Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem

16 files changed, 250 insertions, 227 deletions

diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 5cc1bf7d8033..d0deb3edae21 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -135,7 +135,8 @@ void ieee80211_send_bar(struct ieee80211_vif *vif, u8 *ra, u16 tid, u16 ssn)
         bar->control = cpu_to_le16(bar_control);
         bar->start_seq_num = cpu_to_le16(ssn);
 
-        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
+                                        IEEE80211_TX_CTL_REQ_TX_STATUS;
         ieee80211_tx_skb_tid(sdata, skb, tid);
 }
 EXPORT_SYMBOL(ieee80211_send_bar);
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index ccbe2413142a..d41974aacf51 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -20,31 +20,31 @@
 #include "rate.h"
 #include "mesh.h"
 
-static struct net_device *ieee80211_add_iface(struct wiphy *wiphy, char *name,
-                                              enum nl80211_iftype type,
-                                              u32 *flags,
-                                              struct vif_params *params)
+static struct wireless_dev *ieee80211_add_iface(struct wiphy *wiphy, char *name,
+                                                enum nl80211_iftype type,
+                                                u32 *flags,
+                                                struct vif_params *params)
 {
         struct ieee80211_local *local = wiphy_priv(wiphy);
-        struct net_device *dev;
+        struct wireless_dev *wdev;
         struct ieee80211_sub_if_data *sdata;
         int err;
 
-        err = ieee80211_if_add(local, name, &dev, type, params);
+        err = ieee80211_if_add(local, name, &wdev, type, params);
         if (err)
                 return ERR_PTR(err);
 
         if (type == NL80211_IFTYPE_MONITOR && flags) {
-                sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+                sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
                 sdata->u.mntr_flags = *flags;
         }
 
-        return dev;
+        return wdev;
 }
 
-static int ieee80211_del_iface(struct wiphy *wiphy, struct net_device *dev)
+static int ieee80211_del_iface(struct wiphy *wiphy, struct wireless_dev *wdev)
 {
-        ieee80211_if_remove(IEEE80211_DEV_TO_SUB_IF(dev));
+        ieee80211_if_remove(IEEE80211_WDEV_TO_SUB_IF(wdev));
 
         return 0;
 }
@@ -917,6 +917,7 @@ static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
 
         kfree_rcu(old, rcu_head);
 
+        sta_info_flush(sdata->local, sdata);
         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED);
 
         return 0;
@@ -1741,6 +1742,8 @@ static int ieee80211_set_txq_params(struct wiphy *wiphy,
                 return -EINVAL;
         }
 
+        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_QOS);
+
         return 0;
 }
 
@@ -1761,10 +1764,11 @@ static int ieee80211_resume(struct wiphy *wiphy)
 #endif
 
 static int ieee80211_scan(struct wiphy *wiphy,
-                          struct net_device *dev,
                           struct cfg80211_scan_request *req)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_sub_if_data *sdata;
+
+        sdata = IEEE80211_WDEV_TO_SUB_IF(req->wdev);
 
         switch (ieee80211_vif_type_p2p(&sdata->vif)) {
         case NL80211_IFTYPE_STATION:
@@ -2297,13 +2301,13 @@ static int ieee80211_start_roc_work(struct ieee80211_local *local,
 }
 
 static int ieee80211_remain_on_channel(struct wiphy *wiphy,
-                                       struct net_device *dev,
+                                       struct wireless_dev *wdev,
                                        struct ieee80211_channel *chan,
                                        enum nl80211_channel_type channel_type,
                                        unsigned int duration,
                                        u64 *cookie)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
         struct ieee80211_local *local = sdata->local;
         int ret;
 
@@ -2390,23 +2394,23 @@ static int ieee80211_cancel_roc(struct ieee80211_local *local,
 }
 
 static int ieee80211_cancel_remain_on_channel(struct wiphy *wiphy,
-                                              struct net_device *dev,
+                                              struct wireless_dev *wdev,
                                               u64 cookie)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
         struct ieee80211_local *local = sdata->local;
 
         return ieee80211_cancel_roc(local, cookie, false);
 }
 
-static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
+static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
                              struct ieee80211_channel *chan, bool offchan,
                              enum nl80211_channel_type channel_type,
                              bool channel_type_valid, unsigned int wait,
                              const u8 *buf, size_t len, bool no_cck,
                              bool dont_wait_for_ack, u64 *cookie)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb;
         struct sta_info *sta;
@@ -2490,6 +2494,7 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
         skb->dev = sdata->dev;
 
         if (!need_offchan) {
+                *cookie = (unsigned long) skb;
                 ieee80211_tx_skb(sdata, skb);
                 ret = 0;
                 goto out_unlock;
@@ -2511,21 +2516,20 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
 }
 
 static int ieee80211_mgmt_tx_cancel_wait(struct wiphy *wiphy,
-                                         struct net_device *dev,
+                                         struct wireless_dev *wdev,
                                          u64 cookie)
 {
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_local *local = wiphy_priv(wiphy);
 
         return ieee80211_cancel_roc(local, cookie, true);
 }
 
 static void ieee80211_mgmt_frame_register(struct wiphy *wiphy,
-                                          struct net_device *dev,
+                                          struct wireless_dev *wdev,
                                           u16 frame_type, bool reg)
 {
         struct ieee80211_local *local = wiphy_priv(wiphy);
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
 
         switch (frame_type) {
         case IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_AUTH:
@@ -2980,14 +2984,14 @@ static int ieee80211_probe_client(struct wiphy *wiphy, struct net_device *dev,
         return 0;
 }
 
-static void ieee80211_set_monitor_enabled(struct wiphy *wiphy, bool enabled)
+static struct ieee80211_channel *
+ieee80211_cfg_get_channel(struct wiphy *wiphy, struct wireless_dev *wdev,
+                          enum nl80211_channel_type *type)
 {
         struct ieee80211_local *local = wiphy_priv(wiphy);
 
-        if (enabled)
-                WARN_ON(ieee80211_add_virtual_monitor(local));
-        else
-                ieee80211_del_virtual_monitor(local);
+        *type = local->_oper_channel_type;
+        return local->oper_channel;
 }
 
