Merge git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next

20 files changed, 913 insertions, 485 deletions

diff --git a/net/mac80211/Makefile b/net/mac80211/Makefile
index 9d7d840aac6d..1e46ffa69167 100644
--- a/net/mac80211/Makefile
+++ b/net/mac80211/Makefile
@@ -25,7 +25,8 @@ mac80211-y := \
         wme.o \
         event.o \
         chan.o \
-        trace.o mlme.o
+        trace.o mlme.o \
+        tdls.o
 
 mac80211-$(CONFIG_MAC80211_LEDS) += led.o
 mac80211-$(CONFIG_MAC80211_DEBUGFS) += \
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 7b8d3cf89574..d7513a503be1 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -472,8 +472,10 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
 {
         struct ieee80211_sub_if_data *sdata = sta->sdata;
         struct ieee80211_local *local = sdata->local;
+        struct rate_control_ref *ref = local->rate_ctrl;
         struct timespec uptime;
         u64 packets = 0;
+        u32 thr = 0;
         int i, ac;
 
         sinfo->generation = sdata->local->sta_generation;
@@ -587,6 +589,17 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
                 sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_ASSOCIATED);
         if (test_sta_flag(sta, WLAN_STA_TDLS_PEER))
                 sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_TDLS_PEER);
+
+        /* check if the driver has a SW RC implementation */
+        if (ref && ref->ops->get_expected_throughput)
+                thr = ref->ops->get_expected_throughput(sta->rate_ctrl_priv);
+        else
+                thr = drv_get_expected_throughput(local, &sta->sta);
+
+        if (thr != 0) {
+                sinfo->filled |= STATION_INFO_EXPECTED_THROUGHPUT;
+                sinfo->expected_throughput = thr;
+        }
 }
 
 static const char ieee80211_gstrings_sta_stats[][ETH_GSTRING_LEN] = {
@@ -777,7 +790,7 @@ static void ieee80211_get_et_strings(struct wiphy *wiphy,
 }
 
 static int ieee80211_dump_station(struct wiphy *wiphy, struct net_device *dev,
-                                 int idx, u8 *mac, struct station_info *sinfo)
+                                  int idx, u8 *mac, struct station_info *sinfo)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = sdata->local;
@@ -807,7 +820,7 @@ static int ieee80211_dump_survey(struct wiphy *wiphy, struct net_device *dev,
 }
 
 static int ieee80211_get_station(struct wiphy *wiphy, struct net_device *dev,
-                                 u8 *mac, struct station_info *sinfo)
+                                 const u8 *mac, struct station_info *sinfo)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = sdata->local;
@@ -1084,6 +1097,31 @@ static int ieee80211_change_beacon(struct wiphy *wiphy, struct net_device *dev,
         return 0;
 }
 
+bool ieee80211_csa_needs_block_tx(struct ieee80211_local *local)
+{
+        struct ieee80211_sub_if_data *sdata;
+
+        lockdep_assert_held(&local->mtx);
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+                if (!ieee80211_sdata_running(sdata))
+                        continue;
+
+                if (!sdata->vif.csa_active)
+                        continue;
+
+                if (!sdata->csa_block_tx)
+                        continue;
+
+                rcu_read_unlock();
+                return true;
+        }
+        rcu_read_unlock();
+
+        return false;
+}
+
 static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
@@ -1101,7 +1139,14 @@ static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
         old_probe_resp = sdata_dereference(sdata->u.ap.probe_resp, sdata);
 
         /* abort any running channel switch */
+        mutex_lock(&local->mtx);
         sdata->vif.csa_active = false;
+        if (!ieee80211_csa_needs_block_tx(local))
+                ieee80211_wake_queues_by_reason(&local->hw,
+                                        IEEE80211_MAX_QUEUE_MAP,
+                                        IEEE80211_QUEUE_STOP_REASON_CSA);
+        mutex_unlock(&local->mtx);
+
         kfree(sdata->u.ap.next_beacon);
         sdata->u.ap.next_beacon = NULL;
 
@@ -1425,7 +1470,8 @@ static int sta_apply_parameters(struct ieee80211_local *local,
 }
 
 static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
-                                 u8 *mac, struct station_parameters *params)
+                                 const u8 *mac,
+                                 struct station_parameters *params)
 {
         struct ieee80211_local *local = wiphy_priv(wiphy);
         struct sta_info *sta;
@@ -1459,6 +1505,8 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
         if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))) {
                 sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
                 sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
+        } else {
+                sta->sta.tdls = true;
         }
 
         err = sta_apply_parameters(local, sta, params);
@@ -1492,7 +1540,7 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
 }
 
 static int ieee80211_del_station(struct wiphy *wiphy, struct net_device *dev,
-                                 u8 *mac)
+                                 const u8 *mac)
 {
         struct ieee80211_sub_if_data *sdata;
 
@@ -1506,7 +1554,7 @@ static int ieee80211_del_station(struct wiphy *wiphy, struct net_device *dev,
 }
 
 static int ieee80211_change_station(struct wiphy *wiphy,
-                                    struct net_device *dev, u8 *mac,
+                                    struct net_device *dev, const u8 *mac,
                                     struct station_parameters *params)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
@@ -1631,7 +1679,7 @@ out_err:
 
