Merge branch 'for-john' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next

Conflicts:
	net/mac80211/chan.c

21 files changed, 874 insertions, 246 deletions

diff --git a/net/mac80211/aes_ccm.c b/net/mac80211/aes_ccm.c
index 7c7df475a401..ec24378caaaf 100644
--- a/net/mac80211/aes_ccm.c
+++ b/net/mac80211/aes_ccm.c
@@ -23,12 +23,13 @@ void ieee80211_aes_ccm_encrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
                                u8 *data, size_t data_len, u8 *mic)
 {
         struct scatterlist assoc, pt, ct[2];
-        struct {
-                struct aead_request     req;
-                u8                      priv[crypto_aead_reqsize(tfm)];
-        } aead_req;
 
-        memset(&aead_req, 0, sizeof(aead_req));
+        char aead_req_data[sizeof(struct aead_request) +
+                           crypto_aead_reqsize(tfm)]
+                __aligned(__alignof__(struct aead_request));
+        struct aead_request *aead_req = (void *) aead_req_data;
+
+        memset(aead_req, 0, sizeof(aead_req_data));
 
         sg_init_one(&pt, data, data_len);
         sg_init_one(&assoc, &aad[2], be16_to_cpup((__be16 *)aad));
@@ -36,23 +37,23 @@ void ieee80211_aes_ccm_encrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
         sg_set_buf(&ct[0], data, data_len);
         sg_set_buf(&ct[1], mic, IEEE80211_CCMP_MIC_LEN);
 
-        aead_request_set_tfm(&aead_req.req, tfm);
-        aead_request_set_assoc(&aead_req.req, &assoc, assoc.length);
-        aead_request_set_crypt(&aead_req.req, &pt, ct, data_len, b_0);
+        aead_request_set_tfm(aead_req, tfm);
+        aead_request_set_assoc(aead_req, &assoc, assoc.length);
+        aead_request_set_crypt(aead_req, &pt, ct, data_len, b_0);
 
-        crypto_aead_encrypt(&aead_req.req);
+        crypto_aead_encrypt(aead_req);
 }
 
 int ieee80211_aes_ccm_decrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
                               u8 *data, size_t data_len, u8 *mic)
 {
         struct scatterlist assoc, pt, ct[2];
-        struct {
-                struct aead_request     req;
-                u8                      priv[crypto_aead_reqsize(tfm)];
-        } aead_req;
+        char aead_req_data[sizeof(struct aead_request) +
+                           crypto_aead_reqsize(tfm)]
+                __aligned(__alignof__(struct aead_request));
+        struct aead_request *aead_req = (void *) aead_req_data;
 
-        memset(&aead_req, 0, sizeof(aead_req));
+        memset(aead_req, 0, sizeof(aead_req_data));
 
         sg_init_one(&pt, data, data_len);
         sg_init_one(&assoc, &aad[2], be16_to_cpup((__be16 *)aad));
@@ -60,12 +61,12 @@ int ieee80211_aes_ccm_decrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
         sg_set_buf(&ct[0], data, data_len);
         sg_set_buf(&ct[1], mic, IEEE80211_CCMP_MIC_LEN);
 
-        aead_request_set_tfm(&aead_req.req, tfm);
-        aead_request_set_assoc(&aead_req.req, &assoc, assoc.length);
-        aead_request_set_crypt(&aead_req.req, ct, &pt,
+        aead_request_set_tfm(aead_req, tfm);
+        aead_request_set_assoc(aead_req, &assoc, assoc.length);
+        aead_request_set_crypt(aead_req, ct, &pt,
                                data_len + IEEE80211_CCMP_MIC_LEN, b_0);
 
-        return crypto_aead_decrypt(&aead_req.req);
+        return crypto_aead_decrypt(aead_req);
 }
 
 struct crypto_aead *ieee80211_aes_key_setup_encrypt(const u8 key[])
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index aaa59d719592..7b8d3cf89574 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -109,6 +109,15 @@ static int ieee80211_change_iface(struct wiphy *wiphy,
 static int ieee80211_start_p2p_device(struct wiphy *wiphy,
                                       struct wireless_dev *wdev)
 {
+        struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
+        int ret;
+
+        mutex_lock(&sdata->local->chanctx_mtx);
+        ret = ieee80211_check_combinations(sdata, NULL, 0, 0);
+        mutex_unlock(&sdata->local->chanctx_mtx);
+        if (ret < 0)
+                return ret;
+
         return ieee80211_do_open(wdev, true);
 }
 
@@ -972,13 +981,13 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
         sdata->needed_rx_chains = sdata->local->rx_chains;
 
         mutex_lock(&local->mtx);
-        sdata->radar_required = params->radar_required;
         err = ieee80211_vif_use_channel(sdata, &params->chandef,
                                         IEEE80211_CHANCTX_SHARED);
+        if (!err)
+                ieee80211_vif_copy_chanctx_to_vlans(sdata, false);
         mutex_unlock(&local->mtx);
         if (err)
                 return err;
-        ieee80211_vif_copy_chanctx_to_vlans(sdata, false);
 
         /*
          * Apply control port protocol, this allows us to
@@ -1131,8 +1140,8 @@ static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
         local->total_ps_buffered -= skb_queue_len(&sdata->u.ap.ps.bc_buf);
         skb_queue_purge(&sdata->u.ap.ps.bc_buf);
 
-        ieee80211_vif_copy_chanctx_to_vlans(sdata, true);
         mutex_lock(&local->mtx);
+        ieee80211_vif_copy_chanctx_to_vlans(sdata, true);
         ieee80211_vif_release_channel(sdata);
         mutex_unlock(&local->mtx);
 
@@ -1566,7 +1575,7 @@ static int ieee80211_change_station(struct wiphy *wiphy,
 
                 if (sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
                     sta->sdata->u.vlan.sta) {
-                        rcu_assign_pointer(sta->sdata->u.vlan.sta, NULL);
+                        RCU_INIT_POINTER(sta->sdata->u.vlan.sta, NULL);
                         prev_4addr = true;
                 }
 
@@ -2930,7 +2939,6 @@ static int ieee80211_start_radar_detection(struct wiphy *wiphy,
         /* whatever, but channel contexts should not complain about that one */
         sdata->smps_mode = IEEE80211_SMPS_OFF;
         sdata->needed_rx_chains = local->rx_chains;
-        sdata->radar_required = true;
 
         err = ieee80211_vif_use_channel(sdata, chandef,
                                         IEEE80211_CHANCTX_SHARED);
@@ -3217,7 +3225,7 @@ int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_chanctx_conf *chanctx_conf;
+        struct ieee80211_chanctx_conf *conf;
         struct ieee80211_chanctx *chanctx;
         int err, num_chanctx, changed = 0;
 
@@ -3233,23 +3241,24 @@ int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
                                        &sdata->vif.bss_conf.chandef))
                 return -EINVAL;
 
-        rcu_read_lock();
-        chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
-        if (!chanctx_conf) {
-                rcu_read_unlock();
+        mutex_lock(&local->chanctx_mtx);
+        conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
+                                         lockdep_is_held(&local->chanctx_mtx));
+        if (!conf) {
+                mutex_unlock(&local->chanctx_mtx);
                 return -EBUSY;
         }
 
         /* don't handle for multi-VIF cases */
-        chanctx = container_of(chanctx_conf, struct ieee80211_chanctx, conf);
-        if (chanctx->refcount > 1) {
-                rcu_read_unlock();
+        chanctx = container_of(conf, struct ieee80211_chanctx, conf);
+        if (ieee80211_chanctx_refcount(local, chanctx) > 1) {
+                mutex_unlock(&local->chanctx_mtx);
                 return -EBUSY;
         }
         num_chanctx = 0;
         list_for_each_entry_rcu(chanctx, &local->chanctx_list, list)
                 num_chanctx++;
-        rcu_read_unlock();
+        mutex_unlock(&local->chanctx_mtx);
 
         if (num_chanctx > 1)
                 return -EBUSY;
@@ -3949,6 +3958,21 @@ static int ieee80211_set_qos_map(struct wiphy *wiphy,
         return 0;
 }
 
+static int ieee80211_set_ap_chanwidth(struct wiphy *wiphy,
+                                      struct net_device *dev,
+                                      struct cfg80211_chan_def *chandef)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        int ret;
+        u32 changed = 0;
+
+        ret = ieee80211_vif_change_bandwidth(sdata, chandef, &changed);
+        if (ret == 0)
+                ieee80211_bss_info_change_notify(sdata, changed);
+
+        return ret;
+}
+
 const struct cfg80211_ops mac80211_config_ops = {
         .add_virtual_intf = ieee80211_add_iface,
         .del_virtual_intf = ieee80211_del_iface,
@@ -4029,4 +4053,5 @@ const struct cfg80211_ops mac80211_config_ops = {
         .start_radar_detection = ieee80211_start_radar_detection,
         .channel_switch = ieee80211_channel_switch,
         .set_qos_map = ieee80211_set_qos_map,
+        .set_ap_chanwidth = ieee80211_set_ap_chanwidth,
 };
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index 75b5dd2c9267..48e6d6f010cd 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -9,6 +9,170 @@
 #include "ieee80211_i.h"
 #include "driver-ops.h"
 
