                                        UP_LD_HOST_INT_STATUS),
-                                card->reg->host_intstatus, &ret);
+                sdio_writeb(card->func, ~(*ireg) & (DN_LD_HOST_INT_STATUS |
+                                                    UP_LD_HOST_INT_STATUS),
+                            card->reg->host_intstatus, &ret);
                 if (ret) {
-                        BT_ERR("sdio_writeb: clear int status register failed");
-                        return;
+                        BT_ERR("sdio_writeb: clear int status failed: %d", ret);
+                        return ret;
                 }
         }
 
+        return 0;
+}
+
+static void btmrvl_sdio_interrupt(struct sdio_func *func)
+{
+        struct btmrvl_private *priv;
+        struct btmrvl_sdio_card *card;
+        ulong flags;
+        u8 ireg = 0;
+        int ret;
+
+        card = sdio_get_drvdata(func);
+        if (!card || !card->priv) {
+                BT_ERR("sbi_interrupt(%p) card or priv is "
+                                "NULL, card=%p\n", func, card);
+                return;
+        }
+
+        priv = card->priv;
+
+        if (card->reg->int_read_to_clear)
+                ret = btmrvl_sdio_read_to_clear(card, &ireg);
+        else
+                ret = btmrvl_sdio_write_to_clear(card, &ireg);
+
+        if (ret)
+                return;
+
         spin_lock_irqsave(&priv->driver_lock, flags);
         sdio_ireg |= ireg;
         spin_unlock_irqrestore(&priv->driver_lock, flags);
@@ -777,6 +814,30 @@ static int btmrvl_sdio_register_dev(struct btmrvl_sdio_card *card)
 
         BT_DBG("SDIO FUNC%d IO port: 0x%x", func->num, card->ioport);
 
+        if (card->reg->int_read_to_clear) {
+                reg = sdio_readb(func, card->reg->host_int_rsr, &ret);
+                if (ret < 0) {
+                        ret = -EIO;
+                        goto release_irq;
+                }
+                sdio_writeb(func, reg | 0x3f, card->reg->host_int_rsr, &ret);
+                if (ret < 0) {
+                        ret = -EIO;
+                        goto release_irq;
+                }
+
+                reg = sdio_readb(func, card->reg->card_misc_cfg, &ret);
+                if (ret < 0) {
+                        ret = -EIO;
+                        goto release_irq;
+                }
+                sdio_writeb(func, reg | 0x10, card->reg->card_misc_cfg, &ret);
+                if (ret < 0) {
+                        ret = -EIO;
+                        goto release_irq;
+                }
+        }
+
         sdio_set_drvdata(func, card);
 
         sdio_release_host(func);
diff --git a/drivers/bluetooth/btmrvl_sdio.h b/drivers/bluetooth/btmrvl_sdio.h
index 43d35a609ca9..d4dd3b0fa53d 100644
--- a/drivers/bluetooth/btmrvl_sdio.h
+++ b/drivers/bluetooth/btmrvl_sdio.h
@@ -78,6 +78,9 @@ struct btmrvl_sdio_card_reg {
         u8 io_port_0;
         u8 io_port_1;
         u8 io_port_2;
+        bool int_read_to_clear;
+        u8 host_int_rsr;
+        u8 card_misc_cfg;
 };
 
 struct btmrvl_sdio_card {
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index f338b0c5a8de..a7dfbf9a3afb 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -152,6 +152,7 @@ static const struct usb_device_id blacklist_table[] = {
         { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
@@ -1485,10 +1486,8 @@ static int btusb_probe(struct usb_interface *intf,
         if (id->driver_info & BTUSB_BCM92035)
                 hdev->setup = btusb_setup_bcm92035;
 
-        if (id->driver_info & BTUSB_INTEL) {
-                usb_enable_autosuspend(data->udev);
+        if (id->driver_info & BTUSB_INTEL)
                 hdev->setup = btusb_setup_intel;
-        }
 
         /* Interface numbers are hardcoded in the specification */
         data->isoc = usb_ifnum_to_if(data->udev, 1);
diff --git a/drivers/bluetooth/hci_h4.c b/drivers/bluetooth/hci_h4.c
index 7048a583fe51..66db9a803373 100644
--- a/drivers/bluetooth/hci_h4.c
+++ b/drivers/bluetooth/hci_h4.c
@@ -55,13 +55,6 @@ struct h4_struct {
         struct sk_buff_head txq;
 };
 
-/* H4 receiver States */
-#define H4_W4_PACKET_TYPE       0
-#define H4_W4_EVENT_HDR         1
-#define H4_W4_ACL_HDR           2
-#define H4_W4_SCO_HDR           3
-#define H4_W4_DATA              4
-
 /* Initialize protocol */
 static int h4_open(struct hci_uart *hu)
 {
diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireless/ath/ar5523/ar5523.c
index 507d9a9ee69a..f92050617ae6 100644
--- a/drivers/net/wireless/ath/ar5523/ar5523.c
+++ b/drivers/net/wireless/ath/ar5523/ar5523.c
@@ -1090,7 +1090,8 @@ static int ar5523_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
         return ret;
 }
 
-static void ar5523_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
+static void ar5523_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                         u32 queues, bool drop)
 {
         struct ar5523 *ar = hw->priv;
 
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index e2c01dc5900c..7026f021ccbb 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -3651,7 +3651,8 @@ static int ath10k_set_frag_threshold(struct ieee80211_hw *hw, u32 value)
         return ret;
 }
 
-static void ath10k_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
+static void ath10k_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                         u32 queues, bool drop)
 {
         struct ath10k *ar = hw->priv;
         bool skip;
diff --git a/drivers/net/wireless/ath/ath5k/phy.c b/drivers/net/wireless/ath/ath5k/phy.c
index 1a2973b7acf2..0fce1c76638e 100644
--- a/drivers/net/wireless/ath/ath5k/phy.c
+++ b/drivers/net/wireless/ath/ath5k/phy.c
@@ -3709,8 +3709,8 @@ ath5k_hw_txpower(struct ath5k_hw *ah, struct ieee80211_channel *channel,
                         AR5K_REG_MS(AR5K_TUNE_MAX_TXPOWER, AR5K_TPC_CHIRP),
                         AR5K_TPC);
         } else {
-                ath5k_hw_reg_write(ah, AR5K_PHY_TXPOWER_RATE_MAX |
-                        AR5K_TUNE_MAX_TXPOWER, AR5K_PHY_TXPOWER_RATE_MAX);
+                ath5k_hw_reg_write(ah, AR5K_TUNE_MAX_TXPOWER,
+                        AR5K_PHY_TXPOWER_RATE_MAX);
         }
 
         return 0;
diff --git a/drivers/net/wireless/ath/ath9k/Makefile b/drivers/net/wireless/ath/ath9k/Makefile
index 8e1c7b0fe76c..8fcd586d1c39 100644
--- a/drivers/net/wireless/ath/ath9k/Makefile
+++ b/drivers/net/wireless/ath/ath9k/Makefile
@@ -53,7 +53,8 @@ obj-$(CONFIG_ATH9K_HW) += ath9k_hw.o
 obj-$(CONFIG_ATH9K_COMMON) += ath9k_common.o
 ath9k_common-y:=        common.o \
                         common-init.o \
-                        common-beacon.o
+                        common-beacon.o \
+                        common-debug.o
 
 ath9k_htc-y +=  htc_hst.o \
                 hif_usb.o \
diff --git a/drivers/net/wireless/ath/ath9k/ahb.c b/drivers/net/wireless/ath/ath9k/ahb.c
index a0398fe3eb28..be3eb2a8d602 100644
--- a/drivers/net/wireless/ath/ath9k/ahb.c
+++ b/drivers/net/wireless/ath/ath9k/ahb.c
@@ -86,7 +86,6 @@ static int ath_ahb_probe(struct platform_device *pdev)
         int irq;
         int ret = 0;
         struct ath_hw *ah;
-        struct ath_common *common;
         char hw_name[64];
 
         if (!dev_get_platdata(&pdev->dev)) {
@@ -146,9 +145,6 @@ static int ath_ahb_probe(struct platform_device *pdev)
         wiphy_info(hw->wiphy, "%s mem=0x%lx, irq=%d\n",
                    hw_name, (unsigned long)mem, irq);
 
-        common = ath9k_hw_common(sc->sc_ah);
-        /* Will be cleared in ath9k_start() */
-        set_bit(ATH_OP_INVALID, &common->op_flags);
         return 0;
 
  err_irq:
diff --git a/drivers/net/wireless/ath/ath9k/ani.c b/drivers/net/wireless/ath/ath9k/ani.c
index 6d47783f2e5b..ba502a2d199b 100644
--- a/drivers/net/wireless/ath/ath9k/ani.c
+++ b/drivers/net/wireless/ath/ath9k/ani.c
@@ -155,6 +155,9 @@ static void ath9k_hw_set_ofdm_nil(struct ath_hw *ah, u8 immunityLevel,
                 ATH9K_ANI_RSSI_THR_LOW,
                 ATH9K_ANI_RSSI_THR_HIGH);
 
+        if (AR_SREV_9100(ah) && immunityLevel < ATH9K_ANI_OFDM_DEF_LEVEL)
+                immunityLevel = ATH9K_ANI_OFDM_DEF_LEVEL;
+
         if (!scan)
                 aniState->ofdmNoiseImmunityLevel = immunityLevel;
 
@@ -235,6 +238,9 @@ static void ath9k_hw_set_cck_nil(struct ath_hw *ah, u_int8_t immunityLevel,
                 BEACON_RSSI(ah), ATH9K_ANI_RSSI_THR_LOW,
                 ATH9K_ANI_RSSI_THR_HIGH);
 
+        if (AR_SREV_9100(ah) && immunityLevel < ATH9K_ANI_CCK_DEF_LEVEL)
+                immunityLevel = ATH9K_ANI_CCK_DEF_LEVEL;
+
         if (ah->opmode == NL80211_IFTYPE_STATION &&
             BEACON_RSSI(ah) <= ATH9K_ANI_RSSI_THR_LOW &&
             immunityLevel > ATH9K_ANI_CCK_MAX_LEVEL_LOW_RSSI)
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h b/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
index 0a6163e9248c..c38399bc9aa9 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
@@ -410,7 +410,7 @@ static const u32 ar9300_2p2_baseband_core[][2] = {
         {0x00009e30, 0x06336f77},
         {0x00009e34, 0x6af6532f},
         {0x00009e38, 0x0cc80c00},
-        {0x00009e40, 0x0d261820},
+        {0x00009e40, 0x0d261800},
         {0x00009e4c, 0x00001004},
         {0x00009e50, 0x00ff03f1},
         {0x00009e54, 0x00000000},
diff --git a/drivers/net/wireless/ath/ath9k/ar9330_1p1_initvals.h b/drivers/net/wireless/ath/ath9k/ar9330_1p1_initvals.h
index f76139bbb74f..2c42ff05efa3 100644
--- a/drivers/net/wireless/ath/ath9k/ar9330_1p1_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9330_1p1_initvals.h
@@ -592,7 +592,7 @@ static const u32 ar9331_1p1_baseband_core[][2] = {
         {0x00009e30, 0x06336f77},
         {0x00009e34, 0x6af6532f},
         {0x00009e38, 0x0cc80c00},
-        {0x00009e40, 0x0d261820},
+        {0x00009e40, 0x0d261800},
         {0x00009e4c, 0x00001004},
         {0x00009e50, 0x00ff03f1},
         {0x00009fc0, 0x803e4788},
diff --git a/drivers/net/wireless/ath/ath9k/ar9330_1p2_initvals.h b/drivers/net/wireless/ath/ath9k/ar9330_1p2_initvals.h
index 0ac8be96097f..2154efcd3900 100644
--- a/drivers/net/wireless/ath/ath9k/ar9330_1p2_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9330_1p2_initvals.h
@@ -231,7 +231,7 @@ static const u32 ar9331_1p2_baseband_core[][2] = {
         {0x00009e30, 0x06336f77},
         {0x00009e34, 0x6af6532f},
         {0x00009e38, 0x0cc80c00},
-        {0x00009e40, 0x0d261820},
+        {0x00009e40, 0x0d261800},
         {0x00009e4c, 0x00001004},
         {0x00009e50, 0x00ff03f1},
         {0x00009fc0, 0x803e4788},
diff --git a/drivers/net/wireless/ath/ath9k/ar9340_initvals.h b/drivers/net/wireless/ath/ath9k/ar9340_initvals.h
index a01f0edb6518..b995ffe88b33 100644
--- a/drivers/net/wireless/ath/ath9k/ar9340_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9340_initvals.h
@@ -318,7 +318,7 @@ static const u32 ar9340_1p0_baseband_core[][2] = {
         {0x00009e30, 0x06336f77},
         {0x00009e34, 0x6af6532f},
         {0x00009e38, 0x0cc80c00},
-        {0x00009e40, 0x0d261820},
+        {0x00009e40, 0x0d261800},
         {0x00009e4c, 0x00001004},
         {0x00009e50, 0x00ff03f1},
         {0x00009e54, 0x00000000},
@@ -348,9 +348,9 @@ static const u32 ar9340_1p0_baseband_core[][2] = {
         {0x0000a370, 0x00000000},
         {0x0000a390, 0x00000001},
         {0x0000a394, 0x00000444},
-        {0x0000a398, 0x00000000},
-        {0x0000a39c, 0x210d0401},
-        {0x0000a3a0, 0xab9a7144},
+        {0x0000a398, 0x001f0e0f},
+        {0x0000a39c, 0x0075393f},
+        {0x0000a3a0, 0xb79f6427},
         {0x0000a3a4, 0x00000000},
         {0x0000a3a8, 0xaaaaaaaa},
         {0x0000a3ac, 0x3c466478},
diff --git a/drivers/net/wireless/ath/ath9k/ar953x_initvals.h b/drivers/net/wireless/ath/ath9k/ar953x_initvals.h
index 3c9113d9b1bc..8e5c3b9786e3 100644
--- a/drivers/net/wireless/ath/ath9k/ar953x_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar953x_initvals.h
@@ -257,9 +257,9 @@ static const u32 qca953x_1p0_baseband_core[][2] = {
         {0x0000a370, 0x00000000},
         {0x0000a390, 0x00000001},
         {0x0000a394, 0x00000444},
-        {0x0000a398, 0x1f020503},
-        {0x0000a39c, 0x29180c03},
-        {0x0000a3a0, 0x9a8b6844},
+        {0x0000a398, 0x001f0e0f},
+        {0x0000a39c, 0x0075393f},
+        {0x0000a3a0, 0xb79f6427},
         {0x0000a3a4, 0x000000ff},
         {0x0000a3a8, 0x6a6a6a6a},
         {0x0000a3ac, 0x6a6a6a6a},
diff --git a/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h b/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h
index e6aec2c0207f..a5ca65240af3 100644
--- a/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h
@@ -90,7 +90,7 @@ static const u32 ar9580_1p0_baseband_core[][2] = {
         {0x00009e30, 0x06336f77},
         {0x00009e34, 0x6af6532f},
         {0x00009e38, 0x0cc80c00},
-        {0x00009e40, 0x0d261820},
+        {0x00009e40, 0x0d261800},
         {0x00009e4c, 0x00001004},
         {0x00009e50, 0x00ff03f1},
         {0x00009e54, 0x00000000},
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 05935f638525..20dd344bf645 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -23,8 +23,8 @@
 #include <linux/leds.h>
 #include <linux/completion.h>
 
-#include "debug.h"
 #include "common.h"
+#include "debug.h"
 #include "mci.h"
 #include "dfs.h"
 #include "spectral.h"
@@ -254,7 +254,6 @@ struct ath_atx_tid {
 
         s8 bar_index;
         bool sched;
-        bool paused;
         bool active;
 };
 
diff --git a/drivers/net/wireless/ath/ath9k/beacon.c b/drivers/net/wireless/ath/ath9k/beacon.c
index bd9e634879e6..e387f0b2954a 100644
--- a/drivers/net/wireless/ath/ath9k/beacon.c
+++ b/drivers/net/wireless/ath/ath9k/beacon.c
@@ -537,8 +537,6 @@ static void ath9k_cache_beacon_config(struct ath_softc *sc,
         cur_conf->dtim_period = bss_conf->dtim_period;
         cur_conf->dtim_count = 1;
         cur_conf->ibss_creator = bss_conf->ibss_creator;
-        cur_conf->bmiss_timeout =
-                ATH_DEFAULT_BMISS_LIMIT * cur_conf->beacon_interval;
 
         /*
          * It looks like mac80211 may end up using beacon interval of zero in
@@ -549,6 +547,9 @@ static void ath9k_cache_beacon_config(struct ath_softc *sc,
         if (cur_conf->beacon_interval == 0)
                 cur_conf->beacon_interval = 100;
 
+        cur_conf->bmiss_timeout =
+                ATH_DEFAULT_BMISS_LIMIT * cur_conf->beacon_interval;
+
         /*
          * We don't parse dtim period from mac80211 during the driver
          * initialization as it breaks association with hidden-ssid
diff --git a/drivers/net/wireless/ath/ath9k/common-debug.c b/drivers/net/wireless/ath/ath9k/common-debug.c
new file mode 100644
index 000000000000..3b289f933405
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/common-debug.c
@@ -0,0 +1,253 @@
+/*
+ * Copyright (c) 2008-2011 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "common.h"
+
+static ssize_t read_file_modal_eeprom(struct file *file, char __user *user_buf,
+                                      size_t count, loff_t *ppos)
+{
+        struct ath_hw *ah = file->private_data;
+        u32 len = 0, size = 6000;
+        char *buf;
+        size_t retval;
+
+        buf = kzalloc(size, GFP_KERNEL);
+        if (buf == NULL)
+                return -ENOMEM;
+
+        len = ah->eep_ops->dump_eeprom(ah, false, buf, len, size);
+
+        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
+        kfree(buf);
+
+        return retval;
+}
+
+static const struct file_operations fops_modal_eeprom = {
+        .read = read_file_modal_eeprom,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+
+void ath9k_cmn_debug_modal_eeprom(struct dentry *debugfs_phy,
+                                  struct ath_hw *ah)
+{
+        debugfs_create_file("modal_eeprom", S_IRUSR, debugfs_phy, ah,
+                            &fops_modal_eeprom);
+}
+EXPORT_SYMBOL(ath9k_cmn_debug_modal_eeprom);
+
+static ssize_t read_file_base_eeprom(struct file *file, char __user *user_buf,
+                                     size_t count, loff_t *ppos)
+{
+        struct ath_hw *ah = file->private_data;
+        u32 len = 0, size = 1500;
+        ssize_t retval = 0;
+        char *buf;
+
+        buf = kzalloc(size, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        len = ah->eep_ops->dump_eeprom(ah, true, buf, len, size);
+
+        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
+        kfree(buf);
+
+        return retval;
+}
+
+static const struct file_operations fops_base_eeprom = {
+        .read = read_file_base_eeprom,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+void ath9k_cmn_debug_base_eeprom(struct dentry *debugfs_phy,
+                                 struct ath_hw *ah)
+{
+        debugfs_create_file("base_eeprom", S_IRUSR, debugfs_phy, ah,
+                            &fops_base_eeprom);
+}
+EXPORT_SYMBOL(ath9k_cmn_debug_base_eeprom);
+
+void ath9k_cmn_debug_stat_rx(struct ath_rx_stats *rxstats,
+                             struct ath_rx_status *rs)
+{
+#define RX_PHY_ERR_INC(c) rxstats->phy_err_stats[c]++
+#define RX_CMN_STAT_INC(c) (rxstats->c++)
+
+        RX_CMN_STAT_INC(rx_pkts_all);
+        rxstats->rx_bytes_all += rs->rs_datalen;
+
+        if (rs->rs_status & ATH9K_RXERR_CRC)
+                RX_CMN_STAT_INC(crc_err);
+        if (rs->rs_status & ATH9K_RXERR_DECRYPT)
+                RX_CMN_STAT_INC(decrypt_crc_err);
+        if (rs->rs_status & ATH9K_RXERR_MIC)
+                RX_CMN_STAT_INC(mic_err);
+        if (rs->rs_status & ATH9K_RX_DELIM_CRC_PRE)
+                RX_CMN_STAT_INC(pre_delim_crc_err);
+        if (rs->rs_status & ATH9K_RX_DELIM_CRC_POST)
+                RX_CMN_STAT_INC(post_delim_crc_err);
+        if (rs->rs_status & ATH9K_RX_DECRYPT_BUSY)
+                RX_CMN_STAT_INC(decrypt_busy_err);
+
+        if (rs->rs_status & ATH9K_RXERR_PHY) {
+                RX_CMN_STAT_INC(phy_err);
+                if (rs->rs_phyerr < ATH9K_PHYERR_MAX)
+                        RX_PHY_ERR_INC(rs->rs_phyerr);
+        }
+
+#undef RX_CMN_STAT_INC
+#undef RX_PHY_ERR_INC
+}
+EXPORT_SYMBOL(ath9k_cmn_debug_stat_rx);
+
+static ssize_t read_file_recv(struct file *file, char __user *user_buf,
+                              size_t count, loff_t *ppos)
+{
+#define RXS_ERR(s, e)                                   \
+        do {                                            \
+                len += scnprintf(buf + len, size - len, \
+                                 "%18s : %10u\n", s,    \
+                                 rxstats->e);           \
+        } while (0)
+
+        struct ath_rx_stats *rxstats = file->private_data;
+        char *buf;
+        unsigned int len = 0, size = 1600;
+        ssize_t retval = 0;
+
+        buf = kzalloc(size, GFP_KERNEL);
+        if (buf == NULL)
+                return -ENOMEM;
+
+        RXS_ERR("PKTS-ALL", rx_pkts_all);
+        RXS_ERR("BYTES-ALL", rx_bytes_all);
+        RXS_ERR("BEACONS", rx_beacons);
+        RXS_ERR("FRAGS", rx_frags);
+        RXS_ERR("SPECTRAL", rx_spectral);
+
+        RXS_ERR("CRC ERR", crc_err);
+        RXS_ERR("DECRYPT CRC ERR", decrypt_crc_err);
+        RXS_ERR("PHY ERR", phy_err);
+        RXS_ERR("MIC ERR", mic_err);
+        RXS_ERR("PRE-DELIM CRC ERR", pre_delim_crc_err);
+        RXS_ERR("POST-DELIM CRC ERR", post_delim_crc_err);
+        RXS_ERR("DECRYPT BUSY ERR", decrypt_busy_err);
+        RXS_ERR("LENGTH-ERR", rx_len_err);
+        RXS_ERR("OOM-ERR", rx_oom_err);
+        RXS_ERR("RATE-ERR", rx_rate_err);
+        RXS_ERR("TOO-MANY-FRAGS", rx_too_many_frags_err);
+
+        if (len > size)
+                len = size;
+
+        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
+        kfree(buf);
+
+        return retval;
+
+#undef RXS_ERR
+}
+
+static const struct file_operations fops_recv = {
+        .read = read_file_recv,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+void ath9k_cmn_debug_recv(struct dentry *debugfs_phy,
+                          struct ath_rx_stats *rxstats)
+{
+        debugfs_create_file("recv", S_IRUSR, debugfs_phy, rxstats,
+                            &fops_recv);
+}
+EXPORT_SYMBOL(ath9k_cmn_debug_recv);
+
+static ssize_t read_file_phy_err(struct file *file, char __user *user_buf,
+                                 size_t count, loff_t *ppos)
+{
+#define PHY_ERR(s, p) \
+        len += scnprintf(buf + len, size - len, "%22s : %10u\n", s, \
+                         rxstats->phy_err_stats[p]);
+
+        struct ath_rx_stats *rxstats = file->private_data;
+        char *buf;
+        unsigned int len = 0, size = 1600;
+        ssize_t retval = 0;
+
+        buf = kzalloc(size, GFP_KERNEL);
+        if (buf == NULL)
+                return -ENOMEM;
+
+        PHY_ERR("UNDERRUN ERR", ATH9K_PHYERR_UNDERRUN);
+        PHY_ERR("TIMING ERR", ATH9K_PHYERR_TIMING);
+        PHY_ERR("PARITY ERR", ATH9K_PHYERR_PARITY);
+        PHY_ERR("RATE ERR", ATH9K_PHYERR_RATE);
+        PHY_ERR("LENGTH ERR", ATH9K_PHYERR_LENGTH);
+        PHY_ERR("RADAR ERR", ATH9K_PHYERR_RADAR);
+        PHY_ERR("SERVICE ERR", ATH9K_PHYERR_SERVICE);
+        PHY_ERR("TOR ERR", ATH9K_PHYERR_TOR);
+        PHY_ERR("OFDM-TIMING ERR", ATH9K_PHYERR_OFDM_TIMING);
+        PHY_ERR("OFDM-SIGNAL-PARITY ERR", ATH9K_PHYERR_OFDM_SIGNAL_PARITY);
+        PHY_ERR("OFDM-RATE ERR", ATH9K_PHYERR_OFDM_RATE_ILLEGAL);
+        PHY_ERR("OFDM-LENGTH ERR", ATH9K_PHYERR_OFDM_LENGTH_ILLEGAL);
+        PHY_ERR("OFDM-POWER-DROP ERR", ATH9K_PHYERR_OFDM_POWER_DROP);
+        PHY_ERR("OFDM-SERVICE ERR", ATH9K_PHYERR_OFDM_SERVICE);
+        PHY_ERR("OFDM-RESTART ERR", ATH9K_PHYERR_OFDM_RESTART);
+        PHY_ERR("FALSE-RADAR-EXT ERR", ATH9K_PHYERR_FALSE_RADAR_EXT);
+        PHY_ERR("CCK-TIMING ERR", ATH9K_PHYERR_CCK_TIMING);
+        PHY_ERR("CCK-HEADER-CRC ERR", ATH9K_PHYERR_CCK_HEADER_CRC);
+        PHY_ERR("CCK-RATE ERR", ATH9K_PHYERR_CCK_RATE_ILLEGAL);
+        PHY_ERR("CCK-SERVICE ERR", ATH9K_PHYERR_CCK_SERVICE);
+        PHY_ERR("CCK-RESTART ERR", ATH9K_PHYERR_CCK_RESTART);
+        PHY_ERR("CCK-LENGTH ERR", ATH9K_PHYERR_CCK_LENGTH_ILLEGAL);
+        PHY_ERR("CCK-POWER-DROP ERR", ATH9K_PHYERR_CCK_POWER_DROP);
+        PHY_ERR("HT-CRC ERR", ATH9K_PHYERR_HT_CRC_ERROR);
+        PHY_ERR("HT-LENGTH ERR", ATH9K_PHYERR_HT_LENGTH_ILLEGAL);
+        PHY_ERR("HT-RATE ERR", ATH9K_PHYERR_HT_RATE_ILLEGAL);
+
+        if (len > size)
+                len = size;
+
+        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
+        kfree(buf);
+
+        return retval;
+
+#undef PHY_ERR
+}
+
+static const struct file_operations fops_phy_err = {
+        .read = read_file_phy_err,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+void ath9k_cmn_debug_phy_err(struct dentry *debugfs_phy,
+                             struct ath_rx_stats *rxstats)
+{
+        debugfs_create_file("phy_err", S_IRUSR, debugfs_phy, rxstats,
+                            &fops_phy_err);
+}
+EXPORT_SYMBOL(ath9k_cmn_debug_phy_err);
diff --git a/drivers/net/wireless/ath/ath9k/common-debug.h b/drivers/net/wireless/ath/ath9k/common-debug.h
new file mode 100644
index 000000000000..7c9788490f7f
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/common-debug.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (c) 2008-2011 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+
+
+/**
+ * struct ath_rx_stats - RX Statistics
+ * @rx_pkts_all:  No. of total frames received, including ones that
+        may have had errors.
+ * @rx_bytes_all:  No. of total bytes received, including ones that
+        may have had errors.
+ * @crc_err: No. of frames with incorrect CRC value
+ * @decrypt_crc_err: No. of frames whose CRC check failed after
+        decryption process completed
+ * @phy_err: No. of frames whose reception failed because the PHY
+        encountered an error
+ * @mic_err: No. of frames with incorrect TKIP MIC verification failure
+ * @pre_delim_crc_err: Pre-Frame delimiter CRC error detections
+ * @post_delim_crc_err: Post-Frame delimiter CRC error detections
+ * @decrypt_busy_err: Decryption interruptions counter
+ * @phy_err_stats: Individual PHY error statistics
+ * @rx_len_err:  No. of frames discarded due to bad length.
+ * @rx_oom_err:  No. of frames dropped due to OOM issues.
+ * @rx_rate_err:  No. of frames dropped due to rate errors.
+ * @rx_too_many_frags_err:  Frames dropped due to too-many-frags received.
+ * @rx_beacons:  No. of beacons received.
+ * @rx_frags:  No. of rx-fragements received.
+ * @rx_spectral: No of spectral packets received.
+ */
+struct ath_rx_stats {
+        u32 rx_pkts_all;
+        u32 rx_bytes_all;
+        u32 crc_err;
+        u32 decrypt_crc_err;
+        u32 phy_err;
+        u32 mic_err;
+        u32 pre_delim_crc_err;
+        u32 post_delim_crc_err;
+        u32 decrypt_busy_err;
+        u32 phy_err_stats[ATH9K_PHYERR_MAX];
+        u32 rx_len_err;
+        u32 rx_oom_err;
+        u32 rx_rate_err;
+        u32 rx_too_many_frags_err;
+        u32 rx_beacons;
+        u32 rx_frags;
+        u32 rx_spectral;
+};
+
+void ath9k_cmn_debug_modal_eeprom(struct dentry *debugfs_phy,
+                                  struct ath_hw *ah);
+void ath9k_cmn_debug_base_eeprom(struct dentry *debugfs_phy,
+                                 struct ath_hw *ah);
+void ath9k_cmn_debug_stat_rx(struct ath_rx_stats *rxstats,
+                             struct ath_rx_status *rs);
+void ath9k_cmn_debug_recv(struct dentry *debugfs_phy,
+                          struct ath_rx_stats *rxstats);
+void ath9k_cmn_debug_phy_err(struct dentry *debugfs_phy,
+                             struct ath_rx_stats *rxstats);
diff --git a/drivers/net/wireless/ath/ath9k/common.h b/drivers/net/wireless/ath/ath9k/common.h
index ca38116838f0..ffc454b18637 100644
--- a/drivers/net/wireless/ath/ath9k/common.h
+++ b/drivers/net/wireless/ath/ath9k/common.h
@@ -23,6 +23,7 @@
 
 #include "common-init.h"
 #include "common-beacon.h"
+#include "common-debug.h"
 
 /* Common header for Atheros 802.11n base driver cores */
 
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index 780ff1bee6f6..6cc42be48d4e 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -948,151 +948,11 @@ static const struct file_operations fops_reset = {
         .llseek = default_llseek,
 };
 
-static ssize_t read_file_recv(struct file *file, char __user *user_buf,
-                              size_t count, loff_t *ppos)
-{
-#define RXS_ERR(s, e)                                       \
-        do {                                                \
-                len += scnprintf(buf + len, size - len,     \
-                                 "%18s : %10u\n", s,        \
-                                 sc->debug.stats.rxstats.e);\
-        } while (0)
-
-        struct ath_softc *sc = file->private_data;
-        char *buf;
-        unsigned int len = 0, size = 1600;
-        ssize_t retval = 0;
-
-        buf = kzalloc(size, GFP_KERNEL);
-        if (buf == NULL)
-                return -ENOMEM;
-
-        RXS_ERR("PKTS-ALL", rx_pkts_all);
-        RXS_ERR("BYTES-ALL", rx_bytes_all);
-        RXS_ERR("BEACONS", rx_beacons);
-        RXS_ERR("FRAGS", rx_frags);
-        RXS_ERR("SPECTRAL", rx_spectral);
-
-        RXS_ERR("CRC ERR", crc_err);
-        RXS_ERR("DECRYPT CRC ERR", decrypt_crc_err);
-        RXS_ERR("PHY ERR", phy_err);
-        RXS_ERR("MIC ERR", mic_err);
-        RXS_ERR("PRE-DELIM CRC ERR", pre_delim_crc_err);
-        RXS_ERR("POST-DELIM CRC ERR", post_delim_crc_err);
-        RXS_ERR("DECRYPT BUSY ERR", decrypt_busy_err);
-        RXS_ERR("LENGTH-ERR", rx_len_err);
-        RXS_ERR("OOM-ERR", rx_oom_err);
-        RXS_ERR("RATE-ERR", rx_rate_err);
-        RXS_ERR("TOO-MANY-FRAGS", rx_too_many_frags_err);
-
-        if (len > size)
-                len = size;
-
-        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
-        kfree(buf);
-
-        return retval;
-
-#undef RXS_ERR
-}
-
 void ath_debug_stat_rx(struct ath_softc *sc, struct ath_rx_status *rs)
 {
-#define RX_PHY_ERR_INC(c) sc->debug.stats.rxstats.phy_err_stats[c]++
-
-        RX_STAT_INC(rx_pkts_all);
-        sc->debug.stats.rxstats.rx_bytes_all += rs->rs_datalen;
-
-        if (rs->rs_status & ATH9K_RXERR_CRC)
-                RX_STAT_INC(crc_err);
-        if (rs->rs_status & ATH9K_RXERR_DECRYPT)
-                RX_STAT_INC(decrypt_crc_err);
-        if (rs->rs_status & ATH9K_RXERR_MIC)
-                RX_STAT_INC(mic_err);
-        if (rs->rs_status & ATH9K_RX_DELIM_CRC_PRE)
-                RX_STAT_INC(pre_delim_crc_err);
-        if (rs->rs_status & ATH9K_RX_DELIM_CRC_POST)
-                RX_STAT_INC(post_delim_crc_err);
-        if (rs->rs_status & ATH9K_RX_DECRYPT_BUSY)
-                RX_STAT_INC(decrypt_busy_err);
-
-        if (rs->rs_status & ATH9K_RXERR_PHY) {
-                RX_STAT_INC(phy_err);
-                if (rs->rs_phyerr < ATH9K_PHYERR_MAX)
-                        RX_PHY_ERR_INC(rs->rs_phyerr);
-        }
-
-#undef RX_PHY_ERR_INC
+        ath9k_cmn_debug_stat_rx(&sc->debug.stats.rxstats, rs);
 }
 
-static const struct file_operations fops_recv = {
-        .read = read_file_recv,
-        .open = simple_open,
-        .owner = THIS_MODULE,
-        .llseek = default_llseek,
-};
-
-static ssize_t read_file_phy_err(struct file *file, char __user *user_buf,
-                                 size_t count, loff_t *ppos)
-{
-#define PHY_ERR(s, p) \
-        len += scnprintf(buf + len, size - len, "%22s : %10u\n", s, \
-                         sc->debug.stats.rxstats.phy_err_stats[p]);
-
-        struct ath_softc *sc = file->private_data;
-        char *buf;
-        unsigned int len = 0, size = 1600;
-        ssize_t retval = 0;
-
-        buf = kzalloc(size, GFP_KERNEL);
-        if (buf == NULL)
-                return -ENOMEM;
-
-        PHY_ERR("UNDERRUN ERR", ATH9K_PHYERR_UNDERRUN);
-        PHY_ERR("TIMING ERR", ATH9K_PHYERR_TIMING);
-        PHY_ERR("PARITY ERR", ATH9K_PHYERR_PARITY);
-        PHY_ERR("RATE ERR", ATH9K_PHYERR_RATE);
-        PHY_ERR("LENGTH ERR", ATH9K_PHYERR_LENGTH);
-        PHY_ERR("RADAR ERR", ATH9K_PHYERR_RADAR);
-        PHY_ERR("SERVICE ERR", ATH9K_PHYERR_SERVICE);
-        PHY_ERR("TOR ERR", ATH9K_PHYERR_TOR);
-        PHY_ERR("OFDM-TIMING ERR", ATH9K_PHYERR_OFDM_TIMING);
-        PHY_ERR("OFDM-SIGNAL-PARITY ERR", ATH9K_PHYERR_OFDM_SIGNAL_PARITY);
-        PHY_ERR("OFDM-RATE ERR", ATH9K_PHYERR_OFDM_RATE_ILLEGAL);
-        PHY_ERR("OFDM-LENGTH ERR", ATH9K_PHYERR_OFDM_LENGTH_ILLEGAL);
-        PHY_ERR("OFDM-POWER-DROP ERR", ATH9K_PHYERR_OFDM_POWER_DROP);
-        PHY_ERR("OFDM-SERVICE ERR", ATH9K_PHYERR_OFDM_SERVICE);
-        PHY_ERR("OFDM-RESTART ERR", ATH9K_PHYERR_OFDM_RESTART);
-        PHY_ERR("FALSE-RADAR-EXT ERR", ATH9K_PHYERR_FALSE_RADAR_EXT);
-        PHY_ERR("CCK-TIMING ERR", ATH9K_PHYERR_CCK_TIMING);
-        PHY_ERR("CCK-HEADER-CRC ERR", ATH9K_PHYERR_CCK_HEADER_CRC);
-        PHY_ERR("CCK-RATE ERR", ATH9K_PHYERR_CCK_RATE_ILLEGAL);
-        PHY_ERR("CCK-SERVICE ERR", ATH9K_PHYERR_CCK_SERVICE);
-        PHY_ERR("CCK-RESTART ERR", ATH9K_PHYERR_CCK_RESTART);
-        PHY_ERR("CCK-LENGTH ERR", ATH9K_PHYERR_CCK_LENGTH_ILLEGAL);
-        PHY_ERR("CCK-POWER-DROP ERR", ATH9K_PHYERR_CCK_POWER_DROP);
-        PHY_ERR("HT-CRC ERR", ATH9K_PHYERR_HT_CRC_ERROR);
-        PHY_ERR("HT-LENGTH ERR", ATH9K_PHYERR_HT_LENGTH_ILLEGAL);
-        PHY_ERR("HT-RATE ERR", ATH9K_PHYERR_HT_RATE_ILLEGAL);
-
-        if (len > size)
-                len = size;
-
-        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
-        kfree(buf);
-
-        return retval;
-
-#undef PHY_ERR
-}
-
-static const struct file_operations fops_phy_err = {
-        .read = read_file_phy_err,
-        .open = simple_open,
-        .owner = THIS_MODULE,
-        .llseek = default_llseek,
-};
-
 static ssize_t read_file_regidx(struct file *file, char __user *user_buf,
                                 size_t count, loff_t *ppos)
 {
@@ -1268,62 +1128,6 @@ static const struct file_operations fops_dump_nfcal = {
         .llseek = default_llseek,
 };
 
-static ssize_t read_file_base_eeprom(struct file *file, char __user *user_buf,
-                                     size_t count, loff_t *ppos)
-{
-        struct ath_softc *sc = file->private_data;
-        struct ath_hw *ah = sc->sc_ah;
-        u32 len = 0, size = 1500;
-        ssize_t retval = 0;
-        char *buf;
-
-        buf = kzalloc(size, GFP_KERNEL);
-        if (!buf)
-                return -ENOMEM;
-
-        len = ah->eep_ops->dump_eeprom(ah, true, buf, len, size);
-
-        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
-        kfree(buf);
-
-        return retval;
-}
-
-static const struct file_operations fops_base_eeprom = {
-        .read = read_file_base_eeprom,
-        .open = simple_open,
-        .owner = THIS_MODULE,
-        .llseek = default_llseek,
-};
-
-static ssize_t read_file_modal_eeprom(struct file *file, char __user *user_buf,
-                                      size_t count, loff_t *ppos)
-{
-        struct ath_softc *sc = file->private_data;
-        struct ath_hw *ah = sc->sc_ah;
-        u32 len = 0, size = 6000;
-        char *buf;
-        size_t retval;
-
-        buf = kzalloc(size, GFP_KERNEL);
-        if (buf == NULL)
-                return -ENOMEM;
-
-        len = ah->eep_ops->dump_eeprom(ah, false, buf, len, size);
-
-        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
-        kfree(buf);
-
-        return retval;
-}
-
-static const struct file_operations fops_modal_eeprom = {
-        .read = read_file_modal_eeprom,
-        .open = simple_open,
-        .owner = THIS_MODULE,
-        .llseek = default_llseek,
-};
-
 #ifdef CONFIG_ATH9K_BTCOEX_SUPPORT
 static ssize_t read_file_btcoex(struct file *file, char __user *user_buf,
                                 size_t count, loff_t *ppos)
@@ -1524,10 +1328,10 @@ int ath9k_init_debug(struct ath_hw *ah)
                             &fops_misc);
         debugfs_create_file("reset", S_IRUSR, sc->debug.debugfs_phy, sc,
                             &fops_reset);
-        debugfs_create_file("recv", S_IRUSR, sc->debug.debugfs_phy, sc,
-                            &fops_recv);
-        debugfs_create_file("phy_err", S_IRUSR, sc->debug.debugfs_phy, sc,
-                            &fops_phy_err);
+
+        ath9k_cmn_debug_recv(sc->debug.debugfs_phy, &sc->debug.stats.rxstats);
+        ath9k_cmn_debug_phy_err(sc->debug.debugfs_phy, &sc->debug.stats.rxstats);
+
         debugfs_create_u8("rx_chainmask", S_IRUSR, sc->debug.debugfs_phy,
                           &ah->rxchainmask);
         debugfs_create_u8("tx_chainmask", S_IRUSR, sc->debug.debugfs_phy,
@@ -1547,10 +1351,10 @@ int ath9k_init_debug(struct ath_hw *ah)
                             &fops_regdump);
         debugfs_create_file("dump_nfcal", S_IRUSR, sc->debug.debugfs_phy, sc,
                             &fops_dump_nfcal);
-        debugfs_create_file("base_eeprom", S_IRUSR, sc->debug.debugfs_phy, sc,
-                            &fops_base_eeprom);
-        debugfs_create_file("modal_eeprom", S_IRUSR, sc->debug.debugfs_phy, sc,
-                            &fops_modal_eeprom);
+
+        ath9k_cmn_debug_base_eeprom(sc->debug.debugfs_phy, sc->sc_ah);
+        ath9k_cmn_debug_modal_eeprom(sc->debug.debugfs_phy, sc->sc_ah);
+
         debugfs_create_u32("gpio_mask", S_IRUSR | S_IWUSR,
                            sc->debug.debugfs_phy, &sc->sc_ah->gpio_mask);
         debugfs_create_u32("gpio_val", S_IRUSR | S_IWUSR,
diff --git a/drivers/net/wireless/ath/ath9k/debug.h b/drivers/net/wireless/ath/ath9k/debug.h
index 559a68c2709c..53ae15bd0c9d 100644
--- a/drivers/net/wireless/ath/ath9k/debug.h
+++ b/drivers/net/wireless/ath/ath9k/debug.h
@@ -221,50 +221,6 @@ struct ath_rx_rate_stats {
         } cck_stats[4];
 };
 
-/**
- * struct ath_rx_stats - RX Statistics
- * @rx_pkts_all:  No. of total frames received, including ones that
-        may have had errors.
- * @rx_bytes_all:  No. of total bytes received, including ones that
-        may have had errors.
- * @crc_err: No. of frames with incorrect CRC value
- * @decrypt_crc_err: No. of frames whose CRC check failed after
-        decryption process completed
- * @phy_err: No. of frames whose reception failed because the PHY
-        encountered an error
- * @mic_err: No. of frames with incorrect TKIP MIC verification failure
- * @pre_delim_crc_err: Pre-Frame delimiter CRC error detections
- * @post_delim_crc_err: Post-Frame delimiter CRC error detections
- * @decrypt_busy_err: Decryption interruptions counter
- * @phy_err_stats: Individual PHY error statistics
- * @rx_len_err:  No. of frames discarded due to bad length.
- * @rx_oom_err:  No. of frames dropped due to OOM issues.
- * @rx_rate_err:  No. of frames dropped due to rate errors.
- * @rx_too_many_frags_err:  Frames dropped due to too-many-frags received.
- * @rx_beacons:  No. of beacons received.
- * @rx_frags:  No. of rx-fragements received.
- * @rx_spectral: No of spectral packets received.
- */
-struct ath_rx_stats {
-        u32 rx_pkts_all;
-        u32 rx_bytes_all;
-        u32 crc_err;
-        u32 decrypt_crc_err;
-        u32 phy_err;
-        u32 mic_err;
-        u32 pre_delim_crc_err;
-        u32 post_delim_crc_err;
-        u32 decrypt_busy_err;
-        u32 phy_err_stats[ATH9K_PHYERR_MAX];
-        u32 rx_len_err;
-        u32 rx_oom_err;
-        u32 rx_rate_err;
-        u32 rx_too_many_frags_err;
-        u32 rx_beacons;
-        u32 rx_frags;
-        u32 rx_spectral;
-};
-
 #define ANT_MAIN 0
 #define ANT_ALT  1
 
diff --git a/drivers/net/wireless/ath/ath9k/debug_sta.c b/drivers/net/wireless/ath/ath9k/debug_sta.c
index d76e6e0120d2..ffca918ff16a 100644
--- a/drivers/net/wireless/ath/ath9k/debug_sta.c
+++ b/drivers/net/wireless/ath/ath9k/debug_sta.c
@@ -72,7 +72,7 @@ static ssize_t read_file_node_aggr(struct file *file, char __user *user_buf,
                 ath_txq_lock(sc, txq);
                 if (tid->active) {
                         len += scnprintf(buf + len, size - len,
-                                         "%3d%11d%10d%10d%10d%10d%9d%6d%8d\n",
+                                         "%3d%11d%10d%10d%10d%10d%9d%6d\n",
                                          tid->tidno,
                                          tid->seq_start,
                                          tid->seq_next,
@@ -80,8 +80,7 @@ static ssize_t read_file_node_aggr(struct file *file, char __user *user_buf,
                                          tid->baw_head,
                                          tid->baw_tail,
                                          tid->bar_index,
-                                         tid->sched,
-                                         tid->paused);
+                                         tid->sched);
                 }
                 ath_txq_unlock(sc, txq);
         }
diff --git a/drivers/net/wireless/ath/ath9k/dfs.c b/drivers/net/wireless/ath/ath9k/dfs.c
index 857bb28b3894..5049bec5c676 100644
--- a/drivers/net/wireless/ath/ath9k/dfs.c
+++ b/drivers/net/wireless/ath/ath9k/dfs.c
@@ -178,12 +178,12 @@ void ath9k_dfs_process_phyerr(struct ath_softc *sc, void *data,
         pe.ts = mactime;
         if (ath9k_postprocess_radar_event(sc, &ard, &pe)) {
                 struct dfs_pattern_detector *pd = sc->dfs_detector;
-                static u64 last_ts;
                 ath_dbg(common, DFS,
                         "ath9k_dfs_process_phyerr: channel=%d, ts=%llu, "
                         "width=%d, rssi=%d, delta_ts=%llu\n",
-                        pe.freq, pe.ts, pe.width, pe.rssi, pe.ts-last_ts);
-                last_ts = pe.ts;
+                        pe.freq, pe.ts, pe.width, pe.rssi,
+                        pe.ts - sc->debug.stats.dfs_stats.last_ts);
+                sc->debug.stats.dfs_stats.last_ts = pe.ts;
                 DFS_STAT_INC(sc, pulses_processed);
                 if (pd != NULL && pd->add_pulse(pd, &pe)) {
                         DFS_STAT_INC(sc, radar_detected);
diff --git a/drivers/net/wireless/ath/ath9k/dfs_debug.h b/drivers/net/wireless/ath/ath9k/dfs_debug.h
index 7936c9126a20..d9486867a5e0 100644
--- a/drivers/net/wireless/ath/ath9k/dfs_debug.h
+++ b/drivers/net/wireless/ath/ath9k/dfs_debug.h
@@ -51,6 +51,7 @@ struct ath_dfs_stats {
         /* pattern detection stats */
         u32 pulses_processed;
         u32 radar_detected;
+        u64 last_ts;
 };
 
 #if defined(CONFIG_ATH9K_DFS_DEBUGFS)
diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
index dab1f0cab993..04d2f4f90e49 100644
--- a/drivers/net/wireless/ath/ath9k/htc.h
+++ b/drivers/net/wireless/ath/ath9k/htc.h
@@ -325,14 +325,14 @@ static inline struct ath9k_htc_tx_ctl *HTC_SKB_CB(struct sk_buff *skb)
 
 #define TX_STAT_INC(c) (hif_dev->htc_handle->drv_priv->debug.tx_stats.c++)
 #define TX_STAT_ADD(c, a) (hif_dev->htc_handle->drv_priv->debug.tx_stats.c += a)
-#define RX_STAT_INC(c) (hif_dev->htc_handle->drv_priv->debug.rx_stats.c++)
-#define RX_STAT_ADD(c, a) (hif_dev->htc_handle->drv_priv->debug.rx_stats.c += a)
+#define RX_STAT_INC(c) (hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c++)
+#define RX_STAT_ADD(c, a) (hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c += a)
 #define CAB_STAT_INC   priv->debug.tx_stats.cab_queued++
 
 #define TX_QSTAT_INC(q) (priv->debug.tx_stats.queue_stats[q]++)
 
 void ath9k_htc_err_stat_rx(struct ath9k_htc_priv *priv,
-                           struct ath_htc_rx_status *rxs);
+                           struct ath_rx_status *rs);
 
 struct ath_tx_stats {
         u32 buf_queued;
@@ -345,25 +345,18 @@ struct ath_tx_stats {
         u32 queue_stats[IEEE80211_NUM_ACS];
 };
 
-struct ath_rx_stats {
+struct ath_skbrx_stats {
         u32 skb_allocated;
         u32 skb_completed;
         u32 skb_completed_bytes;
         u32 skb_dropped;
-        u32 err_crc;
-        u32 err_decrypt_crc;
-        u32 err_mic;
-        u32 err_pre_delim;
-        u32 err_post_delim;
-        u32 err_decrypt_busy;
-        u32 err_phy;
-        u32 err_phy_stats[ATH9K_PHYERR_MAX];
 };
 
 struct ath9k_debug {
         struct dentry *debugfs_phy;
         struct ath_tx_stats tx_stats;
         struct ath_rx_stats rx_stats;
+        struct ath_skbrx_stats skbrx_stats;
 };
 
 void ath9k_htc_get_et_strings(struct ieee80211_hw *hw,
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
index fb071ee4fcfb..8b529e4b8ac4 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
@@ -243,39 +243,14 @@ static const struct file_operations fops_xmit = {
 };
 
 void ath9k_htc_err_stat_rx(struct ath9k_htc_priv *priv,
-                           struct ath_htc_rx_status *rxs)
+                             struct ath_rx_status *rs)
 {
-#define RX_PHY_ERR_INC(c) priv->debug.rx_stats.err_phy_stats[c]++
-
-        if (rxs->rs_status & ATH9K_RXERR_CRC)
-                priv->debug.rx_stats.err_crc++;
-        if (rxs->rs_status & ATH9K_RXERR_DECRYPT)
-                priv->debug.rx_stats.err_decrypt_crc++;
-        if (rxs->rs_status & ATH9K_RXERR_MIC)
-                priv->debug.rx_stats.err_mic++;
-        if (rxs->rs_status & ATH9K_RX_DELIM_CRC_PRE)
-                priv->debug.rx_stats.err_pre_delim++;
-        if (rxs->rs_status & ATH9K_RX_DELIM_CRC_POST)
-                priv->debug.rx_stats.err_post_delim++;
-        if (rxs->rs_status & ATH9K_RX_DECRYPT_BUSY)
-                priv->debug.rx_stats.err_decrypt_busy++;
-
-        if (rxs->rs_status & ATH9K_RXERR_PHY) {
-                priv->debug.rx_stats.err_phy++;
-                if (rxs->rs_phyerr < ATH9K_PHYERR_MAX)
-                        RX_PHY_ERR_INC(rxs->rs_phyerr);
-        }
-
-#undef RX_PHY_ERR_INC
+        ath9k_cmn_debug_stat_rx(&priv->debug.rx_stats, rs);
 }
 
-static ssize_t read_file_recv(struct file *file, char __user *user_buf,
+static ssize_t read_file_skb_rx(struct file *file, char __user *user_buf,
                               size_t count, loff_t *ppos)
 {
-#define PHY_ERR(s, p)                                                   \
-        len += scnprintf(buf + len, size - len, "%20s : %10u\n", s,     \
-                         priv->debug.rx_stats.err_phy_stats[p]);
-
         struct ath9k_htc_priv *priv = file->private_data;
         char *buf;
         unsigned int len = 0, size = 1500;
@@ -287,63 +262,13 @@ static ssize_t read_file_recv(struct file *file, char __user *user_buf,
 
         len += scnprintf(buf + len, size - len,
                          "%20s : %10u\n", "SKBs allocated",
-                         priv->debug.rx_stats.skb_allocated);
+                         priv->debug.skbrx_stats.skb_allocated);
         len += scnprintf(buf + len, size - len,
                          "%20s : %10u\n", "SKBs completed",
-                         priv->debug.rx_stats.skb_completed);
+                         priv->debug.skbrx_stats.skb_completed);
         len += scnprintf(buf + len, size - len,
                          "%20s : %10u\n", "SKBs Dropped",
-                         priv->debug.rx_stats.skb_dropped);
-
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10u\n", "CRC ERR",
-                         priv->debug.rx_stats.err_crc);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10u\n", "DECRYPT CRC ERR",
-                         priv->debug.rx_stats.err_decrypt_crc);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10u\n", "MIC ERR",
-                         priv->debug.rx_stats.err_mic);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10u\n", "PRE-DELIM CRC ERR",
-                         priv->debug.rx_stats.err_pre_delim);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10u\n", "POST-DELIM CRC ERR",
-                         priv->debug.rx_stats.err_post_delim);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10u\n", "DECRYPT BUSY ERR",
-                         priv->debug.rx_stats.err_decrypt_busy);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10u\n", "TOTAL PHY ERR",
-                         priv->debug.rx_stats.err_phy);
-
-
-        PHY_ERR("UNDERRUN", ATH9K_PHYERR_UNDERRUN);
-        PHY_ERR("TIMING", ATH9K_PHYERR_TIMING);
-        PHY_ERR("PARITY", ATH9K_PHYERR_PARITY);
-        PHY_ERR("RATE", ATH9K_PHYERR_RATE);
-        PHY_ERR("LENGTH", ATH9K_PHYERR_LENGTH);
-        PHY_ERR("RADAR", ATH9K_PHYERR_RADAR);
-        PHY_ERR("SERVICE", ATH9K_PHYERR_SERVICE);
-        PHY_ERR("TOR", ATH9K_PHYERR_TOR);
-        PHY_ERR("OFDM-TIMING", ATH9K_PHYERR_OFDM_TIMING);
-        PHY_ERR("OFDM-SIGNAL-PARITY", ATH9K_PHYERR_OFDM_SIGNAL_PARITY);
-        PHY_ERR("OFDM-RATE", ATH9K_PHYERR_OFDM_RATE_ILLEGAL);
-        PHY_ERR("OFDM-LENGTH", ATH9K_PHYERR_OFDM_LENGTH_ILLEGAL);
-        PHY_ERR("OFDM-POWER-DROP", ATH9K_PHYERR_OFDM_POWER_DROP);
-        PHY_ERR("OFDM-SERVICE", ATH9K_PHYERR_OFDM_SERVICE);
-        PHY_ERR("OFDM-RESTART", ATH9K_PHYERR_OFDM_RESTART);
-        PHY_ERR("FALSE-RADAR-EXT", ATH9K_PHYERR_FALSE_RADAR_EXT);
-        PHY_ERR("CCK-TIMING", ATH9K_PHYERR_CCK_TIMING);
-        PHY_ERR("CCK-HEADER-CRC", ATH9K_PHYERR_CCK_HEADER_CRC);
-        PHY_ERR("CCK-RATE", ATH9K_PHYERR_CCK_RATE_ILLEGAL);
-        PHY_ERR("CCK-SERVICE", ATH9K_PHYERR_CCK_SERVICE);
-        PHY_ERR("CCK-RESTART", ATH9K_PHYERR_CCK_RESTART);
-        PHY_ERR("CCK-LENGTH", ATH9K_PHYERR_CCK_LENGTH_ILLEGAL);
-        PHY_ERR("CCK-POWER-DROP", ATH9K_PHYERR_CCK_POWER_DROP);
-        PHY_ERR("HT-CRC", ATH9K_PHYERR_HT_CRC_ERROR);
-        PHY_ERR("HT-LENGTH", ATH9K_PHYERR_HT_LENGTH_ILLEGAL);
-        PHY_ERR("HT-RATE", ATH9K_PHYERR_HT_RATE_ILLEGAL);
+                         priv->debug.skbrx_stats.skb_dropped);
 
         if (len > size)
                 len = size;
@@ -352,12 +277,10 @@ static ssize_t read_file_recv(struct file *file, char __user *user_buf,
         kfree(buf);
 
         return retval;
-
-#undef PHY_ERR
 }
 
-static const struct file_operations fops_recv = {
-        .read = read_file_recv,
+static const struct file_operations fops_skb_rx = {
+        .read = read_file_skb_rx,
         .open = simple_open,
         .owner = THIS_MODULE,
         .llseek = default_llseek,
@@ -486,423 +409,6 @@ static const struct file_operations fops_debug = {
         .llseek = default_llseek,
 };
 
-static ssize_t read_file_base_eeprom(struct file *file, char __user *user_buf,
-                                     size_t count, loff_t *ppos)
-{
-        struct ath9k_htc_priv *priv = file->private_data;
-        struct ath_common *common = ath9k_hw_common(priv->ah);
-        struct base_eep_header *pBase = NULL;
-        unsigned int len = 0, size = 1500;
-        ssize_t retval = 0;
-        char *buf;
-
-        pBase = ath9k_htc_get_eeprom_base(priv);
-
-        if (pBase == NULL) {
-                ath_err(common, "Unknown EEPROM type\n");
-                return 0;
-        }
-
-        buf = kzalloc(size, GFP_KERNEL);
-        if (buf == NULL)
-                return -ENOMEM;
-
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n", "Major Version",
-                         pBase->version >> 12);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n", "Minor Version",
-                         pBase->version & 0xFFF);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n", "Checksum",
-                         pBase->checksum);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n", "Length",
-                         pBase->length);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n", "RegDomain1",
-                         pBase->regDmn[0]);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n", "RegDomain2",
-                         pBase->regDmn[1]);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n",
-                         "TX Mask", pBase->txMask);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n",
-                         "RX Mask", pBase->rxMask);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n",
-                         "Allow 5GHz",
-                         !!(pBase->opCapFlags & AR5416_OPFLAGS_11A));
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n",
-                         "Allow 2GHz",
-                         !!(pBase->opCapFlags & AR5416_OPFLAGS_11G));
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n",
-                         "Disable 2GHz HT20",
-                         !!(pBase->opCapFlags & AR5416_OPFLAGS_N_2G_HT20));
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n",
-                         "Disable 2GHz HT40",
-                         !!(pBase->opCapFlags & AR5416_OPFLAGS_N_2G_HT40));
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n",
-                         "Disable 5Ghz HT20",
-                         !!(pBase->opCapFlags & AR5416_OPFLAGS_N_5G_HT20));
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n",
-                         "Disable 5Ghz HT40",
-                         !!(pBase->opCapFlags & AR5416_OPFLAGS_N_5G_HT40));
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n",
-                         "Big Endian",
-                         !!(pBase->eepMisc & 0x01));
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n",
-                         "Cal Bin Major Ver",
-                         (pBase->binBuildNumber >> 24) & 0xFF);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n",
-                         "Cal Bin Minor Ver",
-                         (pBase->binBuildNumber >> 16) & 0xFF);
-        len += scnprintf(buf + len, size - len,
-                         "%20s : %10d\n",
-                         "Cal Bin Build",
-                         (pBase->binBuildNumber >> 8) & 0xFF);
-
-        /*
-         * UB91 specific data.
-         */
-        if (AR_SREV_9271(priv->ah)) {
-                struct base_eep_header_4k *pBase4k =
-                        &priv->ah->eeprom.map4k.baseEepHeader;
-
-                len += scnprintf(buf + len, size - len,
-                                 "%20s : %10d\n",
-                                 "TX Gain type",
-                                 pBase4k->txGainType);
-        }
-
-        /*
-         * UB95 specific data.
-         */
-        if (priv->ah->hw_version.usbdev == AR9287_USB) {
-                struct base_eep_ar9287_header *pBase9287 =
-                        &priv->ah->eeprom.map9287.baseEepHeader;
-
-                len += scnprintf(buf + len, size - len,
-                                 "%20s : %10ddB\n",
-                                 "Power Table Offset",
-                                 pBase9287->pwrTableOffset);
-
-                len += scnprintf(buf + len, size - len,
-                                 "%20s : %10d\n",
-                                 "OpenLoop Power Ctrl",
-                                 pBase9287->openLoopPwrCntl);
-        }
-
-        len += scnprintf(buf + len, size - len, "%20s : %pM\n", "MacAddress",
-                         pBase->macAddr);
-        if (len > size)
-                len = size;
-
-        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
-        kfree(buf);
-
-        return retval;
-}
-
-static const struct file_operations fops_base_eeprom = {
-        .read = read_file_base_eeprom,
-        .open = simple_open,
-        .owner = THIS_MODULE,
-        .llseek = default_llseek,
-};
-
-static ssize_t read_4k_modal_eeprom(struct file *file,
-                                    char __user *user_buf,
-                                    size_t count, loff_t *ppos)
-{
-#define PR_EEP(_s, _val)                                                \
-        do {                                                            \
-                len += scnprintf(buf + len, size - len, "%20s : %10d\n",\
-                                 _s, (_val));                           \
-        } while (0)
-
-        struct ath9k_htc_priv *priv = file->private_data;
-        struct modal_eep_4k_header *pModal = &priv->ah->eeprom.map4k.modalHeader;
-        unsigned int len = 0, size = 2048;
-        ssize_t retval = 0;
-        char *buf;
-
-        buf = kzalloc(size, GFP_KERNEL);
-        if (buf == NULL)
-                return -ENOMEM;
-
-        PR_EEP("Chain0 Ant. Control", pModal->antCtrlChain[0]);
-        PR_EEP("Ant. Common Control", pModal->antCtrlCommon);
-        PR_EEP("Chain0 Ant. Gain", pModal->antennaGainCh[0]);
-        PR_EEP("Switch Settle", pModal->switchSettling);
-        PR_EEP("Chain0 TxRxAtten", pModal->txRxAttenCh[0]);
-        PR_EEP("Chain0 RxTxMargin", pModal->rxTxMarginCh[0]);
-        PR_EEP("ADC Desired size", pModal->adcDesiredSize);
-        PR_EEP("PGA Desired size", pModal->pgaDesiredSize);
-        PR_EEP("Chain0 xlna Gain", pModal->xlnaGainCh[0]);
-        PR_EEP("txEndToXpaOff", pModal->txEndToXpaOff);
-        PR_EEP("txEndToRxOn", pModal->txEndToRxOn);
-        PR_EEP("txFrameToXpaOn", pModal->txFrameToXpaOn);
-        PR_EEP("CCA Threshold)", pModal->thresh62);
-        PR_EEP("Chain0 NF Threshold", pModal->noiseFloorThreshCh[0]);
-        PR_EEP("xpdGain", pModal->xpdGain);
-        PR_EEP("External PD", pModal->xpd);
-        PR_EEP("Chain0 I Coefficient", pModal->iqCalICh[0]);
-        PR_EEP("Chain0 Q Coefficient", pModal->iqCalQCh[0]);
-        PR_EEP("pdGainOverlap", pModal->pdGainOverlap);
-        PR_EEP("O/D Bias Version", pModal->version);
-        PR_EEP("CCK OutputBias", pModal->ob_0);
-        PR_EEP("BPSK OutputBias", pModal->ob_1);
-        PR_EEP("QPSK OutputBias", pModal->ob_2);
-        PR_EEP("16QAM OutputBias", pModal->ob_3);
-        PR_EEP("64QAM OutputBias", pModal->ob_4);
-        PR_EEP("CCK Driver1_Bias", pModal->db1_0);
-        PR_EEP("BPSK Driver1_Bias", pModal->db1_1);
-        PR_EEP("QPSK Driver1_Bias", pModal->db1_2);
-        PR_EEP("16QAM Driver1_Bias", pModal->db1_3);
-        PR_EEP("64QAM Driver1_Bias", pModal->db1_4);
-        PR_EEP("CCK Driver2_Bias", pModal->db2_0);
-        PR_EEP("BPSK Driver2_Bias", pModal->db2_1);
-        PR_EEP("QPSK Driver2_Bias", pModal->db2_2);
-        PR_EEP("16QAM Driver2_Bias", pModal->db2_3);
-        PR_EEP("64QAM Driver2_Bias", pModal->db2_4);
-        PR_EEP("xPA Bias Level", pModal->xpaBiasLvl);
-        PR_EEP("txFrameToDataStart", pModal->txFrameToDataStart);
-        PR_EEP("txFrameToPaOn", pModal->txFrameToPaOn);
-        PR_EEP("HT40 Power Inc.", pModal->ht40PowerIncForPdadc);
-        PR_EEP("Chain0 bswAtten", pModal->bswAtten[0]);
-        PR_EEP("Chain0 bswMargin", pModal->bswMargin[0]);
-        PR_EEP("HT40 Switch Settle", pModal->swSettleHt40);
-        PR_EEP("Chain0 xatten2Db", pModal->xatten2Db[0]);
-        PR_EEP("Chain0 xatten2Margin", pModal->xatten2Margin[0]);
-        PR_EEP("Ant. Diversity ctl1", pModal->antdiv_ctl1);
-        PR_EEP("Ant. Diversity ctl2", pModal->antdiv_ctl2);
-        PR_EEP("TX Diversity", pModal->tx_diversity);
-
-        if (len > size)
-                len = size;
-
-        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
-        kfree(buf);
-
-        return retval;
-
-#undef PR_EEP
-}
-
-static ssize_t read_def_modal_eeprom(struct file *file,
-                                     char __user *user_buf,
-                                     size_t count, loff_t *ppos)
-{
-#define PR_EEP(_s, _val)                                                \
-        do {                                                            \
-                if (pBase->opCapFlags & AR5416_OPFLAGS_11G) {           \
-                        pModal = &priv->ah->eeprom.def.modalHeader[1];  \
-                        len += scnprintf(buf + len, size - len, "%20s : %8d%7s", \
-                                         _s, (_val), "|");              \
-                }                                                       \
-                if (pBase->opCapFlags & AR5416_OPFLAGS_11A) {           \
-                        pModal = &priv->ah->eeprom.def.modalHeader[0];  \
-                        len += scnprintf(buf + len, size - len, "%9d\n",\
-                                        (_val));                        \
-                }                                                       \
-        } while (0)
-
-        struct ath9k_htc_priv *priv = file->private_data;
-        struct base_eep_header *pBase = &priv->ah->eeprom.def.baseEepHeader;
-        struct modal_eep_header *pModal = NULL;
-        unsigned int len = 0, size = 3500;
-        ssize_t retval = 0;
-        char *buf;
-
-        buf = kzalloc(size, GFP_KERNEL);
-        if (buf == NULL)
-                return -ENOMEM;
-
-        len += scnprintf(buf + len, size - len,
-                         "%31s %15s\n", "2G", "5G");
-        len += scnprintf(buf + len, size - len,
-                         "%32s %16s\n", "====", "====\n");
-
-        PR_EEP("Chain0 Ant. Control", pModal->antCtrlChain[0]);
-        PR_EEP("Chain1 Ant. Control", pModal->antCtrlChain[1]);
-        PR_EEP("Chain2 Ant. Control", pModal->antCtrlChain[2]);
-        PR_EEP("Ant. Common Control", pModal->antCtrlCommon);
-        PR_EEP("Chain0 Ant. Gain", pModal->antennaGainCh[0]);
-        PR_EEP("Chain1 Ant. Gain", pModal->antennaGainCh[1]);
-        PR_EEP("Chain2 Ant. Gain", pModal->antennaGainCh[2]);
-        PR_EEP("Switch Settle", pModal->switchSettling);
-        PR_EEP("Chain0 TxRxAtten", pModal->txRxAttenCh[0]);
-        PR_EEP("Chain1 TxRxAtten", pModal->txRxAttenCh[1]);
-        PR_EEP("Chain2 TxRxAtten", pModal->txRxAttenCh[2]);
-        PR_EEP("Chain0 RxTxMargin", pModal->rxTxMarginCh[0]);
-        PR_EEP("Chain1 RxTxMargin", pModal->rxTxMarginCh[1]);
-        PR_EEP("Chain2 RxTxMargin", pModal->rxTxMarginCh[2]);
-        PR_EEP("ADC Desired size", pModal->adcDesiredSize);
-        PR_EEP("PGA Desired size", pModal->pgaDesiredSize);
-        PR_EEP("Chain0 xlna Gain", pModal->xlnaGainCh[0]);
-        PR_EEP("Chain1 xlna Gain", pModal->xlnaGainCh[1]);
-        PR_EEP("Chain2 xlna Gain", pModal->xlnaGainCh[2]);
-        PR_EEP("txEndToXpaOff", pModal->txEndToXpaOff);
-        PR_EEP("txEndToRxOn", pModal->txEndToRxOn);
-        PR_EEP("txFrameToXpaOn", pModal->txFrameToXpaOn);
-        PR_EEP("CCA Threshold)", pModal->thresh62);
-        PR_EEP("Chain0 NF Threshold", pModal->noiseFloorThreshCh[0]);
-        PR_EEP("Chain1 NF Threshold", pModal->noiseFloorThreshCh[1]);
-        PR_EEP("Chain2 NF Threshold", pModal->noiseFloorThreshCh[2]);
-        PR_EEP("xpdGain", pModal->xpdGain);
-        PR_EEP("External PD", pModal->xpd);
-        PR_EEP("Chain0 I Coefficient", pModal->iqCalICh[0]);
-        PR_EEP("Chain1 I Coefficient", pModal->iqCalICh[1]);
-        PR_EEP("Chain2 I Coefficient", pModal->iqCalICh[2]);
-        PR_EEP("Chain0 Q Coefficient", pModal->iqCalQCh[0]);
-        PR_EEP("Chain1 Q Coefficient", pModal->iqCalQCh[1]);
-        PR_EEP("Chain2 Q Coefficient", pModal->iqCalQCh[2]);
-        PR_EEP("pdGainOverlap", pModal->pdGainOverlap);
-        PR_EEP("Chain0 OutputBias", pModal->ob);
-        PR_EEP("Chain0 DriverBias", pModal->db);
-        PR_EEP("xPA Bias Level", pModal->xpaBiasLvl);
-        PR_EEP("2chain pwr decrease", pModal->pwrDecreaseFor2Chain);
-        PR_EEP("3chain pwr decrease", pModal->pwrDecreaseFor3Chain);
-        PR_EEP("txFrameToDataStart", pModal->txFrameToDataStart);
-        PR_EEP("txFrameToPaOn", pModal->txFrameToPaOn);
-        PR_EEP("HT40 Power Inc.", pModal->ht40PowerIncForPdadc);
-        PR_EEP("Chain0 bswAtten", pModal->bswAtten[0]);
-        PR_EEP("Chain1 bswAtten", pModal->bswAtten[1]);
-        PR_EEP("Chain2 bswAtten", pModal->bswAtten[2]);
-        PR_EEP("Chain0 bswMargin", pModal->bswMargin[0]);
-        PR_EEP("Chain1 bswMargin", pModal->bswMargin[1]);
-        PR_EEP("Chain2 bswMargin", pModal->bswMargin[2]);
-        PR_EEP("HT40 Switch Settle", pModal->swSettleHt40);
-        PR_EEP("Chain0 xatten2Db", pModal->xatten2Db[0]);
-        PR_EEP("Chain1 xatten2Db", pModal->xatten2Db[1]);
-        PR_EEP("Chain2 xatten2Db", pModal->xatten2Db[2]);
-        PR_EEP("Chain0 xatten2Margin", pModal->xatten2Margin[0]);
-        PR_EEP("Chain1 xatten2Margin", pModal->xatten2Margin[1]);
-        PR_EEP("Chain2 xatten2Margin", pModal->xatten2Margin[2]);
-        PR_EEP("Chain1 OutputBias", pModal->ob_ch1);
-        PR_EEP("Chain1 DriverBias", pModal->db_ch1);
-        PR_EEP("LNA Control", pModal->lna_ctl);
-        PR_EEP("XPA Bias Freq0", pModal->xpaBiasLvlFreq[0]);
-        PR_EEP("XPA Bias Freq1", pModal->xpaBiasLvlFreq[1]);
-        PR_EEP("XPA Bias Freq2", pModal->xpaBiasLvlFreq[2]);
-
-        if (len > size)
-                len = size;
-
-        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
-        kfree(buf);
-
-        return retval;
-
-#undef PR_EEP
-}
-
-static ssize_t read_9287_modal_eeprom(struct file *file,
-                                      char __user *user_buf,
-                                      size_t count, loff_t *ppos)
-{
-#define PR_EEP(_s, _val)                                                \
-        do {                                                            \
-                len += scnprintf(buf + len, size - len, "%20s : %10d\n",\
-                                 _s, (_val));                           \
-        } while (0)
-
-        struct ath9k_htc_priv *priv = file->private_data;
-        struct modal_eep_ar9287_header *pModal = &priv->ah->eeprom.map9287.modalHeader;
-        unsigned int len = 0, size = 3000;
-        ssize_t retval = 0;
-        char *buf;
-
-        buf = kzalloc(size, GFP_KERNEL);
-        if (buf == NULL)
-                return -ENOMEM;
-
-        PR_EEP("Chain0 Ant. Control", pModal->antCtrlChain[0]);
-        PR_EEP("Chain1 Ant. Control", pModal->antCtrlChain[1]);
-        PR_EEP("Ant. Common Control", pModal->antCtrlCommon);
-        PR_EEP("Chain0 Ant. Gain", pModal->antennaGainCh[0]);
-        PR_EEP("Chain1 Ant. Gain", pModal->antennaGainCh[1]);
-        PR_EEP("Switch Settle", pModal->switchSettling);
-        PR_EEP("Chain0 TxRxAtten", pModal->txRxAttenCh[0]);
-        PR_EEP("Chain1 TxRxAtten", pModal->txRxAttenCh[1]);
-        PR_EEP("Chain0 RxTxMargin", pModal->rxTxMarginCh[0]);
-        PR_EEP("Chain1 RxTxMargin", pModal->rxTxMarginCh[1]);
-        PR_EEP("ADC Desired size", pModal->adcDesiredSize);
-        PR_EEP("txEndToXpaOff", pModal->txEndToXpaOff);
-        PR_EEP("txEndToRxOn", pModal->txEndToRxOn);
-        PR_EEP("txFrameToXpaOn", pModal->txFrameToXpaOn);
-        PR_EEP("CCA Threshold)", pModal->thresh62);
-        PR_EEP("Chain0 NF Threshold", pModal->noiseFloorThreshCh[0]);
-        PR_EEP("Chain1 NF Threshold", pModal->noiseFloorThreshCh[1]);
-        PR_EEP("xpdGain", pModal->xpdGain);
-        PR_EEP("External PD", pModal->xpd);
-        PR_EEP("Chain0 I Coefficient", pModal->iqCalICh[0]);
-        PR_EEP("Chain1 I Coefficient", pModal->iqCalICh[1]);
-        PR_EEP("Chain0 Q Coefficient", pModal->iqCalQCh[0]);
-        PR_EEP("Chain1 Q Coefficient", pModal->iqCalQCh[1]);
-        PR_EEP("pdGainOverlap", pModal->pdGainOverlap);
-        PR_EEP("xPA Bias Level", pModal->xpaBiasLvl);
-        PR_EEP("txFrameToDataStart", pModal->txFrameToDataStart);
-        PR_EEP("txFrameToPaOn", pModal->txFrameToPaOn);
-        PR_EEP("HT40 Power Inc.", pModal->ht40PowerIncForPdadc);
-        PR_EEP("Chain0 bswAtten", pModal->bswAtten[0]);
-        PR_EEP("Chain1 bswAtten", pModal->bswAtten[1]);
-        PR_EEP("Chain0 bswMargin", pModal->bswMargin[0]);
-        PR_EEP("Chain1 bswMargin", pModal->bswMargin[1]);
-        PR_EEP("HT40 Switch Settle", pModal->swSettleHt40);
-        PR_EEP("AR92x7 Version", pModal->version);
-        PR_EEP("DriverBias1", pModal->db1);
-        PR_EEP("DriverBias2", pModal->db1);
-        PR_EEP("CCK OutputBias", pModal->ob_cck);
-        PR_EEP("PSK OutputBias", pModal->ob_psk);
-        PR_EEP("QAM OutputBias", pModal->ob_qam);
-        PR_EEP("PAL_OFF OutputBias", pModal->ob_pal_off);
-
-        if (len > size)
-                len = size;
-
-        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
-        kfree(buf);
-
-        return retval;
-
-#undef PR_EEP
-}
-
-static ssize_t read_file_modal_eeprom(struct file *file, char __user *user_buf,
-                                      size_t count, loff_t *ppos)
-{
-        struct ath9k_htc_priv *priv = file->private_data;
-
-        if (AR_SREV_9271(priv->ah))
-                return read_4k_modal_eeprom(file, user_buf, count, ppos);
-        else if (priv->ah->hw_version.usbdev == AR9280_USB)
-                return read_def_modal_eeprom(file, user_buf, count, ppos);
-        else if (priv->ah->hw_version.usbdev == AR9287_USB)
-                return read_9287_modal_eeprom(file, user_buf, count, ppos);
-
-        return 0;
-}
-
-static const struct file_operations fops_modal_eeprom = {
-        .read = read_file_modal_eeprom,
-        .open = simple_open,
-        .owner = THIS_MODULE,
-        .llseek = default_llseek,
-};
-
-
 /* Ethtool support for get-stats */
 #define AMKSTR(nm) #nm "_BE", #nm "_BK", #nm "_VI", #nm "_VO"
 static const char ath9k_htc_gstrings_stats[][ETH_GSTRING_LEN] = {
@@ -947,6 +453,8 @@ int ath9k_htc_get_et_sset_count(struct ieee80211_hw *hw,
 