 #ifdef CONFIG_MAC80211_MESH
 static int ieee80211_add_mpath(struct wiphy *wiphy, struct net_device *dev,
-                                 u8 *dst, u8 *next_hop)
+                               const u8 *dst, const u8 *next_hop)
 {
         struct ieee80211_sub_if_data *sdata;
         struct mesh_path *mpath;
@@ -1659,7 +1707,7 @@ static int ieee80211_add_mpath(struct wiphy *wiphy, struct net_device *dev,
 }
 
 static int ieee80211_del_mpath(struct wiphy *wiphy, struct net_device *dev,
-                               u8 *dst)
+                               const u8 *dst)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
@@ -1670,9 +1718,8 @@ static int ieee80211_del_mpath(struct wiphy *wiphy, struct net_device *dev,
         return 0;
 }
 
-static int ieee80211_change_mpath(struct wiphy *wiphy,
-                                    struct net_device *dev,
-                                    u8 *dst, u8 *next_hop)
+static int ieee80211_change_mpath(struct wiphy *wiphy, struct net_device *dev,
+                                  const u8 *dst, const u8 *next_hop)
 {
         struct ieee80211_sub_if_data *sdata;
         struct mesh_path *mpath;
@@ -1764,8 +1811,8 @@ static int ieee80211_get_mpath(struct wiphy *wiphy, struct net_device *dev,
 }
 
 static int ieee80211_dump_mpath(struct wiphy *wiphy, struct net_device *dev,
-                                 int idx, u8 *dst, u8 *next_hop,
-                                 struct mpath_info *pinfo)
+                                int idx, u8 *dst, u8 *next_hop,
+                                struct mpath_info *pinfo)
 {
         struct ieee80211_sub_if_data *sdata;
         struct mesh_path *mpath;
@@ -3019,26 +3066,11 @@ void ieee80211_csa_finish(struct ieee80211_vif *vif)
 }
 EXPORT_SYMBOL(ieee80211_csa_finish);
 
-static void ieee80211_csa_finalize(struct ieee80211_sub_if_data *sdata)
+static int ieee80211_set_after_csa_beacon(struct ieee80211_sub_if_data *sdata,
+                                          u32 *changed)
 {
-        struct ieee80211_local *local = sdata->local;
-        int err, changed = 0;
-
-        sdata_assert_lock(sdata);
-
-        mutex_lock(&local->mtx);
-        sdata->radar_required = sdata->csa_radar_required;
-        err = ieee80211_vif_change_channel(sdata, &changed);
-        mutex_unlock(&local->mtx);
-        if (WARN_ON(err < 0))
-                return;
-
-        if (!local->use_chanctx) {
-                local->_oper_chandef = sdata->csa_chandef;
-                ieee80211_hw_config(local, 0);
-        }
+        int err;
 
-        sdata->vif.csa_active = false;
         switch (sdata->vif.type) {
         case NL80211_IFTYPE_AP:
                 err = ieee80211_assign_beacon(sdata, sdata->u.ap.next_beacon);
@@ -3046,35 +3078,74 @@ static void ieee80211_csa_finalize(struct ieee80211_sub_if_data *sdata)
                 sdata->u.ap.next_beacon = NULL;
 
                 if (err < 0)
-                        return;
-                changed |= err;
+                        return err;
+                *changed |= err;
                 break;
         case NL80211_IFTYPE_ADHOC:
                 err = ieee80211_ibss_finish_csa(sdata);
                 if (err < 0)
-                        return;
-                changed |= err;
+                        return err;
+                *changed |= err;
                 break;
 #ifdef CONFIG_MAC80211_MESH
         case NL80211_IFTYPE_MESH_POINT:
                 err = ieee80211_mesh_finish_csa(sdata);
                 if (err < 0)
-                        return;
-                changed |= err;
+                        return err;
+                *changed |= err;
                 break;
 #endif
         default:
                 WARN_ON(1);
-                return;
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static int __ieee80211_csa_finalize(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+        u32 changed = 0;
+        int err;
+
+        sdata_assert_lock(sdata);
+        lockdep_assert_held(&local->mtx);
+
+        sdata->radar_required = sdata->csa_radar_required;
+        err = ieee80211_vif_change_channel(sdata, &changed);
+        if (err < 0)
+                return err;
+
+        if (!local->use_chanctx) {
+                local->_oper_chandef = sdata->csa_chandef;
+                ieee80211_hw_config(local, 0);
         }
 
+        sdata->vif.csa_active = false;
+
+        err = ieee80211_set_after_csa_beacon(sdata, &changed);
+        if (err)
+                return err;
+
         ieee80211_bss_info_change_notify(sdata, changed);
+        cfg80211_ch_switch_notify(sdata->dev, &sdata->csa_chandef);
 
-        ieee80211_wake_queues_by_reason(&sdata->local->hw,
+        if (!ieee80211_csa_needs_block_tx(local))
+                ieee80211_wake_queues_by_reason(&local->hw,
                                         IEEE80211_MAX_QUEUE_MAP,
                                         IEEE80211_QUEUE_STOP_REASON_CSA);
 