+static int ieee80211_chanctx_num_assigned(struct ieee80211_local *local,
+                                          struct ieee80211_chanctx *ctx)
+{
+        struct ieee80211_sub_if_data *sdata;
+        int num = 0;
+
+        lockdep_assert_held(&local->chanctx_mtx);
+
+        list_for_each_entry(sdata, &ctx->assigned_vifs, assigned_chanctx_list)
+                num++;
+
+        return num;
+}
+
+static int ieee80211_chanctx_num_reserved(struct ieee80211_local *local,
+                                          struct ieee80211_chanctx *ctx)
+{
+        struct ieee80211_sub_if_data *sdata;
+        int num = 0;
+
+        lockdep_assert_held(&local->chanctx_mtx);
+
+        list_for_each_entry(sdata, &ctx->reserved_vifs, reserved_chanctx_list)
+                num++;
+
+        return num;
+}
+
+int ieee80211_chanctx_refcount(struct ieee80211_local *local,
+                               struct ieee80211_chanctx *ctx)
+{
+        return ieee80211_chanctx_num_assigned(local, ctx) +
+               ieee80211_chanctx_num_reserved(local, ctx);
+}
+
+static int ieee80211_num_chanctx(struct ieee80211_local *local)
+{
+        struct ieee80211_chanctx *ctx;
+        int num = 0;
+
+        lockdep_assert_held(&local->chanctx_mtx);
+
+        list_for_each_entry(ctx, &local->chanctx_list, list)
+                num++;
+
+        return num;
+}
+
+static bool ieee80211_can_create_new_chanctx(struct ieee80211_local *local)
+{
+        lockdep_assert_held(&local->chanctx_mtx);
+        return ieee80211_num_chanctx(local) < ieee80211_max_num_channels(local);
+}
+
+static const struct cfg80211_chan_def *
+ieee80211_chanctx_reserved_chandef(struct ieee80211_local *local,
+                                   struct ieee80211_chanctx *ctx,
+                                   const struct cfg80211_chan_def *compat)
+{
+        struct ieee80211_sub_if_data *sdata;
+
+        lockdep_assert_held(&local->chanctx_mtx);
+
+        list_for_each_entry(sdata, &ctx->reserved_vifs,
+                            reserved_chanctx_list) {
+                if (!compat)
+                        compat = &sdata->reserved_chandef;
+
+                compat = cfg80211_chandef_compatible(&sdata->reserved_chandef,
+                                                     compat);
+                if (!compat)
+                        break;
+        }
+
+        return compat;
+}
+
+static const struct cfg80211_chan_def *
+ieee80211_chanctx_non_reserved_chandef(struct ieee80211_local *local,
+                                       struct ieee80211_chanctx *ctx,
+                                       const struct cfg80211_chan_def *compat)
+{
+        struct ieee80211_sub_if_data *sdata;
+
+        lockdep_assert_held(&local->chanctx_mtx);
+
+        list_for_each_entry(sdata, &ctx->assigned_vifs,
+                            assigned_chanctx_list) {
+                if (sdata->reserved_chanctx != NULL)
+                        continue;
+
+                if (!compat)
+                        compat = &sdata->vif.bss_conf.chandef;
+
+                compat = cfg80211_chandef_compatible(
+                                &sdata->vif.bss_conf.chandef, compat);
+                if (!compat)
+                        break;
+        }
+
+        return compat;
+}
+
+static const struct cfg80211_chan_def *
+ieee80211_chanctx_combined_chandef(struct ieee80211_local *local,
+                                   struct ieee80211_chanctx *ctx,
+                                   const struct cfg80211_chan_def *compat)
+{
+        lockdep_assert_held(&local->chanctx_mtx);
+
+        compat = ieee80211_chanctx_reserved_chandef(local, ctx, compat);
+        if (!compat)
+                return NULL;
+
+        compat = ieee80211_chanctx_non_reserved_chandef(local, ctx, compat);
+        if (!compat)
+                return NULL;
+
+        return compat;
+}
+
+static bool
+ieee80211_chanctx_can_reserve_chandef(struct ieee80211_local *local,
+                                      struct ieee80211_chanctx *ctx,
+                                      const struct cfg80211_chan_def *def)
+{
+        lockdep_assert_held(&local->chanctx_mtx);
+
+        if (ieee80211_chanctx_combined_chandef(local, ctx, def))
+                return true;
+
+        if (!list_empty(&ctx->reserved_vifs) &&
+            ieee80211_chanctx_reserved_chandef(local, ctx, def))
+                return true;
+
+        return false;
+}
+
+static struct ieee80211_chanctx *
+ieee80211_find_reservation_chanctx(struct ieee80211_local *local,
+                                   const struct cfg80211_chan_def *chandef,
+                                   enum ieee80211_chanctx_mode mode)
+{
+        struct ieee80211_chanctx *ctx;
+
+        lockdep_assert_held(&local->chanctx_mtx);
+
+        if (mode == IEEE80211_CHANCTX_EXCLUSIVE)
+                return NULL;
+
+        list_for_each_entry(ctx, &local->chanctx_list, list) {
+                if (ctx->mode == IEEE80211_CHANCTX_EXCLUSIVE)
+                        continue;
+
+                if (!ieee80211_chanctx_can_reserve_chandef(local, ctx,
+                                                           chandef))
+                        continue;
+
+                return ctx;
+        }
+
+        return NULL;
+}
+
 static enum nl80211_chan_width ieee80211_get_sta_bw(struct ieee80211_sta *sta)
 {
         switch (sta->bandwidth) {
@@ -190,6 +354,11 @@ ieee80211_find_chanctx(struct ieee80211_local *local,
                 if (!compat)
                         continue;
 
+                compat = ieee80211_chanctx_reserved_chandef(local, ctx,
+                                                            compat);
+                if (!compat)
+                        continue;
+
                 ieee80211_change_chanctx(local, ctx, compat);
 
                 return ctx;
@@ -217,62 +386,91 @@ static bool ieee80211_is_radar_required(struct ieee80211_local *local)
 }
 
 static struct ieee80211_chanctx *
-ieee80211_new_chanctx(struct ieee80211_local *local,
-                      const struct cfg80211_chan_def *chandef,
-                      enum ieee80211_chanctx_mode mode)
+ieee80211_alloc_chanctx(struct ieee80211_local *local,
+                        const struct cfg80211_chan_def *chandef,
+                        enum ieee80211_chanctx_mode mode)
 {
         struct ieee80211_chanctx *ctx;
-        u32 changed;
-        int err;
 
         lockdep_assert_held(&local->chanctx_mtx);
 
         ctx = kzalloc(sizeof(*ctx) + local->hw.chanctx_data_size, GFP_KERNEL);
         if (!ctx)
-                return ERR_PTR(-ENOMEM);
+                return NULL;
 
+        INIT_LIST_HEAD(&ctx->assigned_vifs);
+        INIT_LIST_HEAD(&ctx->reserved_vifs);
         ctx->conf.def = *chandef;
         ctx->conf.rx_chains_static = 1;
         ctx->conf.rx_chains_dynamic = 1;
         ctx->mode = mode;
         ctx->conf.radar_enabled = ieee80211_is_radar_required(local);
         ieee80211_recalc_chanctx_min_def(local, ctx);
+
+        return ctx;
+}
+
+static int ieee80211_add_chanctx(struct ieee80211_local *local,
+                                 struct ieee80211_chanctx *ctx)
+{
+        u32 changed;
+        int err;
+
+        lockdep_assert_held(&local->mtx);
+        lockdep_assert_held(&local->chanctx_mtx);
+
         if (!local->use_chanctx)
                 local->hw.conf.radar_enabled = ctx->conf.radar_enabled;
 
-        /* we hold the mutex to prevent idle from changing */
-        lockdep_assert_held(&local->mtx);
         /* turn idle off *before* setting channel -- some drivers need that */
         changed = ieee80211_idle_off(local);
         if (changed)
                 ieee80211_hw_config(local, changed);
 
         if (!local->use_chanctx) {
-                local->_oper_chandef = *chandef;
+                local->_oper_chandef = ctx->conf.def;
                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
         } else {
                 err = drv_add_chanctx(local, ctx);
                 if (err) {
-                        kfree(ctx);
                         ieee80211_recalc_idle(local);
-                        return ERR_PTR(err);
+                        return err;
                 }
         }
 
-        /* and keep the mutex held until the new chanctx is on the list */
-        list_add_rcu(&ctx->list, &local->chanctx_list);
+        return 0;
+}
+
+static struct ieee80211_chanctx *
+ieee80211_new_chanctx(struct ieee80211_local *local,
+                      const struct cfg80211_chan_def *chandef,
+                      enum ieee80211_chanctx_mode mode)
+{
+        struct ieee80211_chanctx *ctx;
+        int err;
+
+        lockdep_assert_held(&local->mtx);
+        lockdep_assert_held(&local->chanctx_mtx);
 
+        ctx = ieee80211_alloc_chanctx(local, chandef, mode);
+        if (!ctx)
+                return ERR_PTR(-ENOMEM);
+
+        err = ieee80211_add_chanctx(local, ctx);
+        if (err) {
+                kfree(ctx);
+                return ERR_PTR(err);
+        }
+
+        list_add_rcu(&ctx->list, &local->chanctx_list);
         return ctx;
 }
 
-static void ieee80211_free_chanctx(struct ieee80211_local *local,
-                                   struct ieee80211_chanctx *ctx)
+static void ieee80211_del_chanctx(struct ieee80211_local *local,
+                                  struct ieee80211_chanctx *ctx)
 {
-        bool check_single_channel = false;
         lockdep_assert_held(&local->chanctx_mtx);
 