 #ifdef CONFIG_PM
@@ -3064,11 +3068,11 @@ struct cfg80211_ops mac80211_config_ops = {
         .tdls_mgmt = ieee80211_tdls_mgmt,
         .probe_client = ieee80211_probe_client,
         .set_noack_map = ieee80211_set_noack_map,
-        .set_monitor_enabled = ieee80211_set_monitor_enabled,
 #ifdef CONFIG_PM
         .set_wakeup = ieee80211_set_wakeup,
 #endif
         .get_et_sset_count = ieee80211_get_et_sset_count,
         .get_et_stats = ieee80211_get_et_stats,
         .get_et_strings = ieee80211_get_et_strings,
+        .get_channel = ieee80211_cfg_get_channel,
 };
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index 778e5916d7c3..b8dfb440c8ef 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -325,8 +325,6 @@ void debugfs_hw_add(struct ieee80211_local *local)
                 local->rx_handlers_drop_defrag);
         DEBUGFS_STATS_ADD(rx_handlers_drop_short,
                 local->rx_handlers_drop_short);
-        DEBUGFS_STATS_ADD(rx_handlers_drop_passive_scan,
-                local->rx_handlers_drop_passive_scan);
         DEBUGFS_STATS_ADD(tx_expand_skb_head,
                 local->tx_expand_skb_head);
         DEBUGFS_STATS_ADD(tx_expand_skb_head_cloned,
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index e0423f8c0ce1..bb61f7718c4c 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -85,6 +85,8 @@ struct ieee80211_bss {
         size_t ssid_len;
         u8 ssid[IEEE80211_MAX_SSID_LEN];
 
+        u32 device_ts;
+
         u8 dtim_period;
 
         bool wmm_used;
@@ -207,7 +209,6 @@ typedef unsigned __bitwise__ ieee80211_rx_result;
  * enum ieee80211_packet_rx_flags - packet RX flags
  * @IEEE80211_RX_RA_MATCH: frame is destined to interface currently processed
  *      (incl. multicast frames)
- * @IEEE80211_RX_IN_SCAN: received while scanning
  * @IEEE80211_RX_FRAGMENTED: fragmented frame
  * @IEEE80211_RX_AMSDU: a-MSDU packet
  * @IEEE80211_RX_MALFORMED_ACTION_FRM: action frame is malformed
@@ -217,7 +218,6 @@ typedef unsigned __bitwise__ ieee80211_rx_result;
  * @rx_flags field of &struct ieee80211_rx_status.
  */
 enum ieee80211_packet_rx_flags {
-        IEEE80211_RX_IN_SCAN                    = BIT(0),
         IEEE80211_RX_RA_MATCH                   = BIT(1),
         IEEE80211_RX_FRAGMENTED                 = BIT(2),
         IEEE80211_RX_AMSDU                      = BIT(3),
@@ -965,14 +965,14 @@ struct ieee80211_local {
         int scan_channel_idx;
         int scan_ies_len;
 
-        bool sched_scanning;
         struct ieee80211_sched_scan_ies sched_scan_ies;
         struct work_struct sched_scan_stopped_work;
+        struct ieee80211_sub_if_data __rcu *sched_scan_sdata;
 
         unsigned long leave_oper_channel_time;
         enum mac80211_scan_state next_scan_state;
         struct delayed_work scan_work;
-        struct ieee80211_sub_if_data *scan_sdata;
+        struct ieee80211_sub_if_data __rcu *scan_sdata;
         enum nl80211_channel_type _oper_channel_type;
         struct ieee80211_channel *oper_channel, *csa_channel;
 
@@ -1014,7 +1014,6 @@ struct ieee80211_local {
         unsigned int rx_handlers_drop_nullfunc;
         unsigned int rx_handlers_drop_defrag;
         unsigned int rx_handlers_drop_short;
-        unsigned int rx_handlers_drop_passive_scan;
         unsigned int tx_expand_skb_head;
         unsigned int tx_expand_skb_head_cloned;
         unsigned int rx_expand_skb_head;
@@ -1091,6 +1090,12 @@ IEEE80211_DEV_TO_SUB_IF(struct net_device *dev)
         return netdev_priv(dev);
 }
 
+static inline struct ieee80211_sub_if_data *
+IEEE80211_WDEV_TO_SUB_IF(struct wireless_dev *wdev)
+{
+        return container_of(wdev, struct ieee80211_sub_if_data, wdev);
+}
+
 /* this struct represents 802.11n's RA/TID combination */
 struct ieee80211_ra_tid {
         u8 ra[ETH_ALEN];
@@ -1241,8 +1246,7 @@ int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
                            struct cfg80211_scan_request *req);
 void ieee80211_scan_cancel(struct ieee80211_local *local);
 void ieee80211_run_deferred_scan(struct ieee80211_local *local);
-ieee80211_rx_result
-ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb);
+void ieee80211_scan_rx(struct ieee80211_local *local, struct sk_buff *skb);
 
 void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local);
 struct ieee80211_bss *
@@ -1278,7 +1282,7 @@ void ieee80211_handle_roc_started(struct ieee80211_roc_work *roc);
 int ieee80211_iface_init(void);
 void ieee80211_iface_exit(void);
 int ieee80211_if_add(struct ieee80211_local *local, const char *name,
-                     struct net_device **new_dev, enum nl80211_iftype type,
+                     struct wireless_dev **new_wdev, enum nl80211_iftype type,
                      struct vif_params *params);
 int ieee80211_if_change_type(struct ieee80211_sub_if_data *sdata,
                              enum nl80211_iftype type);
@@ -1487,10 +1491,6 @@ int ieee80211_add_srates_ie(struct ieee80211_sub_if_data *sdata,
 int ieee80211_add_ext_srates_ie(struct ieee80211_sub_if_data *sdata,
                                 struct sk_buff *skb, bool need_basic);
 
-/* virtual monitor */
-int ieee80211_add_virtual_monitor(struct ieee80211_local *local);
-void ieee80211_del_virtual_monitor(struct ieee80211_local *local);
-
 /* channel management */
 enum ieee80211_chan_mode {
         CHAN_MODE_UNDEFINED,
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index fbef7a1ada7a..bfb57dcc1538 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -112,10 +112,11 @@ static u32 __ieee80211_recalc_idle(struct ieee80211_local *local)
                 }
         }
 