-        cfg80211_ch_switch_notify(sdata->dev, &sdata->csa_chandef);
+        return 0;
+}
+
+static void ieee80211_csa_finalize(struct ieee80211_sub_if_data *sdata)
+{
+        if (__ieee80211_csa_finalize(sdata)) {
+                sdata_info(sdata, "failed to finalize CSA, disconnecting\n");
+                cfg80211_stop_iface(sdata->local->hw.wiphy, &sdata->wdev,
+                                    GFP_KERNEL);
+        }
 }
 
 void ieee80211_csa_finalize_work(struct work_struct *work)
@@ -3082,8 +3153,11 @@ void ieee80211_csa_finalize_work(struct work_struct *work)
         struct ieee80211_sub_if_data *sdata =
                 container_of(work, struct ieee80211_sub_if_data,
                              csa_finalize_work);
+        struct ieee80211_local *local = sdata->local;
 
         sdata_lock(sdata);
+        mutex_lock(&local->mtx);
+
         /* AP might have been stopped while waiting for the lock. */
         if (!sdata->vif.csa_active)
                 goto unlock;
@@ -3094,6 +3168,7 @@ void ieee80211_csa_finalize_work(struct work_struct *work)
         ieee80211_csa_finalize(sdata);
 
 unlock:
+        mutex_unlock(&local->mtx);
         sdata_unlock(sdata);
 }
 
@@ -3129,9 +3204,25 @@ static int ieee80211_set_csa_beacon(struct ieee80211_sub_if_data *sdata,
                 if (params->count <= 1)
                         break;
 
-                sdata->csa_counter_offset_beacon =
-                        params->counter_offset_beacon;
-                sdata->csa_counter_offset_presp = params->counter_offset_presp;
+                if ((params->n_counter_offsets_beacon >
+                     IEEE80211_MAX_CSA_COUNTERS_NUM) ||
+                    (params->n_counter_offsets_presp >
+                     IEEE80211_MAX_CSA_COUNTERS_NUM))
+                        return -EINVAL;
+
+                /* make sure we don't have garbage in other counters */
+                memset(sdata->csa_counter_offset_beacon, 0,
+                       sizeof(sdata->csa_counter_offset_beacon));
+                memset(sdata->csa_counter_offset_presp, 0,
+                       sizeof(sdata->csa_counter_offset_presp));
+
+                memcpy(sdata->csa_counter_offset_beacon,
+                       params->counter_offsets_beacon,
+                       params->n_counter_offsets_beacon * sizeof(u16));
+                memcpy(sdata->csa_counter_offset_presp,
+                       params->counter_offsets_presp,
+                       params->n_counter_offsets_presp * sizeof(u16));
+
                 err = ieee80211_assign_beacon(sdata, &params->beacon_csa);
                 if (err < 0) {
                         kfree(sdata->u.ap.next_beacon);
@@ -3220,8 +3311,9 @@ static int ieee80211_set_csa_beacon(struct ieee80211_sub_if_data *sdata,
         return 0;
 }
 
-int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
-                             struct cfg80211_csa_settings *params)
+static int
+__ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
+                           struct cfg80211_csa_settings *params)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = sdata->local;
@@ -3230,6 +3322,7 @@ int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
         int err, num_chanctx, changed = 0;
 
         sdata_assert_lock(sdata);
+        lockdep_assert_held(&local->mtx);
 
         if (!list_empty(&local->roc_list) || local->scanning)
                 return -EBUSY;
@@ -3272,15 +3365,16 @@ int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
                 return err;
 
         sdata->csa_radar_required = params->radar_required;
-
-        if (params->block_tx)
-                ieee80211_stop_queues_by_reason(&local->hw,
-                                IEEE80211_MAX_QUEUE_MAP,
-                                IEEE80211_QUEUE_STOP_REASON_CSA);
-
         sdata->csa_chandef = params->chandef;
+        sdata->csa_block_tx = params->block_tx;
+        sdata->csa_current_counter = params->count;
         sdata->vif.csa_active = true;
 
+        if (sdata->csa_block_tx)
+                ieee80211_stop_queues_by_reason(&local->hw,
+                                        IEEE80211_MAX_QUEUE_MAP,
+                                        IEEE80211_QUEUE_STOP_REASON_CSA);
+
         if (changed) {
                 ieee80211_bss_info_change_notify(sdata, changed);
                 drv_channel_switch_beacon(sdata, &params->chandef);
@@ -3292,6 +3386,20 @@ int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
         return 0;
 }
 
+int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
+                             struct cfg80211_csa_settings *params)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = sdata->local;
+        int err;
+
+        mutex_lock(&local->mtx);
+        err = __ieee80211_channel_switch(wiphy, dev, params);
+        mutex_unlock(&local->mtx);
+
+        return err;
+}
+
 static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
                              struct cfg80211_mgmt_tx_params *params,
                              u64 *cookie)
@@ -3304,6 +3412,7 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
         bool need_offchan = false;
         u32 flags;
         int ret;
+        u8 *data;
 
         if (params->dont_wait_for_ack)
                 flags = IEEE80211_TX_CTL_NO_ACK;
@@ -3397,7 +3506,20 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
         }
         skb_reserve(skb, local->hw.extra_tx_headroom);
 