-        WARN_ON_ONCE(ctx->refcount != 0);
-
         if (!local->use_chanctx) {
                 struct cfg80211_chan_def *chandef = &local->_oper_chandef;
                 chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
@@ -282,8 +480,9 @@ static void ieee80211_free_chanctx(struct ieee80211_local *local,
                 /* NOTE: Disabling radar is only valid here for
                  * single channel context. To be sure, check it ...
                  */
-                if (local->hw.conf.radar_enabled)
-                        check_single_channel = true;
+                WARN_ON(local->hw.conf.radar_enabled &&
+                        !list_empty(&local->chanctx_list));
+
                 local->hw.conf.radar_enabled = false;
 
                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
@@ -291,39 +490,19 @@ static void ieee80211_free_chanctx(struct ieee80211_local *local,
                 drv_remove_chanctx(local, ctx);
         }
 
-        list_del_rcu(&ctx->list);
-        kfree_rcu(ctx, rcu_head);
-
-        /* throw a warning if this wasn't the only channel context. */
-        WARN_ON(check_single_channel && !list_empty(&local->chanctx_list));
-
         ieee80211_recalc_idle(local);
 }
 
-static int ieee80211_assign_vif_chanctx(struct ieee80211_sub_if_data *sdata,
-                                        struct ieee80211_chanctx *ctx)
+static void ieee80211_free_chanctx(struct ieee80211_local *local,
+                                   struct ieee80211_chanctx *ctx)
 {
-        struct ieee80211_local *local = sdata->local;
-        int ret;
-
         lockdep_assert_held(&local->chanctx_mtx);
 
-        ret = drv_assign_vif_chanctx(local, sdata, ctx);
-        if (ret)
-                return ret;
-
-        rcu_assign_pointer(sdata->vif.chanctx_conf, &ctx->conf);
-        ctx->refcount++;
-
-        ieee80211_recalc_txpower(sdata);
-        ieee80211_recalc_chanctx_min_def(local, ctx);
-        sdata->vif.bss_conf.idle = false;
+        WARN_ON_ONCE(ieee80211_chanctx_refcount(local, ctx) != 0);
 
-        if (sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE &&
-            sdata->vif.type != NL80211_IFTYPE_MONITOR)
-                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_IDLE);
-
-        return 0;
+        list_del_rcu(&ctx->list);
+        ieee80211_del_chanctx(local, ctx);
+        kfree_rcu(ctx, rcu_head);
 }
 
 static void ieee80211_recalc_chanctx_chantype(struct ieee80211_local *local,
@@ -384,30 +563,58 @@ static void ieee80211_recalc_radar_chanctx(struct ieee80211_local *local,
         drv_change_chanctx(local, chanctx, IEEE80211_CHANCTX_CHANGE_RADAR);
 }
 
-static void ieee80211_unassign_vif_chanctx(struct ieee80211_sub_if_data *sdata,
-                                           struct ieee80211_chanctx *ctx)
+static int ieee80211_assign_vif_chanctx(struct ieee80211_sub_if_data *sdata,
+                                        struct ieee80211_chanctx *new_ctx)
 {
         struct ieee80211_local *local = sdata->local;
+        struct ieee80211_chanctx_conf *conf;
+        struct ieee80211_chanctx *curr_ctx = NULL;
+        int ret = 0;
 
-        lockdep_assert_held(&local->chanctx_mtx);
+        conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
+                                         lockdep_is_held(&local->chanctx_mtx));
 
-        ctx->refcount--;
-        rcu_assign_pointer(sdata->vif.chanctx_conf, NULL);
+        if (conf) {
+                curr_ctx = container_of(conf, struct ieee80211_chanctx, conf);
 
-        sdata->vif.bss_conf.idle = true;
+                drv_unassign_vif_chanctx(local, sdata, curr_ctx);
+                conf = NULL;
+                list_del(&sdata->assigned_chanctx_list);
+        }
 
-        if (sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE &&
-            sdata->vif.type != NL80211_IFTYPE_MONITOR)
-                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_IDLE);
+        if (new_ctx) {
+                ret = drv_assign_vif_chanctx(local, sdata, new_ctx);
+                if (ret)
+                        goto out;
 
-        drv_unassign_vif_chanctx(local, sdata, ctx);
+                conf = &new_ctx->conf;
+                list_add(&sdata->assigned_chanctx_list,
+                         &new_ctx->assigned_vifs);
+        }
 
-        if (ctx->refcount > 0) {
-                ieee80211_recalc_chanctx_chantype(sdata->local, ctx);
-                ieee80211_recalc_smps_chanctx(local, ctx);
-                ieee80211_recalc_radar_chanctx(local, ctx);
-                ieee80211_recalc_chanctx_min_def(local, ctx);
+out:
+        rcu_assign_pointer(sdata->vif.chanctx_conf, conf);
+
+        sdata->vif.bss_conf.idle = !conf;
+
+        if (curr_ctx && ieee80211_chanctx_num_assigned(local, curr_ctx) > 0) {
+                ieee80211_recalc_chanctx_chantype(local, curr_ctx);
+                ieee80211_recalc_smps_chanctx(local, curr_ctx);
+                ieee80211_recalc_radar_chanctx(local, curr_ctx);
+                ieee80211_recalc_chanctx_min_def(local, curr_ctx);
         }
+
+        if (new_ctx && ieee80211_chanctx_num_assigned(local, new_ctx) > 0) {
+                ieee80211_recalc_txpower(sdata);
+                ieee80211_recalc_chanctx_min_def(local, new_ctx);
+        }
+
+        if (sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE &&
+            sdata->vif.type != NL80211_IFTYPE_MONITOR)
+                ieee80211_bss_info_change_notify(sdata,
+                                                 BSS_CHANGED_IDLE);
+
+        return ret;
 }
 
 static void __ieee80211_vif_release_channel(struct ieee80211_sub_if_data *sdata)
@@ -425,8 +632,11 @@ static void __ieee80211_vif_release_channel(struct ieee80211_sub_if_data *sdata)
 
         ctx = container_of(conf, struct ieee80211_chanctx, conf);
 
-        ieee80211_unassign_vif_chanctx(sdata, ctx);
-        if (ctx->refcount == 0)
+        if (sdata->reserved_chanctx)
+                ieee80211_vif_unreserve_chanctx(sdata);
+
+        ieee80211_assign_vif_chanctx(sdata, NULL);
+        if (ieee80211_chanctx_refcount(local, ctx) == 0)
                 ieee80211_free_chanctx(local, ctx);
 }
 
@@ -526,6 +736,7 @@ int ieee80211_vif_use_channel(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_chanctx *ctx;
+        u8 radar_detect_width = 0;
         int ret;
 
         lockdep_assert_held(&local->mtx);
@@ -533,6 +744,22 @@ int ieee80211_vif_use_channel(struct ieee80211_sub_if_data *sdata,
         WARN_ON(sdata->dev && netif_carrier_ok(sdata->dev));
 
         mutex_lock(&local->chanctx_mtx);
+
+        ret = cfg80211_chandef_dfs_required(local->hw.wiphy,
+                                            chandef,
+                                            sdata->wdev.iftype);
+        if (ret < 0)
+                goto out;
+        if (ret > 0)
+                radar_detect_width = BIT(chandef->width);
+
+        sdata->radar_required = ret;
+
+        ret = ieee80211_check_combinations(sdata, chandef, mode,
+                                           radar_detect_width);
+        if (ret < 0)
+                goto out;
+
         __ieee80211_vif_release_channel(sdata);
 
         ctx = ieee80211_find_chanctx(local, chandef, mode);
@@ -548,7 +775,7 @@ int ieee80211_vif_use_channel(struct ieee80211_sub_if_data *sdata,
         ret = ieee80211_assign_vif_chanctx(sdata, ctx);
         if (ret) {
                 /* if assign fails refcount stays the same */
-                if (ctx->refcount == 0)
+                if (ieee80211_chanctx_refcount(local, ctx) == 0)
                         ieee80211_free_chanctx(local, ctx);
                 goto out;
         }
@@ -560,15 +787,47 @@ int ieee80211_vif_use_channel(struct ieee80211_sub_if_data *sdata,
         return ret;
 }
 
+static int __ieee80211_vif_change_channel(struct ieee80211_sub_if_data *sdata,
+                                          struct ieee80211_chanctx *ctx,
+                                          u32 *changed)
+{
+        struct ieee80211_local *local = sdata->local;
+        const struct cfg80211_chan_def *chandef = &sdata->csa_chandef;
+        u32 chanctx_changed = 0;
+
+        if (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
+                                     IEEE80211_CHAN_DISABLED))
+                return -EINVAL;
+
+        if (ieee80211_chanctx_refcount(local, ctx) != 1)
+                return -EINVAL;
+
+        if (sdata->vif.bss_conf.chandef.width != chandef->width) {
+                chanctx_changed = IEEE80211_CHANCTX_CHANGE_WIDTH;
+                *changed |= BSS_CHANGED_BANDWIDTH;
+        }
+
+        sdata->vif.bss_conf.chandef = *chandef;
+        ctx->conf.def = *chandef;
+
+        chanctx_changed |= IEEE80211_CHANCTX_CHANGE_CHANNEL;
+        drv_change_chanctx(local, ctx, chanctx_changed);
+
+        ieee80211_recalc_chanctx_chantype(local, ctx);
+        ieee80211_recalc_smps_chanctx(local, ctx);
+        ieee80211_recalc_radar_chanctx(local, ctx);
+        ieee80211_recalc_chanctx_min_def(local, ctx);
+
+        return 0;
+}
+
 int ieee80211_vif_change_channel(struct ieee80211_sub_if_data *sdata,
                                  u32 *changed)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_chanctx_conf *conf;
         struct ieee80211_chanctx *ctx;
-        const struct cfg80211_chan_def *chandef = &sdata->csa_chandef;
         int ret;
-        u32 chanctx_changed = 0;
 
         lockdep_assert_held(&local->mtx);
 