 #define STXBASE priv->debug.tx_stats
 #define SRXBASE priv->debug.rx_stats
+#define SKBTXBASE priv->debug.tx_stats
+#define SKBRXBASE priv->debug.skbrx_stats
 #define ASTXQ(a)                                        \
         data[i++] = STXBASE.a[IEEE80211_AC_BE];         \
         data[i++] = STXBASE.a[IEEE80211_AC_BK];         \
@@ -960,24 +468,24 @@ void ath9k_htc_get_et_stats(struct ieee80211_hw *hw,
         struct ath9k_htc_priv *priv = hw->priv;
         int i = 0;
 
-        data[i++] = STXBASE.skb_success;
-        data[i++] = STXBASE.skb_success_bytes;
-        data[i++] = SRXBASE.skb_completed;
-        data[i++] = SRXBASE.skb_completed_bytes;
+        data[i++] = SKBTXBASE.skb_success;
+        data[i++] = SKBTXBASE.skb_success_bytes;
+        data[i++] = SKBRXBASE.skb_completed;
+        data[i++] = SKBRXBASE.skb_completed_bytes;
 
         ASTXQ(queue_stats);
 
-        data[i++] = SRXBASE.err_crc;
-        data[i++] = SRXBASE.err_decrypt_crc;
-        data[i++] = SRXBASE.err_phy;
-        data[i++] = SRXBASE.err_mic;
-        data[i++] = SRXBASE.err_pre_delim;
-        data[i++] = SRXBASE.err_post_delim;
-        data[i++] = SRXBASE.err_decrypt_busy;
+        data[i++] = SRXBASE.crc_err;
+        data[i++] = SRXBASE.decrypt_crc_err;
+        data[i++] = SRXBASE.phy_err;
+        data[i++] = SRXBASE.mic_err;
+        data[i++] = SRXBASE.pre_delim_crc_err;
+        data[i++] = SRXBASE.post_delim_crc_err;
+        data[i++] = SRXBASE.decrypt_busy_err;
 
-        data[i++] = SRXBASE.err_phy_stats[ATH9K_PHYERR_RADAR];
-        data[i++] = SRXBASE.err_phy_stats[ATH9K_PHYERR_OFDM_TIMING];
-        data[i++] = SRXBASE.err_phy_stats[ATH9K_PHYERR_CCK_TIMING];
+        data[i++] = SRXBASE.phy_err_stats[ATH9K_PHYERR_RADAR];
+        data[i++] = SRXBASE.phy_err_stats[ATH9K_PHYERR_OFDM_TIMING];
+        data[i++] = SRXBASE.phy_err_stats[ATH9K_PHYERR_CCK_TIMING];
 
         WARN_ON(i != ATH9K_HTC_SSTATS_LEN);
 }
@@ -1001,18 +509,21 @@ int ath9k_htc_init_debug(struct ath_hw *ah)
                             priv, &fops_tgt_rx_stats);
         debugfs_create_file("xmit", S_IRUSR, priv->debug.debugfs_phy,
                             priv, &fops_xmit);
-        debugfs_create_file("recv", S_IRUSR, priv->debug.debugfs_phy,
-                            priv, &fops_recv);
+        debugfs_create_file("skb_rx", S_IRUSR, priv->debug.debugfs_phy,
+                            priv, &fops_skb_rx);
+
+        ath9k_cmn_debug_recv(priv->debug.debugfs_phy, &priv->debug.rx_stats);
+        ath9k_cmn_debug_phy_err(priv->debug.debugfs_phy, &priv->debug.rx_stats);
+
         debugfs_create_file("slot", S_IRUSR, priv->debug.debugfs_phy,
                             priv, &fops_slot);
         debugfs_create_file("queue", S_IRUSR, priv->debug.debugfs_phy,
                             priv, &fops_queue);
         debugfs_create_file("debug", S_IRUSR | S_IWUSR, priv->debug.debugfs_phy,
                             priv, &fops_debug);
-        debugfs_create_file("base_eeprom", S_IRUSR, priv->debug.debugfs_phy,
-                            priv, &fops_base_eeprom);
-        debugfs_create_file("modal_eeprom", S_IRUSR, priv->debug.debugfs_phy,
-                            priv, &fops_modal_eeprom);
+
+        ath9k_cmn_debug_base_eeprom(priv->debug.debugfs_phy, priv->ah);
+        ath9k_cmn_debug_modal_eeprom(priv->debug.debugfs_phy, priv->ah);
 
         return 0;
 }
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
index 289f3d8924b5..bb86eb2ffc95 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
@@ -996,8 +996,6 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv,
                 goto rx_next;
         }
 
-        ath9k_htc_err_stat_rx(priv, rxstatus);
-
         /* Get the RX status information */
 
         memset(rx_status, 0, sizeof(struct ieee80211_rx_status));
@@ -1005,6 +1003,7 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv,
         /* Copy everything from ath_htc_rx_status (HTC_RX_FRAME_HEADER).
          * After this, we can drop this part of skb. */
         rx_status_htc_to_ath(&rx_stats, rxstatus);
+        ath9k_htc_err_stat_rx(priv, &rx_stats);
         rx_status->mactime = be64_to_cpu(rxstatus->rs_tstamp);
         skb_pull(skb, HTC_RX_FRAME_HEADER_SIZE);
 
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index c8a9dfab1fee..2a8ed8375ec0 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -26,7 +26,6 @@
 #include "ar9003_mac.h"
 #include "ar9003_mci.h"
 #include "ar9003_phy.h"
-#include "debug.h"
 #include "ath9k.h"
 
 static bool ath9k_hw_set_reset_reg(struct ath_hw *ah, u32 type);
@@ -246,6 +245,8 @@ static void ath9k_hw_read_revisions(struct ath_hw *ah)
                 return;
         case AR9300_DEVID_AR953X:
                 ah->hw_version.macVersion = AR_SREV_VERSION_9531;
+                if (ah->get_mac_revision)
+                        ah->hw_version.macRev = ah->get_mac_revision();
                 return;
         }
 
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index 21e174cfc909..1af77081181e 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -508,7 +508,7 @@ static int ath9k_init_softc(u16 devid, struct ath_softc *sc,
         sc->tx99_power = MAX_RATE_POWER + 1;
         init_waitqueue_head(&sc->tx_wait);
 
-        if (!pdata) {
+        if (!pdata || pdata->use_eeprom) {
                 ah->ah_flags |= AH_USE_EEPROM;
                 sc->sc_ah->led_pin = -1;
         } else {
@@ -714,7 +714,8 @@ static void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
         if (AR_SREV_9160_10_OR_LATER(sc->sc_ah) || ath9k_modparam_nohwcrypt)
                 hw->flags |= IEEE80211_HW_MFP_CAPABLE;
 
-        hw->wiphy->features |= NL80211_FEATURE_ACTIVE_MONITOR;
+        hw->wiphy->features |= (NL80211_FEATURE_ACTIVE_MONITOR |
+                                NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE);
 
         if (!config_enabled(CONFIG_ATH9K_TX99)) {
                 hw->wiphy->interface_modes =
@@ -786,6 +787,9 @@ int ath9k_init_device(u16 devid, struct ath_softc *sc,
         common = ath9k_hw_common(ah);
         ath9k_set_hw_capab(sc, hw);
 
+        /* Will be cleared in ath9k_start() */
+        set_bit(ATH_OP_INVALID, &common->op_flags);
+
         /* Initialize regulatory */
         error = ath_regd_init(&common->regulatory, sc->hw->wiphy,
                               ath9k_reg_notifier);
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 22c9e5471f9c..8d7b9b66fefa 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -1989,7 +1989,8 @@ static bool ath9k_has_tx_pending(struct ath_softc *sc)
         return !!npend;
 }
 
-static void ath9k_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
+static void ath9k_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                        u32 queues, bool drop)
 {
         struct ath_softc *sc = hw->priv;
         struct ath_hw *ah = sc->sc_ah;
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index 25304adece57..c1e82f779544 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -686,7 +686,7 @@ static bool ath_pci_eeprom_read(struct ath_common *common, u32 off, u16 *data)
         struct ath_softc *sc = (struct ath_softc *) common->priv;
         struct ath9k_platform_data *pdata = sc->dev->platform_data;
 
-        if (pdata) {
+        if (pdata && !pdata->use_eeprom) {
                 if (off >= (ARRAY_SIZE(pdata->eeprom_data))) {
                         ath_err(common,
                                 "%s: eeprom read failed, offset %08x is out of range\n",
@@ -784,7 +784,6 @@ static int ath_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 {
         struct ath_softc *sc;
         struct ieee80211_hw *hw;
-        struct ath_common *common;
         u8 csz;
         u32 val;
         int ret = 0;
@@ -877,10 +876,6 @@ static int ath_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
         wiphy_info(hw->wiphy, "%s mem=0x%lx, irq=%d\n",
                    hw_name, (unsigned long)sc->mem, pdev->irq);
 
-        /* Will be cleared in ath9k_start() */
-        common = ath9k_hw_common(sc->sc_ah);
-        set_bit(ATH_OP_INVALID, &common->op_flags);
-
         return 0;
 
 err_init:
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index a01efd3e741e..43ae199601f7 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -538,8 +538,8 @@ static void ath_rx_ps_beacon(struct ath_softc *sc, struct sk_buff *skb)
                 sc->ps_flags &= ~PS_BEACON_SYNC;
                 ath_dbg(common, PS,
                         "Reconfigure beacon timers based on synchronized timestamp\n");
-                ath9k_set_beacon(sc);
-
+                if (!(WARN_ON_ONCE(sc->cur_beacon_conf.beacon_interval == 0)))
+                        ath9k_set_beacon(sc);
                 if (sc->p2p_ps_vif)
                         ath9k_update_p2p_ps(sc, sc->p2p_ps_vif->vif);
         }
@@ -978,6 +978,7 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
         u64 tsf = 0;
         unsigned long flags;
         dma_addr_t new_buf_addr;
+        unsigned int budget = 512;
 
         if (edma)
                 dma_type = DMA_BIDIRECTIONAL;
@@ -1116,15 +1117,17 @@ requeue_drop_frag:
                 }
 requeue:
                 list_add_tail(&bf->list, &sc->rx.rxbuf);
-                if (flush)
-                        continue;
 
                 if (edma) {
                         ath_rx_edma_buf_link(sc, qtype);
                 } else {
                         ath_rx_buf_relink(sc, bf);
-                        ath9k_hw_rxena(ah);
+                        if (!flush)
+                                ath9k_hw_rxena(ah);
                 }
+
+                if (!budget--)
+                        break;
         } while (1);
 
         if (!(ah->imask & ATH9K_INT_RXEOL)) {
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 87cbec47fb48..66acb2cbd9df 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -107,9 +107,6 @@ static void ath_tx_queue_tid(struct ath_txq *txq, struct ath_atx_tid *tid)
 {
         struct ath_atx_ac *ac = tid->ac;
 
-        if (tid->paused)
-                return;
-
         if (tid->sched)
                 return;
 
@@ -1407,7 +1404,6 @@ int ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
         ath_tx_tid_change_state(sc, txtid);
 
         txtid->active = true;
-        txtid->paused = true;
         *ssn = txtid->seq_start = txtid->seq_next;
         txtid->bar_index = -1;
 
@@ -1427,7 +1423,6 @@ void ath_tx_aggr_stop(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid)
 
         ath_txq_lock(sc, txq);
         txtid->active = false;
-        txtid->paused = false;
         ath_tx_flush_tid(sc, txtid);
         ath_tx_tid_change_state(sc, txtid);
         ath_txq_unlock_complete(sc, txq);
@@ -1487,7 +1482,7 @@ void ath_tx_aggr_wakeup(struct ath_softc *sc, struct ath_node *an)
                 ath_txq_lock(sc, txq);
                 ac->clear_ps_filter = true;
 
-                if (!tid->paused && ath_tid_has_buffered(tid)) {
+                if (ath_tid_has_buffered(tid)) {
                         ath_tx_queue_tid(txq, tid);
                         ath_txq_schedule(sc, txq);
                 }
@@ -1510,7 +1505,6 @@ void ath_tx_aggr_resume(struct ath_softc *sc, struct ieee80211_sta *sta,
         ath_txq_lock(sc, txq);
 
         tid->baw_size = IEEE80211_MIN_AMPDU_BUF << sta->ht_cap.ampdu_factor;
-        tid->paused = false;
 
         if (ath_tid_has_buffered(tid)) {
                 ath_tx_queue_tid(txq, tid);
@@ -1544,8 +1538,6 @@ void ath9k_release_buffered_frames(struct ieee80211_hw *hw,
                         continue;
 
                 tid = ATH_AN_2_TID(an, i);
-                if (tid->paused)
-                        continue;
 
                 ath_txq_lock(sc, tid->ac->txq);
                 while (nframes > 0) {
@@ -1844,9 +1836,6 @@ void ath_txq_schedule(struct ath_softc *sc, struct ath_txq *txq)
                         list_del(&tid->list);
                         tid->sched = false;
 
-                        if (tid->paused)
-                                continue;
-
                         if (ath_tx_sched_aggr(sc, txq, tid, &stop))
                                 sent = true;
 
@@ -2698,7 +2687,6 @@ void ath_tx_node_init(struct ath_softc *sc, struct ath_node *an)
                 tid->baw_size  = WME_MAX_BA;
                 tid->baw_head  = tid->baw_tail = 0;
                 tid->sched     = false;
-                tid->paused    = false;
                 tid->active        = false;
                 __skb_queue_head_init(&tid->buf_q);
                 __skb_queue_head_init(&tid->retry_q);
diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c
index 4c8cdb097b65..f8ded84b7be8 100644
--- a/drivers/net/wireless/ath/carl9170/main.c
+++ b/drivers/net/wireless/ath/carl9170/main.c
@@ -1707,7 +1707,9 @@ found:
         return 0;
 }
 
-static void carl9170_op_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
+static void carl9170_op_flush(struct ieee80211_hw *hw,
+                              struct ieee80211_vif *vif,
+                              u32 queues, bool drop)
 {
         struct ar9170 *ar = hw->priv;
         unsigned int vid;
diff --git a/drivers/net/wireless/b43/Kconfig b/drivers/net/wireless/b43/Kconfig
index 088d544ec63f..1c7d27bf4bf0 100644
--- a/drivers/net/wireless/b43/Kconfig
+++ b/drivers/net/wireless/b43/Kconfig
@@ -1,7 +1,8 @@
 config B43
         tristate "Broadcom 43xx wireless support (mac80211 stack)"
-        depends on SSB_POSSIBLE && MAC80211 && HAS_DMA
-        select SSB
+        depends on (BCMA_POSSIBLE || SSB_POSSIBLE) && MAC80211 && HAS_DMA
+        select BCMA if B43_BCMA
+        select SSB if B43_SSB
         select FW_LOADER
         ---help---
           b43 is a driver for the Broadcom 43xx series wireless devices.
@@ -27,14 +28,33 @@ config B43
           If unsure, say M.
 
 config B43_BCMA
-        bool "Support for BCMA bus"
-        depends on B43 && (BCMA = y || BCMA = B43)
-        default y
+        bool
 
 config B43_SSB
         bool
-        depends on B43 && (SSB = y || SSB = B43)
-        default y
+
+choice
+        prompt "Supported bus types"
+        depends on B43
+        default B43_BCMA_AND_SSB
+
+config B43_BUSES_BCMA_AND_SSB
+        bool "BCMA and SSB"
+        depends on BCMA_POSSIBLE && SSB_POSSIBLE
+        select B43_BCMA
+        select B43_SSB
+
+config B43_BUSES_BCMA
+        bool "BCMA only"
+        depends on BCMA_POSSIBLE
+        select B43_BCMA
+
+config B43_BUSES_SSB
+        bool "SSB only"
+        depends on SSB_POSSIBLE
+        select B43_SSB
+
+endchoice
 
 # Auto-select SSB PCI-HOST support, if possible
 config B43_PCI_AUTOSELECT
@@ -98,7 +118,7 @@ config B43_BCMA_PIO
 
 config B43_PIO
         bool
-        depends on B43
+        depends on B43 && B43_SSB
         select SSB_BLOCKIO
         default y
 
@@ -116,7 +136,7 @@ config B43_PHY_N
 
 config B43_PHY_LP
         bool "Support for low-power (LP-PHY) devices"
-        depends on B43
+        depends on B43 && B43_SSB
         default y
         ---help---
           Support for the LP-PHY.
diff --git a/drivers/net/wireless/b43/bus.h b/drivers/net/wireless/b43/bus.h
index 184c95659279..f3205c6988bc 100644
--- a/drivers/net/wireless/b43/bus.h
+++ b/drivers/net/wireless/b43/bus.h
@@ -5,7 +5,9 @@ enum b43_bus_type {
 #ifdef CONFIG_B43_BCMA
         B43_BUS_BCMA,
 #endif
+#ifdef CONFIG_B43_SSB
         B43_BUS_SSB,
+#endif
 };
 
 struct b43_bus_dev {
@@ -52,13 +54,21 @@ struct b43_bus_dev {
 
 static inline bool b43_bus_host_is_pcmcia(struct b43_bus_dev *dev)
 {
+#ifdef CONFIG_B43_SSB
         return (dev->bus_type == B43_BUS_SSB &&
                 dev->sdev->bus->bustype == SSB_BUSTYPE_PCMCIA);
+#else
+        return false;
+#endif
 }
 static inline bool b43_bus_host_is_sdio(struct b43_bus_dev *dev)
 {
+#ifdef CONFIG_B43_SSB
         return (dev->bus_type == B43_BUS_SSB &&
                 dev->sdev->bus->bustype == SSB_BUSTYPE_SDIO);
+#else
+        return false;
+#endif
 }
 
 struct b43_bus_dev *b43_bus_dev_bcma_init(struct bcma_device *core);
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 07024c69d0b5..558abe7718e4 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -1195,14 +1195,20 @@ static void b43_bcma_wireless_core_reset(struct b43_wldev *dev, bool gmode)
                   B43_BCMA_CLKCTLST_PHY_PLL_REQ;
         u32 status = B43_BCMA_CLKCTLST_80211_PLL_ST |
                      B43_BCMA_CLKCTLST_PHY_PLL_ST;
+        u32 flags;
+
+        flags = B43_BCMA_IOCTL_PHY_CLKEN;
+        if (gmode)
+                flags |= B43_BCMA_IOCTL_GMODE;
+        b43_device_enable(dev, flags);
 
-        b43_device_enable(dev, B43_BCMA_IOCTL_PHY_CLKEN);
         bcma_core_set_clockmode(dev->dev->bdev, BCMA_CLKMODE_FAST);
         b43_bcma_phy_reset(dev);
         bcma_core_pll_ctl(dev->dev->bdev, req, status, true);
 }
 #endif
 
+#ifdef CONFIG_B43_SSB
 static void b43_ssb_wireless_core_reset(struct b43_wldev *dev, bool gmode)
 {
         struct ssb_device *sdev = dev->dev->sdev;
@@ -1230,6 +1236,7 @@ static void b43_ssb_wireless_core_reset(struct b43_wldev *dev, bool gmode)
         ssb_read32(sdev, SSB_TMSLOW);   /* flush */
         msleep(1);
 }
+#endif
 
 void b43_wireless_core_reset(struct b43_wldev *dev, bool gmode)
 {
@@ -2730,6 +2737,8 @@ out:
 /* Initialize the GPIOs
  * http://bcm-specs.sipsolutions.net/GPIO
  */
+
+#ifdef CONFIG_B43_SSB
 static struct ssb_device *b43_ssb_gpio_dev(struct b43_wldev *dev)
 {
         struct ssb_bus *bus = dev->dev->sdev->bus;
@@ -2740,10 +2749,13 @@ static struct ssb_device *b43_ssb_gpio_dev(struct b43_wldev *dev)
         return bus->chipco.dev;
 #endif
 }
+#endif
 
 static int b43_gpio_init(struct b43_wldev *dev)
 {
+#ifdef CONFIG_B43_SSB
         struct ssb_device *gpiodev;
+#endif
         u32 mask, set;
 
         b43_maskset32(dev, B43_MMIO_MACCTL, ~B43_MACCTL_GPOUTSMSK, 0);
@@ -2802,7 +2814,9 @@ static int b43_gpio_init(struct b43_wldev *dev)
 /* Turn off all GPIO stuff. Call this on module unload, for example. */
 static void b43_gpio_cleanup(struct b43_wldev *dev)
 {
+#ifdef CONFIG_B43_SSB
         struct ssb_device *gpiodev;
+#endif
 
         switch (dev->dev->bus_type) {
 #ifdef CONFIG_B43_BCMA
@@ -3687,7 +3701,9 @@ static void b43_op_set_tsf(struct ieee80211_hw *hw,
 
 static void b43_put_phy_into_reset(struct b43_wldev *dev)
 {
+#ifdef CONFIG_B43_SSB
         u32 tmp;
+#endif
 
         switch (dev->dev->bus_type) {
 #ifdef CONFIG_B43_BCMA
@@ -4577,8 +4593,12 @@ static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev)
         struct ssb_bus *bus;
         u32 tmp;
 
+#ifdef CONFIG_B43_SSB
         if (dev->dev->bus_type != B43_BUS_SSB)
                 return;
+#else
+        return;
+#endif
 
         bus = dev->dev->sdev->bus;
 
@@ -4733,7 +4753,7 @@ static int b43_wireless_core_init(struct b43_wldev *dev)
         }
         if (sprom->boardflags_lo & B43_BFL_XTAL_NOSLOW)
                 hf |= B43_HF_DSCRQ; /* Disable slowclock requests from ucode. */
-#ifdef CONFIG_SSB_DRIVER_PCICORE
+#if defined(CONFIG_B43_SSB) && defined(CONFIG_SSB_DRIVER_PCICORE)
         if (dev->dev->bus_type == B43_BUS_SSB &&
             dev->dev->sdev->bus->bustype == SSB_BUSTYPE_PCI &&
             dev->dev->sdev->bus->pcicore.dev->id.revision <= 10)
@@ -5173,7 +5193,6 @@ static int b43_wireless_core_attach(struct b43_wldev *dev)
         }
 
         dev->phy.gmode = have_2ghz_phy;
-        dev->phy.radio_on = true;
         b43_wireless_core_reset(dev, dev->phy.gmode);
 
         err = b43_phy_versioning(dev);
@@ -5306,6 +5325,7 @@ static int b43_one_core_attach(struct b43_bus_dev *dev, struct b43_wl *wl)
         (pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) &&       \
         (pdev->subsystem_device == _subdevice)                          )
 
+#ifdef CONFIG_B43_SSB
 static void b43_sprom_fixup(struct ssb_bus *bus)
 {
         struct pci_dev *pdev;
@@ -5337,6 +5357,7 @@ static void b43_wireless_exit(struct b43_bus_dev *dev, struct b43_wl *wl)
         ssb_set_devtypedata(dev->sdev, NULL);
         ieee80211_free_hw(hw);
 }
+#endif
 
 static struct b43_wl *b43_wireless_init(struct b43_bus_dev *dev)
 {
diff --git a/drivers/net/wireless/b43/phy_common.c b/drivers/net/wireless/b43/phy_common.c
index dbaa51890198..3e45989f418d 100644
--- a/drivers/net/wireless/b43/phy_common.c
+++ b/drivers/net/wireless/b43/phy_common.c
@@ -96,7 +96,7 @@ int b43_phy_init(struct b43_wldev *dev)
 
         phy->channel = ops->get_default_chan(dev);
 
-        ops->software_rfkill(dev, false);
+        b43_software_rfkill(dev, false);
         err = ops->init(dev);
         if (err) {
                 b43err(dev->wl, "PHY init failed\n");
@@ -116,7 +116,7 @@ err_phy_exit:
         if (ops->exit)
                 ops->exit(dev);
 err_block_rf:
-        ops->software_rfkill(dev, true);
+        b43_software_rfkill(dev, true);
 
         return err;
 }
@@ -125,7 +125,7 @@ void b43_phy_exit(struct b43_wldev *dev)
 {
         const struct b43_phy_operations *ops = dev->phy.ops;
 
-        ops->software_rfkill(dev, true);
+        b43_software_rfkill(dev, true);
         if (ops->exit)
                 ops->exit(dev);
 }
diff --git a/drivers/net/wireless/b43/phy_n.c b/drivers/net/wireless/b43/phy_n.c
index 482b31210d28..41dab89a2942 100644
--- a/drivers/net/wireless/b43/phy_n.c
+++ b/drivers/net/wireless/b43/phy_n.c
@@ -807,9 +807,16 @@ static void b43_radio_2056_setup(struct b43_wldev *dev,
         u16 bias, cbias;
         u16 pag_boost, padg_boost, pgag_boost, mixg_boost;
         u16 paa_boost, pada_boost, pgaa_boost, mixa_boost;
+        bool is_pkg_fab_smic;
 
         B43_WARN_ON(dev->phy.rev < 3);
 
+        is_pkg_fab_smic =
+                ((dev->dev->chip_id == BCMA_CHIP_ID_BCM43224 ||
+                  dev->dev->chip_id == BCMA_CHIP_ID_BCM43225 ||
+                  dev->dev->chip_id == BCMA_CHIP_ID_BCM43421) &&
+                 dev->dev->chip_pkg == BCMA_PKG_ID_BCM43224_FAB_SMIC);
+
         b43_chantab_radio_2056_upload(dev, e);
         b2056_upload_syn_pll_cp2(dev, band == IEEE80211_BAND_5GHZ);
 
@@ -817,7 +824,8 @@ static void b43_radio_2056_setup(struct b43_wldev *dev,
             b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ) {
                 b43_radio_write(dev, B2056_SYN_PLL_LOOPFILTER1, 0x1F);
                 b43_radio_write(dev, B2056_SYN_PLL_LOOPFILTER2, 0x1F);
-                if (dev->dev->chip_id == 0x4716) {
+                if (dev->dev->chip_id == BCMA_CHIP_ID_BCM4716 ||
+                    dev->dev->chip_id == BCMA_CHIP_ID_BCM47162) {
                         b43_radio_write(dev, B2056_SYN_PLL_LOOPFILTER4, 0x14);
                         b43_radio_write(dev, B2056_SYN_PLL_CP2, 0);
                 } else {
@@ -825,6 +833,13 @@ static void b43_radio_2056_setup(struct b43_wldev *dev,
                         b43_radio_write(dev, B2056_SYN_PLL_CP2, 0x14);
                 }
         }
+        if (sprom->boardflags2_hi & B43_BFH2_GPLL_WAR2 &&
+            b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ) {
+                b43_radio_write(dev, B2056_SYN_PLL_LOOPFILTER1, 0x1f);
+                b43_radio_write(dev, B2056_SYN_PLL_LOOPFILTER2, 0x1f);
+                b43_radio_write(dev, B2056_SYN_PLL_LOOPFILTER4, 0x0b);
+                b43_radio_write(dev, B2056_SYN_PLL_CP2, 0x20);
+        }
         if (sprom->boardflags2_lo & B43_BFL2_APLL_WAR &&
             b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ) {
                 b43_radio_write(dev, B2056_SYN_PLL_LOOPFILTER1, 0x1F);
@@ -840,7 +855,8 @@ static void b43_radio_2056_setup(struct b43_wldev *dev,
                                 b43_radio_write(dev,
                                         offset | B2056_TX_PADG_IDAC, 0xcc);
 
-                                if (dev->dev->chip_id == 0x4716) {
+                                if (dev->dev->chip_id == BCMA_CHIP_ID_BCM4716 ||
+                                    dev->dev->chip_id == BCMA_CHIP_ID_BCM47162) {
                                         bias = 0x40;
                                         cbias = 0x45;
                                         pag_boost = 0x5;
@@ -849,6 +865,10 @@ static void b43_radio_2056_setup(struct b43_wldev *dev,
                                 } else {
                                         bias = 0x25;
                                         cbias = 0x20;
+                                        if (is_pkg_fab_smic) {
+                                                bias = 0x2a;
+                                                cbias = 0x38;
+                                        }
                                         pag_boost = 0x4;
                                         pgag_boost = 0x03;
                                         mixg_boost = 0x65;
@@ -917,6 +937,8 @@ static void b43_radio_2056_setup(struct b43_wldev *dev,
                         mixa_boost = 0xF;
                 }
 
+                cbias = is_pkg_fab_smic ? 0x35 : 0x30;
+
                 for (i = 0; i < 2; i++) {
                         offset = i ? B2056_TX1 : B2056_TX0;
 
@@ -935,11 +957,11 @@ static void b43_radio_2056_setup(struct b43_wldev *dev,
                         b43_radio_write(dev,
                                 offset | B2056_TX_PADA_CASCBIAS, 0x03);
                         b43_radio_write(dev,
-                                offset | B2056_TX_INTPAA_IAUX_STAT, 0x50);
+                                offset | B2056_TX_INTPAA_IAUX_STAT, 0x30);
                         b43_radio_write(dev,
-                                offset | B2056_TX_INTPAA_IMAIN_STAT, 0x50);
+                                offset | B2056_TX_INTPAA_IMAIN_STAT, 0x30);
                         b43_radio_write(dev,
-                                offset | B2056_TX_INTPAA_CASCBIAS, 0x30);
+                                offset | B2056_TX_INTPAA_CASCBIAS, cbias);
                 }
         }
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/chip.c b/drivers/net/wireless/brcm80211/brcmfmac/chip.c
index df130ef53d1c..c7c9f15c0fe0 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/chip.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/chip.c
@@ -303,10 +303,10 @@ static void brcmf_chip_ai_coredisable(struct brcmf_core_priv *core,
 
         ci = core->chip;
 
-        /* if core is already in reset, just return */
+        /* if core is already in reset, skip reset */
         regdata = ci->ops->read32(ci->ctx, core->wrapbase + BCMA_RESET_CTL);
         if ((regdata & BCMA_RESET_CTL_RESET) != 0)
-                return;
+                goto in_reset_configure;
 
         /* configure reset */
         ci->ops->write32(ci->ctx, core->wrapbase + BCMA_IOCTL,
@@ -322,6 +322,7 @@ static void brcmf_chip_ai_coredisable(struct brcmf_core_priv *core,
         SPINWAIT(ci->ops->read32(ci->ctx, core->wrapbase + BCMA_RESET_CTL) !=
                  BCMA_RESET_CTL_RESET, 300);
 
+in_reset_configure:
         /* in-reset configure */
         ci->ops->write32(ci->ctx, core->wrapbase + BCMA_IOCTL,
                          reset | BCMA_IOCTL_FGC | BCMA_IOCTL_CLK);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
index 939d6b132922..16f9ab2568a8 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
@@ -186,7 +186,7 @@ void brcmf_del_if(struct brcmf_pub *drvr, s32 bssidx);
 void brcmf_txflowblock_if(struct brcmf_if *ifp,
                           enum brcmf_netif_stop_reason reason, bool state);
 u32 brcmf_get_chip_info(struct brcmf_if *ifp);
-void brcmf_txfinalize(struct brcmf_pub *drvr, struct sk_buff *txp,
+void brcmf_txfinalize(struct brcmf_pub *drvr, struct sk_buff *txp, u8 ifidx,
                       bool success);
 
 /* Sets dongle media info (drv_version, mac address). */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
index c4535616064e..c5dcd82e884b 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
@@ -99,6 +99,7 @@ struct brcmf_bus {
         unsigned long tx_realloc;
         u32 chip;
         u32 chiprev;
+        bool always_use_fws_queue;
 
         struct brcmf_bus_ops *ops;
 };
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
index 6a8983a1fb9c..ed3e32ce8c23 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
@@ -32,6 +32,9 @@
 #define BRCMF_DEFAULT_SCAN_UNASSOC_TIME 40
 #define BRCMF_DEFAULT_PACKET_FILTER     "100 0 0 0 0x01 0x00"
 
+/* boost value for RSSI_DELTA in preferred join selection */
+#define BRCMF_JOIN_PREF_RSSI_BOOST      8
+
 
 bool brcmf_c_prec_enq(struct device *dev, struct pktq *q,
                       struct sk_buff *pkt, int prec)
@@ -246,6 +249,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_if *ifp)
 {
         s8 eventmask[BRCMF_EVENTING_MASK_LEN];
         u8 buf[BRCMF_DCMD_SMLEN];
+        struct brcmf_join_pref_params join_pref_params[2];
         char *ptr;
         s32 err;
 
@@ -298,6 +302,20 @@ int brcmf_c_preinit_dcmds(struct brcmf_if *ifp)
                 goto done;
         }
 
+        /* Setup join_pref to select target by RSSI(with boost on 5GHz) */
+        join_pref_params[0].type = BRCMF_JOIN_PREF_RSSI_DELTA;
+        join_pref_params[0].len = 2;
+        join_pref_params[0].rssi_gain = BRCMF_JOIN_PREF_RSSI_BOOST;
+        join_pref_params[0].band = WLC_BAND_5G;
+        join_pref_params[1].type = BRCMF_JOIN_PREF_RSSI;
+        join_pref_params[1].len = 2;
+        join_pref_params[1].rssi_gain = 0;
+        join_pref_params[1].band = 0;
+        err = brcmf_fil_iovar_data_set(ifp, "join_pref", join_pref_params,
+                                       sizeof(join_pref_params));
+        if (err)
+                brcmf_err("Set join_pref error (%d)\n", err);
+
         /* Setup event_msgs, enable E_IF */
         err = brcmf_fil_iovar_data_get(ifp, "event_msgs", eventmask,
                                        BRCMF_EVENTING_MASK_LEN);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
index 7d28cd385092..4cacc3d85212 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
@@ -190,7 +190,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,
         int ret;
         struct brcmf_if *ifp = netdev_priv(ndev);
         struct brcmf_pub *drvr = ifp->drvr;
-        struct ethhdr *eh;
+        struct ethhdr *eh = (struct ethhdr *)(skb->data);
 
         brcmf_dbg(DATA, "Enter, idx=%d\n", ifp->bssidx);
 
@@ -236,6 +236,9 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,
                 goto done;
         }
 
+        if (eh->h_proto == htons(ETH_P_PAE))
+                atomic_inc(&ifp->pend_8021x_cnt);
+
         ret = brcmf_fws_process_skb(ifp, skb);
 
 done:
@@ -538,31 +541,26 @@ void brcmf_rx_frame(struct device *dev, struct sk_buff *skb)
                 brcmf_netif_rx(ifp, skb);
 }
 
-void brcmf_txfinalize(struct brcmf_pub *drvr, struct sk_buff *txp,
+void brcmf_txfinalize(struct brcmf_pub *drvr, struct sk_buff *txp, u8 ifidx,
                       bool success)
 {
         struct brcmf_if *ifp;
         struct ethhdr *eh;
-        u8 ifidx;
         u16 type;
-        int res;
-
-        res = brcmf_proto_hdrpull(drvr, false, &ifidx, txp);
 
         ifp = drvr->iflist[ifidx];
         if (!ifp)
                 goto done;
 
-        if (res == 0) {
-                eh = (struct ethhdr *)(txp->data);
-                type = ntohs(eh->h_proto);
+        eh = (struct ethhdr *)(txp->data);
+        type = ntohs(eh->h_proto);
 
-                if (type == ETH_P_PAE) {
-                        atomic_dec(&ifp->pend_8021x_cnt);
-                        if (waitqueue_active(&ifp->pend_8021x_wait))
-                                wake_up(&ifp->pend_8021x_wait);
-                }
+        if (type == ETH_P_PAE) {
+                atomic_dec(&ifp->pend_8021x_cnt);
+                if (waitqueue_active(&ifp->pend_8021x_wait))
+                        wake_up(&ifp->pend_8021x_wait);
         }
+
         if (!success)
                 ifp->stats.tx_errors++;
 done:
@@ -573,13 +571,17 @@ void brcmf_txcomplete(struct device *dev, struct sk_buff *txp, bool success)
 {
         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
         struct brcmf_pub *drvr = bus_if->drvr;
+        u8 ifidx;
 
         /* await txstatus signal for firmware if active */
         if (brcmf_fws_fc_active(drvr->fws)) {
                 if (!success)
                         brcmf_fws_bustxfail(drvr->fws, txp);
         } else {
-                brcmf_txfinalize(drvr, txp, success);
+                if (brcmf_proto_hdrpull(drvr, false, &ifidx, txp))
+                        brcmu_pkt_buf_free_skb(txp);
+                else
+                        brcmf_txfinalize(drvr, txp, ifidx, success);
         }
 }
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h b/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
index 614e4888504f..2bc68a2137fc 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
@@ -53,6 +53,14 @@
 #define BRCMF_OBSS_COEX_OFF             0
 #define BRCMF_OBSS_COEX_ON              1
 
+/* join preference types for join_pref iovar */
+enum brcmf_join_pref_types {
+        BRCMF_JOIN_PREF_RSSI = 1,
+        BRCMF_JOIN_PREF_WPA,
+        BRCMF_JOIN_PREF_BAND,
+        BRCMF_JOIN_PREF_RSSI_DELTA,
+};
+
 enum brcmf_fil_p2p_if_types {
         BRCMF_FIL_P2P_IF_CLIENT,
         BRCMF_FIL_P2P_IF_GO,
@@ -282,6 +290,22 @@ struct brcmf_assoc_params_le {
         __le16 chanspec_list[1];
 };
 
+/**
+ * struct join_pref params - parameters for preferred join selection.
+ *
+ * @type: preference type (see enum brcmf_join_pref_types).
+ * @len: length of bytes following (currently always 2).
+ * @rssi_gain: signal gain for selection (only when @type is RSSI_DELTA).
+ * @band: band to which selection preference applies.
+ *      This is used if @type is BAND or RSSI_DELTA.
+ */
+struct brcmf_join_pref_params {
+        u8 type;
+        u8 len;
+        u8 rssi_gain;
+        u8 band;
+};
+
 /* used for join with or without a specific bssid and channel list */
 struct brcmf_join_params {
         struct brcmf_ssid_le ssid_le;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
index c3e7d76dbf35..699908de314a 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
@@ -476,6 +476,7 @@ struct brcmf_fws_info {
         bool bus_flow_blocked;
         bool creditmap_received;
         u8 mode;
+        bool avoid_queueing;
 };
 
 /*
@@ -1369,13 +1370,12 @@ done:
 }
 
 static int brcmf_fws_txstatus_suppressed(struct brcmf_fws_info *fws, int fifo,
-                                         struct sk_buff *skb, u32 genbit,
-                                         u16 seq)
+                                         struct sk_buff *skb, u8 ifidx,
+                                         u32 genbit, u16 seq)
 {
         struct brcmf_fws_mac_descriptor *entry = brcmf_skbcb(skb)->mac;
         u32 hslot;
         int ret;
-        u8 ifidx;
 
         hslot = brcmf_skb_htod_tag_get_field(skb, HSLOT);
 
@@ -1389,29 +1389,21 @@ static int brcmf_fws_txstatus_suppressed(struct brcmf_fws_info *fws, int fifo,
 
         entry->generation = genbit;
 
-        ret = brcmf_proto_hdrpull(fws->drvr, false, &ifidx, skb);
-        if (ret == 0) {
-                brcmf_skb_htod_tag_set_field(skb, GENERATION, genbit);
-                brcmf_skbcb(skb)->htod_seq = seq;
-                if (brcmf_skb_htod_seq_get_field(skb, FROMFW)) {
-                        brcmf_skb_htod_seq_set_field(skb, FROMDRV, 1);
-                        brcmf_skb_htod_seq_set_field(skb, FROMFW, 0);
-                } else {
-                        brcmf_skb_htod_seq_set_field(skb, FROMDRV, 0);
-                }
-                ret = brcmf_fws_enq(fws, BRCMF_FWS_SKBSTATE_SUPPRESSED, fifo,
-                                    skb);
+        brcmf_skb_htod_tag_set_field(skb, GENERATION, genbit);
+        brcmf_skbcb(skb)->htod_seq = seq;
+        if (brcmf_skb_htod_seq_get_field(skb, FROMFW)) {
+                brcmf_skb_htod_seq_set_field(skb, FROMDRV, 1);
+                brcmf_skb_htod_seq_set_field(skb, FROMFW, 0);
+        } else {
+                brcmf_skb_htod_seq_set_field(skb, FROMDRV, 0);
         }
+        ret = brcmf_fws_enq(fws, BRCMF_FWS_SKBSTATE_SUPPRESSED, fifo, skb);
 
         if (ret != 0) {
-                /* suppress q is full or hdrpull failed, drop this packet */
-                brcmf_fws_hanger_poppkt(&fws->hanger, hslot, &skb,
-                                        true);
+                /* suppress q is full drop this packet */
+                brcmf_fws_hanger_poppkt(&fws->hanger, hslot, &skb, true);
         } else {
-                /*
-                 * Mark suppressed to avoid a double free during
-                 * wlfc cleanup
-                 */
+                /* Mark suppressed to avoid a double free during wlfc cleanup */
                 brcmf_fws_hanger_mark_suppressed(&fws->hanger, hslot);
         }
 
@@ -1428,6 +1420,7 @@ brcmf_fws_txs_process(struct brcmf_fws_info *fws, u8 flags, u32 hslot,
         struct sk_buff *skb;
         struct brcmf_skbuff_cb *skcb;
         struct brcmf_fws_mac_descriptor *entry = NULL;
+        u8 ifidx;
 
         brcmf_dbg(DATA, "flags %d\n", flags);
 
@@ -1476,12 +1469,15 @@ brcmf_fws_txs_process(struct brcmf_fws_info *fws, u8 flags, u32 hslot,
         }
         brcmf_fws_macdesc_return_req_credit(skb);
 
+        if (brcmf_proto_hdrpull(fws->drvr, false, &ifidx, skb)) {
+                brcmu_pkt_buf_free_skb(skb);
+                return -EINVAL;
+        }
         if (!remove_from_hanger)
-                ret = brcmf_fws_txstatus_suppressed(fws, fifo, skb, genbit,
-                                                    seq);
-
+                ret = brcmf_fws_txstatus_suppressed(fws, fifo, skb, ifidx,
+                                                    genbit, seq);
         if (remove_from_hanger || ret)
-                brcmf_txfinalize(fws->drvr, skb, true);
+                brcmf_txfinalize(fws->drvr, skb, ifidx, true);
 
         return 0;
 }
@@ -1868,7 +1864,7 @@ int brcmf_fws_process_skb(struct brcmf_if *ifp, struct sk_buff *skb)
         struct ethhdr *eh = (struct ethhdr *)(skb->data);
         int fifo = BRCMF_FWS_FIFO_BCMC;
         bool multicast = is_multicast_ether_addr(eh->h_dest);
-        bool pae = eh->h_proto == htons(ETH_P_PAE);
+        int rc = 0;
 
         brcmf_dbg(DATA, "tx proto=0x%X\n", ntohs(eh->h_proto));
         /* determine the priority */
@@ -1876,8 +1872,13 @@ int brcmf_fws_process_skb(struct brcmf_if *ifp, struct sk_buff *skb)
                 skb->priority = cfg80211_classify8021d(skb, NULL);
 
         drvr->tx_multicast += !!multicast;
-        if (pae)
-                atomic_inc(&ifp->pend_8021x_cnt);
+
+        if (fws->avoid_queueing) {
+                rc = brcmf_proto_txdata(drvr, ifp->ifidx, 0, skb);
+                if (rc < 0)
+                        brcmf_txfinalize(drvr, skb, ifp->ifidx, false);
+                return rc;
+        }
 
         /* set control buffer information */
         skcb->if_flags = 0;
@@ -1899,15 +1900,12 @@ int brcmf_fws_process_skb(struct brcmf_if *ifp, struct sk_buff *skb)
                 brcmf_fws_schedule_deq(fws);
         } else {
                 brcmf_err("drop skb: no hanger slot\n");
-                if (pae) {
-                        atomic_dec(&ifp->pend_8021x_cnt);
-                        if (waitqueue_active(&ifp->pend_8021x_wait))
-                                wake_up(&ifp->pend_8021x_wait);
-                }
-                brcmu_pkt_buf_free_skb(skb);
+                brcmf_txfinalize(drvr, skb, ifp->ifidx, false);
+                rc = -ENOMEM;
         }
         brcmf_fws_unlock(fws);
-        return 0;
+
+        return rc;
 }
 
 void brcmf_fws_reset_interface(struct brcmf_if *ifp)
@@ -1982,7 +1980,8 @@ static void brcmf_fws_dequeue_worker(struct work_struct *worker)
                                 ret = brcmf_proto_txdata(drvr, ifidx, 0, skb);
                                 brcmf_fws_lock(fws);
                                 if (ret < 0)
-                                        brcmf_txfinalize(drvr, skb, false);
+                                        brcmf_txfinalize(drvr, skb, ifidx,
+                                                         false);
                                 if (fws->bus_flow_blocked)
                                         break;
                         }
@@ -2039,6 +2038,13 @@ int brcmf_fws_init(struct brcmf_pub *drvr)
         fws->drvr = drvr;
         fws->fcmode = fcmode;
 
+        if ((drvr->bus_if->always_use_fws_queue == false) &&
+            (fcmode == BRCMF_FWS_FCMODE_NONE)) {
+                fws->avoid_queueing = true;
+                brcmf_dbg(INFO, "FWS queueing will be avoided\n");
+                return 0;
+        }
+
         fws->fws_wq = create_singlethread_workqueue("brcmf_fws_wq");
         if (fws->fws_wq == NULL) {
                 brcmf_err("workqueue creation failed\n");
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/nvram.c b/drivers/net/wireless/brcm80211/brcmfmac/nvram.c
index d5ef86db631b..5c450d11dbc9 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/nvram.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/nvram.c
@@ -18,72 +18,205 @@
 #include <linux/slab.h>
 #include <linux/firmware.h>
 
+#include "dhd_dbg.h"
 #include "nvram.h"
 
-/* brcmf_nvram_strip :Takes a buffer of "<var>=<value>\n" lines read from a file
+enum nvram_parser_state {
+        IDLE,
+        KEY,
+        VALUE,
+        COMMENT,
+        END
+};
+
+/**
+ * struct nvram_parser - internal info for parser.
+ *
+ * @state: current parser state.
+ * @fwnv: input buffer being parsed.
+ * @nvram: output buffer with parse result.
+ * @nvram_len: lenght of parse result.
+ * @line: current line.
+ * @column: current column in line.
+ * @pos: byte offset in input buffer.
+ * @entry: start position of key,value entry.
+ */
+struct nvram_parser {
+        enum nvram_parser_state state;
+        const struct firmware *fwnv;
+        u8 *nvram;
+        u32 nvram_len;
+        u32 line;
+        u32 column;
+        u32 pos;
+        u32 entry;
+};
+
+static bool is_nvram_char(char c)
+{
+        /* comment marker excluded */
+        if (c == '#')
+                return false;
+
+        /* key and value may have any other readable character */
+        return (c > 0x20 && c < 0x7f);
+}
+
+static bool is_whitespace(char c)
+{
+        return (c == ' ' || c == '\r' || c == '\n' || c == '\t');
+}
+
+static enum nvram_parser_state brcmf_nvram_handle_idle(struct nvram_parser *nvp)
+{
+        char c;
+
+        c = nvp->fwnv->data[nvp->pos];
+        if (c == '\n')
+                return COMMENT;
+        if (is_whitespace(c))
+                goto proceed;
+        if (c == '#')
+                return COMMENT;
+        if (is_nvram_char(c)) {
+                nvp->entry = nvp->pos;
+                return KEY;
+        }
+        brcmf_dbg(INFO, "warning: ln=%d:col=%d: ignoring invalid character\n",
+                  nvp->line, nvp->column);
+proceed:
+        nvp->column++;
+        nvp->pos++;
+        return IDLE;
+}
+
+static enum nvram_parser_state brcmf_nvram_handle_key(struct nvram_parser *nvp)
+{
+        enum nvram_parser_state st = nvp->state;
+        char c;
+
+        c = nvp->fwnv->data[nvp->pos];
+        if (c == '=') {
+                st = VALUE;
+        } else if (!is_nvram_char(c)) {
+                brcmf_dbg(INFO, "warning: ln=%d:col=%d: '=' expected, skip invalid key entry\n",
+                          nvp->line, nvp->column);
+                return COMMENT;
+        }
+
+        nvp->column++;
+        nvp->pos++;
+        return st;
+}
+
+static enum nvram_parser_state
+brcmf_nvram_handle_value(struct nvram_parser *nvp)
+{
+        char c;
+        char *skv;
+        char *ekv;
+        u32 cplen;
+
+        c = nvp->fwnv->data[nvp->pos];
+        if (!is_nvram_char(c)) {
+                /* key,value pair complete */
+                ekv = (u8 *)&nvp->fwnv->data[nvp->pos];
+                skv = (u8 *)&nvp->fwnv->data[nvp->entry];
+                cplen = ekv - skv;
+                /* copy to output buffer */
+                memcpy(&nvp->nvram[nvp->nvram_len], skv, cplen);
+                nvp->nvram_len += cplen;
+                nvp->nvram[nvp->nvram_len] = '\0';
+                nvp->nvram_len++;
+                return IDLE;
+        }
+        nvp->pos++;
+        nvp->column++;
+        return VALUE;
+}
+
+static enum nvram_parser_state
+brcmf_nvram_handle_comment(struct nvram_parser *nvp)
+{
+        char *eol, *sol;
+
+        sol = (char *)&nvp->fwnv->data[nvp->pos];
+        eol = strchr(sol, '\n');
+        if (eol == NULL)
+                return END;
+
+        /* eat all moving to next line */
+        nvp->line++;
+        nvp->column = 1;
+        nvp->pos += (eol - sol) + 1;
+        return IDLE;
+}
+
+static enum nvram_parser_state brcmf_nvram_handle_end(struct nvram_parser *nvp)
+{
+        /* final state */
+        return END;
+}
+
+static enum nvram_parser_state
+(*nv_parser_states[])(struct nvram_parser *nvp) = {
+        brcmf_nvram_handle_idle,
+        brcmf_nvram_handle_key,
+        brcmf_nvram_handle_value,
+        brcmf_nvram_handle_comment,
+        brcmf_nvram_handle_end
+};
+
+static int brcmf_init_nvram_parser(struct nvram_parser *nvp,
+                                   const struct firmware *nv)
+{
+        memset(nvp, 0, sizeof(*nvp));
+        nvp->fwnv = nv;
+        /* Alloc for extra 0 byte + roundup by 4 + length field */
+        nvp->nvram = kzalloc(nv->size + 1 + 3 + sizeof(u32), GFP_KERNEL);
+        if (!nvp->nvram)
+                return -ENOMEM;
+
+        nvp->line = 1;
+        nvp->column = 1;
+        return 0;
+}
+
+/* brcmf_nvram_strip :Takes a buffer of "<var>=<value>\n" lines read from a fil
  * and ending in a NUL. Removes carriage returns, empty lines, comment lines,
  * and converts newlines to NULs. Shortens buffer as needed and pads with NULs.
  * End of buffer is completed with token identifying length of buffer.
  */
 void *brcmf_nvram_strip(const struct firmware *nv, u32 *new_length)
 {
-        u8 *nvram;
-        u32 i;
-        u32 len;
-        u32 column;
-        u8 val;
-        bool comment;
+        struct nvram_parser nvp;
+        u32 pad;
         u32 token;
         __le32 token_le;
 
-        /* Alloc for extra 0 byte + roundup by 4 + length field */
-        nvram = kmalloc(nv->size + 1 + 3 + sizeof(token_le), GFP_KERNEL);
-        if (!nvram)
+        if (brcmf_init_nvram_parser(&nvp, nv) < 0)
                 return NULL;
 
-        len = 0;
-        column = 0;
-        comment = false;
-        for (i = 0; i < nv->size; i++) {
-                val = nv->data[i];
-                if (val == 0)
+        while (nvp.pos < nv->size) {
+                nvp.state = nv_parser_states[nvp.state](&nvp);
+                if (nvp.state == END)
                         break;
-                if (val == '\r')
-                        continue;
-                if (comment && (val != '\n'))
-                        continue;
-                comment = false;
-                if (val == '#') {
-                        comment = true;
-                        continue;
-                }
-                if (val == '\n') {
-                        if (column == 0)
-                                continue;
-                        nvram[len] = 0;
-                        len++;
-                        column = 0;
-                        continue;
-                }
-                nvram[len] = val;
-                len++;
-                column++;
         }
-        column = len;
-        *new_length = roundup(len + 1, 4);
-        while (column != *new_length) {
-                nvram[column] = 0;
-                column++;
+        pad = nvp.nvram_len;
+        *new_length = roundup(nvp.nvram_len + 1, 4);
+        while (pad != *new_length) {
+                nvp.nvram[pad] = 0;
+                pad++;
         }
 
         token = *new_length / 4;
         token = (~token << 16) | (token & 0x0000FFFF);
         token_le = cpu_to_le32(token);
 
-        memcpy(&nvram[*new_length], &token_le, sizeof(token_le));
+        memcpy(&nvp.nvram[*new_length], &token_le, sizeof(token_le));
         *new_length += sizeof(token_le);
 
-        return nvram;
+        return nvp.nvram;
 }
 
 void brcmf_nvram_free(void *nvram)
@@ -91,4 +224,3 @@ void brcmf_nvram_free(void *nvram)
         kfree(nvram);
 }
 
-
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
index 24f65cd53859..3ce0e7cfd027 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
@@ -1254,6 +1254,7 @@ static int brcmf_usb_probe_cb(struct brcmf_usbdev_info *devinfo)
         bus->chip = bus_pub->devid;
         bus->chiprev = bus_pub->chiprev;
         bus->proto_type = BRCMF_PROTO_BCDC;
+        bus->always_use_fws_queue = true;
 
         /* Attach to the common driver interface */
         ret = brcmf_attach(dev);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
index afb3d15e38ff..70bc2542061a 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
@@ -221,9 +221,9 @@ static const struct ieee80211_regdomain brcmf_regdom = {
                  */
                 REG_RULE(2484-10, 2484+10, 20, 6, 20, 0),
                 /* IEEE 802.11a, channel 36..64 */
-                REG_RULE(5150-10, 5350+10, 40, 6, 20, 0),
+                REG_RULE(5150-10, 5350+10, 80, 6, 20, 0),
                 /* IEEE 802.11a, channel 100..165 */
-                REG_RULE(5470-10, 5850+10, 40, 6, 20, 0), }
+                REG_RULE(5470-10, 5850+10, 80, 6, 20, 0), }
 };
 
 static const u32 __wl_cipher_suites[] = {
@@ -341,6 +341,60 @@ static u8 brcmf_mw_to_qdbm(u16 mw)
         return qdbm;
 }
 
+u16 chandef_to_chanspec(struct brcmu_d11inf *d11inf,
+                        struct cfg80211_chan_def *ch)
+{
+        struct brcmu_chan ch_inf;
+        s32 primary_offset;
+
+        brcmf_dbg(TRACE, "chandef: control %d center %d width %d\n",
+                  ch->chan->center_freq, ch->center_freq1, ch->width);
+        ch_inf.chnum = ieee80211_frequency_to_channel(ch->center_freq1);
+        primary_offset = ch->center_freq1 - ch->chan->center_freq;
+        switch (ch->width) {
+        case NL80211_CHAN_WIDTH_20:
+                ch_inf.bw = BRCMU_CHAN_BW_20;
+                WARN_ON(primary_offset != 0);
+                break;
+        case NL80211_CHAN_WIDTH_40:
+                ch_inf.bw = BRCMU_CHAN_BW_40;
+                if (primary_offset < 0)
+                        ch_inf.sb = BRCMU_CHAN_SB_U;
+                else
+                        ch_inf.sb = BRCMU_CHAN_SB_L;
+                break;
+        case NL80211_CHAN_WIDTH_80:
+                ch_inf.bw = BRCMU_CHAN_BW_80;
+                if (primary_offset < 0) {
+                        if (primary_offset < -CH_10MHZ_APART)
+                                ch_inf.sb = BRCMU_CHAN_SB_UU;
+                        else
+                                ch_inf.sb = BRCMU_CHAN_SB_UL;
+                } else {
+                        if (primary_offset > CH_10MHZ_APART)
+                                ch_inf.sb = BRCMU_CHAN_SB_LL;
+                        else
+                                ch_inf.sb = BRCMU_CHAN_SB_LU;
+                }
+                break;
+        default:
+                WARN_ON_ONCE(1);
+        }
+        switch (ch->chan->band) {
+        case IEEE80211_BAND_2GHZ:
+                ch_inf.band = BRCMU_CHAN_BAND_2G;
+                break;
+        case IEEE80211_BAND_5GHZ:
+                ch_inf.band = BRCMU_CHAN_BAND_5G;
+                break;
+        default:
+                WARN_ON_ONCE(1);
+        }
+        d11inf->encchspec(&ch_inf);
+
+        return ch_inf.chspec;
+}
+
 u16 channel_to_chanspec(struct brcmu_d11inf *d11inf,
                         struct ieee80211_channel *ch)
 {
@@ -1236,8 +1290,8 @@ brcmf_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *ndev,
                                 params->chandef.chan->center_freq);
                 if (params->channel_fixed) {
                         /* adding chanspec */
-                        chanspec = channel_to_chanspec(&cfg->d11inf,
-                                                       params->chandef.chan);
+                        chanspec = chandef_to_chanspec(&cfg->d11inf,
+                                                       &params->chandef);
                         join_params.params_le.chanspec_list[0] =
                                 cpu_to_le16(chanspec);
                         join_params.params_le.chanspec_num = cpu_to_le32(1);
@@ -3734,23 +3788,6 @@ brcmf_config_ap_mgmt_ie(struct brcmf_cfg80211_vif *vif,
 }
 
 static s32
-brcmf_cfg80211_set_channel(struct brcmf_cfg80211_info *cfg,
-                           struct brcmf_if *ifp,
-                           struct ieee80211_channel *channel)
-{
-        u16 chanspec;
-        s32 err;
-
-        brcmf_dbg(TRACE, "band=%d, center_freq=%d\n", channel->band,
-                  channel->center_freq);
-
-        chanspec = channel_to_chanspec(&cfg->d11inf, channel);
-        err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
-
-        return err;
-}
-
-static s32
 brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
                         struct cfg80211_ap_settings *settings)
 {
@@ -3765,11 +3802,12 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
         struct brcmf_join_params join_params;
         enum nl80211_iftype dev_role;
         struct brcmf_fil_bss_enable_le bss_enable;
+        u16 chanspec;
 
-        brcmf_dbg(TRACE, "channel_type=%d, beacon_interval=%d, dtim_period=%d,\n",
-                  cfg80211_get_chandef_type(&settings->chandef),
-                  settings->beacon_interval,
-                  settings->dtim_period);
+        brcmf_dbg(TRACE, "ctrlchn=%d, center=%d, bw=%d, beacon_interval=%d, dtim_period=%d,\n",
+                  settings->chandef.chan->hw_value,
+                  settings->chandef.center_freq1, settings->chandef.width,
+                  settings->beacon_interval, settings->dtim_period);
         brcmf_dbg(TRACE, "ssid=%s(%zu), auth_type=%d, inactivity_timeout=%d\n",
                   settings->ssid, settings->ssid_len, settings->auth_type,
                   settings->inactivity_timeout);
@@ -3826,9 +3864,10 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
 
         brcmf_config_ap_mgmt_ie(ifp->vif, &settings->beacon);
 
-        err = brcmf_cfg80211_set_channel(cfg, ifp, settings->chandef.chan);
+        chanspec = chandef_to_chanspec(&cfg->d11inf, &settings->chandef);
+        err = brcmf_fil_iovar_int_set(ifp, "chanspec", chanspec);
         if (err < 0) {
-                brcmf_err("Set Channel failed, %d\n", err);
+                brcmf_err("Set Channel failed: chspec=%d, %d\n", chanspec, err);
                 goto exit;
         }
 
@@ -4364,6 +4403,8 @@ static struct wiphy *brcmf_setup_wiphy(struct device *phydev)
                         WIPHY_FLAG_OFFCHAN_TX |
                         WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL |
                         WIPHY_FLAG_SUPPORTS_TDLS;
+        if (!brcmf_roamoff)
+                wiphy->flags |= WIPHY_FLAG_SUPPORTS_FW_ROAM;
         wiphy->mgmt_stypes = brcmf_txrx_stypes;
         wiphy->max_remain_on_channel_duration = 5000;
         brcmf_wiphy_pno_params(wiphy);
@@ -4685,7 +4726,6 @@ brcmf_notify_connect_status(struct brcmf_if *ifp,
         struct brcmf_cfg80211_profile *profile = &ifp->vif->profile;
         struct ieee80211_channel *chan;
         s32 err = 0;
-        u16 reason;
 
         if (brcmf_is_apmode(ifp->vif)) {
                 err = brcmf_notify_connect_status_ap(cfg, ndev, e, data);
@@ -4706,16 +4746,6 @@ brcmf_notify_connect_status(struct brcmf_if *ifp,
                 brcmf_dbg(CONN, "Linkdown\n");
                 if (!brcmf_is_ibssmode(ifp->vif)) {
                         brcmf_bss_connect_done(cfg, ndev, e, false);
-                        if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTED,
-                                               &ifp->vif->sme_state)) {
-                                reason = 0;
-                                if (((e->event_code == BRCMF_E_DEAUTH_IND) ||
-                                     (e->event_code == BRCMF_E_DISASSOC_IND)) &&
-                                    (e->reason != WLAN_REASON_UNSPECIFIED))
-                                        reason = e->reason;
-                                cfg80211_disconnected(ndev, reason, NULL, 0,
-                                                      GFP_KERNEL);
-                        }
                 }
                 brcmf_link_down(ifp->vif);
                 brcmf_init_prof(ndev_to_prof(ndev));
@@ -4948,7 +4978,7 @@ static int brcmf_enable_bw40_2g(struct brcmf_if *ifp)
         if (!err) {
                 /* only set 2G bandwidth using bw_cap command */
                 band_bwcap.band = cpu_to_le32(WLC_BAND_2G);
-                band_bwcap.bw_cap = cpu_to_le32(WLC_BW_40MHZ_BIT);
+                band_bwcap.bw_cap = cpu_to_le32(WLC_BW_CAP_40MHZ);
                 err = brcmf_fil_iovar_data_set(ifp, "bw_cap", &band_bwcap,
                                                sizeof(band_bwcap));
         } else {
@@ -5215,6 +5245,9 @@ static s32 brcmf_construct_reginfo(struct brcmf_cfg80211_info *cfg,
                 if (!(bw_cap[band] & WLC_BW_40MHZ_BIT) &&
                     ch.bw == BRCMU_CHAN_BW_40)
                         continue;
+                if (!(bw_cap[band] & WLC_BW_80MHZ_BIT) &&
+                    ch.bw == BRCMU_CHAN_BW_80)
+                        continue;
                 update = false;
                 for (j = 0; (j < *n_cnt && (*n_cnt < array_size)); j++) {
                         if (band_chan_arr[j].hw_value == ch.chnum) {
@@ -5231,10 +5264,13 @@ static s32 brcmf_construct_reginfo(struct brcmf_cfg80211_info *cfg,
                                 ieee80211_channel_to_frequency(ch.chnum, band);
                         band_chan_arr[index].hw_value = ch.chnum;
 
-                        if (ch.bw == BRCMU_CHAN_BW_40) {
-                                /* assuming the order is HT20, HT40 Upper,
-                                 * HT40 lower from chanspecs
-                                 */
+                        /* assuming the chanspecs order is HT20,
+                         * HT40 upper, HT40 lower, and VHT80.
+                         */
+                        if (ch.bw == BRCMU_CHAN_BW_80) {
+                                band_chan_arr[index].flags &=
+                                        ~IEEE80211_CHAN_NO_80MHZ;
+                        } else if (ch.bw == BRCMU_CHAN_BW_40) {
                                 ht40_flag = band_chan_arr[index].flags &
                                             IEEE80211_CHAN_NO_HT40;
                                 if (ch.sb == BRCMU_CHAN_SB_U) {
@@ -5255,8 +5291,13 @@ static s32 brcmf_construct_reginfo(struct brcmf_cfg80211_info *cfg,
                                                     IEEE80211_CHAN_NO_HT40MINUS;
                                 }
                         } else {
+                                /* disable other bandwidths for now as mentioned
+                                 * order assure they are enabled for subsequent
+                                 * chanspecs.
+                                 */
                                 band_chan_arr[index].flags =
-                                                        IEEE80211_CHAN_NO_HT40;
+                                                IEEE80211_CHAN_NO_HT40 |
+                                                IEEE80211_CHAN_NO_80MHZ;
                                 ch.bw = BRCMU_CHAN_BW_20;
                                 cfg->d11inf.encchspec(&ch);
                                 channel = ch.chspec;
@@ -5323,13 +5364,63 @@ static void brcmf_get_bwcap(struct brcmf_if *ifp, u32 bw_cap[])
         }
 }
 