-        memcpy(skb_put(skb, params->len), params->buf, params->len);
+        data = skb_put(skb, params->len);
+        memcpy(data, params->buf, params->len);
+
+        /* Update CSA counters */
+        if (sdata->vif.csa_active &&
+            (sdata->vif.type == NL80211_IFTYPE_AP ||
+             sdata->vif.type == NL80211_IFTYPE_ADHOC) &&
+            params->n_csa_offsets) {
+                int i;
+                u8 c = sdata->csa_current_counter;
+
+                for (i = 0; i < params->n_csa_offsets; i++)
+                        data[params->csa_offsets[i]] = c;
+        }
 
         IEEE80211_SKB_CB(skb)->flags = flags;
 
@@ -3506,320 +3628,6 @@ static int ieee80211_set_rekey_data(struct wiphy *wiphy,
         return 0;
 }
 
-static void ieee80211_tdls_add_ext_capab(struct sk_buff *skb)
-{
-        u8 *pos = (void *)skb_put(skb, 7);
-
-        *pos++ = WLAN_EID_EXT_CAPABILITY;
-        *pos++ = 5; /* len */
-        *pos++ = 0x0;
-        *pos++ = 0x0;
-        *pos++ = 0x0;
-        *pos++ = 0x0;
-        *pos++ = WLAN_EXT_CAPA5_TDLS_ENABLED;
-}
-
-static u16 ieee80211_get_tdls_sta_capab(struct ieee80211_sub_if_data *sdata)
-{
-        struct ieee80211_local *local = sdata->local;
-        u16 capab;
-
-        capab = 0;
-        if (ieee80211_get_sdata_band(sdata) != IEEE80211_BAND_2GHZ)
-                return capab;
-
-        if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE))
-                capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
-        if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE))
-                capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
-
-        return capab;
-}
-
-static void ieee80211_tdls_add_link_ie(struct sk_buff *skb, u8 *src_addr,
-                                       u8 *peer, u8 *bssid)
-{
-        struct ieee80211_tdls_lnkie *lnkid;
-
-        lnkid = (void *)skb_put(skb, sizeof(struct ieee80211_tdls_lnkie));
-
-        lnkid->ie_type = WLAN_EID_LINK_ID;
-        lnkid->ie_len = sizeof(struct ieee80211_tdls_lnkie) - 2;
-
-        memcpy(lnkid->bssid, bssid, ETH_ALEN);
-        memcpy(lnkid->init_sta, src_addr, ETH_ALEN);
-        memcpy(lnkid->resp_sta, peer, ETH_ALEN);
-}
-
-static int
-ieee80211_prep_tdls_encap_data(struct wiphy *wiphy, struct net_device *dev,
-                               u8 *peer, u8 action_code, u8 dialog_token,
-                               u16 status_code, struct sk_buff *skb)
-{
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        enum ieee80211_band band = ieee80211_get_sdata_band(sdata);
-        struct ieee80211_tdls_data *tf;
-
-        tf = (void *)skb_put(skb, offsetof(struct ieee80211_tdls_data, u));
-
-        memcpy(tf->da, peer, ETH_ALEN);
-        memcpy(tf->sa, sdata->vif.addr, ETH_ALEN);
-        tf->ether_type = cpu_to_be16(ETH_P_TDLS);
-        tf->payload_type = WLAN_TDLS_SNAP_RFTYPE;
-
-        switch (action_code) {
-        case WLAN_TDLS_SETUP_REQUEST:
-                tf->category = WLAN_CATEGORY_TDLS;
-                tf->action_code = WLAN_TDLS_SETUP_REQUEST;
-
-                skb_put(skb, sizeof(tf->u.setup_req));
-                tf->u.setup_req.dialog_token = dialog_token;
-                tf->u.setup_req.capability =
-                        cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata));
-
-                ieee80211_add_srates_ie(sdata, skb, false, band);
-                ieee80211_add_ext_srates_ie(sdata, skb, false, band);
-                ieee80211_tdls_add_ext_capab(skb);
-                break;
-        case WLAN_TDLS_SETUP_RESPONSE:
-                tf->category = WLAN_CATEGORY_TDLS;
-                tf->action_code = WLAN_TDLS_SETUP_RESPONSE;
-
-                skb_put(skb, sizeof(tf->u.setup_resp));
-                tf->u.setup_resp.status_code = cpu_to_le16(status_code);
-                tf->u.setup_resp.dialog_token = dialog_token;
-                tf->u.setup_resp.capability =
-                        cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata));
-
-                ieee80211_add_srates_ie(sdata, skb, false, band);
-                ieee80211_add_ext_srates_ie(sdata, skb, false, band);
-                ieee80211_tdls_add_ext_capab(skb);
-                break;
-        case WLAN_TDLS_SETUP_CONFIRM:
-                tf->category = WLAN_CATEGORY_TDLS;
-                tf->action_code = WLAN_TDLS_SETUP_CONFIRM;
-
-                skb_put(skb, sizeof(tf->u.setup_cfm));
-                tf->u.setup_cfm.status_code = cpu_to_le16(status_code);
-                tf->u.setup_cfm.dialog_token = dialog_token;
-                break;
-        case WLAN_TDLS_TEARDOWN:
-                tf->category = WLAN_CATEGORY_TDLS;
-                tf->action_code = WLAN_TDLS_TEARDOWN;
-
-                skb_put(skb, sizeof(tf->u.teardown));
-                tf->u.teardown.reason_code = cpu_to_le16(status_code);
-                break;
-        case WLAN_TDLS_DISCOVERY_REQUEST:
-                tf->category = WLAN_CATEGORY_TDLS;
-                tf->action_code = WLAN_TDLS_DISCOVERY_REQUEST;
-
-                skb_put(skb, sizeof(tf->u.discover_req));
-                tf->u.discover_req.dialog_token = dialog_token;
-                break;
-        default:
-                return -EINVAL;
-        }
-
-        return 0;
-}
-
-static int
-ieee80211_prep_tdls_direct(struct wiphy *wiphy, struct net_device *dev,
-                           u8 *peer, u8 action_code, u8 dialog_token,
-                           u16 status_code, struct sk_buff *skb)
-{
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        enum ieee80211_band band = ieee80211_get_sdata_band(sdata);
-        struct ieee80211_mgmt *mgmt;
-
-        mgmt = (void *)skb_put(skb, 24);
-        memset(mgmt, 0, 24);
-        memcpy(mgmt->da, peer, ETH_ALEN);
-        memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
-        memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
-
-        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
-                                          IEEE80211_STYPE_ACTION);
-
-        switch (action_code) {
-        case WLAN_PUB_ACTION_TDLS_DISCOVER_RES:
-                skb_put(skb, 1 + sizeof(mgmt->u.action.u.tdls_discover_resp));
-                mgmt->u.action.category = WLAN_CATEGORY_PUBLIC;
-                mgmt->u.action.u.tdls_discover_resp.action_code =
-                        WLAN_PUB_ACTION_TDLS_DISCOVER_RES;
-                mgmt->u.action.u.tdls_discover_resp.dialog_token =
-                        dialog_token;
-                mgmt->u.action.u.tdls_discover_resp.capability =