@@ -576,11 +835,94 @@ int ieee80211_vif_change_channel(struct ieee80211_sub_if_data *sdata,
         if (WARN_ON(!sdata->vif.csa_active))
                 return -EINVAL;
 
-        if (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
-                                     IEEE80211_CHAN_DISABLED))
+        mutex_lock(&local->chanctx_mtx);
+        conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
+                                         lockdep_is_held(&local->chanctx_mtx));
+        if (!conf) {
+                ret = -EINVAL;
+                goto out;
+        }
+
+        ctx = container_of(conf, struct ieee80211_chanctx, conf);
+
+        ret = __ieee80211_vif_change_channel(sdata, ctx, changed);
+ out:
+        mutex_unlock(&local->chanctx_mtx);
+        return ret;
+}
+
+static void
+__ieee80211_vif_copy_chanctx_to_vlans(struct ieee80211_sub_if_data *sdata,
+                                      bool clear)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_sub_if_data *vlan;
+        struct ieee80211_chanctx_conf *conf;
+
+        if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_AP))
+                return;
+
+        lockdep_assert_held(&local->mtx);
+
+        /* Check that conf exists, even when clearing this function
+         * must be called with the AP's channel context still there
+         * as it would otherwise cause VLANs to have an invalid
+         * channel context pointer for a while, possibly pointing
+         * to a channel context that has already been freed.
+         */
+        conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
+                                lockdep_is_held(&local->chanctx_mtx));
+        WARN_ON(!conf);
+
+        if (clear)
+                conf = NULL;
+
+        list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
+                rcu_assign_pointer(vlan->vif.chanctx_conf, conf);
+}
+
+void ieee80211_vif_copy_chanctx_to_vlans(struct ieee80211_sub_if_data *sdata,
+                                         bool clear)
+{
+        struct ieee80211_local *local = sdata->local;
+
+        mutex_lock(&local->chanctx_mtx);
+
+        __ieee80211_vif_copy_chanctx_to_vlans(sdata, clear);
+
+        mutex_unlock(&local->chanctx_mtx);
+}
+
+int ieee80211_vif_unreserve_chanctx(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_chanctx *ctx = sdata->reserved_chanctx;
+
+        lockdep_assert_held(&sdata->local->chanctx_mtx);
+
+        if (WARN_ON(!ctx))
                 return -EINVAL;
 
+        list_del(&sdata->reserved_chanctx_list);
+        sdata->reserved_chanctx = NULL;
+
+        if (ieee80211_chanctx_refcount(sdata->local, ctx) == 0)
+                ieee80211_free_chanctx(sdata->local, ctx);
+
+        return 0;
+}
+
+int ieee80211_vif_reserve_chanctx(struct ieee80211_sub_if_data *sdata,
+                                  const struct cfg80211_chan_def *chandef,
+                                  enum ieee80211_chanctx_mode mode,
+                                  bool radar_required)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_chanctx_conf *conf;
+        struct ieee80211_chanctx *new_ctx, *curr_ctx;
+        int ret = 0;
+
         mutex_lock(&local->chanctx_mtx);
+
         conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
                                          lockdep_is_held(&local->chanctx_mtx));
         if (!conf) {
@@ -588,30 +930,108 @@ int ieee80211_vif_change_channel(struct ieee80211_sub_if_data *sdata,
                 goto out;
         }
 
-        ctx = container_of(conf, struct ieee80211_chanctx, conf);
-        if (ctx->refcount != 1) {
+        curr_ctx = container_of(conf, struct ieee80211_chanctx, conf);
+
+        new_ctx = ieee80211_find_reservation_chanctx(local, chandef, mode);
+        if (!new_ctx) {
+                if (ieee80211_chanctx_refcount(local, curr_ctx) == 1 &&
+                    (local->hw.flags & IEEE80211_HW_CHANGE_RUNNING_CHANCTX)) {
+                        /* if we're the only users of the chanctx and
+                         * the driver supports changing a running
+                         * context, reserve our current context
+                         */
+                        new_ctx = curr_ctx;
+                } else if (ieee80211_can_create_new_chanctx(local)) {
+                        /* create a new context and reserve it */
+                        new_ctx = ieee80211_new_chanctx(local, chandef, mode);
+                        if (IS_ERR(new_ctx)) {
+                                ret = PTR_ERR(new_ctx);
+                                goto out;
+                        }
+                } else {
+                        ret = -EBUSY;
+                        goto out;
+                }
+        }
+
+        list_add(&sdata->reserved_chanctx_list, &new_ctx->reserved_vifs);
+        sdata->reserved_chanctx = new_ctx;
+        sdata->reserved_chandef = *chandef;
+        sdata->reserved_radar_required = radar_required;
+out:
+        mutex_unlock(&local->chanctx_mtx);
+        return ret;
+}
+
+int ieee80211_vif_use_reserved_context(struct ieee80211_sub_if_data *sdata,
+                                       u32 *changed)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_chanctx *ctx;
+        struct ieee80211_chanctx *old_ctx;
+        struct ieee80211_chanctx_conf *conf;
+        int ret;
+        u32 tmp_changed = *changed;
+
+        /* TODO: need to recheck if the chandef is usable etc.? */
+
+        lockdep_assert_held(&local->mtx);
+
+        mutex_lock(&local->chanctx_mtx);
+
+        ctx = sdata->reserved_chanctx;
+        if (WARN_ON(!ctx)) {
                 ret = -EINVAL;
                 goto out;
         }
 
-        if (sdata->vif.bss_conf.chandef.width != chandef->width) {
-                chanctx_changed = IEEE80211_CHANCTX_CHANGE_WIDTH;
-                *changed |= BSS_CHANGED_BANDWIDTH;
+        conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
+                                         lockdep_is_held(&local->chanctx_mtx));
+        if (!conf) {
+                ret = -EINVAL;
+                goto out;
         }
 
-        sdata->vif.bss_conf.chandef = *chandef;
-        ctx->conf.def = *chandef;
+        old_ctx = container_of(conf, struct ieee80211_chanctx, conf);
 
-        chanctx_changed |= IEEE80211_CHANCTX_CHANGE_CHANNEL;
-        drv_change_chanctx(local, ctx, chanctx_changed);
+        if (sdata->vif.bss_conf.chandef.width != sdata->reserved_chandef.width)
+                tmp_changed |= BSS_CHANGED_BANDWIDTH;
+
+        sdata->vif.bss_conf.chandef = sdata->reserved_chandef;
+
+        /* unref our reservation */
+        sdata->reserved_chanctx = NULL;
+        sdata->radar_required = sdata->reserved_radar_required;
+        list_del(&sdata->reserved_chanctx_list);
+
+        if (old_ctx == ctx) {
+                /* This is our own context, just change it */
+                ret = __ieee80211_vif_change_channel(sdata, old_ctx,
+                                                     &tmp_changed);
+                if (ret)
+                        goto out;
+        } else {
+                ret = ieee80211_assign_vif_chanctx(sdata, ctx);
+                if (ieee80211_chanctx_refcount(local, old_ctx) == 0)
+                        ieee80211_free_chanctx(local, old_ctx);
+                if (ret) {
+                        /* if assign fails refcount stays the same */
+                        if (ieee80211_chanctx_refcount(local, ctx) == 0)
+                                ieee80211_free_chanctx(local, ctx);
+                        goto out;
+                }
+
+                if (sdata->vif.type == NL80211_IFTYPE_AP)
+                        __ieee80211_vif_copy_chanctx_to_vlans(sdata, false);
+        }
+
+        *changed = tmp_changed;
 
         ieee80211_recalc_chanctx_chantype(local, ctx);
         ieee80211_recalc_smps_chanctx(local, ctx);
         ieee80211_recalc_radar_chanctx(local, ctx);
         ieee80211_recalc_chanctx_min_def(local, ctx);
-
-        ret = 0;
- out:
+out:
         mutex_unlock(&local->chanctx_mtx);
         return ret;
 }
@@ -695,40 +1115,6 @@ void ieee80211_vif_vlan_copy_chanctx(struct ieee80211_sub_if_data *sdata)
         mutex_unlock(&local->chanctx_mtx);
 }
 
-void ieee80211_vif_copy_chanctx_to_vlans(struct ieee80211_sub_if_data *sdata,
-                                         bool clear)
-{
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_sub_if_data *vlan;
-        struct ieee80211_chanctx_conf *conf;
-
-        ASSERT_RTNL();
-
-        if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_AP))
-                return;
-
-        mutex_lock(&local->chanctx_mtx);
-
-        /*
-         * Check that conf exists, even when clearing this function
-         * must be called with the AP's channel context still there
-         * as it would otherwise cause VLANs to have an invalid
-         * channel context pointer for a while, possibly pointing
-         * to a channel context that has already been freed.
-         */
-        conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
-                                lockdep_is_held(&local->chanctx_mtx));
-        WARN_ON(!conf);
-
-        if (clear)
-                conf = NULL;
-
-        list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
-                rcu_assign_pointer(vlan->vif.chanctx_conf, conf);
-
-        mutex_unlock(&local->chanctx_mtx);
-}
-
 void ieee80211_iter_chan_contexts_atomic(
         struct ieee80211_hw *hw,
         void (*iter)(struct ieee80211_hw *hw,
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index fa16e54980a1..0e963bc1ceac 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -128,7 +128,7 @@ static ssize_t sta_tx_latency_stat_write(struct file *file,
         if (!strcmp(buf, TX_LATENCY_DISABLED)) {
                 if (!tx_latency)
                         goto unlock;
-                rcu_assign_pointer(local->tx_latency, NULL);
+                RCU_INIT_POINTER(local->tx_latency, NULL);
                 synchronize_rcu();
                 kfree(tx_latency);
                 goto unlock;
diff --git a/net/mac80211/debugfs.h b/net/mac80211/debugfs.h
index 214ed4ecd739..60c35afee29d 100644
--- a/net/mac80211/debugfs.h
+++ b/net/mac80211/debugfs.h
@@ -1,6 +1,8 @@
 #ifndef __MAC80211_DEBUGFS_H
 #define __MAC80211_DEBUGFS_H
 