-        if (local->scan_sdata &&
-            !(local->hw.flags & IEEE80211_HW_SCAN_WHILE_IDLE)) {
+        sdata = rcu_dereference_protected(local->scan_sdata,
+                                          lockdep_is_held(&local->mtx));
+        if (sdata && !(local->hw.flags & IEEE80211_HW_SCAN_WHILE_IDLE)) {
                 scanning = true;
-                local->scan_sdata->vif.bss_conf.idle = false;
+                sdata->vif.bss_conf.idle = false;
         }
 
         list_for_each_entry(sdata, &local->interfaces, list) {
@@ -330,20 +331,24 @@ static void ieee80211_set_default_queues(struct ieee80211_sub_if_data *sdata)
         sdata->vif.cab_queue = IEEE80211_INVAL_HW_QUEUE;
 }
 
-int ieee80211_add_virtual_monitor(struct ieee80211_local *local)
+static int ieee80211_add_virtual_monitor(struct ieee80211_local *local)
 {
         struct ieee80211_sub_if_data *sdata;
-        int ret;
+        int ret = 0;
 
         if (!(local->hw.flags & IEEE80211_HW_WANT_MONITOR_VIF))
                 return 0;
 
+        mutex_lock(&local->iflist_mtx);
+
         if (local->monitor_sdata)
-                return 0;
+                goto out_unlock;
 
         sdata = kzalloc(sizeof(*sdata) + local->hw.vif_data_size, GFP_KERNEL);
-        if (!sdata)
-                return -ENOMEM;
+        if (!sdata) {
+                ret = -ENOMEM;
+                goto out_unlock;
+        }
 
         /* set up data */
         sdata->local = local;
@@ -357,31 +362,34 @@ int ieee80211_add_virtual_monitor(struct ieee80211_local *local)
         if (WARN_ON(ret)) {
                 /* ok .. stupid driver, it asked for this! */
                 kfree(sdata);
-                return ret;
+                goto out_unlock;
         }
 
         ret = ieee80211_check_queues(sdata);
         if (ret) {
                 kfree(sdata);
-                return ret;
+                goto out_unlock;
         }
 
         rcu_assign_pointer(local->monitor_sdata, sdata);
-
-        return 0;
+ out_unlock:
+        mutex_unlock(&local->iflist_mtx);
+        return ret;
 }
 
-void ieee80211_del_virtual_monitor(struct ieee80211_local *local)
+static void ieee80211_del_virtual_monitor(struct ieee80211_local *local)
 {
         struct ieee80211_sub_if_data *sdata;
 
         if (!(local->hw.flags & IEEE80211_HW_WANT_MONITOR_VIF))
                 return;
 
-        sdata = rtnl_dereference(local->monitor_sdata);
+        mutex_lock(&local->iflist_mtx);
 
+        sdata = rcu_dereference_protected(local->monitor_sdata,
+                                          lockdep_is_held(&local->iflist_mtx));
         if (!sdata)
-                return;
+                goto out_unlock;
 
         rcu_assign_pointer(local->monitor_sdata, NULL);
         synchronize_net();
@@ -389,6 +397,8 @@ void ieee80211_del_virtual_monitor(struct ieee80211_local *local)
         drv_remove_interface(local, sdata);
 
         kfree(sdata);
+ out_unlock:
+        mutex_unlock(&local->iflist_mtx);
 }
 
 /*
@@ -487,6 +497,12 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
                         break;
                 }
 
+                if (local->monitors == 0 && local->open_count == 0) {
+                        res = ieee80211_add_virtual_monitor(local);
+                        if (res)
+                                goto err_stop;
+                }
+
                 /* must be before the call to ieee80211_configure_filter */
                 local->monitors++;
                 if (local->monitors == 1) {
@@ -501,6 +517,8 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up)
                 break;
         default:
                 if (coming_up) {
+                        ieee80211_del_virtual_monitor(local);
+
                         res = drv_add_interface(local, sdata);
                         if (res)
                                 goto err_stop;
@@ -628,7 +646,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
 
         clear_bit(SDATA_STATE_RUNNING, &sdata->state);
 
-        if (local->scan_sdata == sdata)
+        if (rcu_access_pointer(local->scan_sdata) == sdata)
                 ieee80211_scan_cancel(local);
 
         /*
@@ -735,6 +753,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                 if (local->monitors == 0) {
                         local->hw.conf.flags &= ~IEEE80211_CONF_MONITOR;
                         hw_reconf_flags |= IEEE80211_CONF_CHANGE_MONITOR;
+                        ieee80211_del_virtual_monitor(local);
                 }
 
                 ieee80211_adjust_monitor_flags(sdata, -1);
@@ -808,6 +827,9 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                 }
         }
         spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+
+        if (local->monitors == local->open_count && local->monitors > 0)
+                ieee80211_add_virtual_monitor(local);
 }
 
 static int ieee80211_stop(struct net_device *dev)
@@ -1373,7 +1395,7 @@ static void ieee80211_assign_perm_addr(struct ieee80211_local *local,
 }
 
 int ieee80211_if_add(struct ieee80211_local *local, const char *name,
-                     struct net_device **new_dev, enum nl80211_iftype type,
+                     struct wireless_dev **new_wdev, enum nl80211_iftype type,
                      struct vif_params *params)
 {
         struct net_device *ndev;
@@ -1463,8 +1485,8 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
         list_add_tail_rcu(&sdata->list, &local->interfaces);
         mutex_unlock(&local->iflist_mtx);
 
-        if (new_dev)
-                *new_dev = ndev;
+        if (new_wdev)
+                *new_wdev = &sdata->wdev;
 
         return 0;
 
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index b3b7e526e245..7ae678ba5d67 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -194,26 +194,6 @@ static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
         key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
 }
 