-                        cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata));
-
-                ieee80211_add_srates_ie(sdata, skb, false, band);
-                ieee80211_add_ext_srates_ie(sdata, skb, false, band);
-                ieee80211_tdls_add_ext_capab(skb);
-                break;
-        default:
-                return -EINVAL;
-        }
-
-        return 0;
-}
-
-static int ieee80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
-                               u8 *peer, u8 action_code, u8 dialog_token,
-                               u16 status_code, u32 peer_capability,
-                               const u8 *extra_ies, size_t extra_ies_len)
-{
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct ieee80211_local *local = sdata->local;
-        struct sk_buff *skb = NULL;
-        bool send_direct;
-        int ret;
-
-        if (!(wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS))
-                return -ENOTSUPP;
-
-        /* make sure we are in managed mode, and associated */
-        if (sdata->vif.type != NL80211_IFTYPE_STATION ||
-            !sdata->u.mgd.associated)
-                return -EINVAL;
-
-        tdls_dbg(sdata, "TDLS mgmt action %d peer %pM\n",
-                 action_code, peer);
-
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom +
-                            max(sizeof(struct ieee80211_mgmt),
-                                sizeof(struct ieee80211_tdls_data)) +
-                            50 + /* supported rates */
-                            7 + /* ext capab */
-                            extra_ies_len +
-                            sizeof(struct ieee80211_tdls_lnkie));
-        if (!skb)
-                return -ENOMEM;
-
-        skb_reserve(skb, local->hw.extra_tx_headroom);
-
-        switch (action_code) {
-        case WLAN_TDLS_SETUP_REQUEST:
-        case WLAN_TDLS_SETUP_RESPONSE:
-        case WLAN_TDLS_SETUP_CONFIRM:
-        case WLAN_TDLS_TEARDOWN:
-        case WLAN_TDLS_DISCOVERY_REQUEST:
-                ret = ieee80211_prep_tdls_encap_data(wiphy, dev, peer,
-                                                     action_code, dialog_token,
-                                                     status_code, skb);
-                send_direct = false;
-                break;
-        case WLAN_PUB_ACTION_TDLS_DISCOVER_RES:
-                ret = ieee80211_prep_tdls_direct(wiphy, dev, peer, action_code,
-                                                 dialog_token, status_code,
-                                                 skb);
-                send_direct = true;
-                break;
-        default:
-                ret = -ENOTSUPP;
-                break;
-        }
-
-        if (ret < 0)
-                goto fail;
-
-        if (extra_ies_len)
-                memcpy(skb_put(skb, extra_ies_len), extra_ies, extra_ies_len);
-
-        /* the TDLS link IE is always added last */
-        switch (action_code) {
-        case WLAN_TDLS_SETUP_REQUEST:
-        case WLAN_TDLS_SETUP_CONFIRM:
-        case WLAN_TDLS_TEARDOWN:
-        case WLAN_TDLS_DISCOVERY_REQUEST:
-                /* we are the initiator */
-                ieee80211_tdls_add_link_ie(skb, sdata->vif.addr, peer,
-                                           sdata->u.mgd.bssid);
-                break;
-        case WLAN_TDLS_SETUP_RESPONSE:
-        case WLAN_PUB_ACTION_TDLS_DISCOVER_RES:
-                /* we are the responder */
-                ieee80211_tdls_add_link_ie(skb, peer, sdata->vif.addr,
-                                           sdata->u.mgd.bssid);
-                break;
-        default:
-                ret = -ENOTSUPP;
-                goto fail;
-        }
-
-        if (send_direct) {
-                ieee80211_tx_skb(sdata, skb);
-                return 0;
-        }
-
-        /*
-         * According to 802.11z: Setup req/resp are sent in AC_BK, otherwise
-         * we should default to AC_VI.
-         */
-        switch (action_code) {
-        case WLAN_TDLS_SETUP_REQUEST:
-        case WLAN_TDLS_SETUP_RESPONSE:
-                skb_set_queue_mapping(skb, IEEE80211_AC_BK);
-                skb->priority = 2;
-                break;
-        default:
-                skb_set_queue_mapping(skb, IEEE80211_AC_VI);
-                skb->priority = 5;
-                break;
-        }
-
-        /* disable bottom halves when entering the Tx path */
-        local_bh_disable();
-        ret = ieee80211_subif_start_xmit(skb, dev);
-        local_bh_enable();
-
-        return ret;
-
-fail:
-        dev_kfree_skb(skb);
-        return ret;
-}
-
-static int ieee80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev,
-                               u8 *peer, enum nl80211_tdls_operation oper)
-{
-        struct sta_info *sta;
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
-        if (!(wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS))
-                return -ENOTSUPP;
-
-        if (sdata->vif.type != NL80211_IFTYPE_STATION)
-                return -EINVAL;
-
-        tdls_dbg(sdata, "TDLS oper %d peer %pM\n", oper, peer);
-
-        switch (oper) {
-        case NL80211_TDLS_ENABLE_LINK:
-                rcu_read_lock();
-                sta = sta_info_get(sdata, peer);
-                if (!sta) {
-                        rcu_read_unlock();
-                        return -ENOLINK;
-                }
-
-                set_sta_flag(sta, WLAN_STA_TDLS_PEER_AUTH);
-                rcu_read_unlock();
-                break;
-        case NL80211_TDLS_DISABLE_LINK:
-                return sta_info_destroy_addr(sdata, peer);
-        case NL80211_TDLS_TEARDOWN:
-        case NL80211_TDLS_SETUP:
-        case NL80211_TDLS_DISCOVERY_REQ:
-                /* We don't support in-driver setup/teardown/discovery */
-                return -ENOTSUPP;
-        default:
-                return -ENOTSUPP;
-        }
-
-        return 0;
-}
-
 static int ieee80211_probe_client(struct wiphy *wiphy, struct net_device *dev,
                                   const u8 *peer, u64 *cookie)
 {
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index 48e6d6f010cd..a310e33972de 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -855,7 +855,7 @@ static void
 __ieee80211_vif_copy_chanctx_to_vlans(struct ieee80211_sub_if_data *sdata,
                                       bool clear)
 {
-        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_local *local __maybe_unused = sdata->local;
         struct ieee80211_sub_if_data *vlan;
         struct ieee80211_chanctx_conf *conf;
 