+#include "ieee80211_i.h"
+
 #ifdef CONFIG_MAC80211_DEBUGFS
 void debugfs_hw_add(struct ieee80211_local *local);
 int __printf(4, 5) mac80211_format_buffer(char __user *userbuf, size_t count,
diff --git a/net/mac80211/debugfs_netdev.h b/net/mac80211/debugfs_netdev.h
index 79025e79f4d6..9f5501a9a795 100644
--- a/net/mac80211/debugfs_netdev.h
+++ b/net/mac80211/debugfs_netdev.h
@@ -3,6 +3,8 @@
 #ifndef __IEEE80211_DEBUGFS_NETDEV_H
 #define __IEEE80211_DEBUGFS_NETDEV_H
 
+#include "ieee80211_i.h"
+
 #ifdef CONFIG_MAC80211_DEBUGFS
 void ieee80211_debugfs_add_netdev(struct ieee80211_sub_if_data *sdata);
 void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata);
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index fc689f5d971e..5331582a2c81 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -726,13 +726,19 @@ static inline void drv_rfkill_poll(struct ieee80211_local *local)
 }
 
 static inline void drv_flush(struct ieee80211_local *local,
+                             struct ieee80211_sub_if_data *sdata,
                              u32 queues, bool drop)
 {
+        struct ieee80211_vif *vif = sdata ? &sdata->vif : NULL;
+
         might_sleep();
 
+        if (sdata)
+                check_sdata_in_driver(sdata);
+
         trace_drv_flush(local, queues, drop);
         if (local->ops->flush)
-                local->ops->flush(&local->hw, queues, drop);
+                local->ops->flush(&local->hw, vif, queues, drop);
         trace_drv_return_void(local);
 }
 
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index c150b68436d7..15702ff64a4c 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -31,6 +31,18 @@ static void __check_htcap_disable(struct ieee80211_ht_cap *ht_capa,
         }
 }
 
+static void __check_htcap_enable(struct ieee80211_ht_cap *ht_capa,
+                                  struct ieee80211_ht_cap *ht_capa_mask,
+                                  struct ieee80211_sta_ht_cap *ht_cap,
+                                  u16 flag)
+{
+        __le16 le_flag = cpu_to_le16(flag);
+
+        if ((ht_capa_mask->cap_info & le_flag) &&
+            (ht_capa->cap_info & le_flag))
+                ht_cap->cap |= flag;
+}
+
 void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
                                      struct ieee80211_sta_ht_cap *ht_cap)
 {
@@ -59,7 +71,7 @@ void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
         smask = (u8 *)(&ht_capa_mask->mcs.rx_mask);
 
         /* NOTE:  If you add more over-rides here, update register_hw
-         * ht_capa_mod_msk logic in main.c as well.
+         * ht_capa_mod_mask logic in main.c as well.
          * And, if this method can ever change ht_cap.ht_supported, fix
          * the check in ieee80211_add_ht_ie.
          */
@@ -86,6 +98,14 @@ void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
         __check_htcap_disable(ht_capa, ht_capa_mask, ht_cap,
                               IEEE80211_HT_CAP_MAX_AMSDU);
 
+        /* Allow user to disable LDPC */
+        __check_htcap_disable(ht_capa, ht_capa_mask, ht_cap,
+                              IEEE80211_HT_CAP_LDPC_CODING);
+
+        /* Allow user to enable 40 MHz intolerant bit. */
+        __check_htcap_enable(ht_capa, ht_capa_mask, ht_cap,
+                             IEEE80211_HT_CAP_40MHZ_INTOLERANT);
+
         /* Allow user to decrease AMPDU factor */
         if (ht_capa_mask->ampdu_params_info &
             IEEE80211_HT_AMPDU_PARM_FACTOR) {
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 06d28787945b..ff4d4155a84d 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -228,7 +228,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         struct beacon_data *presp;
         enum nl80211_bss_scan_width scan_width;
         bool have_higher_than_11mbit;
-        bool radar_required = false;
+        bool radar_required;
         int err;
 
         sdata_assert_lock(sdata);
@@ -253,7 +253,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
 
         presp = rcu_dereference_protected(ifibss->presp,
                                           lockdep_is_held(&sdata->wdev.mtx));
-        rcu_assign_pointer(ifibss->presp, NULL);
+        RCU_INIT_POINTER(ifibss->presp, NULL);
         if (presp)
                 kfree_rcu(presp, rcu_head);
 
@@ -262,7 +262,8 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         /* make a copy of the chandef, it could be modified below. */
         chandef = *req_chandef;
         chan = chandef.chan;
-        if (!cfg80211_reg_can_beacon(local->hw.wiphy, &chandef)) {
+        if (!cfg80211_reg_can_beacon(local->hw.wiphy, &chandef,
+                                     NL80211_IFTYPE_ADHOC)) {
                 if (chandef.width == NL80211_CHAN_WIDTH_5 ||
                     chandef.width == NL80211_CHAN_WIDTH_10 ||
                     chandef.width == NL80211_CHAN_WIDTH_20_NOHT ||
@@ -274,7 +275,8 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
                 chandef.width = NL80211_CHAN_WIDTH_20;
                 chandef.center_freq1 = chan->center_freq;
                 /* check again for downgraded chandef */
-                if (!cfg80211_reg_can_beacon(local->hw.wiphy, &chandef)) {
+                if (!cfg80211_reg_can_beacon(local->hw.wiphy, &chandef,
+                                             NL80211_IFTYPE_ADHOC)) {
                         sdata_info(sdata,
                                    "Failed to join IBSS, beacons forbidden\n");
                         return;
@@ -282,21 +284,20 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         }
 
         err = cfg80211_chandef_dfs_required(sdata->local->hw.wiphy,
-                                            &chandef);
+                                            &chandef, NL80211_IFTYPE_ADHOC);
         if (err < 0) {
                 sdata_info(sdata,
                            "Failed to join IBSS, invalid chandef\n");
                 return;
         }
-        if (err > 0) {
-                if (!ifibss->userspace_handles_dfs) {
-                        sdata_info(sdata,
-                                   "Failed to join IBSS, DFS channel without control program\n");
-                        return;
-                }
-                radar_required = true;
+        if (err > 0 && !ifibss->userspace_handles_dfs) {
+                sdata_info(sdata,
+                           "Failed to join IBSS, DFS channel without control program\n");
+                return;
         }
 
+        radar_required = err;
+
         mutex_lock(&local->mtx);
         if (ieee80211_vif_use_channel(sdata, &chandef,
                                       ifibss->fixed_channel ?
@@ -775,7 +776,8 @@ static void ieee80211_ibss_csa_mark_radar(struct ieee80211_sub_if_data *sdata)
          * unavailable.
          */
         err = cfg80211_chandef_dfs_required(sdata->local->hw.wiphy,
-                                            &ifibss->chandef);
+                                            &ifibss->chandef,
+                                            NL80211_IFTYPE_ADHOC);
         if (err > 0)
                 cfg80211_radar_event(sdata->local->hw.wiphy, &ifibss->chandef,
                                      GFP_ATOMIC);
@@ -861,7 +863,8 @@ ieee80211_ibss_process_chanswitch(struct ieee80211_sub_if_data *sdata,
                 goto disconnect;
         }
 
-        if (!cfg80211_reg_can_beacon(sdata->local->hw.wiphy, &params.chandef)) {
+        if (!cfg80211_reg_can_beacon(sdata->local->hw.wiphy, &params.chandef,
+                                     NL80211_IFTYPE_ADHOC)) {
                 sdata_info(sdata,
                            "IBSS %pM switches to unsupported channel (%d MHz, width:%d, CF1/2: %d/%d MHz), disconnecting\n",
                            ifibss->bssid,
@@ -873,17 +876,17 @@ ieee80211_ibss_process_chanswitch(struct ieee80211_sub_if_data *sdata,
         }
 
         err = cfg80211_chandef_dfs_required(sdata->local->hw.wiphy,
-                                            &params.chandef);
+                                            &params.chandef,
+                                            NL80211_IFTYPE_ADHOC);
         if (err < 0)
                 goto disconnect;
-        if (err) {
+        if (err > 0 && !ifibss->userspace_handles_dfs) {
                 /* IBSS-DFS only allowed with a control program */
-                if (!ifibss->userspace_handles_dfs)
-                        goto disconnect;
-
-                params.radar_required = true;
+                goto disconnect;
         }
 