-void ieee80211_key_removed(struct ieee80211_key_conf *key_conf)
-{
-        struct ieee80211_key *key;
-
-        key = container_of(key_conf, struct ieee80211_key, conf);
-
-        might_sleep();
-        assert_key_lock(key->local);
-
-        key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
-
-        /*
-         * Flush TX path to avoid attempts to use this key
-         * after this function returns. Until then, drivers
-         * must be prepared to handle the key.
-         */
-        synchronize_rcu();
-}
-EXPORT_SYMBOL_GPL(ieee80211_key_removed);
-
 static void __ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata,
                                         int idx, bool uni, bool multi)
 {
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index c794101f8987..c26e231c733a 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -322,7 +322,8 @@ static void ieee80211_restart_work(struct work_struct *work)
 
         mutex_lock(&local->mtx);
         WARN(test_bit(SCAN_HW_SCANNING, &local->scanning) ||
-             local->sched_scanning,
+             rcu_dereference_protected(local->sched_scan_sdata,
+                                       lockdep_is_held(&local->mtx)),
                 "%s called with hardware scan in progress\n", __func__);
         mutex_unlock(&local->mtx);
 
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index f49f14f8ba82..cef0c9e79aba 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1108,7 +1108,7 @@ void ieee80211_dynamic_ps_timer(unsigned long data)
 }
 
 /* MLME */
-static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
+static bool ieee80211_sta_wmm_params(struct ieee80211_local *local,
                                      struct ieee80211_sub_if_data *sdata,
                                      u8 *wmm_param, size_t wmm_param_len)
 {
@@ -1119,23 +1119,23 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
         u8 *pos, uapsd_queues = 0;
 
         if (!local->ops->conf_tx)
-                return;
+                return false;
 
         if (local->hw.queues < IEEE80211_NUM_ACS)
-                return;
+                return false;
 
         if (!wmm_param)
-                return;
+                return false;
 
         if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
-                return;
+                return false;
 
         if (ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED)
                 uapsd_queues = ifmgd->uapsd_queues;
 
         count = wmm_param[6] & 0x0f;
         if (count == ifmgd->wmm_last_param_set)
-                return;
+                return false;
         ifmgd->wmm_last_param_set = count;
 
         pos = wmm_param + 8;
@@ -1202,6 +1202,7 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
 
         /* enable WMM or activate new settings */
         sdata->vif.bss_conf.qos = true;
+        return true;
 }
 
 static void __ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
@@ -1268,11 +1269,6 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
 
         bss_info_changed |= BSS_CHANGED_ASSOC;
-        /* set timing information */
-        bss_conf->beacon_int = cbss->beacon_interval;
-        bss_conf->last_tsf = cbss->tsf;
-
-        bss_info_changed |= BSS_CHANGED_BEACON_INT;
         bss_info_changed |= ieee80211_handle_bss_capability(sdata,
                 bss_conf->assoc_capability, bss->has_erp_value, bss->erp_value);
 
@@ -1364,6 +1360,17 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         }
         mutex_unlock(&local->sta_mtx);
 
+        /*
+         * if we want to get out of ps before disassoc (why?) we have
+         * to do it before sending disassoc, as otherwise the null-packet
+         * won't be valid.
+         */
+        if (local->hw.conf.flags & IEEE80211_CONF_PS) {
+                local->hw.conf.flags &= ~IEEE80211_CONF_PS;
+                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
+        }
+        local->ps_sdata = NULL;
+
         /* flush out any pending frame (e.g. DELBA) before deauth/disassoc */
         if (tx)
                 drv_flush(local, false);
@@ -1399,12 +1406,6 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         del_timer_sync(&local->dynamic_ps_timer);
         cancel_work_sync(&local->dynamic_ps_enable_work);
 
-        if (local->hw.conf.flags & IEEE80211_CONF_PS) {
-                local->hw.conf.flags &= ~IEEE80211_CONF_PS;
-                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
-        }
-        local->ps_sdata = NULL;
-
         /* Disable ARP filtering */
         if (sdata->vif.bss_conf.arp_filter_enabled) {
                 sdata->vif.bss_conf.arp_filter_enabled = false;
@@ -2435,14 +2436,6 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                 directed_tim = ieee80211_check_tim(elems.tim, elems.tim_len,
                                                    ifmgd->aid);
 
-        if (ncrc != ifmgd->beacon_crc || !ifmgd->beacon_crc_valid) {
-                ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems,
-                                      true);
-
-                ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
-                                         elems.wmm_param_len);
-        }
-
         if (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) {
                 if (directed_tim) {
                         if (local->hw.conf.dynamic_ps_timeout > 0) {
@@ -2473,6 +2466,13 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
         ifmgd->beacon_crc = ncrc;
         ifmgd->beacon_crc_valid = true;
 
+        ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems,
+                              true);
+
+        if (ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
+                                     elems.wmm_param_len))
+                changed |= BSS_CHANGED_QOS;
+
         if (elems.erp_info && elems.erp_info_len >= 1) {
                 erp_valid = true;
                 erp_value = elems.erp_info[0];
@@ -2974,7 +2974,7 @@ void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
 /* scan finished notification */
 void ieee80211_mlme_notify_scan_completed(struct ieee80211_local *local)
 {
-        struct ieee80211_sub_if_data *sdata = local->scan_sdata;
+        struct ieee80211_sub_if_data *sdata;
 
         /* Restart STA timers */
         rcu_read_lock();
@@ -3132,9 +3132,15 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
 
                 memcpy(ifmgd->bssid, cbss->bssid, ETH_ALEN);
 
-                /* tell driver about BSSID and basic rates */
+                /* set timing information */
+                sdata->vif.bss_conf.beacon_int = cbss->beacon_interval;
+                sdata->vif.bss_conf.sync_tsf = cbss->tsf;
+                sdata->vif.bss_conf.sync_device_ts = bss->device_ts;
+
+                /* tell driver about BSSID, basic rates and timing */
                 ieee80211_bss_info_change_notify(sdata,
-                        BSS_CHANGED_BSSID | BSS_CHANGED_BASIC_RATES);
+                        BSS_CHANGED_BSSID | BSS_CHANGED_BASIC_RATES |
+                        BSS_CHANGED_BEACON_INT);
 
                 if (assoc)
                         sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index b0fb6a2b89ad..635c3250c668 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -191,7 +191,7 @@ void ieee80211_handle_roc_started(struct ieee80211_roc_work *roc)
                         roc->frame = NULL;
                 }
         } else {
-                cfg80211_ready_on_channel(roc->sdata->dev, (unsigned long)roc,
+                cfg80211_ready_on_channel(&roc->sdata->wdev, (unsigned long)roc,
                                           roc->chan, roc->chan_type,
                                           roc->req_duration, GFP_KERNEL);
         }
@@ -299,7 +299,7 @@ void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc)
 