+static void brcmf_update_ht_cap(struct ieee80211_supported_band *band,
+                                u32 bw_cap[2], u32 nchain)
+{
+        band->ht_cap.ht_supported = true;
+        if (bw_cap[band->band] & WLC_BW_40MHZ_BIT) {
+                band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_40;
+                band->ht_cap.cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+        }
+        band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_20;
+        band->ht_cap.cap |= IEEE80211_HT_CAP_DSSSCCK40;
+        band->ht_cap.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
+        band->ht_cap.ampdu_density = IEEE80211_HT_MPDU_DENSITY_16;
+        memset(band->ht_cap.mcs.rx_mask, 0xff, nchain);
+        band->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
+}
+
+static __le16 brcmf_get_mcs_map(u32 nchain, enum ieee80211_vht_mcs_support supp)
+{
+        u16 mcs_map;
+        int i;
+
+        for (i = 0, mcs_map = 0xFFFF; i < nchain; i++)
+                mcs_map = (mcs_map << 2) | supp;
+
+        return cpu_to_le16(mcs_map);
+}
+
+static void brcmf_update_vht_cap(struct ieee80211_supported_band *band,
+                                 u32 bw_cap[2], u32 nchain)
+{
+        __le16 mcs_map;
+
+        /* not allowed in 2.4G band */
+        if (band->band == IEEE80211_BAND_2GHZ)
+                return;
+
+        band->vht_cap.vht_supported = true;
+        /* 80MHz is mandatory */
+        band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_80;
+        if (bw_cap[band->band] & WLC_BW_160MHZ_BIT) {
+                band->vht_cap.cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
+                band->vht_cap.cap |= IEEE80211_VHT_CAP_SHORT_GI_160;
+        }
+        /* all support 256-QAM */
+        mcs_map = brcmf_get_mcs_map(nchain, IEEE80211_VHT_MCS_SUPPORT_0_9);
+        band->vht_cap.vht_mcs.rx_mcs_map = mcs_map;
+        band->vht_cap.vht_mcs.tx_mcs_map = mcs_map;
+}
+
 static s32 brcmf_update_wiphybands(struct brcmf_cfg80211_info *cfg)
 {
         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
         struct wiphy *wiphy;
         s32 phy_list;
         u32 band_list[3];
-        u32 nmode;
+        u32 nmode = 0;
+        u32 vhtmode = 0;
         u32 bw_cap[2] = { 0, 0 };
         u32 rxchain;
         u32 nchain;
@@ -5360,14 +5451,16 @@ static s32 brcmf_update_wiphybands(struct brcmf_cfg80211_info *cfg)
         brcmf_dbg(INFO, "BRCMF_C_GET_BANDLIST reported: 0x%08x 0x%08x 0x%08x phy\n",
                   band_list[0], band_list[1], band_list[2]);
 
+        (void)brcmf_fil_iovar_int_get(ifp, "vhtmode", &vhtmode);
         err = brcmf_fil_iovar_int_get(ifp, "nmode", &nmode);
         if (err) {
                 brcmf_err("nmode error (%d)\n", err);
         } else {
                 brcmf_get_bwcap(ifp, bw_cap);
         }
-        brcmf_dbg(INFO, "nmode=%d, bw_cap=(%d, %d)\n", nmode,
-                  bw_cap[IEEE80211_BAND_2GHZ], bw_cap[IEEE80211_BAND_5GHZ]);
+        brcmf_dbg(INFO, "nmode=%d, vhtmode=%d, bw_cap=(%d, %d)\n",
+                  nmode, vhtmode, bw_cap[IEEE80211_BAND_2GHZ],
+                  bw_cap[IEEE80211_BAND_5GHZ]);
 
         err = brcmf_fil_iovar_int_get(ifp, "rxchain", &rxchain);
         if (err) {
@@ -5398,17 +5491,10 @@ static s32 brcmf_update_wiphybands(struct brcmf_cfg80211_info *cfg)
                 else
                         continue;
 
-                if (bw_cap[band->band] & WLC_BW_40MHZ_BIT) {
-                        band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_40;
-                        band->ht_cap.cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
-                }
-                band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_20;
-                band->ht_cap.cap |= IEEE80211_HT_CAP_DSSSCCK40;
-                band->ht_cap.ht_supported = true;
-                band->ht_cap.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
-                band->ht_cap.ampdu_density = IEEE80211_HT_MPDU_DENSITY_16;
-                memset(band->ht_cap.mcs.rx_mask, 0xff, nchain);
-                band->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
+                if (nmode)
+                        brcmf_update_ht_cap(band, bw_cap, nchain);
+                if (vhtmode)
+                        brcmf_update_vht_cap(band, bw_cap, nchain);
                 bands[band->band] = band;
         }
 
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
index 8c5fa4e58139..43c71bfaa474 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
@@ -897,7 +897,8 @@ static bool brcms_tx_flush_completed(struct brcms_info *wl)
         return result;
 }
 
-static void brcms_ops_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
+static void brcms_ops_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                            u32 queues, bool drop)
 {
         struct brcms_info *wl = hw->priv;
         int ret;
diff --git a/drivers/net/wireless/brcm80211/brcmutil/d11.c b/drivers/net/wireless/brcm80211/brcmutil/d11.c
index 30e54e2c6c9b..6cbc33d0fc19 100644
--- a/drivers/net/wireless/brcm80211/brcmutil/d11.c
+++ b/drivers/net/wireless/brcm80211/brcmutil/d11.c
@@ -21,43 +21,81 @@
 #include <brcmu_wifi.h>
 #include <brcmu_d11.h>
 
-static void brcmu_d11n_encchspec(struct brcmu_chan *ch)
+static u16 d11n_sb(enum brcmu_chan_sb sb)
 {
-        ch->chspec = ch->chnum & BRCMU_CHSPEC_CH_MASK;
+        switch (sb) {
+        case BRCMU_CHAN_SB_NONE:
+                return BRCMU_CHSPEC_D11N_SB_N;
+        case BRCMU_CHAN_SB_L:
+                return BRCMU_CHSPEC_D11N_SB_L;
+        case BRCMU_CHAN_SB_U:
+                return BRCMU_CHSPEC_D11N_SB_U;
+        default:
+                WARN_ON(1);
+        }
+        return 0;
+}
 
-        switch (ch->bw) {
+static u16 d11n_bw(enum brcmu_chan_bw bw)
+{
+        switch (bw) {
         case BRCMU_CHAN_BW_20:
-                ch->chspec |= BRCMU_CHSPEC_D11N_BW_20 | BRCMU_CHSPEC_D11N_SB_N;
-                break;
+                return BRCMU_CHSPEC_D11N_BW_20;
         case BRCMU_CHAN_BW_40:
+                return BRCMU_CHSPEC_D11N_BW_40;
         default:
-                WARN_ON_ONCE(1);
-                break;
+                WARN_ON(1);
         }
+        return 0;
+}
 
+static void brcmu_d11n_encchspec(struct brcmu_chan *ch)
+{
+        if (ch->bw == BRCMU_CHAN_BW_20)
+                ch->sb = BRCMU_CHAN_SB_NONE;
+
+        brcmu_maskset16(&ch->chspec, BRCMU_CHSPEC_CH_MASK,
+                        BRCMU_CHSPEC_CH_SHIFT, ch->chnum);
+        brcmu_maskset16(&ch->chspec, BRCMU_CHSPEC_D11N_SB_MASK,
+                        0, d11n_sb(ch->sb));
+        brcmu_maskset16(&ch->chspec, BRCMU_CHSPEC_D11N_BW_MASK,
+                        0, d11n_bw(ch->bw));
+
+        ch->chspec &= ~BRCMU_CHSPEC_D11N_BND_MASK;
         if (ch->chnum <= CH_MAX_2G_CHANNEL)
                 ch->chspec |= BRCMU_CHSPEC_D11N_BND_2G;
         else
                 ch->chspec |= BRCMU_CHSPEC_D11N_BND_5G;
 }
 
-static void brcmu_d11ac_encchspec(struct brcmu_chan *ch)
+static u16 d11ac_bw(enum brcmu_chan_bw bw)
 {
-        ch->chspec = ch->chnum & BRCMU_CHSPEC_CH_MASK;
-
-        switch (ch->bw) {
+        switch (bw) {
         case BRCMU_CHAN_BW_20:
-                ch->chspec |= BRCMU_CHSPEC_D11AC_BW_20;
-                break;
+                return BRCMU_CHSPEC_D11AC_BW_20;
         case BRCMU_CHAN_BW_40:
+                return BRCMU_CHSPEC_D11AC_BW_40;
         case BRCMU_CHAN_BW_80:
-        case BRCMU_CHAN_BW_80P80:
-        case BRCMU_CHAN_BW_160:
+                return BRCMU_CHSPEC_D11AC_BW_80;
         default:
-                WARN_ON_ONCE(1);
-                break;
+                WARN_ON(1);
         }
+        return 0;
+}
 
+static void brcmu_d11ac_encchspec(struct brcmu_chan *ch)
+{
+        if (ch->bw == BRCMU_CHAN_BW_20 || ch->sb == BRCMU_CHAN_SB_NONE)
+                ch->sb = BRCMU_CHAN_SB_L;
+
+        brcmu_maskset16(&ch->chspec, BRCMU_CHSPEC_CH_MASK,
+                        BRCMU_CHSPEC_CH_SHIFT, ch->chnum);
+        brcmu_maskset16(&ch->chspec, BRCMU_CHSPEC_D11AC_SB_MASK,
+                        BRCMU_CHSPEC_D11AC_SB_SHIFT, ch->sb);
+        brcmu_maskset16(&ch->chspec, BRCMU_CHSPEC_D11AC_BW_MASK,
+                        0, d11ac_bw(ch->bw));
+
+        ch->chspec &= ~BRCMU_CHSPEC_D11AC_BND_MASK;
         if (ch->chnum <= CH_MAX_2G_CHANNEL)
                 ch->chspec |= BRCMU_CHSPEC_D11AC_BND_2G;
         else
@@ -73,6 +111,7 @@ static void brcmu_d11n_decchspec(struct brcmu_chan *ch)
         switch (ch->chspec & BRCMU_CHSPEC_D11N_BW_MASK) {
         case BRCMU_CHSPEC_D11N_BW_20:
                 ch->bw = BRCMU_CHAN_BW_20;
+                ch->sb = BRCMU_CHAN_SB_NONE;
                 break;
         case BRCMU_CHSPEC_D11N_BW_40:
                 ch->bw = BRCMU_CHAN_BW_40;
@@ -112,6 +151,7 @@ static void brcmu_d11ac_decchspec(struct brcmu_chan *ch)
         switch (ch->chspec & BRCMU_CHSPEC_D11AC_BW_MASK) {
         case BRCMU_CHSPEC_D11AC_BW_20:
                 ch->bw = BRCMU_CHAN_BW_20;
+                ch->sb = BRCMU_CHAN_SB_NONE;
                 break;
         case BRCMU_CHSPEC_D11AC_BW_40:
                 ch->bw = BRCMU_CHAN_BW_40;
@@ -128,6 +168,25 @@ static void brcmu_d11ac_decchspec(struct brcmu_chan *ch)
                 break;
         case BRCMU_CHSPEC_D11AC_BW_80:
                 ch->bw = BRCMU_CHAN_BW_80;
+                ch->sb = brcmu_maskget16(ch->chspec, BRCMU_CHSPEC_D11AC_SB_MASK,
+                                         BRCMU_CHSPEC_D11AC_SB_SHIFT);
+                switch (ch->sb) {
+                case BRCMU_CHAN_SB_LL:
+                        ch->chnum -= CH_30MHZ_APART;
+                        break;
+                case BRCMU_CHAN_SB_LU:
+                        ch->chnum -= CH_10MHZ_APART;
+                        break;
+                case BRCMU_CHAN_SB_UL:
+                        ch->chnum += CH_10MHZ_APART;
+                        break;
+                case BRCMU_CHAN_SB_UU:
+                        ch->chnum += CH_30MHZ_APART;
+                        break;
+                default:
+                        WARN_ON_ONCE(1);
+                        break;
+                }
                 break;
         case BRCMU_CHSPEC_D11AC_BW_8080:
         case BRCMU_CHSPEC_D11AC_BW_160:
diff --git a/drivers/net/wireless/brcm80211/include/brcmu_d11.h b/drivers/net/wireless/brcm80211/include/brcmu_d11.h
index 8660a2cba098..f9745ea8b3e0 100644
--- a/drivers/net/wireless/brcm80211/include/brcmu_d11.h
+++ b/drivers/net/wireless/brcm80211/include/brcmu_d11.h
@@ -108,13 +108,7 @@ enum brcmu_chan_bw {
 };
 
 enum brcmu_chan_sb {
-        BRCMU_CHAN_SB_NONE = 0,
-        BRCMU_CHAN_SB_L,
-        BRCMU_CHAN_SB_U,
-        BRCMU_CHAN_SB_LL,
-        BRCMU_CHAN_SB_LU,
-        BRCMU_CHAN_SB_UL,
-        BRCMU_CHAN_SB_UU,
+        BRCMU_CHAN_SB_NONE = -1,
         BRCMU_CHAN_SB_LLL,
         BRCMU_CHAN_SB_LLU,
         BRCMU_CHAN_SB_LUL,
@@ -123,6 +117,12 @@ enum brcmu_chan_sb {
         BRCMU_CHAN_SB_ULU,
         BRCMU_CHAN_SB_UUL,
         BRCMU_CHAN_SB_UUU,
+        BRCMU_CHAN_SB_L = BRCMU_CHAN_SB_LLL,
+        BRCMU_CHAN_SB_U = BRCMU_CHAN_SB_LLU,
+        BRCMU_CHAN_SB_LL = BRCMU_CHAN_SB_LLL,
+        BRCMU_CHAN_SB_LU = BRCMU_CHAN_SB_LLU,
+        BRCMU_CHAN_SB_UL = BRCMU_CHAN_SB_LUL,
+        BRCMU_CHAN_SB_UU = BRCMU_CHAN_SB_LUU,
 };
 
 struct brcmu_chan {
diff --git a/drivers/net/wireless/brcm80211/include/brcmu_wifi.h b/drivers/net/wireless/brcm80211/include/brcmu_wifi.h
index 74419d4bd123..76b5d3a86294 100644
--- a/drivers/net/wireless/brcm80211/include/brcmu_wifi.h
+++ b/drivers/net/wireless/brcm80211/include/brcmu_wifi.h
@@ -29,6 +29,7 @@
 #define CH_UPPER_SB                     0x01
 #define CH_LOWER_SB                     0x02
 #define CH_EWA_VALID                    0x04
+#define CH_30MHZ_APART                  6
 #define CH_20MHZ_APART                  4
 #define CH_10MHZ_APART                  2
 #define CH_5MHZ_APART                   1 /* 2G band channels are 5 Mhz apart */
diff --git a/drivers/net/wireless/cw1200/sta.c b/drivers/net/wireless/cw1200/sta.c
index 103f7bce8932..cd0cad7f7759 100644
--- a/drivers/net/wireless/cw1200/sta.c
+++ b/drivers/net/wireless/cw1200/sta.c
@@ -936,7 +936,8 @@ static int __cw1200_flush(struct cw1200_common *priv, bool drop)
         return ret;
 }
 
-void cw1200_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
+void cw1200_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                  u32 queues, bool drop)
 {
         struct cw1200_common *priv = hw->priv;
 
diff --git a/drivers/net/wireless/cw1200/sta.h b/drivers/net/wireless/cw1200/sta.h
index 35babb62cc6a..b7e386b7662b 100644
--- a/drivers/net/wireless/cw1200/sta.h
+++ b/drivers/net/wireless/cw1200/sta.h
@@ -40,7 +40,8 @@ int cw1200_set_key(struct ieee80211_hw *dev, enum set_key_cmd cmd,
 
 int cw1200_set_rts_threshold(struct ieee80211_hw *hw, u32 value);
 
-void cw1200_flush(struct ieee80211_hw *hw, u32 queues, bool drop);
+void cw1200_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                  u32 queues, bool drop);
 
 u64 cw1200_prepare_multicast(struct ieee80211_hw *hw,
                              struct netdev_hw_addr_list *mc_list);
diff --git a/drivers/net/wireless/iwlegacy/3945.c b/drivers/net/wireless/iwlegacy/3945.c
index d37a6fd90d40..b598e2803500 100644
--- a/drivers/net/wireless/iwlegacy/3945.c
+++ b/drivers/net/wireless/iwlegacy/3945.c
@@ -573,7 +573,7 @@ il3945_hdl_rx(struct il_priv *il, struct il_rx_buf *rxb)
                 rx_status.flag |= RX_FLAG_SHORTPRE;
 
         if ((unlikely(rx_stats->phy_count > 20))) {
-                D_DROP("dsp size out of range [0,20]: %d/n",
+                D_DROP("dsp size out of range [0,20]: %d\n",
                        rx_stats->phy_count);
                 return;
         }
diff --git a/drivers/net/wireless/iwlegacy/4965-mac.c b/drivers/net/wireless/iwlegacy/4965-mac.c
index 888ad5c74639..c159c05db6ef 100644
--- a/drivers/net/wireless/iwlegacy/4965-mac.c
+++ b/drivers/net/wireless/iwlegacy/4965-mac.c
@@ -670,7 +670,7 @@ il4965_hdl_rx(struct il_priv *il, struct il_rx_buf *rxb)
         }
 
         if ((unlikely(phy_res->cfg_phy_cnt > 20))) {
-                D_DROP("dsp size out of range [0,20]: %d/n",
+                D_DROP("dsp size out of range [0,20]: %d\n",
                        phy_res->cfg_phy_cnt);
                 return;
         }
diff --git a/drivers/net/wireless/iwlegacy/common.c b/drivers/net/wireless/iwlegacy/common.c
index 4f42174d9994..ecc674627e6e 100644
--- a/drivers/net/wireless/iwlegacy/common.c
+++ b/drivers/net/wireless/iwlegacy/common.c
@@ -4755,7 +4755,8 @@ out:
 }
 EXPORT_SYMBOL(il_mac_change_interface);
 
-void il_mac_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
+void il_mac_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                  u32 queues, bool drop)
 {
         struct il_priv *il = hw->priv;
         unsigned long timeout = jiffies + msecs_to_jiffies(500);
diff --git a/drivers/net/wireless/iwlegacy/common.h b/drivers/net/wireless/iwlegacy/common.h
index dfb13c70efe8..ea5c0f863c4e 100644
--- a/drivers/net/wireless/iwlegacy/common.h
+++ b/drivers/net/wireless/iwlegacy/common.h
@@ -1723,7 +1723,8 @@ void il_mac_remove_interface(struct ieee80211_hw *hw,
                              struct ieee80211_vif *vif);
 int il_mac_change_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                             enum nl80211_iftype newtype, bool newp2p);
-void il_mac_flush(struct ieee80211_hw *hw, u32 queues, bool drop);
+void il_mac_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                  u32 queues, bool drop);
 int il_alloc_txq_mem(struct il_priv *il);
 void il_free_txq_mem(struct il_priv *il);
 
diff --git a/drivers/net/wireless/iwlwifi/Kconfig b/drivers/net/wireless/iwlwifi/Kconfig
index 74b3b4de7bb7..b82d30c0f0c9 100644
--- a/drivers/net/wireless/iwlwifi/Kconfig
+++ b/drivers/net/wireless/iwlwifi/Kconfig
@@ -2,10 +2,6 @@ config IWLWIFI
         tristate "Intel Wireless WiFi Next Gen AGN - Wireless-N/Advanced-N/Ultimate-N (iwlwifi) "
         depends on PCI && MAC80211 && HAS_IOMEM
         select FW_LOADER
-        select NEW_LEDS
-        select LEDS_CLASS
-        select LEDS_TRIGGERS
-        select MAC80211_LEDS
         ---help---
           Select to build the driver supporting the:
 
@@ -43,6 +39,14 @@ config IWLWIFI
           say M here and read <file:Documentation/kbuild/modules.txt>.  The
           module will be called iwlwifi.
 
+config IWLWIFI_LEDS
+        bool
+        depends on IWLWIFI
+        depends on LEDS_CLASS
+        select LEDS_TRIGGERS
+        select MAC80211_LEDS
+        default y
+
 config IWLDVM
         tristate "Intel Wireless WiFi DVM Firmware support"
         depends on IWLWIFI
diff --git a/drivers/net/wireless/iwlwifi/dvm/Makefile b/drivers/net/wireless/iwlwifi/dvm/Makefile
index dce7ab2e0c4b..4d19685f31c3 100644
--- a/drivers/net/wireless/iwlwifi/dvm/Makefile
+++ b/drivers/net/wireless/iwlwifi/dvm/Makefile
@@ -4,9 +4,10 @@ iwldvm-objs		+= main.o rs.o mac80211.o ucode.o tx.o
 iwldvm-objs             += lib.o calib.o tt.o sta.o rx.o
 
 iwldvm-objs             += power.o
-iwldvm-objs             += scan.o led.o
+iwldvm-objs             += scan.o
 iwldvm-objs             += rxon.o devices.o
 
+iwldvm-$(CONFIG_IWLWIFI_LEDS) += led.o
 iwldvm-$(CONFIG_IWLWIFI_DEBUGFS) += debugfs.o
 
 ccflags-y += -D__CHECK_ENDIAN__ -I$(src)/../
diff --git a/drivers/net/wireless/iwlwifi/dvm/dev.h b/drivers/net/wireless/iwlwifi/dvm/dev.h
index 3441f70d0ff9..a6f22c32a279 100644
--- a/drivers/net/wireless/iwlwifi/dvm/dev.h
+++ b/drivers/net/wireless/iwlwifi/dvm/dev.h
@@ -888,9 +888,11 @@ struct iwl_priv {
 
         struct iwl_event_log event_log;
 
+#ifdef CONFIG_IWLWIFI_LEDS
         struct led_classdev led;
         unsigned long blink_on, blink_off;
         bool led_registered;
+#endif
 
         /* WoWLAN GTK rekey data */
         u8 kck[NL80211_KCK_LEN], kek[NL80211_KEK_LEN];
diff --git a/drivers/net/wireless/iwlwifi/dvm/led.h b/drivers/net/wireless/iwlwifi/dvm/led.h
index 6a0817d9c4fa..1c6b2252d0f2 100644
--- a/drivers/net/wireless/iwlwifi/dvm/led.h
+++ b/drivers/net/wireless/iwlwifi/dvm/led.h
@@ -36,8 +36,20 @@ struct iwl_priv;
 #define IWL_LED_ACTIVITY       (0<<1)
 #define IWL_LED_LINK           (1<<1)
 
+#ifdef CONFIG_IWLWIFI_LEDS
 void iwlagn_led_enable(struct iwl_priv *priv);
 void iwl_leds_init(struct iwl_priv *priv);
 void iwl_leds_exit(struct iwl_priv *priv);
+#else
+static inline void iwlagn_led_enable(struct iwl_priv *priv)
+{
+}
+static inline void iwl_leds_init(struct iwl_priv *priv)
+{
+}
+static inline void iwl_leds_exit(struct iwl_priv *priv)
+{
+}
+#endif
 
 #endif /* __iwl_leds_h__ */
diff --git a/drivers/net/wireless/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
index d3abc15125d6..29af7b51e370 100644
--- a/drivers/net/wireless/iwlwifi/dvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
@@ -1091,7 +1091,8 @@ static void iwlagn_configure_filter(struct ieee80211_hw *hw,
                         FIF_BCN_PRBRESP_PROMISC | FIF_CONTROL;
 }
 
-static void iwlagn_mac_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
+static void iwlagn_mac_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                             u32 queues, bool drop)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-7000.c b/drivers/net/wireless/iwlwifi/iwl-7000.c
index f73de239cdc1..48730064da73 100644
--- a/drivers/net/wireless/iwlwifi/iwl-7000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-7000.c
@@ -98,7 +98,7 @@
 #define NVM_HW_SECTION_NUM_FAMILY_7000          0
 
 static const struct iwl_base_params iwl7000_base_params = {
-        .eeprom_size = OTP_LOW_IMAGE_SIZE,
+        .eeprom_size = OTP_LOW_IMAGE_SIZE_FAMILY_7000,
         .num_of_queues = IWLAGN_NUM_QUEUES,
         .pll_cfg_val = 0,
         .shadow_ram_support = true,
diff --git a/drivers/net/wireless/iwlwifi/iwl-8000.c b/drivers/net/wireless/iwlwifi/iwl-8000.c
index f5bd82b88592..b26b68ce8205 100644
--- a/drivers/net/wireless/iwlwifi/iwl-8000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-8000.c
@@ -85,7 +85,7 @@
 #define NVM_HW_SECTION_NUM_FAMILY_8000          10
 
 static const struct iwl_base_params iwl8000_base_params = {
-        .eeprom_size = OTP_LOW_IMAGE_SIZE,
+        .eeprom_size = OTP_LOW_IMAGE_SIZE_FAMILY_8000,
         .num_of_queues = IWLAGN_NUM_QUEUES,
         .pll_cfg_val = 0,
         .shadow_ram_support = true,
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-hw.h b/drivers/net/wireless/iwlwifi/iwl-agn-hw.h
index 7f37fb86837b..04a483d38659 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-hw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-hw.h
@@ -102,9 +102,7 @@
 
 /* EEPROM */
 #define IWLAGN_EEPROM_IMG_SIZE          2048
-/* OTP */
-/* lower blocks contain EEPROM image and calibration data */
-#define OTP_LOW_IMAGE_SIZE              (2 * 512 * sizeof(u16)) /* 2 KB */
+
 /* high blocks contain PAPD data */
 #define OTP_HIGH_IMAGE_SIZE_6x00        (6 * 512 * sizeof(u16)) /* 6 KB */
 #define OTP_HIGH_IMAGE_SIZE_1000        (0x200 * sizeof(u16)) /* 1024 bytes */
diff --git a/drivers/net/wireless/iwlwifi/iwl-config.h b/drivers/net/wireless/iwlwifi/iwl-config.h
index 7ce82d9c7222..97f23d6e480b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-config.h
+++ b/drivers/net/wireless/iwlwifi/iwl-config.h
@@ -193,6 +193,11 @@ struct iwl_ht_params {
 #define EEPROM_6000_REG_BAND_24_HT40_CHANNELS   0x80
 #define EEPROM_REGULATORY_BAND_NO_HT40          0
 
+/* lower blocks contain EEPROM image and calibration data */
+#define OTP_LOW_IMAGE_SIZE              (2 * 512 * sizeof(u16)) /* 2 KB */
+#define OTP_LOW_IMAGE_SIZE_FAMILY_7000  (4 * 512 * sizeof(u16)) /* 4 KB */
+#define OTP_LOW_IMAGE_SIZE_FAMILY_8000  (32 * 512 * sizeof(u16)) /* 32 KB */
+
 struct iwl_eeprom_params {
         const u8 regulatory_bands[7];
         bool enhanced_txpower;
@@ -269,6 +274,7 @@ struct iwl_cfg {
         u8   nvm_hw_section_num;
         bool lp_xtal_workaround;
         const struct iwl_pwr_tx_backoff *pwr_tx_backoffs;
+        bool no_power_up_nic_in_init;
 };
 
 /*
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-error-dump.h b/drivers/net/wireless/iwlwifi/iwl-fw-error-dump.h
index f381908be7e5..2953ffceda38 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-error-dump.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fw-error-dump.h
@@ -72,11 +72,14 @@
  * @IWL_FW_ERROR_DUMP_SRAM:
  * @IWL_FW_ERROR_DUMP_REG:
  * @IWL_FW_ERROR_DUMP_RXF:
+ * @IWL_FW_ERROR_DUMP_TXCMD: last TX command data, structured as
+ *      &struct iwl_fw_error_dump_txcmd packets
  */
 enum iwl_fw_error_dump_type {
         IWL_FW_ERROR_DUMP_SRAM = 0,
         IWL_FW_ERROR_DUMP_REG = 1,
         IWL_FW_ERROR_DUMP_RXF = 2,
+        IWL_FW_ERROR_DUMP_TXCMD = 3,
 
         IWL_FW_ERROR_DUMP_MAX,
 };
@@ -105,4 +108,27 @@ struct iwl_fw_error_dump_file {
         u8 data[0];
 } __packed;
 
+/**
+ * struct iwl_fw_error_dump_txcmd - TX command data
+ * @cmdlen: original length of command
+ * @caplen: captured length of command (may be less)
+ * @data: captured command data, @caplen bytes
+ */
+struct iwl_fw_error_dump_txcmd {
+        __le32 cmdlen;
+        __le32 caplen;
+        u8 data[];
+} __packed;
+
+/**
+ * iwl_mvm_fw_error_next_data - advance fw error dump data pointer
+ * @data: previous data block
+ * Returns: next data block
+ */
+static inline struct iwl_fw_error_dump_data *
+iwl_mvm_fw_error_next_data(struct iwl_fw_error_dump_data *data)
+{
+        return (void *)(data->data + le32_to_cpu(data->len));
+}
+
 #endif /* __fw_error_dump_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-fw.h b/drivers/net/wireless/iwlwifi/iwl-fw.h
index f5927d0cf9b6..6fea27c0dd8e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fw.h
@@ -116,9 +116,11 @@ enum iwl_ucode_tlv_flag {
 /**
  * enum iwl_ucode_tlv_api - ucode api
  * @IWL_UCODE_TLV_API_WOWLAN_CONFIG_TID: wowlan config includes tid field.
+ * @IWL_UCODE_TLV_API_CSA_FLOW: ucode can do unbind-bind flow for CSA.
  */
 enum iwl_ucode_tlv_api {
         IWL_UCODE_TLV_API_WOWLAN_CONFIG_TID     = BIT(0),
+        IWL_UCODE_TLV_API_CSA_FLOW              = BIT(4),
 };
 
 /**
diff --git a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
index 4049c0d626ba..49963e4a887e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
+++ b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
@@ -62,6 +62,7 @@
 #include <linux/types.h>
 #include <linux/slab.h>
 #include <linux/export.h>
+#include <linux/etherdevice.h>
 #include "iwl-drv.h"
 #include "iwl-modparams.h"
 #include "iwl-nvm-parse.h"
@@ -450,13 +451,7 @@ static void iwl_set_hw_address(const struct iwl_cfg *cfg,
                                struct iwl_nvm_data *data,
                                const __le16 *nvm_sec)
 {
-        u8 hw_addr[ETH_ALEN];
-
-        if (cfg->device_family != IWL_DEVICE_FAMILY_8000)
-                memcpy(hw_addr, nvm_sec + HW_ADDR, ETH_ALEN);
-        else
-                memcpy(hw_addr, nvm_sec + MAC_ADDRESS_OVERRIDE_FAMILY_8000,
-                       ETH_ALEN);
+        const u8 *hw_addr = (const u8 *)(nvm_sec + HW_ADDR);
 
         /* The byte order is little endian 16 bit, meaning 214365 */
         data->hw_addr[0] = hw_addr[1];
@@ -467,6 +462,41 @@ static void iwl_set_hw_address(const struct iwl_cfg *cfg,
         data->hw_addr[5] = hw_addr[4];
 }
 
+static void iwl_set_hw_address_family_8000(const struct iwl_cfg *cfg,
+                                           struct iwl_nvm_data *data,
+                                           const __le16 *mac_override,
+                                           const __le16 *nvm_hw)
+{
+        const u8 *hw_addr;
+
+        if (mac_override) {
+                hw_addr = (const u8 *)(mac_override +
+                                 MAC_ADDRESS_OVERRIDE_FAMILY_8000);
+
+                /* The byte order is little endian 16 bit, meaning 214365 */
+                data->hw_addr[0] = hw_addr[1];
+                data->hw_addr[1] = hw_addr[0];
+                data->hw_addr[2] = hw_addr[3];
+                data->hw_addr[3] = hw_addr[2];
+                data->hw_addr[4] = hw_addr[5];
+                data->hw_addr[5] = hw_addr[4];
+
+                if (is_valid_ether_addr(hw_addr))
+                        return;
+        }
+
+        /* take the MAC address from the OTP */
+        hw_addr = (const u8 *)(nvm_hw + HW_ADDR0_FAMILY_8000);
+        data->hw_addr[0] = hw_addr[3];
+        data->hw_addr[1] = hw_addr[2];
+        data->hw_addr[2] = hw_addr[1];
+        data->hw_addr[3] = hw_addr[0];
+
+        hw_addr = (const u8 *)(nvm_hw + HW_ADDR1_FAMILY_8000);
+        data->hw_addr[4] = hw_addr[1];
+        data->hw_addr[5] = hw_addr[0];
+}
+
 struct iwl_nvm_data *
 iwl_parse_nvm_data(struct device *dev, const struct iwl_cfg *cfg,
                    const __le16 *nvm_hw, const __le16 *nvm_sw,
@@ -526,7 +556,7 @@ iwl_parse_nvm_data(struct device *dev, const struct iwl_cfg *cfg,
                                 rx_chains);
         } else {
                 /* MAC address in family 8000 */
-                iwl_set_hw_address(cfg, data, mac_override);
+                iwl_set_hw_address_family_8000(cfg, data, mac_override, nvm_hw);
 
                 iwl_init_sbands(dev, cfg, data, regulatory,
                                 sku & NVM_SKU_CAP_11AC_ENABLE, tx_chains,
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans.h b/drivers/net/wireless/iwlwifi/iwl-trans.h
index 22fd94ec8048..84ad48de6e29 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans.h
+++ b/drivers/net/wireless/iwlwifi/iwl-trans.h
@@ -463,6 +463,11 @@ struct iwl_trans;
  * @unref: release a reference previously taken with @ref. Note that
  *      initially the reference count is 1, making an initial @unref
  *      necessary to allow low power states.
+ * @dump_data: fill a data dump with debug data, maybe containing last
+ *      TX'ed commands and similar. When called with a NULL buffer and
+ *      zero buffer length, provide only the (estimated) required buffer
+ *      length. Return the used buffer length.
+ *      Note that the transport must fill in the proper file headers.
  */
 struct iwl_trans_ops {
 
@@ -511,6 +516,10 @@ struct iwl_trans_ops {
                               u32 value);
         void (*ref)(struct iwl_trans *trans);
         void (*unref)(struct iwl_trans *trans);
+
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+        u32 (*dump_data)(struct iwl_trans *trans, void *buf, u32 buflen);
+#endif
 };
 
 /**
@@ -664,6 +673,16 @@ static inline void iwl_trans_unref(struct iwl_trans *trans)
                 trans->ops->unref(trans);
 }
 
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+static inline u32 iwl_trans_dump_data(struct iwl_trans *trans,
+                                      void *buf, u32 buflen)
+{
+        if (!trans->ops->dump_data)
+                return 0;
+        return trans->ops->dump_data(trans, buf, buflen);
+}
+#endif
+
 static inline int iwl_trans_send_cmd(struct iwl_trans *trans,
                                      struct iwl_host_cmd *cmd)
 {
diff --git a/drivers/net/wireless/iwlwifi/mvm/Makefile b/drivers/net/wireless/iwlwifi/mvm/Makefile
index ccdd3b7c4cce..c30d7f64ec1e 100644
--- a/drivers/net/wireless/iwlwifi/mvm/Makefile
+++ b/drivers/net/wireless/iwlwifi/mvm/Makefile
@@ -3,8 +3,9 @@ iwlmvm-y += fw.o mac80211.o nvm.o ops.o phy-ctxt.o mac-ctxt.o
 iwlmvm-y += utils.o rx.o tx.o binding.o quota.o sta.o sf.o
 iwlmvm-y += scan.o time-event.o rs.o
 iwlmvm-y += power.o coex.o
-iwlmvm-y += led.o tt.o offloading.o
+iwlmvm-y += tt.o offloading.o
 iwlmvm-$(CONFIG_IWLWIFI_DEBUGFS) += debugfs.o debugfs-vif.o
+iwlmvm-$(CONFIG_IWLWIFI_LEDS) += led.o
 iwlmvm-$(CONFIG_PM_SLEEP) += d3.o
 
 ccflags-y += -D__CHECK_ENDIAN__ -I$(src)/../
diff --git a/drivers/net/wireless/iwlwifi/mvm/coex.c b/drivers/net/wireless/iwlwifi/mvm/coex.c
index 8f4b03dbaf3f..4284672d0397 100644
--- a/drivers/net/wireless/iwlwifi/mvm/coex.c
+++ b/drivers/net/wireless/iwlwifi/mvm/coex.c
@@ -611,14 +611,14 @@ int iwl_send_bt_init_conf(struct iwl_mvm *mvm)
                 bt_cmd->flags |= cpu_to_le32(BT_COEX_SYNC2SCO);
 
         if (IWL_MVM_BT_COEX_CORUNNING) {
-                bt_cmd->valid_bit_msk = cpu_to_le32(BT_VALID_CORUN_LUT_20 |
-                                                    BT_VALID_CORUN_LUT_40);
+                bt_cmd->valid_bit_msk |= cpu_to_le32(BT_VALID_CORUN_LUT_20 |
+                                                     BT_VALID_CORUN_LUT_40);
                 bt_cmd->flags |= cpu_to_le32(BT_COEX_CORUNNING);
         }
 
         if (IWL_MVM_BT_COEX_MPLUT) {
                 bt_cmd->flags |= cpu_to_le32(BT_COEX_MPLUT);
-                bt_cmd->valid_bit_msk = cpu_to_le32(BT_VALID_MULTI_PRIO_LUT);
+                bt_cmd->valid_bit_msk |= cpu_to_le32(BT_VALID_MULTI_PRIO_LUT);
         }
 
         if (mvm->cfg->bt_shared_single_ant)
diff --git a/drivers/net/wireless/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
index f462c9baa2b5..bef487bb880e 100644
--- a/drivers/net/wireless/iwlwifi/mvm/debugfs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
@@ -67,7 +67,7 @@
 #include "iwl-io.h"
 #include "iwl-prph.h"
 #include "debugfs.h"
-#include "fw-error-dump.h"
+#include "iwl-fw-error-dump.h"
 
 static ssize_t iwl_dbgfs_tx_flush_write(struct iwl_mvm *mvm, char *buf,
                                         size_t count, loff_t *ppos)
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
index 6174c027ff59..6959fda3fe09 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
@@ -187,9 +187,9 @@ enum iwl_scan_type {
  *      this number of packets were received (typically 1)
  * @passive2active: is auto switching from passive to active during scan allowed
  * @rxchain_sel_flags: RXON_RX_CHAIN_*
- * @max_out_time: in usecs, max out of serving channel time
+ * @max_out_time: in TUs, max out of serving channel time
  * @suspend_time: how long to pause scan when returning to service channel:
- *      bits 0-19: beacon interal in usecs (suspend before executing)
+ *      bits 0-19: beacon interal in TUs (suspend before executing)
  *      bits 20-23: reserved
  *      bits 24-31: number of beacons (suspend between channels)
  * @rxon_flags: RXON_FLG_*
@@ -387,8 +387,8 @@ enum scan_framework_client {
  * @quiet_plcp_th:      quiet channel num of packets threshold
  * @good_CRC_th:        passive to active promotion threshold
  * @rx_chain:           RXON rx chain.
- * @max_out_time:       max uSec to be out of assoceated channel
- * @suspend_time:       pause scan this long when returning to service channel
+ * @max_out_time:       max TUs to be out of assoceated channel
+ * @suspend_time:       pause scan this TUs when returning to service channel
  * @flags:              RXON flags
  * @filter_flags:       RXONfilter
  * @tx_cmd:             tx command for active scan; for 2GHz and for 5GHz.
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw.c b/drivers/net/wireless/iwlwifi/mvm/fw.c
index 3d99cf564ba6..34ae3f32b300 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/iwlwifi/mvm/fw.c
@@ -295,7 +295,7 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
         /* Read the NVM only at driver load time, no need to do this twice */
         if (read_nvm) {
                 /* Read nvm */
-                ret = iwl_nvm_init(mvm);
+                ret = iwl_nvm_init(mvm, true);
                 if (ret) {
                         IWL_ERR(mvm, "Failed to read NVM: %d\n", ret);
                         goto error;
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
index 7110ec2605d6..56cf58e95698 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
@@ -1237,11 +1237,23 @@ int iwl_mvm_rx_beacon_notif(struct iwl_mvm *mvm,
         u32 rate __maybe_unused =
                 le32_to_cpu(beacon->beacon_notify_hdr.initial_rate);
 
+        lockdep_assert_held(&mvm->mutex);
+
         IWL_DEBUG_RX(mvm, "beacon status %#x retries:%d tsf:0x%16llX rate:%d\n",
                      status & TX_STATUS_MSK,
                      beacon->beacon_notify_hdr.failure_frame,
                      le64_to_cpu(beacon->tsf),
                      rate);
+
+        if (unlikely(mvm->csa_vif && mvm->csa_vif->csa_active)) {
+                if (!ieee80211_csa_is_complete(mvm->csa_vif)) {
+                        iwl_mvm_mac_ctxt_beacon_changed(mvm, mvm->csa_vif);
+                } else {
+                        ieee80211_csa_finish(mvm->csa_vif);
+                        mvm->csa_vif = NULL;
+                }
+        }
+
         return 0;
 }
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index 97c3deae6552..f20cbd06a49f 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -320,6 +320,9 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
         if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_GO_UAPSD)
                 hw->wiphy->flags |= WIPHY_FLAG_AP_UAPSD;
 
+        if (mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_CSA_FLOW)
+                hw->wiphy->flags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH;
+
         hw->wiphy->iface_combinations = iwl_mvm_iface_combinations;
         hw->wiphy->n_iface_combinations =
                 ARRAY_SIZE(iwl_mvm_iface_combinations);
@@ -539,13 +542,22 @@ static int iwl_mvm_mac_ampdu_action(struct ieee80211_hw *hw,
                 return -EACCES;
 
         /* return from D0i3 before starting a new Tx aggregation */
-        if (action == IEEE80211_AMPDU_TX_START) {
+        switch (action) {
+        case IEEE80211_AMPDU_TX_START:
+        case IEEE80211_AMPDU_TX_STOP_CONT:
+        case IEEE80211_AMPDU_TX_STOP_FLUSH:
+        case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
+        case IEEE80211_AMPDU_TX_OPERATIONAL:
                 iwl_mvm_ref(mvm, IWL_MVM_REF_TX_AGG);
                 tx_agg_ref = true;
 
                 /*
-                 * wait synchronously until D0i3 exit to get the correct
-                 * sequence number for the tid
+                 * for tx start, wait synchronously until D0i3 exit to
+                 * get the correct sequence number for the tid.
+                 * additionally, some other ampdu actions use direct
+                 * target access, which is not handled automatically
+                 * by the trans layer (unlike commands), so wait for
+                 * d0i3 exit in these cases as well.
                  */
                 if (!wait_event_timeout(mvm->d0i3_exit_waitq,
                           !test_bit(IWL_MVM_STATUS_IN_D0I3, &mvm->status), HZ)) {
@@ -553,6 +565,9 @@ static int iwl_mvm_mac_ampdu_action(struct ieee80211_hw *hw,
                         iwl_mvm_unref(mvm, IWL_MVM_REF_TX_AGG);
                         return -EIO;
                 }
+                break;
+        default:
+                break;
         }
 
         mutex_lock(&mvm->mutex);
@@ -1005,7 +1020,7 @@ static void iwl_mvm_mc_iface_iterator(void *_data, u8 *mac,
         memcpy(cmd->bssid, vif->bss_conf.bssid, ETH_ALEN);
         len = roundup(sizeof(*cmd) + cmd->count * ETH_ALEN, 4);
 
-        ret = iwl_mvm_send_cmd_pdu(mvm, MCAST_FILTER_CMD, CMD_SYNC, len, cmd);
+        ret = iwl_mvm_send_cmd_pdu(mvm, MCAST_FILTER_CMD, CMD_ASYNC, len, cmd);
         if (ret)
                 IWL_ERR(mvm, "mcast filter cmd error. ret=%d\n", ret);
 }
@@ -1021,7 +1036,7 @@ static void iwl_mvm_recalc_multicast(struct iwl_mvm *mvm)
         if (WARN_ON_ONCE(!mvm->mcast_filter_cmd))
                 return;
 
-        ieee80211_iterate_active_interfaces(
+        ieee80211_iterate_active_interfaces_atomic(
                 mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
                 iwl_mvm_mc_iface_iterator, &iter_data);
 }
@@ -1814,6 +1829,11 @@ static int iwl_mvm_mac_sched_scan_start(struct ieee80211_hw *hw,
 
         mutex_lock(&mvm->mutex);
 
+        if (!iwl_mvm_is_idle(mvm)) {
+                ret = -EBUSY;
+                goto out;
+        }
+
         switch (mvm->scan_status) {
         case IWL_MVM_SCAN_OS:
                 IWL_DEBUG_SCAN(mvm, "Stopping previous scan for sched_scan\n");
@@ -2186,6 +2206,11 @@ static int iwl_mvm_assign_vif_chanctx(struct ieee80211_hw *hw,
 
         switch (vif->type) {
         case NL80211_IFTYPE_AP:
+                /* Unless it's a CSA flow we have nothing to do here */
+                if (vif->csa_active) {
+                        mvmvif->ap_ibss_active = true;
+                        break;
+                }
         case NL80211_IFTYPE_ADHOC:
                 /*
                  * The AP binding flow is handled as part of the start_ap flow
@@ -2222,6 +2247,12 @@ static int iwl_mvm_assign_vif_chanctx(struct ieee80211_hw *hw,
                         goto out_remove_binding;
         }
 
+        /* Handle binding during CSA */
+        if (vif->type == NL80211_IFTYPE_AP) {
+                iwl_mvm_update_quotas(mvm, vif);
+                iwl_mvm_mac_ctxt_changed(mvm, vif);
+        }
+
         goto out_unlock;
 
  out_remove_binding:
@@ -2246,13 +2277,20 @@ static void iwl_mvm_unassign_vif_chanctx(struct ieee80211_hw *hw,
         iwl_mvm_remove_time_event(mvm, mvmvif, &mvmvif->time_event_data);
 
         switch (vif->type) {
-        case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_ADHOC:
                 goto out_unlock;
         case NL80211_IFTYPE_MONITOR:
                 mvmvif->monitor_active = false;
                 iwl_mvm_update_quotas(mvm, NULL);
                 break;
+        case NL80211_IFTYPE_AP:
+                /* This part is triggered only during CSA */
+                if (!vif->csa_active || !mvmvif->ap_ibss_active)
+                        goto out_unlock;
+
+                mvmvif->ap_ibss_active = false;
+                iwl_mvm_update_quotas(mvm, NULL);
+                /*TODO: bt_coex notification here? */
         default:
                 break;
         }
@@ -2348,6 +2386,53 @@ static int iwl_mvm_mac_testmode_cmd(struct ieee80211_hw *hw,
 }
 #endif
 
+static void iwl_mvm_channel_switch_beacon(struct ieee80211_hw *hw,
+                                          struct ieee80211_vif *vif,
+                                          struct cfg80211_chan_def *chandef)
+{
+        struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
+
+        mutex_lock(&mvm->mutex);
+        if (WARN(mvm->csa_vif && mvm->csa_vif->csa_active,
+                 "Another CSA is already in progress"))
+                goto out_unlock;
+
+        IWL_DEBUG_MAC80211(mvm, "CSA started to freq %d\n",
+                           chandef->center_freq1);
+        mvm->csa_vif = vif;
+
+out_unlock:
+        mutex_unlock(&mvm->mutex);
+}
+
+static void iwl_mvm_mac_flush(struct ieee80211_hw *hw,
+                              struct ieee80211_vif *vif, u32 queues, bool drop)
+{
+        struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
+        struct iwl_mvm_vif *mvmvif;
+        struct iwl_mvm_sta *mvmsta;
+
+        if (!vif || vif->type != NL80211_IFTYPE_STATION)
+                return;
+
+        mutex_lock(&mvm->mutex);
+        mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        mvmsta = iwl_mvm_sta_from_staid_protected(mvm, mvmvif->ap_sta_id);
+
+        if (WARN_ON_ONCE(!mvmsta))
+                goto done;
+
+        if (drop) {
+                if (iwl_mvm_flush_tx_path(mvm, mvmsta->tfd_queue_msk, true))
+                        IWL_ERR(mvm, "flush request fail\n");
+        } else {
+                iwl_trans_wait_tx_queue_empty(mvm->trans,
+                                              mvmsta->tfd_queue_msk);
+        }
+done:
+        mutex_unlock(&mvm->mutex);
+}
+
 const struct ieee80211_ops iwl_mvm_hw_ops = {
         .tx = iwl_mvm_mac_tx,
         .ampdu_action = iwl_mvm_mac_ampdu_action,
@@ -2371,6 +2456,7 @@ const struct ieee80211_ops iwl_mvm_hw_ops = {
         .sta_rc_update = iwl_mvm_sta_rc_update,
         .conf_tx = iwl_mvm_mac_conf_tx,
         .mgd_prepare_tx = iwl_mvm_mac_mgd_prepare_tx,
+        .flush = iwl_mvm_mac_flush,
         .sched_scan_start = iwl_mvm_mac_sched_scan_start,
         .sched_scan_stop = iwl_mvm_mac_sched_scan_stop,
         .set_key = iwl_mvm_mac_set_key,
@@ -2390,6 +2476,8 @@ const struct ieee80211_ops iwl_mvm_hw_ops = {
 
         .set_tim = iwl_mvm_set_tim,
 
+        .channel_switch_beacon = iwl_mvm_channel_switch_beacon,
+
         CFG80211_TESTMODE_CMD(iwl_mvm_mac_testmode_cmd)
 
 #ifdef CONFIG_PM_SLEEP
diff --git a/drivers/net/wireless/iwlwifi/mvm/mvm.h b/drivers/net/wireless/iwlwifi/mvm/mvm.h
index 17c42da5f9f2..8747d03311f3 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/iwlwifi/mvm/mvm.h
@@ -589,7 +589,9 @@ struct iwl_mvm {
         u32 *fw_error_rxf;
         u32 fw_error_rxf_len;
 
+#ifdef CONFIG_IWLWIFI_LEDS
         struct led_classdev led;
+#endif
 
         struct ieee80211_vif *p2p_device_vif;
 
@@ -642,6 +644,8 @@ struct iwl_mvm {
 
         /* Indicate if device power save is allowed */
         bool ps_disabled;
+
+        struct ieee80211_vif *csa_vif;
 };
 
 /* Extract MVM priv from op_mode and _hw */
@@ -757,7 +761,7 @@ int iwl_mvm_rx_statistics(struct iwl_mvm *mvm,
                           struct iwl_device_cmd *cmd);
 
 /* NVM */
-int iwl_nvm_init(struct iwl_mvm *mvm);
+int iwl_nvm_init(struct iwl_mvm *mvm, bool read_nvm_from_nic);
 int iwl_mvm_load_nvm_to_nic(struct iwl_mvm *mvm);
 
 int iwl_mvm_up(struct iwl_mvm *mvm);
@@ -896,8 +900,18 @@ int iwl_mvm_power_uapsd_misbehaving_ap_notif(struct iwl_mvm *mvm,
                                              struct iwl_rx_cmd_buffer *rxb,
                                              struct iwl_device_cmd *cmd);
 
+#ifdef CONFIG_IWLWIFI_LEDS
 int iwl_mvm_leds_init(struct iwl_mvm *mvm);
 void iwl_mvm_leds_exit(struct iwl_mvm *mvm);
+#else
+static inline int iwl_mvm_leds_init(struct iwl_mvm *mvm)
+{
+        return 0;
+}
+static inline void iwl_mvm_leds_exit(struct iwl_mvm *mvm)
+{
+}
+#endif
 
 /* D3 (WoWLAN, NetDetect) */
 int iwl_mvm_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan);
@@ -1015,6 +1029,9 @@ static inline bool iwl_mvm_vif_low_latency(struct iwl_mvm_vif *mvmvif)
         return mvmvif->low_latency;
 }
 
+/* Assoc status */
+bool iwl_mvm_is_idle(struct iwl_mvm *mvm);
+
 /* Thermal management and CT-kill */
 void iwl_mvm_tt_tx_backoff(struct iwl_mvm *mvm, u32 backoff);
 void iwl_mvm_tt_handler(struct iwl_mvm *mvm);
diff --git a/drivers/net/wireless/iwlwifi/mvm/nvm.c b/drivers/net/wireless/iwlwifi/mvm/nvm.c
index cf2d09f53782..6b88c29ebe6b 100644
--- a/drivers/net/wireless/iwlwifi/mvm/nvm.c
+++ b/drivers/net/wireless/iwlwifi/mvm/nvm.c
@@ -238,13 +238,20 @@ iwl_parse_nvm_sections(struct iwl_mvm *mvm)
                         return NULL;
                 }
         } else {
+                /* SW and REGULATORY sections are mandatory */
                 if (!mvm->nvm_sections[NVM_SECTION_TYPE_SW].data ||
-                    !mvm->nvm_sections[NVM_SECTION_TYPE_MAC_OVERRIDE].data ||
                     !mvm->nvm_sections[NVM_SECTION_TYPE_REGULATORY].data) {
                         IWL_ERR(mvm,
                                 "Can't parse empty family 8000 NVM sections\n");
                         return NULL;
                 }
+                /* MAC_OVERRIDE or at least HW section must exist */
+                if (!mvm->nvm_sections[mvm->cfg->nvm_hw_section_num].data &&
+                    !mvm->nvm_sections[NVM_SECTION_TYPE_MAC_OVERRIDE].data) {
+                        IWL_ERR(mvm,
+                                "Can't parse mac_address, empty sections\n");
+                        return NULL;
+                }
         }
 
         if (WARN_ON(!mvm->cfg))
@@ -427,7 +434,7 @@ int iwl_mvm_load_nvm_to_nic(struct iwl_mvm *mvm)
         return ret;
 }
 
-int iwl_nvm_init(struct iwl_mvm *mvm)
+int iwl_nvm_init(struct iwl_mvm *mvm, bool read_nvm_from_nic)
 {
         int ret, i, section;
         u8 *nvm_buffer, *temp;
@@ -437,13 +444,8 @@ int iwl_nvm_init(struct iwl_mvm *mvm)
         if (WARN_ON_ONCE(mvm->cfg->nvm_hw_section_num >= NVM_MAX_NUM_SECTIONS))
                 return -EINVAL;
 
-        /* load external NVM if configured */
-        if (iwlwifi_mod_params.nvm_file) {
-                /* move to External NVM flow */
-                ret = iwl_mvm_read_external_nvm(mvm);
-                if (ret)
-                        return ret;
-        } else {
+        /* load NVM values from nic */
+        if (read_nvm_from_nic) {
                 /* list of NVM sections we are allowed/need to read */
                 if (mvm->trans->cfg->device_family != IWL_DEVICE_FAMILY_8000) {
                         nvm_to_read[0] = mvm->cfg->nvm_hw_section_num;
@@ -463,7 +465,6 @@ int iwl_nvm_init(struct iwl_mvm *mvm)
                 /* Read From FW NVM */
                 IWL_DEBUG_EEPROM(mvm->trans->dev, "Read from NVM\n");
 
-                /* TODO: find correct NVM max size for a section */
                 nvm_buffer = kmalloc(mvm->cfg->base_params->eeprom_size,
                                      GFP_KERNEL);
                 if (!nvm_buffer)
@@ -511,6 +512,15 @@ int iwl_nvm_init(struct iwl_mvm *mvm)
                         return ret;
         }
 
+        /* load external NVM if configured */
+        if (iwlwifi_mod_params.nvm_file) {
+                /* move to External NVM flow */
+                ret = iwl_mvm_read_external_nvm(mvm);
+                if (ret)
+                        return ret;
+        }
+
+        /* parse the relevant nvm sections */
         mvm->nvm_data = iwl_parse_nvm_sections(mvm);
         if (!mvm->nvm_data)
                 return -ENODATA;
diff --git a/drivers/net/wireless/iwlwifi/mvm/ops.c b/drivers/net/wireless/iwlwifi/mvm/ops.c
index 7a5a8bac5fd0..f8530b329d17 100644
--- a/drivers/net/wireless/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/iwlwifi/mvm/ops.c
@@ -79,8 +79,8 @@
 #include "iwl-prph.h"
 #include "rs.h"
 #include "fw-api-scan.h"
-#include "fw-error-dump.h"
 #include "time-event.h"
+#include "iwl-fw-error-dump.h"
 
 /*
  * module name, copyright, version, etc.
@@ -220,7 +220,7 @@ static const struct iwl_rx_handlers iwl_mvm_rx_handlers[] = {
         RX_HANDLER(BA_NOTIF, iwl_mvm_rx_ba_notif, false),
 
         RX_HANDLER(BT_PROFILE_NOTIFICATION, iwl_mvm_rx_bt_coex_notif, true),
-        RX_HANDLER(BEACON_NOTIFICATION, iwl_mvm_rx_beacon_notif, false),
+        RX_HANDLER(BEACON_NOTIFICATION, iwl_mvm_rx_beacon_notif, true),
         RX_HANDLER(STATISTICS_NOTIFICATION, iwl_mvm_rx_statistics, true),
         RX_HANDLER(ANTENNA_COUPLING_NOTIFICATION,
                    iwl_mvm_rx_ant_coupling_notif, true),
@@ -467,12 +467,18 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
         min_backoff = calc_min_backoff(trans, cfg);
         iwl_mvm_tt_initialize(mvm, min_backoff);
 
+        if (WARN(cfg->no_power_up_nic_in_init && !iwlwifi_mod_params.nvm_file,
+                 "not allowing power-up and not having nvm_file\n"))
+                goto out_free;
+
         /*
-         * If the NVM exists in an external file,
-         * there is no need to unnecessarily power up the NIC at driver load
+         * Even if nvm exists in the nvm_file driver should read agin the nvm
+         * from the nic because there might be entries that exist in the OTP
+         * and not in the file.
+         * for nics with no_power_up_nic_in_init: rely completley on nvm_file
          */
-        if (iwlwifi_mod_params.nvm_file) {
-                err = iwl_nvm_init(mvm);
+        if (cfg->no_power_up_nic_in_init && iwlwifi_mod_params.nvm_file) {
+                err = iwl_nvm_init(mvm, false);
                 if (err)
                         goto out_free;
         } else {
@@ -519,7 +525,7 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
  out_free:
         iwl_phy_db_free(mvm->phy_db);
         kfree(mvm->scan_cmd);
-        if (!iwlwifi_mod_params.nvm_file)
+        if (!cfg->no_power_up_nic_in_init || !iwlwifi_mod_params.nvm_file)
                 iwl_trans_op_mode_leave(trans);
         ieee80211_free_hw(mvm->hw);
         return NULL;
@@ -816,6 +822,7 @@ void iwl_mvm_fw_error_dump(struct iwl_mvm *mvm)
         struct iwl_fw_error_dump_file *dump_file;
         struct iwl_fw_error_dump_data *dump_data;
         u32 file_len;
+        u32 trans_len;
 
         lockdep_assert_held(&mvm->mutex);
 
@@ -827,6 +834,10 @@ void iwl_mvm_fw_error_dump(struct iwl_mvm *mvm)
                    sizeof(*dump_file) +
                    sizeof(*dump_data) * 2;
 
+        trans_len = iwl_trans_dump_data(mvm->trans, NULL, 0);
+        if (trans_len)
+                file_len += trans_len;
+
         dump_file = vmalloc(file_len);
         if (!dump_file)
                 return;
@@ -840,7 +851,7 @@ void iwl_mvm_fw_error_dump(struct iwl_mvm *mvm)
         dump_data->len = cpu_to_le32(mvm->fw_error_rxf_len);
         memcpy(dump_data->data, mvm->fw_error_rxf, mvm->fw_error_rxf_len);
 
-        dump_data = (void *)((u8 *)dump_data->data + mvm->fw_error_rxf_len);
+        dump_data = iwl_mvm_fw_error_next_data(dump_data);
         dump_data->type = cpu_to_le32(IWL_FW_ERROR_DUMP_SRAM);
         dump_data->len = cpu_to_le32(mvm->fw_error_sram_len);
 
@@ -858,6 +869,15 @@ void iwl_mvm_fw_error_dump(struct iwl_mvm *mvm)
         kfree(mvm->fw_error_sram);
         mvm->fw_error_sram = NULL;
         mvm->fw_error_sram_len = 0;
+
+        if (trans_len) {
+                void *buf = iwl_mvm_fw_error_next_data(dump_data);
+                u32 real_trans_len = iwl_trans_dump_data(mvm->trans, buf,
+                                                         trans_len);
+                dump_data = (void *)((u8 *)buf + real_trans_len);
+                dump_file->file_len =
+                        cpu_to_le32(file_len - trans_len + real_trans_len);
+        }
 }
 #endif
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/phy-ctxt.c b/drivers/net/wireless/iwlwifi/mvm/phy-ctxt.c
index 237efe0ac1c4..eafc517a5f9e 100644
--- a/drivers/net/wireless/iwlwifi/mvm/phy-ctxt.c
+++ b/drivers/net/wireless/iwlwifi/mvm/phy-ctxt.c
@@ -202,18 +202,15 @@ int iwl_mvm_phy_ctxt_add(struct iwl_mvm *mvm, struct iwl_mvm_phy_ctxt *ctxt,
                          struct cfg80211_chan_def *chandef,
                          u8 chains_static, u8 chains_dynamic)
 {
-        int ret;
-
         WARN_ON(!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
                 ctxt->ref);
         lockdep_assert_held(&mvm->mutex);
 
         ctxt->channel = chandef->chan;
-        ret = iwl_mvm_phy_ctxt_apply(mvm, ctxt, chandef,
-                                     chains_static, chains_dynamic,
-                                     FW_CTXT_ACTION_ADD, 0);
 
-        return ret;
+        return iwl_mvm_phy_ctxt_apply(mvm, ctxt, chandef,
+                                      chains_static, chains_dynamic,
+                                      FW_CTXT_ACTION_ADD, 0);
 }
 
 /*
diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.c b/drivers/net/wireless/iwlwifi/mvm/rs.c
index d44b2b33b5cc..10ad1dca5f17 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/rs.c
@@ -211,7 +211,7 @@ static const struct rs_tx_column rs_tx_columns[] = {
                 .next_columns = {
                         RS_COLUMN_LEGACY_ANT_B,
                         RS_COLUMN_SISO_ANT_A,
-                        RS_COLUMN_SISO_ANT_B,
+                        RS_COLUMN_MIMO2,
                         RS_COLUMN_INVALID,
                         RS_COLUMN_INVALID,
                         RS_COLUMN_INVALID,
@@ -223,8 +223,8 @@ static const struct rs_tx_column rs_tx_columns[] = {
                 .ant = ANT_B,
                 .next_columns = {
                         RS_COLUMN_LEGACY_ANT_A,
-                        RS_COLUMN_SISO_ANT_A,
                         RS_COLUMN_SISO_ANT_B,
+                        RS_COLUMN_MIMO2,
                         RS_COLUMN_INVALID,
                         RS_COLUMN_INVALID,
                         RS_COLUMN_INVALID,
@@ -238,10 +238,10 @@ static const struct rs_tx_column rs_tx_columns[] = {
                         RS_COLUMN_SISO_ANT_B,
                         RS_COLUMN_MIMO2,
                         RS_COLUMN_SISO_ANT_A_SGI,
-                        RS_COLUMN_SISO_ANT_B_SGI,
                         RS_COLUMN_LEGACY_ANT_A,
                         RS_COLUMN_LEGACY_ANT_B,
                         RS_COLUMN_INVALID,
+                        RS_COLUMN_INVALID,
                 },
                 .checks = {
                         rs_siso_allow,
@@ -254,10 +254,10 @@ static const struct rs_tx_column rs_tx_columns[] = {
                         RS_COLUMN_SISO_ANT_A,
                         RS_COLUMN_MIMO2,
                         RS_COLUMN_SISO_ANT_B_SGI,
-                        RS_COLUMN_SISO_ANT_A_SGI,
                         RS_COLUMN_LEGACY_ANT_A,
                         RS_COLUMN_LEGACY_ANT_B,
                         RS_COLUMN_INVALID,
+                        RS_COLUMN_INVALID,
                 },
                 .checks = {
                         rs_siso_allow,
@@ -271,10 +271,10 @@ static const struct rs_tx_column rs_tx_columns[] = {
                         RS_COLUMN_SISO_ANT_B_SGI,
                         RS_COLUMN_MIMO2_SGI,
                         RS_COLUMN_SISO_ANT_A,
-                        RS_COLUMN_SISO_ANT_B,
-                        RS_COLUMN_MIMO2,
                         RS_COLUMN_LEGACY_ANT_A,
                         RS_COLUMN_LEGACY_ANT_B,
+                        RS_COLUMN_INVALID,
+                        RS_COLUMN_INVALID,
                 },
                 .checks = {
                         rs_siso_allow,
@@ -289,10 +289,10 @@ static const struct rs_tx_column rs_tx_columns[] = {
                         RS_COLUMN_SISO_ANT_A_SGI,
                         RS_COLUMN_MIMO2_SGI,
                         RS_COLUMN_SISO_ANT_B,
-                        RS_COLUMN_SISO_ANT_A,
-                        RS_COLUMN_MIMO2,
                         RS_COLUMN_LEGACY_ANT_A,
                         RS_COLUMN_LEGACY_ANT_B,
+                        RS_COLUMN_INVALID,
+                        RS_COLUMN_INVALID,
                 },
                 .checks = {
                         rs_siso_allow,
@@ -304,12 +304,12 @@ static const struct rs_tx_column rs_tx_columns[] = {
                 .ant = ANT_AB,
                 .next_columns = {
                         RS_COLUMN_SISO_ANT_A,
-                        RS_COLUMN_SISO_ANT_B,
-                        RS_COLUMN_SISO_ANT_A_SGI,
-                        RS_COLUMN_SISO_ANT_B_SGI,
                         RS_COLUMN_MIMO2_SGI,
                         RS_COLUMN_LEGACY_ANT_A,
                         RS_COLUMN_LEGACY_ANT_B,
+                        RS_COLUMN_INVALID,
+                        RS_COLUMN_INVALID,
+                        RS_COLUMN_INVALID,
                 },
                 .checks = {
                         rs_mimo_allow,
@@ -321,12 +321,12 @@ static const struct rs_tx_column rs_tx_columns[] = {
                 .sgi = true,
                 .next_columns = {
                         RS_COLUMN_SISO_ANT_A_SGI,
-                        RS_COLUMN_SISO_ANT_B_SGI,
-                        RS_COLUMN_SISO_ANT_A,
-                        RS_COLUMN_SISO_ANT_B,
                         RS_COLUMN_MIMO2,
                         RS_COLUMN_LEGACY_ANT_A,
                         RS_COLUMN_LEGACY_ANT_B,
+                        RS_COLUMN_INVALID,
+                        RS_COLUMN_INVALID,
+                        RS_COLUMN_INVALID,
                 },
                 .checks = {
                         rs_mimo_allow,
@@ -1031,7 +1031,7 @@ static void rs_tx_status(void *mvm_r, struct ieee80211_supported_band *sband,
                 return;
         }
 
-#ifdef CPTCFG_MAC80211_DEBUGFS
+#ifdef CONFIG_MAC80211_DEBUGFS
         /* Disable last tx check if we are debugging with fixed rate */
         if (lq_sta->dbg_fixed_rate) {
                 IWL_DEBUG_RATE(mvm, "Fixed rate. avoid rate scaling\n");
@@ -1335,105 +1335,50 @@ static void rs_set_expected_tpt_table(struct iwl_lq_sta *lq_sta,
         tbl->expected_tpt = rs_get_expected_tpt_table(lq_sta, column, rate->bw);
 }
 
-/*
- * Find starting rate for new "search" high-throughput mode of modulation.
- * Goal is to find lowest expected rate (under perfect conditions) that is
- * above the current measured throughput of "active" mode, to give new mode
- * a fair chance to prove itself without too many challenges.
- *
- * This gets called when transitioning to more aggressive modulation
- * (i.e. legacy to SISO or MIMO, or SISO to MIMO), as well as less aggressive
- * (i.e. MIMO to SISO).  When moving to MIMO, bit rate will typically need
- * to decrease to match "active" throughput.  When moving from MIMO to SISO,
- * bit rate will typically need to increase, but not if performance was bad.
- */
 static s32 rs_get_best_rate(struct iwl_mvm *mvm,
                             struct iwl_lq_sta *lq_sta,
                             struct iwl_scale_tbl_info *tbl,     /* "search" */
-                            u16 rate_mask, s8 index)
+                            unsigned long rate_mask, s8 index)
 {
-        /* "active" values */
         struct iwl_scale_tbl_info *active_tbl =
             &(lq_sta->lq_info[lq_sta->active_tbl]);
-        s32 active_sr = active_tbl->win[index].success_ratio;
-        s32 active_tpt = active_tbl->expected_tpt[index];
-        /* expected "search" throughput */
+        s32 success_ratio = active_tbl->win[index].success_ratio;
+        u16 expected_current_tpt = active_tbl->expected_tpt[index];
         const u16 *tpt_tbl = tbl->expected_tpt;
-
-        s32 new_rate, high, low, start_hi;
         u16 high_low;
-        s8 rate = index;
-
-        new_rate = high = low = start_hi = IWL_RATE_INVALID;
-
-        while (1) {
-                high_low = rs_get_adjacent_rate(mvm, rate, rate_mask,
-                                                tbl->rate.type);
-
-                low = high_low & 0xff;
-                high = (high_low >> 8) & 0xff;
+        u32 target_tpt;
+        int rate_idx;
 
-                /*
-                 * Lower the "search" bit rate, to give new "search" mode
-                 * approximately the same throughput as "active" if:
-                 *
-                 * 1) "Active" mode has been working modestly well (but not
-                 *    great), and expected "search" throughput (under perfect
-                 *    conditions) at candidate rate is above the actual
-                 *    measured "active" throughput (but less than expected
-                 *    "active" throughput under perfect conditions).
-                 * OR
-                 * 2) "Active" mode has been working perfectly or very well
-                 *    and expected "search" throughput (under perfect
-                 *    conditions) at candidate rate is above expected
-                 *    "active" throughput (under perfect conditions).
-                 */
-                if ((((100 * tpt_tbl[rate]) > lq_sta->last_tpt) &&
-                     ((active_sr > RS_SR_FORCE_DECREASE) &&
-                      (active_sr <= IWL_RATE_HIGH_TH) &&
-                      (tpt_tbl[rate] <= active_tpt))) ||
-                    ((active_sr >= IWL_RATE_SCALE_SWITCH) &&
-                     (tpt_tbl[rate] > active_tpt))) {
-                        /* (2nd or later pass)
-                         * If we've already tried to raise the rate, and are
-                         * now trying to lower it, use the higher rate. */
-                        if (start_hi != IWL_RATE_INVALID) {
-                                new_rate = start_hi;
-                                break;
-                        }
-
-                        new_rate = rate;
-
-                        /* Loop again with lower rate */
-                        if (low != IWL_RATE_INVALID)
-                                rate = low;
+        if (success_ratio > RS_SR_NO_DECREASE) {
+                target_tpt = 100 * expected_current_tpt;
+                IWL_DEBUG_RATE(mvm,
+                               "SR %d high. Find rate exceeding EXPECTED_CURRENT %d\n",
+                               success_ratio, target_tpt);
+        } else {
+                target_tpt = lq_sta->last_tpt;
+                IWL_DEBUG_RATE(mvm,
+                               "SR %d not thag good. Find rate exceeding ACTUAL_TPT %d\n",
+                               success_ratio, target_tpt);
+        }
 
-                        /* Lower rate not available, use the original */
-                        else
-                                break;
+        rate_idx = find_first_bit(&rate_mask, BITS_PER_LONG);
 
-                /* Else try to raise the "search" rate to match "active" */
-                } else {
-                        /* (2nd or later pass)
-                         * If we've already tried to lower the rate, and are
-                         * now trying to raise it, use the lower rate. */
-                        if (new_rate != IWL_RATE_INVALID)
-                                break;
+        while (rate_idx != IWL_RATE_INVALID) {
+                if (target_tpt < (100 * tpt_tbl[rate_idx]))
+                        break;
 
-                        /* Loop again with higher rate */
-                        else if (high != IWL_RATE_INVALID) {
-                                start_hi = high;
-                                rate = high;
+                high_low = rs_get_adjacent_rate(mvm, rate_idx, rate_mask,
+                                                tbl->rate.type);
 
-                        /* Higher rate not available, use the original */
-                        } else {
-                                new_rate = rate;
-                                break;
-                        }
-                }
+                rate_idx = (high_low >> 8) & 0xff;
         }
 
-        return new_rate;
+        IWL_DEBUG_RATE(mvm, "Best rate found %d target_tp %d expected_new %d\n",
+                       rate_idx, target_tpt,
+                       rate_idx != IWL_RATE_INVALID ?
+                       100 * tpt_tbl[rate_idx] : IWL_INVALID_VALUE);
+
+        return rate_idx;
 }
 
 static u32 rs_bw_from_sta_bw(struct ieee80211_sta *sta)
@@ -1608,7 +1553,7 @@ static enum rs_column rs_get_next_column(struct iwl_mvm *mvm,
 
                 tpt = lq_sta->last_tpt / 100;
                 expected_tpt_tbl = rs_get_expected_tpt_table(lq_sta, next_col,
-                                                             tbl->rate.bw);
+                                                     rs_bw_from_sta_bw(sta));
                 if (WARN_ON_ONCE(!expected_tpt_tbl))
                         continue;
 