@@ -871,7 +871,7 @@ __ieee80211_vif_copy_chanctx_to_vlans(struct ieee80211_sub_if_data *sdata,
          * to a channel context that has already been freed.
          */
         conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
-                                lockdep_is_held(&local->chanctx_mtx));
+                                         lockdep_is_held(&local->chanctx_mtx));
         WARN_ON(!conf);
 
         if (clear)
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 5331582a2c81..696ef78b1fb7 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -5,11 +5,11 @@
 #include "ieee80211_i.h"
 #include "trace.h"
 
-static inline void check_sdata_in_driver(struct ieee80211_sub_if_data *sdata)
+static inline bool check_sdata_in_driver(struct ieee80211_sub_if_data *sdata)
 {
-        WARN(!(sdata->flags & IEEE80211_SDATA_IN_DRIVER),
-             "%s:  Failed check-sdata-in-driver check, flags: 0x%x\n",
-             sdata->dev ? sdata->dev->name : sdata->name, sdata->flags);
+        return !WARN(!(sdata->flags & IEEE80211_SDATA_IN_DRIVER),
+                     "%s:  Failed check-sdata-in-driver check, flags: 0x%x\n",
+                     sdata->dev ? sdata->dev->name : sdata->name, sdata->flags);
 }
 
 static inline struct ieee80211_sub_if_data *
@@ -168,7 +168,8 @@ static inline int drv_change_interface(struct ieee80211_local *local,
 
         might_sleep();
 
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return -EIO;
 
         trace_drv_change_interface(local, sdata, type, p2p);
         ret = local->ops->change_interface(&local->hw, &sdata->vif, type, p2p);
@@ -181,7 +182,8 @@ static inline void drv_remove_interface(struct ieee80211_local *local,
 {
         might_sleep();
 