         /* was never transmitted */
         if (roc->frame) {
-                cfg80211_mgmt_tx_status(roc->sdata->dev,
+                cfg80211_mgmt_tx_status(&roc->sdata->wdev,
                                         (unsigned long)roc->frame,
                                         roc->frame->data, roc->frame->len,
                                         false, GFP_KERNEL);
@@ -307,7 +307,7 @@ void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc)
         }
 
         if (!roc->mgmt_tx_cookie)
-                cfg80211_remain_on_channel_expired(roc->sdata->dev,
+                cfg80211_remain_on_channel_expired(&roc->sdata->wdev,
                                                    (unsigned long)roc,
                                                    roc->chan, roc->chan_type,
                                                    GFP_KERNEL);
@@ -324,6 +324,7 @@ void ieee80211_sw_roc_work(struct work_struct *work)
                 container_of(work, struct ieee80211_roc_work, work.work);
         struct ieee80211_sub_if_data *sdata = roc->sdata;
         struct ieee80211_local *local = sdata->local;
+        bool started;
 
         mutex_lock(&local->mtx);
 
@@ -366,9 +367,10 @@ void ieee80211_sw_roc_work(struct work_struct *work)
                 /* finish this ROC */
  finish:
                 list_del(&roc->list);
+                started = roc->started;
                 ieee80211_roc_notify_destroy(roc);
 
-                if (roc->started) {
+                if (started) {
                         drv_flush(local, false);
 
                         local->tmp_channel = NULL;
@@ -379,7 +381,7 @@ void ieee80211_sw_roc_work(struct work_struct *work)
 
                 ieee80211_recalc_idle(local);
 
-                if (roc->started)
+                if (started)
                         ieee80211_start_next_roc(local);
         }
 
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index f9e51ef8dfa2..fb1d4aa65e8c 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -626,8 +626,12 @@ minstrel_ht_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
 
 #ifdef CONFIG_MAC80211_DEBUGFS
         /* use fixed index if set */
-        if (mp->fixed_rate_idx != -1)
-                sample_idx = mp->fixed_rate_idx;
+        if (mp->fixed_rate_idx != -1) {
+                mi->max_tp_rate = mp->fixed_rate_idx;
+                mi->max_tp_rate2 = mp->fixed_rate_idx;
+                mi->max_prob_rate = mp->fixed_rate_idx;
+                sample_idx = -1;
+        }
 #endif
 
         if (sample_idx >= 0) {
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 67edd69e8421..0cb4edee6af5 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -413,29 +413,6 @@ static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
 
 /* rx handlers */
 
-static ieee80211_rx_result debug_noinline
-ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
-{
-        struct ieee80211_local *local = rx->local;
-        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
-        struct sk_buff *skb = rx->skb;
-
-        if (likely(!(status->rx_flags & IEEE80211_RX_IN_SCAN) &&
-                   !local->sched_scanning))
-                return RX_CONTINUE;
-
-        if (test_bit(SCAN_HW_SCANNING, &local->scanning) ||
-            test_bit(SCAN_SW_SCANNING, &local->scanning) ||
-            test_bit(SCAN_ONCHANNEL_SCANNING, &local->scanning) ||
-            local->sched_scanning)
-                return ieee80211_scan_rx(rx->sdata, skb);
-
-        /* scanning finished during invoking of handlers */
-        I802_DEBUG_INC(local->rx_handlers_drop_passive_scan);
-        return RX_DROP_UNUSABLE;
-}
-
-
 static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
@@ -2404,7 +2381,7 @@ ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx)
         if (rx->local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
                 sig = status->signal;
 
-        if (cfg80211_rx_mgmt(rx->sdata->dev, status->freq, sig,
+        if (cfg80211_rx_mgmt(&rx->sdata->wdev, status->freq, sig,
                              rx->skb->data, rx->skb->len,
                              GFP_ATOMIC)) {
                 if (rx->sta)
@@ -2695,7 +2672,6 @@ static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
                         goto rxh_next;  \
         } while (0);
 
-        CALL_RXH(ieee80211_rx_h_passive_scan)
         CALL_RXH(ieee80211_rx_h_check)
 
         ieee80211_rx_reorder_ampdu(rx);
@@ -2765,11 +2741,8 @@ static int prepare_for_handlers(struct ieee80211_rx_data *rx,
                         return 0;
                 if (ieee80211_is_beacon(hdr->frame_control)) {
                         return 1;
-                }
-                else if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) {
-                        if (!(status->rx_flags & IEEE80211_RX_IN_SCAN))
-                                return 0;
-                        status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
+                } else if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) {
+                        return 0;
                 } else if (!multicast &&
                            !ether_addr_equal(sdata->vif.addr, hdr->addr1)) {
                         if (!(sdata->dev->flags & IFF_PROMISC))
@@ -2807,11 +2780,9 @@ static int prepare_for_handlers(struct ieee80211_rx_data *rx,
                          * and location updates. Note that mac80211
                          * itself never looks at these frames.
                          */
-                        if (!(status->rx_flags & IEEE80211_RX_IN_SCAN) &&
-                            ieee80211_is_public_action(hdr, skb->len))
+                        if (ieee80211_is_public_action(hdr, skb->len))
                                 return 1;
-                        if (!(status->rx_flags & IEEE80211_RX_IN_SCAN) &&
-                            !ieee80211_is_beacon(hdr->frame_control))
+                        if (!ieee80211_is_beacon(hdr->frame_control))
                                 return 0;
                         status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
                 }
@@ -2877,7 +2848,6 @@ static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
 static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
                                          struct sk_buff *skb)
 {
-        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
         struct ieee80211_local *local = hw_to_local(hw);
         struct ieee80211_sub_if_data *sdata;
         struct ieee80211_hdr *hdr;
@@ -2895,11 +2865,6 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
         if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc))
                 local->dot11ReceivedFragmentCount++;
 