@@ -1649,7 +1594,7 @@ static int rs_switch_to_column(struct iwl_mvm *mvm,
         const struct rs_tx_column *curr_column = &rs_tx_columns[tbl->column];
         u32 sz = (sizeof(struct iwl_scale_tbl_info) -
                   (sizeof(struct iwl_rate_scale_data) * IWL_RATE_COUNT));
-        u16 rate_mask = 0;
+        unsigned long rate_mask = 0;
         u32 rate_idx = 0;
 
         memcpy(search_tbl, tbl, sz);
@@ -1691,7 +1636,7 @@ static int rs_switch_to_column(struct iwl_mvm *mvm,
                     !(BIT(rate_idx) & rate_mask)) {
                         IWL_DEBUG_RATE(mvm,
                                        "can not switch with index %d"
-                                       " rate mask %x\n",
+                                       " rate mask %lx\n",
                                        rate_idx, rate_mask);
 
                         goto err;
@@ -1805,16 +1750,21 @@ static void rs_get_adjacent_txp(struct iwl_mvm *mvm, int index,
                 *stronger = TPC_INVALID;
 }
 
-static bool rs_tpc_allowed(struct iwl_mvm *mvm, struct rs_rate *rate,
-                           enum ieee80211_band band)
+static bool rs_tpc_allowed(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+                           struct rs_rate *rate, enum ieee80211_band band)
 {
         int index = rate->index;
+        bool cam = (iwlmvm_mod_params.power_scheme == IWL_POWER_SCHEME_CAM);
+        bool sta_ps_disabled = (vif->type == NL80211_IFTYPE_STATION &&
+                                !vif->bss_conf.ps);
 
+        IWL_DEBUG_RATE(mvm, "cam: %d sta_ps_disabled %d\n",
+                       cam, sta_ps_disabled);
         /*
          * allow tpc only if power management is enabled, or bt coex
          * activity grade allows it and we are on 2.4Ghz.
          */
-        if (iwlmvm_mod_params.power_scheme == IWL_POWER_SCHEME_CAM &&
+        if ((cam || sta_ps_disabled) &&
             !iwl_mvm_bt_coex_is_tpc_allowed(mvm, band))
                 return false;
 
@@ -1931,7 +1881,7 @@ static bool rs_tpc_perform(struct iwl_mvm *mvm,
                 band = chanctx_conf->def.chan->band;
         rcu_read_unlock();
 
-        if (!rs_tpc_allowed(mvm, rate, band)) {
+        if (!rs_tpc_allowed(mvm, vif, rate, band)) {
                 IWL_DEBUG_RATE(mvm,
                                "tpc is not allowed. remove txp restrictions");
                 lq_sta->lq.reduced_tpc = TPC_NO_REDUCTION;
@@ -2235,7 +2185,8 @@ static void rs_rate_scale_perform(struct iwl_mvm *mvm,
                 break;
         case RS_ACTION_STAY:
                 /* No change */
-                update_lq = rs_tpc_perform(mvm, sta, lq_sta, tbl);
+                if (lq_sta->rs_state == RS_STATE_STAY_IN_COLUMN)
+                        update_lq = rs_tpc_perform(mvm, sta, lq_sta, tbl);
                 break;
         default:
                 break;
@@ -2489,10 +2440,6 @@ static void rs_vht_set_enabled_rates(struct ieee80211_sta *sta,
                         if (i == IWL_RATE_9M_INDEX)
                                 continue;
 
-                        /* Disable MCS9 as a workaround */
-                        if (i == IWL_RATE_MCS_9_INDEX)
-                                continue;
-
                         /* VHT MCS9 isn't valid for 20Mhz for NSS=1,2 */
                         if (i == IWL_RATE_MCS_9_INDEX &&
                             sta->bandwidth == IEEE80211_STA_RX_BW_20)
@@ -2511,10 +2458,6 @@ static void rs_vht_set_enabled_rates(struct ieee80211_sta *sta,
                         if (i == IWL_RATE_9M_INDEX)
                                 continue;
 
-                        /* Disable MCS9 as a workaround */
-                        if (i == IWL_RATE_MCS_9_INDEX)
-                                continue;
-
                         /* VHT MCS9 isn't valid for 20Mhz for NSS=1,2 */
                         if (i == IWL_RATE_MCS_9_INDEX &&
                             sta->bandwidth == IEEE80211_STA_RX_BW_20)
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index 63e7b16edb55..36ae01a18dee 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -277,51 +277,22 @@ static void iwl_mvm_scan_calc_params(struct iwl_mvm *mvm,
                                             IEEE80211_IFACE_ITER_NORMAL,
                                             iwl_mvm_scan_condition_iterator,
                                             &global_bound);
-        /*
-         * Under low latency traffic passive scan is fragmented meaning
-         * that dwell on a particular channel will be fragmented. Each fragment
-         * dwell time is 20ms and fragments period is 105ms. Skipping to next
-         * channel will be delayed by the same period - 105ms. So suspend_time
-         * parameter describing both fragments and channels skipping periods is
-         * set to 105ms. This value is chosen so that overall passive scan
-         * duration will not be too long. Max_out_time in this case is set to
-         * 70ms, so for active scanning operating channel will be left for 70ms
-         * while for passive still for 20ms (fragment dwell).
-         */
-        if (global_bound) {
-                if (!iwl_mvm_low_latency(mvm)) {
-                        params->suspend_time = ieee80211_tu_to_usec(100);
-                        params->max_out_time = ieee80211_tu_to_usec(600);
-                } else {
-                        params->suspend_time = ieee80211_tu_to_usec(105);
-                        /* P2P doesn't support fragmented passive scan, so
-                         * configure max_out_time to be at least longest dwell
-                         * time for passive scan.
-                         */
-                        if (vif->type == NL80211_IFTYPE_STATION && !vif->p2p) {
-                                params->max_out_time = ieee80211_tu_to_usec(70);
-                                params->passive_fragmented = true;
-                        } else {
-                                u32 passive_dwell;
 
-                                /*
-                                 * Use band G so that passive channel dwell time
-                                 * will be assigned with maximum value.
-                                 */
-                                band = IEEE80211_BAND_2GHZ;
-                                passive_dwell = iwl_mvm_get_passive_dwell(band);
-                                params->max_out_time =
-                                        ieee80211_tu_to_usec(passive_dwell);
-                        }
-                }
+        if (!global_bound)
+                goto not_bound;
+
+        params->suspend_time = 100;
+        params->max_out_time = 600;
+
+        if (iwl_mvm_low_latency(mvm)) {
+                params->suspend_time = 250;
+                params->max_out_time = 250;
         }
 
+not_bound:
+
         for (band = IEEE80211_BAND_2GHZ; band < IEEE80211_NUM_BANDS; band++) {
-                if (params->passive_fragmented)
-                        params->dwell[band].passive = 20;
-                else
-                        params->dwell[band].passive =
-                                iwl_mvm_get_passive_dwell(band);
+                params->dwell[band].passive = iwl_mvm_get_passive_dwell(band);
                 params->dwell[band].active = iwl_mvm_get_active_dwell(band,
                                                                       n_ssids);
         }
@@ -770,7 +741,7 @@ int iwl_mvm_config_sched_scan(struct iwl_mvm *mvm,
         int band_2ghz = mvm->nvm_data->bands[IEEE80211_BAND_2GHZ].n_channels;
         int band_5ghz = mvm->nvm_data->bands[IEEE80211_BAND_5GHZ].n_channels;
         int head = 0;
-        int tail = band_2ghz + band_5ghz;
+        int tail = band_2ghz + band_5ghz - 1;
         u32 ssid_bitmap;
         int cmd_len;
         int ret;
diff --git a/drivers/net/wireless/iwlwifi/mvm/utils.c b/drivers/net/wireless/iwlwifi/mvm/utils.c
index c5f4532cafa9..2f82d0dc7ad8 100644
--- a/drivers/net/wireless/iwlwifi/mvm/utils.c
+++ b/drivers/net/wireless/iwlwifi/mvm/utils.c
@@ -519,6 +519,7 @@ void iwl_mvm_dump_nic_error_log(struct iwl_mvm *mvm)
                 iwl_mvm_dump_umac_error_log(mvm);
 }
 
+#ifdef CONFIG_IWLWIFI_DEBUGFS
 void iwl_mvm_fw_error_sram_dump(struct iwl_mvm *mvm)
 {
         const struct fw_img *img;
@@ -581,6 +582,7 @@ void iwl_mvm_fw_error_rxf_dump(struct iwl_mvm *mvm)
         }
         iwl_trans_release_nic_access(mvm->trans, &flags);
 }
+#endif
 
 /**
  * iwl_mvm_send_lq_cmd() - Send link quality command
@@ -688,3 +690,22 @@ bool iwl_mvm_low_latency(struct iwl_mvm *mvm)
 
         return result;
 }
+
+static void iwl_mvm_idle_iter(void *_data, u8 *mac, struct ieee80211_vif *vif)
+{
+        bool *idle = _data;
+
+        if (!vif->bss_conf.idle)
+                *idle = false;
+}
+
+bool iwl_mvm_is_idle(struct iwl_mvm *mvm)
+{
+        bool idle = true;
+
+        ieee80211_iterate_active_interfaces_atomic(
+                        mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
+                        iwl_mvm_idle_iter, &idle);
+
+        return idle;
+}
diff --git a/drivers/net/wireless/iwlwifi/pcie/internal.h b/drivers/net/wireless/iwlwifi/pcie/internal.h
index 1b95d856dfd5..6c22b23a2845 100644
--- a/drivers/net/wireless/iwlwifi/pcie/internal.h
+++ b/drivers/net/wireless/iwlwifi/pcie/internal.h
@@ -117,21 +117,19 @@ struct iwl_dma_ptr {
 /**
  * iwl_queue_inc_wrap - increment queue index, wrap back to beginning
  * @index -- current index
- * @n_bd -- total number of entries in queue (must be power of 2)
  */
-static inline int iwl_queue_inc_wrap(int index, int n_bd)
+static inline int iwl_queue_inc_wrap(int index)
 {
-        return ++index & (n_bd - 1);
+        return ++index & (TFD_QUEUE_SIZE_MAX - 1);
 }
 
 /**
  * iwl_queue_dec_wrap - decrement queue index, wrap back to end
  * @index -- current index
- * @n_bd -- total number of entries in queue (must be power of 2)
  */
-static inline int iwl_queue_dec_wrap(int index, int n_bd)
+static inline int iwl_queue_dec_wrap(int index)
 {
-        return --index & (n_bd - 1);
+        return --index & (TFD_QUEUE_SIZE_MAX - 1);
 }
 
 struct iwl_cmd_meta {
@@ -145,13 +143,13 @@ struct iwl_cmd_meta {
  *
  * Contains common data for Rx and Tx queues.
  *
- * Note the difference between n_bd and n_window: the hardware
- * always assumes 256 descriptors, so n_bd is always 256 (unless
+ * Note the difference between TFD_QUEUE_SIZE_MAX and n_window: the hardware
+ * always assumes 256 descriptors, so TFD_QUEUE_SIZE_MAX is always 256 (unless
  * there might be HW changes in the future). For the normal TX
  * queues, n_window, which is the size of the software queue data
  * is also 256; however, for the command queue, n_window is only
  * 32 since we don't need so many commands pending. Since the HW
- * still uses 256 BDs for DMA though, n_bd stays 256. As a result,
+ * still uses 256 BDs for DMA though, TFD_QUEUE_SIZE_MAX stays 256. As a result,
  * the software buffers (in the variables @meta, @txb in struct
  * iwl_txq) only have 32 entries, while the HW buffers (@tfds in
  * the same struct) have 256.
@@ -162,7 +160,6 @@ struct iwl_cmd_meta {
  * data is a window overlayed over the HW queue.
  */
 struct iwl_queue {
-        int n_bd;              /* number of BDs in this queue */
         int write_ptr;       /* 1-st empty entry (index) host_w*/
         int read_ptr;         /* last used entry (index) host_r*/
         /* use for monitoring and recovering the stuck queue */
@@ -373,6 +370,13 @@ void iwl_trans_pcie_reclaim(struct iwl_trans *trans, int txq_id, int ssn,
                             struct sk_buff_head *skbs);
 void iwl_trans_pcie_tx_reset(struct iwl_trans *trans);
 
+static inline u16 iwl_pcie_tfd_tb_get_len(struct iwl_tfd *tfd, u8 idx)
+{
+        struct iwl_tfd_tb *tb = &tfd->tbs[idx];
+
+        return le16_to_cpu(tb->hi_n_len) >> 4;
+}
+
 /*****************************************************
 * Error handling
 ******************************************************/
diff --git a/drivers/net/wireless/iwlwifi/pcie/rx.c b/drivers/net/wireless/iwlwifi/pcie/rx.c
index 4a26a082a1ba..a2698e5e062c 100644
--- a/drivers/net/wireless/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/rx.c
@@ -850,7 +850,7 @@ static u32 iwl_pcie_int_cause_ict(struct iwl_trans *trans)
                                 trans_pcie->ict_index, read);
                 trans_pcie->ict_tbl[trans_pcie->ict_index] = 0;
                 trans_pcie->ict_index =
-                        iwl_queue_inc_wrap(trans_pcie->ict_index, ICT_COUNT);
+                        ((trans_pcie->ict_index + 1) & (ICT_COUNT - 1));
 
                 read = le32_to_cpu(trans_pcie->ict_tbl[trans_pcie->ict_index]);
                 trace_iwlwifi_dev_ict_read(trans->dev, trans_pcie->ict_index,
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index f98ef1e62eb9..a1af903f6c9b 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -73,6 +73,7 @@
 #include "iwl-csr.h"
 #include "iwl-prph.h"
 #include "iwl-agn-hw.h"
+#include "iwl-fw-error-dump.h"
 #include "internal.h"
 
 static u32 iwl_trans_pcie_read_shr(struct iwl_trans *trans, u32 reg)
@@ -1337,8 +1338,8 @@ static int iwl_trans_pcie_wait_txq_empty(struct iwl_trans *trans, u32 txq_bm)
                 IWL_ERR(trans,
                         "Q %d is %sactive and mapped to fifo %d ra_tid 0x%04x [%d,%d]\n",
                         cnt, active ? "" : "in", fifo, tbl_dw,
-                        iwl_read_prph(trans,
-                                      SCD_QUEUE_RDPTR(cnt)) & (txq->q.n_bd - 1),
+                        iwl_read_prph(trans, SCD_QUEUE_RDPTR(cnt)) &
+                                (TFD_QUEUE_SIZE_MAX - 1),
                         iwl_read_prph(trans, SCD_QUEUE_WRPTR(cnt)));
         }
 
@@ -1669,6 +1670,61 @@ err:
         IWL_ERR(trans, "failed to create the trans debugfs entry\n");
         return -ENOMEM;
 }
+
+static u32 iwl_trans_pcie_get_cmdlen(struct iwl_tfd *tfd)
+{
+        u32 cmdlen = 0;
+        int i;
+
+        for (i = 0; i < IWL_NUM_OF_TBS; i++)
+                cmdlen += iwl_pcie_tfd_tb_get_len(tfd, i);
+
+        return cmdlen;
+}
+
+static u32 iwl_trans_pcie_dump_data(struct iwl_trans *trans,
+                                    void *buf, u32 buflen)
+{
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+        struct iwl_fw_error_dump_data *data;
+        struct iwl_txq *cmdq = &trans_pcie->txq[trans_pcie->cmd_queue];
+        struct iwl_fw_error_dump_txcmd *txcmd;
+        u32 len;
+        int i, ptr;
+
+        if (!buf)
+                return sizeof(*data) +
+                       cmdq->q.n_window * (sizeof(*txcmd) +
+                                           TFD_MAX_PAYLOAD_SIZE);
+
+        len = 0;
+        data = buf;
+        data->type = cpu_to_le32(IWL_FW_ERROR_DUMP_TXCMD);
+        txcmd = (void *)data->data;
+        spin_lock_bh(&cmdq->lock);
+        ptr = cmdq->q.write_ptr;
+        for (i = 0; i < cmdq->q.n_window; i++) {
+                u8 idx = get_cmd_index(&cmdq->q, ptr);
+                u32 caplen, cmdlen;
+
+                cmdlen = iwl_trans_pcie_get_cmdlen(&cmdq->tfds[ptr]);
+                caplen = min_t(u32, TFD_MAX_PAYLOAD_SIZE, cmdlen);
+
+                if (cmdlen) {
+                        len += sizeof(*txcmd) + caplen;
+                        txcmd->cmdlen = cpu_to_le32(cmdlen);
+                        txcmd->caplen = cpu_to_le32(caplen);
+                        memcpy(txcmd->data, cmdq->entries[idx].cmd, caplen);
+                        txcmd = (void *)((u8 *)txcmd->data + caplen);
+                }
+
+                ptr = iwl_queue_dec_wrap(ptr);
+        }
+        spin_unlock_bh(&cmdq->lock);
+
+        data->len = cpu_to_le32(len);
+        return sizeof(*data) + len;
+}
 #else
 static int iwl_trans_pcie_dbgfs_register(struct iwl_trans *trans,
                                          struct dentry *dir)
@@ -1711,6 +1767,10 @@ static const struct iwl_trans_ops trans_ops_pcie = {
         .grab_nic_access = iwl_trans_pcie_grab_nic_access,
         .release_nic_access = iwl_trans_pcie_release_nic_access,
         .set_bits_mask = iwl_trans_pcie_set_bits_mask,
+
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+        .dump_data = iwl_trans_pcie_dump_data,
+#endif
 };
 
 struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
@@ -1788,6 +1848,10 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
          * PCI Tx retries from interfering with C3 CPU state */
         pci_write_config_byte(pdev, PCI_CFG_RETRY_TIMEOUT, 0x00);
 
+        trans->dev = &pdev->dev;
+        trans_pcie->pci_dev = pdev;
+        iwl_disable_interrupts(trans);
+
         err = pci_enable_msi(pdev);
         if (err) {
                 dev_err(&pdev->dev, "pci_enable_msi failed(0X%x)\n", err);
@@ -1799,8 +1863,6 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
                 }
         }
 
-        trans->dev = &pdev->dev;
-        trans_pcie->pci_dev = pdev;
         trans->hw_rev = iwl_read32(trans, CSR_HW_REV);
         trans->hw_id = (pdev->device << 16) + pdev->subsystem_device;
         snprintf(trans->hw_id_str, sizeof(trans->hw_id_str),
@@ -1826,8 +1888,6 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
                 goto out_pci_disable_msi;
         }
 
-        trans_pcie->inta_mask = CSR_INI_SET_MASK;
-
         if (iwl_pcie_alloc_ict(trans))
                 goto out_free_cmd_pool;
 
@@ -1839,6 +1899,8 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
                 goto out_free_ict;
         }
 
+        trans_pcie->inta_mask = CSR_INI_SET_MASK;
+
         return trans;
 
 out_free_ict:
diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c
index dde6031f4257..77a512a5a755 100644
--- a/drivers/net/wireless/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
@@ -70,20 +70,20 @@ static int iwl_queue_space(const struct iwl_queue *q)
 
         /*
          * To avoid ambiguity between empty and completely full queues, there
-         * should always be less than q->n_bd elements in the queue.
-         * If q->n_window is smaller than q->n_bd, there is no need to reserve
-         * any queue entries for this purpose.
+         * should always be less than TFD_QUEUE_SIZE_MAX elements in the queue.
+         * If q->n_window is smaller than TFD_QUEUE_SIZE_MAX, there is no need
+         * to reserve any queue entries for this purpose.
          */
-        if (q->n_window < q->n_bd)
+        if (q->n_window < TFD_QUEUE_SIZE_MAX)
                 max = q->n_window;
         else
-                max = q->n_bd - 1;
+                max = TFD_QUEUE_SIZE_MAX - 1;
 
         /*
-         * q->n_bd is a power of 2, so the following is equivalent to modulo by
-         * q->n_bd and is well defined for negative dividends.
+         * TFD_QUEUE_SIZE_MAX is a power of 2, so the following is equivalent to
+         * modulo by TFD_QUEUE_SIZE_MAX and is well defined.
          */
-        used = (q->write_ptr - q->read_ptr) & (q->n_bd - 1);
+        used = (q->write_ptr - q->read_ptr) & (TFD_QUEUE_SIZE_MAX - 1);
 
         if (WARN_ON(used > max))
                 return 0;
@@ -94,17 +94,11 @@ static int iwl_queue_space(const struct iwl_queue *q)
 /*
  * iwl_queue_init - Initialize queue's high/low-water and read/write indexes
  */
-static int iwl_queue_init(struct iwl_queue *q, int count, int slots_num, u32 id)
+static int iwl_queue_init(struct iwl_queue *q, int slots_num, u32 id)
 {
-        q->n_bd = count;
         q->n_window = slots_num;
         q->id = id;
 
-        /* count must be power-of-two size, otherwise iwl_queue_inc_wrap
-         * and iwl_queue_dec_wrap are broken. */
-        if (WARN_ON(!is_power_of_2(count)))
-                return -EINVAL;
-
         /* slots_num must be power-of-two size, otherwise
          * get_cmd_index is broken. */
         if (WARN_ON(!is_power_of_2(slots_num)))
@@ -197,13 +191,13 @@ static void iwl_pcie_txq_stuck_timer(unsigned long data)
                 IWL_ERR(trans,
                         "Q %d is %sactive and mapped to fifo %d ra_tid 0x%04x [%d,%d]\n",
                         i, active ? "" : "in", fifo, tbl_dw,
-                        iwl_read_prph(trans,
-                                      SCD_QUEUE_RDPTR(i)) & (txq->q.n_bd - 1),
+                        iwl_read_prph(trans, SCD_QUEUE_RDPTR(i)) &
+                                (TFD_QUEUE_SIZE_MAX - 1),
                         iwl_read_prph(trans, SCD_QUEUE_WRPTR(i)));
         }
 
         for (i = q->read_ptr; i != q->write_ptr;
-             i = iwl_queue_inc_wrap(i, q->n_bd))
+             i = iwl_queue_inc_wrap(i))
                 IWL_ERR(trans, "scratch %d = 0x%08x\n", i,
                         le32_to_cpu(txq->scratchbufs[i].scratch));
 
@@ -359,13 +353,6 @@ static inline dma_addr_t iwl_pcie_tfd_tb_get_addr(struct iwl_tfd *tfd, u8 idx)
         return addr;
 }
 
-static inline u16 iwl_pcie_tfd_tb_get_len(struct iwl_tfd *tfd, u8 idx)
-{
-        struct iwl_tfd_tb *tb = &tfd->tbs[idx];
-
-        return le16_to_cpu(tb->hi_n_len) >> 4;
-}
-
 static inline void iwl_pcie_tfd_set_tb(struct iwl_tfd *tfd, u8 idx,
                                        dma_addr_t addr, u16 len)
 {
@@ -425,13 +412,17 @@ static void iwl_pcie_txq_free_tfd(struct iwl_trans *trans, struct iwl_txq *txq)
 {
         struct iwl_tfd *tfd_tmp = txq->tfds;
 
-        /* rd_ptr is bounded by n_bd and idx is bounded by n_window */
+        /* rd_ptr is bounded by TFD_QUEUE_SIZE_MAX and
+         * idx is bounded by n_window
+         */
         int rd_ptr = txq->q.read_ptr;
         int idx = get_cmd_index(&txq->q, rd_ptr);
 
         lockdep_assert_held(&txq->lock);
 
-        /* We have only q->n_window txq->entries, but we use q->n_bd tfds */
+        /* We have only q->n_window txq->entries, but we use
+         * TFD_QUEUE_SIZE_MAX tfds
+         */
         iwl_pcie_tfd_unmap(trans, &txq->entries[idx].meta, &tfd_tmp[rd_ptr]);
 
         /* free SKB */
@@ -452,7 +443,7 @@ static void iwl_pcie_txq_free_tfd(struct iwl_trans *trans, struct iwl_txq *txq)
 }
 
 static int iwl_pcie_txq_build_tfd(struct iwl_trans *trans, struct iwl_txq *txq,
-                                  dma_addr_t addr, u16 len, u8 reset)
+                                  dma_addr_t addr, u16 len, bool reset)
 {
         struct iwl_queue *q;
         struct iwl_tfd *tfd, *tfd_tmp;
@@ -565,8 +556,7 @@ static int iwl_pcie_txq_init(struct iwl_trans *trans, struct iwl_txq *txq,
         BUILD_BUG_ON(TFD_QUEUE_SIZE_MAX & (TFD_QUEUE_SIZE_MAX - 1));
 
         /* Initialize queue's high/low-water marks, and head/tail indexes */
-        ret = iwl_queue_init(&txq->q, TFD_QUEUE_SIZE_MAX, slots_num,
-                        txq_id);
+        ret = iwl_queue_init(&txq->q, slots_num, txq_id);
         if (ret)
                 return ret;
 
@@ -591,15 +581,12 @@ static void iwl_pcie_txq_unmap(struct iwl_trans *trans, int txq_id)
         struct iwl_txq *txq = &trans_pcie->txq[txq_id];
         struct iwl_queue *q = &txq->q;
 
-        if (!q->n_bd)
-                return;
-
         spin_lock_bh(&txq->lock);
         while (q->write_ptr != q->read_ptr) {
                 IWL_DEBUG_TX_REPLY(trans, "Q %d Free %d\n",
                                    txq_id, q->read_ptr);
                 iwl_pcie_txq_free_tfd(trans, txq);
-                q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd);
+                q->read_ptr = iwl_queue_inc_wrap(q->read_ptr);
         }
         txq->active = false;
         spin_unlock_bh(&txq->lock);
@@ -636,10 +623,12 @@ static void iwl_pcie_txq_free(struct iwl_trans *trans, int txq_id)
                 }
 
         /* De-alloc circular buffer of TFDs */
-        if (txq->q.n_bd) {
-                dma_free_coherent(dev, sizeof(struct iwl_tfd) *
-                                  txq->q.n_bd, txq->tfds, txq->q.dma_addr);
+        if (txq->tfds) {
+                dma_free_coherent(dev,
+                                  sizeof(struct iwl_tfd) * TFD_QUEUE_SIZE_MAX,
+                                  txq->tfds, txq->q.dma_addr);
                 txq->q.dma_addr = 0;
+                txq->tfds = NULL;
 
                 dma_free_coherent(dev,
                                   sizeof(*txq->scratchbufs) * txq->q.n_window,
@@ -948,8 +937,7 @@ void iwl_trans_pcie_reclaim(struct iwl_trans *trans, int txq_id, int ssn,
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         struct iwl_txq *txq = &trans_pcie->txq[txq_id];
-        /* n_bd is usually 256 => n_bd - 1 = 0xff */
-        int tfd_num = ssn & (txq->q.n_bd - 1);
+        int tfd_num = ssn & (TFD_QUEUE_SIZE_MAX - 1);
         struct iwl_queue *q = &txq->q;
         int last_to_free;
 
@@ -973,12 +961,12 @@ void iwl_trans_pcie_reclaim(struct iwl_trans *trans, int txq_id, int ssn,
 
         /*Since we free until index _not_ inclusive, the one before index is
          * the last we will free. This one must be used */
-        last_to_free = iwl_queue_dec_wrap(tfd_num, q->n_bd);
+        last_to_free = iwl_queue_dec_wrap(tfd_num);
 
         if (!iwl_queue_used(q, last_to_free)) {
                 IWL_ERR(trans,
                         "%s: Read index for DMA queue txq id (%d), last_to_free %d is out of range [0-%d] %d %d.\n",
-                        __func__, txq_id, last_to_free, q->n_bd,
+                        __func__, txq_id, last_to_free, TFD_QUEUE_SIZE_MAX,
                         q->write_ptr, q->read_ptr);
                 goto out;
         }
@@ -988,7 +976,7 @@ void iwl_trans_pcie_reclaim(struct iwl_trans *trans, int txq_id, int ssn,
 
         for (;
              q->read_ptr != tfd_num;
-             q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd)) {
+             q->read_ptr = iwl_queue_inc_wrap(q->read_ptr)) {
 
                 if (WARN_ON_ONCE(txq->entries[txq->q.read_ptr].skb == NULL))
                         continue;
@@ -1027,16 +1015,16 @@ static void iwl_pcie_cmdq_reclaim(struct iwl_trans *trans, int txq_id, int idx)
 
         lockdep_assert_held(&txq->lock);
 
-        if ((idx >= q->n_bd) || (!iwl_queue_used(q, idx))) {
+        if ((idx >= TFD_QUEUE_SIZE_MAX) || (!iwl_queue_used(q, idx))) {
                 IWL_ERR(trans,
                         "%s: Read index for DMA queue txq id (%d), index %d is out of range [0-%d] %d %d.\n",
-                        __func__, txq_id, idx, q->n_bd,
+                        __func__, txq_id, idx, TFD_QUEUE_SIZE_MAX,
                         q->write_ptr, q->read_ptr);
                 return;
         }
 
-        for (idx = iwl_queue_inc_wrap(idx, q->n_bd); q->read_ptr != idx;
-             q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd)) {
+        for (idx = iwl_queue_inc_wrap(idx); q->read_ptr != idx;
+             q->read_ptr = iwl_queue_inc_wrap(q->read_ptr)) {
 
                 if (nfreed++ > 0) {
                         IWL_ERR(trans, "HCMD skipped: index (%d) %d %d\n",
@@ -1327,28 +1315,39 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
         cmd_pos = offsetof(struct iwl_device_cmd, payload);
         copy_size = sizeof(out_cmd->hdr);
         for (i = 0; i < IWL_MAX_CMD_TBS_PER_TFD; i++) {
-                int copy = 0;
+                int copy;
 
                 if (!cmd->len[i])
                         continue;
 
-                /* need at least IWL_HCMD_SCRATCHBUF_SIZE copied */
-                if (copy_size < IWL_HCMD_SCRATCHBUF_SIZE) {
-                        copy = IWL_HCMD_SCRATCHBUF_SIZE - copy_size;
-
-                        if (copy > cmd->len[i])
-                                copy = cmd->len[i];
-                }
-
                 /* copy everything if not nocopy/dup */
                 if (!(cmd->dataflags[i] & (IWL_HCMD_DFL_NOCOPY |
-                                           IWL_HCMD_DFL_DUP)))
+                                           IWL_HCMD_DFL_DUP))) {
                         copy = cmd->len[i];
 
-                if (copy) {
                         memcpy((u8 *)out_cmd + cmd_pos, cmd->data[i], copy);
                         cmd_pos += copy;
                         copy_size += copy;
+                        continue;
+                }
+
+                /*
+                 * Otherwise we need at least IWL_HCMD_SCRATCHBUF_SIZE copied
+                 * in total (for the scratchbuf handling), but copy up to what
+                 * we can fit into the payload for debug dump purposes.
+                 */
+                copy = min_t(int, TFD_MAX_PAYLOAD_SIZE - cmd_pos, cmd->len[i]);
+
+                memcpy((u8 *)out_cmd + cmd_pos, cmd->data[i], copy);
+                cmd_pos += copy;
+
+                /* However, treat copy_size the proper way, we need it below */
+                if (copy_size < IWL_HCMD_SCRATCHBUF_SIZE) {
+                        copy = IWL_HCMD_SCRATCHBUF_SIZE - copy_size;
+
+                        if (copy > cmd->len[i])
+                                copy = cmd->len[i];
+                        copy_size += copy;
                 }
         }
 
@@ -1363,7 +1362,7 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
         memcpy(&txq->scratchbufs[q->write_ptr], &out_cmd->hdr, scratch_size);
         iwl_pcie_txq_build_tfd(trans, txq,
                                iwl_pcie_get_scratchbuf_dma(txq, q->write_ptr),
-                               scratch_size, 1);
+                               scratch_size, true);
 
         /* map first command fragment, if any remains */
         if (copy_size > scratch_size) {
@@ -1379,7 +1378,7 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
                 }
 
                 iwl_pcie_txq_build_tfd(trans, txq, phys_addr,
-                                       copy_size - scratch_size, 0);
+                                       copy_size - scratch_size, false);
         }
 
         /* map the remaining (adjusted) nocopy/dup fragments */
@@ -1402,7 +1401,7 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
                         goto out;
                 }
 
-                iwl_pcie_txq_build_tfd(trans, txq, phys_addr, cmdlen[i], 0);
+                iwl_pcie_txq_build_tfd(trans, txq, phys_addr, cmdlen[i], false);
         }
 
         out_meta->flags = cmd->flags;
@@ -1445,7 +1444,7 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
         }
 
         /* Increment and update queue's write index */
-        q->write_ptr = iwl_queue_inc_wrap(q->write_ptr, q->n_bd);
+        q->write_ptr = iwl_queue_inc_wrap(q->write_ptr);
         iwl_pcie_txq_inc_wr_ptr(trans, txq);
 
         spin_unlock_irqrestore(&trans_pcie->reg_lock, flags);
@@ -1740,7 +1739,7 @@ int iwl_trans_pcie_tx(struct iwl_trans *trans, struct sk_buff *skb,
         memcpy(&txq->scratchbufs[q->write_ptr], &dev_cmd->hdr,
                IWL_HCMD_SCRATCHBUF_SIZE);
         iwl_pcie_txq_build_tfd(trans, txq, tb0_phys,
-                               IWL_HCMD_SCRATCHBUF_SIZE, 1);
+                               IWL_HCMD_SCRATCHBUF_SIZE, true);
 
         /* there must be data left over for TB1 or this code must be changed */
         BUILD_BUG_ON(sizeof(struct iwl_tx_cmd) < IWL_HCMD_SCRATCHBUF_SIZE);
@@ -1750,7 +1749,7 @@ int iwl_trans_pcie_tx(struct iwl_trans *trans, struct sk_buff *skb,
         tb1_phys = dma_map_single(trans->dev, tb1_addr, tb1_len, DMA_TO_DEVICE);
         if (unlikely(dma_mapping_error(trans->dev, tb1_phys)))
                 goto out_err;
-        iwl_pcie_txq_build_tfd(trans, txq, tb1_phys, tb1_len, 0);
+        iwl_pcie_txq_build_tfd(trans, txq, tb1_phys, tb1_len, false);
 
         /*
          * Set up TFD's third entry to point directly to remainder
@@ -1766,7 +1765,7 @@ int iwl_trans_pcie_tx(struct iwl_trans *trans, struct sk_buff *skb,
                                            &txq->tfds[q->write_ptr]);
                         goto out_err;
                 }
-                iwl_pcie_txq_build_tfd(trans, txq, tb2_phys, tb2_len, 0);
+                iwl_pcie_txq_build_tfd(trans, txq, tb2_phys, tb2_len, false);
         }
 
         /* Set up entry for this TFD in Tx byte-count array */
@@ -1788,7 +1787,7 @@ int iwl_trans_pcie_tx(struct iwl_trans *trans, struct sk_buff *skb,
                 mod_timer(&txq->stuck_timer, jiffies + trans_pcie->wd_timeout);
 
         /* Tell device the write index *just past* this latest filled TFD */
-        q->write_ptr = iwl_queue_inc_wrap(q->write_ptr, q->n_bd);
+        q->write_ptr = iwl_queue_inc_wrap(q->write_ptr);
         if (!wait_write_ptr)
                 iwl_pcie_txq_inc_wr_ptr(trans, txq);
 
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 9d7a52f5a410..a312c653d116 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -1676,7 +1676,9 @@ static int mac80211_hwsim_ampdu_action(struct ieee80211_hw *hw,
         return 0;
 }
 
-static void mac80211_hwsim_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
+static void mac80211_hwsim_flush(struct ieee80211_hw *hw,
+                                 struct ieee80211_vif *vif,
+                                 u32 queues, bool drop)
 {
         /* Not implemented, queues only on kernel side */
 }
@@ -2056,6 +2058,7 @@ static int mac80211_hwsim_create_radio(int channels, const char *reg_alpha2,
                             WIPHY_FLAG_AP_UAPSD |
                             WIPHY_FLAG_HAS_CHANNEL_SWITCH;
         hw->wiphy->features |= NL80211_FEATURE_ACTIVE_MONITOR;
+        hw->wiphy->features |= NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE;
 
         /* ask mac80211 to reserve space for magic */
         hw->vif_data_size = sizeof(struct hwsim_vif_priv);
diff --git a/drivers/net/wireless/mwifiex/11n.c b/drivers/net/wireless/mwifiex/11n.c
index 2bd07d681c5e..e1c2f67ae85e 100644
--- a/drivers/net/wireless/mwifiex/11n.c
+++ b/drivers/net/wireless/mwifiex/11n.c
@@ -749,3 +749,45 @@ void mwifiex_set_ba_params(struct mwifiex_private *priv)
 
         return;
 }
+
+u8 mwifiex_get_sec_chan_offset(int chan)
+{
+        u8 sec_offset;
+
+        switch (chan) {
+        case 36:
+        case 44:
+        case 52:
+        case 60:
+        case 100:
+        case 108:
+        case 116:
+        case 124:
+        case 132:
+        case 140:
+        case 149:
+        case 157:
+                sec_offset = IEEE80211_HT_PARAM_CHA_SEC_ABOVE;
+                break;
+        case 40:
+        case 48:
+        case 56:
+        case 64:
+        case 104:
+        case 112:
+        case 120:
+        case 128:
+        case 136:
+        case 144:
+        case 153:
+        case 161:
+                sec_offset = IEEE80211_HT_PARAM_CHA_SEC_BELOW;
+                break;
+        case 165:
+        default:
+                sec_offset = IEEE80211_HT_PARAM_CHA_SEC_NONE;
+                break;
+        }
+
+        return sec_offset;
+}
diff --git a/drivers/net/wireless/mwifiex/11n.h b/drivers/net/wireless/mwifiex/11n.h
index 40b007a00f4b..43889d9e3b35 100644
--- a/drivers/net/wireless/mwifiex/11n.h
+++ b/drivers/net/wireless/mwifiex/11n.h
@@ -63,6 +63,7 @@ int mwifiex_cmd_amsdu_aggr_ctrl(struct host_cmd_ds_command *cmd,
                                 int cmd_action,
                                 struct mwifiex_ds_11n_amsdu_aggr_ctrl *aa_ctrl);
 void mwifiex_del_tx_ba_stream_tbl_by_ra(struct mwifiex_private *priv, u8 *ra);
+u8 mwifiex_get_sec_chan_offset(int chan);
 
 static inline u8
 mwifiex_is_station_ampdu_allowed(struct mwifiex_private *priv,
diff --git a/drivers/net/wireless/mwifiex/cmdevt.c b/drivers/net/wireless/mwifiex/cmdevt.c
index 421322f5e5fb..8dee6c86f4f1 100644
--- a/drivers/net/wireless/mwifiex/cmdevt.c
+++ b/drivers/net/wireless/mwifiex/cmdevt.c
@@ -960,9 +960,6 @@ mwifiex_cmd_timeout_func(unsigned long function_context)
         if (adapter->hw_status == MWIFIEX_HW_STATUS_INITIALIZING)
                 mwifiex_init_fw_complete(adapter);
 
-        if (adapter->if_ops.fw_dump)
-                adapter->if_ops.fw_dump(adapter);
-
         if (adapter->if_ops.card_reset)
                 adapter->if_ops.card_reset(adapter);
 }
diff --git a/drivers/net/wireless/mwifiex/fw.h b/drivers/net/wireless/mwifiex/fw.h
index b485dc1ae5eb..ee59508307cc 100644
--- a/drivers/net/wireless/mwifiex/fw.h
+++ b/drivers/net/wireless/mwifiex/fw.h
@@ -169,6 +169,7 @@ enum MWIFIEX_802_11_PRIVACY_FILTER {
 #define TLV_TYPE_GWK_CIPHER         (PROPRIETARY_TLV_BASE_ID + 146)
 #define TLV_TYPE_COALESCE_RULE      (PROPRIETARY_TLV_BASE_ID + 154)
 #define TLV_TYPE_KEY_PARAM_V2       (PROPRIETARY_TLV_BASE_ID + 156)
+#define TLV_TYPE_TDLS_IDLE_TIMEOUT  (PROPRIETARY_TLV_BASE_ID + 194)
 #define TLV_TYPE_FW_API_REV         (PROPRIETARY_TLV_BASE_ID + 199)
 
 #define MWIFIEX_TX_DATA_BUF_SIZE_2K        2048
@@ -229,6 +230,7 @@ enum MWIFIEX_802_11_PRIVACY_FILTER {
 #define ISENABLED_40MHZ_INTOLERANT(Dot11nDevCap) (Dot11nDevCap & BIT(8))
 #define ISSUPP_RXLDPC(Dot11nDevCap) (Dot11nDevCap & BIT(22))
 #define ISSUPP_BEAMFORMING(Dot11nDevCap) (Dot11nDevCap & BIT(30))
+#define ISALLOWED_CHANWIDTH40(ht_param) (ht_param & BIT(2))
 
 /* httxcfg bitmap
  * 0            reserved
@@ -487,6 +489,7 @@ enum P2P_MODES {
 #define EVENT_UAP_MIC_COUNTERMEASURES   0x0000004c
 #define EVENT_HOSTWAKE_STAIE            0x0000004d
 #define EVENT_CHANNEL_SWITCH_ANN        0x00000050
+#define EVENT_TDLS_GENERIC_EVENT        0x00000052
 #define EVENT_EXT_SCAN_REPORT           0x00000058
 #define EVENT_REMAIN_ON_CHAN_EXPIRED    0x0000005f
 
@@ -519,6 +522,7 @@ enum P2P_MODES {
 #define ACT_TDLS_DELETE            0x00
 #define ACT_TDLS_CREATE            0x01
 #define ACT_TDLS_CONFIG            0x02
+#define TDLS_EVENT_LINK_TEAR_DOWN  3
 
 #define MWIFIEX_FW_V15             15
 
@@ -708,6 +712,13 @@ struct mwifiex_ie_types_vendor_param_set {
         u8 ie[MWIFIEX_MAX_VSIE_LEN];
 };
 
+#define MWIFIEX_TDLS_IDLE_TIMEOUT       60
+
+struct mwifiex_ie_types_tdls_idle_timeout {
+        struct mwifiex_ie_types_header header;
+        __le16 value;
+} __packed;
+
 struct mwifiex_ie_types_rsn_param_set {
         struct mwifiex_ie_types_header header;
         u8 rsn_ie[1];
@@ -1745,6 +1756,15 @@ struct host_cmd_ds_802_11_subsc_evt {
         __le16 events;
 } __packed;
 
+struct mwifiex_tdls_generic_event {
+        __le16 type;
+        u8 peer_mac[ETH_ALEN];
+        union {
+                __le16 reason_code;
+                __le16 reserved;
+        } u;
+} __packed;
+
 struct mwifiex_ie {
         __le16 ie_index;
         __le16 mgmt_subtype_mask;
diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
index 6bc645a120fa..cbabc12fbda3 100644
--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -881,8 +881,6 @@ mwifiex_add_card(void *card, struct semaphore *sem,
                 goto err_kmalloc;
 
         INIT_WORK(&adapter->main_work, mwifiex_main_work_queue);
-        if (adapter->if_ops.iface_work)
-                INIT_WORK(&adapter->iface_work, adapter->if_ops.iface_work);
 
         /* Register the device. Fill up the private data structure with relevant
            information from the card. */
diff --git a/drivers/net/wireless/mwifiex/main.h b/drivers/net/wireless/mwifiex/main.h
index d70457b26e26..34181192a666 100644
--- a/drivers/net/wireless/mwifiex/main.h
+++ b/drivers/net/wireless/mwifiex/main.h
@@ -674,7 +674,6 @@ struct mwifiex_if_ops {
         void (*card_reset) (struct mwifiex_adapter *);
         void (*fw_dump)(struct mwifiex_adapter *);
         int (*clean_pcie_ring) (struct mwifiex_adapter *adapter);
-        void (*iface_work)(struct work_struct *work);
 };
 
 struct mwifiex_adapter {
@@ -810,7 +809,6 @@ struct mwifiex_adapter {
         bool ext_scan;
         u8 fw_api_ver;
         u8 fw_key_api_major_ver, fw_key_api_minor_ver;
-        struct work_struct iface_work;
 };
 
 int mwifiex_init_lock_list(struct mwifiex_adapter *adapter);
diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
index 51989b31137a..c2cfeec466d8 100644
--- a/drivers/net/wireless/mwifiex/pcie.c
+++ b/drivers/net/wireless/mwifiex/pcie.c
@@ -37,9 +37,6 @@ static struct mwifiex_if_ops pcie_ops;
 
 static struct semaphore add_remove_card_sem;
 
-/* enum mwifiex_pcie_work_flags bitmap */
-static unsigned long pcie_work_flags;
-
 static int
 mwifiex_map_pci_memory(struct mwifiex_adapter *adapter, struct sk_buff *skb,
                        size_t size, int flags)
@@ -224,8 +221,6 @@ static void mwifiex_pcie_remove(struct pci_dev *pdev)
         if (!adapter || !adapter->priv_num)
                 return;
 
-        cancel_work_sync(&adapter->iface_work);
-
         if (user_rmmod) {
 #ifdef CONFIG_PM_SLEEP
                 if (adapter->is_suspended)
@@ -312,17 +307,6 @@ static int mwifiex_read_reg(struct mwifiex_adapter *adapter, int reg, u32 *data)
         return 0;
 }
 
-/* This function reads u8 data from PCIE card register. */
-static int mwifiex_read_reg_byte(struct mwifiex_adapter *adapter,
-                                 int reg, u8 *data)
-{
-        struct pcie_service_card *card = adapter->card;
-
-        *data = ioread8(card->pci_mmap1 + reg);
-
-        return 0;
-}
-
 /*
  * This function adds delay loop to ensure FW is awake before proceeding.
  */
@@ -2188,215 +2172,6 @@ static int mwifiex_pcie_host_to_card(struct mwifiex_adapter *adapter, u8 type,
         return 0;
 }
 
-/* This function read/write firmware */
-static enum rdwr_status
-mwifiex_pcie_rdwr_firmware(struct mwifiex_adapter *adapter, u8 doneflag)
-{
-        int ret, tries;
-        u8 ctrl_data;
-
-        ret = mwifiex_write_reg(adapter, DEBUG_DUMP_CTRL_REG, DEBUG_HOST_READY);
-        if (ret) {
-                dev_err(adapter->dev, "PCIE write err\n");
-                return RDWR_STATUS_FAILURE;
-        }
-
-        for (tries = 0; tries < MAX_POLL_TRIES; tries++) {
-                mwifiex_read_reg_byte(adapter, DEBUG_DUMP_CTRL_REG, &ctrl_data);
-                if (ctrl_data == DEBUG_FW_DONE)
-                        return RDWR_STATUS_SUCCESS;
-                if (doneflag && ctrl_data == doneflag)
-                        return RDWR_STATUS_DONE;
-                if (ctrl_data != DEBUG_HOST_READY) {
-                        dev_info(adapter->dev,
-                                 "The ctrl reg was changed, re-try again!\n");
-                        mwifiex_write_reg(adapter, DEBUG_DUMP_CTRL_REG,
-                                          DEBUG_HOST_READY);
-                        if (ret) {
-                                dev_err(adapter->dev, "PCIE write err\n");
-                                return RDWR_STATUS_FAILURE;
-                        }
-                }
-                usleep_range(100, 200);
-        }
-
-        dev_err(adapter->dev, "Fail to pull ctrl_data\n");
-        return RDWR_STATUS_FAILURE;
-}
-
-/* This function dump firmware memory to file */
-static void mwifiex_pcie_fw_dump_work(struct work_struct *work)
-{
-        struct mwifiex_adapter *adapter =
-                        container_of(work, struct mwifiex_adapter, iface_work);
-        unsigned int reg, reg_start, reg_end;
-        u8 *dbg_ptr;
-        struct timeval t;
-        u8 dump_num = 0, idx, i, read_reg, doneflag = 0;
-        enum rdwr_status stat;
-        u32 memory_size;
-        u8 filename[MAX_FULL_NAME_LEN];
-        mm_segment_t fs;
-        loff_t pos;
-        u8 *end_ptr;
-        u8 *name_prefix = "/var/log/fw_dump_";
-        struct memory_type_mapping mem_type_mapping_tbl[] = {
-                {"ITCM", NULL, NULL, 0xF0},
-                {"DTCM", NULL, NULL, 0xF1},
-                {"SQRAM", NULL, NULL, 0xF2},
-                {"IRAM", NULL, NULL, 0xF3},
-        };
-
-        if (!adapter) {
-                dev_err(adapter->dev, "Could not dump firmwware info\n");
-                return;
-        }
-
-        do_gettimeofday(&t);
-        dev_info(adapter->dev, "== mwifiex firmware dump start: %u.%06u ==\n",
-                 (u32)t.tv_sec, (u32)t.tv_usec);
-
-        /* Read the number of the memories which will dump */
-        stat = mwifiex_pcie_rdwr_firmware(adapter, doneflag);
-        if (stat == RDWR_STATUS_FAILURE)
-                goto done;
-
-        reg = DEBUG_DUMP_START_REG;
-        mwifiex_read_reg_byte(adapter, reg, &dump_num);
-
-        /* Read the length of every memory which will dump */
-        for (idx = 0; idx < dump_num; idx++) {
-                struct memory_type_mapping *entry = &mem_type_mapping_tbl[idx];
-
-                stat = mwifiex_pcie_rdwr_firmware(adapter, doneflag);
-                if (stat == RDWR_STATUS_FAILURE)
-                        goto done;
-
-                memory_size = 0;
-                reg = DEBUG_DUMP_START_REG;
-                for (i = 0; i < 4; i++) {
-                        mwifiex_read_reg_byte(adapter, reg, &read_reg);
-                        memory_size |= (read_reg << (i * 8));
-                        reg++;
-                }
-
-                if (memory_size == 0) {
-                        dev_info(adapter->dev, "Firmware dump Finished!\n");
-                        break;
-                }
-
-                dev_info(adapter->dev,
-                         "%s_SIZE=0x%x\n", entry->mem_name, memory_size);
-                entry->mem_ptr = vmalloc(memory_size + 1);
-                if (!entry->mem_ptr) {
-                        dev_err(adapter->dev,
-                                "Vmalloc %s failed\n", entry->mem_name);
-                        goto done;
-                }
-                dbg_ptr = entry->mem_ptr;
-                end_ptr = dbg_ptr + memory_size;
-
-                doneflag = entry->done_flag;
-                do_gettimeofday(&t);
-                dev_info(adapter->dev, "Start %s output %u.%06u, please wait...\n",
-                         entry->mem_name, (u32)t.tv_sec, (u32)t.tv_usec);
-
-                do {
-                        stat = mwifiex_pcie_rdwr_firmware(adapter, doneflag);
-                        if (RDWR_STATUS_FAILURE == stat)
-                                goto done;
-
-                        reg_start = DEBUG_DUMP_START_REG;
-                        reg_end = DEBUG_DUMP_END_REG;
-                        for (reg = reg_start; reg <= reg_end; reg++) {
-                                mwifiex_read_reg_byte(adapter, reg, dbg_ptr);
-                                if (dbg_ptr < end_ptr)
-                                        dbg_ptr++;
-                                else
-                                        dev_err(adapter->dev,
-                                                "Allocated buf not enough\n");
-                        }
-
-                        if (stat != RDWR_STATUS_DONE)
-                                continue;
-
-                        dev_info(adapter->dev, "%s done: size=0x%lx\n",
-                                 entry->mem_name, dbg_ptr - entry->mem_ptr);
-                        memset(filename, 0, sizeof(filename));
-                        memcpy(filename, name_prefix, strlen(name_prefix));
-                        strcat(filename, entry->mem_name);
-                        do_gettimeofday(&t);
-                        entry->file_mem = filp_open(filename, O_CREAT | O_RDWR,
-                                                    0644);
-                        if (IS_ERR(entry->file_mem)) {
-                                dev_info(adapter->dev,
-                                         "Create %s file failed at %s, opening another dir /tmp\n",
-                                         entry->mem_name, filename);
-                                memset(filename, 0, sizeof(filename));
-                                sprintf(filename, "%s%s", "/tmp/fw_dump_",
-                                        entry->mem_name);
-                                entry->file_mem =
-                                        filp_open(filename,
-                                                  O_CREAT | O_RDWR, 0644);
-                        }
-                        if (!IS_ERR(entry->file_mem)) {
-                                dev_info(adapter->dev,
-                                         "Start to save the output : %u.%06u, please wait...\n",
-                                         (u32)t.tv_sec, (u32)t.tv_usec);
-                                fs = get_fs();
-                                set_fs(KERNEL_DS);
-                                pos = 0;
-                                vfs_write(entry->file_mem,
-                                          (char __user *)entry->mem_ptr,
-                                          memory_size, &pos);
-                                filp_close(entry->file_mem, NULL);
-                                set_fs(fs);
-                                dev_info(adapter->dev,
-                                         "The output %s have been saved to file successfully!\n",
-                                         entry->mem_name);
-                        } else {
-                                dev_err(adapter->dev,
-                                        "Failed to create file %s\n", filename);
-                        }
-                        vfree(entry->mem_ptr);
-                        entry->mem_ptr = NULL;
-                        break;
-                } while (true);
-        }
-        do_gettimeofday(&t);
-        dev_info(adapter->dev, "== mwifiex firmware dump end: %u.%06u ==\n",
-                 (u32)t.tv_sec, (u32)t.tv_usec);
-
-done:
-        for (idx = 0; idx < ARRAY_SIZE(mem_type_mapping_tbl); idx++) {
-                struct memory_type_mapping *entry = &mem_type_mapping_tbl[idx];
-
-                if (entry->mem_ptr) {
-                        vfree(entry->mem_ptr);
-                        entry->mem_ptr = NULL;
-                }
-        }
-
-        return;
-}
-
-static void mwifiex_pcie_work(struct work_struct *work)
-{
-        if (test_and_clear_bit(MWIFIEX_PCIE_WORK_FW_DUMP, &pcie_work_flags))
-                mwifiex_pcie_fw_dump_work(work);
-}
-
-/* This function dumps FW information */
-static void mwifiex_pcie_fw_dump(struct mwifiex_adapter *adapter)
-{
-        if (test_bit(MWIFIEX_PCIE_WORK_FW_DUMP, &pcie_work_flags))
-                return;
-
-        set_bit(MWIFIEX_PCIE_WORK_FW_DUMP, &pcie_work_flags);
-
-        schedule_work(&adapter->iface_work);
-}
-
 /*
  * This function initializes the PCI-E host memory space, WCB rings, etc.
  *
@@ -2618,8 +2393,6 @@ static struct mwifiex_if_ops pcie_ops = {
         .cleanup_mpa_buf =              NULL,
         .init_fw_port =                 mwifiex_pcie_init_fw_port,
         .clean_pcie_ring =              mwifiex_clean_pcie_ring_buf,
-        .fw_dump =                      mwifiex_pcie_fw_dump,
-        .iface_work =                   mwifiex_pcie_work,
 };
 
 /*
diff --git a/drivers/net/wireless/mwifiex/pcie.h b/drivers/net/wireless/mwifiex/pcie.h
index 3abba32e9448..e8ec561f8a64 100644
--- a/drivers/net/wireless/mwifiex/pcie.h
+++ b/drivers/net/wireless/mwifiex/pcie.h
@@ -100,28 +100,6 @@
 #define MWIFIEX_DEF_SLEEP_COOKIE                        0xBEEFBEEF
 #define MWIFIEX_MAX_DELAY_COUNT                         5
 
-#define DEBUG_DUMP_CTRL_REG                             0xCF4
-#define DEBUG_DUMP_START_REG                            0xCF8
-#define DEBUG_DUMP_END_REG                              0xCFF
-#define DEBUG_HOST_READY                                0xEE
-#define DEBUG_FW_DONE                                   0xFF
-
-#define MAX_NAME_LEN                                    8
-#define MAX_FULL_NAME_LEN                               32
-
-struct memory_type_mapping {
-        u8 mem_name[MAX_NAME_LEN];
-        u8 *mem_ptr;
-        struct file *file_mem;
-        u8 done_flag;
-};
-
-enum rdwr_status {
-        RDWR_STATUS_SUCCESS = 0,
-        RDWR_STATUS_FAILURE = 1,
-        RDWR_STATUS_DONE = 2
-};
-
 struct mwifiex_pcie_card_reg {
         u16 cmd_addr_lo;
         u16 cmd_addr_hi;
@@ -344,9 +322,4 @@ mwifiex_pcie_txbd_not_full(struct pcie_service_card *card)
 
         return 0;
 }
-
-enum mwifiex_pcie_work_flags {
-        MWIFIEX_PCIE_WORK_FW_DUMP,
-};
-
 #endif /* _MWIFIEX_PCIE_H */
diff --git a/drivers/net/wireless/mwifiex/sta_cmd.c b/drivers/net/wireless/mwifiex/sta_cmd.c
index e3cac1495cc7..88202ce0c139 100644
--- a/drivers/net/wireless/mwifiex/sta_cmd.c
+++ b/drivers/net/wireless/mwifiex/sta_cmd.c
@@ -1546,6 +1546,7 @@ mwifiex_cmd_tdls_oper(struct mwifiex_private *priv,
         struct mwifiex_ie_types_extcap *extcap;
         struct mwifiex_ie_types_vhtcap *vht_capab;
         struct mwifiex_ie_types_aid *aid;
+        struct mwifiex_ie_types_tdls_idle_timeout *timeout;
         u8 *pos, qos_info;
         u16 config_len = 0;
         struct station_parameters *params = priv->sta_params;
@@ -1643,6 +1644,12 @@ mwifiex_cmd_tdls_oper(struct mwifiex_private *priv,
                         config_len += sizeof(struct mwifiex_ie_types_aid);
                 }
 
+                timeout = (void *)(pos + config_len);
+                timeout->header.type = cpu_to_le16(TLV_TYPE_TDLS_IDLE_TIMEOUT);
+                timeout->header.len = cpu_to_le16(sizeof(timeout->value));
+                timeout->value = cpu_to_le16(MWIFIEX_TDLS_IDLE_TIMEOUT);
+                config_len += sizeof(struct mwifiex_ie_types_tdls_idle_timeout);
+
                 break;
         default:
                 dev_err(priv->adapter->dev, "Unknown TDLS operation\n");
diff --git a/drivers/net/wireless/mwifiex/sta_event.c b/drivers/net/wireless/mwifiex/sta_event.c
index 368450cc56c7..5aea719219a3 100644
--- a/drivers/net/wireless/mwifiex/sta_event.c
+++ b/drivers/net/wireless/mwifiex/sta_event.c
@@ -134,6 +134,42 @@ mwifiex_reset_connect_state(struct mwifiex_private *priv, u16 reason_code)
                 netif_carrier_off(priv->netdev);
 }
 
+static int mwifiex_parse_tdls_event(struct mwifiex_private *priv,
+                                    struct sk_buff *event_skb)
+{
+        struct mwifiex_adapter *adapter = priv->adapter;
+        struct mwifiex_sta_node *sta_ptr;
+        struct mwifiex_tdls_generic_event *tdls_evt =
+                        (void *)event_skb->data + sizeof(adapter->event_cause);
+
+        /* reserved 2 bytes are not mandatory in tdls event */
+        if (event_skb->len < (sizeof(struct mwifiex_tdls_generic_event) -
+                              sizeof(u16) - sizeof(adapter->event_cause))) {
+                dev_err(adapter->dev, "Invalid event length!\n");
+                return -1;
+        }
+
+        sta_ptr = mwifiex_get_sta_entry(priv, tdls_evt->peer_mac);
+        if (!sta_ptr) {
+                dev_err(adapter->dev, "cannot get sta entry!\n");
+                return -1;
+        }
+
+        switch (le16_to_cpu(tdls_evt->type)) {
+        case TDLS_EVENT_LINK_TEAR_DOWN:
+                cfg80211_tdls_oper_request(priv->netdev,
+                                           tdls_evt->peer_mac,
+                                           NL80211_TDLS_TEARDOWN,
+                                           le16_to_cpu(tdls_evt->u.reason_code),
+                                           GFP_KERNEL);
+                break;
+        default:
+                break;
+        }
+
+        return 0;
+}
+
 /*
  * This function handles events generated by firmware.
  *
@@ -459,6 +495,10 @@ int mwifiex_process_sta_event(struct mwifiex_private *priv)
                         false);
                 break;
 
+        case EVENT_TDLS_GENERIC_EVENT:
+                ret = mwifiex_parse_tdls_event(priv, adapter->event_skb);
+                break;
+
         default:
                 dev_dbg(adapter->dev, "event: unknown event id: %#x\n",
                         eventcause);
diff --git a/drivers/net/wireless/mwifiex/tdls.c b/drivers/net/wireless/mwifiex/tdls.c
index 97662a1ba58c..6bef47c2a70d 100644
--- a/drivers/net/wireless/mwifiex/tdls.c
+++ b/drivers/net/wireless/mwifiex/tdls.c
@@ -185,6 +185,48 @@ static int mwifiex_tdls_add_vht_capab(struct mwifiex_private *priv,
         return 0;
 }
 
+static int
+mwifiex_tdls_add_ht_oper(struct mwifiex_private *priv, u8 *mac,
+                         u8 vht_enabled, struct sk_buff *skb)
+{
+        struct ieee80211_ht_operation *ht_oper;
+        struct mwifiex_sta_node *sta_ptr;
+        struct mwifiex_bssdescriptor *bss_desc =
+                                        &priv->curr_bss_params.bss_descriptor;
+        u8 *pos;
+
+        sta_ptr = mwifiex_get_sta_entry(priv, mac);
+        if (unlikely(!sta_ptr)) {
+                dev_warn(priv->adapter->dev,
+                         "TDLS peer station not found in list\n");
+                return -1;
+        }
+
+        pos = (void *)skb_put(skb, sizeof(struct ieee80211_ht_operation) + 2);
+        *pos++ = WLAN_EID_HT_OPERATION;
+        *pos++ = sizeof(struct ieee80211_ht_operation);
+        ht_oper = (void *)pos;
+
+        ht_oper->primary_chan = bss_desc->channel;
+
+        /* follow AP's channel bandwidth */
+        if (ISSUPP_CHANWIDTH40(priv->adapter->hw_dot_11n_dev_cap) &&
+            bss_desc->bcn_ht_cap &&
+            ISALLOWED_CHANWIDTH40(bss_desc->bcn_ht_oper->ht_param))
+                ht_oper->ht_param = bss_desc->bcn_ht_oper->ht_param;
+
+        if (vht_enabled) {
+                ht_oper->ht_param =
+                          mwifiex_get_sec_chan_offset(bss_desc->channel);
+                ht_oper->ht_param |= BIT(2);
+        }
+
+        memcpy(&sta_ptr->tdls_cap.ht_oper, ht_oper,
+               sizeof(struct ieee80211_ht_operation));
+
+        return 0;
+}
+
 static int mwifiex_tdls_add_vht_oper(struct mwifiex_private *priv,
                                      u8 *mac, struct sk_buff *skb)
 {
@@ -428,6 +470,17 @@ static int mwifiex_prep_tdls_encap_data(struct mwifiex_private *priv,
                                 dev_kfree_skb_any(skb);
                                 return ret;
                         }
+                        ret = mwifiex_tdls_add_ht_oper(priv, peer, 1, skb);
+                        if (ret) {
+                                dev_kfree_skb_any(skb);
+                                return ret;
+                        }
+                } else {
+                        ret = mwifiex_tdls_add_ht_oper(priv, peer, 0, skb);
+                        if (ret) {
+                                dev_kfree_skb_any(skb);
+                                return ret;
+                        }
                 }
                 break;
 
diff --git a/drivers/net/wireless/orinoco/orinoco_usb.c b/drivers/net/wireless/orinoco/orinoco_usb.c
index f9805c9353d2..1cbb7835806f 100644
--- a/drivers/net/wireless/orinoco/orinoco_usb.c
+++ b/drivers/net/wireless/orinoco/orinoco_usb.c
@@ -1687,7 +1687,7 @@ static int ezusb_probe(struct usb_interface *interface,
                 firmware.code = fw_entry->data;
         }
         if (firmware.size && firmware.code) {
-                if (ezusb_firmware_download(upriv, &firmware))
+                if (ezusb_firmware_download(upriv, &firmware) < 0)
                         goto error;
         } else {
                 err("No firmware to download");
diff --git a/drivers/net/wireless/p54/main.c b/drivers/net/wireless/p54/main.c
index eede90b63f84..7be3a4839640 100644
--- a/drivers/net/wireless/p54/main.c
+++ b/drivers/net/wireless/p54/main.c
@@ -669,7 +669,8 @@ static unsigned int p54_flush_count(struct p54_common *priv)
         return total;
 }
 
-static void p54_flush(struct ieee80211_hw *dev, u32 queues, bool drop)
+static void p54_flush(struct ieee80211_hw *dev, struct ieee80211_vif *vif,
+                      u32 queues, bool drop)
 {
         struct p54_common *priv = dev->priv;
         unsigned int total, i;
diff --git a/drivers/net/wireless/rsi/rsi_91x_mac80211.c b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
index 84164747ace0..54aaeb09debf 100644
--- a/drivers/net/wireless/rsi/rsi_91x_mac80211.c
+++ b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
@@ -656,6 +656,7 @@ static int rsi_mac80211_ampdu_action(struct ieee80211_hw *hw,
         case IEEE80211_AMPDU_TX_START:
                 common->vif_info[ii].seq_start = seq_no;
                 ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid);
+                status = 0;
                 break;
 
         case IEEE80211_AMPDU_TX_STOP_CONT:
diff --git a/drivers/net/wireless/rsi/rsi_91x_mgmt.c b/drivers/net/wireless/rsi/rsi_91x_mgmt.c
index 1b28cda6ca88..2eefbf159bc0 100644
--- a/drivers/net/wireless/rsi/rsi_91x_mgmt.c
+++ b/drivers/net/wireless/rsi/rsi_91x_mgmt.c
@@ -1083,7 +1083,7 @@ void rsi_inform_bss_status(struct rsi_common *common,
 {
         if (status) {
                 rsi_hal_send_sta_notify_frame(common,
-                                              NL80211_IFTYPE_STATION,
+                                              RSI_IFTYPE_STATION,
                                               STA_CONNECTED,
                                               bssid,
                                               qos_enable,
@@ -1092,7 +1092,7 @@ void rsi_inform_bss_status(struct rsi_common *common,
                         rsi_send_auto_rate_request(common);
         } else {
                 rsi_hal_send_sta_notify_frame(common,
-                                              NL80211_IFTYPE_STATION,
+                                              RSI_IFTYPE_STATION,
                                               STA_DISCONNECTED,
                                               bssid,
                                               qos_enable,
diff --git a/drivers/net/wireless/rsi/rsi_mgmt.h b/drivers/net/wireless/rsi/rsi_mgmt.h
index ac67c4ad63c2..225215a3b8bb 100644
--- a/drivers/net/wireless/rsi/rsi_mgmt.h
+++ b/drivers/net/wireless/rsi/rsi_mgmt.h
@@ -73,6 +73,7 @@
 #define RX_BA_INDICATION                1
 #define RSI_TBL_SZ                      40
 #define MAX_RETRIES                     8
+#define RSI_IFTYPE_STATION               0
 
 #define STD_RATE_MCS7                   0x07
 #define STD_RATE_MCS6                   0x06
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index e3b885d8f7db..010b76505243 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -1448,7 +1448,8 @@ int rt2x00mac_conf_tx(struct ieee80211_hw *hw,
                       struct ieee80211_vif *vif, u16 queue,
                       const struct ieee80211_tx_queue_params *params);
 void rt2x00mac_rfkill_poll(struct ieee80211_hw *hw);
-void rt2x00mac_flush(struct ieee80211_hw *hw, u32 queues, bool drop);
+void rt2x00mac_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                     u32 queues, bool drop);
 int rt2x00mac_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant);
 int rt2x00mac_get_antenna(struct ieee80211_hw *hw, u32 *tx_ant, u32 *rx_ant);
 void rt2x00mac_get_ringparam(struct ieee80211_hw *hw,
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
index ddeb5a709aa3..212ac4842c16 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -621,20 +621,18 @@ void rt2x00mac_bss_info_changed(struct ieee80211_hw *hw,
                                       bss_conf->bssid);
 
         /*
-         * Update the beacon. This is only required on USB devices. PCI
-         * devices fetch beacons periodically.
-         */
-        if (changes & BSS_CHANGED_BEACON && rt2x00_is_usb(rt2x00dev))
-                rt2x00queue_update_beacon(rt2x00dev, vif);
-
-        /*
          * Start/stop beaconing.
          */
         if (changes & BSS_CHANGED_BEACON_ENABLED) {
                 if (!bss_conf->enable_beacon && intf->enable_beacon) {
-                        rt2x00queue_clear_beacon(rt2x00dev, vif);
                         rt2x00dev->intf_beaconing--;
                         intf->enable_beacon = false;
+                        /*
+                         * Clear beacon in the H/W for this vif. This is needed
+                         * to disable beaconing on this particular interface
+                         * and keep it running on other interfaces.
+                         */
+                        rt2x00queue_clear_beacon(rt2x00dev, vif);
 
                         if (rt2x00dev->intf_beaconing == 0) {
                                 /*
@@ -645,11 +643,15 @@ void rt2x00mac_bss_info_changed(struct ieee80211_hw *hw,
                                 rt2x00queue_stop_queue(rt2x00dev->bcn);
                                 mutex_unlock(&intf->beacon_skb_mutex);
                         }
-
-
                 } else if (bss_conf->enable_beacon && !intf->enable_beacon) {
                         rt2x00dev->intf_beaconing++;
                         intf->enable_beacon = true;
+                        /*
+                         * Upload beacon to the H/W. This is only required on
+                         * USB devices. PCI devices fetch beacons periodically.
+                         */
+                        if (rt2x00_is_usb(rt2x00dev))
+                                rt2x00queue_update_beacon(rt2x00dev, vif);
 
                         if (rt2x00dev->intf_beaconing == 1) {
                                 /*
@@ -747,7 +749,8 @@ void rt2x00mac_rfkill_poll(struct ieee80211_hw *hw)
 }
 EXPORT_SYMBOL_GPL(rt2x00mac_rfkill_poll);
 
-void rt2x00mac_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
+void rt2x00mac_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                     u32 queues, bool drop)
 {
         struct rt2x00_dev *rt2x00dev = hw->priv;
         struct data_queue *queue;
diff --git a/drivers/net/wireless/rtl818x/rtl8180/dev.c b/drivers/net/wireless/rtl818x/rtl8180/dev.c
index 50d69b13f984..2c1c02bafa10 100644
--- a/drivers/net/wireless/rtl818x/rtl8180/dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8180/dev.c
@@ -284,6 +284,8 @@ static void rtl8180_handle_rx(struct ieee80211_hw *dev)
                         rx_status.band = dev->conf.chandef.chan->band;
                         rx_status.mactime = tsft;
                         rx_status.flag |= RX_FLAG_MACTIME_START;
+                        if (flags & RTL818X_RX_DESC_FLAG_SPLCP)
+                                rx_status.flag |= RX_FLAG_SHORTPRE;
                         if (flags & RTL818X_RX_DESC_FLAG_CRC32_ERR)
                                 rx_status.flag |= RX_FLAG_FAILED_FCS_CRC;
 