+        params.radar_required = err;
+
         if (cfg80211_chandef_identical(&params.chandef,
                                        &sdata->vif.bss_conf.chandef)) {
                 ibss_dbg(sdata,
@@ -1636,7 +1639,33 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
         u32 changed = 0;
         u32 rate_flags;
         struct ieee80211_supported_band *sband;
+        enum ieee80211_chanctx_mode chanmode;
+        struct ieee80211_local *local = sdata->local;
+        int radar_detect_width = 0;
         int i;
+        int ret;
+
+        ret = cfg80211_chandef_dfs_required(local->hw.wiphy,
+                                            &params->chandef,
+                                            sdata->wdev.iftype);
+        if (ret < 0)
+                return ret;
+
+        if (ret > 0) {
+                if (!params->userspace_handles_dfs)
+                        return -EINVAL;
+                radar_detect_width = BIT(params->chandef.width);
+        }
+
+        chanmode = (params->channel_fixed && !ret) ?
+                IEEE80211_CHANCTX_SHARED : IEEE80211_CHANCTX_EXCLUSIVE;
+
+        mutex_lock(&local->chanctx_mtx);
+        ret = ieee80211_check_combinations(sdata, &params->chandef, chanmode,
+                                           radar_detect_width);
+        mutex_unlock(&local->chanctx_mtx);
+        if (ret < 0)
+                return ret;
 
         if (params->bssid) {
                 memcpy(sdata->u.ibss.bssid, params->bssid, ETH_ALEN);
@@ -1651,7 +1680,7 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
 
         /* fix basic_rates if channel does not support these rates */
         rate_flags = ieee80211_chandef_rate_flags(&params->chandef);
-        sband = sdata->local->hw.wiphy->bands[params->chandef.chan->band];
+        sband = local->hw.wiphy->bands[params->chandef.chan->band];
         for (i = 0; i < sband->n_bitrates; i++) {
                 if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
                         sdata->u.ibss.basic_rates &= ~BIT(i);
@@ -1700,9 +1729,9 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
         ieee80211_bss_info_change_notify(sdata, changed);
 
         sdata->smps_mode = IEEE80211_SMPS_OFF;
-        sdata->needed_rx_chains = sdata->local->rx_chains;
+        sdata->needed_rx_chains = local->rx_chains;
 
-        ieee80211_queue_work(&sdata->local->hw, &sdata->work);
+        ieee80211_queue_work(&local->hw, &sdata->work);
 
         return 0;
 }
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 222c28b75315..b455f62d357a 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -260,7 +260,7 @@ struct ieee80211_if_ap {
 
         /* to be used after channel switch. */
         struct cfg80211_beacon_data *next_beacon;
-        struct list_head vlans;
+        struct list_head vlans; /* write-protected with RTNL and local->mtx */
 
         struct ps_data ps;
         atomic_t num_mcast_sta; /* number of stations receiving multicast */
@@ -276,7 +276,7 @@ struct ieee80211_if_wds {
 };
 
 struct ieee80211_if_vlan {
-        struct list_head list;
+        struct list_head list; /* write-protected with RTNL and local->mtx */
 
         /* used for all tx if the VLAN is configured to 4-addr mode */
         struct sta_info __rcu *sta;
@@ -691,8 +691,10 @@ struct ieee80211_chanctx {
         struct list_head list;
         struct rcu_head rcu_head;
 
+        struct list_head assigned_vifs;
+        struct list_head reserved_vifs;
+
         enum ieee80211_chanctx_mode mode;
-        int refcount;
         bool driver_present;
 
         struct ieee80211_chanctx_conf conf;
@@ -756,6 +758,14 @@ struct ieee80211_sub_if_data {
         bool csa_radar_required;
         struct cfg80211_chan_def csa_chandef;
 
+        struct list_head assigned_chanctx_list; /* protected by chanctx_mtx */
+        struct list_head reserved_chanctx_list; /* protected by chanctx_mtx */
+
+        /* context reservation -- protected with chanctx_mtx */
+        struct ieee80211_chanctx *reserved_chanctx;
+        struct cfg80211_chan_def reserved_chandef;
+        bool reserved_radar_required;
+
         /* used to reconfigure hardware SM PS */
         struct work_struct recalc_smps;
 
@@ -1771,6 +1781,16 @@ ieee80211_vif_use_channel(struct ieee80211_sub_if_data *sdata,
                           const struct cfg80211_chan_def *chandef,
                           enum ieee80211_chanctx_mode mode);
 int __must_check
+ieee80211_vif_reserve_chanctx(struct ieee80211_sub_if_data *sdata,
+                              const struct cfg80211_chan_def *chandef,
+                              enum ieee80211_chanctx_mode mode,
+                              bool radar_required);
+int __must_check
+ieee80211_vif_use_reserved_context(struct ieee80211_sub_if_data *sdata,
+                                   u32 *changed);
+int ieee80211_vif_unreserve_chanctx(struct ieee80211_sub_if_data *sdata);
+
+int __must_check
 ieee80211_vif_change_bandwidth(struct ieee80211_sub_if_data *sdata,
                                const struct cfg80211_chan_def *chandef,
                                u32 *changed);
@@ -1782,6 +1802,8 @@ void ieee80211_vif_release_channel(struct ieee80211_sub_if_data *sdata);
 void ieee80211_vif_vlan_copy_chanctx(struct ieee80211_sub_if_data *sdata);
 void ieee80211_vif_copy_chanctx_to_vlans(struct ieee80211_sub_if_data *sdata,
                                          bool clear);
+int ieee80211_chanctx_refcount(struct ieee80211_local *local,
+                               struct ieee80211_chanctx *ctx);
 
 void ieee80211_recalc_smps_chanctx(struct ieee80211_local *local,
                                    struct ieee80211_chanctx *chanctx);
@@ -1805,6 +1827,11 @@ int ieee80211_cs_headroom(struct ieee80211_local *local,
                           enum nl80211_iftype iftype);
 void ieee80211_recalc_dtim(struct ieee80211_local *local,
                            struct ieee80211_sub_if_data *sdata);
+int ieee80211_check_combinations(struct ieee80211_sub_if_data *sdata,
+                                 const struct cfg80211_chan_def *chandef,
+                                 enum ieee80211_chanctx_mode chanmode,
+                                 u8 radar_detect);
+int ieee80211_max_num_channels(struct ieee80211_local *local);
 
 #ifdef CONFIG_MAC80211_NOINLINE
 #define debug_noinline noinline
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index b8d331e7d883..7fff3dcaac43 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -250,6 +250,7 @@ static int ieee80211_check_concurrent_iface(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_sub_if_data *nsdata;
+        int ret;
 
         ASSERT_RTNL();
 
@@ -300,7 +301,10 @@ static int ieee80211_check_concurrent_iface(struct ieee80211_sub_if_data *sdata,
                 }
         }
 
-        return 0;
+        mutex_lock(&local->chanctx_mtx);
+        ret = ieee80211_check_combinations(sdata, NULL, 0, 0);
+        mutex_unlock(&local->chanctx_mtx);
+        return ret;
 }
 
 static int ieee80211_check_queues(struct ieee80211_sub_if_data *sdata,
@@ -423,7 +427,7 @@ int ieee80211_add_virtual_monitor(struct ieee80211_local *local)
         mutex_unlock(&local->mtx);
         if (ret) {
                 mutex_lock(&local->iflist_mtx);
-                rcu_assign_pointer(local->monitor_sdata, NULL);
+                RCU_INIT_POINTER(local->monitor_sdata, NULL);
                 mutex_unlock(&local->iflist_mtx);
                 synchronize_net();
                 drv_remove_interface(local, sdata);
@@ -452,7 +456,7 @@ void ieee80211_del_virtual_monitor(struct ieee80211_local *local)
                 return;
         }
 
-        rcu_assign_pointer(local->monitor_sdata, NULL);
+        RCU_INIT_POINTER(local->monitor_sdata, NULL);
         mutex_unlock(&local->iflist_mtx);
 
         synchronize_net();
@@ -492,7 +496,9 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
                 if (!sdata->bss)
                         return -ENOLINK;
 
+                mutex_lock(&local->mtx);
                 list_add(&sdata->u.vlan.list, &sdata->bss->vlans);
+                mutex_unlock(&local->mtx);
 
                 master = container_of(sdata->bss,
                                       struct ieee80211_sub_if_data, u.ap);
@@ -722,8 +728,11 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
                 drv_stop(local);
  err_del_bss:
         sdata->bss = NULL;
-        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
+                mutex_lock(&local->mtx);
                 list_del(&sdata->u.vlan.list);
+                mutex_unlock(&local->mtx);
+        }
         /* might already be clear but that doesn't matter */
         clear_bit(SDATA_STATE_RUNNING, &sdata->state);
         return res;
@@ -875,8 +884,10 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
 
         switch (sdata->vif.type) {
         case NL80211_IFTYPE_AP_VLAN:
+                mutex_lock(&local->mtx);
                 list_del(&sdata->u.vlan.list);
-                rcu_assign_pointer(sdata->vif.chanctx_conf, NULL);
+                mutex_unlock(&local->mtx);
+                RCU_INIT_POINTER(sdata->vif.chanctx_conf, NULL);
                 /* no need to tell driver */
                 break;
         case NL80211_IFTYPE_MONITOR:
@@ -895,7 +906,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                 break;
         case NL80211_IFTYPE_P2P_DEVICE:
                 /* relies on synchronize_rcu() below */
-                rcu_assign_pointer(local->p2p_sdata, NULL);
+                RCU_INIT_POINTER(local->p2p_sdata, NULL);
                 /* fall through */
         default:
                 cancel_work_sync(&sdata->work);
@@ -1280,6 +1291,8 @@ static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
         INIT_WORK(&sdata->work, ieee80211_iface_work);
         INIT_WORK(&sdata->recalc_smps, ieee80211_recalc_smps_work);
         INIT_WORK(&sdata->csa_finalize_work, ieee80211_csa_finalize_work);
+        INIT_LIST_HEAD(&sdata->assigned_chanctx_list);
+        INIT_LIST_HEAD(&sdata->reserved_chanctx_list);
 
         switch (type) {
         case NL80211_IFTYPE_P2P_GO:
@@ -1774,20 +1787,19 @@ static int netdev_notify(struct notifier_block *nb,
         struct ieee80211_sub_if_data *sdata;
 
         if (state != NETDEV_CHANGENAME)
-                return 0;
+                return NOTIFY_DONE;
 
         if (!dev->ieee80211_ptr || !dev->ieee80211_ptr->wiphy)
-                return 0;
+                return NOTIFY_DONE;
 
         if (dev->ieee80211_ptr->wiphy->privid != mac80211_wiphy_privid)
-                return 0;
+                return NOTIFY_DONE;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
         memcpy(sdata->name, dev->name, IFNAMSIZ);
-
         ieee80211_debugfs_rename_netdev(sdata);
-        return 0;
+
+        return NOTIFY_OK;
 }
 
 static struct notifier_block mac80211_netdev_notifier = {
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 4c1bf61bc778..27b9364cdf17 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -340,7 +340,7 @@ static int ieee80211_ifa_changed(struct notifier_block *nb,
 
         sdata_unlock(sdata);
 