-        if (unlikely(test_bit(SCAN_HW_SCANNING, &local->scanning) ||
-                     test_bit(SCAN_ONCHANNEL_SCANNING, &local->scanning) ||
-                     test_bit(SCAN_SW_SCANNING, &local->scanning)))
-                status->rx_flags |= IEEE80211_RX_IN_SCAN;
-
         if (ieee80211_is_mgmt(fc))
                 err = skb_linearize(skb);
         else
@@ -2914,6 +2879,10 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
         ieee80211_parse_qos(&rx);
         ieee80211_verify_alignment(&rx);
 
+        if (unlikely(ieee80211_is_probe_resp(hdr->frame_control) ||
+                     ieee80211_is_beacon(hdr->frame_control)))
+                ieee80211_scan_rx(local, skb);
+
         if (ieee80211_is_data(fc)) {
                 prev_sta = NULL;
 
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 267b2940fadd..bcaee5d12839 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -83,13 +83,14 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
 
         cbss = cfg80211_inform_bss_frame(local->hw.wiphy, channel,
                                          mgmt, len, signal, GFP_ATOMIC);
-
         if (!cbss)
                 return NULL;
 
         cbss->free_priv = ieee80211_rx_bss_free;
         bss = (void *)cbss->priv;
 
+        bss->device_ts = rx_status->device_timestamp;
+
         if (elems->parse_error) {
                 if (beacon)
                         bss->corrupt_data |= IEEE80211_BSS_CORRUPT_BEACON;
@@ -164,52 +165,47 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
         return bss;
 }
 
-ieee80211_rx_result
-ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
+void ieee80211_scan_rx(struct ieee80211_local *local, struct sk_buff *skb)
 {
         struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
-        struct ieee80211_mgmt *mgmt;
+        struct ieee80211_sub_if_data *sdata1, *sdata2;
+        struct ieee80211_mgmt *mgmt = (void *)skb->data;
         struct ieee80211_bss *bss;
         u8 *elements;
         struct ieee80211_channel *channel;
         size_t baselen;
         int freq;
-        __le16 fc;
-        bool presp, beacon = false;
+        bool beacon;
         struct ieee802_11_elems elems;
 
-        if (skb->len < 2)
-                return RX_DROP_UNUSABLE;
-
-        mgmt = (struct ieee80211_mgmt *) skb->data;
-        fc = mgmt->frame_control;
+        if (skb->len < 24 ||
+            (!ieee80211_is_probe_resp(mgmt->frame_control) &&
+             !ieee80211_is_beacon(mgmt->frame_control)))
+                return;
 
-        if (ieee80211_is_ctl(fc))
-                return RX_CONTINUE;
+        sdata1 = rcu_dereference(local->scan_sdata);
+        sdata2 = rcu_dereference(local->sched_scan_sdata);
 
-        if (skb->len < 24)
-                return RX_CONTINUE;
+        if (likely(!sdata1 && !sdata2))
+                return;
 
-        presp = ieee80211_is_probe_resp(fc);
-        if (presp) {
+        if (ieee80211_is_probe_resp(mgmt->frame_control)) {
                 /* ignore ProbeResp to foreign address */
-                if (!ether_addr_equal(mgmt->da, sdata->vif.addr))
-                        return RX_DROP_MONITOR;
+                if ((!sdata1 || !ether_addr_equal(mgmt->da, sdata1->vif.addr)) &&
+                    (!sdata2 || !ether_addr_equal(mgmt->da, sdata2->vif.addr)))
+                        return;
 
-                presp = true;
                 elements = mgmt->u.probe_resp.variable;
                 baselen = offsetof(struct ieee80211_mgmt, u.probe_resp.variable);
+                beacon = false;
         } else {
-                beacon = ieee80211_is_beacon(fc);
                 baselen = offsetof(struct ieee80211_mgmt, u.beacon.variable);
                 elements = mgmt->u.beacon.variable;
+                beacon = true;
         }
 
-        if (!presp && !beacon)
-                return RX_CONTINUE;
-
         if (baselen > skb->len)
-                return RX_DROP_MONITOR;
+                return;
 
         ieee802_11_parse_elems(elements, skb->len - baselen, &elems);
 
@@ -219,22 +215,16 @@ ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
         else
                 freq = rx_status->freq;
 
-        channel = ieee80211_get_channel(sdata->local->hw.wiphy, freq);
+        channel = ieee80211_get_channel(local->hw.wiphy, freq);
 
         if (!channel || channel->flags & IEEE80211_CHAN_DISABLED)
-                return RX_DROP_MONITOR;
+                return;
 
-        bss = ieee80211_bss_info_update(sdata->local, rx_status,
+        bss = ieee80211_bss_info_update(local, rx_status,
                                         mgmt, skb->len, &elems,
                                         channel, beacon);
         if (bss)
-                ieee80211_rx_bss_put(sdata->local, bss);
-
-        if (channel == sdata->local->oper_channel)
-                return RX_CONTINUE;
-
-        dev_kfree_skb(skb);
-        return RX_QUEUED;
+                ieee80211_rx_bss_put(local, bss);
 }
 
 /* return false if no more work */
@@ -292,7 +282,13 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted,
                 return;
 
         if (was_hw_scan && !aborted && ieee80211_prep_hw_scan(local)) {
-                int rc = drv_hw_scan(local, local->scan_sdata, local->hw_scan_req);
+                int rc;
+
+                rc = drv_hw_scan(local,
+                        rcu_dereference_protected(local->scan_sdata,
+                                                  lockdep_is_held(&local->mtx)),
+                        local->hw_scan_req);
+
                 if (rc == 0)
                         return;
         }
@@ -393,7 +389,10 @@ void ieee80211_run_deferred_scan(struct ieee80211_local *local)
         if (!local->scan_req || local->scanning)
                 return;
 