@@ -461,18 +463,23 @@ static void rtl8180_tx(struct ieee80211_hw *dev,
                             RTL818X_TX_DESC_FLAG_NO_ENC;
 
         rc_flags = info->control.rates[0].flags;
+
+        /* HW will perform RTS-CTS when only RTS flags is set.
+         * HW will perform CTS-to-self when both RTS and CTS flags are set.
+         * RTS rate and RTS duration will be used also for CTS-to-self.
+         */
         if (rc_flags & IEEE80211_TX_RC_USE_RTS_CTS) {
                 tx_flags |= RTL818X_TX_DESC_FLAG_RTS;
                 tx_flags |= ieee80211_get_rts_cts_rate(dev, info)->hw_value << 19;
+                rts_duration = ieee80211_rts_duration(dev, priv->vif,
+                                                skb->len, info);
         } else if (rc_flags & IEEE80211_TX_RC_USE_CTS_PROTECT) {
-                tx_flags |= RTL818X_TX_DESC_FLAG_CTS;
+                tx_flags |= RTL818X_TX_DESC_FLAG_RTS | RTL818X_TX_DESC_FLAG_CTS;
                 tx_flags |= ieee80211_get_rts_cts_rate(dev, info)->hw_value << 19;
+                rts_duration = ieee80211_ctstoself_duration(dev, priv->vif,
+                                                skb->len, info);
         }
 
-        if (rc_flags & IEEE80211_TX_RC_USE_RTS_CTS)
-                rts_duration = ieee80211_rts_duration(dev, priv->vif, skb->len,
-                                                      info);
-
         if (priv->chip_family == RTL818X_CHIP_FAMILY_RTL8180) {
                 unsigned int remainder;
 
diff --git a/drivers/net/wireless/rtl818x/rtl8187/dev.c b/drivers/net/wireless/rtl818x/rtl8187/dev.c
index 0ca17cda48fa..629ad8cfa17b 100644
--- a/drivers/net/wireless/rtl818x/rtl8187/dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8187/dev.c
@@ -253,14 +253,21 @@ static void rtl8187_tx(struct ieee80211_hw *dev,
         flags |= ieee80211_get_tx_rate(dev, info)->hw_value << 24;
         if (ieee80211_has_morefrags(tx_hdr->frame_control))
                 flags |= RTL818X_TX_DESC_FLAG_MOREFRAG;
+
+        /* HW will perform RTS-CTS when only RTS flags is set.
+         * HW will perform CTS-to-self when both RTS and CTS flags are set.
+         * RTS rate and RTS duration will be used also for CTS-to-self.
+         */
         if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS) {
                 flags |= RTL818X_TX_DESC_FLAG_RTS;
                 flags |= ieee80211_get_rts_cts_rate(dev, info)->hw_value << 19;
                 rts_dur = ieee80211_rts_duration(dev, priv->vif,
                                                  skb->len, info);
         } else if (info->control.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT) {
-                flags |= RTL818X_TX_DESC_FLAG_CTS;
+                flags |= RTL818X_TX_DESC_FLAG_RTS | RTL818X_TX_DESC_FLAG_CTS;
                 flags |= ieee80211_get_rts_cts_rate(dev, info)->hw_value << 19;
+                rts_dur = ieee80211_ctstoself_duration(dev, priv->vif,
+                                                 skb->len, info);
         }
 
         if (info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ) {
@@ -381,6 +388,8 @@ static void rtl8187_rx_cb(struct urb *urb)
         rx_status.freq = dev->conf.chandef.chan->center_freq;
         rx_status.band = dev->conf.chandef.chan->band;
         rx_status.flag |= RX_FLAG_MACTIME_START;
+        if (flags & RTL818X_RX_DESC_FLAG_SPLCP)
+                rx_status.flag |= RX_FLAG_SHORTPRE;
         if (flags & RTL818X_RX_DESC_FLAG_CRC32_ERR)
                 rx_status.flag |= RX_FLAG_FAILED_FCS_CRC;
         memcpy(IEEE80211_SKB_RXCB(skb), &rx_status, sizeof(rx_status));
diff --git a/drivers/net/wireless/rtlwifi/core.c b/drivers/net/wireless/rtlwifi/core.c
index 4ec424f26672..b1ed6d0796f6 100644
--- a/drivers/net/wireless/rtlwifi/core.c
+++ b/drivers/net/wireless/rtlwifi/core.c
@@ -1387,7 +1387,8 @@ static void rtl_op_rfkill_poll(struct ieee80211_hw *hw)
  * before switch channel or power save, or tx buffer packet
  * maybe send after offchannel or rf sleep, this may cause
  * dis-association by AP */
-static void rtl_op_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
+static void rtl_op_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                         u32 queues, bool drop)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
 
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/sw.c b/drivers/net/wireless/rtlwifi/rtl8188ee/sw.c
index 1b4101bf9974..79792d477b43 100644
--- a/drivers/net/wireless/rtlwifi/rtl8188ee/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/sw.c
@@ -93,7 +93,7 @@ int rtl88e_init_sw_vars(struct ieee80211_hw *hw)
         u8 tid;
 
         rtl8188ee_bt_reg_init(hw);
-        rtlpci->msi_support = true;
+        rtlpci->msi_support = rtlpriv->cfg->mod_params->msi_support;
 
         rtlpriv->dm.dm_initialgain_enable = 1;
         rtlpriv->dm.dm_flag = 0;
@@ -267,6 +267,7 @@ static struct rtl_mod_params rtl88ee_mod_params = {
         .inactiveps = true,
         .swctrl_lps = false,
         .fwctrl_lps = true,
+        .msi_support = false,
         .debug = DBG_EMERG,
 };
 
@@ -383,10 +384,12 @@ module_param_named(debug, rtl88ee_mod_params.debug, int, 0444);
 module_param_named(ips, rtl88ee_mod_params.inactiveps, bool, 0444);
 module_param_named(swlps, rtl88ee_mod_params.swctrl_lps, bool, 0444);
 module_param_named(fwlps, rtl88ee_mod_params.fwctrl_lps, bool, 0444);
+module_param_named(msi, rtl88ee_mod_params.msi_support, bool, 0444);
 MODULE_PARM_DESC(swenc, "Set to 1 for software crypto (default 0)\n");
 MODULE_PARM_DESC(ips, "Set to 0 to not use link power save (default 1)\n");
 MODULE_PARM_DESC(swlps, "Set to 1 to use SW control power save (default 0)\n");
 MODULE_PARM_DESC(fwlps, "Set to 1 to use FW control power save (default 1)\n");
+MODULE_PARM_DESC(msi, "Set to 1 to use MSI interrupts mode (default 0)\n");
 MODULE_PARM_DESC(debug, "Set debug level (0-5) (default 0)");
 
 static SIMPLE_DEV_PM_OPS(rtlwifi_pm_ops, rtl_pci_suspend, rtl_pci_resume);
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c b/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c
index 06ef47cd6203..5b4c225396f2 100644
--- a/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/trx.c
@@ -293,7 +293,7 @@ static void _rtl88ee_translate_rx_signal_stuff(struct ieee80211_hw *hw,
         u8 *psaddr;
         __le16 fc;
         u16 type, ufc;
-        bool match_bssid, packet_toself, packet_beacon, addr;
+        bool match_bssid, packet_toself, packet_beacon = false, addr;
 
         tmp_buf = skb->data + pstatus->rx_drvinfo_size + pstatus->rx_bufshift;
 
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
index 68b5c7e92cfb..a903c2671b4d 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
@@ -511,7 +511,7 @@ static int _rtl92cu_init_power_on(struct ieee80211_hw *hw)
                         pr_info("MAC auto ON okay!\n");
                         break;
                 }
-                if (pollingCount++ > 100) {
+                if (pollingCount++ > 1000) {
                         RT_TRACE(rtlpriv, COMP_INIT, DBG_EMERG,
                                  "Failed to polling REG_APS_FSMCO[APFM_ONMAC] done!\n");
                         return -ENODEV;
@@ -1001,7 +1001,7 @@ int rtl92cu_hw_init(struct ieee80211_hw *hw)
         err = _rtl92cu_init_mac(hw);
         if (err) {
                 RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, "init mac failed!\n");
-                return err;
+                goto exit;
         }
         err = rtl92c_download_fw(hw);
         if (err) {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
index 36b48be8329c..2b3c78baa9f8 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
@@ -49,6 +49,12 @@ static u8 _rtl92se_map_hwqueue_to_fwqueue(struct sk_buff *skb,	u8 skb_queue)
         if (ieee80211_is_nullfunc(fc))
                 return QSLT_HIGH;
 
+        /* Kernel commit 1bf4bbb4024dcdab changed EAPOL packets to use
+         * queue V0 at priority 7; however, the RTL8192SE appears to have
+         * that queue at priority 6
+         */
+        if (skb->priority == 7)
+                return QSLT_VO;
         return skb->priority;
 }
 
diff --git a/drivers/net/wireless/rtlwifi/rtl8723be/sw.c b/drivers/net/wireless/rtlwifi/rtl8723be/sw.c
index b4577ebc4bb0..ff12bf41644b 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723be/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723be/sw.c
@@ -92,7 +92,7 @@ int rtl8723be_init_sw_vars(struct ieee80211_hw *hw)
         struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
 
         rtl8723be_bt_reg_init(hw);
-        rtlpci->msi_support = true;
+        rtlpci->msi_support = rtlpriv->cfg->mod_params->msi_support;
         rtlpriv->btcoexist.btc_ops = rtl_btc_get_ops_pointer();
 
         rtlpriv->dm.dm_initialgain_enable = 1;
@@ -253,6 +253,7 @@ static struct rtl_mod_params rtl8723be_mod_params = {
         .inactiveps = true,
         .swctrl_lps = false,
         .fwctrl_lps = true,
+        .msi_support = false,
         .debug = DBG_EMERG,
 };
 
@@ -365,9 +366,11 @@ module_param_named(debug, rtl8723be_mod_params.debug, int, 0444);
 module_param_named(ips, rtl8723be_mod_params.inactiveps, bool, 0444);
 module_param_named(swlps, rtl8723be_mod_params.swctrl_lps, bool, 0444);
 module_param_named(fwlps, rtl8723be_mod_params.fwctrl_lps, bool, 0444);
+module_param_named(msi, rtl8723be_mod_params.msi_support, bool, 0444);
 MODULE_PARM_DESC(swenc, "using hardware crypto (default 0 [hardware])\n");
 MODULE_PARM_DESC(ips, "using no link power save (default 1 is open)\n");
 MODULE_PARM_DESC(fwlps, "using linked fw control power save (default 1 is open)\n");
+MODULE_PARM_DESC(msi, "Set to 1 to use MSI interrupts mode (default 0)\n");
 MODULE_PARM_DESC(debug, "Set debug level (0-5) (default 0)");
 
 static SIMPLE_DEV_PM_OPS(rtlwifi_pm_ops, rtl_pci_suspend, rtl_pci_resume);
diff --git a/drivers/net/wireless/rtlwifi/wifi.h b/drivers/net/wireless/rtlwifi/wifi.h
index 6965afdf572a..eef93d1ccc56 100644
--- a/drivers/net/wireless/rtlwifi/wifi.h
+++ b/drivers/net/wireless/rtlwifi/wifi.h
@@ -2030,6 +2030,10 @@ struct rtl_mod_params {
 
         /* default: 1 = using linked fw power save */
         bool fwctrl_lps;
+
+        /* default: 0 = not using MSI interrupts mode */
+        /* submodules should set their own defalut value */
+        bool msi_support;
 };
 
 struct rtl_hal_usbint_cfg {
diff --git a/drivers/net/wireless/ti/wl1251/event.c b/drivers/net/wireless/ti/wl1251/event.c
index db0105313745..c98630394a1a 100644
--- a/drivers/net/wireless/ti/wl1251/event.c
+++ b/drivers/net/wireless/ti/wl1251/event.c
@@ -124,11 +124,12 @@ static int wl1251_event_process(struct wl1251 *wl, struct event_mailbox *mbox)
                         return ret;
         }
 
-        if (wl->vif && vector & SYNCHRONIZATION_TIMEOUT_EVENT_ID) {
+        if (vector & SYNCHRONIZATION_TIMEOUT_EVENT_ID) {
                 wl1251_debug(DEBUG_EVENT, "SYNCHRONIZATION_TIMEOUT_EVENT");
 
                 /* indicate to the stack, that beacons have been lost */
-                ieee80211_beacon_loss(wl->vif);
+                if (wl->vif && wl->vif->type == NL80211_IFTYPE_STATION)
+                        ieee80211_beacon_loss(wl->vif);
         }
 
         if (vector & REGAINED_BSS_EVENT_ID) {
diff --git a/drivers/net/wireless/ti/wl1251/main.c b/drivers/net/wireless/ti/wl1251/main.c
index 757e25784a8a..4e782f18ae34 100644
--- a/drivers/net/wireless/ti/wl1251/main.c
+++ b/drivers/net/wireless/ti/wl1251/main.c
@@ -550,6 +550,34 @@ static void wl1251_op_remove_interface(struct ieee80211_hw *hw,
         mutex_unlock(&wl->mutex);
 }
 
+static int wl1251_build_null_data(struct wl1251 *wl)
+{
+        struct sk_buff *skb = NULL;
+        int size;
+        void *ptr;
+        int ret = -ENOMEM;
+
+        if (wl->bss_type == BSS_TYPE_IBSS) {
+                size = sizeof(struct wl12xx_null_data_template);
+                ptr = NULL;
+        } else {
+                skb = ieee80211_nullfunc_get(wl->hw, wl->vif);
+                if (!skb)
+                        goto out;
+                size = skb->len;
+                ptr = skb->data;
+        }
+
+        ret = wl1251_cmd_template_set(wl, CMD_NULL_DATA, ptr, size);
+
+out:
+        dev_kfree_skb(skb);
+        if (ret)
+                wl1251_warning("cmd buld null data failed: %d", ret);
+
+        return ret;
+}
+
 static int wl1251_build_qos_null_data(struct wl1251 *wl)
 {
         struct ieee80211_qos_hdr template;
@@ -687,16 +715,6 @@ static int wl1251_op_config(struct ieee80211_hw *hw, u32 changed)
                 wl->power_level = conf->power_level;
         }
 
-        /*
-         * Tell stack that connection is lost because hw encryption isn't
-         * supported in monitor mode.
-         * This requires temporary enabling of the hw connection monitor flag
-         */
-        if ((changed & IEEE80211_CONF_CHANGE_MONITOR) && wl->vif) {
-                wl->hw->flags |= IEEE80211_HW_CONNECTION_MONITOR;
-                ieee80211_connection_loss(wl->vif);
-        }
-
 out_sleep:
         wl1251_ps_elp_sleep(wl);
 
@@ -1103,24 +1121,19 @@ static void wl1251_op_bss_info_changed(struct ieee80211_hw *hw,
                 wl->rssi_thold = bss_conf->cqm_rssi_thold;
         }
 
-        if (changed & BSS_CHANGED_BSSID) {
+        if ((changed & BSS_CHANGED_BSSID) &&
+            memcmp(wl->bssid, bss_conf->bssid, ETH_ALEN)) {
                 memcpy(wl->bssid, bss_conf->bssid, ETH_ALEN);
 
-                skb = ieee80211_nullfunc_get(wl->hw, wl->vif);
-                if (!skb)
-                        goto out_sleep;
-
-                ret = wl1251_cmd_template_set(wl, CMD_NULL_DATA,
-                                              skb->data, skb->len);
-                dev_kfree_skb(skb);
-                if (ret < 0)
-                        goto out_sleep;
+                if (!is_zero_ether_addr(wl->bssid)) {
+                        ret = wl1251_build_null_data(wl);
+                        if (ret < 0)
+                                goto out_sleep;
 
-                ret = wl1251_build_qos_null_data(wl);
-                if (ret < 0)
-                        goto out;
+                        ret = wl1251_build_qos_null_data(wl);
+                        if (ret < 0)
+                                goto out_sleep;
 
-                if (wl->bss_type != BSS_TYPE_IBSS) {
                         ret = wl1251_join(wl, wl->bss_type, wl->channel,
                                           wl->beacon_int, wl->dtim_period);
                         if (ret < 0)
@@ -1129,9 +1142,6 @@ static void wl1251_op_bss_info_changed(struct ieee80211_hw *hw,
         }
 
         if (changed & BSS_CHANGED_ASSOC) {
-                /* Disable temporary enabled hw connection monitor flag */
-                wl->hw->flags &= ~IEEE80211_HW_CONNECTION_MONITOR;
-
                 if (bss_conf->assoc) {
                         wl->beacon_int = bss_conf->beacon_int;
 
@@ -1216,8 +1226,8 @@ static void wl1251_op_bss_info_changed(struct ieee80211_hw *hw,
                 if (ret < 0)
                         goto out_sleep;
 
-                ret = wl1251_join(wl, wl->bss_type, wl->beacon_int,
-                                  wl->channel, wl->dtim_period);
+                ret = wl1251_join(wl, wl->bss_type, wl->channel,
+                                  wl->beacon_int, wl->dtim_period);
 
                 if (ret < 0)
                         goto out_sleep;
diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
index ed88d3913483..077eb5b9cd74 100644
--- a/drivers/net/wireless/ti/wlcore/main.c
+++ b/drivers/net/wireless/ti/wlcore/main.c
@@ -5184,7 +5184,8 @@ out:
         mutex_unlock(&wl->mutex);
 }
 
-static void wlcore_op_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
+static void wlcore_op_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                            u32 queues, bool drop)
 {
         struct wl1271 *wl = hw->priv;
 
diff --git a/drivers/net/wireless/ti/wlcore/sdio.c b/drivers/net/wireless/ti/wlcore/sdio.c
index 29ef2492951f..d3dd7bfdf3f1 100644
--- a/drivers/net/wireless/ti/wlcore/sdio.c
+++ b/drivers/net/wireless/ti/wlcore/sdio.c
@@ -217,7 +217,7 @@ static struct wl1271_if_operations sdio_ops = {
 static int wl1271_probe(struct sdio_func *func,
                                   const struct sdio_device_id *id)
 {
-        struct wlcore_platdev_data *pdev_data;
+        struct wlcore_platdev_data pdev_data;
         struct wl12xx_sdio_glue *glue;
         struct resource res[1];
         mmc_pm_flag_t mmcflags;
@@ -228,16 +228,13 @@ static int wl1271_probe(struct sdio_func *func,
         if (func->num != 0x02)
                 return -ENODEV;
 
-        pdev_data = kzalloc(sizeof(*pdev_data), GFP_KERNEL);
-        if (!pdev_data)
-                goto out;
-
-        pdev_data->if_ops = &sdio_ops;
+        memset(&pdev_data, 0x00, sizeof(pdev_data));
+        pdev_data.if_ops = &sdio_ops;
 
         glue = kzalloc(sizeof(*glue), GFP_KERNEL);
         if (!glue) {
                 dev_err(&func->dev, "can't allocate glue\n");
-                goto out_free_pdev_data;
+                goto out;
         }
 
         glue->dev = &func->dev;
@@ -248,9 +245,9 @@ static int wl1271_probe(struct sdio_func *func,
         /* Use block mode for transferring over one block size of data */
         func->card->quirks |= MMC_QUIRK_BLKSZ_FOR_BYTE_MODE;
 
-        pdev_data->pdata = wl12xx_get_platform_data();
-        if (IS_ERR(pdev_data->pdata)) {
-                ret = PTR_ERR(pdev_data->pdata);
+        pdev_data.pdata = wl12xx_get_platform_data();
+        if (IS_ERR(pdev_data.pdata)) {
+                ret = PTR_ERR(pdev_data.pdata);
                 dev_err(glue->dev, "missing wlan platform data: %d\n", ret);
                 goto out_free_glue;
         }
@@ -260,7 +257,7 @@ static int wl1271_probe(struct sdio_func *func,
         dev_dbg(glue->dev, "sdio PM caps = 0x%x\n", mmcflags);
 
         if (mmcflags & MMC_PM_KEEP_POWER)
-                pdev_data->pdata->pwr_in_suspend = true;
+                pdev_data.pdata->pwr_in_suspend = true;
 
         sdio_set_drvdata(func, glue);
 
@@ -289,7 +286,7 @@ static int wl1271_probe(struct sdio_func *func,
 
         memset(res, 0x00, sizeof(res));
 
-        res[0].start = pdev_data->pdata->irq;
+        res[0].start = pdev_data.pdata->irq;
         res[0].flags = IORESOURCE_IRQ;
         res[0].name = "irq";
 
@@ -299,8 +296,8 @@ static int wl1271_probe(struct sdio_func *func,
                 goto out_dev_put;
         }
 
-        ret = platform_device_add_data(glue->core, pdev_data,
-                                       sizeof(*pdev_data));
+        ret = platform_device_add_data(glue->core, &pdev_data,
+                                       sizeof(pdev_data));
         if (ret) {
                 dev_err(glue->dev, "can't add platform data\n");
                 goto out_dev_put;
@@ -319,9 +316,6 @@ out_dev_put:
 out_free_glue:
         kfree(glue);
 
-out_free_pdev_data:
-        kfree(pdev_data);
-
 out:
         return ret;
 }
diff --git a/drivers/net/wireless/ti/wlcore/spi.c b/drivers/net/wireless/ti/wlcore/spi.c
index dbe826dd7c23..5f3a389dd74c 100644
--- a/drivers/net/wireless/ti/wlcore/spi.c
+++ b/drivers/net/wireless/ti/wlcore/spi.c
@@ -327,27 +327,25 @@ static struct wl1271_if_operations spi_ops = {
 static int wl1271_probe(struct spi_device *spi)
 {
         struct wl12xx_spi_glue *glue;
-        struct wlcore_platdev_data *pdev_data;
+        struct wlcore_platdev_data pdev_data;
         struct resource res[1];
         int ret = -ENOMEM;
 
-        pdev_data = kzalloc(sizeof(*pdev_data), GFP_KERNEL);
-        if (!pdev_data)
-                goto out;
+        memset(&pdev_data, 0x00, sizeof(pdev_data));
 
-        pdev_data->pdata = dev_get_platdata(&spi->dev);
-        if (!pdev_data->pdata) {
+        pdev_data.pdata = dev_get_platdata(&spi->dev);
+        if (!pdev_data.pdata) {
                 dev_err(&spi->dev, "no platform data\n");
                 ret = -ENODEV;
-                goto out_free_pdev_data;
+                goto out;
         }
 
-        pdev_data->if_ops = &spi_ops;
+        pdev_data.if_ops = &spi_ops;
 
         glue = kzalloc(sizeof(*glue), GFP_KERNEL);
         if (!glue) {
                 dev_err(&spi->dev, "can't allocate glue\n");
-                goto out_free_pdev_data;
+                goto out;
         }
 
         glue->dev = &spi->dev;
@@ -385,8 +383,8 @@ static int wl1271_probe(struct spi_device *spi)
                 goto out_dev_put;
         }
 
-        ret = platform_device_add_data(glue->core, pdev_data,
-                                       sizeof(*pdev_data));
+        ret = platform_device_add_data(glue->core, &pdev_data,
+                                       sizeof(pdev_data));
         if (ret) {
                 dev_err(glue->dev, "can't add platform data\n");
                 goto out_dev_put;
@@ -406,9 +404,6 @@ out_dev_put:
 out_free_glue:
         kfree(glue);
 
-out_free_pdev_data:
-        kfree(pdev_data);
-
 out:
         return ret;
 }
diff --git a/drivers/staging/rtl8821ae/core.c b/drivers/staging/rtl8821ae/core.c
index ff3139b6da65..63ae2d1997d3 100644
--- a/drivers/staging/rtl8821ae/core.c
+++ b/drivers/staging/rtl8821ae/core.c
@@ -1414,23 +1414,15 @@ static void rtl_op_rfkill_poll(struct ieee80211_hw *hw)
  * before switch channel or power save, or tx buffer packet
  * maybe send after offchannel or rf sleep, this may cause
  * dis-association by AP */
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,10,0))
-static void rtl_op_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
+static void rtl_op_flush(struct ieee80211_hw *hw,
+                         struct ieee80211_vif *vif,
+                         u32 queues, bool drop)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
 
         if (rtlpriv->intf_ops->flush)
                 rtlpriv->intf_ops->flush(hw, queues, drop);
 }
-#else
-static void rtl_op_flush(struct ieee80211_hw *hw, bool drop)
-{
-        struct rtl_priv *rtlpriv = rtl_priv(hw);
-
-        if (rtlpriv->intf_ops->flush)
-                rtlpriv->intf_ops->flush(hw, drop);
-}
-#endif
 
 const struct ieee80211_ops rtl_ops = {
         .start = rtl_op_start,
diff --git a/include/linux/ath9k_platform.h b/include/linux/ath9k_platform.h
index 8598f8eacb20..a495a959e8a7 100644
--- a/include/linux/ath9k_platform.h
+++ b/include/linux/ath9k_platform.h
@@ -36,6 +36,8 @@ struct ath9k_platform_data {
 
         int (*get_mac_revision)(void);
         int (*external_reset)(void);
+
+        bool use_eeprom;
 };
 
 #endif /* _LINUX_ATH9K_PLATFORM_H */
diff --git a/include/linux/rfkill-gpio.h b/include/linux/rfkill-gpio.h
index 4d09f6eab359..20bcb55498cd 100644
--- a/include/linux/rfkill-gpio.h
+++ b/include/linux/rfkill-gpio.h
@@ -27,21 +27,11 @@
  * struct rfkill_gpio_platform_data - platform data for rfkill gpio device.
  * for unused gpio's, the expected value is -1.
  * @name:               name for the gpio rf kill instance
- * @reset_gpio:         GPIO which is used for reseting rfkill switch
- * @shutdown_gpio:      GPIO which is used for shutdown of rfkill switch
- * @power_clk_name:     [optional] name of clk to turn off while blocked
- * @gpio_runtime_close: clean up platform specific gpio configuration
- * @gpio_runtime_setup: set up platform specific gpio configuration
  */
 
 struct rfkill_gpio_platform_data {
         char                    *name;
-        int                     reset_gpio;
-        int                     shutdown_gpio;
-        const char              *power_clk_name;
         enum rfkill_type        type;
-        void    (*gpio_runtime_close)(struct platform_device *);
-        int     (*gpio_runtime_setup)(struct platform_device *);
 };
 
 #endif /* __RFKILL_GPIO_H */
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index be150cf8cd43..4261a67682c0 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -367,6 +367,7 @@ enum {
 #define HCI_ERROR_REMOTE_POWER_OFF      0x15
 #define HCI_ERROR_LOCAL_HOST_TERM       0x16
 #define HCI_ERROR_PAIRING_NOT_ALLOWED   0x18
+#define HCI_ERROR_ADVERTISING_TIMEOUT   0x3c
 
 /* Flow control modes */
 #define HCI_FLOW_CTL_MODE_PACKET_BASED  0x00
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 5f8bc05694ac..d73f41855ada 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -68,6 +68,11 @@ struct discovery_state {
         struct list_head        unknown;        /* Name state not known */
         struct list_head        resolve;        /* Name needs to be resolved */
         __u32                   timestamp;
+        bdaddr_t                last_adv_addr;
+        u8                      last_adv_addr_type;
+        s8                      last_adv_rssi;
+        u8                      last_adv_data[HCI_MAX_AD_LENGTH];
+        u8                      last_adv_data_len;
 };
 
 struct hci_conn_hash {
@@ -194,6 +199,7 @@ struct hci_dev {
         __u16           le_scan_window;
         __u16           le_conn_min_interval;
         __u16           le_conn_max_interval;
+        __u16           discov_interleaved_timeout;
         __u8            ssp_debug_mode;
 
         __u16           devid_source;
@@ -1204,8 +1210,8 @@ void hci_sock_dev_event(struct hci_dev *hdev, int event);
  */
 #define DISCOV_LE_SCAN_WIN              0x12
 #define DISCOV_LE_SCAN_INT              0x12
-#define DISCOV_LE_TIMEOUT               msecs_to_jiffies(10240)
-#define DISCOV_INTERLEAVED_TIMEOUT      msecs_to_jiffies(5120)
+#define DISCOV_LE_TIMEOUT               10240   /* msec */
+#define DISCOV_INTERLEAVED_TIMEOUT      5120    /* msec */
 #define DISCOV_INTERLEAVED_INQUIRY_LEN  0x04
 #define DISCOV_BREDR_INQUIRY_LEN        0x08
 
@@ -1265,7 +1271,8 @@ void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
                                        u8 *randomizer256, u8 status);
 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
                        u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name,
-                       u8 ssp, u8 *eir, u16 eir_len);
+                       u8 ssp, u8 *eir, u16 eir_len, u8 *scan_rsp,
+                       u8 scan_rsp_len);
 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
                       u8 addr_type, s8 rssi, u8 *name, u8 name_len);
 void mgmt_discovering(struct hci_dev *hdev, u8 discovering);
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index f3539a15c411..f2c318655519 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -109,6 +109,13 @@ enum ieee80211_band {
  *      channel as the control or any of the secondary channels.
  *      This may be due to the driver or due to regulatory bandwidth
  *      restrictions.
+ * @IEEE80211_CHAN_INDOOR_ONLY: see %NL80211_FREQUENCY_ATTR_INDOOR_ONLY
+ * @IEEE80211_CHAN_GO_CONCURRENT: see %NL80211_FREQUENCY_ATTR_GO_CONCURRENT
+ * @IEEE80211_CHAN_NO_20MHZ: 20 MHz bandwidth is not permitted
+ *      on this channel.
+ * @IEEE80211_CHAN_NO_10MHZ: 10 MHz bandwidth is not permitted
+ *      on this channel.
+ *
  */
 enum ieee80211_channel_flags {
         IEEE80211_CHAN_DISABLED         = 1<<0,
@@ -120,6 +127,10 @@ enum ieee80211_channel_flags {
         IEEE80211_CHAN_NO_OFDM          = 1<<6,
         IEEE80211_CHAN_NO_80MHZ         = 1<<7,
         IEEE80211_CHAN_NO_160MHZ        = 1<<8,
+        IEEE80211_CHAN_INDOOR_ONLY      = 1<<9,
+        IEEE80211_CHAN_GO_CONCURRENT    = 1<<10,
+        IEEE80211_CHAN_NO_20MHZ         = 1<<11,
+        IEEE80211_CHAN_NO_10MHZ         = 1<<12,
 };
 
 #define IEEE80211_CHAN_NO_HT40 \
@@ -441,10 +452,13 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy,
  * cfg80211_chandef_dfs_required - checks if radar detection is required
  * @wiphy: the wiphy to validate against
  * @chandef: the channel definition to check
- * Return: 1 if radar detection is required, 0 if it is not, < 0 on error
+ * @iftype: the interface type as specified in &enum nl80211_iftype
+ * Returns:
+ *      1 if radar detection is required, 0 if it is not, < 0 on error
  */
 int cfg80211_chandef_dfs_required(struct wiphy *wiphy,
-                                  const struct cfg80211_chan_def *chandef);
+                                  const struct cfg80211_chan_def *chandef,
+                                  enum nl80211_iftype);
 
 /**
  * ieee80211_chandef_rate_flags - returns rate flags for a channel
@@ -654,7 +668,6 @@ struct cfg80211_acl_data {
  * @p2p_opp_ps: P2P opportunistic PS
  * @acl: ACL configuration used by the drivers which has support for
  *      MAC address based access control
- * @radar_required: set if radar detection is required
  */
 struct cfg80211_ap_settings {
         struct cfg80211_chan_def chandef;
@@ -672,7 +685,6 @@ struct cfg80211_ap_settings {
         u8 p2p_ctwindow;
         bool p2p_opp_ps;
         const struct cfg80211_acl_data *acl;
-        bool radar_required;
 };
 
 /**
@@ -2278,6 +2290,10 @@ struct cfg80211_qos_map {
  * @channel_switch: initiate channel-switch procedure (with CSA)
  *
  * @set_qos_map: Set QoS mapping information to the driver
+ *
+ * @set_ap_chanwidth: Set the AP (including P2P GO) mode channel width for the
+ *      given interface This is used e.g. for dynamic HT 20/40 MHz channel width
+ *      changes during the lifetime of the BSS.
  */
 struct cfg80211_ops {
         int     (*suspend)(struct wiphy *wiphy, struct cfg80211_wowlan *wow);
@@ -2521,9 +2537,13 @@ struct cfg80211_ops {
         int     (*channel_switch)(struct wiphy *wiphy,
                                   struct net_device *dev,
                                   struct cfg80211_csa_settings *params);
+
         int     (*set_qos_map)(struct wiphy *wiphy,
                                struct net_device *dev,
                                struct cfg80211_qos_map *qos_map);
+
+        int     (*set_ap_chanwidth)(struct wiphy *wiphy, struct net_device *dev,
+                                    struct cfg80211_chan_def *chandef);
 };
 
 /*
@@ -3194,6 +3214,7 @@ struct cfg80211_cached_keys;
  * @ibss_dfs_possible: (private) IBSS may change to a DFS channel
  * @event_list: (private) list for internal event processing
  * @event_lock: (private) lock for event list
+ * @owner_nlportid: (private) owner socket port ID
  */
 struct wireless_dev {
         struct wiphy *wiphy;
@@ -3241,6 +3262,8 @@ struct wireless_dev {
         unsigned long cac_start_time;
         unsigned int cac_time_ms;
 
+        u32 owner_nlportid;
+
 #ifdef CONFIG_CFG80211_WEXT
         /* wext data */
         struct {
@@ -3600,7 +3623,7 @@ int regulatory_hint(struct wiphy *wiphy, const char *alpha2);
  * default channel settings will be disregarded. If no rule is found for a
  * channel on the regulatory domain the channel will be disabled.
  * Drivers using this for a wiphy should also set the wiphy flag
- * WIPHY_FLAG_CUSTOM_REGULATORY or cfg80211 will set it for the wiphy
+ * REGULATORY_CUSTOM_REG or cfg80211 will set it for the wiphy
  * that called this helper.
  */
 void wiphy_apply_custom_regulatory(struct wiphy *wiphy,
@@ -3669,6 +3692,18 @@ void cfg80211_sched_scan_results(struct wiphy *wiphy);
 void cfg80211_sched_scan_stopped(struct wiphy *wiphy);
 
 /**
+ * cfg80211_sched_scan_stopped_rtnl - notify that the scheduled scan has stopped
+ *
+ * @wiphy: the wiphy on which the scheduled scan stopped
+ *
+ * The driver can call this function to inform cfg80211 that the
+ * scheduled scan had to be stopped, for whatever reason.  The driver
+ * is then called back via the sched_scan_stop operation when done.
+ * This function should be called with rtnl locked.
+ */
+void cfg80211_sched_scan_stopped_rtnl(struct wiphy *wiphy);
+
+/**
  * cfg80211_inform_bss_width_frame - inform cfg80211 of a received BSS frame
  *
  * @wiphy: the wiphy reporting the BSS
@@ -4531,12 +4566,14 @@ void cfg80211_report_obss_beacon(struct wiphy *wiphy,
  * cfg80211_reg_can_beacon - check if beaconing is allowed
  * @wiphy: the wiphy
  * @chandef: the channel definition
+ * @iftype: interface type
  *
  * Return: %true if there is no secondary channel or the secondary channel(s)
  * can be used for beaconing (i.e. is not a radar channel etc.)
  */
 bool cfg80211_reg_can_beacon(struct wiphy *wiphy,
-                             struct cfg80211_chan_def *chandef);
+                             struct cfg80211_chan_def *chandef,
+                             enum nl80211_iftype iftype);
 
 /*
  * cfg80211_ch_switch_notify - update wdev channel and notify userspace
@@ -4682,6 +4719,55 @@ void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp);
  */
 unsigned int ieee80211_get_num_supported_channels(struct wiphy *wiphy);
 
+/**
+ * cfg80211_check_combinations - check interface combinations
+ *
+ * @wiphy: the wiphy
+ * @num_different_channels: the number of different channels we want
+ *      to use for verification
+ * @radar_detect: a bitmap where each bit corresponds to a channel
+ *      width where radar detection is needed, as in the definition of
+ *      &struct ieee80211_iface_combination.@radar_detect_widths
+ * @iftype_num: array with the numbers of interfaces of each interface
+ *      type.  The index is the interface type as specified in &enum
+ *      nl80211_iftype.
+ *
+ * This function can be called by the driver to check whether a
+ * combination of interfaces and their types are allowed according to
+ * the interface combinations.
+ */
+int cfg80211_check_combinations(struct wiphy *wiphy,
+                                const int num_different_channels,
+                                const u8 radar_detect,
+                                const int iftype_num[NUM_NL80211_IFTYPES]);
+
+/**
+ * cfg80211_iter_combinations - iterate over matching combinations
+ *
+ * @wiphy: the wiphy
+ * @num_different_channels: the number of different channels we want
+ *      to use for verification
+ * @radar_detect: a bitmap where each bit corresponds to a channel
+ *      width where radar detection is needed, as in the definition of
+ *      &struct ieee80211_iface_combination.@radar_detect_widths
+ * @iftype_num: array with the numbers of interfaces of each interface
+ *      type.  The index is the interface type as specified in &enum
+ *      nl80211_iftype.
+ * @iter: function to call for each matching combination
+ * @data: pointer to pass to iter function
+ *
+ * This function can be called by the driver to check what possible
+ * combinations it fits in at a given moment, e.g. for channel switching
+ * purposes.
+ */
+int cfg80211_iter_combinations(struct wiphy *wiphy,
+                               const int num_different_channels,
+                               const u8 radar_detect,
+                               const int iftype_num[NUM_NL80211_IFTYPES],
+                               void (*iter)(const struct ieee80211_iface_combination *c,
+                                            void *data),
+                               void *data);
+
 /* Logging, debugging and troubleshooting/diagnostic helpers. */
 
 /* wiphy_printk helpers, similar to dev_printk */
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 8248e3909fdf..451c1bf00df9 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -1202,14 +1202,18 @@ struct ieee80211_vif *wdev_to_ieee80211_vif(struct wireless_dev *wdev);
  *      fall back to software crypto. Note that this flag deals only with
  *      RX, if your crypto engine can't deal with TX you can also set the
  *      %IEEE80211_KEY_FLAG_SW_MGMT_TX flag to encrypt such frames in SW.
+ * @IEEE80211_KEY_FLAG_GENERATE_IV_MGMT: This flag should be set by the
+ *      driver for a CCMP key to indicate that is requires IV generation
+ *      only for managment frames (MFP).
  */
 enum ieee80211_key_flags {
-        IEEE80211_KEY_FLAG_GENERATE_IV  = 1<<1,
-        IEEE80211_KEY_FLAG_GENERATE_MMIC= 1<<2,
-        IEEE80211_KEY_FLAG_PAIRWISE     = 1<<3,
-        IEEE80211_KEY_FLAG_SW_MGMT_TX   = 1<<4,
-        IEEE80211_KEY_FLAG_PUT_IV_SPACE = 1<<5,
-        IEEE80211_KEY_FLAG_RX_MGMT      = 1<<6,
+        IEEE80211_KEY_FLAG_GENERATE_IV_MGMT     = BIT(0),
+        IEEE80211_KEY_FLAG_GENERATE_IV          = BIT(1),
+        IEEE80211_KEY_FLAG_GENERATE_MMIC        = BIT(2),
+        IEEE80211_KEY_FLAG_PAIRWISE             = BIT(3),
+        IEEE80211_KEY_FLAG_SW_MGMT_TX           = BIT(4),
+        IEEE80211_KEY_FLAG_PUT_IV_SPACE         = BIT(5),
+        IEEE80211_KEY_FLAG_RX_MGMT              = BIT(6),
 };
 
 /**
@@ -1555,6 +1559,12 @@ struct ieee80211_tx_control {
  *      for a single active channel while using channel contexts. When support
  *      is not enabled the default action is to disconnect when getting the
  *      CSA frame.
+ *
+ * @IEEE80211_HW_CHANGE_RUNNING_CHANCTX: The hardware can change a
+ *      channel context on-the-fly.  This is needed for channel switch
+ *      on single-channel hardware.  It can also be used as an
+ *      optimization in certain channel switch cases with
+ *      multi-channel.
  */
 enum ieee80211_hw_flags {
         IEEE80211_HW_HAS_RATE_CONTROL                   = 1<<0,
@@ -1586,6 +1596,7 @@ enum ieee80211_hw_flags {
         IEEE80211_HW_TIMING_BEACON_ONLY                 = 1<<26,
         IEEE80211_HW_SUPPORTS_HT_CCK_RATES              = 1<<27,
         IEEE80211_HW_CHANCTX_STA_CSA                    = 1<<28,
+        IEEE80211_HW_CHANGE_RUNNING_CHANCTX             = 1<<29,
 };
 
 /**
@@ -2609,6 +2620,7 @@ enum ieee80211_roc_type {
  *      of queues to flush, which is useful if different virtual interfaces
  *      use different hardware queues; it may also indicate all queues.
  *      If the parameter @drop is set to %true, pending frames may be dropped.
+ *      Note that vif can be NULL.
  *      The callback can sleep.
  *
  * @channel_switch: Drivers that need (or want) to offload the channel
@@ -2871,7 +2883,8 @@ struct ieee80211_ops {
                              struct netlink_callback *cb,
                              void *data, int len);
 #endif
-        void (*flush)(struct ieee80211_hw *hw, u32 queues, bool drop);
+        void (*flush)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                      u32 queues, bool drop);
         void (*channel_switch)(struct ieee80211_hw *hw,
                                struct ieee80211_channel_switch *ch_switch);
         int (*set_antenna)(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant);
@@ -4576,7 +4589,9 @@ conf_is_ht40(struct ieee80211_conf *conf)
 static inline bool
 conf_is_ht(struct ieee80211_conf *conf)
 {
-        return conf->chandef.width != NL80211_CHAN_WIDTH_20_NOHT;
+        return (conf->chandef.width != NL80211_CHAN_WIDTH_5) &&
+                (conf->chandef.width != NL80211_CHAN_WIDTH_10) &&
+                (conf->chandef.width != NL80211_CHAN_WIDTH_20_NOHT);
 }
 
 static inline enum nl80211_iftype
diff --git a/include/net/regulatory.h b/include/net/regulatory.h
index 75fc1f5a948d..259992444e80 100644
--- a/include/net/regulatory.h
+++ b/include/net/regulatory.h
@@ -131,6 +131,11 @@ struct regulatory_request {
  *      all country IE information processed by the regulatory core. This will
  *      override %REGULATORY_COUNTRY_IE_FOLLOW_POWER as all country IEs will
  *      be ignored.
+ * @REGULATORY_ENABLE_RELAX_NO_IR: for devices that wish to allow the
+ *      NO_IR relaxation, which enables transmissions on channels on which
+ *      otherwise initiating radiation is not allowed. This will enable the
+ *      relaxations enabled under the CFG80211_REG_RELAX_NO_IR configuration
+ *      option
  */
 enum ieee80211_regulatory_flags {
         REGULATORY_CUSTOM_REG                   = BIT(0),
@@ -138,6 +143,7 @@ enum ieee80211_regulatory_flags {
         REGULATORY_DISABLE_BEACON_HINTS         = BIT(2),
         REGULATORY_COUNTRY_IE_FOLLOW_POWER      = BIT(3),
         REGULATORY_COUNTRY_IE_IGNORE            = BIT(4),
+        REGULATORY_ENABLE_RELAX_NO_IR           = BIT(5),
 };
 
 struct ieee80211_freq_range {
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index 1ba9d626aa83..406010d4def0 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -1579,6 +1579,10 @@ enum nl80211_commands {
  * @NL80211_ATTR_TDLS_PEER_CAPABILITY: flags for TDLS peer capabilities, u32.
  *      As specified in the &enum nl80211_tdls_peer_capability.
  *
+ * @NL80211_ATTR_IFACE_SOCKET_OWNER: flag attribute, if set during interface
+ *      creation then the new interface will be owned by the netlink socket
+ *      that created it and will be destroyed when the socket is closed
+ *
  * @NL80211_ATTR_MAX: highest attribute number currently defined
  * @__NL80211_ATTR_AFTER_LAST: internal use
  */
@@ -1914,6 +1918,8 @@ enum nl80211_attrs {
 
         NL80211_ATTR_TDLS_PEER_CAPABILITY,
 
+        NL80211_ATTR_IFACE_SOCKET_OWNER,
+
         /* add attributes here, update the policy in nl80211.c */
 
         __NL80211_ATTR_AFTER_LAST,
@@ -2336,9 +2342,34 @@ enum nl80211_band_attr {
  *      using this channel as the primary or any of the secondary channels
  *      isn't possible
  * @NL80211_FREQUENCY_ATTR_DFS_CAC_TIME: DFS CAC time in milliseconds.
+ * @NL80211_FREQUENCY_ATTR_INDOOR_ONLY: Only indoor use is permitted on this
+ *      channel. A channel that has the INDOOR_ONLY attribute can only be
+ *      used when there is a clear assessment that the device is operating in
+ *      an indoor surroundings, i.e., it is connected to AC power (and not
+ *      through portable DC inverters) or is under the control of a master
+ *      that is acting as an AP and is connected to AC power.
+ * @NL80211_FREQUENCY_ATTR_GO_CONCURRENT: GO operation is allowed on this
+ *      channel if it's connected concurrently to a BSS on the same channel on
+ *      the 2 GHz band or to a channel in the same UNII band (on the 5 GHz
+ *      band), and IEEE80211_CHAN_RADAR is not set. Instantiating a GO on a
+ *      channel that has the GO_CONCURRENT attribute set can be done when there
+ *      is a clear assessment that the device is operating under the guidance of
+ *      an authorized master, i.e., setting up a GO while the device is also
+ *      connected to an AP with DFS and radar detection on the UNII band (it is
+ *      up to user-space, i.e., wpa_supplicant to perform the required
+ *      verifications)
+ * @NL80211_FREQUENCY_ATTR_NO_20MHZ: 20 MHz operation is not allowed
+ *      on this channel in current regulatory domain.
+ * @NL80211_FREQUENCY_ATTR_NO_10MHZ: 10 MHz operation is not allowed
+ *      on this channel in current regulatory domain.
  * @NL80211_FREQUENCY_ATTR_MAX: highest frequency attribute number
  *      currently defined
  * @__NL80211_FREQUENCY_ATTR_AFTER_LAST: internal use
+ *
+ * See https://apps.fcc.gov/eas/comments/GetPublishedDocument.html?id=327&tn=528122
+ * for more information on the FCC description of the relaxations allowed
+ * by NL80211_FREQUENCY_ATTR_INDOOR_ONLY and
+ * NL80211_FREQUENCY_ATTR_GO_CONCURRENT.
  */
 enum nl80211_frequency_attr {
         __NL80211_FREQUENCY_ATTR_INVALID,
@@ -2355,6 +2386,10 @@ enum nl80211_frequency_attr {
         NL80211_FREQUENCY_ATTR_NO_80MHZ,
         NL80211_FREQUENCY_ATTR_NO_160MHZ,
         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
+        NL80211_FREQUENCY_ATTR_INDOOR_ONLY,
+        NL80211_FREQUENCY_ATTR_GO_CONCURRENT,
+        NL80211_FREQUENCY_ATTR_NO_20MHZ,
+        NL80211_FREQUENCY_ATTR_NO_10MHZ,
 
         /* keep last */
         __NL80211_FREQUENCY_ATTR_AFTER_LAST,
@@ -2573,10 +2608,13 @@ enum nl80211_dfs_regions {
  *      present has been registered with the wireless core that
  *      has listed NL80211_FEATURE_CELL_BASE_REG_HINTS as a
  *      supported feature.
+ * @NL80211_USER_REG_HINT_INDOOR: a user sent an hint indicating that the
+ *      platform is operating in an indoor environment.
  */
 enum nl80211_user_reg_hint_type {
         NL80211_USER_REG_HINT_USER      = 0,
         NL80211_USER_REG_HINT_CELL_BASE = 1,
+        NL80211_USER_REG_HINT_INDOOR    = 2,
 };
 
 /**
@@ -3891,6 +3929,9 @@ enum nl80211_ap_sme_features {
  *      interface. An active monitor interface behaves like a normal monitor
  *      interface, but gets added to the driver. It ensures that incoming
  *      unicast packets directed at the configured interface address get ACKed.
+ * @NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE: This driver supports dynamic
+ *      channel bandwidth change (e.g., HT 20 <-> 40 MHz channel) during the
+ *      lifetime of a BSS.
  */
 enum nl80211_feature_flags {
         NL80211_FEATURE_SK_TX_STATUS                    = 1 << 0,
@@ -3911,6 +3952,7 @@ enum nl80211_feature_flags {
         NL80211_FEATURE_FULL_AP_CLIENT_STATE            = 1 << 15,
         NL80211_FEATURE_USERSPACE_MPM                   = 1 << 16,
         NL80211_FEATURE_ACTIVE_MONITOR                  = 1 << 17,
+        NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE       = 1 << 18,
 };
 
 /**
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index d958e2dca52f..095943c02d6e 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -367,9 +367,23 @@ static void le_conn_timeout(struct work_struct *work)
 {
         struct hci_conn *conn = container_of(work, struct hci_conn,
                                              le_conn_timeout.work);
+        struct hci_dev *hdev = conn->hdev;
 
         BT_DBG("");
 
+        /* We could end up here due to having done directed advertising,
+         * so clean up the state if necessary. This should however only
+         * happen with broken hardware or if low duty cycle was used
+         * (which doesn't have a timeout of its own).
+         */
+        if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
+                u8 enable = 0x00;
+                hci_send_cmd(hdev, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable),
+                             &enable);
+                hci_le_conn_failed(conn, HCI_ERROR_ADVERTISING_TIMEOUT);
+                return;
+        }
+
         hci_le_create_connection_cancel(conn);
 }
 
@@ -401,6 +415,10 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
         case ACL_LINK:
                 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
                 break;
+        case LE_LINK:
+                /* conn->src should reflect the local identity address */
+                hci_copy_identity_address(hdev, &conn->src, &conn->src_type);
+                break;
         case SCO_LINK:
                 if (lmp_esco_capable(hdev))
                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
@@ -545,6 +563,11 @@ void hci_le_conn_failed(struct hci_conn *conn, u8 status)
          * favor of connection establishment, we should restart it.
          */
         hci_update_background_scan(hdev);
+
+        /* Re-enable advertising in case this was a failed connection
+         * attempt as a peripheral.
+         */
+        mgmt_reenable_advertising(hdev);
 }
 
 static void create_le_conn_complete(struct hci_dev *hdev, u8 status)
@@ -605,6 +628,45 @@ static void hci_req_add_le_create_conn(struct hci_request *req,
         conn->state = BT_CONNECT;
 }
 
+static void hci_req_directed_advertising(struct hci_request *req,
+                                         struct hci_conn *conn)
+{
+        struct hci_dev *hdev = req->hdev;
+        struct hci_cp_le_set_adv_param cp;
+        u8 own_addr_type;
+        u8 enable;
+
+        enable = 0x00;
+        hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
+
+        /* Clear the HCI_ADVERTISING bit temporarily so that the
+         * hci_update_random_address knows that it's safe to go ahead
+         * and write a new random address. The flag will be set back on
+         * as soon as the SET_ADV_ENABLE HCI command completes.
+         */
+        clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
+
+        /* Set require_privacy to false so that the remote device has a
+         * chance of identifying us.
+         */
+        if (hci_update_random_address(req, false, &own_addr_type) < 0)
+                return;
+
+        memset(&cp, 0, sizeof(cp));
+        cp.type = LE_ADV_DIRECT_IND;
+        cp.own_address_type = own_addr_type;
+        cp.direct_addr_type = conn->dst_type;
+        bacpy(&cp.direct_addr, &conn->dst);
+        cp.channel_map = hdev->le_adv_channel_map;
+
+        hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
+
+        enable = 0x01;
+        hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
+
+        conn->state = BT_CONNECT;
+}
+
 struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
                                 u8 dst_type, u8 sec_level, u8 auth_type)
 {
@@ -614,9 +676,6 @@ struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
         struct hci_request req;
         int err;
 
-        if (test_bit(HCI_ADVERTISING, &hdev->flags))
-                return ERR_PTR(-ENOTSUPP);
-
         /* Some devices send ATT messages as soon as the physical link is
          * established. To be able to handle these ATT messages, the user-
          * space first establishes the connection and then starts the pairing
@@ -664,13 +723,20 @@ struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
                 return ERR_PTR(-ENOMEM);
 
         conn->dst_type = dst_type;
-
-        conn->out = true;
-        conn->link_mode |= HCI_LM_MASTER;
         conn->sec_level = BT_SECURITY_LOW;
         conn->pending_sec_level = sec_level;
         conn->auth_type = auth_type;
 
+        hci_req_init(&req, hdev);
+
+        if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
+                hci_req_directed_advertising(&req, conn);
+                goto create_conn;
+        }
+
+        conn->out = true;
+        conn->link_mode |= HCI_LM_MASTER;
+
         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
         if (params) {
                 conn->le_conn_min_interval = params->conn_min_interval;
@@ -680,8 +746,6 @@ struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
                 conn->le_conn_max_interval = hdev->le_conn_max_interval;
         }
 
-        hci_req_init(&req, hdev);
-
         /* If controller is scanning, we stop it since some controllers are
          * not able to scan and connect at the same time. Also set the
          * HCI_LE_SCAN_INTERRUPTED flag so that the command complete
@@ -695,6 +759,7 @@ struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
 
         hci_req_add_le_create_conn(&req, conn);
 
+create_conn:
         err = hci_req_run(&req, create_le_conn_complete);
         if (err) {
                 hci_conn_del(conn);
@@ -819,14 +884,17 @@ static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
                 struct hci_cp_auth_requested cp;
 
-                /* encrypt must be pending if auth is also pending */
-                set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
-
                 cp.handle = cpu_to_le16(conn->handle);
                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
                              sizeof(cp), &cp);
+
+                /* If we're already encrypted set the REAUTH_PEND flag,
+                 * otherwise set the ENCRYPT_PEND.
+                 */
                 if (conn->key_type != 0xff)
                         set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
+                else
+                        set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
         }
 
         return 0;
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 1c6ffaa8902f..d31f144860d1 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -955,14 +955,9 @@ static ssize_t le_auto_conn_write(struct file *file, const char __user *data,
         if (count < 3)
                 return -EINVAL;
 
-        buf = kzalloc(count, GFP_KERNEL);
-        if (!buf)
-                return -ENOMEM;
-
-        if (copy_from_user(buf, data, count)) {
-                err = -EFAULT;
-                goto done;
-        }
+        buf = memdup_user(data, count);
+        if (IS_ERR(buf))
+                return PTR_ERR(buf);
 
         if (memcmp(buf, "add", 3) == 0) {
                 n = sscanf(&buf[4], "%hhx:%hhx:%hhx:%hhx:%hhx:%hhx %hhu %hhu",
@@ -1828,6 +1823,9 @@ static int __hci_init(struct hci_dev *hdev)
                                     &lowpan_debugfs_fops);
                 debugfs_create_file("le_auto_conn", 0644, hdev->debugfs, hdev,
                                     &le_auto_conn_fops);
+                debugfs_create_u16("discov_interleaved_timeout", 0644,
+                                   hdev->debugfs,
+                                   &hdev->discov_interleaved_timeout);
         }
 
         return 0;
@@ -2033,12 +2031,11 @@ bool hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
 
         hci_remove_remote_oob_data(hdev, &data->bdaddr);
 
-        if (ssp)
-                *ssp = data->ssp_mode;
+        *ssp = data->ssp_mode;
 
         ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
         if (ie) {
-                if (ie->data.ssp_mode && ssp)
+                if (ie->data.ssp_mode)
                         *ssp = true;
 
                 if (ie->name_state == NAME_NEEDED &&
@@ -3791,6 +3788,7 @@ struct hci_dev *hci_alloc_dev(void)
         hdev->le_conn_max_interval = 0x0038;
 
         hdev->rpa_timeout = HCI_DEFAULT_RPA_TIMEOUT;
+        hdev->discov_interleaved_timeout = DISCOV_INTERLEAVED_TIMEOUT;
 
         mutex_init(&hdev->lock);
         mutex_init(&hdev->req_lock);
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 49774912cb01..ca19fd4bbb8f 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -991,10 +991,25 @@ static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
         if (!sent)
                 return;
 
+        if (status)
+                return;
+
         hci_dev_lock(hdev);
 
-        if (!status)
-                mgmt_advertising(hdev, *sent);
+        /* If we're doing connection initation as peripheral. Set a
+         * timeout in case something goes wrong.
+         */
+        if (*sent) {
+                struct hci_conn *conn;
+
+                conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
+                if (conn)
+                        queue_delayed_work(hdev->workqueue,
+                                           &conn->le_conn_timeout,
+                                           HCI_LE_CONN_TIMEOUT);
+        }
+
+        mgmt_advertising(hdev, *sent);
 
         hci_dev_unlock(hdev);
 }
@@ -1018,6 +1033,33 @@ static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
         hci_dev_unlock(hdev);
 }
 
+static bool has_pending_adv_report(struct hci_dev *hdev)
+{
+        struct discovery_state *d = &hdev->discovery;
+
+        return bacmp(&d->last_adv_addr, BDADDR_ANY);
+}
+
+static void clear_pending_adv_report(struct hci_dev *hdev)
+{
+        struct discovery_state *d = &hdev->discovery;
+
+        bacpy(&d->last_adv_addr, BDADDR_ANY);
+        d->last_adv_data_len = 0;
+}
+
+static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                                     u8 bdaddr_type, s8 rssi, u8 *data, u8 len)
+{
+        struct discovery_state *d = &hdev->discovery;
+
+        bacpy(&d->last_adv_addr, bdaddr);
+        d->last_adv_addr_type = bdaddr_type;
+        d->last_adv_rssi = rssi;
+        memcpy(d->last_adv_data, data, len);
+        d->last_adv_data_len = len;
+}
+
 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
                                       struct sk_buff *skb)
 {
@@ -1036,9 +1078,25 @@ static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
         switch (cp->enable) {
         case LE_SCAN_ENABLE:
                 set_bit(HCI_LE_SCAN, &hdev->dev_flags);
+                if (hdev->le_scan_type == LE_SCAN_ACTIVE)
+                        clear_pending_adv_report(hdev);
                 break;
 
         case LE_SCAN_DISABLE:
+                /* We do this here instead of when setting DISCOVERY_STOPPED
+                 * since the latter would potentially require waiting for
+                 * inquiry to stop too.
+                 */
+                if (has_pending_adv_report(hdev)) {
+                        struct discovery_state *d = &hdev->discovery;
+
+                        mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
+                                          d->last_adv_addr_type, NULL,
+                                          d->last_adv_rssi, 0, 1,
+                                          d->last_adv_data,
+                                          d->last_adv_data_len, NULL, 0);
+                }
+
                 /* Cancel this timer so that we don't try to disable scanning
                  * when it's already disabled.
                  */
@@ -1827,7 +1885,7 @@ static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 name_known = hci_inquiry_cache_update(hdev, &data, false, &ssp);
                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
                                   info->dev_class, 0, !name_known, ssp, NULL,
-                                  0);
+                                  0, NULL, 0);
         }
 
         hci_dev_unlock(hdev);
@@ -3102,7 +3160,7 @@ static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
                                                               false, &ssp);
                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
                                           info->dev_class, info->rssi,
-                                          !name_known, ssp, NULL, 0);
+                                          !name_known, ssp, NULL, 0, NULL, 0);
                 }
         } else {
                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
@@ -3120,7 +3178,7 @@ static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
                                                               false, &ssp);
                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
                                           info->dev_class, info->rssi,
-                                          !name_known, ssp, NULL, 0);
+                                          !name_known, ssp, NULL, 0, NULL, 0);
                 }
         }
 
@@ -3309,7 +3367,7 @@ static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
                 eir_len = eir_get_length(info->data, sizeof(info->data));
                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
                                   info->dev_class, info->rssi, !name_known,
-                                  ssp, info->data, eir_len);
+                                  ssp, info->data, eir_len, NULL, 0);
         }
 
         hci_dev_unlock(hdev);
@@ -3330,6 +3388,12 @@ static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
         if (!conn)
                 goto unlock;
 
+        /* For BR/EDR the necessary steps are taken through the
+         * auth_complete event.
+         */
+        if (conn->type != LE_LINK)
+                goto unlock;
+
         if (!ev->status)
                 conn->sec_level = conn->pending_sec_level;
 
@@ -3361,24 +3425,20 @@ unlock:
 
 static u8 hci_get_auth_req(struct hci_conn *conn)
 {
-        /* If remote requests dedicated bonding follow that lead */
-        if (conn->remote_auth == HCI_AT_DEDICATED_BONDING ||
-            conn->remote_auth == HCI_AT_DEDICATED_BONDING_MITM) {
-                /* If both remote and local IO capabilities allow MITM
-                 * protection then require it, otherwise don't */
-                if (conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT ||
-                    conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)
-                        return HCI_AT_DEDICATED_BONDING;
-                else
-                        return HCI_AT_DEDICATED_BONDING_MITM;
-        }
-
         /* If remote requests no-bonding follow that lead */
         if (conn->remote_auth == HCI_AT_NO_BONDING ||
             conn->remote_auth == HCI_AT_NO_BONDING_MITM)
                 return conn->remote_auth | (conn->auth_type & 0x01);
 
-        return conn->auth_type;
+        /* If both remote and local have enough IO capabilities, require
+         * MITM protection
+         */
+        if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
+            conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
+                return conn->remote_auth | 0x01;
+
+        /* No MITM protection possible so ignore remote requirement */
+        return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
 }
 
 static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
@@ -3408,8 +3468,21 @@ static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
                  * to DisplayYesNo as it is not supported by BT spec. */
                 cp.capability = (conn->io_capability == 0x04) ?
                                 HCI_IO_DISPLAY_YESNO : conn->io_capability;
-                conn->auth_type = hci_get_auth_req(conn);
-                cp.authentication = conn->auth_type;
+
+                /* If we are initiators, there is no remote information yet */
+                if (conn->remote_auth == 0xff) {
+                        cp.authentication = conn->auth_type;
+
+                        /* Request MITM protection if our IO caps allow it
+                         * except for the no-bonding case
+                         */
+                        if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
+                            cp.authentication != HCI_AT_NO_BONDING)
+                                cp.authentication |= 0x01;
+                } else {
+                        conn->auth_type = hci_get_auth_req(conn);
+                        cp.authentication = conn->auth_type;
+                }
 
                 if (hci_find_remote_oob_data(hdev, &conn->dst) &&
                     (conn->out || test_bit(HCI_CONN_REMOTE_OOB, &conn->flags)))
@@ -3477,12 +3550,9 @@ static void hci_user_confirm_request_evt(struct hci_dev *hdev,
         rem_mitm = (conn->remote_auth & 0x01);
 
         /* If we require MITM but the remote device can't provide that
-         * (it has NoInputNoOutput) then reject the confirmation
-         * request. The only exception is when we're dedicated bonding
-         * initiators (connect_cfm_cb set) since then we always have the MITM
-         * bit set. */
-        if (!conn->connect_cfm_cb && loc_mitm &&
-            conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
+         * (it has NoInputNoOutput) then reject the confirmation request
+         */
+        if (loc_mitm && conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
                 BT_DBG("Rejecting request: remote device can't provide MITM");
                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
                              sizeof(ev->bdaddr), &ev->bdaddr);
@@ -3840,17 +3910,6 @@ static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 
                 conn->dst_type = ev->bdaddr_type;
 
-                /* The advertising parameters for own address type
-                 * define which source address and source address
-                 * type this connections has.
-                 */
-                if (bacmp(&conn->src, BDADDR_ANY)) {
-                        conn->src_type = ADDR_LE_DEV_PUBLIC;
-                } else {
-                        bacpy(&conn->src, &hdev->static_addr);
-                        conn->src_type = ADDR_LE_DEV_RANDOM;
-                }
-
                 if (ev->role == LE_CONN_ROLE_MASTER) {
                         conn->out = true;
                         conn->link_mode |= HCI_LM_MASTER;
@@ -3875,27 +3934,24 @@ static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
                                                           &conn->init_addr,
                                                           &conn->init_addr_type);
                         }
-                } else {
-                        /* Set the responder (our side) address type based on
-                         * the advertising address type.
-                         */
-                        conn->resp_addr_type = hdev->adv_addr_type;
-                        if (hdev->adv_addr_type == ADDR_LE_DEV_RANDOM)
-                                bacpy(&conn->resp_addr, &hdev->random_addr);
-                        else
-                                bacpy(&conn->resp_addr, &hdev->bdaddr);
-
-                        conn->init_addr_type = ev->bdaddr_type;
-                        bacpy(&conn->init_addr, &ev->bdaddr);
                 }
         } else {
                 cancel_delayed_work(&conn->le_conn_timeout);
         }
 
-        /* Ensure that the hci_conn contains the identity address type
-         * regardless of which address the connection was made with.
-         */
-        hci_copy_identity_address(hdev, &conn->src, &conn->src_type);
+        if (!conn->out) {
+                /* Set the responder (our side) address type based on
+                 * the advertising address type.
+                 */
+                conn->resp_addr_type = hdev->adv_addr_type;
+                if (hdev->adv_addr_type == ADDR_LE_DEV_RANDOM)
+                        bacpy(&conn->resp_addr, &hdev->random_addr);
+                else
+                        bacpy(&conn->resp_addr, &hdev->bdaddr);
+
+                conn->init_addr_type = ev->bdaddr_type;
+                bacpy(&conn->init_addr, &ev->bdaddr);
+        }
 
         /* Lookup the identity address from the stored connection
          * address and address type.
@@ -3975,25 +4031,97 @@ static void check_pending_le_conn(struct hci_dev *hdev, bdaddr_t *addr,
         }
 }
 
+static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
+                               u8 bdaddr_type, s8 rssi, u8 *data, u8 len)
+{
+        struct discovery_state *d = &hdev->discovery;
+        bool match;
+
+        /* Passive scanning shouldn't trigger any device found events */
+        if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
+                if (type == LE_ADV_IND || type == LE_ADV_DIRECT_IND)
+                        check_pending_le_conn(hdev, bdaddr, bdaddr_type);
+                return;
+        }
+
+        /* If there's nothing pending either store the data from this
+         * event or send an immediate device found event if the data
+         * should not be stored for later.
+         */
+        if (!has_pending_adv_report(hdev)) {
+                /* If the report will trigger a SCAN_REQ store it for
+                 * later merging.
+                 */
+                if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
+                        store_pending_adv_report(hdev, bdaddr, bdaddr_type,
+                                                 rssi, data, len);
+                        return;
+                }
+
+                mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
+                                  rssi, 0, 1, data, len, NULL, 0);
+                return;
+        }
+
+        /* Check if the pending report is for the same device as the new one */
+        match = (!bacmp(bdaddr, &d->last_adv_addr) &&
+                 bdaddr_type == d->last_adv_addr_type);
+
+        /* If the pending data doesn't match this report or this isn't a
+         * scan response (e.g. we got a duplicate ADV_IND) then force
+         * sending of the pending data.
+         */
+        if (type != LE_ADV_SCAN_RSP || !match) {
+                /* Send out whatever is in the cache, but skip duplicates */
+                if (!match)
+                        mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
+                                          d->last_adv_addr_type, NULL,
+                                          d->last_adv_rssi, 0, 1,
+                                          d->last_adv_data,
+                                          d->last_adv_data_len, NULL, 0);
+
+                /* If the new report will trigger a SCAN_REQ store it for
+                 * later merging.
+                 */
+                if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
+                        store_pending_adv_report(hdev, bdaddr, bdaddr_type,
+                                                 rssi, data, len);
+                        return;
+                }
+
+                /* The advertising reports cannot be merged, so clear
+                 * the pending report and send out a device found event.
+                 */
+                clear_pending_adv_report(hdev);
+                mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
+                                  rssi, 0, 1, data, len, NULL, 0);
+                return;
+        }
+
+        /* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
+         * the new event is a SCAN_RSP. We can therefore proceed with
+         * sending a merged device found event.
+         */
+        mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
+                          d->last_adv_addr_type, NULL, rssi, 0, 1, data, len,
+                          d->last_adv_data, d->last_adv_data_len);
+        clear_pending_adv_report(hdev);
+}
+
 static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         u8 num_reports = skb->data[0];
         void *ptr = &skb->data[1];
-        s8 rssi;
 
         hci_dev_lock(hdev);
 
         while (num_reports--) {
                 struct hci_ev_le_advertising_info *ev = ptr;
-
-                if (ev->evt_type == LE_ADV_IND ||
-                    ev->evt_type == LE_ADV_DIRECT_IND)
-                        check_pending_le_conn(hdev, &ev->bdaddr,
-                                              ev->bdaddr_type);
+                s8 rssi;
 
                 rssi = ev->data[ev->length];
-                mgmt_device_found(hdev, &ev->bdaddr, LE_LINK, ev->bdaddr_type,
-                                  NULL, rssi, 0, 1, ev->data, ev->length);
+                process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
+                                   ev->bdaddr_type, rssi, ev->data, ev->length);
 
                 ptr += sizeof(*ev) + ev->length + 1;
         }
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index b9a418e578e0..f608bffdb8b9 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -524,16 +524,7 @@ static int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd,
         case HCISETRAW:
                 if (!capable(CAP_NET_ADMIN))
                         return -EPERM;
-
-                if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
-                        return -EPERM;
-
-                if (arg)
-                        set_bit(HCI_RAW, &hdev->flags);
-                else
-                        clear_bit(HCI_RAW, &hdev->flags);
-
-                return 0;
+                return -EOPNOTSUPP;
 
         case HCIGETCONNINFO:
                 return hci_get_conn_info(hdev, (void __user *) arg);
diff --git a/net/bluetooth/lib.c b/net/bluetooth/lib.c
index b3fbc73516c4..941ad7530eda 100644
--- a/net/bluetooth/lib.c
+++ b/net/bluetooth/lib.c
@@ -58,6 +58,7 @@ int bt_to_errno(__u16 code)
                 return EIO;
 
         case 0x04:
+        case 0x3c:
                 return EHOSTDOWN;
 
         case 0x05:
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index d2d4e0d5aed0..54abbce3a39e 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -2850,10 +2850,7 @@ static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
         }
 
         sec_level = BT_SECURITY_MEDIUM;
-        if (cp->io_cap == 0x03)
-                auth_type = HCI_AT_DEDICATED_BONDING;
-        else
-                auth_type = HCI_AT_DEDICATED_BONDING_MITM;
+        auth_type = HCI_AT_DEDICATED_BONDING;
 
         if (cp->addr.type == BDADDR_BREDR) {
                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
@@ -3351,6 +3348,8 @@ static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
 
 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
 {
+        unsigned long timeout = 0;
+
         BT_DBG("status %d", status);
 
         if (status) {
@@ -3366,13 +3365,11 @@ static void start_discovery_complete(struct hci_dev *hdev, u8 status)
 
         switch (hdev->discovery.type) {
         case DISCOV_TYPE_LE:
-                queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
-                                   DISCOV_LE_TIMEOUT);
+                timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
                 break;
 
         case DISCOV_TYPE_INTERLEAVED:
-                queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
-                                   DISCOV_INTERLEAVED_TIMEOUT);
+                timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
                 break;
 
         case DISCOV_TYPE_BREDR:
@@ -3381,6 +3378,11 @@ static void start_discovery_complete(struct hci_dev *hdev, u8 status)
         default:
                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
         }
+
+        if (!timeout)
+                return;
+
+        queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable, timeout);
 }
 
 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
@@ -5668,8 +5670,9 @@ void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
 }
 
 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
-                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
-                       ssp, u8 *eir, u16 eir_len)
+                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name,
+                       u8 ssp, u8 *eir, u16 eir_len, u8 *scan_rsp,
+                       u8 scan_rsp_len)
 {
         char buf[512];
         struct mgmt_ev_device_found *ev = (void *) buf;
@@ -5679,8 +5682,10 @@ void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
         if (!hci_discovery_active(hdev))
                 return;
 
-        /* Leave 5 bytes for a potential CoD field */
-        if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
+        /* Make sure that the buffer is big enough. The 5 extra bytes
+         * are for the potential CoD field.
+         */
+        if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
                 return;
 
         memset(buf, 0, sizeof(buf));
@@ -5707,8 +5712,11 @@ void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
                                           dev_class, 3);
 
-        ev->eir_len = cpu_to_le16(eir_len);
-        ev_size = sizeof(*ev) + eir_len;
+        if (scan_rsp_len > 0)
+                memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
+
+        ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
+        ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
 