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return;
 
         trace_drv_remove_interface(local, sdata);
         local->ops->remove_interface(&local->hw, &sdata->vif);
@@ -219,7 +221,8 @@ static inline void drv_bss_info_changed(struct ieee80211_local *local,
                          sdata->vif.type == NL80211_IFTYPE_MONITOR))
                 return;
 
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return;
 
         trace_drv_bss_info_changed(local, sdata, info, changed);
         if (local->ops->bss_info_changed)
@@ -278,7 +281,8 @@ static inline int drv_set_key(struct ieee80211_local *local,
         might_sleep();
 
         sdata = get_bss_sdata(sdata);
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return -EIO;
 
         trace_drv_set_key(local, cmd, sdata, sta, key);
         ret = local->ops->set_key(&local->hw, cmd, &sdata->vif, sta, key);
@@ -298,7 +302,8 @@ static inline void drv_update_tkip_key(struct ieee80211_local *local,
                 ista = &sta->sta;
 
         sdata = get_bss_sdata(sdata);
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return;
 
         trace_drv_update_tkip_key(local, sdata, conf, ista, iv32);
         if (local->ops->update_tkip_key)
@@ -315,7 +320,8 @@ static inline int drv_hw_scan(struct ieee80211_local *local,
 
         might_sleep();
 
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return -EIO;
 
         trace_drv_hw_scan(local, sdata);
         ret = local->ops->hw_scan(&local->hw, &sdata->vif, req);
@@ -328,7 +334,8 @@ static inline void drv_cancel_hw_scan(struct ieee80211_local *local,
 {
         might_sleep();
 
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return;
 
         trace_drv_cancel_hw_scan(local, sdata);
         local->ops->cancel_hw_scan(&local->hw, &sdata->vif);
@@ -345,7 +352,8 @@ drv_sched_scan_start(struct ieee80211_local *local,
 
         might_sleep();
 
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return -EIO;
 
         trace_drv_sched_scan_start(local, sdata);
         ret = local->ops->sched_scan_start(&local->hw, &sdata->vif,
@@ -361,7 +369,8 @@ static inline int drv_sched_scan_stop(struct ieee80211_local *local,
 
         might_sleep();
 
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return -EIO;
 
         trace_drv_sched_scan_stop(local, sdata);
         ret = local->ops->sched_scan_stop(&local->hw, &sdata->vif);
@@ -462,7 +471,8 @@ static inline void drv_sta_notify(struct ieee80211_local *local,
                                   struct ieee80211_sta *sta)
 {
         sdata = get_bss_sdata(sdata);
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return;
 
         trace_drv_sta_notify(local, sdata, cmd, sta);
         if (local->ops->sta_notify)
@@ -479,7 +489,8 @@ static inline int drv_sta_add(struct ieee80211_local *local,
         might_sleep();
 
         sdata = get_bss_sdata(sdata);
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return -EIO;
 
         trace_drv_sta_add(local, sdata, sta);
         if (local->ops->sta_add)
@@ -497,7 +508,8 @@ static inline void drv_sta_remove(struct ieee80211_local *local,
         might_sleep();
 
         sdata = get_bss_sdata(sdata);
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return;
 
         trace_drv_sta_remove(local, sdata, sta);
         if (local->ops->sta_remove)
@@ -515,7 +527,8 @@ static inline void drv_sta_add_debugfs(struct ieee80211_local *local,
         might_sleep();
 
         sdata = get_bss_sdata(sdata);
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return;
 
         if (local->ops->sta_add_debugfs)
                 local->ops->sta_add_debugfs(&local->hw, &sdata->vif,
@@ -545,7 +558,8 @@ static inline void drv_sta_pre_rcu_remove(struct ieee80211_local *local,
         might_sleep();
 
         sdata = get_bss_sdata(sdata);
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return;
 
         trace_drv_sta_pre_rcu_remove(local, sdata, &sta->sta);
         if (local->ops->sta_pre_rcu_remove)
@@ -566,7 +580,8 @@ int drv_sta_state(struct ieee80211_local *local,
         might_sleep();
 
         sdata = get_bss_sdata(sdata);
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return -EIO;
 
         trace_drv_sta_state(local, sdata, &sta->sta, old_state, new_state);
         if (local->ops->sta_state) {
@@ -590,7 +605,8 @@ static inline void drv_sta_rc_update(struct ieee80211_local *local,
                                      struct ieee80211_sta *sta, u32 changed)
 {
         sdata = get_bss_sdata(sdata);
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return;
 
         WARN_ON(changed & IEEE80211_RC_SUPP_RATES_CHANGED &&
                 (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
@@ -612,7 +628,8 @@ static inline int drv_conf_tx(struct ieee80211_local *local,
 
         might_sleep();
 
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return -EIO;
 
         trace_drv_conf_tx(local, sdata, ac, params);
         if (local->ops->conf_tx)
@@ -629,7 +646,8 @@ static inline u64 drv_get_tsf(struct ieee80211_local *local,
 
         might_sleep();
 