-        return NOTIFY_DONE;
+        return NOTIFY_OK;
 }
 #endif
 
@@ -371,7 +371,7 @@ static int ieee80211_ifa6_changed(struct notifier_block *nb,
 
         drv_ipv6_addr_change(local, sdata, idev);
 
-        return NOTIFY_DONE;
+        return NOTIFY_OK;
 }
 #endif
 
@@ -446,7 +446,9 @@ static const struct ieee80211_ht_cap mac80211_ht_capa_mod_mask = {
         .cap_info = cpu_to_le16(IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
                                 IEEE80211_HT_CAP_MAX_AMSDU |
                                 IEEE80211_HT_CAP_SGI_20 |
-                                IEEE80211_HT_CAP_SGI_40),
+                                IEEE80211_HT_CAP_SGI_40 |
+                                IEEE80211_HT_CAP_LDPC_CODING |
+                                IEEE80211_HT_CAP_40MHZ_INTOLERANT),
         .mcs = {
                 .rx_mask = { 0xff, 0xff, 0xff, 0xff, 0xff,
                              0xff, 0xff, 0xff, 0xff, 0xff, },
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index f70e9cd10552..b06ddc9519ce 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -366,20 +366,15 @@ int mesh_add_rsn_ie(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
                 return 0;
 
         /* find RSN IE */
-        data = ifmsh->ie;
-        while (data < ifmsh->ie + ifmsh->ie_len) {
-                if (*data == WLAN_EID_RSN) {
-                        len = data[1] + 2;
-                        break;
-                }
-                data++;
-        }
+        data = cfg80211_find_ie(WLAN_EID_RSN, ifmsh->ie, ifmsh->ie_len);
+        if (!data)
+                return 0;
 
-        if (len) {
-                if (skb_tailroom(skb) < len)
-                        return -ENOMEM;
-                memcpy(skb_put(skb, len), data, len);
-        }
+        len = data[1] + 2;
+
+        if (skb_tailroom(skb) < len)
+                return -ENOMEM;
+        memcpy(skb_put(skb, len), data, len);
 
         return 0;
 }
@@ -829,7 +824,7 @@ void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED);
         bcn = rcu_dereference_protected(ifmsh->beacon,
                                         lockdep_is_held(&sdata->wdev.mtx));
-        rcu_assign_pointer(ifmsh->beacon, NULL);
+        RCU_INIT_POINTER(ifmsh->beacon, NULL);
         kfree_rcu(bcn, rcu_head);
 
         /* flush STAs and mpaths on this iface */
@@ -903,14 +898,15 @@ ieee80211_mesh_process_chnswitch(struct ieee80211_sub_if_data *sdata,
         }
 
         err = cfg80211_chandef_dfs_required(sdata->local->hw.wiphy,
-                                            &params.chandef);
+                                            &params.chandef,
+                                            NL80211_IFTYPE_MESH_POINT);
         if (err < 0)
                 return false;
-        if (err) {
-                params.radar_required = true;
+        if (err > 0)
                 /* TODO: DFS not (yet) supported */
                 return false;
-        }
+
+        params.radar_required = err;
 
         if (cfg80211_chandef_identical(&params.chandef,
                                        &sdata->vif.bss_conf.chandef)) {
@@ -1068,7 +1064,7 @@ int ieee80211_mesh_finish_csa(struct ieee80211_sub_if_data *sdata)
 
         /* Remove the CSA and MCSP elements from the beacon */
         tmp_csa_settings = rcu_dereference(ifmsh->csa);
-        rcu_assign_pointer(ifmsh->csa, NULL);
+        RCU_INIT_POINTER(ifmsh->csa, NULL);
         if (tmp_csa_settings)
                 kfree_rcu(tmp_csa_settings, rcu_head);
         ret = ieee80211_mesh_rebuild_beacon(sdata);
@@ -1102,7 +1098,7 @@ int ieee80211_mesh_csa_beacon(struct ieee80211_sub_if_data *sdata,
         ret = ieee80211_mesh_rebuild_beacon(sdata);
         if (ret) {
                 tmp_csa_settings = rcu_dereference(ifmsh->csa);
-                rcu_assign_pointer(ifmsh->csa, NULL);
+                RCU_INIT_POINTER(ifmsh->csa, NULL);
                 kfree_rcu(tmp_csa_settings, rcu_head);
                 return ret;
         }
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index f9514685d45a..94758b9c9ed4 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -37,7 +37,7 @@ static inline u32 u32_field_get(const u8 *preq_elem, int offset, bool ae)
         return get_unaligned_le32(preq_elem + offset);
 }
 
-static inline u32 u16_field_get(const u8 *preq_elem, int offset, bool ae)
+static inline u16 u16_field_get(const u8 *preq_elem, int offset, bool ae)
 {
         if (ae)
                 offset += 6;
@@ -544,9 +544,10 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
                 if (time_after(jiffies, ifmsh->last_sn_update +
                                         net_traversal_jiffies(sdata)) ||
                     time_before(jiffies, ifmsh->last_sn_update)) {
-                        target_sn = ++ifmsh->sn;
+                        ++ifmsh->sn;
                         ifmsh->last_sn_update = jiffies;
                 }
+                target_sn = ifmsh->sn;
         } else if (is_broadcast_ether_addr(target_addr) &&
                    (target_flags & IEEE80211_PREQ_TO_FLAG)) {
                 rcu_read_lock();
diff --git a/net/mac80211/michael.h b/net/mac80211/michael.h
index 3b848dad9587..0e4886f881f1 100644
--- a/net/mac80211/michael.h
+++ b/net/mac80211/michael.h
@@ -11,6 +11,7 @@
 #define MICHAEL_H
 
 #include <linux/types.h>
+#include <linux/ieee80211.h>
 
 #define MICHAEL_MIC_LEN 8
 
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index dee50aefd6e8..488826f188a7 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1089,7 +1089,7 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
         }
         chanctx = container_of(rcu_access_pointer(sdata->vif.chanctx_conf),
                                struct ieee80211_chanctx, conf);
-        if (chanctx->refcount > 1) {
+        if (ieee80211_chanctx_refcount(local, chanctx) > 1) {
                 sdata_info(sdata,
                            "channel switch with multiple interfaces on the same channel, disconnecting\n");
                 ieee80211_queue_work(&local->hw,
@@ -3701,7 +3701,7 @@ int ieee80211_max_network_latency(struct notifier_block *nb,
         ieee80211_recalc_ps(local, latency_usec);
         mutex_unlock(&local->iflist_mtx);
 
-        return 0;
+        return NOTIFY_OK;
 }
 
 static u8 ieee80211_ht_vht_rx_chains(struct ieee80211_sub_if_data *sdata,
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 216c45b949e5..0e5b67015650 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -54,24 +54,25 @@ static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
         return skb;
 }
 
-static inline int should_drop_frame(struct sk_buff *skb, int present_fcs_len)
+static inline bool should_drop_frame(struct sk_buff *skb, int present_fcs_len)
 {
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
-        struct ieee80211_hdr *hdr;
-
-        hdr = (void *)(skb->data);
+        struct ieee80211_hdr *hdr = (void *)skb->data;
 
         if (status->flag & (RX_FLAG_FAILED_FCS_CRC |
                             RX_FLAG_FAILED_PLCP_CRC |
                             RX_FLAG_AMPDU_IS_ZEROLEN))
-                return 1;
+                return true;
+
         if (unlikely(skb->len < 16 + present_fcs_len))
-                return 1;
+                return true;
+
         if (ieee80211_is_ctl(hdr->frame_control) &&
             !ieee80211_is_pspoll(hdr->frame_control) &&
             !ieee80211_is_back_req(hdr->frame_control))
-                return 1;
-        return 0;
+                return true;
+
+        return false;
 }
 
 static int
@@ -3190,7 +3191,7 @@ static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
 }
 