         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
 }
diff --git a/net/mac80211/aes_ccm.c b/net/mac80211/aes_ccm.c
index 7c7df475a401..ec24378caaaf 100644
--- a/net/mac80211/aes_ccm.c
+++ b/net/mac80211/aes_ccm.c
@@ -23,12 +23,13 @@ void ieee80211_aes_ccm_encrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
                                u8 *data, size_t data_len, u8 *mic)
 {
         struct scatterlist assoc, pt, ct[2];
-        struct {
-                struct aead_request     req;
-                u8                      priv[crypto_aead_reqsize(tfm)];
-        } aead_req;
 
-        memset(&aead_req, 0, sizeof(aead_req));
+        char aead_req_data[sizeof(struct aead_request) +
+                           crypto_aead_reqsize(tfm)]
+                __aligned(__alignof__(struct aead_request));
+        struct aead_request *aead_req = (void *) aead_req_data;
+
+        memset(aead_req, 0, sizeof(aead_req_data));
 
         sg_init_one(&pt, data, data_len);
         sg_init_one(&assoc, &aad[2], be16_to_cpup((__be16 *)aad));
@@ -36,23 +37,23 @@ void ieee80211_aes_ccm_encrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
         sg_set_buf(&ct[0], data, data_len);
         sg_set_buf(&ct[1], mic, IEEE80211_CCMP_MIC_LEN);
 
-        aead_request_set_tfm(&aead_req.req, tfm);
-        aead_request_set_assoc(&aead_req.req, &assoc, assoc.length);
-        aead_request_set_crypt(&aead_req.req, &pt, ct, data_len, b_0);
+        aead_request_set_tfm(aead_req, tfm);
+        aead_request_set_assoc(aead_req, &assoc, assoc.length);
+        aead_request_set_crypt(aead_req, &pt, ct, data_len, b_0);
 
-        crypto_aead_encrypt(&aead_req.req);
+        crypto_aead_encrypt(aead_req);
 }
 
 int ieee80211_aes_ccm_decrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
                               u8 *data, size_t data_len, u8 *mic)
 {
         struct scatterlist assoc, pt, ct[2];
-        struct {
-                struct aead_request     req;
-                u8                      priv[crypto_aead_reqsize(tfm)];
-        } aead_req;
+        char aead_req_data[sizeof(struct aead_request) +
+                           crypto_aead_reqsize(tfm)]
+                __aligned(__alignof__(struct aead_request));
+        struct aead_request *aead_req = (void *) aead_req_data;
 
-        memset(&aead_req, 0, sizeof(aead_req));
+        memset(aead_req, 0, sizeof(aead_req_data));
 
         sg_init_one(&pt, data, data_len);
         sg_init_one(&assoc, &aad[2], be16_to_cpup((__be16 *)aad));
@@ -60,12 +61,12 @@ int ieee80211_aes_ccm_decrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
         sg_set_buf(&ct[0], data, data_len);
         sg_set_buf(&ct[1], mic, IEEE80211_CCMP_MIC_LEN);
 
-        aead_request_set_tfm(&aead_req.req, tfm);
-        aead_request_set_assoc(&aead_req.req, &assoc, assoc.length);
-        aead_request_set_crypt(&aead_req.req, ct, &pt,
+        aead_request_set_tfm(aead_req, tfm);
+        aead_request_set_assoc(aead_req, &assoc, assoc.length);
+        aead_request_set_crypt(aead_req, ct, &pt,
                                data_len + IEEE80211_CCMP_MIC_LEN, b_0);
 
-        return crypto_aead_decrypt(&aead_req.req);
+        return crypto_aead_decrypt(aead_req);
 }
 
 struct crypto_aead *ieee80211_aes_key_setup_encrypt(const u8 key[])
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index aaa59d719592..7b8d3cf89574 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -109,6 +109,15 @@ static int ieee80211_change_iface(struct wiphy *wiphy,
 static int ieee80211_start_p2p_device(struct wiphy *wiphy,
                                       struct wireless_dev *wdev)
 {
+        struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
+        int ret;
+
+        mutex_lock(&sdata->local->chanctx_mtx);
+        ret = ieee80211_check_combinations(sdata, NULL, 0, 0);
+        mutex_unlock(&sdata->local->chanctx_mtx);
+        if (ret < 0)
+                return ret;
+
         return ieee80211_do_open(wdev, true);
 }
 
@@ -972,13 +981,13 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
         sdata->needed_rx_chains = sdata->local->rx_chains;
 
         mutex_lock(&local->mtx);
-        sdata->radar_required = params->radar_required;
         err = ieee80211_vif_use_channel(sdata, &params->chandef,
                                         IEEE80211_CHANCTX_SHARED);
+        if (!err)
+                ieee80211_vif_copy_chanctx_to_vlans(sdata, false);
         mutex_unlock(&local->mtx);
         if (err)
                 return err;
-        ieee80211_vif_copy_chanctx_to_vlans(sdata, false);
 
         /*
          * Apply control port protocol, this allows us to
@@ -1131,8 +1140,8 @@ static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
         local->total_ps_buffered -= skb_queue_len(&sdata->u.ap.ps.bc_buf);
         skb_queue_purge(&sdata->u.ap.ps.bc_buf);
 
-        ieee80211_vif_copy_chanctx_to_vlans(sdata, true);
         mutex_lock(&local->mtx);
+        ieee80211_vif_copy_chanctx_to_vlans(sdata, true);
         ieee80211_vif_release_channel(sdata);
         mutex_unlock(&local->mtx);
 
@@ -1566,7 +1575,7 @@ static int ieee80211_change_station(struct wiphy *wiphy,
 
                 if (sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
                     sta->sdata->u.vlan.sta) {
-                        rcu_assign_pointer(sta->sdata->u.vlan.sta, NULL);
+                        RCU_INIT_POINTER(sta->sdata->u.vlan.sta, NULL);
                         prev_4addr = true;
                 }
 
@@ -2930,7 +2939,6 @@ static int ieee80211_start_radar_detection(struct wiphy *wiphy,
         /* whatever, but channel contexts should not complain about that one */
         sdata->smps_mode = IEEE80211_SMPS_OFF;
         sdata->needed_rx_chains = local->rx_chains;
-        sdata->radar_required = true;
 
         err = ieee80211_vif_use_channel(sdata, chandef,
                                         IEEE80211_CHANCTX_SHARED);
@@ -3217,7 +3225,7 @@ int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_chanctx_conf *chanctx_conf;
+        struct ieee80211_chanctx_conf *conf;
         struct ieee80211_chanctx *chanctx;
         int err, num_chanctx, changed = 0;
 
@@ -3233,23 +3241,24 @@ int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
                                        &sdata->vif.bss_conf.chandef))
                 return -EINVAL;
 
-        rcu_read_lock();
-        chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
-        if (!chanctx_conf) {
-                rcu_read_unlock();
+        mutex_lock(&local->chanctx_mtx);
+        conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
+                                         lockdep_is_held(&local->chanctx_mtx));
+        if (!conf) {
+                mutex_unlock(&local->chanctx_mtx);
                 return -EBUSY;
         }
 
         /* don't handle for multi-VIF cases */
-        chanctx = container_of(chanctx_conf, struct ieee80211_chanctx, conf);
-        if (chanctx->refcount > 1) {
-                rcu_read_unlock();
+        chanctx = container_of(conf, struct ieee80211_chanctx, conf);
+        if (ieee80211_chanctx_refcount(local, chanctx) > 1) {
+                mutex_unlock(&local->chanctx_mtx);
                 return -EBUSY;
         }
         num_chanctx = 0;
         list_for_each_entry_rcu(chanctx, &local->chanctx_list, list)
                 num_chanctx++;
-        rcu_read_unlock();
+        mutex_unlock(&local->chanctx_mtx);
 
         if (num_chanctx > 1)
                 return -EBUSY;
@@ -3949,6 +3958,21 @@ static int ieee80211_set_qos_map(struct wiphy *wiphy,
         return 0;
 }
 
+static int ieee80211_set_ap_chanwidth(struct wiphy *wiphy,
+                                      struct net_device *dev,
+                                      struct cfg80211_chan_def *chandef)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        int ret;
+        u32 changed = 0;
+
+        ret = ieee80211_vif_change_bandwidth(sdata, chandef, &changed);
+        if (ret == 0)
+                ieee80211_bss_info_change_notify(sdata, changed);
+
+        return ret;
+}
+
 const struct cfg80211_ops mac80211_config_ops = {
         .add_virtual_intf = ieee80211_add_iface,
         .del_virtual_intf = ieee80211_del_iface,
@@ -4029,4 +4053,5 @@ const struct cfg80211_ops mac80211_config_ops = {
         .start_radar_detection = ieee80211_start_radar_detection,
         .channel_switch = ieee80211_channel_switch,
         .set_qos_map = ieee80211_set_qos_map,
+        .set_ap_chanwidth = ieee80211_set_ap_chanwidth,
 };
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index 75b5dd2c9267..48e6d6f010cd 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -9,6 +9,170 @@
 #include "ieee80211_i.h"
 #include "driver-ops.h"
 
+static int ieee80211_chanctx_num_assigned(struct ieee80211_local *local,
+                                          struct ieee80211_chanctx *ctx)
+{
+        struct ieee80211_sub_if_data *sdata;
+        int num = 0;
+
+        lockdep_assert_held(&local->chanctx_mtx);
+
+        list_for_each_entry(sdata, &ctx->assigned_vifs, assigned_chanctx_list)
+                num++;
+
+        return num;
+}
+
+static int ieee80211_chanctx_num_reserved(struct ieee80211_local *local,
+                                          struct ieee80211_chanctx *ctx)
+{
+        struct ieee80211_sub_if_data *sdata;
+        int num = 0;
+
+        lockdep_assert_held(&local->chanctx_mtx);
+
+        list_for_each_entry(sdata, &ctx->reserved_vifs, reserved_chanctx_list)
+                num++;
+
+        return num;
+}
+
+int ieee80211_chanctx_refcount(struct ieee80211_local *local,
+                               struct ieee80211_chanctx *ctx)
+{
+        return ieee80211_chanctx_num_assigned(local, ctx) +
+               ieee80211_chanctx_num_reserved(local, ctx);
+}
+
+static int ieee80211_num_chanctx(struct ieee80211_local *local)
+{
+        struct ieee80211_chanctx *ctx;
+        int num = 0;
+
+        lockdep_assert_held(&local->chanctx_mtx);
+
+        list_for_each_entry(ctx, &local->chanctx_list, list)
+                num++;
+
+        return num;
+}
+
+static bool ieee80211_can_create_new_chanctx(struct ieee80211_local *local)
+{
+        lockdep_assert_held(&local->chanctx_mtx);
+        return ieee80211_num_chanctx(local) < ieee80211_max_num_channels(local);
+}
+
+static const struct cfg80211_chan_def *
+ieee80211_chanctx_reserved_chandef(struct ieee80211_local *local,
+                                   struct ieee80211_chanctx *ctx,
+                                   const struct cfg80211_chan_def *compat)
+{
+        struct ieee80211_sub_if_data *sdata;
+
+        lockdep_assert_held(&local->chanctx_mtx);
+
+        list_for_each_entry(sdata, &ctx->reserved_vifs,
+                            reserved_chanctx_list) {
+                if (!compat)
+                        compat = &sdata->reserved_chandef;
+
+                compat = cfg80211_chandef_compatible(&sdata->reserved_chandef,
+                                                     compat);
+                if (!compat)
+                        break;
+        }
+
+        return compat;
+}
+
+static const struct cfg80211_chan_def *
+ieee80211_chanctx_non_reserved_chandef(struct ieee80211_local *local,
+                                       struct ieee80211_chanctx *ctx,
+                                       const struct cfg80211_chan_def *compat)
+{
+        struct ieee80211_sub_if_data *sdata;
+
+        lockdep_assert_held(&local->chanctx_mtx);
+
+        list_for_each_entry(sdata, &ctx->assigned_vifs,
+                            assigned_chanctx_list) {
+                if (sdata->reserved_chanctx != NULL)
+                        continue;
+
+                if (!compat)
+                        compat = &sdata->vif.bss_conf.chandef;
+
+                compat = cfg80211_chandef_compatible(
+                                &sdata->vif.bss_conf.chandef, compat);
+                if (!compat)
+                        break;
+        }
+
+        return compat;
+}
+
+static const struct cfg80211_chan_def *
+ieee80211_chanctx_combined_chandef(struct ieee80211_local *local,
+                                   struct ieee80211_chanctx *ctx,
+                                   const struct cfg80211_chan_def *compat)
+{
+        lockdep_assert_held(&local->chanctx_mtx);
+
+        compat = ieee80211_chanctx_reserved_chandef(local, ctx, compat);
+        if (!compat)
+                return NULL;
+
+        compat = ieee80211_chanctx_non_reserved_chandef(local, ctx, compat);
+        if (!compat)
+                return NULL;
+
+        return compat;
+}
+
+static bool
+ieee80211_chanctx_can_reserve_chandef(struct ieee80211_local *local,
+                                      struct ieee80211_chanctx *ctx,
+                                      const struct cfg80211_chan_def *def)
+{
+        lockdep_assert_held(&local->chanctx_mtx);
+
+        if (ieee80211_chanctx_combined_chandef(local, ctx, def))
+                return true;
+
+        if (!list_empty(&ctx->reserved_vifs) &&
+            ieee80211_chanctx_reserved_chandef(local, ctx, def))
+                return true;
+
+        return false;
+}
+
+static struct ieee80211_chanctx *
+ieee80211_find_reservation_chanctx(struct ieee80211_local *local,
+                                   const struct cfg80211_chan_def *chandef,
+                                   enum ieee80211_chanctx_mode mode)
+{
+        struct ieee80211_chanctx *ctx;
+
+        lockdep_assert_held(&local->chanctx_mtx);
+
+        if (mode == IEEE80211_CHANCTX_EXCLUSIVE)
+                return NULL;
+
+        list_for_each_entry(ctx, &local->chanctx_list, list) {
+                if (ctx->mode == IEEE80211_CHANCTX_EXCLUSIVE)
+                        continue;
+
+                if (!ieee80211_chanctx_can_reserve_chandef(local, ctx,
+                                                           chandef))
+                        continue;
+
+                return ctx;
+        }
+
+        return NULL;
+}
+
 static enum nl80211_chan_width ieee80211_get_sta_bw(struct ieee80211_sta *sta)
 {
         switch (sta->bandwidth) {
@@ -190,6 +354,11 @@ ieee80211_find_chanctx(struct ieee80211_local *local,
                 if (!compat)
                         continue;
 
+                compat = ieee80211_chanctx_reserved_chandef(local, ctx,
+                                                            compat);
+                if (!compat)
+                        continue;
+
                 ieee80211_change_chanctx(local, ctx, compat);
 
                 return ctx;
@@ -217,62 +386,91 @@ static bool ieee80211_is_radar_required(struct ieee80211_local *local)
 }
 
 static struct ieee80211_chanctx *
-ieee80211_new_chanctx(struct ieee80211_local *local,
-                      const struct cfg80211_chan_def *chandef,
-                      enum ieee80211_chanctx_mode mode)
+ieee80211_alloc_chanctx(struct ieee80211_local *local,
+                        const struct cfg80211_chan_def *chandef,
+                        enum ieee80211_chanctx_mode mode)
 {
         struct ieee80211_chanctx *ctx;
-        u32 changed;
-        int err;
 
         lockdep_assert_held(&local->chanctx_mtx);
 
         ctx = kzalloc(sizeof(*ctx) + local->hw.chanctx_data_size, GFP_KERNEL);
         if (!ctx)
-                return ERR_PTR(-ENOMEM);
+                return NULL;
 
+        INIT_LIST_HEAD(&ctx->assigned_vifs);
+        INIT_LIST_HEAD(&ctx->reserved_vifs);
         ctx->conf.def = *chandef;
         ctx->conf.rx_chains_static = 1;
         ctx->conf.rx_chains_dynamic = 1;
         ctx->mode = mode;
         ctx->conf.radar_enabled = ieee80211_is_radar_required(local);
         ieee80211_recalc_chanctx_min_def(local, ctx);
+
+        return ctx;
+}
+
+static int ieee80211_add_chanctx(struct ieee80211_local *local,
+                                 struct ieee80211_chanctx *ctx)
+{
+        u32 changed;
+        int err;
+
+        lockdep_assert_held(&local->mtx);
+        lockdep_assert_held(&local->chanctx_mtx);
+
         if (!local->use_chanctx)
                 local->hw.conf.radar_enabled = ctx->conf.radar_enabled;
 
-        /* we hold the mutex to prevent idle from changing */
-        lockdep_assert_held(&local->mtx);
         /* turn idle off *before* setting channel -- some drivers need that */
         changed = ieee80211_idle_off(local);
         if (changed)
                 ieee80211_hw_config(local, changed);
 
         if (!local->use_chanctx) {
-                local->_oper_chandef = *chandef;
+                local->_oper_chandef = ctx->conf.def;
                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
         } else {
                 err = drv_add_chanctx(local, ctx);
                 if (err) {
-                        kfree(ctx);
                         ieee80211_recalc_idle(local);
-                        return ERR_PTR(err);
+                        return err;
                 }
         }
 
-        /* and keep the mutex held until the new chanctx is on the list */
-        list_add_rcu(&ctx->list, &local->chanctx_list);
+        return 0;
+}
+
+static struct ieee80211_chanctx *
+ieee80211_new_chanctx(struct ieee80211_local *local,
+                      const struct cfg80211_chan_def *chandef,
+                      enum ieee80211_chanctx_mode mode)
+{
+        struct ieee80211_chanctx *ctx;
+        int err;
+
+        lockdep_assert_held(&local->mtx);
+        lockdep_assert_held(&local->chanctx_mtx);
 
+        ctx = ieee80211_alloc_chanctx(local, chandef, mode);
+        if (!ctx)
+                return ERR_PTR(-ENOMEM);
+
+        err = ieee80211_add_chanctx(local, ctx);
+        if (err) {
+                kfree(ctx);
+                return ERR_PTR(err);
+        }
+
+        list_add_rcu(&ctx->list, &local->chanctx_list);
         return ctx;
 }
 
-static void ieee80211_free_chanctx(struct ieee80211_local *local,
-                                   struct ieee80211_chanctx *ctx)
+static void ieee80211_del_chanctx(struct ieee80211_local *local,
+                                  struct ieee80211_chanctx *ctx)
 {
-        bool check_single_channel = false;
         lockdep_assert_held(&local->chanctx_mtx);
 
-        WARN_ON_ONCE(ctx->refcount != 0);
-
         if (!local->use_chanctx) {
                 struct cfg80211_chan_def *chandef = &local->_oper_chandef;
                 chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
@@ -282,8 +480,9 @@ static void ieee80211_free_chanctx(struct ieee80211_local *local,
                 /* NOTE: Disabling radar is only valid here for
                  * single channel context. To be sure, check it ...
                  */
-                if (local->hw.conf.radar_enabled)
-                        check_single_channel = true;
+                WARN_ON(local->hw.conf.radar_enabled &&
+                        !list_empty(&local->chanctx_list));
+
                 local->hw.conf.radar_enabled = false;
 
                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
@@ -291,39 +490,19 @@ static void ieee80211_free_chanctx(struct ieee80211_local *local,
                 drv_remove_chanctx(local, ctx);
         }
 
-        list_del_rcu(&ctx->list);
-        kfree_rcu(ctx, rcu_head);
-
-        /* throw a warning if this wasn't the only channel context. */
-        WARN_ON(check_single_channel && !list_empty(&local->chanctx_list));
-
         ieee80211_recalc_idle(local);
 }
 
-static int ieee80211_assign_vif_chanctx(struct ieee80211_sub_if_data *sdata,
-                                        struct ieee80211_chanctx *ctx)
+static void ieee80211_free_chanctx(struct ieee80211_local *local,
+                                   struct ieee80211_chanctx *ctx)
 {
-        struct ieee80211_local *local = sdata->local;
-        int ret;
-
         lockdep_assert_held(&local->chanctx_mtx);
 
-        ret = drv_assign_vif_chanctx(local, sdata, ctx);
-        if (ret)
-                return ret;
-
-        rcu_assign_pointer(sdata->vif.chanctx_conf, &ctx->conf);
-        ctx->refcount++;
-
-        ieee80211_recalc_txpower(sdata);
-        ieee80211_recalc_chanctx_min_def(local, ctx);
-        sdata->vif.bss_conf.idle = false;
+        WARN_ON_ONCE(ieee80211_chanctx_refcount(local, ctx) != 0);
 
-        if (sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE &&
-            sdata->vif.type != NL80211_IFTYPE_MONITOR)
-                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_IDLE);
-
-        return 0;
+        list_del_rcu(&ctx->list);
+        ieee80211_del_chanctx(local, ctx);
+        kfree_rcu(ctx, rcu_head);
 }
 
 static void ieee80211_recalc_chanctx_chantype(struct ieee80211_local *local,
@@ -384,30 +563,58 @@ static void ieee80211_recalc_radar_chanctx(struct ieee80211_local *local,
         drv_change_chanctx(local, chanctx, IEEE80211_CHANCTX_CHANGE_RADAR);
 }
 
-static void ieee80211_unassign_vif_chanctx(struct ieee80211_sub_if_data *sdata,
-                                           struct ieee80211_chanctx *ctx)
+static int ieee80211_assign_vif_chanctx(struct ieee80211_sub_if_data *sdata,
+                                        struct ieee80211_chanctx *new_ctx)
 {
         struct ieee80211_local *local = sdata->local;
+        struct ieee80211_chanctx_conf *conf;
+        struct ieee80211_chanctx *curr_ctx = NULL;
+        int ret = 0;
 
-        lockdep_assert_held(&local->chanctx_mtx);
+        conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
+                                         lockdep_is_held(&local->chanctx_mtx));
 
-        ctx->refcount--;
-        rcu_assign_pointer(sdata->vif.chanctx_conf, NULL);
+        if (conf) {
+                curr_ctx = container_of(conf, struct ieee80211_chanctx, conf);
 
-        sdata->vif.bss_conf.idle = true;
+                drv_unassign_vif_chanctx(local, sdata, curr_ctx);
+                conf = NULL;
+                list_del(&sdata->assigned_chanctx_list);
+        }
 
-        if (sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE &&
-            sdata->vif.type != NL80211_IFTYPE_MONITOR)
-                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_IDLE);
+        if (new_ctx) {
+                ret = drv_assign_vif_chanctx(local, sdata, new_ctx);
+                if (ret)
+                        goto out;
 
-        drv_unassign_vif_chanctx(local, sdata, ctx);
+                conf = &new_ctx->conf;
+                list_add(&sdata->assigned_chanctx_list,
+                         &new_ctx->assigned_vifs);
+        }
 
-        if (ctx->refcount > 0) {
-                ieee80211_recalc_chanctx_chantype(sdata->local, ctx);
-                ieee80211_recalc_smps_chanctx(local, ctx);
-                ieee80211_recalc_radar_chanctx(local, ctx);
-                ieee80211_recalc_chanctx_min_def(local, ctx);
+out:
+        rcu_assign_pointer(sdata->vif.chanctx_conf, conf);
+
+        sdata->vif.bss_conf.idle = !conf;
+
+        if (curr_ctx && ieee80211_chanctx_num_assigned(local, curr_ctx) > 0) {
+                ieee80211_recalc_chanctx_chantype(local, curr_ctx);
+                ieee80211_recalc_smps_chanctx(local, curr_ctx);
+                ieee80211_recalc_radar_chanctx(local, curr_ctx);
+                ieee80211_recalc_chanctx_min_def(local, curr_ctx);
         }
+
+        if (new_ctx && ieee80211_chanctx_num_assigned(local, new_ctx) > 0) {
+                ieee80211_recalc_txpower(sdata);
+                ieee80211_recalc_chanctx_min_def(local, new_ctx);
+        }
+
+        if (sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE &&
+            sdata->vif.type != NL80211_IFTYPE_MONITOR)
+                ieee80211_bss_info_change_notify(sdata,
+                                                 BSS_CHANGED_IDLE);
+
+        return ret;
 }
 
 static void __ieee80211_vif_release_channel(struct ieee80211_sub_if_data *sdata)
@@ -425,8 +632,11 @@ static void __ieee80211_vif_release_channel(struct ieee80211_sub_if_data *sdata)
 
         ctx = container_of(conf, struct ieee80211_chanctx, conf);
 
-        ieee80211_unassign_vif_chanctx(sdata, ctx);
-        if (ctx->refcount == 0)
+        if (sdata->reserved_chanctx)
+                ieee80211_vif_unreserve_chanctx(sdata);
+
+        ieee80211_assign_vif_chanctx(sdata, NULL);
+        if (ieee80211_chanctx_refcount(local, ctx) == 0)
                 ieee80211_free_chanctx(local, ctx);
 }
 
@@ -526,6 +736,7 @@ int ieee80211_vif_use_channel(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_chanctx *ctx;
+        u8 radar_detect_width = 0;
         int ret;
 
         lockdep_assert_held(&local->mtx);
@@ -533,6 +744,22 @@ int ieee80211_vif_use_channel(struct ieee80211_sub_if_data *sdata,
         WARN_ON(sdata->dev && netif_carrier_ok(sdata->dev));
 
         mutex_lock(&local->chanctx_mtx);
+
+        ret = cfg80211_chandef_dfs_required(local->hw.wiphy,
+                                            chandef,
+                                            sdata->wdev.iftype);
+        if (ret < 0)
+                goto out;
+        if (ret > 0)
+                radar_detect_width = BIT(chandef->width);
+
+        sdata->radar_required = ret;
+
+        ret = ieee80211_check_combinations(sdata, chandef, mode,
+                                           radar_detect_width);
+        if (ret < 0)
+                goto out;
+
         __ieee80211_vif_release_channel(sdata);
 
         ctx = ieee80211_find_chanctx(local, chandef, mode);
@@ -548,7 +775,7 @@ int ieee80211_vif_use_channel(struct ieee80211_sub_if_data *sdata,
         ret = ieee80211_assign_vif_chanctx(sdata, ctx);
         if (ret) {
                 /* if assign fails refcount stays the same */
-                if (ctx->refcount == 0)
+                if (ieee80211_chanctx_refcount(local, ctx) == 0)
                         ieee80211_free_chanctx(local, ctx);
                 goto out;
         }
@@ -560,15 +787,47 @@ int ieee80211_vif_use_channel(struct ieee80211_sub_if_data *sdata,
         return ret;
 }
 
+static int __ieee80211_vif_change_channel(struct ieee80211_sub_if_data *sdata,
+                                          struct ieee80211_chanctx *ctx,
+                                          u32 *changed)
+{
+        struct ieee80211_local *local = sdata->local;
+        const struct cfg80211_chan_def *chandef = &sdata->csa_chandef;
+        u32 chanctx_changed = 0;
+
+        if (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
+                                     IEEE80211_CHAN_DISABLED))
+                return -EINVAL;
+
+        if (ieee80211_chanctx_refcount(local, ctx) != 1)
+                return -EINVAL;
+
+        if (sdata->vif.bss_conf.chandef.width != chandef->width) {
+                chanctx_changed = IEEE80211_CHANCTX_CHANGE_WIDTH;
+                *changed |= BSS_CHANGED_BANDWIDTH;
+        }
+
+        sdata->vif.bss_conf.chandef = *chandef;
+        ctx->conf.def = *chandef;
+
+        chanctx_changed |= IEEE80211_CHANCTX_CHANGE_CHANNEL;
+        drv_change_chanctx(local, ctx, chanctx_changed);
+
+        ieee80211_recalc_chanctx_chantype(local, ctx);
+        ieee80211_recalc_smps_chanctx(local, ctx);
+        ieee80211_recalc_radar_chanctx(local, ctx);
+        ieee80211_recalc_chanctx_min_def(local, ctx);
+
+        return 0;
+}
+
 int ieee80211_vif_change_channel(struct ieee80211_sub_if_data *sdata,
                                  u32 *changed)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_chanctx_conf *conf;
         struct ieee80211_chanctx *ctx;
-        const struct cfg80211_chan_def *chandef = &sdata->csa_chandef;
         int ret;
-        u32 chanctx_changed = 0;
 
         lockdep_assert_held(&local->mtx);
 
@@ -576,11 +835,94 @@ int ieee80211_vif_change_channel(struct ieee80211_sub_if_data *sdata,
         if (WARN_ON(!sdata->vif.csa_active))
                 return -EINVAL;
 
-        if (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
-                                     IEEE80211_CHAN_DISABLED))
+        mutex_lock(&local->chanctx_mtx);
+        conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
+                                         lockdep_is_held(&local->chanctx_mtx));
+        if (!conf) {
+                ret = -EINVAL;
+                goto out;
+        }
+
+        ctx = container_of(conf, struct ieee80211_chanctx, conf);
+
+        ret = __ieee80211_vif_change_channel(sdata, ctx, changed);
+ out:
+        mutex_unlock(&local->chanctx_mtx);
+        return ret;
+}
+
+static void
+__ieee80211_vif_copy_chanctx_to_vlans(struct ieee80211_sub_if_data *sdata,
+                                      bool clear)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_sub_if_data *vlan;
+        struct ieee80211_chanctx_conf *conf;
+
+        if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_AP))
+                return;
+
+        lockdep_assert_held(&local->mtx);
+
+        /* Check that conf exists, even when clearing this function
+         * must be called with the AP's channel context still there
+         * as it would otherwise cause VLANs to have an invalid
+         * channel context pointer for a while, possibly pointing
+         * to a channel context that has already been freed.
+         */
+        conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
+                                lockdep_is_held(&local->chanctx_mtx));
+        WARN_ON(!conf);
+
+        if (clear)
+                conf = NULL;
+
+        list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
+                rcu_assign_pointer(vlan->vif.chanctx_conf, conf);
+}
+
+void ieee80211_vif_copy_chanctx_to_vlans(struct ieee80211_sub_if_data *sdata,
+                                         bool clear)
+{
+        struct ieee80211_local *local = sdata->local;
+
+        mutex_lock(&local->chanctx_mtx);
+
+        __ieee80211_vif_copy_chanctx_to_vlans(sdata, clear);
+
+        mutex_unlock(&local->chanctx_mtx);
+}
+
+int ieee80211_vif_unreserve_chanctx(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_chanctx *ctx = sdata->reserved_chanctx;
+
+        lockdep_assert_held(&sdata->local->chanctx_mtx);
+
+        if (WARN_ON(!ctx))
                 return -EINVAL;
 
+        list_del(&sdata->reserved_chanctx_list);
+        sdata->reserved_chanctx = NULL;
+
+        if (ieee80211_chanctx_refcount(sdata->local, ctx) == 0)
+                ieee80211_free_chanctx(sdata->local, ctx);
+
+        return 0;
+}
+
+int ieee80211_vif_reserve_chanctx(struct ieee80211_sub_if_data *sdata,
+                                  const struct cfg80211_chan_def *chandef,
+                                  enum ieee80211_chanctx_mode mode,
+                                  bool radar_required)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_chanctx_conf *conf;
+        struct ieee80211_chanctx *new_ctx, *curr_ctx;
+        int ret = 0;
+
         mutex_lock(&local->chanctx_mtx);
+
         conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
                                          lockdep_is_held(&local->chanctx_mtx));
         if (!conf) {
@@ -588,30 +930,108 @@ int ieee80211_vif_change_channel(struct ieee80211_sub_if_data *sdata,
                 goto out;
         }
 
-        ctx = container_of(conf, struct ieee80211_chanctx, conf);
-        if (ctx->refcount != 1) {
+        curr_ctx = container_of(conf, struct ieee80211_chanctx, conf);
+
+        new_ctx = ieee80211_find_reservation_chanctx(local, chandef, mode);
+        if (!new_ctx) {
+                if (ieee80211_chanctx_refcount(local, curr_ctx) == 1 &&
+                    (local->hw.flags & IEEE80211_HW_CHANGE_RUNNING_CHANCTX)) {
+                        /* if we're the only users of the chanctx and
+                         * the driver supports changing a running
+                         * context, reserve our current context
+                         */
+                        new_ctx = curr_ctx;
+                } else if (ieee80211_can_create_new_chanctx(local)) {
+                        /* create a new context and reserve it */
+                        new_ctx = ieee80211_new_chanctx(local, chandef, mode);
+                        if (IS_ERR(new_ctx)) {
+                                ret = PTR_ERR(new_ctx);
+                                goto out;
+                        }
+                } else {
+                        ret = -EBUSY;
+                        goto out;
+                }
+        }
+
+        list_add(&sdata->reserved_chanctx_list, &new_ctx->reserved_vifs);
+        sdata->reserved_chanctx = new_ctx;
+        sdata->reserved_chandef = *chandef;
+        sdata->reserved_radar_required = radar_required;
+out:
+        mutex_unlock(&local->chanctx_mtx);
+        return ret;
+}
+
+int ieee80211_vif_use_reserved_context(struct ieee80211_sub_if_data *sdata,
+                                       u32 *changed)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_chanctx *ctx;
+        struct ieee80211_chanctx *old_ctx;
+        struct ieee80211_chanctx_conf *conf;
+        int ret;
+        u32 tmp_changed = *changed;
+
+        /* TODO: need to recheck if the chandef is usable etc.? */
+
+        lockdep_assert_held(&local->mtx);
+
+        mutex_lock(&local->chanctx_mtx);
+
+        ctx = sdata->reserved_chanctx;
+        if (WARN_ON(!ctx)) {
                 ret = -EINVAL;
                 goto out;
         }
 
-        if (sdata->vif.bss_conf.chandef.width != chandef->width) {
-                chanctx_changed = IEEE80211_CHANCTX_CHANGE_WIDTH;
-                *changed |= BSS_CHANGED_BANDWIDTH;
+        conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
+                                         lockdep_is_held(&local->chanctx_mtx));
+        if (!conf) {
+                ret = -EINVAL;
+                goto out;
         }
 
-        sdata->vif.bss_conf.chandef = *chandef;
-        ctx->conf.def = *chandef;
+        old_ctx = container_of(conf, struct ieee80211_chanctx, conf);
 
-        chanctx_changed |= IEEE80211_CHANCTX_CHANGE_CHANNEL;
-        drv_change_chanctx(local, ctx, chanctx_changed);
+        if (sdata->vif.bss_conf.chandef.width != sdata->reserved_chandef.width)
+                tmp_changed |= BSS_CHANGED_BANDWIDTH;
+
+        sdata->vif.bss_conf.chandef = sdata->reserved_chandef;
+
+        /* unref our reservation */
+        sdata->reserved_chanctx = NULL;
+        sdata->radar_required = sdata->reserved_radar_required;
+        list_del(&sdata->reserved_chanctx_list);
+
+        if (old_ctx == ctx) {
+                /* This is our own context, just change it */
+                ret = __ieee80211_vif_change_channel(sdata, old_ctx,
+                                                     &tmp_changed);
+                if (ret)
+                        goto out;
+        } else {
+                ret = ieee80211_assign_vif_chanctx(sdata, ctx);
+                if (ieee80211_chanctx_refcount(local, old_ctx) == 0)
+                        ieee80211_free_chanctx(local, old_ctx);
+                if (ret) {
+                        /* if assign fails refcount stays the same */
+                        if (ieee80211_chanctx_refcount(local, ctx) == 0)
+                                ieee80211_free_chanctx(local, ctx);
+                        goto out;
+                }
+
+                if (sdata->vif.type == NL80211_IFTYPE_AP)
+                        __ieee80211_vif_copy_chanctx_to_vlans(sdata, false);
+        }
+
+        *changed = tmp_changed;
 
         ieee80211_recalc_chanctx_chantype(local, ctx);
         ieee80211_recalc_smps_chanctx(local, ctx);
         ieee80211_recalc_radar_chanctx(local, ctx);
         ieee80211_recalc_chanctx_min_def(local, ctx);
-
-        ret = 0;
- out:
+out:
         mutex_unlock(&local->chanctx_mtx);
         return ret;
 }
@@ -695,40 +1115,6 @@ void ieee80211_vif_vlan_copy_chanctx(struct ieee80211_sub_if_data *sdata)
         mutex_unlock(&local->chanctx_mtx);
 }
 
-void ieee80211_vif_copy_chanctx_to_vlans(struct ieee80211_sub_if_data *sdata,
-                                         bool clear)
-{
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_sub_if_data *vlan;
-        struct ieee80211_chanctx_conf *conf;
-
-        ASSERT_RTNL();
-
-        if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_AP))
-                return;
-
-        mutex_lock(&local->chanctx_mtx);
-
-        /*
-         * Check that conf exists, even when clearing this function
-         * must be called with the AP's channel context still there
-         * as it would otherwise cause VLANs to have an invalid
-         * channel context pointer for a while, possibly pointing
-         * to a channel context that has already been freed.
-         */
-        conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
-                                lockdep_is_held(&local->chanctx_mtx));
-        WARN_ON(!conf);
-
-        if (clear)
-                conf = NULL;
-
-        list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
-                rcu_assign_pointer(vlan->vif.chanctx_conf, conf);
-
-        mutex_unlock(&local->chanctx_mtx);
-}
-
 void ieee80211_iter_chan_contexts_atomic(
         struct ieee80211_hw *hw,
         void (*iter)(struct ieee80211_hw *hw,
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index fa16e54980a1..0e963bc1ceac 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -128,7 +128,7 @@ static ssize_t sta_tx_latency_stat_write(struct file *file,
         if (!strcmp(buf, TX_LATENCY_DISABLED)) {
                 if (!tx_latency)
                         goto unlock;
-                rcu_assign_pointer(local->tx_latency, NULL);
+                RCU_INIT_POINTER(local->tx_latency, NULL);
                 synchronize_rcu();
                 kfree(tx_latency);
                 goto unlock;
diff --git a/net/mac80211/debugfs.h b/net/mac80211/debugfs.h
index 214ed4ecd739..60c35afee29d 100644
--- a/net/mac80211/debugfs.h
+++ b/net/mac80211/debugfs.h
@@ -1,6 +1,8 @@
 #ifndef __MAC80211_DEBUGFS_H
 #define __MAC80211_DEBUGFS_H
 
+#include "ieee80211_i.h"
+
 #ifdef CONFIG_MAC80211_DEBUGFS
 void debugfs_hw_add(struct ieee80211_local *local);
 int __printf(4, 5) mac80211_format_buffer(char __user *userbuf, size_t count,
diff --git a/net/mac80211/debugfs_netdev.h b/net/mac80211/debugfs_netdev.h
index 79025e79f4d6..9f5501a9a795 100644
--- a/net/mac80211/debugfs_netdev.h
+++ b/net/mac80211/debugfs_netdev.h
@@ -3,6 +3,8 @@
 #ifndef __IEEE80211_DEBUGFS_NETDEV_H
 #define __IEEE80211_DEBUGFS_NETDEV_H
 
+#include "ieee80211_i.h"
+
 #ifdef CONFIG_MAC80211_DEBUGFS
 void ieee80211_debugfs_add_netdev(struct ieee80211_sub_if_data *sdata);
 void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata);
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index fc689f5d971e..5331582a2c81 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -726,13 +726,19 @@ static inline void drv_rfkill_poll(struct ieee80211_local *local)
 }
 
 static inline void drv_flush(struct ieee80211_local *local,
+                             struct ieee80211_sub_if_data *sdata,
                              u32 queues, bool drop)
 {
+        struct ieee80211_vif *vif = sdata ? &sdata->vif : NULL;
+
         might_sleep();
 
+        if (sdata)
+                check_sdata_in_driver(sdata);
+
         trace_drv_flush(local, queues, drop);
         if (local->ops->flush)
-                local->ops->flush(&local->hw, queues, drop);
+                local->ops->flush(&local->hw, vif, queues, drop);
         trace_drv_return_void(local);
 }
 
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index c150b68436d7..15702ff64a4c 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -31,6 +31,18 @@ static void __check_htcap_disable(struct ieee80211_ht_cap *ht_capa,
         }
 }
 
+static void __check_htcap_enable(struct ieee80211_ht_cap *ht_capa,
+                                  struct ieee80211_ht_cap *ht_capa_mask,
+                                  struct ieee80211_sta_ht_cap *ht_cap,
+                                  u16 flag)
+{
+        __le16 le_flag = cpu_to_le16(flag);
+
+        if ((ht_capa_mask->cap_info & le_flag) &&
+            (ht_capa->cap_info & le_flag))
+                ht_cap->cap |= flag;
+}
+
 void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
                                      struct ieee80211_sta_ht_cap *ht_cap)
 {
@@ -59,7 +71,7 @@ void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
         smask = (u8 *)(&ht_capa_mask->mcs.rx_mask);
 
         /* NOTE:  If you add more over-rides here, update register_hw
-         * ht_capa_mod_msk logic in main.c as well.
+         * ht_capa_mod_mask logic in main.c as well.
          * And, if this method can ever change ht_cap.ht_supported, fix
          * the check in ieee80211_add_ht_ie.
          */
@@ -86,6 +98,14 @@ void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
         __check_htcap_disable(ht_capa, ht_capa_mask, ht_cap,
                               IEEE80211_HT_CAP_MAX_AMSDU);
 
+        /* Allow user to disable LDPC */
+        __check_htcap_disable(ht_capa, ht_capa_mask, ht_cap,
+                              IEEE80211_HT_CAP_LDPC_CODING);
+
+        /* Allow user to enable 40 MHz intolerant bit. */
+        __check_htcap_enable(ht_capa, ht_capa_mask, ht_cap,
+                             IEEE80211_HT_CAP_40MHZ_INTOLERANT);
+
         /* Allow user to decrease AMPDU factor */
         if (ht_capa_mask->ampdu_params_info &
             IEEE80211_HT_AMPDU_PARM_FACTOR) {
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 06d28787945b..ff4d4155a84d 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -228,7 +228,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         struct beacon_data *presp;
         enum nl80211_bss_scan_width scan_width;
         bool have_higher_than_11mbit;
-        bool radar_required = false;
+        bool radar_required;
         int err;
 
         sdata_assert_lock(sdata);
@@ -253,7 +253,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
 
         presp = rcu_dereference_protected(ifibss->presp,
                                           lockdep_is_held(&sdata->wdev.mtx));
-        rcu_assign_pointer(ifibss->presp, NULL);
+        RCU_INIT_POINTER(ifibss->presp, NULL);
         if (presp)
                 kfree_rcu(presp, rcu_head);
 
@@ -262,7 +262,8 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         /* make a copy of the chandef, it could be modified below. */
         chandef = *req_chandef;
         chan = chandef.chan;
-        if (!cfg80211_reg_can_beacon(local->hw.wiphy, &chandef)) {
+        if (!cfg80211_reg_can_beacon(local->hw.wiphy, &chandef,
+                                     NL80211_IFTYPE_ADHOC)) {
                 if (chandef.width == NL80211_CHAN_WIDTH_5 ||
                     chandef.width == NL80211_CHAN_WIDTH_10 ||
                     chandef.width == NL80211_CHAN_WIDTH_20_NOHT ||
@@ -274,7 +275,8 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
                 chandef.width = NL80211_CHAN_WIDTH_20;
                 chandef.center_freq1 = chan->center_freq;
                 /* check again for downgraded chandef */
-                if (!cfg80211_reg_can_beacon(local->hw.wiphy, &chandef)) {
+                if (!cfg80211_reg_can_beacon(local->hw.wiphy, &chandef,
+                                             NL80211_IFTYPE_ADHOC)) {
                         sdata_info(sdata,
                                    "Failed to join IBSS, beacons forbidden\n");
                         return;
@@ -282,21 +284,20 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         }
 
         err = cfg80211_chandef_dfs_required(sdata->local->hw.wiphy,
-                                            &chandef);
+                                            &chandef, NL80211_IFTYPE_ADHOC);
         if (err < 0) {
                 sdata_info(sdata,
                            "Failed to join IBSS, invalid chandef\n");
                 return;
         }
-        if (err > 0) {
-                if (!ifibss->userspace_handles_dfs) {
-                        sdata_info(sdata,
-                                   "Failed to join IBSS, DFS channel without control program\n");
-                        return;
-                }
-                radar_required = true;
+        if (err > 0 && !ifibss->userspace_handles_dfs) {
+                sdata_info(sdata,
+                           "Failed to join IBSS, DFS channel without control program\n");
+                return;
         }
 
+        radar_required = err;
+
         mutex_lock(&local->mtx);
         if (ieee80211_vif_use_channel(sdata, &chandef,
                                       ifibss->fixed_channel ?
@@ -775,7 +776,8 @@ static void ieee80211_ibss_csa_mark_radar(struct ieee80211_sub_if_data *sdata)
          * unavailable.
          */
         err = cfg80211_chandef_dfs_required(sdata->local->hw.wiphy,
-                                            &ifibss->chandef);
+                                            &ifibss->chandef,
+                                            NL80211_IFTYPE_ADHOC);
         if (err > 0)
                 cfg80211_radar_event(sdata->local->hw.wiphy, &ifibss->chandef,
                                      GFP_ATOMIC);
@@ -861,7 +863,8 @@ ieee80211_ibss_process_chanswitch(struct ieee80211_sub_if_data *sdata,
                 goto disconnect;
         }
 
-        if (!cfg80211_reg_can_beacon(sdata->local->hw.wiphy, &params.chandef)) {
+        if (!cfg80211_reg_can_beacon(sdata->local->hw.wiphy, &params.chandef,
+                                     NL80211_IFTYPE_ADHOC)) {
                 sdata_info(sdata,
                            "IBSS %pM switches to unsupported channel (%d MHz, width:%d, CF1/2: %d/%d MHz), disconnecting\n",
                            ifibss->bssid,
@@ -873,17 +876,17 @@ ieee80211_ibss_process_chanswitch(struct ieee80211_sub_if_data *sdata,
         }
 
         err = cfg80211_chandef_dfs_required(sdata->local->hw.wiphy,
-                                            &params.chandef);
+                                            &params.chandef,
+                                            NL80211_IFTYPE_ADHOC);
         if (err < 0)
                 goto disconnect;
-        if (err) {
+        if (err > 0 && !ifibss->userspace_handles_dfs) {
                 /* IBSS-DFS only allowed with a control program */
-                if (!ifibss->userspace_handles_dfs)
-                        goto disconnect;
-
-                params.radar_required = true;
+                goto disconnect;
         }
 
+        params.radar_required = err;
+
         if (cfg80211_chandef_identical(&params.chandef,
                                        &sdata->vif.bss_conf.chandef)) {
                 ibss_dbg(sdata,
@@ -1636,7 +1639,33 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
         u32 changed = 0;
         u32 rate_flags;
         struct ieee80211_supported_band *sband;
+        enum ieee80211_chanctx_mode chanmode;
+        struct ieee80211_local *local = sdata->local;
+        int radar_detect_width = 0;
         int i;
+        int ret;
+
+        ret = cfg80211_chandef_dfs_required(local->hw.wiphy,
+                                            &params->chandef,
+                                            sdata->wdev.iftype);
+        if (ret < 0)
+                return ret;
+
+        if (ret > 0) {
+                if (!params->userspace_handles_dfs)
+                        return -EINVAL;
+                radar_detect_width = BIT(params->chandef.width);
+        }
+
+        chanmode = (params->channel_fixed && !ret) ?
+                IEEE80211_CHANCTX_SHARED : IEEE80211_CHANCTX_EXCLUSIVE;
+
+        mutex_lock(&local->chanctx_mtx);
+        ret = ieee80211_check_combinations(sdata, &params->chandef, chanmode,
+                                           radar_detect_width);
+        mutex_unlock(&local->chanctx_mtx);
+        if (ret < 0)
+                return ret;
 
         if (params->bssid) {
                 memcpy(sdata->u.ibss.bssid, params->bssid, ETH_ALEN);
@@ -1651,7 +1680,7 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
 
         /* fix basic_rates if channel does not support these rates */
         rate_flags = ieee80211_chandef_rate_flags(&params->chandef);
-        sband = sdata->local->hw.wiphy->bands[params->chandef.chan->band];
+        sband = local->hw.wiphy->bands[params->chandef.chan->band];
         for (i = 0; i < sband->n_bitrates; i++) {
                 if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
                         sdata->u.ibss.basic_rates &= ~BIT(i);
@@ -1700,9 +1729,9 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
         ieee80211_bss_info_change_notify(sdata, changed);
 
         sdata->smps_mode = IEEE80211_SMPS_OFF;
-        sdata->needed_rx_chains = sdata->local->rx_chains;
+        sdata->needed_rx_chains = local->rx_chains;
 
-        ieee80211_queue_work(&sdata->local->hw, &sdata->work);
+        ieee80211_queue_work(&local->hw, &sdata->work);
 
         return 0;
 }
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 222c28b75315..b455f62d357a 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -260,7 +260,7 @@ struct ieee80211_if_ap {
 
         /* to be used after channel switch. */
         struct cfg80211_beacon_data *next_beacon;
-        struct list_head vlans;
+        struct list_head vlans; /* write-protected with RTNL and local->mtx */
 
         struct ps_data ps;
         atomic_t num_mcast_sta; /* number of stations receiving multicast */
@@ -276,7 +276,7 @@ struct ieee80211_if_wds {
 };
 
 struct ieee80211_if_vlan {
-        struct list_head list;
+        struct list_head list; /* write-protected with RTNL and local->mtx */
 
         /* used for all tx if the VLAN is configured to 4-addr mode */
         struct sta_info __rcu *sta;
@@ -691,8 +691,10 @@ struct ieee80211_chanctx {
         struct list_head list;
         struct rcu_head rcu_head;
 
+        struct list_head assigned_vifs;
+        struct list_head reserved_vifs;
+
         enum ieee80211_chanctx_mode mode;
-        int refcount;
         bool driver_present;
 
         struct ieee80211_chanctx_conf conf;
@@ -756,6 +758,14 @@ struct ieee80211_sub_if_data {
         bool csa_radar_required;
         struct cfg80211_chan_def csa_chandef;
 
+        struct list_head assigned_chanctx_list; /* protected by chanctx_mtx */
+        struct list_head reserved_chanctx_list; /* protected by chanctx_mtx */
+
+        /* context reservation -- protected with chanctx_mtx */
+        struct ieee80211_chanctx *reserved_chanctx;
+        struct cfg80211_chan_def reserved_chandef;
+        bool reserved_radar_required;
+
         /* used to reconfigure hardware SM PS */
         struct work_struct recalc_smps;
 
@@ -1771,6 +1781,16 @@ ieee80211_vif_use_channel(struct ieee80211_sub_if_data *sdata,
                           const struct cfg80211_chan_def *chandef,
                           enum ieee80211_chanctx_mode mode);
 int __must_check
+ieee80211_vif_reserve_chanctx(struct ieee80211_sub_if_data *sdata,
+                              const struct cfg80211_chan_def *chandef,
+                              enum ieee80211_chanctx_mode mode,
+                              bool radar_required);
+int __must_check
+ieee80211_vif_use_reserved_context(struct ieee80211_sub_if_data *sdata,
+                                   u32 *changed);
+int ieee80211_vif_unreserve_chanctx(struct ieee80211_sub_if_data *sdata);
+
+int __must_check
 ieee80211_vif_change_bandwidth(struct ieee80211_sub_if_data *sdata,
                                const struct cfg80211_chan_def *chandef,
                                u32 *changed);
@@ -1782,6 +1802,8 @@ void ieee80211_vif_release_channel(struct ieee80211_sub_if_data *sdata);
 void ieee80211_vif_vlan_copy_chanctx(struct ieee80211_sub_if_data *sdata);
 void ieee80211_vif_copy_chanctx_to_vlans(struct ieee80211_sub_if_data *sdata,
                                          bool clear);
+int ieee80211_chanctx_refcount(struct ieee80211_local *local,
+                               struct ieee80211_chanctx *ctx);
 
 void ieee80211_recalc_smps_chanctx(struct ieee80211_local *local,
                                    struct ieee80211_chanctx *chanctx);
@@ -1805,6 +1827,11 @@ int ieee80211_cs_headroom(struct ieee80211_local *local,
                           enum nl80211_iftype iftype);
 void ieee80211_recalc_dtim(struct ieee80211_local *local,
                            struct ieee80211_sub_if_data *sdata);
+int ieee80211_check_combinations(struct ieee80211_sub_if_data *sdata,
+                                 const struct cfg80211_chan_def *chandef,
+                                 enum ieee80211_chanctx_mode chanmode,
+                                 u8 radar_detect);
+int ieee80211_max_num_channels(struct ieee80211_local *local);
 
 #ifdef CONFIG_MAC80211_NOINLINE
 #define debug_noinline noinline
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index b8d331e7d883..7fff3dcaac43 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -250,6 +250,7 @@ static int ieee80211_check_concurrent_iface(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_sub_if_data *nsdata;
+        int ret;
 
         ASSERT_RTNL();
 
@@ -300,7 +301,10 @@ static int ieee80211_check_concurrent_iface(struct ieee80211_sub_if_data *sdata,
                 }
         }
 
-        return 0;
+        mutex_lock(&local->chanctx_mtx);
+        ret = ieee80211_check_combinations(sdata, NULL, 0, 0);
+        mutex_unlock(&local->chanctx_mtx);
+        return ret;
 }
 
 static int ieee80211_check_queues(struct ieee80211_sub_if_data *sdata,
@@ -423,7 +427,7 @@ int ieee80211_add_virtual_monitor(struct ieee80211_local *local)
         mutex_unlock(&local->mtx);
         if (ret) {
                 mutex_lock(&local->iflist_mtx);
-                rcu_assign_pointer(local->monitor_sdata, NULL);
+                RCU_INIT_POINTER(local->monitor_sdata, NULL);
                 mutex_unlock(&local->iflist_mtx);
                 synchronize_net();
                 drv_remove_interface(local, sdata);
@@ -452,7 +456,7 @@ void ieee80211_del_virtual_monitor(struct ieee80211_local *local)
                 return;
         }
 
-        rcu_assign_pointer(local->monitor_sdata, NULL);
+        RCU_INIT_POINTER(local->monitor_sdata, NULL);
         mutex_unlock(&local->iflist_mtx);
 
         synchronize_net();
@@ -492,7 +496,9 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
                 if (!sdata->bss)
                         return -ENOLINK;
 
+                mutex_lock(&local->mtx);
                 list_add(&sdata->u.vlan.list, &sdata->bss->vlans);
+                mutex_unlock(&local->mtx);
 
                 master = container_of(sdata->bss,
                                       struct ieee80211_sub_if_data, u.ap);
@@ -722,8 +728,11 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
                 drv_stop(local);
  err_del_bss:
         sdata->bss = NULL;
-        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
+                mutex_lock(&local->mtx);
                 list_del(&sdata->u.vlan.list);
+                mutex_unlock(&local->mtx);
+        }
         /* might already be clear but that doesn't matter */
         clear_bit(SDATA_STATE_RUNNING, &sdata->state);
         return res;
@@ -875,8 +884,10 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
 
         switch (sdata->vif.type) {
         case NL80211_IFTYPE_AP_VLAN:
+                mutex_lock(&local->mtx);
                 list_del(&sdata->u.vlan.list);
-                rcu_assign_pointer(sdata->vif.chanctx_conf, NULL);
+                mutex_unlock(&local->mtx);
+                RCU_INIT_POINTER(sdata->vif.chanctx_conf, NULL);
                 /* no need to tell driver */
                 break;
         case NL80211_IFTYPE_MONITOR:
@@ -895,7 +906,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                 break;
         case NL80211_IFTYPE_P2P_DEVICE:
                 /* relies on synchronize_rcu() below */
-                rcu_assign_pointer(local->p2p_sdata, NULL);
+                RCU_INIT_POINTER(local->p2p_sdata, NULL);
                 /* fall through */
         default:
                 cancel_work_sync(&sdata->work);
@@ -1280,6 +1291,8 @@ static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
         INIT_WORK(&sdata->work, ieee80211_iface_work);
         INIT_WORK(&sdata->recalc_smps, ieee80211_recalc_smps_work);
         INIT_WORK(&sdata->csa_finalize_work, ieee80211_csa_finalize_work);
+        INIT_LIST_HEAD(&sdata->assigned_chanctx_list);
+        INIT_LIST_HEAD(&sdata->reserved_chanctx_list);
 
         switch (type) {
         case NL80211_IFTYPE_P2P_GO:
@@ -1774,20 +1787,19 @@ static int netdev_notify(struct notifier_block *nb,
         struct ieee80211_sub_if_data *sdata;
 
         if (state != NETDEV_CHANGENAME)
-                return 0;
+                return NOTIFY_DONE;
 
         if (!dev->ieee80211_ptr || !dev->ieee80211_ptr->wiphy)
-                return 0;
+                return NOTIFY_DONE;
 
         if (dev->ieee80211_ptr->wiphy->privid != mac80211_wiphy_privid)
-                return 0;
+                return NOTIFY_DONE;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
         memcpy(sdata->name, dev->name, IFNAMSIZ);
-
         ieee80211_debugfs_rename_netdev(sdata);
-        return 0;
+
+        return NOTIFY_OK;
 }
 
 static struct notifier_block mac80211_netdev_notifier = {
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 4c1bf61bc778..27b9364cdf17 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -340,7 +340,7 @@ static int ieee80211_ifa_changed(struct notifier_block *nb,
 
         sdata_unlock(sdata);
 
-        return NOTIFY_DONE;
+        return NOTIFY_OK;
 }
 #endif
 
@@ -371,7 +371,7 @@ static int ieee80211_ifa6_changed(struct notifier_block *nb,
 
         drv_ipv6_addr_change(local, sdata, idev);
 
-        return NOTIFY_DONE;
+        return NOTIFY_OK;
 }
 #endif
 
@@ -446,7 +446,9 @@ static const struct ieee80211_ht_cap mac80211_ht_capa_mod_mask = {
         .cap_info = cpu_to_le16(IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
                                 IEEE80211_HT_CAP_MAX_AMSDU |
                                 IEEE80211_HT_CAP_SGI_20 |
-                                IEEE80211_HT_CAP_SGI_40),
+                                IEEE80211_HT_CAP_SGI_40 |
+                                IEEE80211_HT_CAP_LDPC_CODING |
+                                IEEE80211_HT_CAP_40MHZ_INTOLERANT),
         .mcs = {
                 .rx_mask = { 0xff, 0xff, 0xff, 0xff, 0xff,
                              0xff, 0xff, 0xff, 0xff, 0xff, },
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index f70e9cd10552..b06ddc9519ce 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -366,20 +366,15 @@ int mesh_add_rsn_ie(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
                 return 0;
 
         /* find RSN IE */
-        data = ifmsh->ie;
-        while (data < ifmsh->ie + ifmsh->ie_len) {
-                if (*data == WLAN_EID_RSN) {
-                        len = data[1] + 2;
-                        break;
-                }
-                data++;
-        }
+        data = cfg80211_find_ie(WLAN_EID_RSN, ifmsh->ie, ifmsh->ie_len);
+        if (!data)
+                return 0;
 
-        if (len) {
-                if (skb_tailroom(skb) < len)
-                        return -ENOMEM;
-                memcpy(skb_put(skb, len), data, len);
-        }
+        len = data[1] + 2;
+
+        if (skb_tailroom(skb) < len)
+                return -ENOMEM;
+        memcpy(skb_put(skb, len), data, len);
 
         return 0;
 }
@@ -829,7 +824,7 @@ void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED);
         bcn = rcu_dereference_protected(ifmsh->beacon,
                                         lockdep_is_held(&sdata->wdev.mtx));
-        rcu_assign_pointer(ifmsh->beacon, NULL);
+        RCU_INIT_POINTER(ifmsh->beacon, NULL);
         kfree_rcu(bcn, rcu_head);
 
         /* flush STAs and mpaths on this iface */
@@ -903,14 +898,15 @@ ieee80211_mesh_process_chnswitch(struct ieee80211_sub_if_data *sdata,
         }
 
         err = cfg80211_chandef_dfs_required(sdata->local->hw.wiphy,
-                                            &params.chandef);
+                                            &params.chandef,
+                                            NL80211_IFTYPE_MESH_POINT);
         if (err < 0)
                 return false;
-        if (err) {
-                params.radar_required = true;
+        if (err > 0)
                 /* TODO: DFS not (yet) supported */
                 return false;
-        }
+
+        params.radar_required = err;
 
         if (cfg80211_chandef_identical(&params.chandef,
                                        &sdata->vif.bss_conf.chandef)) {
@@ -1068,7 +1064,7 @@ int ieee80211_mesh_finish_csa(struct ieee80211_sub_if_data *sdata)
 
         /* Remove the CSA and MCSP elements from the beacon */
         tmp_csa_settings = rcu_dereference(ifmsh->csa);
-        rcu_assign_pointer(ifmsh->csa, NULL);
+        RCU_INIT_POINTER(ifmsh->csa, NULL);
         if (tmp_csa_settings)
                 kfree_rcu(tmp_csa_settings, rcu_head);
         ret = ieee80211_mesh_rebuild_beacon(sdata);
@@ -1102,7 +1098,7 @@ int ieee80211_mesh_csa_beacon(struct ieee80211_sub_if_data *sdata,
         ret = ieee80211_mesh_rebuild_beacon(sdata);
         if (ret) {
                 tmp_csa_settings = rcu_dereference(ifmsh->csa);
-                rcu_assign_pointer(ifmsh->csa, NULL);
+                RCU_INIT_POINTER(ifmsh->csa, NULL);
                 kfree_rcu(tmp_csa_settings, rcu_head);
                 return ret;
         }
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index f9514685d45a..94758b9c9ed4 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -37,7 +37,7 @@ static inline u32 u32_field_get(const u8 *preq_elem, int offset, bool ae)
         return get_unaligned_le32(preq_elem + offset);
 }
 
-static inline u32 u16_field_get(const u8 *preq_elem, int offset, bool ae)
+static inline u16 u16_field_get(const u8 *preq_elem, int offset, bool ae)
 {
         if (ae)
                 offset += 6;
@@ -544,9 +544,10 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
                 if (time_after(jiffies, ifmsh->last_sn_update +
                                         net_traversal_jiffies(sdata)) ||
                     time_before(jiffies, ifmsh->last_sn_update)) {
-                        target_sn = ++ifmsh->sn;
+                        ++ifmsh->sn;
                         ifmsh->last_sn_update = jiffies;
                 }
+                target_sn = ifmsh->sn;
         } else if (is_broadcast_ether_addr(target_addr) &&
                    (target_flags & IEEE80211_PREQ_TO_FLAG)) {
                 rcu_read_lock();
diff --git a/net/mac80211/michael.h b/net/mac80211/michael.h
index 3b848dad9587..0e4886f881f1 100644
--- a/net/mac80211/michael.h
+++ b/net/mac80211/michael.h
@@ -11,6 +11,7 @@
 #define MICHAEL_H
 
 #include <linux/types.h>
+#include <linux/ieee80211.h>
 
 #define MICHAEL_MIC_LEN 8
 
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index dee50aefd6e8..488826f188a7 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1089,7 +1089,7 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
         }
         chanctx = container_of(rcu_access_pointer(sdata->vif.chanctx_conf),
                                struct ieee80211_chanctx, conf);
-        if (chanctx->refcount > 1) {
+        if (ieee80211_chanctx_refcount(local, chanctx) > 1) {
                 sdata_info(sdata,
                            "channel switch with multiple interfaces on the same channel, disconnecting\n");
                 ieee80211_queue_work(&local->hw,
@@ -3701,7 +3701,7 @@ int ieee80211_max_network_latency(struct notifier_block *nb,
         ieee80211_recalc_ps(local, latency_usec);
         mutex_unlock(&local->iflist_mtx);
 
-        return 0;
+        return NOTIFY_OK;
 }
 
 static u8 ieee80211_ht_vht_rx_chains(struct ieee80211_sub_if_data *sdata,
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 216c45b949e5..394e201cde6d 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -54,24 +54,25 @@ static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
         return skb;
 }
 
-static inline int should_drop_frame(struct sk_buff *skb, int present_fcs_len)
+static inline bool should_drop_frame(struct sk_buff *skb, int present_fcs_len)
 {
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
-        struct ieee80211_hdr *hdr;
-
-        hdr = (void *)(skb->data);
+        struct ieee80211_hdr *hdr = (void *)skb->data;
 
         if (status->flag & (RX_FLAG_FAILED_FCS_CRC |
                             RX_FLAG_FAILED_PLCP_CRC |
                             RX_FLAG_AMPDU_IS_ZEROLEN))
-                return 1;
+                return true;
+
         if (unlikely(skb->len < 16 + present_fcs_len))
-                return 1;
+                return true;
+
         if (ieee80211_is_ctl(hdr->frame_control) &&
             !ieee80211_is_pspoll(hdr->frame_control) &&
             !ieee80211_is_back_req(hdr->frame_control))
-                return 1;
-        return 0;
+                return true;
+
+        return false;
 }
 
 static int
@@ -1231,7 +1232,8 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
                 if (ether_addr_equal(bssid, rx->sdata->u.ibss.bssid) &&
                     test_sta_flag(sta, WLAN_STA_AUTHORIZED)) {
                         sta->last_rx = jiffies;
-                        if (ieee80211_is_data(hdr->frame_control)) {
+                        if (ieee80211_is_data(hdr->frame_control) &&
+                            !is_multicast_ether_addr(hdr->addr1)) {
                                 sta->last_rx_rate_idx = status->rate_idx;
                                 sta->last_rx_rate_flag = status->flag;
                                 sta->last_rx_rate_vht_flag = status->vht_flag;
@@ -3190,7 +3192,7 @@ static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
 }
 
 /*
- * This is the actual Rx frames handler. as it blongs to Rx path it must
+ * This is the actual Rx frames handler. as it belongs to Rx path it must
  * be called with rcu_read_lock protection.
  */
 static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 3ce7f2c8539a..28185c8dc19a 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -309,7 +309,7 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
         if (local->scan_req != local->int_scan_req)
                 cfg80211_scan_done(local->scan_req, aborted);
         local->scan_req = NULL;
-        rcu_assign_pointer(local->scan_sdata, NULL);
+        RCU_INIT_POINTER(local->scan_sdata, NULL);
 
         local->scanning = 0;
         local->scan_chandef.chan = NULL;
@@ -559,7 +559,7 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
                 ieee80211_recalc_idle(local);
 
                 local->scan_req = NULL;
-                rcu_assign_pointer(local->scan_sdata, NULL);
+                RCU_INIT_POINTER(local->scan_sdata, NULL);
         }
 
         return rc;
@@ -773,7 +773,7 @@ void ieee80211_scan_work(struct work_struct *work)
                 int rc;
 
                 local->scan_req = NULL;
-                rcu_assign_pointer(local->scan_sdata, NULL);
+                RCU_INIT_POINTER(local->scan_sdata, NULL);
 
                 rc = __ieee80211_start_scan(sdata, req);
                 if (rc) {
@@ -1014,7 +1014,7 @@ out_free:
 
         if (ret) {
                 /* Clean in case of failure after HW restart or upon resume. */
-                rcu_assign_pointer(local->sched_scan_sdata, NULL);
+                RCU_INIT_POINTER(local->sched_scan_sdata, NULL);
                 local->sched_scan_req = NULL;
         }
 
@@ -1089,7 +1089,7 @@ void ieee80211_sched_scan_stopped_work(struct work_struct *work)
                 return;
         }
 
-        rcu_assign_pointer(local->sched_scan_sdata, NULL);
+        RCU_INIT_POINTER(local->sched_scan_sdata, NULL);
 
         /* If sched scan was aborted by the driver. */
         local->sched_scan_req = NULL;
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 137a192e64bc..632d372bb511 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -552,7 +552,7 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU)
 int sta_info_insert_rcu(struct sta_info *sta) __acquires(RCU)
 {
         struct ieee80211_local *local = sta->local;
-        int err = 0;
+        int err;
 
         might_sleep();
 
@@ -570,7 +570,6 @@ int sta_info_insert_rcu(struct sta_info *sta) __acquires(RCU)
 
         return 0;
  out_free:
-        BUG_ON(!err);
         sta_info_free(local, sta);
         return err;
 }
@@ -1148,7 +1147,8 @@ void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
         atomic_dec(&ps->num_sta_ps);
 
         /* This station just woke up and isn't aware of our SMPS state */
-        if (!ieee80211_smps_is_restrictive(sta->known_smps_mode,
+        if (!ieee80211_vif_is_mesh(&sdata->vif) &&
+            !ieee80211_smps_is_restrictive(sta->known_smps_mode,
                                            sdata->smps_mode) &&
             sta->known_smps_mode != sdata->bss->req_smps &&
             sta_info_tx_streams(sta) != 1) {
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 00ba90b02ab2..60cb7a665976 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -314,10 +314,9 @@ ieee80211_add_tx_radiotap_header(struct ieee80211_local *local,
             !is_multicast_ether_addr(hdr->addr1))
                 txflags |= IEEE80211_RADIOTAP_F_TX_FAIL;
 
-        if ((info->status.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS) ||
-            (info->status.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT))
+        if (info->status.rates[0].flags & IEEE80211_TX_RC_USE_CTS_PROTECT)
                 txflags |= IEEE80211_RADIOTAP_F_TX_CTS;
-        else if (info->status.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS)
+        if (info->status.rates[0].flags & IEEE80211_TX_RC_USE_RTS_CTS)
                 txflags |= IEEE80211_RADIOTAP_F_TX_RTS;
 
         put_unaligned_le16(txflags, pos);
diff --git a/net/mac80211/trace.h b/net/mac80211/trace.h
index a0b0aea76525..cec5b60487a4 100644
--- a/net/mac80211/trace.h
+++ b/net/mac80211/trace.h
@@ -21,10 +21,10 @@
 
 #define VIF_ENTRY       __field(enum nl80211_iftype, vif_type) __field(void *, sdata)   \
                         __field(bool, p2p)                                              \
-                        __string(vif_name, sdata->dev ? sdata->dev->name : "<nodev>")
+                        __string(vif_name, sdata->name)
 #define VIF_ASSIGN      __entry->vif_type = sdata->vif.type; __entry->sdata = sdata;    \
                         __entry->p2p = sdata->vif.p2p;                                  \
-                        __assign_str(vif_name, sdata->dev ? sdata->dev->name : sdata->name)
+                        __assign_str(vif_name, sdata->name)
 #define VIF_PR_FMT      " vif:%s(%d%s)"
 #define VIF_PR_ARG      __get_str(vif_name), __entry->vif_type, __entry->p2p ? "/p2p" : ""
 
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 275c94f995f7..c08bd4aca6bb 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -554,7 +554,7 @@ void ieee80211_flush_queues(struct ieee80211_local *local,
         ieee80211_stop_queues_by_reason(&local->hw, IEEE80211_MAX_QUEUE_MAP,
                                         IEEE80211_QUEUE_STOP_REASON_FLUSH);
 
-        drv_flush(local, queues, false);
+        drv_flush(local, sdata, queues, false);
 
         ieee80211_wake_queues_by_reason(&local->hw, IEEE80211_MAX_QUEUE_MAP,
                                         IEEE80211_QUEUE_STOP_REASON_FLUSH);
@@ -1546,7 +1546,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                 WARN_ON(local->resuming);
                 res = drv_add_interface(local, sdata);
                 if (WARN_ON(res)) {
-                        rcu_assign_pointer(local->monitor_sdata, NULL);
+                        RCU_INIT_POINTER(local->monitor_sdata, NULL);
                         synchronize_net();
                         kfree(sdata);
                 }
@@ -1565,17 +1565,17 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                 list_for_each_entry(ctx, &local->chanctx_list, list)
                         WARN_ON(drv_add_chanctx(local, ctx));
                 mutex_unlock(&local->chanctx_mtx);
-        }
 
-        list_for_each_entry(sdata, &local->interfaces, list) {
-                if (!ieee80211_sdata_running(sdata))
-                        continue;
-                ieee80211_assign_chanctx(local, sdata);
-        }
+                list_for_each_entry(sdata, &local->interfaces, list) {
+                        if (!ieee80211_sdata_running(sdata))
+                                continue;
+                        ieee80211_assign_chanctx(local, sdata);
+                }
 