-        if (!ieee80211_can_scan(local, local->scan_sdata))
+        if (!ieee80211_can_scan(local,
+                                rcu_dereference_protected(
+                                        local->scan_sdata,
+                                        lockdep_is_held(&local->mtx))))
                 return;
 
         ieee80211_queue_delayed_work(&local->hw, &local->scan_work,
@@ -404,9 +403,12 @@ static void ieee80211_scan_state_send_probe(struct ieee80211_local *local,
                                             unsigned long *next_delay)
 {
         int i;
-        struct ieee80211_sub_if_data *sdata = local->scan_sdata;
+        struct ieee80211_sub_if_data *sdata;
         enum ieee80211_band band = local->hw.conf.channel->band;
 
+        sdata = rcu_dereference_protected(local->scan_sdata,
+                                          lockdep_is_held(&local->mtx));;
+
         for (i = 0; i < local->scan_req->n_ssids; i++)
                 ieee80211_send_probe_req(
                         sdata, NULL,
@@ -438,7 +440,7 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
         if (!ieee80211_can_scan(local, sdata)) {
                 /* wait for the work to finish/time out */
                 local->scan_req = req;
-                local->scan_sdata = sdata;
+                rcu_assign_pointer(local->scan_sdata, sdata);
                 return 0;
         }
 
@@ -472,7 +474,7 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
         }
 
         local->scan_req = req;
-        local->scan_sdata = sdata;
+        rcu_assign_pointer(local->scan_sdata, sdata);
 
         if (local->ops->hw_scan) {
                 __set_bit(SCAN_HW_SCANNING, &local->scanning);
@@ -532,7 +534,7 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
                 ieee80211_recalc_idle(local);
 
                 local->scan_req = NULL;
-                local->scan_sdata = NULL;
+                rcu_assign_pointer(local->scan_sdata, NULL);
         }
 
         return rc;
@@ -719,7 +721,8 @@ void ieee80211_scan_work(struct work_struct *work)
 
         mutex_lock(&local->mtx);
 
-        sdata = local->scan_sdata;
+        sdata = rcu_dereference_protected(local->scan_sdata,
+                                          lockdep_is_held(&local->mtx));
 
         /* When scanning on-channel, the first-callback means completed. */
         if (test_bit(SCAN_ONCHANNEL_SCANNING, &local->scanning)) {
@@ -740,7 +743,7 @@ void ieee80211_scan_work(struct work_struct *work)
                 int rc;
 
                 local->scan_req = NULL;
-                local->scan_sdata = NULL;
+                rcu_assign_pointer(local->scan_sdata, NULL);
 
                 rc = __ieee80211_start_scan(sdata, req);
                 if (rc) {
@@ -892,7 +895,9 @@ void ieee80211_scan_cancel(struct ieee80211_local *local)
 
         if (test_bit(SCAN_HW_SCANNING, &local->scanning)) {
                 if (local->ops->cancel_hw_scan)
-                        drv_cancel_hw_scan(local, local->scan_sdata);
+                        drv_cancel_hw_scan(local,
+                                rcu_dereference_protected(local->scan_sdata,
+                                                lockdep_is_held(&local->mtx)));
                 goto out;
         }
 
@@ -914,9 +919,9 @@ int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_local *local = sdata->local;
         int ret, i;
 
-        mutex_lock(&sdata->local->mtx);
+        mutex_lock(&local->mtx);
 
-        if (local->sched_scanning) {
+        if (rcu_access_pointer(local->sched_scan_sdata)) {
                 ret = -EBUSY;
                 goto out;
         }
@@ -927,6 +932,9 @@ int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
         }
 
         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
+                if (!local->hw.wiphy->bands[i])
+                        continue;
+
                 local->sched_scan_ies.ie[i] = kzalloc(2 +
                                                       IEEE80211_MAX_SSID_LEN +
                                                       local->scan_ies_len +
@@ -947,7 +955,7 @@ int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
         ret = drv_sched_scan_start(local, sdata, req,
                                    &local->sched_scan_ies);
         if (ret == 0) {
-                local->sched_scanning = true;
+                rcu_assign_pointer(local->sched_scan_sdata, sdata);
                 goto out;
         }
 
@@ -955,7 +963,7 @@ out_free:
         while (i > 0)
                 kfree(local->sched_scan_ies.ie[--i]);
 out:
-        mutex_unlock(&sdata->local->mtx);
+        mutex_unlock(&local->mtx);
         return ret;
 }
 
@@ -964,22 +972,22 @@ int ieee80211_request_sched_scan_stop(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_local *local = sdata->local;
         int ret = 0, i;
 
-        mutex_lock(&sdata->local->mtx);
+        mutex_lock(&local->mtx);
 
         if (!local->ops->sched_scan_stop) {
                 ret = -ENOTSUPP;
                 goto out;
         }
 
-        if (local->sched_scanning) {
+        if (rcu_access_pointer(local->sched_scan_sdata)) {
                 for (i = 0; i < IEEE80211_NUM_BANDS; i++)
                         kfree(local->sched_scan_ies.ie[i]);
 
                 drv_sched_scan_stop(local, sdata);
-                local->sched_scanning = false;
+                rcu_assign_pointer(local->sched_scan_sdata, NULL);
         }
 out:
-        mutex_unlock(&sdata->local->mtx);
+        mutex_unlock(&local->mtx);
 
         return ret;
 }
@@ -1003,7 +1011,7 @@ void ieee80211_sched_scan_stopped_work(struct work_struct *work)
 
         mutex_lock(&local->mtx);
 
-        if (!local->sched_scanning) {
+        if (!rcu_access_pointer(local->sched_scan_sdata)) {
                 mutex_unlock(&local->mtx);
                 return;
         }
@@ -1011,7 +1019,7 @@ void ieee80211_sched_scan_stopped_work(struct work_struct *work)
         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
                 kfree(local->sched_scan_ies.ie[i]);
 
-        local->sched_scanning = false;
+        rcu_assign_pointer(local->sched_scan_sdata, NULL);
 
         mutex_unlock(&local->mtx);
 
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 2ed2f27fe8a7..8cd72914cdaf 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -519,14 +519,19 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                 u64 cookie = (unsigned long)skb;
                 acked = info->flags & IEEE80211_TX_STAT_ACK;
 