 /*
- * This is the actual Rx frames handler. as it blongs to Rx path it must
+ * This is the actual Rx frames handler. as it belongs to Rx path it must
  * be called with rcu_read_lock protection.
  */
 static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 3ce7f2c8539a..28185c8dc19a 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -309,7 +309,7 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
         if (local->scan_req != local->int_scan_req)
                 cfg80211_scan_done(local->scan_req, aborted);
         local->scan_req = NULL;
-        rcu_assign_pointer(local->scan_sdata, NULL);
+        RCU_INIT_POINTER(local->scan_sdata, NULL);
 
         local->scanning = 0;
         local->scan_chandef.chan = NULL;
@@ -559,7 +559,7 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
                 ieee80211_recalc_idle(local);
 
                 local->scan_req = NULL;
-                rcu_assign_pointer(local->scan_sdata, NULL);
+                RCU_INIT_POINTER(local->scan_sdata, NULL);
         }
 
         return rc;
@@ -773,7 +773,7 @@ void ieee80211_scan_work(struct work_struct *work)
                 int rc;
 
                 local->scan_req = NULL;
-                rcu_assign_pointer(local->scan_sdata, NULL);
+                RCU_INIT_POINTER(local->scan_sdata, NULL);
 
                 rc = __ieee80211_start_scan(sdata, req);
                 if (rc) {
@@ -1014,7 +1014,7 @@ out_free:
 
         if (ret) {
                 /* Clean in case of failure after HW restart or upon resume. */
-                rcu_assign_pointer(local->sched_scan_sdata, NULL);
+                RCU_INIT_POINTER(local->sched_scan_sdata, NULL);
                 local->sched_scan_req = NULL;
         }
 
@@ -1089,7 +1089,7 @@ void ieee80211_sched_scan_stopped_work(struct work_struct *work)
                 return;
         }
 
-        rcu_assign_pointer(local->sched_scan_sdata, NULL);
+        RCU_INIT_POINTER(local->sched_scan_sdata, NULL);
 
         /* If sched scan was aborted by the driver. */
         local->sched_scan_req = NULL;
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 137a192e64bc..c34a5f97abc7 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -552,7 +552,7 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU)
 int sta_info_insert_rcu(struct sta_info *sta) __acquires(RCU)
 {
         struct ieee80211_local *local = sta->local;
-        int err = 0;
+        int err;
 
         might_sleep();
 
@@ -570,7 +570,6 @@ int sta_info_insert_rcu(struct sta_info *sta) __acquires(RCU)
 
         return 0;
  out_free:
-        BUG_ON(!err);
         sta_info_free(local, sta);
         return err;
 }
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 275c94f995f7..ad058759e85e 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -554,7 +554,7 @@ void ieee80211_flush_queues(struct ieee80211_local *local,
         ieee80211_stop_queues_by_reason(&local->hw, IEEE80211_MAX_QUEUE_MAP,
                                         IEEE80211_QUEUE_STOP_REASON_FLUSH);
 
-        drv_flush(local, queues, false);
+        drv_flush(local, sdata, queues, false);
 
         ieee80211_wake_queues_by_reason(&local->hw, IEEE80211_MAX_QUEUE_MAP,
                                         IEEE80211_QUEUE_STOP_REASON_FLUSH);
@@ -1546,7 +1546,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                 WARN_ON(local->resuming);
                 res = drv_add_interface(local, sdata);
                 if (WARN_ON(res)) {
-                        rcu_assign_pointer(local->monitor_sdata, NULL);
+                        RCU_INIT_POINTER(local->monitor_sdata, NULL);
                         synchronize_net();
                         kfree(sdata);
                 }
@@ -1565,17 +1565,17 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                 list_for_each_entry(ctx, &local->chanctx_list, list)
                         WARN_ON(drv_add_chanctx(local, ctx));
                 mutex_unlock(&local->chanctx_mtx);
-        }
 
-        list_for_each_entry(sdata, &local->interfaces, list) {
-                if (!ieee80211_sdata_running(sdata))
-                        continue;
-                ieee80211_assign_chanctx(local, sdata);
-        }
+                list_for_each_entry(sdata, &local->interfaces, list) {
+                        if (!ieee80211_sdata_running(sdata))
+                                continue;
+                        ieee80211_assign_chanctx(local, sdata);
+                }
 
-        sdata = rtnl_dereference(local->monitor_sdata);
-        if (sdata && ieee80211_sdata_running(sdata))
-                ieee80211_assign_chanctx(local, sdata);
+                sdata = rtnl_dereference(local->monitor_sdata);
+                if (sdata && ieee80211_sdata_running(sdata))
+                        ieee80211_assign_chanctx(local, sdata);
+        }
 
         /* add STAs back */
         mutex_lock(&local->sta_mtx);
@@ -1671,13 +1671,10 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                         }
                         break;
                 case NL80211_IFTYPE_WDS:
-                        break;
                 case NL80211_IFTYPE_AP_VLAN:
                 case NL80211_IFTYPE_MONITOR:
-                        /* ignore virtual */
-                        break;
                 case NL80211_IFTYPE_P2P_DEVICE:
-                        changed = BSS_CHANGED_IDLE;
+                        /* nothing to do */
                         break;
                 case NL80211_IFTYPE_UNSPECIFIED:
                 case NUM_NL80211_IFTYPES:
@@ -2797,3 +2794,121 @@ void ieee80211_recalc_dtim(struct ieee80211_local *local,
 
         ps->dtim_count = dtim_count;
 }
+
+int ieee80211_check_combinations(struct ieee80211_sub_if_data *sdata,
+                                 const struct cfg80211_chan_def *chandef,
+                                 enum ieee80211_chanctx_mode chanmode,
+                                 u8 radar_detect)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_sub_if_data *sdata_iter;
+        enum nl80211_iftype iftype = sdata->wdev.iftype;
+        int num[NUM_NL80211_IFTYPES];
+        struct ieee80211_chanctx *ctx;
+        int num_different_channels = 0;
+        int total = 1;
+
+        lockdep_assert_held(&local->chanctx_mtx);
+
+        if (WARN_ON(hweight32(radar_detect) > 1))
+                return -EINVAL;
+
+        if (WARN_ON(chandef && chanmode == IEEE80211_CHANCTX_SHARED &&
+                    !chandef->chan))
+                return -EINVAL;
+
+        if (chandef)
+                num_different_channels = 1;
+
+        if (WARN_ON(iftype >= NUM_NL80211_IFTYPES))
+                return -EINVAL;
+
+        /* Always allow software iftypes */
+        if (local->hw.wiphy->software_iftypes & BIT(iftype)) {
+                if (radar_detect)
+                        return -EINVAL;
+                return 0;
+        }
+
+        memset(num, 0, sizeof(num));
+
+        if (iftype != NL80211_IFTYPE_UNSPECIFIED)
+                num[iftype] = 1;
+
+        list_for_each_entry(ctx, &local->chanctx_list, list) {
+                if (ctx->conf.radar_enabled)
+                        radar_detect |= BIT(ctx->conf.def.width);
+                if (ctx->mode == IEEE80211_CHANCTX_EXCLUSIVE) {
+                        num_different_channels++;
+                        continue;
+                }
+                if (chandef && chanmode == IEEE80211_CHANCTX_SHARED &&
+                    cfg80211_chandef_compatible(chandef,
+                                                &ctx->conf.def))
+                        continue;
+                num_different_channels++;
+        }
+
+        list_for_each_entry_rcu(sdata_iter, &local->interfaces, list) {
+                struct wireless_dev *wdev_iter;
+
+                wdev_iter = &sdata_iter->wdev;
+
+                if (sdata_iter == sdata ||
+                    rcu_access_pointer(sdata_iter->vif.chanctx_conf) == NULL ||
+                    local->hw.wiphy->software_iftypes & BIT(wdev_iter->iftype))
+                        continue;
+
+                num[wdev_iter->iftype]++;
+                total++;
+        }
+
+        if (total == 1 && !radar_detect)
+                return 0;
+
+        return cfg80211_check_combinations(local->hw.wiphy,
+                                           num_different_channels,
+                                           radar_detect, num);
+}
+
+static void
+ieee80211_iter_max_chans(const struct ieee80211_iface_combination *c,
+                         void *data)
+{
+        u32 *max_num_different_channels = data;
+
+        *max_num_different_channels = max(*max_num_different_channels,
+                                          c->num_different_channels);
+}
+
+int ieee80211_max_num_channels(struct ieee80211_local *local)
+{
+        struct ieee80211_sub_if_data *sdata;
+        int num[NUM_NL80211_IFTYPES] = {};
+        struct ieee80211_chanctx *ctx;
+        int num_different_channels = 0;
+        u8 radar_detect = 0;
+        u32 max_num_different_channels = 1;
+        int err;
+
+        lockdep_assert_held(&local->chanctx_mtx);
+
+        list_for_each_entry(ctx, &local->chanctx_list, list) {
+                num_different_channels++;
+
+                if (ctx->conf.radar_enabled)
+                        radar_detect |= BIT(ctx->conf.def.width);
+        }
+
+        list_for_each_entry_rcu(sdata, &local->interfaces, list)
+                num[sdata->wdev.iftype]++;
+
+        err = cfg80211_iter_combinations(local->hw.wiphy,
+                                         num_different_channels, radar_detect,
+                                         num, ieee80211_iter_max_chans,
+                                         &max_num_different_channels);
+        if (err < 0)
+                return err;
+
+        return max_num_different_channels;
+}
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index b8600e3c29c8..9b3dcc201145 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -406,7 +406,10 @@ static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
 
         if (info->control.hw_key &&
             !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_GENERATE_IV) &&
-            !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)) {
+            !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) &&
+            !((info->control.hw_key->flags &
+               IEEE80211_KEY_FLAG_GENERATE_IV_MGMT) &&
+              ieee80211_is_mgmt(hdr->frame_control))) {
                 /*
                  * hwaccel has no need for preallocated room for CCMP
                  * header or MIC fields