-        sdata = rtnl_dereference(local->monitor_sdata);
-        if (sdata && ieee80211_sdata_running(sdata))
-                ieee80211_assign_chanctx(local, sdata);
+                sdata = rtnl_dereference(local->monitor_sdata);
+                if (sdata && ieee80211_sdata_running(sdata))
+                        ieee80211_assign_chanctx(local, sdata);
+        }
 
         /* add STAs back */
         mutex_lock(&local->sta_mtx);
@@ -1671,13 +1671,10 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                         }
                         break;
                 case NL80211_IFTYPE_WDS:
-                        break;
                 case NL80211_IFTYPE_AP_VLAN:
                 case NL80211_IFTYPE_MONITOR:
-                        /* ignore virtual */
-                        break;
                 case NL80211_IFTYPE_P2P_DEVICE:
-                        changed = BSS_CHANGED_IDLE;
+                        /* nothing to do */
                         break;
                 case NL80211_IFTYPE_UNSPECIFIED:
                 case NUM_NL80211_IFTYPES:
@@ -1780,7 +1777,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
         mutex_unlock(&local->mtx);
 
         if (sched_scan_stopped)
-                cfg80211_sched_scan_stopped(local->hw.wiphy);
+                cfg80211_sched_scan_stopped_rtnl(local->hw.wiphy);
 
         /*
          * If this is for hw restart things are still running.
@@ -2797,3 +2794,121 @@ void ieee80211_recalc_dtim(struct ieee80211_local *local,
 
         ps->dtim_count = dtim_count;
 }
+
+int ieee80211_check_combinations(struct ieee80211_sub_if_data *sdata,
+                                 const struct cfg80211_chan_def *chandef,
+                                 enum ieee80211_chanctx_mode chanmode,
+                                 u8 radar_detect)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_sub_if_data *sdata_iter;
+        enum nl80211_iftype iftype = sdata->wdev.iftype;
+        int num[NUM_NL80211_IFTYPES];
+        struct ieee80211_chanctx *ctx;
+        int num_different_channels = 0;
+        int total = 1;
+
+        lockdep_assert_held(&local->chanctx_mtx);
+
+        if (WARN_ON(hweight32(radar_detect) > 1))
+                return -EINVAL;
+
+        if (WARN_ON(chandef && chanmode == IEEE80211_CHANCTX_SHARED &&
+                    !chandef->chan))
+                return -EINVAL;
+
+        if (chandef)
+                num_different_channels = 1;
+
+        if (WARN_ON(iftype >= NUM_NL80211_IFTYPES))
+                return -EINVAL;
+
+        /* Always allow software iftypes */
+        if (local->hw.wiphy->software_iftypes & BIT(iftype)) {
+                if (radar_detect)
+                        return -EINVAL;
+                return 0;
+        }
+
+        memset(num, 0, sizeof(num));
+
+        if (iftype != NL80211_IFTYPE_UNSPECIFIED)
+                num[iftype] = 1;
+
+        list_for_each_entry(ctx, &local->chanctx_list, list) {
+                if (ctx->conf.radar_enabled)
+                        radar_detect |= BIT(ctx->conf.def.width);
+                if (ctx->mode == IEEE80211_CHANCTX_EXCLUSIVE) {
+                        num_different_channels++;
+                        continue;
+                }
+                if (chandef && chanmode == IEEE80211_CHANCTX_SHARED &&
+                    cfg80211_chandef_compatible(chandef,
+                                                &ctx->conf.def))
+                        continue;
+                num_different_channels++;
+        }
+
+        list_for_each_entry_rcu(sdata_iter, &local->interfaces, list) {
+                struct wireless_dev *wdev_iter;
+
+                wdev_iter = &sdata_iter->wdev;
+
+                if (sdata_iter == sdata ||
+                    rcu_access_pointer(sdata_iter->vif.chanctx_conf) == NULL ||
+                    local->hw.wiphy->software_iftypes & BIT(wdev_iter->iftype))
+                        continue;
+
+                num[wdev_iter->iftype]++;
+                total++;
+        }
+
+        if (total == 1 && !radar_detect)
+                return 0;
+
+        return cfg80211_check_combinations(local->hw.wiphy,
+                                           num_different_channels,
+                                           radar_detect, num);
+}
+
+static void
+ieee80211_iter_max_chans(const struct ieee80211_iface_combination *c,
+                         void *data)
+{
+        u32 *max_num_different_channels = data;
+
+        *max_num_different_channels = max(*max_num_different_channels,
+                                          c->num_different_channels);
+}
+
+int ieee80211_max_num_channels(struct ieee80211_local *local)
+{
+        struct ieee80211_sub_if_data *sdata;
+        int num[NUM_NL80211_IFTYPES] = {};
+        struct ieee80211_chanctx *ctx;
+        int num_different_channels = 0;
+        u8 radar_detect = 0;
+        u32 max_num_different_channels = 1;
+        int err;
+
+        lockdep_assert_held(&local->chanctx_mtx);
+
+        list_for_each_entry(ctx, &local->chanctx_list, list) {
+                num_different_channels++;
+
+                if (ctx->conf.radar_enabled)
+                        radar_detect |= BIT(ctx->conf.def.width);
+        }
+
+        list_for_each_entry_rcu(sdata, &local->interfaces, list)
+                num[sdata->wdev.iftype]++;
+
+        err = cfg80211_iter_combinations(local->hw.wiphy,
+                                         num_different_channels, radar_detect,
+                                         num, ieee80211_iter_max_chans,
+                                         &max_num_different_channels);
+        if (err < 0)
+                return err;
+
+        return max_num_different_channels;
+}
diff --git a/net/mac80211/vht.c b/net/mac80211/vht.c
index e9e36a256165..9265adfdabfc 100644
--- a/net/mac80211/vht.c
+++ b/net/mac80211/vht.c
@@ -129,9 +129,12 @@ ieee80211_vht_cap_ie_to_sta_vht_cap(struct ieee80211_sub_if_data *sdata,
         if (!vht_cap_ie || !sband->vht_cap.vht_supported)
                 return;
 
-        /* A VHT STA must support 40 MHz */
-        if (!(sta->sta.ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40))
-                return;
+        /*
+         * A VHT STA must support 40 MHz, but if we verify that here
+         * then we break a few things - some APs (e.g. Netgear R6300v2
+         * and others based on the BCM4360 chipset) will unset this
+         * capability bit when operating in 20 MHz.
+         */
 
         vht_cap->vht_supported = true;
 
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index b8600e3c29c8..9b3dcc201145 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -406,7 +406,10 @@ static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
 
         if (info->control.hw_key &&
             !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_GENERATE_IV) &&
-            !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)) {
+            !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) &&
+            !((info->control.hw_key->flags &
+               IEEE80211_KEY_FLAG_GENERATE_IV_MGMT) &&
+              ieee80211_is_mgmt(hdr->frame_control))) {
                 /*
                  * hwaccel has no need for preallocated room for CCMP
                  * header or MIC fields
diff --git a/net/rfkill/rfkill-gpio.c b/net/rfkill/rfkill-gpio.c
index bd2a5b90400c..9c4a5eb91cbf 100644
--- a/net/rfkill/rfkill-gpio.c
+++ b/net/rfkill/rfkill-gpio.c
@@ -36,8 +36,6 @@ struct rfkill_gpio_data {
         struct gpio_desc        *shutdown_gpio;
 
         struct rfkill           *rfkill_dev;
-        char                    *reset_name;
-        char                    *shutdown_name;
         struct clk              *clk;
 
         bool                    clk_enabled;
@@ -87,10 +85,8 @@ static int rfkill_gpio_probe(struct platform_device *pdev)
 {
         struct rfkill_gpio_platform_data *pdata = pdev->dev.platform_data;
         struct rfkill_gpio_data *rfkill;
-        const char *clk_name = NULL;
         struct gpio_desc *gpio;
         int ret;
-        int len;
 
         rfkill = devm_kzalloc(&pdev->dev, sizeof(*rfkill), GFP_KERNEL);
         if (!rfkill)
@@ -101,28 +97,15 @@ static int rfkill_gpio_probe(struct platform_device *pdev)
                 if (ret)
                         return ret;
         } else if (pdata) {
-                clk_name = pdata->power_clk_name;
                 rfkill->name = pdata->name;
                 rfkill->type = pdata->type;
         } else {
                 return -ENODEV;
         }
 
-        len = strlen(rfkill->name);
-        rfkill->reset_name = devm_kzalloc(&pdev->dev, len + 7, GFP_KERNEL);
-        if (!rfkill->reset_name)
-                return -ENOMEM;
-
-        rfkill->shutdown_name = devm_kzalloc(&pdev->dev, len + 10, GFP_KERNEL);
-        if (!rfkill->shutdown_name)
-                return -ENOMEM;
-
-        snprintf(rfkill->reset_name, len + 6 , "%s_reset", rfkill->name);
-        snprintf(rfkill->shutdown_name, len + 9, "%s_shutdown", rfkill->name);
-
-        rfkill->clk = devm_clk_get(&pdev->dev, clk_name);
+        rfkill->clk = devm_clk_get(&pdev->dev, NULL);
 
-        gpio = devm_gpiod_get_index(&pdev->dev, rfkill->reset_name, 0);
+        gpio = devm_gpiod_get_index(&pdev->dev, "reset", 0);
         if (!IS_ERR(gpio)) {
                 ret = gpiod_direction_output(gpio, 0);
                 if (ret)
@@ -130,7 +113,7 @@ static int rfkill_gpio_probe(struct platform_device *pdev)
                 rfkill->reset_gpio = gpio;
         }
 
-        gpio = devm_gpiod_get_index(&pdev->dev, rfkill->shutdown_name, 1);
+        gpio = devm_gpiod_get_index(&pdev->dev, "shutdown", 1);
         if (!IS_ERR(gpio)) {
                 ret = gpiod_direction_output(gpio, 0);
                 if (ret)
@@ -146,14 +129,6 @@ static int rfkill_gpio_probe(struct platform_device *pdev)
                 return -EINVAL;
         }
 
-        if (pdata && pdata->gpio_runtime_setup) {
-                ret = pdata->gpio_runtime_setup(pdev);
-                if (ret) {
-                        dev_err(&pdev->dev, "can't set up gpio\n");
-                        return ret;
-                }
-        }
-
         rfkill->rfkill_dev = rfkill_alloc(rfkill->name, &pdev->dev,
                                           rfkill->type, &rfkill_gpio_ops,
                                           rfkill);
@@ -174,20 +149,23 @@ static int rfkill_gpio_probe(struct platform_device *pdev)
 static int rfkill_gpio_remove(struct platform_device *pdev)
 {
         struct rfkill_gpio_data *rfkill = platform_get_drvdata(pdev);
-        struct rfkill_gpio_platform_data *pdata = pdev->dev.platform_data;
 
-        if (pdata && pdata->gpio_runtime_close)
-                pdata->gpio_runtime_close(pdev);
         rfkill_unregister(rfkill->rfkill_dev);
         rfkill_destroy(rfkill->rfkill_dev);
 
         return 0;
 }
 
+#ifdef CONFIG_ACPI
 static const struct acpi_device_id rfkill_acpi_match[] = {
+        { "BCM2E1A", RFKILL_TYPE_BLUETOOTH },
+        { "BCM2E39", RFKILL_TYPE_BLUETOOTH },
+        { "BCM2E3D", RFKILL_TYPE_BLUETOOTH },
         { "BCM4752", RFKILL_TYPE_GPS },
+        { "LNV4752", RFKILL_TYPE_GPS },
         { },
 };
+#endif
 
 static struct platform_driver rfkill_gpio_driver = {
         .probe = rfkill_gpio_probe,
diff --git a/net/wireless/Kconfig b/net/wireless/Kconfig
index 16d08b399210..405f3c4cf70c 100644
--- a/net/wireless/Kconfig
+++ b/net/wireless/Kconfig
@@ -95,6 +95,43 @@ config CFG80211_CERTIFICATION_ONUS
           you are a wireless researcher and are working in a controlled
           and approved environment by your local regulatory agency.
 
+config CFG80211_REG_CELLULAR_HINTS
+        bool "cfg80211 regulatory support for cellular base station hints"
+        depends on CFG80211_CERTIFICATION_ONUS
+        ---help---
+          This option enables support for parsing regulatory hints
+          from cellular base stations. If enabled and at least one driver
+          claims support for parsing cellular base station hints the
+          regulatory core will allow and parse these regulatory hints.
+          The regulatory core will only apply these regulatory hints on
+          drivers that support this feature. You should only enable this
+          feature if you have tested and validated this feature on your
+          systems.
+
+config CFG80211_REG_RELAX_NO_IR
+        bool "cfg80211 support for NO_IR relaxation"
+        depends on CFG80211_CERTIFICATION_ONUS
+        ---help---
+         This option enables support for relaxation of the NO_IR flag for
+         situations that certain regulatory bodies have provided clarifications
+         on how relaxation can occur. This feature has an inherent dependency on
+         userspace features which must have been properly tested and as such is
+         not enabled by default.
+
+         A relaxation feature example is allowing the operation of a P2P group
+         owner (GO) on channels marked with NO_IR if there is an additional BSS
+         interface which associated to an AP which userspace assumes or confirms
+         to be an authorized master, i.e., with radar detection support and DFS
+         capabilities. However, note that in order to not create daisy chain
+         scenarios, this relaxation is not allowed in cases that the BSS client
+         is associated to P2P GO and in addition the P2P GO instantiated on
+         a channel due to this relaxation should not allow connection from
+         non P2P clients.
+
+         The regulatory core will apply these relaxations only for drivers that
+         support this feature by declaring the appropriate channel flags and
+         capabilities in their registration flow.
+
 config CFG80211_DEFAULT_PS
         bool "enable powersave by default"
         depends on CFG80211
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index 9c9501a35fb5..84d686e2dbd0 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -326,28 +326,57 @@ static int cfg80211_get_chans_dfs_required(struct wiphy *wiphy,
 
 
 int cfg80211_chandef_dfs_required(struct wiphy *wiphy,
-                                  const struct cfg80211_chan_def *chandef)
+                                  const struct cfg80211_chan_def *chandef,
+                                  enum nl80211_iftype iftype)
 {
         int width;
-        int r;
+        int ret;
 
         if (WARN_ON(!cfg80211_chandef_valid(chandef)))
                 return -EINVAL;
 
-        width = cfg80211_chandef_get_width(chandef);
-        if (width < 0)
-                return -EINVAL;
+        switch (iftype) {
+        case NL80211_IFTYPE_ADHOC:
+        case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_P2P_GO:
+        case NL80211_IFTYPE_MESH_POINT:
+                width = cfg80211_chandef_get_width(chandef);
+                if (width < 0)
+                        return -EINVAL;
 
-        r = cfg80211_get_chans_dfs_required(wiphy, chandef->center_freq1,
-                                            width);
-        if (r)
-                return r;
+                ret = cfg80211_get_chans_dfs_required(wiphy,
+                                                      chandef->center_freq1,
+                                                      width);
+                if (ret < 0)
+                        return ret;
+                else if (ret > 0)
+                        return BIT(chandef->width);
 
-        if (!chandef->center_freq2)
-                return 0;
+                if (!chandef->center_freq2)
+                        return 0;
+
+                ret = cfg80211_get_chans_dfs_required(wiphy,
+                                                      chandef->center_freq2,
+                                                      width);
+                if (ret < 0)
+                        return ret;
+                else if (ret > 0)
+                        return BIT(chandef->width);
 
-        return cfg80211_get_chans_dfs_required(wiphy, chandef->center_freq2,
-                                               width);
+                break;
+        case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_P2P_CLIENT:
+        case NL80211_IFTYPE_MONITOR:
+        case NL80211_IFTYPE_AP_VLAN:
+        case NL80211_IFTYPE_WDS:
+        case NL80211_IFTYPE_P2P_DEVICE:
+        case NL80211_IFTYPE_UNSPECIFIED:
+                break;
+        case NUM_NL80211_IFTYPES:
+                WARN_ON(1);
+        }
+
+        return 0;
 }
 EXPORT_SYMBOL(cfg80211_chandef_dfs_required);
 
@@ -587,12 +616,14 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy,
                 width = 5;
                 break;
         case NL80211_CHAN_WIDTH_10:
+                prohibited_flags |= IEEE80211_CHAN_NO_10MHZ;
                 width = 10;
                 break;
         case NL80211_CHAN_WIDTH_20:
                 if (!ht_cap->ht_supported)
                         return false;
         case NL80211_CHAN_WIDTH_20_NOHT:
+                prohibited_flags |= IEEE80211_CHAN_NO_20MHZ;
                 width = 20;
                 break;
         case NL80211_CHAN_WIDTH_40:
@@ -661,17 +692,112 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy,
 }
 EXPORT_SYMBOL(cfg80211_chandef_usable);
 
+/*
+ * For GO only, check if the channel can be used under permissive conditions
+ * mandated by the some regulatory bodies, i.e., the channel is marked with
+ * IEEE80211_CHAN_GO_CONCURRENT and there is an additional station interface
+ * associated to an AP on the same channel or on the same UNII band
+ * (assuming that the AP is an authorized master).
+ * In addition allow the GO to operate on a channel on which indoor operation is
+ * allowed, iff we are currently operating in an indoor environment.
+ */
+static bool cfg80211_go_permissive_chan(struct cfg80211_registered_device *rdev,
+                                        struct ieee80211_channel *chan)
+{
+        struct wireless_dev *wdev_iter;
+        struct wiphy *wiphy = wiphy_idx_to_wiphy(rdev->wiphy_idx);
+
+        ASSERT_RTNL();
+
+        if (!config_enabled(CONFIG_CFG80211_REG_RELAX_NO_IR) ||
+            !(wiphy->regulatory_flags & REGULATORY_ENABLE_RELAX_NO_IR))
+                return false;
+
+        if (regulatory_indoor_allowed() &&
+            (chan->flags & IEEE80211_CHAN_INDOOR_ONLY))
+                return true;
+
+        if (!(chan->flags & IEEE80211_CHAN_GO_CONCURRENT))
+                return false;
+
+        /*
+         * Generally, it is possible to rely on another device/driver to allow
+         * the GO concurrent relaxation, however, since the device can further
+         * enforce the relaxation (by doing a similar verifications as this),
+         * and thus fail the GO instantiation, consider only the interfaces of
+         * the current registered device.
+         */
+        list_for_each_entry(wdev_iter, &rdev->wdev_list, list) {
+                struct ieee80211_channel *other_chan = NULL;
+                int r1, r2;
+
+                if (wdev_iter->iftype != NL80211_IFTYPE_STATION ||
+                    !netif_running(wdev_iter->netdev))
+                        continue;
+
+                wdev_lock(wdev_iter);
+                if (wdev_iter->current_bss)
+                        other_chan = wdev_iter->current_bss->pub.channel;
+                wdev_unlock(wdev_iter);
+
+                if (!other_chan)
+                        continue;
+
+                if (chan == other_chan)
+                        return true;
+
+                if (chan->band != IEEE80211_BAND_5GHZ)
+                        continue;
+
+                r1 = cfg80211_get_unii(chan->center_freq);
+                r2 = cfg80211_get_unii(other_chan->center_freq);
+
+                if (r1 != -EINVAL && r1 == r2) {
+                        /*
+                         * At some locations channels 149-165 are considered a
+                         * bundle, but at other locations, e.g., Indonesia,
+                         * channels 149-161 are considered a bundle while
+                         * channel 165 is left out and considered to be in a
+                         * different bundle. Thus, in case that there is a
+                         * station interface connected to an AP on channel 165,
+                         * it is assumed that channels 149-161 are allowed for
+                         * GO operations. However, having a station interface
+                         * connected to an AP on channels 149-161, does not
+                         * allow GO operation on channel 165.
+                         */
+                        if (chan->center_freq == 5825 &&
+                            other_chan->center_freq != 5825)
+                                continue;
+                        return true;
+                }
+        }
+
+        return false;
+}
+
 bool cfg80211_reg_can_beacon(struct wiphy *wiphy,
-                             struct cfg80211_chan_def *chandef)
+                             struct cfg80211_chan_def *chandef,
+                             enum nl80211_iftype iftype)
 {
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
         bool res;
         u32 prohibited_flags = IEEE80211_CHAN_DISABLED |
-                               IEEE80211_CHAN_NO_IR |
                                IEEE80211_CHAN_RADAR;
 
-        trace_cfg80211_reg_can_beacon(wiphy, chandef);
+        trace_cfg80211_reg_can_beacon(wiphy, chandef, iftype);
 
-        if (cfg80211_chandef_dfs_required(wiphy, chandef) > 0 &&
+        /*
+         * Under certain conditions suggested by the some regulatory bodies
+         * a GO can operate on channels marked with IEEE80211_NO_IR
+         * so set this flag only if such relaxations are not enabled and
+         * the conditions are not met.
+         */
+        if (iftype != NL80211_IFTYPE_P2P_GO ||
+            !cfg80211_go_permissive_chan(rdev, chandef->chan))
+                prohibited_flags |= IEEE80211_CHAN_NO_IR;
+
+        if (cfg80211_chandef_dfs_required(wiphy, chandef,
+                                          NL80211_IFTYPE_UNSPECIFIED) > 0 &&
             cfg80211_chandef_dfs_available(wiphy, chandef)) {
                 /* We can skip IEEE80211_CHAN_NO_IR if chandef dfs available */
                 prohibited_flags = IEEE80211_CHAN_DISABLED;
@@ -701,6 +827,8 @@ cfg80211_get_chan_state(struct wireless_dev *wdev,
                         enum cfg80211_chan_mode *chanmode,
                         u8 *radar_detect)
 {
+        int ret;
+
         *chan = NULL;
         *chanmode = CHAN_MODE_UNDEFINED;
 
@@ -743,8 +871,11 @@ cfg80211_get_chan_state(struct wireless_dev *wdev,
                         *chan = wdev->chandef.chan;
                         *chanmode = CHAN_MODE_SHARED;
 
-                        if (cfg80211_chandef_dfs_required(wdev->wiphy,
-                                                          &wdev->chandef))
+                        ret = cfg80211_chandef_dfs_required(wdev->wiphy,
+                                                            &wdev->chandef,
+                                                            wdev->iftype);
+                        WARN_ON(ret < 0);
+                        if (ret > 0)
                                 *radar_detect |= BIT(wdev->chandef.width);
                 }
                 return;
@@ -753,8 +884,11 @@ cfg80211_get_chan_state(struct wireless_dev *wdev,
                         *chan = wdev->chandef.chan;
                         *chanmode = CHAN_MODE_SHARED;
 
-                        if (cfg80211_chandef_dfs_required(wdev->wiphy,
-                                                          &wdev->chandef))
+                        ret = cfg80211_chandef_dfs_required(wdev->wiphy,
+                                                            &wdev->chandef,
+                                                            wdev->iftype);
+                        WARN_ON(ret < 0);
+                        if (ret > 0)
                                 *radar_detect |= BIT(wdev->chandef.width);
                 }
                 return;
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 086cddd03ba6..b3ff3697239a 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -69,7 +69,7 @@ struct cfg80211_registered_device *cfg80211_rdev_by_wiphy_idx(int wiphy_idx)
 
 int get_wiphy_idx(struct wiphy *wiphy)
 {
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 
         return rdev->wiphy_idx;
 }
@@ -260,6 +260,45 @@ static void cfg80211_event_work(struct work_struct *work)
         rtnl_unlock();
 }
 
+void cfg80211_destroy_ifaces(struct cfg80211_registered_device *rdev)
+{
+        struct cfg80211_iface_destroy *item;
+
+        ASSERT_RTNL();
+
+        spin_lock_irq(&rdev->destroy_list_lock);
+        while ((item = list_first_entry_or_null(&rdev->destroy_list,
+                                                struct cfg80211_iface_destroy,
+                                                list))) {
+                struct wireless_dev *wdev, *tmp;
+                u32 nlportid = item->nlportid;
+
+                list_del(&item->list);
+                kfree(item);
+                spin_unlock_irq(&rdev->destroy_list_lock);
+
+                list_for_each_entry_safe(wdev, tmp, &rdev->wdev_list, list) {
+                        if (nlportid == wdev->owner_nlportid)
+                                rdev_del_virtual_intf(rdev, wdev);
+                }
+
+                spin_lock_irq(&rdev->destroy_list_lock);
+        }
+        spin_unlock_irq(&rdev->destroy_list_lock);
+}
+
+static void cfg80211_destroy_iface_wk(struct work_struct *work)
+{
+        struct cfg80211_registered_device *rdev;
+
+        rdev = container_of(work, struct cfg80211_registered_device,
+                            destroy_work);
+
+        rtnl_lock();
+        cfg80211_destroy_ifaces(rdev);
+        rtnl_unlock();
+}
+
 /* exported functions */
 
 struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv)
@@ -318,6 +357,10 @@ struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv)
         rdev->wiphy.dev.class = &ieee80211_class;
         rdev->wiphy.dev.platform_data = rdev;
 
+        INIT_LIST_HEAD(&rdev->destroy_list);
+        spin_lock_init(&rdev->destroy_list_lock);
+        INIT_WORK(&rdev->destroy_work, cfg80211_destroy_iface_wk);
+
 #ifdef CONFIG_CFG80211_DEFAULT_PS
         rdev->wiphy.flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT;
 #endif
@@ -396,10 +439,7 @@ static int wiphy_verify_combinations(struct wiphy *wiphy)
                 for (j = 0; j < c->n_limits; j++) {
                         u16 types = c->limits[j].types;
 
-                        /*
-                         * interface types shouldn't overlap, this is
-                         * used in cfg80211_can_change_interface()
-                         */
+                        /* interface types shouldn't overlap */
                         if (WARN_ON(types & all_iftypes))
                                 return -EINVAL;
                         all_iftypes |= types;
@@ -435,7 +475,7 @@ static int wiphy_verify_combinations(struct wiphy *wiphy)
 
 int wiphy_register(struct wiphy *wiphy)
 {
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
         int res;
         enum ieee80211_band band;
         struct ieee80211_supported_band *sband;
@@ -616,7 +656,7 @@ EXPORT_SYMBOL(wiphy_register);
 
 void wiphy_rfkill_start_polling(struct wiphy *wiphy)
 {
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 
         if (!rdev->ops->rfkill_poll)
                 return;
@@ -627,7 +667,7 @@ EXPORT_SYMBOL(wiphy_rfkill_start_polling);
 
 void wiphy_rfkill_stop_polling(struct wiphy *wiphy)
 {
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 
         rfkill_pause_polling(rdev->rfkill);
 }
@@ -635,7 +675,7 @@ EXPORT_SYMBOL(wiphy_rfkill_stop_polling);
 
 void wiphy_unregister(struct wiphy *wiphy)
 {
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 
         wait_event(rdev->dev_wait, ({
                 int __count;
@@ -675,6 +715,7 @@ void wiphy_unregister(struct wiphy *wiphy)
         cancel_work_sync(&rdev->conn_work);
         flush_work(&rdev->event_work);
         cancel_delayed_work_sync(&rdev->dfs_update_channels_wk);
+        flush_work(&rdev->destroy_work);
 
 #ifdef CONFIG_PM
         if (rdev->wiphy.wowlan_config && rdev->ops->set_wakeup)
@@ -707,7 +748,7 @@ EXPORT_SYMBOL(wiphy_free);
 
 void wiphy_rfkill_set_hw_state(struct wiphy *wiphy, bool blocked)
 {
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 
         if (rfkill_set_hw_state(rdev->rfkill, blocked))
                 schedule_work(&rdev->rfkill_sync);
@@ -716,7 +757,7 @@ EXPORT_SYMBOL(wiphy_rfkill_set_hw_state);
 
 void cfg80211_unregister_wdev(struct wireless_dev *wdev)
 {
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 
         ASSERT_RTNL();
 
@@ -796,12 +837,11 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
         struct net_device *dev = netdev_notifier_info_to_dev(ptr);
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_registered_device *rdev;
-        int ret;
 
         if (!wdev)
                 return NOTIFY_DONE;
 
-        rdev = wiphy_to_dev(wdev->wiphy);
+        rdev = wiphy_to_rdev(wdev->wiphy);
 
         WARN_ON(wdev->iftype == NL80211_IFTYPE_UNSPECIFIED);
 
@@ -959,13 +999,14 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
         case NETDEV_PRE_UP:
                 if (!(wdev->wiphy->interface_modes & BIT(wdev->iftype)))
                         return notifier_from_errno(-EOPNOTSUPP);
-                ret = cfg80211_can_add_interface(rdev, wdev->iftype);
-                if (ret)
-                        return notifier_from_errno(ret);
+                if (rfkill_blocked(rdev->rfkill))
+                        return notifier_from_errno(-ERFKILL);
                 break;
+        default:
+                return NOTIFY_DONE;
         }
 
-        return NOTIFY_DONE;
+        return NOTIFY_OK;
 }
 
 static struct notifier_block cfg80211_netdev_notifier = {
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 5b1fdcadd469..681b8fa4355b 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -80,13 +80,17 @@ struct cfg80211_registered_device {
 
         struct cfg80211_coalesce *coalesce;
 
+        spinlock_t destroy_list_lock;
+        struct list_head destroy_list;
+        struct work_struct destroy_work;
+
         /* must be last because of the way we do wiphy_priv(),
          * and it should at least be aligned to NETDEV_ALIGN */
         struct wiphy wiphy __aligned(NETDEV_ALIGN);
 };
 
 static inline
-struct cfg80211_registered_device *wiphy_to_dev(struct wiphy *wiphy)
+struct cfg80211_registered_device *wiphy_to_rdev(struct wiphy *wiphy)
 {
         BUG_ON(!wiphy);
         return container_of(wiphy, struct cfg80211_registered_device, wiphy);
@@ -232,6 +236,13 @@ struct cfg80211_beacon_registration {
         u32 nlportid;
 };
 
+struct cfg80211_iface_destroy {
+        struct list_head list;
+        u32 nlportid;
+};
+
+void cfg80211_destroy_ifaces(struct cfg80211_registered_device *rdev);
+
 /* free object */
 void cfg80211_dev_free(struct cfg80211_registered_device *rdev);
 
@@ -240,8 +251,8 @@ int cfg80211_dev_rename(struct cfg80211_registered_device *rdev,
 
 void ieee80211_set_bitrate_flags(struct wiphy *wiphy);
 
-void cfg80211_bss_expire(struct cfg80211_registered_device *dev);
-void cfg80211_bss_age(struct cfg80211_registered_device *dev,
+void cfg80211_bss_expire(struct cfg80211_registered_device *rdev);
+void cfg80211_bss_age(struct cfg80211_registered_device *rdev,
                       unsigned long age_secs);
 
 /* IBSS */
@@ -401,35 +412,6 @@ unsigned int
 cfg80211_chandef_dfs_cac_time(struct wiphy *wiphy,
                               const struct cfg80211_chan_def *chandef);
 
-static inline int
-cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
-                              struct wireless_dev *wdev,
-                              enum nl80211_iftype iftype)
-{
-        return cfg80211_can_use_iftype_chan(rdev, wdev, iftype, NULL,
-                                            CHAN_MODE_UNDEFINED, 0);
-}
-
-static inline int
-cfg80211_can_add_interface(struct cfg80211_registered_device *rdev,
-                           enum nl80211_iftype iftype)
-{
-        if (rfkill_blocked(rdev->rfkill))
-                return -ERFKILL;
-
-        return cfg80211_can_change_interface(rdev, NULL, iftype);
-}
-
-static inline int
-cfg80211_can_use_chan(struct cfg80211_registered_device *rdev,
-                      struct wireless_dev *wdev,
-                      struct ieee80211_channel *chan,
-                      enum cfg80211_chan_mode chanmode)
-{
-        return cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
-                                            chan, chanmode, 0);
-}
-
 static inline unsigned int elapsed_jiffies_msecs(unsigned long start)
 {
         unsigned long end = jiffies;
diff --git a/net/wireless/ethtool.c b/net/wireless/ethtool.c
index e37862f1b127..d4860bfc020e 100644
--- a/net/wireless/ethtool.c
+++ b/net/wireless/ethtool.c
@@ -43,7 +43,7 @@ static void cfg80211_get_ringparam(struct net_device *dev,
                                    struct ethtool_ringparam *rp)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 
         memset(rp, 0, sizeof(*rp));
 
@@ -56,7 +56,7 @@ static int cfg80211_set_ringparam(struct net_device *dev,
                                   struct ethtool_ringparam *rp)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 
         if (rp->rx_mini_pending != 0 || rp->rx_jumbo_pending != 0)
                 return -EINVAL;
@@ -70,7 +70,7 @@ static int cfg80211_set_ringparam(struct net_device *dev,
 static int cfg80211_get_sset_count(struct net_device *dev, int sset)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         if (rdev->ops->get_et_sset_count)
                 return rdev_get_et_sset_count(rdev, dev, sset);
         return -EOPNOTSUPP;
@@ -80,7 +80,7 @@ static void cfg80211_get_stats(struct net_device *dev,
                                struct ethtool_stats *stats, u64 *data)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         if (rdev->ops->get_et_stats)
                 rdev_get_et_stats(rdev, dev, stats, data);
 }
@@ -88,7 +88,7 @@ static void cfg80211_get_stats(struct net_device *dev,
 static void cfg80211_get_strings(struct net_device *dev, u32 sset, u8 *data)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         if (rdev->ops->get_et_strings)
                 rdev_get_et_strings(rdev, dev, sset, data);
 }
diff --git a/net/wireless/ibss.c b/net/wireless/ibss.c
index a6b5bdad039c..6b50588b709f 100644
--- a/net/wireless/ibss.c
+++ b/net/wireless/ibss.c
@@ -45,7 +45,7 @@ void __cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid,
 
         cfg80211_upload_connect_keys(wdev);
 
-        nl80211_send_ibss_bssid(wiphy_to_dev(wdev->wiphy), dev, bssid,
+        nl80211_send_ibss_bssid(wiphy_to_rdev(wdev->wiphy), dev, bssid,
                                 GFP_KERNEL);
 #ifdef CONFIG_CFG80211_WEXT
         memset(&wrqu, 0, sizeof(wrqu));
@@ -58,7 +58,7 @@ void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid,
                           struct ieee80211_channel *channel, gfp_t gfp)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         struct cfg80211_event *ev;
         unsigned long flags;
 
@@ -88,8 +88,6 @@ static int __cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
                                 struct cfg80211_cached_keys *connkeys)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct ieee80211_channel *check_chan;
-        u8 radar_detect_width = 0;
         int err;
 
         ASSERT_WDEV_LOCK(wdev);
@@ -126,28 +124,6 @@ static int __cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
 #ifdef CONFIG_CFG80211_WEXT
         wdev->wext.ibss.chandef = params->chandef;
 #endif
-        check_chan = params->chandef.chan;
-        if (params->userspace_handles_dfs) {
-                /* Check for radar even if the current channel is not
-                 * a radar channel - it might decide to change to DFS
-                 * channel later.
-                 */
-                radar_detect_width = BIT(params->chandef.width);
-        }
-
-        err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
-                                           check_chan,
-                                           (params->channel_fixed &&
-                                            !radar_detect_width)
-                                           ? CHAN_MODE_SHARED
-                                           : CHAN_MODE_EXCLUSIVE,
-                                           radar_detect_width);
-
-        if (err) {
-                wdev->connect_keys = NULL;
-                return err;
-        }
-
         err = rdev_join_ibss(rdev, dev, params);
         if (err) {
                 wdev->connect_keys = NULL;
@@ -180,7 +156,7 @@ int cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
 static void __cfg80211_clear_ibss(struct net_device *dev, bool nowext)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         int i;
 
         ASSERT_WDEV_LOCK(wdev);
@@ -335,7 +311,7 @@ int cfg80211_ibss_wext_siwfreq(struct net_device *dev,
                                struct iw_freq *wextfreq, char *extra)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         struct ieee80211_channel *chan = NULL;
         int err, freq;
 
@@ -346,7 +322,7 @@ int cfg80211_ibss_wext_siwfreq(struct net_device *dev,
         if (!rdev->ops->join_ibss)
                 return -EOPNOTSUPP;
 
-        freq = cfg80211_wext_freq(wdev->wiphy, wextfreq);
+        freq = cfg80211_wext_freq(wextfreq);
         if (freq < 0)
                 return freq;
 
@@ -420,7 +396,7 @@ int cfg80211_ibss_wext_siwessid(struct net_device *dev,
                                 struct iw_point *data, char *ssid)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         size_t len = data->length;
         int err;
 
@@ -487,7 +463,7 @@ int cfg80211_ibss_wext_siwap(struct net_device *dev,
                              struct sockaddr *ap_addr, char *extra)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         u8 *bssid = ap_addr->sa_data;
         int err;
 
@@ -505,6 +481,9 @@ int cfg80211_ibss_wext_siwap(struct net_device *dev,
         if (is_zero_ether_addr(bssid) || is_broadcast_ether_addr(bssid))
                 bssid = NULL;
 
+        if (bssid && !is_valid_ether_addr(bssid))
+                return -EINVAL;
+
         /* both automatic */
         if (!bssid && !wdev->wext.ibss.bssid)
                 return 0;
diff --git a/net/wireless/mesh.c b/net/wireless/mesh.c
index 5af5cc6b2c4c..3ddfb7cd335e 100644
--- a/net/wireless/mesh.c
+++ b/net/wireless/mesh.c
@@ -99,7 +99,6 @@ int __cfg80211_join_mesh(struct cfg80211_registered_device *rdev,
                          const struct mesh_config *conf)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        u8 radar_detect_width = 0;
         int err;
 
         BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN != IEEE80211_MAX_MESH_ID_LEN);
@@ -175,22 +174,10 @@ int __cfg80211_join_mesh(struct cfg80211_registered_device *rdev,
                                                                scan_width);
         }
 
-        if (!cfg80211_reg_can_beacon(&rdev->wiphy, &setup->chandef))
+        if (!cfg80211_reg_can_beacon(&rdev->wiphy, &setup->chandef,
+                                     NL80211_IFTYPE_MESH_POINT))
                 return -EINVAL;
 
-        err = cfg80211_chandef_dfs_required(wdev->wiphy, &setup->chandef);
-        if (err < 0)
-                return err;
-        if (err)
-                radar_detect_width = BIT(setup->chandef.width);
-
-        err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
-                                           setup->chandef.chan,
-                                           CHAN_MODE_SHARED,
-                                           radar_detect_width);
-        if (err)
-                return err;
-
         err = rdev_join_mesh(rdev, dev, conf, setup);
         if (!err) {
                 memcpy(wdev->ssid, setup->mesh_id, setup->mesh_id_len);
@@ -236,17 +223,6 @@ int cfg80211_set_mesh_channel(struct cfg80211_registered_device *rdev,
                 if (!netif_running(wdev->netdev))
                         return -ENETDOWN;
 
-                /* cfg80211_can_use_chan() calls
-                 * cfg80211_can_use_iftype_chan() with no radar
-                 * detection, so if we're trying to use a radar
-                 * channel here, something is wrong.
-                 */
-                WARN_ON_ONCE(chandef->chan->flags & IEEE80211_CHAN_RADAR);
-                err = cfg80211_can_use_chan(rdev, wdev, chandef->chan,
-                                            CHAN_MODE_SHARED);
-                if (err)
-                        return err;
-
                 err = rdev_libertas_set_mesh_channel(rdev, wdev->netdev,
                                                      chandef->chan);
                 if (!err)
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index c52ff59a3e96..266766b8d80b 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -23,7 +23,7 @@ void cfg80211_rx_assoc_resp(struct net_device *dev, struct cfg80211_bss *bss,
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct wiphy *wiphy = wdev->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
         u8 *ie = mgmt->u.assoc_resp.variable;
         int ieoffs = offsetof(struct ieee80211_mgmt, u.assoc_resp.variable);
@@ -54,7 +54,7 @@ EXPORT_SYMBOL(cfg80211_rx_assoc_resp);
 static void cfg80211_process_auth(struct wireless_dev *wdev,
                                   const u8 *buf, size_t len)
 {
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 
         nl80211_send_rx_auth(rdev, wdev->netdev, buf, len, GFP_KERNEL);
         cfg80211_sme_rx_auth(wdev, buf, len);
@@ -63,7 +63,7 @@ static void cfg80211_process_auth(struct wireless_dev *wdev,
 static void cfg80211_process_deauth(struct wireless_dev *wdev,
                                     const u8 *buf, size_t len)
 {
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
         const u8 *bssid = mgmt->bssid;
         u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
@@ -82,7 +82,7 @@ static void cfg80211_process_deauth(struct wireless_dev *wdev,
 static void cfg80211_process_disassoc(struct wireless_dev *wdev,
                                       const u8 *buf, size_t len)
 {
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
         const u8 *bssid = mgmt->bssid;
         u16 reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
@@ -123,7 +123,7 @@ void cfg80211_auth_timeout(struct net_device *dev, const u8 *addr)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct wiphy *wiphy = wdev->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 
         trace_cfg80211_send_auth_timeout(dev, addr);
 
@@ -136,7 +136,7 @@ void cfg80211_assoc_timeout(struct net_device *dev, struct cfg80211_bss *bss)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct wiphy *wiphy = wdev->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 
         trace_cfg80211_send_assoc_timeout(dev, bss->bssid);
 
@@ -172,7 +172,7 @@ void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr,
                                   const u8 *tsc, gfp_t gfp)
 {
         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 #ifdef CONFIG_CFG80211_WEXT
         union iwreq_data wrqu;
         char *buf = kmalloc(128, gfp);
@@ -233,14 +233,8 @@ int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
         if (!req.bss)
                 return -ENOENT;
 
-        err = cfg80211_can_use_chan(rdev, wdev, req.bss->channel,
-                                    CHAN_MODE_SHARED);
-        if (err)
-                goto out;
-
         err = rdev_auth(rdev, dev, &req);
 
-out:
         cfg80211_put_bss(&rdev->wiphy, req.bss);
         return err;
 }
@@ -306,16 +300,10 @@ int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
         if (!req->bss)
                 return -ENOENT;
 
-        err = cfg80211_can_use_chan(rdev, wdev, chan, CHAN_MODE_SHARED);
-        if (err)
-                goto out;
-
         err = rdev_assoc(rdev, dev, req);
         if (!err)
                 cfg80211_hold_bss(bss_from_pub(req->bss));
-
-out:
-        if (err)
+        else
                 cfg80211_put_bss(&rdev->wiphy, req->bss);
 
         return err;
@@ -414,7 +402,7 @@ int cfg80211_mlme_register_mgmt(struct wireless_dev *wdev, u32 snd_portid,
                                 int match_len)
 {
         struct wiphy *wiphy = wdev->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
         struct cfg80211_mgmt_registration *reg, *nreg;
         int err = 0;
         u16 mgmt_type;
@@ -473,7 +461,7 @@ int cfg80211_mlme_register_mgmt(struct wireless_dev *wdev, u32 snd_portid,
 void cfg80211_mlme_unregister_socket(struct wireless_dev *wdev, u32 nlportid)
 {
         struct wiphy *wiphy = wdev->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
         struct cfg80211_mgmt_registration *reg, *tmp;
 
         spin_lock_bh(&wdev->mgmt_registrations_lock);
@@ -620,7 +608,7 @@ bool cfg80211_rx_mgmt(struct wireless_dev *wdev, int freq, int sig_mbm,
                       const u8 *buf, size_t len, u32 flags, gfp_t gfp)
 {
         struct wiphy *wiphy = wdev->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
         struct cfg80211_mgmt_registration *reg;
         const struct ieee80211_txrx_stypes *stypes =
                 &wiphy->mgmt_stypes[wdev->iftype];
@@ -739,7 +727,7 @@ void cfg80211_radar_event(struct wiphy *wiphy,
                           struct cfg80211_chan_def *chandef,
                           gfp_t gfp)
 {
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
         unsigned long timeout;
 
         trace_cfg80211_radar_event(wiphy, chandef);
@@ -764,7 +752,7 @@ void cfg80211_cac_event(struct net_device *netdev,
 {
         struct wireless_dev *wdev = netdev->ieee80211_ptr;
         struct wiphy *wiphy = wdev->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
         unsigned long timeout;
 
         trace_cfg80211_cac_event(netdev, event);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 052c1bf8ffac..0f1b18f209d6 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -168,8 +168,8 @@ __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
                 netdev = __dev_get_by_index(netns, ifindex);
                 if (netdev) {
                         if (netdev->ieee80211_ptr)
-                                tmp = wiphy_to_dev(
-                                                netdev->ieee80211_ptr->wiphy);
+                                tmp = wiphy_to_rdev(
+                                        netdev->ieee80211_ptr->wiphy);
                         else
                                 tmp = NULL;
 
@@ -385,6 +385,7 @@ static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
         [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN },
         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
+        [NL80211_ATTR_IFACE_SOCKET_OWNER] = { .type = NLA_FLAG },
 };
 
 /* policy for the key attributes */
@@ -484,7 +485,7 @@ static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
                         err = PTR_ERR(*wdev);
                         goto out_unlock;
                 }
-                *rdev = wiphy_to_dev((*wdev)->wiphy);
+                *rdev = wiphy_to_rdev((*wdev)->wiphy);
                 /* 0 is the first index - add 1 to parse only once */
                 cb->args[0] = (*rdev)->wiphy_idx + 1;
                 cb->args[1] = (*wdev)->identifier;
@@ -497,7 +498,7 @@ static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
                         err = -ENODEV;
                         goto out_unlock;
                 }
-                *rdev = wiphy_to_dev(wiphy);
+                *rdev = wiphy_to_rdev(wiphy);
                 *wdev = NULL;
 
                 list_for_each_entry(tmp, &(*rdev)->wdev_list, list) {
@@ -566,6 +567,13 @@ static int nl80211_msg_put_channel(struct sk_buff *msg,
                                    struct ieee80211_channel *chan,
                                    bool large)
 {
+        /* Some channels must be completely excluded from the
+         * list to protect old user-space tools from breaking
+         */
+        if (!large && chan->flags &
+            (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
+                return 0;
+
         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
                         chan->center_freq))
                 goto nla_put_failure;
@@ -613,6 +621,18 @@ static int nl80211_msg_put_channel(struct sk_buff *msg,
                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
                         goto nla_put_failure;
+                if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
+                    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
+                        goto nla_put_failure;
+                if ((chan->flags & IEEE80211_CHAN_GO_CONCURRENT) &&
+                    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_GO_CONCURRENT))
+                        goto nla_put_failure;
+                if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
+                    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
+                        goto nla_put_failure;
+                if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
+                    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
+                        goto nla_put_failure;
         }
 
         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
@@ -1006,42 +1026,42 @@ static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
 }
 
 static int nl80211_send_wowlan(struct sk_buff *msg,
-                               struct cfg80211_registered_device *dev,
+                               struct cfg80211_registered_device *rdev,
                                bool large)
 {
         struct nlattr *nl_wowlan;
 
-        if (!dev->wiphy.wowlan)
+        if (!rdev->wiphy.wowlan)
                 return 0;
 
         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
         if (!nl_wowlan)
                 return -ENOBUFS;
 
-        if (((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
+        if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
-            ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
+            ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
-            ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
+            ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
-            ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
+            ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
-            ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
+            ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
-            ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
+            ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
-            ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
+            ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
-            ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
+            ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
                 return -ENOBUFS;
 
-        if (dev->wiphy.wowlan->n_patterns) {
+        if (rdev->wiphy.wowlan->n_patterns) {
                 struct nl80211_pattern_support pat = {
-                        .max_patterns = dev->wiphy.wowlan->n_patterns,
-                        .min_pattern_len = dev->wiphy.wowlan->pattern_min_len,
-                        .max_pattern_len = dev->wiphy.wowlan->pattern_max_len,
-                        .max_pkt_offset = dev->wiphy.wowlan->max_pkt_offset,
+                        .max_patterns = rdev->wiphy.wowlan->n_patterns,
+                        .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
+                        .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
+                        .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
                 };
 
                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
@@ -1049,7 +1069,7 @@ static int nl80211_send_wowlan(struct sk_buff *msg,
                         return -ENOBUFS;
         }
 
-        if (large && nl80211_send_wowlan_tcp_caps(dev, msg))
+        if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
                 return -ENOBUFS;
 
         nla_nest_end(msg, nl_wowlan);
@@ -1059,19 +1079,19 @@ static int nl80211_send_wowlan(struct sk_buff *msg,
 #endif
 
 static int nl80211_send_coalesce(struct sk_buff *msg,
-                                 struct cfg80211_registered_device *dev)
+                                 struct cfg80211_registered_device *rdev)
 {
         struct nl80211_coalesce_rule_support rule;
 
-        if (!dev->wiphy.coalesce)
+        if (!rdev->wiphy.coalesce)
                 return 0;
 
-        rule.max_rules = dev->wiphy.coalesce->n_rules;
-        rule.max_delay = dev->wiphy.coalesce->max_delay;
-        rule.pat.max_patterns = dev->wiphy.coalesce->n_patterns;
-        rule.pat.min_pattern_len = dev->wiphy.coalesce->pattern_min_len;
-        rule.pat.max_pattern_len = dev->wiphy.coalesce->pattern_max_len;
-        rule.pat.max_pkt_offset = dev->wiphy.coalesce->max_pkt_offset;
+        rule.max_rules = rdev->wiphy.coalesce->n_rules;
+        rule.max_delay = rdev->wiphy.coalesce->max_delay;
+        rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
+        rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
+        rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
+        rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
 
         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
                 return -ENOBUFS;
@@ -1202,7 +1222,7 @@ struct nl80211_dump_wiphy_state {
         bool split;
 };
 
-static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
+static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
                               struct sk_buff *msg, u32 portid, u32 seq,
                               int flags, struct nl80211_dump_wiphy_state *state)
 {
@@ -1214,7 +1234,7 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
         struct ieee80211_channel *chan;
         int i;
         const struct ieee80211_txrx_stypes *mgmt_stypes =
-                                dev->wiphy.mgmt_stypes;
+                                rdev->wiphy.mgmt_stypes;
         u32 features;
 
         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_WIPHY);
@@ -1224,9 +1244,9 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
         if (WARN_ON(!state))
                 return -EINVAL;
 
-        if (nla_put_u32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx) ||
+        if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
-                           wiphy_name(&dev->wiphy)) ||
+                           wiphy_name(&rdev->wiphy)) ||
             nla_put_u32(msg, NL80211_ATTR_GENERATION,
                         cfg80211_rdev_list_generation))
                 goto nla_put_failure;
@@ -1234,43 +1254,43 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
         switch (state->split_start) {
         case 0:
                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
-                               dev->wiphy.retry_short) ||
+                               rdev->wiphy.retry_short) ||
                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
-                               dev->wiphy.retry_long) ||
+                               rdev->wiphy.retry_long) ||
                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
-                                dev->wiphy.frag_threshold) ||
+                                rdev->wiphy.frag_threshold) ||
                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
-                                dev->wiphy.rts_threshold) ||
+                                rdev->wiphy.rts_threshold) ||
                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
-                               dev->wiphy.coverage_class) ||
+                               rdev->wiphy.coverage_class) ||
                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
-                               dev->wiphy.max_scan_ssids) ||
+                               rdev->wiphy.max_scan_ssids) ||
                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
-                               dev->wiphy.max_sched_scan_ssids) ||
+                               rdev->wiphy.max_sched_scan_ssids) ||
                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
-                                dev->wiphy.max_scan_ie_len) ||
+                                rdev->wiphy.max_scan_ie_len) ||
                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
-                                dev->wiphy.max_sched_scan_ie_len) ||
+                                rdev->wiphy.max_sched_scan_ie_len) ||
                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
-                               dev->wiphy.max_match_sets))
+                               rdev->wiphy.max_match_sets))
                         goto nla_put_failure;
 
-                if ((dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
+                if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
                         goto nla_put_failure;
-                if ((dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
+                if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
                         goto nla_put_failure;
-                if ((dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
+                if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
                         goto nla_put_failure;
-                if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
+                if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
                         goto nla_put_failure;
-                if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
+                if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
                         goto nla_put_failure;
-                if ((dev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
+                if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
                         goto nla_put_failure;
                 state->split_start++;
@@ -1278,35 +1298,35 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
                         break;
         case 1:
                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
-                            sizeof(u32) * dev->wiphy.n_cipher_suites,
-                            dev->wiphy.cipher_suites))
+                            sizeof(u32) * rdev->wiphy.n_cipher_suites,
+                            rdev->wiphy.cipher_suites))
                         goto nla_put_failure;
 
                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
-                               dev->wiphy.max_num_pmkids))
+                               rdev->wiphy.max_num_pmkids))
                         goto nla_put_failure;
 
-                if ((dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
+                if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
                         goto nla_put_failure;
 
                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
-                                dev->wiphy.available_antennas_tx) ||
+                                rdev->wiphy.available_antennas_tx) ||
                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
-                                dev->wiphy.available_antennas_rx))
+                                rdev->wiphy.available_antennas_rx))
                         goto nla_put_failure;
 
-                if ((dev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
+                if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
-                                dev->wiphy.probe_resp_offload))
+                                rdev->wiphy.probe_resp_offload))
                         goto nla_put_failure;
 
-                if ((dev->wiphy.available_antennas_tx ||
-                     dev->wiphy.available_antennas_rx) &&
-                    dev->ops->get_antenna) {
+                if ((rdev->wiphy.available_antennas_tx ||
+                     rdev->wiphy.available_antennas_rx) &&
+                    rdev->ops->get_antenna) {
                         u32 tx_ant = 0, rx_ant = 0;
                         int res;
-                        res = rdev_get_antenna(dev, &tx_ant, &rx_ant);
+                        res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
                         if (!res) {
                                 if (nla_put_u32(msg,
                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
@@ -1323,7 +1343,7 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
                         break;
         case 2:
                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
-                                        dev->wiphy.interface_modes))
+                                        rdev->wiphy.interface_modes))
                                 goto nla_put_failure;
                 state->split_start++;
                 if (state->split)
@@ -1337,7 +1357,7 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
                      band < IEEE80211_NUM_BANDS; band++) {
                         struct ieee80211_supported_band *sband;
 
-                        sband = dev->wiphy.bands[band];
+                        sband = rdev->wiphy.bands[band];
 
                         if (!sband)
                                 continue;
@@ -1414,7 +1434,7 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
                 i = 0;
 #define CMD(op, n)                                                      \
                  do {                                                   \
-                        if (dev->ops->op) {                             \
+                        if (rdev->ops->op) {                            \
                                 i++;                                    \
                                 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
                                         goto nla_put_failure;           \
@@ -1438,32 +1458,32 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
                 CMD(set_pmksa, SET_PMKSA);
                 CMD(del_pmksa, DEL_PMKSA);
                 CMD(flush_pmksa, FLUSH_PMKSA);
-                if (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
+                if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
                         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
                 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
                 CMD(mgmt_tx, FRAME);
                 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
-                if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
+                if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
                         i++;
                         if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
                                 goto nla_put_failure;
                 }
-                if (dev->ops->set_monitor_channel || dev->ops->start_ap ||
-                    dev->ops->join_mesh) {
+                if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
+                    rdev->ops->join_mesh) {
                         i++;
                         if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
                                 goto nla_put_failure;
                 }
                 CMD(set_wds_peer, SET_WDS_PEER);
-                if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
+                if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
                         CMD(tdls_mgmt, TDLS_MGMT);
                         CMD(tdls_oper, TDLS_OPER);
                 }
-                if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
+                if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
                         CMD(sched_scan_start, START_SCHED_SCAN);
                 CMD(probe_client, PROBE_CLIENT);
                 CMD(set_noack_map, SET_NOACK_MAP);
-                if (dev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
+                if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
                         i++;
                         if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
                                 goto nla_put_failure;
@@ -1473,7 +1493,7 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
                 if (state->split) {
                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
-                        if (dev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
+                        if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
                                 CMD(channel_switch, CHANNEL_SWITCH);
                 }
                 CMD(set_qos_map, SET_QOS_MAP);
@@ -1484,13 +1504,13 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
 
 #undef CMD
 
-                if (dev->ops->connect || dev->ops->auth) {
+                if (rdev->ops->connect || rdev->ops->auth) {
                         i++;
                         if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
                                 goto nla_put_failure;
                 }
 
-                if (dev->ops->disconnect || dev->ops->deauth) {
+                if (rdev->ops->disconnect || rdev->ops->deauth) {
                         i++;
                         if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
                                 goto nla_put_failure;
@@ -1501,14 +1521,14 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
                 if (state->split)
                         break;
         case 5:
-                if (dev->ops->remain_on_channel &&
-                    (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
+                if (rdev->ops->remain_on_channel &&
+                    (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
                     nla_put_u32(msg,
                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
-                                dev->wiphy.max_remain_on_channel_duration))
+                                rdev->wiphy.max_remain_on_channel_duration))
                         goto nla_put_failure;
 
-                if ((dev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
+                if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
                         goto nla_put_failure;
 
@@ -1519,7 +1539,7 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
                         break;
         case 6:
 #ifdef CONFIG_PM
-                if (nl80211_send_wowlan(msg, dev, state->split))
+                if (nl80211_send_wowlan(msg, rdev, state->split))
                         goto nla_put_failure;
                 state->split_start++;
                 if (state->split)
@@ -1529,10 +1549,10 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
 #endif
         case 7:
                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
-                                        dev->wiphy.software_iftypes))
+                                        rdev->wiphy.software_iftypes))
                         goto nla_put_failure;
 
-                if (nl80211_put_iface_combinations(&dev->wiphy, msg,
+                if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
                                                    state->split))
                         goto nla_put_failure;
 
@@ -1540,12 +1560,12 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
                 if (state->split)
                         break;
         case 8:
-                if ((dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
+                if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
-                                dev->wiphy.ap_sme_capa))
+                                rdev->wiphy.ap_sme_capa))
                         goto nla_put_failure;
 
-                features = dev->wiphy.features;
+                features = rdev->wiphy.features;
                 /*
                  * We can only add the per-channel limit information if the
                  * dump is split, otherwise it makes it too big. Therefore
@@ -1556,16 +1576,16 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
                         goto nla_put_failure;
 
-                if (dev->wiphy.ht_capa_mod_mask &&
+                if (rdev->wiphy.ht_capa_mod_mask &&
                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
-                            sizeof(*dev->wiphy.ht_capa_mod_mask),
-                            dev->wiphy.ht_capa_mod_mask))
+                            sizeof(*rdev->wiphy.ht_capa_mod_mask),
+                            rdev->wiphy.ht_capa_mod_mask))
                         goto nla_put_failure;
 
-                if (dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
-                    dev->wiphy.max_acl_mac_addrs &&
+                if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
+                    rdev->wiphy.max_acl_mac_addrs &&
                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
-                                dev->wiphy.max_acl_mac_addrs))
+                                rdev->wiphy.max_acl_mac_addrs))
                         goto nla_put_failure;
 
                 /*
@@ -1581,41 +1601,41 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
                 state->split_start++;
                 break;
         case 9:
-                if (dev->wiphy.extended_capabilities &&
+                if (rdev->wiphy.extended_capabilities &&
                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
-                             dev->wiphy.extended_capabilities_len,
-                             dev->wiphy.extended_capabilities) ||
+                             rdev->wiphy.extended_capabilities_len,
+                             rdev->wiphy.extended_capabilities) ||
                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
-                             dev->wiphy.extended_capabilities_len,
-                             dev->wiphy.extended_capabilities_mask)))
+                             rdev->wiphy.extended_capabilities_len,
+                             rdev->wiphy.extended_capabilities_mask)))
                         goto nla_put_failure;
 
-                if (dev->wiphy.vht_capa_mod_mask &&
+                if (rdev->wiphy.vht_capa_mod_mask &&
                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
-                            sizeof(*dev->wiphy.vht_capa_mod_mask),
-                            dev->wiphy.vht_capa_mod_mask))
+                            sizeof(*rdev->wiphy.vht_capa_mod_mask),
+                            rdev->wiphy.vht_capa_mod_mask))
                         goto nla_put_failure;
 
                 state->split_start++;
                 break;
         case 10:
-                if (nl80211_send_coalesce(msg, dev))
+                if (nl80211_send_coalesce(msg, rdev))
                         goto nla_put_failure;
 
-                if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
+                if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
                         goto nla_put_failure;
 
-                if (dev->wiphy.max_ap_assoc_sta &&
+                if (rdev->wiphy.max_ap_assoc_sta &&
                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
-                                dev->wiphy.max_ap_assoc_sta))
+                                rdev->wiphy.max_ap_assoc_sta))
                         goto nla_put_failure;
 
                 state->split_start++;
                 break;
         case 11:
-                if (dev->wiphy.n_vendor_commands) {
+                if (rdev->wiphy.n_vendor_commands) {
                         const struct nl80211_vendor_cmd_info *info;
                         struct nlattr *nested;
 
@@ -1623,15 +1643,15 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
                         if (!nested)
                                 goto nla_put_failure;
 
-                        for (i = 0; i < dev->wiphy.n_vendor_commands; i++) {
-                                info = &dev->wiphy.vendor_commands[i].info;
+                        for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
+                                info = &rdev->wiphy.vendor_commands[i].info;
                                 if (nla_put(msg, i + 1, sizeof(*info), info))
                                         goto nla_put_failure;
                         }
                         nla_nest_end(msg, nested);
                 }
 
-                if (dev->wiphy.n_vendor_events) {
+                if (rdev->wiphy.n_vendor_events) {
                         const struct nl80211_vendor_cmd_info *info;
                         struct nlattr *nested;
 
@@ -1640,8 +1660,8 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
                         if (!nested)
                                 goto nla_put_failure;
 
-                        for (i = 0; i < dev->wiphy.n_vendor_events; i++) {
-                                info = &dev->wiphy.vendor_events[i];
+                        for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
+                                info = &rdev->wiphy.vendor_events[i];
                                 if (nla_put(msg, i + 1, sizeof(*info), info))
                                         goto nla_put_failure;
                         }
@@ -1684,7 +1704,7 @@ static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
                 if (!netdev)
                         return -ENODEV;
                 if (netdev->ieee80211_ptr) {
-                        rdev = wiphy_to_dev(
+                        rdev = wiphy_to_rdev(
                                 netdev->ieee80211_ptr->wiphy);
                         state->filter_wiphy = rdev->wiphy_idx;
                 }
@@ -1697,7 +1717,7 @@ static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 {
         int idx = 0, ret;
         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
-        struct cfg80211_registered_device *dev;
+        struct cfg80211_registered_device *rdev;
 
         rtnl_lock();
         if (!state) {
@@ -1716,17 +1736,17 @@ static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
                 cb->args[0] = (long)state;
         }
 
-        list_for_each_entry(dev, &cfg80211_rdev_list, list) {
-                if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
+        list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
+                if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
                         continue;
                 if (++idx <= state->start)
                         continue;
                 if (state->filter_wiphy != -1 &&
-                    state->filter_wiphy != dev->wiphy_idx)
+                    state->filter_wiphy != rdev->wiphy_idx)
                         continue;
                 /* attempt to fit multiple wiphy data chunks into the skb */
                 do {
-                        ret = nl80211_send_wiphy(dev, skb,
+                        ret = nl80211_send_wiphy(rdev, skb,
                                                  NETLINK_CB(cb->skb).portid,
                                                  cb->nlh->nlmsg_seq,
                                                  NLM_F_MULTI, state);
@@ -1774,14 +1794,14 @@ static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
 {
         struct sk_buff *msg;
-        struct cfg80211_registered_device *dev = info->user_ptr[0];
+        struct cfg80211_registered_device *rdev = info->user_ptr[0];
         struct nl80211_dump_wiphy_state state = {};
 
         msg = nlmsg_new(4096, GFP_KERNEL);
         if (!msg)
                 return -ENOMEM;
 
-        if (nl80211_send_wiphy(dev, msg, info->snd_portid, info->snd_seq, 0,
+        if (nl80211_send_wiphy(rdev, msg, info->snd_portid, info->snd_seq, 0,
                                &state) < 0) {
                 nlmsg_free(msg);
                 return -ENOBUFS;
@@ -1908,18 +1928,20 @@ static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
 }
 
 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
-                                 struct wireless_dev *wdev,
+                                 struct net_device *dev,
                                  struct genl_info *info)
 {
         struct cfg80211_chan_def chandef;
         int result;
         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
+        struct wireless_dev *wdev = NULL;
 
-        if (wdev)
-                iftype = wdev->iftype;
-
+        if (dev)
+                wdev = dev->ieee80211_ptr;
         if (!nl80211_can_set_dev_channel(wdev))
                 return -EOPNOTSUPP;
+        if (wdev)
+                iftype = wdev->iftype;
 
         result = nl80211_parse_chandef(rdev, info, &chandef);
         if (result)
@@ -1928,14 +1950,27 @@ static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
         switch (iftype) {
         case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_P2P_GO:
-                if (wdev->beacon_interval) {
-                        result = -EBUSY;
-                        break;
-                }
-                if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef)) {
+                if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef, iftype)) {
                         result = -EINVAL;
                         break;
                 }
+                if (wdev->beacon_interval) {
+                        if (!dev || !rdev->ops->set_ap_chanwidth ||
+                            !(rdev->wiphy.features &
+                              NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
+                                result = -EBUSY;
+                                break;
+                        }
+
+                        /* Only allow dynamic channel width changes */
+                        if (chandef.chan != wdev->preset_chandef.chan) {
+                                result = -EBUSY;
+                                break;
+                        }
+                        result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
+                        if (result)
+                                break;
+                }
                 wdev->preset_chandef = chandef;
                 result = 0;
                 break;
@@ -1957,7 +1992,7 @@ static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
         struct net_device *netdev = info->user_ptr[1];
 
-        return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
+        return __nl80211_set_channel(rdev, netdev, info);
 }
 
 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
@@ -2013,7 +2048,7 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 
                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
                 if (netdev && netdev->ieee80211_ptr)
-                        rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
+                        rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
                 else
                         netdev = NULL;
         }
@@ -2079,9 +2114,10 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
         }
 
         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
-                result = __nl80211_set_channel(rdev,
-                                nl80211_can_set_dev_channel(wdev) ? wdev : NULL,
-                                info);
+                result = __nl80211_set_channel(
+                        rdev,
+                        nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
+                        info);
                 if (result)
                         return result;
         }
@@ -2229,7 +2265,7 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 static inline u64 wdev_id(struct wireless_dev *wdev)
 {
         return (u64)wdev->identifier |
-               ((u64)wiphy_to_dev(wdev->wiphy)->wiphy_idx << 32);
+               ((u64)wiphy_to_rdev(wdev->wiphy)->wiphy_idx << 32);
 }
 
 static int nl80211_send_chandef(struct sk_buff *msg,
@@ -2355,7 +2391,7 @@ static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *
 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
 {
         struct sk_buff *msg;
-        struct cfg80211_registered_device *dev = info->user_ptr[0];
+        struct cfg80211_registered_device *rdev = info->user_ptr[0];
         struct wireless_dev *wdev = info->user_ptr[1];
 
         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
@@ -2363,7 +2399,7 @@ static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
                 return -ENOMEM;
 
         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
-                               dev, wdev) < 0) {
+                               rdev, wdev) < 0) {
                 nlmsg_free(msg);
                 return -ENOBUFS;
         }
@@ -2514,6 +2550,9 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
         u32 flags;
 
+        /* to avoid failing a new interface creation due to pending removal */
+        cfg80211_destroy_ifaces(rdev);
+
         memset(&params, 0, sizeof(params));
 
         if (!info->attrs[NL80211_ATTR_IFNAME])
@@ -2563,6 +2602,9 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
                 return PTR_ERR(wdev);
         }
 
+        if (info->attrs[NL80211_ATTR_IFACE_SOCKET_OWNER])
+                wdev->owner_nlportid = info->snd_portid;
+
         switch (type) {
         case NL80211_IFTYPE_MESH_POINT:
                 if (!info->attrs[NL80211_ATTR_MESH_ID])
@@ -3142,7 +3184,6 @@ static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_ap_settings params;
         int err;
-        u8 radar_detect_width = 0;
 
         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
@@ -3258,24 +3299,10 @@ static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
         } else if (!nl80211_get_ap_channel(rdev, &params))
                 return -EINVAL;
 
-        if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef))
+        if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef,
+                                     wdev->iftype))
                 return -EINVAL;
 
-        err = cfg80211_chandef_dfs_required(wdev->wiphy, &params.chandef);
-        if (err < 0)
-                return err;
-        if (err) {
-                radar_detect_width = BIT(params.chandef.width);
-                params.radar_required = true;
-        }
-
-        err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
-                                           params.chandef.chan,
-                                           CHAN_MODE_SHARED,
-                                           radar_detect_width);
-        if (err)
-                return err;
-
         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
                 params.acl = parse_acl_data(&rdev->wiphy, info);
                 if (IS_ERR(params.acl))
@@ -3675,13 +3702,13 @@ static int nl80211_dump_station(struct sk_buff *skb,
                                 struct netlink_callback *cb)
 {
         struct station_info sinfo;
-        struct cfg80211_registered_device *dev;
+        struct cfg80211_registered_device *rdev;
         struct wireless_dev *wdev;
         u8 mac_addr[ETH_ALEN];
         int sta_idx = cb->args[2];
         int err;
 
-        err = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
+        err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
         if (err)
                 return err;
 
@@ -3690,14 +3717,14 @@ static int nl80211_dump_station(struct sk_buff *skb,
                 goto out_err;
         }
 
-        if (!dev->ops->dump_station) {
+        if (!rdev->ops->dump_station) {
                 err = -EOPNOTSUPP;
                 goto out_err;
         }
 
         while (1) {
                 memset(&sinfo, 0, sizeof(sinfo));
-                err = rdev_dump_station(dev, wdev->netdev, sta_idx,
+                err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
                                         mac_addr, &sinfo);
                 if (err == -ENOENT)
                         break;
@@ -3707,7 +3734,7 @@ static int nl80211_dump_station(struct sk_buff *skb,
                 if (nl80211_send_station(skb,
                                 NETLINK_CB(cb->skb).portid,
                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
-                                dev, wdev->netdev, mac_addr,
+                                rdev, wdev->netdev, mac_addr,
                                 &sinfo) < 0)
                         goto out;
 
@@ -3719,7 +3746,7 @@ static int nl80211_dump_station(struct sk_buff *skb,
         cb->args[2] = sta_idx;
         err = skb->len;
  out_err:
-        nl80211_finish_wdev_dump(dev);
+        nl80211_finish_wdev_dump(rdev);
 
         return err;
 }
@@ -4380,18 +4407,18 @@ static int nl80211_dump_mpath(struct sk_buff *skb,
                               struct netlink_callback *cb)
 {
         struct mpath_info pinfo;
-        struct cfg80211_registered_device *dev;
+        struct cfg80211_registered_device *rdev;
         struct wireless_dev *wdev;
         u8 dst[ETH_ALEN];
         u8 next_hop[ETH_ALEN];
         int path_idx = cb->args[2];
         int err;
 
-        err = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
+        err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
         if (err)
                 return err;
 
-        if (!dev->ops->dump_mpath) {
+        if (!rdev->ops->dump_mpath) {
                 err = -EOPNOTSUPP;
                 goto out_err;
         }
@@ -4402,7 +4429,7 @@ static int nl80211_dump_mpath(struct sk_buff *skb,
         }
 
         while (1) {
-                err = rdev_dump_mpath(dev, wdev->netdev, path_idx, dst,
+                err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
                                       next_hop, &pinfo);
                 if (err == -ENOENT)
                         break;
@@ -4423,7 +4450,7 @@ static int nl80211_dump_mpath(struct sk_buff *skb,
         cb->args[2] = path_idx;
         err = skb->len;
  out_err:
-        nl80211_finish_wdev_dump(dev);
+        nl80211_finish_wdev_dump(rdev);
         return err;
 }
 
@@ -4663,7 +4690,6 @@ static int parse_reg_rule(struct nlattr *tb[],
 
 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
 {
-        int r;
         char *data = NULL;
         enum nl80211_user_reg_hint_type user_reg_hint_type;
 
@@ -4676,11 +4702,6 @@ static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
                 return -EINPROGRESS;
 