+                /*
+                 * TODO: When we have non-netdev frame TX,
+                 * we cannot use skb->dev->ieee80211_ptr
+                 */
+
                 if (ieee80211_is_nullfunc(hdr->frame_control) ||
                     ieee80211_is_qos_nullfunc(hdr->frame_control))
                         cfg80211_probe_status(skb->dev, hdr->addr1,
                                               cookie, acked, GFP_ATOMIC);
                 else
                         cfg80211_mgmt_tx_status(
-                                skb->dev, cookie, skb->data, skb->len,
-                                acked, GFP_ATOMIC);
+                                skb->dev->ieee80211_ptr, cookie, skb->data,
+                                skb->len, acked, GFP_ATOMIC);
         }
 
         if (unlikely(info->ack_frame_id)) {
diff --git a/net/mac80211/trace.h b/net/mac80211/trace.h
index e1e9d10ec2e7..c6d33b55b2df 100644
--- a/net/mac80211/trace.h
+++ b/net/mac80211/trace.h
@@ -306,7 +306,8 @@ TRACE_EVENT(drv_bss_info_changed,
                 __field(u8, dtimper)
                 __field(u16, bcnint)
                 __field(u16, assoc_cap)
-                __field(u64, timestamp)
+                __field(u64, sync_tsf)
+                __field(u32, sync_device_ts)
                 __field(u32, basic_rates)
                 __field(u32, changed)
                 __field(bool, enable_beacon)
@@ -325,7 +326,8 @@ TRACE_EVENT(drv_bss_info_changed,
                 __entry->dtimper = info->dtim_period;
                 __entry->bcnint = info->beacon_int;
                 __entry->assoc_cap = info->assoc_capability;
-                __entry->timestamp = info->last_tsf;
+                __entry->sync_tsf = info->sync_tsf;
+                __entry->sync_device_ts = info->sync_device_ts;
                 __entry->basic_rates = info->basic_rates;
                 __entry->enable_beacon = info->enable_beacon;
                 __entry->ht_operation_mode = info->ht_operation_mode;
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index c9d2175d15c1..acf712ffb5e6 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -523,7 +523,7 @@ ieee80211_tx_h_check_control_port_protocol(struct ieee80211_tx_data *tx)
 static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
 {
-        struct ieee80211_key *key = NULL;
+        struct ieee80211_key *key;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
 
@@ -542,16 +542,23 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
         else if (!is_multicast_ether_addr(hdr->addr1) &&
                  (key = rcu_dereference(tx->sdata->default_unicast_key)))
                 tx->key = key;
-        else if (tx->sdata->drop_unencrypted &&
-                 (tx->skb->protocol != tx->sdata->control_port_protocol) &&
-                 !(info->flags & IEEE80211_TX_CTL_INJECTED) &&
-                 (!ieee80211_is_robust_mgmt_frame(hdr) ||
-                  (ieee80211_is_action(hdr->frame_control) &&
-                   tx->sta && test_sta_flag(tx->sta, WLAN_STA_MFP)))) {
+        else if (info->flags & IEEE80211_TX_CTL_INJECTED)
+                tx->key = NULL;
+        else if (!tx->sdata->drop_unencrypted)
+                tx->key = NULL;
+        else if (tx->skb->protocol == tx->sdata->control_port_protocol)
+                tx->key = NULL;
+        else if (ieee80211_is_robust_mgmt_frame(hdr) &&
+                 !(ieee80211_is_action(hdr->frame_control) &&
+                   tx->sta && test_sta_flag(tx->sta, WLAN_STA_MFP)))
+                tx->key = NULL;
+        else if (ieee80211_is_mgmt(hdr->frame_control) &&
+                 !ieee80211_is_robust_mgmt_frame(hdr))
+                tx->key = NULL;
+        else {
                 I802_DEBUG_INC(tx->local->tx_handlers_drop_unencrypted);
                 return TX_DROP;
-        } else
-                tx->key = NULL;
+        }
 
         if (tx->key) {
                 bool skip_hw = false;
@@ -1817,6 +1824,9 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                                         /* RA TA mDA mSA AE:DA SA */
                                         mesh_da = mppath->mpp;
                                         is_mesh_mcast = 0;
+                                } else if (mpath) {
+                                        mesh_da = mpath->dst;
+                                        is_mesh_mcast = 0;
                                 } else {
                                         /* DA TA mSA AE:SA */
                                         mesh_da = bcast;
@@ -2714,7 +2724,7 @@ EXPORT_SYMBOL(ieee80211_get_buffered_bc);
 void ieee80211_tx_skb_tid(struct ieee80211_sub_if_data *sdata,
                           struct sk_buff *skb, int tid)
 {
-        int ac = ieee802_1d_to_ac[tid];
+        int ac = ieee802_1d_to_ac[tid & 7];
 
         skb_set_mac_header(skb, 0);
         skb_set_network_header(skb, 0);
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 64493a7bef1a..39b82fee4904 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -529,6 +529,11 @@ void ieee80211_iterate_active_interfaces(
                                  &sdata->vif);
         }
 
+        sdata = rcu_dereference_protected(local->monitor_sdata,
+                                          lockdep_is_held(&local->iflist_mtx));
+        if (sdata)
+                iterator(data, sdata->vif.addr, &sdata->vif);
+
         mutex_unlock(&local->iflist_mtx);
 }
 EXPORT_SYMBOL_GPL(ieee80211_iterate_active_interfaces);
@@ -557,6 +562,10 @@ void ieee80211_iterate_active_interfaces_atomic(
                                  &sdata->vif);
         }
 
+        sdata = rcu_dereference(local->monitor_sdata);
+        if (sdata)
+                iterator(data, sdata->vif.addr, &sdata->vif);
+
         rcu_read_unlock();
 }
 EXPORT_SYMBOL_GPL(ieee80211_iterate_active_interfaces_atomic);
@@ -999,6 +1008,8 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
         int ext_rates_len;
 
         sband = local->hw.wiphy->bands[band];
+        if (WARN_ON_ONCE(!sband))
+                return 0;
 
         pos = buffer;