-        if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
-                return -EINVAL;
-
-        data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
-
         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
                 user_reg_hint_type =
                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
@@ -4690,14 +4711,16 @@ static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
         switch (user_reg_hint_type) {
         case NL80211_USER_REG_HINT_USER:
         case NL80211_USER_REG_HINT_CELL_BASE:
-                break;
+                if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
+                        return -EINVAL;
+
+                data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
+                return regulatory_hint_user(data, user_reg_hint_type);
+        case NL80211_USER_REG_HINT_INDOOR:
+                return regulatory_hint_indoor_user();
         default:
                 return -EINVAL;
         }
-
-        r = regulatory_hint_user(data, user_reg_hint_type);
-
-        return r;
 }
 
 static int nl80211_get_mesh_config(struct sk_buff *skb,
@@ -5796,7 +5819,8 @@ static int nl80211_start_radar_detection(struct sk_buff *skb,
         if (wdev->cac_started)
                 return -EBUSY;
 
-        err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef);
+        err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef,
+                                            NL80211_IFTYPE_UNSPECIFIED);
         if (err < 0)
                 return err;
 
@@ -5809,12 +5833,6 @@ static int nl80211_start_radar_detection(struct sk_buff *skb,
         if (!rdev->ops->start_radar_detection)
                 return -EOPNOTSUPP;
 
-        err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
-                                           chandef.chan, CHAN_MODE_SHARED,
-                                           BIT(chandef.width));
-        if (err)
-                return err;
-
         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
         if (WARN_ON(!cac_time_ms))
                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
@@ -5928,27 +5946,25 @@ skip_beacons:
         if (err)
                 return err;
 
-        if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef))
+        if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef,
+                                     wdev->iftype))
                 return -EINVAL;
 
-        switch (dev->ieee80211_ptr->iftype) {
-        case NL80211_IFTYPE_AP:
-        case NL80211_IFTYPE_P2P_GO:
-        case NL80211_IFTYPE_ADHOC:
-        case NL80211_IFTYPE_MESH_POINT:
-                err = cfg80211_chandef_dfs_required(wdev->wiphy,
-                                                    &params.chandef);
-                if (err < 0)
-                        return err;
-                if (err) {
-                        radar_detect_width = BIT(params.chandef.width);
-                        params.radar_required = true;
-                }
-                break;
-        default:
-                break;
+        err = cfg80211_chandef_dfs_required(wdev->wiphy,
+                                            &params.chandef,
+                                            wdev->iftype);
+        if (err < 0)
+                return err;
+
+        if (err > 0) {
+                radar_detect_width = BIT(params.chandef.width);
+                params.radar_required = true;
         }
 
+        /* TODO: I left this here for now.  With channel switch, the
+         * verification is a bit more complicated, because we only do
+         * it later when the channel switch really happens.
+         */
         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
                                            params.chandef.chan,
                                            CHAN_MODE_SHARED,
@@ -6175,12 +6191,12 @@ static int nl80211_dump_survey(struct sk_buff *skb,
                         struct netlink_callback *cb)
 {
         struct survey_info survey;
-        struct cfg80211_registered_device *dev;
+        struct cfg80211_registered_device *rdev;
         struct wireless_dev *wdev;
         int survey_idx = cb->args[2];
         int res;
 
-        res = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
+        res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
         if (res)
                 return res;
 
@@ -6189,7 +6205,7 @@ static int nl80211_dump_survey(struct sk_buff *skb,
                 goto out_err;
         }
 
-        if (!dev->ops->dump_survey) {
+        if (!rdev->ops->dump_survey) {
                 res = -EOPNOTSUPP;
                 goto out_err;
         }
@@ -6197,7 +6213,7 @@ static int nl80211_dump_survey(struct sk_buff *skb,
         while (1) {
                 struct ieee80211_channel *chan;
 
-                res = rdev_dump_survey(dev, wdev->netdev, survey_idx, &survey);
+                res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
                 if (res == -ENOENT)
                         break;
                 if (res)
@@ -6209,7 +6225,7 @@ static int nl80211_dump_survey(struct sk_buff *skb,
                         goto out;
                 }
 
-                chan = ieee80211_get_channel(&dev->wiphy,
+                chan = ieee80211_get_channel(&rdev->wiphy,
                                              survey.channel->center_freq);
                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
                         survey_idx++;
@@ -6228,7 +6244,7 @@ static int nl80211_dump_survey(struct sk_buff *skb,
         cb->args[2] = survey_idx;
         res = skb->len;
  out_err:
-        nl80211_finish_wdev_dump(dev);
+        nl80211_finish_wdev_dump(rdev);
         return res;
 }
 
@@ -6704,7 +6720,8 @@ static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
         if (err)
                 return err;
 
-        if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef))
+        if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
+                                     NL80211_IFTYPE_ADHOC))
                 return -EINVAL;
 
         switch (ibss.chandef.width) {
@@ -6879,7 +6896,7 @@ struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
                                            int vendor_event_idx,
                                            int approxlen, gfp_t gfp)
 {
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
         const struct nl80211_vendor_cmd_info *info;
 
         switch (cmd) {
@@ -8981,9 +8998,8 @@ static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
         if (wdev->p2p_started)
                 return 0;
 
-        err = cfg80211_can_add_interface(rdev, wdev->iftype);
-        if (err)
-                return err;
+        if (rfkill_blocked(rdev->rfkill))
+                return -ERFKILL;
 
         err = rdev_start_p2p_device(rdev, wdev);
         if (err)
@@ -9192,7 +9208,7 @@ struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
                                            enum nl80211_attrs attr,
                                            int approxlen)
 {
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 
         if (WARN_ON(!rdev->cur_cmd_info))
                 return NULL;
@@ -9316,7 +9332,7 @@ static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
                 }
 
                 dev = wdev->netdev;
-                rdev = wiphy_to_dev(wdev->wiphy);
+                rdev = wiphy_to_rdev(wdev->wiphy);
 
                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
                         if (!dev) {
@@ -10345,7 +10361,7 @@ void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct wiphy *wiphy = wdev->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
         const struct ieee80211_mgmt *mgmt = (void *)buf;
         u32 cmd;
 
@@ -10567,7 +10583,7 @@ void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
                                         const u8* ie, u8 ie_len, gfp_t gfp)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         struct sk_buff *msg;
         void *hdr;
 
@@ -10747,7 +10763,7 @@ void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
                                unsigned int duration, gfp_t gfp)
 {
         struct wiphy *wiphy = wdev->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 
         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
@@ -10761,7 +10777,7 @@ void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
                                         gfp_t gfp)
 {
         struct wiphy *wiphy = wdev->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 
         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
@@ -10773,7 +10789,7 @@ void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
                       struct station_info *sinfo, gfp_t gfp)
 {
         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
         struct sk_buff *msg;
 
         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
@@ -10796,7 +10812,7 @@ EXPORT_SYMBOL(cfg80211_new_sta);
 void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp)
 {
         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
         struct sk_buff *msg;
         void *hdr;
 
@@ -10833,7 +10849,7 @@ void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
                           gfp_t gfp)
 {
         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
         struct sk_buff *msg;
         void *hdr;
 
@@ -10868,7 +10884,7 @@ static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
                                        const u8 *addr, gfp_t gfp)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         struct sk_buff *msg;
         void *hdr;
         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
@@ -10988,7 +11004,7 @@ void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
 {
         struct wiphy *wiphy = wdev->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
         struct net_device *netdev = wdev->netdev;
         struct sk_buff *msg;
         void *hdr;
@@ -11032,7 +11048,7 @@ void cfg80211_cqm_rssi_notify(struct net_device *dev,
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct wiphy *wiphy = wdev->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
         struct sk_buff *msg;
         struct nlattr *pinfoattr;
         void *hdr;
@@ -11124,7 +11140,7 @@ void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct wiphy *wiphy = wdev->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 
         trace_cfg80211_gtk_rekey_notify(dev, bssid);
         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
@@ -11182,7 +11198,7 @@ void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct wiphy *wiphy = wdev->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 
         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
@@ -11229,7 +11245,7 @@ void cfg80211_ch_switch_notify(struct net_device *dev,
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct wiphy *wiphy = wdev->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 
         ASSERT_WDEV_LOCK(wdev);
 
@@ -11253,7 +11269,7 @@ void cfg80211_cqm_txe_notify(struct net_device *dev,
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct wiphy *wiphy = wdev->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
         struct sk_buff *msg;
         struct nlattr *pinfoattr;
         void *hdr;
@@ -11353,7 +11369,7 @@ void cfg80211_cqm_pktloss_notify(struct net_device *dev,
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct wiphy *wiphy = wdev->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
         struct sk_buff *msg;
         struct nlattr *pinfoattr;
         void *hdr;
@@ -11400,7 +11416,7 @@ void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
                            u64 cookie, bool acked, gfp_t gfp)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         struct sk_buff *msg;
         void *hdr;
 
@@ -11440,7 +11456,7 @@ void cfg80211_report_obss_beacon(struct wiphy *wiphy,
                                  const u8 *frame, size_t len,
                                  int freq, int sig_dbm)
 {
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
         struct sk_buff *msg;
         void *hdr;
         struct cfg80211_beacon_registration *reg;
@@ -11487,7 +11503,7 @@ void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
                                    struct cfg80211_wowlan_wakeup *wakeup,
                                    gfp_t gfp)
 {
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         struct sk_buff *msg;
         void *hdr;
         int size = 200;
@@ -11597,7 +11613,7 @@ void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
                                 u16 reason_code, gfp_t gfp)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         struct sk_buff *msg;
         void *hdr;
 
@@ -11649,9 +11665,15 @@ static int nl80211_netlink_notify(struct notifier_block * nb,
         rcu_read_lock();
 
         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
-                list_for_each_entry_rcu(wdev, &rdev->wdev_list, list)
+                bool schedule_destroy_work = false;
+
+                list_for_each_entry_rcu(wdev, &rdev->wdev_list, list) {
                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
 
+                        if (wdev->owner_nlportid == notify->portid)
+                                schedule_destroy_work = true;
+                }
+
                 spin_lock_bh(&rdev->beacon_registrations_lock);
                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
                                          list) {
@@ -11662,11 +11684,24 @@ static int nl80211_netlink_notify(struct notifier_block * nb,
                         }
                 }
                 spin_unlock_bh(&rdev->beacon_registrations_lock);
+
+                if (schedule_destroy_work) {
+                        struct cfg80211_iface_destroy *destroy;
+
+                        destroy = kzalloc(sizeof(*destroy), GFP_ATOMIC);
+                        if (destroy) {
+                                destroy->nlportid = notify->portid;
+                                spin_lock(&rdev->destroy_list_lock);
+                                list_add(&destroy->list, &rdev->destroy_list);
+                                spin_unlock(&rdev->destroy_list_lock);
+                                schedule_work(&rdev->destroy_work);
+                        }
+                }
         }
 
         rcu_read_unlock();
 
-        return NOTIFY_DONE;
+        return NOTIFY_OK;
 }
 
 static struct notifier_block nl80211_netlink_notifier = {
@@ -11677,7 +11712,7 @@ void cfg80211_ft_event(struct net_device *netdev,
                        struct cfg80211_ft_event_params *ft_event)
 {
         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
         struct sk_buff *msg;
         void *hdr;
 
@@ -11724,7 +11759,7 @@ void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
         void *hdr;
         u32 nlportid;
 
-        rdev = wiphy_to_dev(wdev->wiphy);
+        rdev = wiphy_to_rdev(wdev->wiphy);
         if (!rdev->crit_proto_nlportid)
                 return;
 
@@ -11759,7 +11794,7 @@ EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
 {
         struct wiphy *wiphy = wdev->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
         struct sk_buff *msg;
         void *hdr;
 
diff --git a/net/wireless/rdev-ops.h b/net/wireless/rdev-ops.h
index 74d97d33c938..00cdf73ba6c4 100644
--- a/net/wireless/rdev-ops.h
+++ b/net/wireless/rdev-ops.h
@@ -950,4 +950,17 @@ static inline int rdev_set_qos_map(struct cfg80211_registered_device *rdev,
         return ret;
 }
 
+static inline int
+rdev_set_ap_chanwidth(struct cfg80211_registered_device *rdev,
+                      struct net_device *dev, struct cfg80211_chan_def *chandef)
+{
+        int ret;
+
+        trace_rdev_set_ap_chanwidth(&rdev->wiphy, dev, chandef);
+        ret = rdev->ops->set_ap_chanwidth(&rdev->wiphy, dev, chandef);
+        trace_rdev_return_int(&rdev->wiphy, ret);
+
+        return ret;
+}
+
 #endif /* __CFG80211_RDEV_OPS */
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index f59aaac586f8..e78f532aaa5b 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -65,11 +65,26 @@
 #define REG_DBG_PRINT(args...)
 #endif
 
+/**
+ * enum reg_request_treatment - regulatory request treatment
+ *
+ * @REG_REQ_OK: continue processing the regulatory request
+ * @REG_REQ_IGNORE: ignore the regulatory request
+ * @REG_REQ_INTERSECT: the regulatory domain resulting from this request should
+ *      be intersected with the current one.
+ * @REG_REQ_ALREADY_SET: the regulatory request will not change the current
+ *      regulatory settings, and no further processing is required.
+ * @REG_REQ_USER_HINT_HANDLED: a non alpha2  user hint was handled and no
+ *      further processing is required, i.e., not need to update last_request
+ *      etc. This should be used for user hints that do not provide an alpha2
+ *      but some other type of regulatory hint, i.e., indoor operation.
+ */
 enum reg_request_treatment {
         REG_REQ_OK,
         REG_REQ_IGNORE,
         REG_REQ_INTERSECT,
         REG_REQ_ALREADY_SET,
+        REG_REQ_USER_HINT_HANDLED,
 };
 
 static struct regulatory_request core_request_world = {
@@ -106,6 +121,14 @@ const struct ieee80211_regdomain __rcu *cfg80211_regdomain;
  */
 static int reg_num_devs_support_basehint;
 
+/*
+ * State variable indicating if the platform on which the devices
+ * are attached is operating in an indoor environment. The state variable
+ * is relevant for all registered devices.
+ * (protected by RTNL)
+ */
+static bool reg_is_indoor;
+
 static const struct ieee80211_regdomain *get_cfg80211_regdom(void)
 {
         return rtnl_dereference(cfg80211_regdomain);
@@ -240,8 +263,16 @@ static char user_alpha2[2];
 module_param(ieee80211_regdom, charp, 0444);
 MODULE_PARM_DESC(ieee80211_regdom, "IEEE 802.11 regulatory domain code");
 
-static void reg_free_request(struct regulatory_request *lr)
+static void reg_free_request(struct regulatory_request *request)
 {
+        if (request != get_last_request())
+                kfree(request);
+}
+
+static void reg_free_last_request(void)
+{
+        struct regulatory_request *lr = get_last_request();
+
         if (lr != &core_request_world && lr)
                 kfree_rcu(lr, rcu_head);
 }
@@ -254,7 +285,7 @@ static void reg_update_last_request(struct regulatory_request *request)
         if (lr == request)
                 return;
 
-        reg_free_request(lr);
+        reg_free_last_request();
         rcu_assign_pointer(last_request, request);
 }
 
@@ -873,6 +904,8 @@ static u32 map_regdom_flags(u32 rd_flags)
                 channel_flags |= IEEE80211_CHAN_RADAR;
         if (rd_flags & NL80211_RRF_NO_OFDM)
                 channel_flags |= IEEE80211_CHAN_NO_OFDM;
+        if (rd_flags & NL80211_RRF_NO_OUTDOOR)
+                channel_flags |= IEEE80211_CHAN_INDOOR_ONLY;
         return channel_flags;
 }
 
@@ -902,7 +935,7 @@ freq_reg_info_regd(struct wiphy *wiphy, u32 center_freq,
                 if (!band_rule_found)
                         band_rule_found = freq_in_rule_band(fr, center_freq);
 
-                bw_fits = reg_does_bw_fit(fr, center_freq, MHZ_TO_KHZ(20));
+                bw_fits = reg_does_bw_fit(fr, center_freq, MHZ_TO_KHZ(5));
 
                 if (band_rule_found && bw_fits)
                         return rr;
@@ -986,10 +1019,10 @@ static void chan_reg_rule_print_dbg(const struct ieee80211_regdomain *regd,
 }
 #endif
 
-/*
- * Note that right now we assume the desired channel bandwidth
- * is always 20 MHz for each individual channel (HT40 uses 20 MHz
- * per channel, the primary and the extension channel).
+/* Find an ieee80211_reg_rule such that a 5MHz channel with frequency
+ * chan->center_freq fits there.
+ * If there is no such reg_rule, disable the channel, otherwise set the
+ * flags corresponding to the bandwidths allowed in the particular reg_rule
  */
 static void handle_channel(struct wiphy *wiphy,
                            enum nl80211_reg_initiator initiator,
@@ -1050,8 +1083,12 @@ static void handle_channel(struct wiphy *wiphy,
         if (reg_rule->flags & NL80211_RRF_AUTO_BW)
                 max_bandwidth_khz = reg_get_max_bandwidth(regd, reg_rule);
 
+        if (max_bandwidth_khz < MHZ_TO_KHZ(10))
+                bw_flags = IEEE80211_CHAN_NO_10MHZ;
+        if (max_bandwidth_khz < MHZ_TO_KHZ(20))
+                bw_flags |= IEEE80211_CHAN_NO_20MHZ;
         if (max_bandwidth_khz < MHZ_TO_KHZ(40))
-                bw_flags = IEEE80211_CHAN_NO_HT40;
+                bw_flags |= IEEE80211_CHAN_NO_HT40;
         if (max_bandwidth_khz < MHZ_TO_KHZ(80))
                 bw_flags |= IEEE80211_CHAN_NO_80MHZ;
         if (max_bandwidth_khz < MHZ_TO_KHZ(160))
@@ -1071,6 +1108,13 @@ static void handle_channel(struct wiphy *wiphy,
                         (int) MBI_TO_DBI(power_rule->max_antenna_gain);
                 chan->max_reg_power = chan->max_power = chan->orig_mpwr =
                         (int) MBM_TO_DBM(power_rule->max_eirp);
+
+                if (chan->flags & IEEE80211_CHAN_RADAR) {
+                        chan->dfs_cac_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
+                        if (reg_rule->dfs_cac_ms)
+                                chan->dfs_cac_ms = reg_rule->dfs_cac_ms;
+                }
+
                 return;
         }
 
@@ -1126,12 +1170,19 @@ static bool reg_request_cell_base(struct regulatory_request *request)
         return request->user_reg_hint_type == NL80211_USER_REG_HINT_CELL_BASE;
 }
 
+static bool reg_request_indoor(struct regulatory_request *request)
+{
+        if (request->initiator != NL80211_REGDOM_SET_BY_USER)
+                return false;
+        return request->user_reg_hint_type == NL80211_USER_REG_HINT_INDOOR;
+}
+
 bool reg_last_request_cell_base(void)
 {
         return reg_request_cell_base(get_last_request());
 }
 
-#ifdef CONFIG_CFG80211_CERTIFICATION_ONUS
+#ifdef CONFIG_CFG80211_REG_CELLULAR_HINTS
 /* Core specific check */
 static enum reg_request_treatment
 reg_ignore_cell_hint(struct regulatory_request *pending_request)
@@ -1471,8 +1522,12 @@ static void handle_channel_custom(struct wiphy *wiphy,
         if (reg_rule->flags & NL80211_RRF_AUTO_BW)
                 max_bandwidth_khz = reg_get_max_bandwidth(regd, reg_rule);
 
+        if (max_bandwidth_khz < MHZ_TO_KHZ(10))
+                bw_flags = IEEE80211_CHAN_NO_10MHZ;
+        if (max_bandwidth_khz < MHZ_TO_KHZ(20))
+                bw_flags |= IEEE80211_CHAN_NO_20MHZ;
         if (max_bandwidth_khz < MHZ_TO_KHZ(40))
-                bw_flags = IEEE80211_CHAN_NO_HT40;
+                bw_flags |= IEEE80211_CHAN_NO_HT40;
         if (max_bandwidth_khz < MHZ_TO_KHZ(80))
                 bw_flags |= IEEE80211_CHAN_NO_80MHZ;
         if (max_bandwidth_khz < MHZ_TO_KHZ(160))
@@ -1568,6 +1623,11 @@ __reg_process_hint_user(struct regulatory_request *user_request)
 {
         struct regulatory_request *lr = get_last_request();
 
+        if (reg_request_indoor(user_request)) {
+                reg_is_indoor = true;
+                return REG_REQ_USER_HINT_HANDLED;
+        }
+
         if (reg_request_cell_base(user_request))
                 return reg_ignore_cell_hint(user_request);
 
@@ -1615,8 +1675,9 @@ reg_process_hint_user(struct regulatory_request *user_request)
 
         treatment = __reg_process_hint_user(user_request);
         if (treatment == REG_REQ_IGNORE ||
-            treatment == REG_REQ_ALREADY_SET) {
-                kfree(user_request);
+            treatment == REG_REQ_ALREADY_SET ||
+            treatment == REG_REQ_USER_HINT_HANDLED) {
+                reg_free_request(user_request);
                 return treatment;
         }
 
@@ -1676,14 +1737,15 @@ reg_process_hint_driver(struct wiphy *wiphy,
         case REG_REQ_OK:
                 break;
         case REG_REQ_IGNORE:
-                kfree(driver_request);
+        case REG_REQ_USER_HINT_HANDLED:
+                reg_free_request(driver_request);
                 return treatment;
         case REG_REQ_INTERSECT:
                 /* fall through */
         case REG_REQ_ALREADY_SET:
                 regd = reg_copy_regd(get_cfg80211_regdom());
                 if (IS_ERR(regd)) {
-                        kfree(driver_request);
+                        reg_free_request(driver_request);
                         return REG_REQ_IGNORE;
                 }
                 rcu_assign_pointer(wiphy->regd, regd);
@@ -1775,12 +1837,13 @@ reg_process_hint_country_ie(struct wiphy *wiphy,
         case REG_REQ_OK:
                 break;
         case REG_REQ_IGNORE:
+        case REG_REQ_USER_HINT_HANDLED:
                 /* fall through */
         case REG_REQ_ALREADY_SET:
-                kfree(country_ie_request);
+                reg_free_request(country_ie_request);
                 return treatment;
         case REG_REQ_INTERSECT:
-                kfree(country_ie_request);
+                reg_free_request(country_ie_request);
                 /*
                  * This doesn't happen yet, not sure we
                  * ever want to support it for this case.
@@ -1841,7 +1904,7 @@ static void reg_process_hint(struct regulatory_request *reg_request)
         return;
 
 out_free:
-        kfree(reg_request);
+        reg_free_request(reg_request);
 }
 
 /*
@@ -1857,7 +1920,7 @@ static void reg_process_pending_hints(void)
 
         /* When last_request->processed becomes true this will be rescheduled */
         if (lr && !lr->processed) {
-                REG_DBG_PRINT("Pending regulatory request, waiting for it to be processed...\n");
+                reg_process_hint(lr);
                 return;
         }
 
@@ -1967,6 +2030,22 @@ int regulatory_hint_user(const char *alpha2,
         return 0;
 }
 
+int regulatory_hint_indoor_user(void)
+{
+        struct regulatory_request *request;
+
+        request = kzalloc(sizeof(struct regulatory_request), GFP_KERNEL);
+        if (!request)
+                return -ENOMEM;
+
+        request->wiphy_idx = WIPHY_IDX_INVALID;
+        request->initiator = NL80211_REGDOM_SET_BY_USER;
+        request->user_reg_hint_type = NL80211_USER_REG_HINT_INDOOR;
+        queue_regulatory_request(request);
+
+        return 0;
+}
+
 /* Driver hints */
 int regulatory_hint(struct wiphy *wiphy, const char *alpha2)
 {
@@ -2134,6 +2213,8 @@ static void restore_regulatory_settings(bool reset_user)
 
         ASSERT_RTNL();
 
+        reg_is_indoor = false;
+
         reset_regdomains(true, &world_regdom);
         restore_alpha2(alpha2, reset_user);
 
@@ -2594,7 +2675,7 @@ void wiphy_regulatory_deregister(struct wiphy *wiphy)
                 reg_num_devs_support_basehint--;
 
         rcu_free_regdom(get_wiphy_regdom(wiphy));
-        rcu_assign_pointer(wiphy->regd, NULL);
+        RCU_INIT_POINTER(wiphy->regd, NULL);
 
         if (lr)
                 request_wiphy = wiphy_idx_to_wiphy(lr->wiphy_idx);
@@ -2614,6 +2695,40 @@ static void reg_timeout_work(struct work_struct *work)
         rtnl_unlock();
 }
 
+/*
+ * See http://www.fcc.gov/document/5-ghz-unlicensed-spectrum-unii, for
+ * UNII band definitions
+ */
+int cfg80211_get_unii(int freq)
+{
+        /* UNII-1 */
+        if (freq >= 5150 && freq <= 5250)
+                return 0;
+
+        /* UNII-2A */
+        if (freq > 5250 && freq <= 5350)
+                return 1;
+
+        /* UNII-2B */
+        if (freq > 5350 && freq <= 5470)
+                return 2;
+
+        /* UNII-2C */
+        if (freq > 5470 && freq <= 5725)
+                return 3;
+
+        /* UNII-3 */
+        if (freq > 5725 && freq <= 5825)
+                return 4;
+
+        return -EINVAL;
+}
+
+bool regulatory_indoor_allowed(void)
+{
+        return reg_is_indoor;
+}
+
 int __init regulatory_init(void)
 {
         int err = 0;
diff --git a/net/wireless/reg.h b/net/wireless/reg.h
index 37c180df34b7..5e48031ccb9a 100644
--- a/net/wireless/reg.h
+++ b/net/wireless/reg.h
@@ -25,6 +25,7 @@ enum nl80211_dfs_regions reg_get_dfs_region(struct wiphy *wiphy);
 
 int regulatory_hint_user(const char *alpha2,
                          enum nl80211_user_reg_hint_type user_reg_hint_type);
+int regulatory_hint_indoor_user(void);
 
 void wiphy_regulatory_register(struct wiphy *wiphy);
 void wiphy_regulatory_deregister(struct wiphy *wiphy);
@@ -104,4 +105,21 @@ void regulatory_hint_country_ie(struct wiphy *wiphy,
  */
 void regulatory_hint_disconnect(void);
 
+/**
+ * cfg80211_get_unii - get the U-NII band for the frequency
+ * @freq: the frequency for which we want to get the UNII band.
+
+ * Get a value specifying the U-NII band frequency belongs to.
+ * U-NII bands are defined by the FCC in C.F.R 47 part 15.
+ *
+ * Returns -EINVAL if freq is invalid, 0 for UNII-1, 1 for UNII-2A,
+ * 2 for UNII-2B, 3 for UNII-2C and 4 for UNII-3.
+ */
+int cfg80211_get_unii(int freq);
+
+/**
+ * regulatory_indoor_allowed - is indoor operation allowed
+ */
+bool regulatory_indoor_allowed(void);
+
 #endif  /* __NET_WIRELESS_REG_H */
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 7d09a712cb1f..e7329bb6a323 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -81,10 +81,10 @@ static void bss_free(struct cfg80211_internal_bss *bss)
         kfree(bss);
 }
 
-static inline void bss_ref_get(struct cfg80211_registered_device *dev,
+static inline void bss_ref_get(struct cfg80211_registered_device *rdev,
                                struct cfg80211_internal_bss *bss)
 {
-        lockdep_assert_held(&dev->bss_lock);
+        lockdep_assert_held(&rdev->bss_lock);
 
         bss->refcount++;
         if (bss->pub.hidden_beacon_bss) {
@@ -95,10 +95,10 @@ static inline void bss_ref_get(struct cfg80211_registered_device *dev,
         }
 }
 
-static inline void bss_ref_put(struct cfg80211_registered_device *dev,
+static inline void bss_ref_put(struct cfg80211_registered_device *rdev,
                                struct cfg80211_internal_bss *bss)
 {
-        lockdep_assert_held(&dev->bss_lock);
+        lockdep_assert_held(&rdev->bss_lock);
 
         if (bss->pub.hidden_beacon_bss) {
                 struct cfg80211_internal_bss *hbss;
@@ -114,10 +114,10 @@ static inline void bss_ref_put(struct cfg80211_registered_device *dev,
                 bss_free(bss);
 }
 
-static bool __cfg80211_unlink_bss(struct cfg80211_registered_device *dev,
+static bool __cfg80211_unlink_bss(struct cfg80211_registered_device *rdev,
                                   struct cfg80211_internal_bss *bss)
 {
-        lockdep_assert_held(&dev->bss_lock);
+        lockdep_assert_held(&rdev->bss_lock);
 
         if (!list_empty(&bss->hidden_list)) {
                 /*
@@ -134,31 +134,31 @@ static bool __cfg80211_unlink_bss(struct cfg80211_registered_device *dev,
         }
 
         list_del_init(&bss->list);
-        rb_erase(&bss->rbn, &dev->bss_tree);
-        bss_ref_put(dev, bss);
+        rb_erase(&bss->rbn, &rdev->bss_tree);
+        bss_ref_put(rdev, bss);
         return true;
 }
 
-static void __cfg80211_bss_expire(struct cfg80211_registered_device *dev,
+static void __cfg80211_bss_expire(struct cfg80211_registered_device *rdev,
                                   unsigned long expire_time)
 {
         struct cfg80211_internal_bss *bss, *tmp;
         bool expired = false;
 
-        lockdep_assert_held(&dev->bss_lock);
+        lockdep_assert_held(&rdev->bss_lock);
 
-        list_for_each_entry_safe(bss, tmp, &dev->bss_list, list) {
+        list_for_each_entry_safe(bss, tmp, &rdev->bss_list, list) {
                 if (atomic_read(&bss->hold))
                         continue;
                 if (!time_after(expire_time, bss->ts))
                         continue;
 
-                if (__cfg80211_unlink_bss(dev, bss))
+                if (__cfg80211_unlink_bss(rdev, bss))
                         expired = true;
         }
 
         if (expired)
-                dev->bss_generation++;
+                rdev->bss_generation++;
 }
 
 void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev,
@@ -238,11 +238,11 @@ void __cfg80211_scan_done(struct work_struct *wk)
 void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
 {
         trace_cfg80211_scan_done(request, aborted);
-        WARN_ON(request != wiphy_to_dev(request->wiphy)->scan_req);
+        WARN_ON(request != wiphy_to_rdev(request->wiphy)->scan_req);
 
         request->aborted = aborted;
         request->notified = true;
-        queue_work(cfg80211_wq, &wiphy_to_dev(request->wiphy)->scan_done_wk);
+        queue_work(cfg80211_wq, &wiphy_to_rdev(request->wiphy)->scan_done_wk);
 }
 EXPORT_SYMBOL(cfg80211_scan_done);
 
@@ -278,20 +278,28 @@ void cfg80211_sched_scan_results(struct wiphy *wiphy)
 {
         trace_cfg80211_sched_scan_results(wiphy);
         /* ignore if we're not scanning */
-        if (wiphy_to_dev(wiphy)->sched_scan_req)
+        if (wiphy_to_rdev(wiphy)->sched_scan_req)
                 queue_work(cfg80211_wq,
-                           &wiphy_to_dev(wiphy)->sched_scan_results_wk);
+                           &wiphy_to_rdev(wiphy)->sched_scan_results_wk);
 }
 EXPORT_SYMBOL(cfg80211_sched_scan_results);
 
-void cfg80211_sched_scan_stopped(struct wiphy *wiphy)
+void cfg80211_sched_scan_stopped_rtnl(struct wiphy *wiphy)
 {
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
+
+        ASSERT_RTNL();
 
         trace_cfg80211_sched_scan_stopped(wiphy);
 
-        rtnl_lock();
         __cfg80211_stop_sched_scan(rdev, true);
+}
+EXPORT_SYMBOL(cfg80211_sched_scan_stopped_rtnl);
+
+void cfg80211_sched_scan_stopped(struct wiphy *wiphy)
+{
+        rtnl_lock();
+        cfg80211_sched_scan_stopped_rtnl(wiphy);
         rtnl_unlock();
 }
 EXPORT_SYMBOL(cfg80211_sched_scan_stopped);
@@ -322,21 +330,21 @@ int __cfg80211_stop_sched_scan(struct cfg80211_registered_device *rdev,
         return 0;
 }
 
-void cfg80211_bss_age(struct cfg80211_registered_device *dev,
+void cfg80211_bss_age(struct cfg80211_registered_device *rdev,
                       unsigned long age_secs)
 {
         struct cfg80211_internal_bss *bss;
         unsigned long age_jiffies = msecs_to_jiffies(age_secs * MSEC_PER_SEC);
 
-        spin_lock_bh(&dev->bss_lock);
-        list_for_each_entry(bss, &dev->bss_list, list)
+        spin_lock_bh(&rdev->bss_lock);
+        list_for_each_entry(bss, &rdev->bss_list, list)
                 bss->ts -= age_jiffies;
-        spin_unlock_bh(&dev->bss_lock);
+        spin_unlock_bh(&rdev->bss_lock);
 }
 
-void cfg80211_bss_expire(struct cfg80211_registered_device *dev)
+void cfg80211_bss_expire(struct cfg80211_registered_device *rdev)
 {
-        __cfg80211_bss_expire(dev, jiffies - IEEE80211_SCAN_RESULT_EXPIRE);
+        __cfg80211_bss_expire(rdev, jiffies - IEEE80211_SCAN_RESULT_EXPIRE);
 }
 
 const u8 *cfg80211_find_ie(u8 eid, const u8 *ies, int len)
@@ -526,32 +534,34 @@ struct cfg80211_bss *cfg80211_get_bss(struct wiphy *wiphy,
                                       const u8 *ssid, size_t ssid_len,
                                       u16 capa_mask, u16 capa_val)
 {
-        struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
         struct cfg80211_internal_bss *bss, *res = NULL;
         unsigned long now = jiffies;
 
         trace_cfg80211_get_bss(wiphy, channel, bssid, ssid, ssid_len, capa_mask,
                                capa_val);
 
-        spin_lock_bh(&dev->bss_lock);
+        spin_lock_bh(&rdev->bss_lock);
 
-        list_for_each_entry(bss, &dev->bss_list, list) {
+        list_for_each_entry(bss, &rdev->bss_list, list) {
                 if ((bss->pub.capability & capa_mask) != capa_val)
                         continue;
                 if (channel && bss->pub.channel != channel)
                         continue;
+                if (!is_valid_ether_addr(bss->pub.bssid))
+                        continue;
                 /* Don't get expired BSS structs */
                 if (time_after(now, bss->ts + IEEE80211_SCAN_RESULT_EXPIRE) &&
                     !atomic_read(&bss->hold))
                         continue;
                 if (is_bss(&bss->pub, bssid, ssid, ssid_len)) {
                         res = bss;
-                        bss_ref_get(dev, res);
+                        bss_ref_get(rdev, res);
                         break;
                 }
         }
 
-        spin_unlock_bh(&dev->bss_lock);
+        spin_unlock_bh(&rdev->bss_lock);
         if (!res)
                 return NULL;
         trace_cfg80211_return_bss(&res->pub);
@@ -559,10 +569,10 @@ struct cfg80211_bss *cfg80211_get_bss(struct wiphy *wiphy,
 }
 EXPORT_SYMBOL(cfg80211_get_bss);
 
-static void rb_insert_bss(struct cfg80211_registered_device *dev,
+static void rb_insert_bss(struct cfg80211_registered_device *rdev,
                           struct cfg80211_internal_bss *bss)
 {
-        struct rb_node **p = &dev->bss_tree.rb_node;
+        struct rb_node **p = &rdev->bss_tree.rb_node;
         struct rb_node *parent = NULL;
         struct cfg80211_internal_bss *tbss;
         int cmp;
@@ -585,15 +595,15 @@ static void rb_insert_bss(struct cfg80211_registered_device *dev,
         }
 
         rb_link_node(&bss->rbn, parent, p);
-        rb_insert_color(&bss->rbn, &dev->bss_tree);
+        rb_insert_color(&bss->rbn, &rdev->bss_tree);
 }
 
 static struct cfg80211_internal_bss *
-rb_find_bss(struct cfg80211_registered_device *dev,
+rb_find_bss(struct cfg80211_registered_device *rdev,
             struct cfg80211_internal_bss *res,
             enum bss_compare_mode mode)
 {
-        struct rb_node *n = dev->bss_tree.rb_node;
+        struct rb_node *n = rdev->bss_tree.rb_node;
         struct cfg80211_internal_bss *bss;
         int r;
 
@@ -612,7 +622,7 @@ rb_find_bss(struct cfg80211_registered_device *dev,
         return NULL;
 }
 
-static bool cfg80211_combine_bsses(struct cfg80211_registered_device *dev,
+static bool cfg80211_combine_bsses(struct cfg80211_registered_device *rdev,
                                    struct cfg80211_internal_bss *new)
 {
         const struct cfg80211_bss_ies *ies;
@@ -642,7 +652,7 @@ static bool cfg80211_combine_bsses(struct cfg80211_registered_device *dev,
 
         /* This is the bad part ... */
 
-        list_for_each_entry(bss, &dev->bss_list, list) {
+        list_for_each_entry(bss, &rdev->bss_list, list) {
                 if (!ether_addr_equal(bss->pub.bssid, new->pub.bssid))
                         continue;
                 if (bss->pub.channel != new->pub.channel)
@@ -676,7 +686,7 @@ static bool cfg80211_combine_bsses(struct cfg80211_registered_device *dev,
 
 /* Returned bss is reference counted and must be cleaned up appropriately. */
 static struct cfg80211_internal_bss *
-cfg80211_bss_update(struct cfg80211_registered_device *dev,
+cfg80211_bss_update(struct cfg80211_registered_device *rdev,
                     struct cfg80211_internal_bss *tmp,
                     bool signal_valid)
 {
@@ -687,14 +697,14 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
 
         tmp->ts = jiffies;
 
-        spin_lock_bh(&dev->bss_lock);
+        spin_lock_bh(&rdev->bss_lock);
 
         if (WARN_ON(!rcu_access_pointer(tmp->pub.ies))) {
-                spin_unlock_bh(&dev->bss_lock);
+                spin_unlock_bh(&rdev->bss_lock);
                 return NULL;
         }
 
-        found = rb_find_bss(dev, tmp, BSS_CMP_REGULAR);
+        found = rb_find_bss(rdev, tmp, BSS_CMP_REGULAR);
 
         if (found) {
                 /* Update IEs */
@@ -781,7 +791,7 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
                  * is allocated on the stack since it's not needed in the
                  * more common case of an update
                  */
-                new = kzalloc(sizeof(*new) + dev->wiphy.bss_priv_size,
+                new = kzalloc(sizeof(*new) + rdev->wiphy.bss_priv_size,
                               GFP_ATOMIC);
                 if (!new) {
                         ies = (void *)rcu_dereference(tmp->pub.beacon_ies);
@@ -797,9 +807,9 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
                 INIT_LIST_HEAD(&new->hidden_list);
 
                 if (rcu_access_pointer(tmp->pub.proberesp_ies)) {
-                        hidden = rb_find_bss(dev, tmp, BSS_CMP_HIDE_ZLEN);
+                        hidden = rb_find_bss(rdev, tmp, BSS_CMP_HIDE_ZLEN);
                         if (!hidden)
-                                hidden = rb_find_bss(dev, tmp,
+                                hidden = rb_find_bss(rdev, tmp,
                                                      BSS_CMP_HIDE_NUL);
                         if (hidden) {
                                 new->pub.hidden_beacon_bss = &hidden->pub;
@@ -816,24 +826,24 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
                          * expensive search for any probe responses that should
                          * be grouped with this beacon for updates ...
                          */
-                        if (!cfg80211_combine_bsses(dev, new)) {
+                        if (!cfg80211_combine_bsses(rdev, new)) {
                                 kfree(new);
                                 goto drop;
                         }
                 }
 
-                list_add_tail(&new->list, &dev->bss_list);
-                rb_insert_bss(dev, new);
+                list_add_tail(&new->list, &rdev->bss_list);
+                rb_insert_bss(rdev, new);
                 found = new;
         }
 
-        dev->bss_generation++;
-        bss_ref_get(dev, found);
-        spin_unlock_bh(&dev->bss_lock);
+        rdev->bss_generation++;
+        bss_ref_get(rdev, found);
+        spin_unlock_bh(&rdev->bss_lock);
 
         return found;
  drop:
-        spin_unlock_bh(&dev->bss_lock);
+        spin_unlock_bh(&rdev->bss_lock);
         return NULL;
 }
 
@@ -917,7 +927,7 @@ cfg80211_inform_bss_width(struct wiphy *wiphy,
         rcu_assign_pointer(tmp.pub.beacon_ies, ies);
         rcu_assign_pointer(tmp.pub.ies, ies);
 
-        res = cfg80211_bss_update(wiphy_to_dev(wiphy), &tmp,
+        res = cfg80211_bss_update(wiphy_to_rdev(wiphy), &tmp,
                                   rx_channel == channel);
         if (!res)
                 return NULL;
@@ -989,7 +999,7 @@ cfg80211_inform_bss_width_frame(struct wiphy *wiphy,
         tmp.pub.beacon_interval = le16_to_cpu(mgmt->u.probe_resp.beacon_int);
         tmp.pub.capability = le16_to_cpu(mgmt->u.probe_resp.capab_info);
 
-        res = cfg80211_bss_update(wiphy_to_dev(wiphy), &tmp,
+        res = cfg80211_bss_update(wiphy_to_rdev(wiphy), &tmp,
                                   rx_channel == channel);
         if (!res)
                 return NULL;
@@ -1005,7 +1015,7 @@ EXPORT_SYMBOL(cfg80211_inform_bss_width_frame);
 
 void cfg80211_ref_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
 {
-        struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
         struct cfg80211_internal_bss *bss;
 
         if (!pub)
@@ -1013,15 +1023,15 @@ void cfg80211_ref_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
 
         bss = container_of(pub, struct cfg80211_internal_bss, pub);
 
-        spin_lock_bh(&dev->bss_lock);
-        bss_ref_get(dev, bss);
-        spin_unlock_bh(&dev->bss_lock);
+        spin_lock_bh(&rdev->bss_lock);
+        bss_ref_get(rdev, bss);
+        spin_unlock_bh(&rdev->bss_lock);
 }
 EXPORT_SYMBOL(cfg80211_ref_bss);
 
 void cfg80211_put_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
 {
-        struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
         struct cfg80211_internal_bss *bss;
 
         if (!pub)
@@ -1029,15 +1039,15 @@ void cfg80211_put_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
 
         bss = container_of(pub, struct cfg80211_internal_bss, pub);
 
-        spin_lock_bh(&dev->bss_lock);
-        bss_ref_put(dev, bss);
-        spin_unlock_bh(&dev->bss_lock);
+        spin_lock_bh(&rdev->bss_lock);
+        bss_ref_put(rdev, bss);
+        spin_unlock_bh(&rdev->bss_lock);
 }
 EXPORT_SYMBOL(cfg80211_put_bss);
 
 void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
 {
-        struct cfg80211_registered_device *dev = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
         struct cfg80211_internal_bss *bss;
 
         if (WARN_ON(!pub))
@@ -1045,12 +1055,12 @@ void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
 
         bss = container_of(pub, struct cfg80211_internal_bss, pub);
 
-        spin_lock_bh(&dev->bss_lock);
+        spin_lock_bh(&rdev->bss_lock);
         if (!list_empty(&bss->list)) {
-                if (__cfg80211_unlink_bss(dev, bss))
-                        dev->bss_generation++;
+                if (__cfg80211_unlink_bss(rdev, bss))
+                        rdev->bss_generation++;
         }
-        spin_unlock_bh(&dev->bss_lock);
+        spin_unlock_bh(&rdev->bss_lock);
 }
 EXPORT_SYMBOL(cfg80211_unlink_bss);
 
@@ -1067,7 +1077,7 @@ cfg80211_get_dev_from_ifindex(struct net *net, int ifindex)
         if (!dev)
                 return ERR_PTR(-ENODEV);
         if (dev->ieee80211_ptr)
-                rdev = wiphy_to_dev(dev->ieee80211_ptr->wiphy);
+                rdev = wiphy_to_rdev(dev->ieee80211_ptr->wiphy);
         else
                 rdev = ERR_PTR(-ENODEV);
         dev_put(dev);
@@ -1147,7 +1157,11 @@ int cfg80211_wext_siwscan(struct net_device *dev,
                                 int k;
                                 int wiphy_freq = wiphy->bands[band]->channels[j].center_freq;
                                 for (k = 0; k < wreq->num_channels; k++) {
-                                        int wext_freq = cfg80211_wext_freq(wiphy, &wreq->channel_list[k]);
+                                        struct iw_freq *freq =
+                                                &wreq->channel_list[k];
+                                        int wext_freq =
+                                                cfg80211_wext_freq(freq);
+
                                         if (wext_freq == wiphy_freq)
                                                 goto wext_freq_found;
                                 }
@@ -1459,7 +1473,7 @@ ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
 }
 
 
-static int ieee80211_scan_results(struct cfg80211_registered_device *dev,
+static int ieee80211_scan_results(struct cfg80211_registered_device *rdev,
                                   struct iw_request_info *info,
                                   char *buf, size_t len)
 {
@@ -1467,18 +1481,18 @@ static int ieee80211_scan_results(struct cfg80211_registered_device *dev,
         char *end_buf = buf + len;
         struct cfg80211_internal_bss *bss;
 
-        spin_lock_bh(&dev->bss_lock);
-        cfg80211_bss_expire(dev);
+        spin_lock_bh(&rdev->bss_lock);
+        cfg80211_bss_expire(rdev);
 
-        list_for_each_entry(bss, &dev->bss_list, list) {
+        list_for_each_entry(bss, &rdev->bss_list, list) {
                 if (buf + len - current_ev <= IW_EV_ADDR_LEN) {
-                        spin_unlock_bh(&dev->bss_lock);
+                        spin_unlock_bh(&rdev->bss_lock);
                         return -E2BIG;
                 }
-                current_ev = ieee80211_bss(&dev->wiphy, info, bss,
+                current_ev = ieee80211_bss(&rdev->wiphy, info, bss,
                                            current_ev, end_buf);
         }
-        spin_unlock_bh(&dev->bss_lock);
+        spin_unlock_bh(&rdev->bss_lock);
         return current_ev - buf;
 }
 
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index acdcb4a81817..0c0844b585d1 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -59,7 +59,7 @@ static void cfg80211_sme_free(struct wireless_dev *wdev)
 
 static int cfg80211_conn_scan(struct wireless_dev *wdev)
 {
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         struct cfg80211_scan_request *request;
         int n_channels, err;
 
@@ -130,7 +130,7 @@ static int cfg80211_conn_scan(struct wireless_dev *wdev)
 
 static int cfg80211_conn_do_work(struct wireless_dev *wdev)
 {
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         struct cfg80211_connect_params *params;
         struct cfg80211_assoc_request req = {};
         int err;
@@ -234,7 +234,6 @@ void cfg80211_conn_work(struct work_struct *work)
                                         NULL, 0, NULL, 0,
                                         WLAN_STATUS_UNSPECIFIED_FAILURE,
                                         false, NULL);
-                        cfg80211_sme_free(wdev);
                 }
                 wdev_unlock(wdev);
         }
@@ -245,7 +244,7 @@ void cfg80211_conn_work(struct work_struct *work)
 /* Returned bss is reference counted and must be cleaned up appropriately. */
 static struct cfg80211_bss *cfg80211_get_conn_bss(struct wireless_dev *wdev)
 {
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         struct cfg80211_bss *bss;
         u16 capa = WLAN_CAPABILITY_ESS;
 
@@ -275,7 +274,7 @@ static struct cfg80211_bss *cfg80211_get_conn_bss(struct wireless_dev *wdev)
 static void __cfg80211_sme_scan_done(struct net_device *dev)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         struct cfg80211_bss *bss;
 
         ASSERT_WDEV_LOCK(wdev);
@@ -306,7 +305,7 @@ void cfg80211_sme_scan_done(struct net_device *dev)
 void cfg80211_sme_rx_auth(struct wireless_dev *wdev, const u8 *buf, size_t len)
 {
         struct wiphy *wiphy = wdev->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
         u16 status_code = le16_to_cpu(mgmt->u.auth.status_code);
 
@@ -352,7 +351,7 @@ void cfg80211_sme_rx_auth(struct wireless_dev *wdev, const u8 *buf, size_t len)
 
 bool cfg80211_sme_rx_assoc_resp(struct wireless_dev *wdev, u16 status)
 {
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 
         if (!wdev->conn)
                 return false;
@@ -386,7 +385,7 @@ void cfg80211_sme_deauth(struct wireless_dev *wdev)
 
 void cfg80211_sme_auth_timeout(struct wireless_dev *wdev)
 {
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 
         if (!wdev->conn)
                 return;
@@ -397,7 +396,7 @@ void cfg80211_sme_auth_timeout(struct wireless_dev *wdev)
 
 void cfg80211_sme_disassoc(struct wireless_dev *wdev)
 {
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 
         if (!wdev->conn)
                 return;
@@ -408,7 +407,7 @@ void cfg80211_sme_disassoc(struct wireless_dev *wdev)
 
 void cfg80211_sme_assoc_timeout(struct wireless_dev *wdev)
 {
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 
         if (!wdev->conn)
                 return;
@@ -421,7 +420,7 @@ static int cfg80211_sme_connect(struct wireless_dev *wdev,
                                 struct cfg80211_connect_params *connect,
                                 const u8 *prev_bssid)
 {
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         struct cfg80211_bss *bss;
         int err;
 
@@ -468,7 +467,7 @@ static int cfg80211_sme_connect(struct wireless_dev *wdev,
         }
 
         wdev->conn->params.ssid = wdev->ssid;
-        wdev->conn->params.ssid_len = connect->ssid_len;
+        wdev->conn->params.ssid_len = wdev->ssid_len;
 
         /* see if we have the bss already */
         bss = cfg80211_get_conn_bss(wdev);
@@ -480,7 +479,6 @@ static int cfg80211_sme_connect(struct wireless_dev *wdev,
 
         /* we're good if we have a matching bss struct */
         if (bss) {
-                wdev->conn->state = CFG80211_CONN_AUTHENTICATE_NEXT;
                 err = cfg80211_conn_do_work(wdev);
                 cfg80211_put_bss(wdev->wiphy, bss);
         } else {
@@ -506,7 +504,7 @@ static int cfg80211_sme_connect(struct wireless_dev *wdev,
 
 static int cfg80211_sme_disconnect(struct wireless_dev *wdev, u16 reason)
 {
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         int err;
 
         if (!wdev->conn)
@@ -594,7 +592,7 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
                 return;
         }
 
-        nl80211_send_connect_result(wiphy_to_dev(wdev->wiphy), dev,
+        nl80211_send_connect_result(wiphy_to_rdev(wdev->wiphy), dev,
                                     bssid, req_ie, req_ie_len,
                                     resp_ie, resp_ie_len,
                                     status, GFP_KERNEL);
@@ -625,7 +623,7 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
 #endif
 
         if (!bss && (status == WLAN_STATUS_SUCCESS)) {
-                WARN_ON_ONCE(!wiphy_to_dev(wdev->wiphy)->ops->connect);
+                WARN_ON_ONCE(!wiphy_to_rdev(wdev->wiphy)->ops->connect);
                 bss = cfg80211_get_bss(wdev->wiphy, NULL, bssid,
                                        wdev->ssid, wdev->ssid_len,
                                        WLAN_CAPABILITY_ESS,
@@ -648,6 +646,7 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
                         cfg80211_unhold_bss(bss_from_pub(bss));
                         cfg80211_put_bss(wdev->wiphy, bss);
                 }
+                cfg80211_sme_free(wdev);
                 return;
         }
 
@@ -687,7 +686,7 @@ void cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
                              u16 status, gfp_t gfp)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         struct cfg80211_event *ev;
         unsigned long flags;
 
@@ -742,7 +741,8 @@ void __cfg80211_roamed(struct wireless_dev *wdev,
         cfg80211_hold_bss(bss_from_pub(bss));
         wdev->current_bss = bss_from_pub(bss);
 
-        nl80211_send_roamed(wiphy_to_dev(wdev->wiphy), wdev->netdev, bss->bssid,
+        nl80211_send_roamed(wiphy_to_rdev(wdev->wiphy),
+                            wdev->netdev, bss->bssid,
                             req_ie, req_ie_len, resp_ie, resp_ie_len,
                             GFP_KERNEL);
 
@@ -801,7 +801,7 @@ void cfg80211_roamed_bss(struct net_device *dev,
                          size_t resp_ie_len, gfp_t gfp)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         struct cfg80211_event *ev;
         unsigned long flags;
 
@@ -834,7 +834,7 @@ void __cfg80211_disconnected(struct net_device *dev, const u8 *ie,
                              size_t ie_len, u16 reason, bool from_ap)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         int i;
 #ifdef CONFIG_CFG80211_WEXT
         union iwreq_data wrqu;
@@ -880,7 +880,7 @@ void cfg80211_disconnected(struct net_device *dev, u16 reason,
                            u8 *ie, size_t ie_len, gfp_t gfp)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         struct cfg80211_event *ev;
         unsigned long flags;
 
diff --git a/net/wireless/trace.h b/net/wireless/trace.h
index aabccf13e07b..f3c13ff4d04c 100644
--- a/net/wireless/trace.h
+++ b/net/wireless/trace.h
@@ -1919,6 +1919,24 @@ TRACE_EVENT(rdev_set_qos_map,
                   WIPHY_PR_ARG, NETDEV_PR_ARG, __entry->num_des)
 );
 
+TRACE_EVENT(rdev_set_ap_chanwidth,
+        TP_PROTO(struct wiphy *wiphy, struct net_device *netdev,
+                 struct cfg80211_chan_def *chandef),
+        TP_ARGS(wiphy, netdev, chandef),
+        TP_STRUCT__entry(
+                WIPHY_ENTRY
+                NETDEV_ENTRY
+                CHAN_DEF_ENTRY
+        ),
+        TP_fast_assign(
+                WIPHY_ASSIGN;
+                NETDEV_ASSIGN;
+                CHAN_DEF_ASSIGN(chandef);
+        ),
+        TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT ", " CHAN_DEF_PR_FMT,
+                  WIPHY_PR_ARG, NETDEV_PR_ARG, CHAN_DEF_PR_ARG)
+);
+
 /*************************************************************
  *           cfg80211 exported functions traces              *
  *************************************************************/
@@ -2193,18 +2211,21 @@ TRACE_EVENT(cfg80211_cqm_rssi_notify,
 );
 
 TRACE_EVENT(cfg80211_reg_can_beacon,
-        TP_PROTO(struct wiphy *wiphy, struct cfg80211_chan_def *chandef),
-        TP_ARGS(wiphy, chandef),
+        TP_PROTO(struct wiphy *wiphy, struct cfg80211_chan_def *chandef,
+                 enum nl80211_iftype iftype),
+        TP_ARGS(wiphy, chandef, iftype),
         TP_STRUCT__entry(
                 WIPHY_ENTRY
                 CHAN_DEF_ENTRY
+                __field(enum nl80211_iftype, iftype)
         ),
         TP_fast_assign(
                 WIPHY_ASSIGN;
                 CHAN_DEF_ASSIGN(chandef);
+                __entry->iftype = iftype;
         ),
-        TP_printk(WIPHY_PR_FMT ", " CHAN_DEF_PR_FMT,
-                  WIPHY_PR_ARG, CHAN_DEF_PR_ARG)
+        TP_printk(WIPHY_PR_FMT ", " CHAN_DEF_PR_FMT ", iftype=%d",
+                  WIPHY_PR_ARG, CHAN_DEF_PR_ARG, __entry->iftype)
 );
 
 TRACE_EVENT(cfg80211_chandef_dfs_required,
diff --git a/net/wireless/util.c b/net/wireless/util.c
index e5872ff2c27c..7c47fa07b276 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -770,7 +770,7 @@ EXPORT_SYMBOL(ieee80211_bss_get_ie);
 
 void cfg80211_upload_connect_keys(struct wireless_dev *wdev)
 {
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         struct net_device *dev = wdev->netdev;
         int i;
 
@@ -888,11 +888,6 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
                 return -EBUSY;
 
         if (ntype != otype && netif_running(dev)) {
-                err = cfg80211_can_change_interface(rdev, dev->ieee80211_ptr,
-                                                    ntype);
-                if (err)
-                        return err;
-
                 dev->ieee80211_ptr->use_4addr = false;
                 dev->ieee80211_ptr->mesh_id_up_len = 0;
                 wdev_lock(dev->ieee80211_ptr);
@@ -1268,6 +1263,106 @@ int cfg80211_validate_beacon_int(struct cfg80211_registered_device *rdev,
         return res;
 }
 
+int cfg80211_iter_combinations(struct wiphy *wiphy,
+                               const int num_different_channels,
+                               const u8 radar_detect,
+                               const int iftype_num[NUM_NL80211_IFTYPES],
+                               void (*iter)(const struct ieee80211_iface_combination *c,
+                                            void *data),
+                               void *data)
+{
+        int i, j, iftype;
+        int num_interfaces = 0;
+        u32 used_iftypes = 0;
+
+        for (iftype = 0; iftype < NUM_NL80211_IFTYPES; iftype++) {
+                num_interfaces += iftype_num[iftype];
+                if (iftype_num[iftype] > 0 &&
+                    !(wiphy->software_iftypes & BIT(iftype)))
+                        used_iftypes |= BIT(iftype);
+        }
+
+        for (i = 0; i < wiphy->n_iface_combinations; i++) {
+                const struct ieee80211_iface_combination *c;
+                struct ieee80211_iface_limit *limits;
+                u32 all_iftypes = 0;
+
+                c = &wiphy->iface_combinations[i];
+
+                if (num_interfaces > c->max_interfaces)
+                        continue;
+                if (num_different_channels > c->num_different_channels)
+                        continue;
+
+                limits = kmemdup(c->limits, sizeof(limits[0]) * c->n_limits,
+                                 GFP_KERNEL);
+                if (!limits)
+                        return -ENOMEM;
+
+                for (iftype = 0; iftype < NUM_NL80211_IFTYPES; iftype++) {
+                        if (wiphy->software_iftypes & BIT(iftype))
+                                continue;
+                        for (j = 0; j < c->n_limits; j++) {
+                                all_iftypes |= limits[j].types;
+                                if (!(limits[j].types & BIT(iftype)))
+                                        continue;
+                                if (limits[j].max < iftype_num[iftype])
+                                        goto cont;
+                                limits[j].max -= iftype_num[iftype];
+                        }
+                }
+
+                if (radar_detect != (c->radar_detect_widths & radar_detect))
+                        goto cont;
+
+                /* Finally check that all iftypes that we're currently
+                 * using are actually part of this combination. If they
+                 * aren't then we can't use this combination and have
+                 * to continue to the next.
+                 */
+                if ((all_iftypes & used_iftypes) != used_iftypes)
+                        goto cont;
+
+                /* This combination covered all interface types and
+                 * supported the requested numbers, so we're good.
+                 */
+
+                (*iter)(c, data);
+ cont:
+                kfree(limits);
+        }
+
+        return 0;
+}
+EXPORT_SYMBOL(cfg80211_iter_combinations);
+
+static void
+cfg80211_iter_sum_ifcombs(const struct ieee80211_iface_combination *c,
+                          void *data)
+{
+        int *num = data;
+        (*num)++;
+}
+
+int cfg80211_check_combinations(struct wiphy *wiphy,
+                                const int num_different_channels,
+                                const u8 radar_detect,
+                                const int iftype_num[NUM_NL80211_IFTYPES])
+{
+        int err, num = 0;
+
+        err = cfg80211_iter_combinations(wiphy, num_different_channels,
+                                         radar_detect, iftype_num,
+                                         cfg80211_iter_sum_ifcombs, &num);
+        if (err)
+                return err;
+        if (num == 0)
+                return -EBUSY;
+
+        return 0;
+}
+EXPORT_SYMBOL(cfg80211_check_combinations);
+
 int cfg80211_can_use_iftype_chan(struct cfg80211_registered_device *rdev,
                                  struct wireless_dev *wdev,
                                  enum nl80211_iftype iftype,
@@ -1276,7 +1371,6 @@ int cfg80211_can_use_iftype_chan(struct cfg80211_registered_device *rdev,
                                  u8 radar_detect)
 {
         struct wireless_dev *wdev_iter;
-        u32 used_iftypes = BIT(iftype);
         int num[NUM_NL80211_IFTYPES];
         struct ieee80211_channel
                         *used_channels[CFG80211_MAX_NUM_DIFFERENT_CHANNELS];
@@ -1284,7 +1378,7 @@ int cfg80211_can_use_iftype_chan(struct cfg80211_registered_device *rdev,
         enum cfg80211_chan_mode chmode;
         int num_different_channels = 0;
         int total = 1;
-        int i, j;
+        int i;
 
         ASSERT_RTNL();
 
@@ -1306,6 +1400,11 @@ int cfg80211_can_use_iftype_chan(struct cfg80211_registered_device *rdev,
 
         num[iftype] = 1;
 
+        /* TODO: We'll probably not need this anymore, since this
+         * should only be called with CHAN_MODE_UNDEFINED. There are
+         * still a couple of pending calls where other chanmodes are
+         * used, but we should get rid of them.
+         */
         switch (chanmode) {
         case CHAN_MODE_UNDEFINED:
                 break;
@@ -1369,65 +1468,13 @@ int cfg80211_can_use_iftype_chan(struct cfg80211_registered_device *rdev,
 
                 num[wdev_iter->iftype]++;
                 total++;
-                used_iftypes |= BIT(wdev_iter->iftype);
         }
 
         if (total == 1 && !radar_detect)
                 return 0;
 
-        for (i = 0; i < rdev->wiphy.n_iface_combinations; i++) {
-                const struct ieee80211_iface_combination *c;
-                struct ieee80211_iface_limit *limits;
-                u32 all_iftypes = 0;
-
-                c = &rdev->wiphy.iface_combinations[i];
-
-                if (total > c->max_interfaces)
-                        continue;
-                if (num_different_channels > c->num_different_channels)
-                        continue;
-
-                limits = kmemdup(c->limits, sizeof(limits[0]) * c->n_limits,
-                                 GFP_KERNEL);
-                if (!limits)
-                        return -ENOMEM;
-
-                for (iftype = 0; iftype < NUM_NL80211_IFTYPES; iftype++) {
-                        if (rdev->wiphy.software_iftypes & BIT(iftype))
-                                continue;
-                        for (j = 0; j < c->n_limits; j++) {
-                                all_iftypes |= limits[j].types;
-                                if (!(limits[j].types & BIT(iftype)))
-                                        continue;
-                                if (limits[j].max < num[iftype])
-                                        goto cont;
-                                limits[j].max -= num[iftype];
-                        }
-                }
-
-                if (radar_detect && !(c->radar_detect_widths & radar_detect))
-                        goto cont;
-
-                /*
-                 * Finally check that all iftypes that we're currently
-                 * using are actually part of this combination. If they
-                 * aren't then we can't use this combination and have
-                 * to continue to the next.
-                 */
-                if ((all_iftypes & used_iftypes) != used_iftypes)
-                        goto cont;
-
-                /*
-                 * This combination covered all interface types and
-                 * supported the requested numbers, so we're good.
-                 */
-                kfree(limits);
-                return 0;
- cont:
-                kfree(limits);
-        }
-
-        return -EBUSY;
+        return cfg80211_check_combinations(&rdev->wiphy, num_different_channels,
+                                           radar_detect, num);
 }
 
 int ieee80211_get_ratemask(struct ieee80211_supported_band *sband,
diff --git a/net/wireless/wext-compat.c b/net/wireless/wext-compat.c
index 5661a54ac7ee..11120bb14162 100644
--- a/net/wireless/wext-compat.c
+++ b/net/wireless/wext-compat.c
@@ -73,7 +73,7 @@ int cfg80211_wext_siwmode(struct net_device *dev, struct iw_request_info *info,
         struct vif_params vifparams;
         enum nl80211_iftype type;
 
-        rdev = wiphy_to_dev(wdev->wiphy);
+        rdev = wiphy_to_rdev(wdev->wiphy);
 
         switch (*mode) {
         case IW_MODE_INFRA:
@@ -253,12 +253,12 @@ EXPORT_SYMBOL_GPL(cfg80211_wext_giwrange);
 
 /**
  * cfg80211_wext_freq - get wext frequency for non-"auto"
- * @wiphy: the wiphy
+ * @dev: the net device
  * @freq: the wext freq encoding
  *
  * Returns a frequency, or a negative error code, or 0 for auto.
  */
-int cfg80211_wext_freq(struct wiphy *wiphy, struct iw_freq *freq)
+int cfg80211_wext_freq(struct iw_freq *freq)
 {
         /*
          * Parse frequency - return 0 for auto and
@@ -286,7 +286,7 @@ int cfg80211_wext_siwrts(struct net_device *dev,
                          struct iw_param *rts, char *extra)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         u32 orts = wdev->wiphy->rts_threshold;
         int err;
 
@@ -324,7 +324,7 @@ int cfg80211_wext_siwfrag(struct net_device *dev,
                           struct iw_param *frag, char *extra)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         u32 ofrag = wdev->wiphy->frag_threshold;
         int err;
 
@@ -364,7 +364,7 @@ static int cfg80211_wext_siwretry(struct net_device *dev,
                                   struct iw_param *retry, char *extra)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         u32 changed = 0;
         u8 olong = wdev->wiphy->retry_long;
         u8 oshort = wdev->wiphy->retry_short;
@@ -587,7 +587,7 @@ static int cfg80211_wext_siwencode(struct net_device *dev,
                                    struct iw_point *erq, char *keybuf)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         int idx, err;
         bool remove = false;
         struct key_params params;
@@ -647,7 +647,7 @@ static int cfg80211_wext_siwencodeext(struct net_device *dev,
                                       struct iw_point *erq, char *extra)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         struct iw_encode_ext *ext = (struct iw_encode_ext *) extra;
         const u8 *addr;
         int idx;
@@ -775,7 +775,7 @@ static int cfg80211_wext_siwfreq(struct net_device *dev,
                                  struct iw_freq *wextfreq, char *extra)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         struct cfg80211_chan_def chandef = {
                 .width = NL80211_CHAN_WIDTH_20_NOHT,
         };
@@ -787,7 +787,7 @@ static int cfg80211_wext_siwfreq(struct net_device *dev,
         case NL80211_IFTYPE_ADHOC:
                 return cfg80211_ibss_wext_siwfreq(dev, info, wextfreq, extra);
         case NL80211_IFTYPE_MONITOR:
-                freq = cfg80211_wext_freq(wdev->wiphy, wextfreq);
+                freq = cfg80211_wext_freq(wextfreq);
                 if (freq < 0)
                         return freq;
                 if (freq == 0)
@@ -798,7 +798,7 @@ static int cfg80211_wext_siwfreq(struct net_device *dev,
                         return -EINVAL;
                 return cfg80211_set_monitor_channel(rdev, &chandef);
         case NL80211_IFTYPE_MESH_POINT:
-                freq = cfg80211_wext_freq(wdev->wiphy, wextfreq);
+                freq = cfg80211_wext_freq(wextfreq);
                 if (freq < 0)
                         return freq;
                 if (freq == 0)
@@ -818,7 +818,7 @@ static int cfg80211_wext_giwfreq(struct net_device *dev,
                                  struct iw_freq *freq, char *extra)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         struct cfg80211_chan_def chandef;
         int ret;
 
@@ -847,7 +847,7 @@ static int cfg80211_wext_siwtxpower(struct net_device *dev,
                                     union iwreq_data *data, char *extra)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         enum nl80211_tx_power_setting type;
         int dbm = 0;
 
@@ -899,7 +899,7 @@ static int cfg80211_wext_giwtxpower(struct net_device *dev,
                                     union iwreq_data *data, char *extra)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         int err, val;
 
         if ((data->txpower.flags & IW_TXPOW_TYPE) != IW_TXPOW_DBM)
@@ -1119,7 +1119,7 @@ static int cfg80211_wext_siwpower(struct net_device *dev,
                                   struct iw_param *wrq, char *extra)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         bool ps = wdev->ps;
         int timeout = wdev->ps_timeout;
         int err;
@@ -1177,7 +1177,7 @@ static int cfg80211_wds_wext_siwap(struct net_device *dev,
                                    struct sockaddr *addr, char *extra)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         int err;
 
         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_WDS))
@@ -1221,7 +1221,7 @@ static int cfg80211_wext_siwrate(struct net_device *dev,
                                  struct iw_param *rate, char *extra)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         struct cfg80211_bitrate_mask mask;
         u32 fixed, maxrate;
         struct ieee80211_supported_band *sband;
@@ -1272,7 +1272,7 @@ static int cfg80211_wext_giwrate(struct net_device *dev,
                                  struct iw_param *rate, char *extra)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         /* we are under RTNL - globally locked - so can use a static struct */
         static struct station_info sinfo;
         u8 addr[ETH_ALEN];
@@ -1310,7 +1310,7 @@ static int cfg80211_wext_giwrate(struct net_device *dev,
 static struct iw_statistics *cfg80211_wireless_stats(struct net_device *dev)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         /* we are under RTNL - globally locked - so can use static structs */
         static struct iw_statistics wstats;
         static struct station_info sinfo;
@@ -1449,7 +1449,7 @@ static int cfg80211_wext_siwpmksa(struct net_device *dev,
                                   struct iw_point *data, char *extra)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         struct cfg80211_pmksa cfg_pmksa;
         struct iw_pmksa *pmksa = (struct iw_pmksa *)extra;
 
diff --git a/net/wireless/wext-compat.h b/net/wireless/wext-compat.h
index 5d766b0118e8..ebcacca2f731 100644
--- a/net/wireless/wext-compat.h
+++ b/net/wireless/wext-compat.h
@@ -50,7 +50,7 @@ int cfg80211_wext_siwgenie(struct net_device *dev,
                            struct iw_point *data, char *extra);
 
 
-int cfg80211_wext_freq(struct wiphy *wiphy, struct iw_freq *freq);
+int cfg80211_wext_freq(struct iw_freq *freq);
 
 
 extern const struct iw_handler_def cfg80211_wext_handler;
diff --git a/net/wireless/wext-sme.c b/net/wireless/wext-sme.c
index 86c331a65664..c7e5c8eb4f24 100644
--- a/net/wireless/wext-sme.c
+++ b/net/wireless/wext-sme.c
@@ -67,7 +67,7 @@ int cfg80211_mgd_wext_siwfreq(struct net_device *dev,
                               struct iw_freq *wextfreq, char *extra)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         struct ieee80211_channel *chan = NULL;
         int err, freq;
 
@@ -75,7 +75,7 @@ int cfg80211_mgd_wext_siwfreq(struct net_device *dev,
         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION))
                 return -EINVAL;
 
-        freq = cfg80211_wext_freq(wdev->wiphy, wextfreq);
+        freq = cfg80211_wext_freq(wextfreq);
         if (freq < 0)
                 return freq;
 
@@ -169,7 +169,7 @@ int cfg80211_mgd_wext_siwessid(struct net_device *dev,
                                struct iw_point *data, char *ssid)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         size_t len = data->length;
         int err;
 
@@ -260,7 +260,7 @@ int cfg80211_mgd_wext_siwap(struct net_device *dev,
                             struct sockaddr *ap_addr, char *extra)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         u8 *bssid = ap_addr->sa_data;
         int err;
 
@@ -333,7 +333,7 @@ int cfg80211_wext_siwgenie(struct net_device *dev,
                            struct iw_point *data, char *extra)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
         u8 *ie = extra;
         int ie_len = data->length, err;
 
@@ -390,7 +390,7 @@ int cfg80211_wext_siwmlme(struct net_device *dev,
         if (!wdev)
                 return -EOPNOTSUPP;
 
-        rdev = wiphy_to_dev(wdev->wiphy);
+        rdev = wiphy_to_rdev(wdev->wiphy);
 
         if (wdev->iftype != NL80211_IFTYPE_STATION)
                 return -EINVAL;