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return ret;
 
         trace_drv_get_tsf(local, sdata);
         if (local->ops->get_tsf)
@@ -644,7 +662,8 @@ static inline void drv_set_tsf(struct ieee80211_local *local,
 {
         might_sleep();
 
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return;
 
         trace_drv_set_tsf(local, sdata, tsf);
         if (local->ops->set_tsf)
@@ -657,7 +676,8 @@ static inline void drv_reset_tsf(struct ieee80211_local *local,
 {
         might_sleep();
 
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return;
 
         trace_drv_reset_tsf(local, sdata);
         if (local->ops->reset_tsf)
@@ -689,7 +709,8 @@ static inline int drv_ampdu_action(struct ieee80211_local *local,
         might_sleep();
 
         sdata = get_bss_sdata(sdata);
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return -EIO;
 
         trace_drv_ampdu_action(local, sdata, action, sta, tid, ssn, buf_size);
 
@@ -733,8 +754,8 @@ static inline void drv_flush(struct ieee80211_local *local,
 
         might_sleep();
 
-        if (sdata)
-                check_sdata_in_driver(sdata);
+        if (sdata && !check_sdata_in_driver(sdata))
+                return;
 
         trace_drv_flush(local, queues, drop);
         if (local->ops->flush)
@@ -854,7 +875,8 @@ static inline int drv_set_bitrate_mask(struct ieee80211_local *local,
 
         might_sleep();
 
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return -EIO;
 
         trace_drv_set_bitrate_mask(local, sdata, mask);
         if (local->ops->set_bitrate_mask)
@@ -869,7 +891,8 @@ static inline void drv_set_rekey_data(struct ieee80211_local *local,
                                       struct ieee80211_sub_if_data *sdata,
                                       struct cfg80211_gtk_rekey_data *data)
 {
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return;
 
         trace_drv_set_rekey_data(local, sdata, data);
         if (local->ops->set_rekey_data)
@@ -937,7 +960,8 @@ static inline void drv_mgd_prepare_tx(struct ieee80211_local *local,
 {
         might_sleep();
 
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return;
         WARN_ON_ONCE(sdata->vif.type != NL80211_IFTYPE_STATION);
 
         trace_drv_mgd_prepare_tx(local, sdata);
@@ -964,6 +988,9 @@ static inline int drv_add_chanctx(struct ieee80211_local *local,
 static inline void drv_remove_chanctx(struct ieee80211_local *local,
                                       struct ieee80211_chanctx *ctx)
 {
+        if (WARN_ON(!ctx->driver_present))
+                return;
+
         trace_drv_remove_chanctx(local, ctx);
         if (local->ops->remove_chanctx)
                 local->ops->remove_chanctx(&local->hw, &ctx->conf);
@@ -989,7 +1016,8 @@ static inline int drv_assign_vif_chanctx(struct ieee80211_local *local,
 {
         int ret = 0;
 
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return -EIO;
 
         trace_drv_assign_vif_chanctx(local, sdata, ctx);
         if (local->ops->assign_vif_chanctx) {
@@ -1007,7 +1035,8 @@ static inline void drv_unassign_vif_chanctx(struct ieee80211_local *local,
                                             struct ieee80211_sub_if_data *sdata,
                                             struct ieee80211_chanctx *ctx)
 {
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return;
 
         trace_drv_unassign_vif_chanctx(local, sdata, ctx);
         if (local->ops->unassign_vif_chanctx) {
@@ -1024,7 +1053,8 @@ static inline int drv_start_ap(struct ieee80211_local *local,
 {
         int ret = 0;
 
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return -EIO;
 
         trace_drv_start_ap(local, sdata, &sdata->vif.bss_conf);
         if (local->ops->start_ap)
@@ -1036,7 +1066,8 @@ static inline int drv_start_ap(struct ieee80211_local *local,
 static inline void drv_stop_ap(struct ieee80211_local *local,
                                struct ieee80211_sub_if_data *sdata)
 {
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return;
 
         trace_drv_stop_ap(local, sdata);
         if (local->ops->stop_ap)
@@ -1059,7 +1090,8 @@ drv_set_default_unicast_key(struct ieee80211_local *local,
                             struct ieee80211_sub_if_data *sdata,
                             int key_idx)
 {
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return;
 
         WARN_ON_ONCE(key_idx < -1 || key_idx > 3);
 
@@ -1101,7 +1133,8 @@ static inline int drv_join_ibss(struct ieee80211_local *local,
         int ret = 0;
 
         might_sleep();
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return -EIO;
 
         trace_drv_join_ibss(local, sdata, &sdata->vif.bss_conf);
         if (local->ops->join_ibss)
@@ -1114,7 +1147,8 @@ static inline void drv_leave_ibss(struct ieee80211_local *local,
                                   struct ieee80211_sub_if_data *sdata)
 {
         might_sleep();
-        check_sdata_in_driver(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return;
 
         trace_drv_leave_ibss(local, sdata);
         if (local->ops->leave_ibss)
@@ -1122,4 +1156,17 @@ static inline void drv_leave_ibss(struct ieee80211_local *local,
         trace_drv_return_void(local);
 }
 
+static inline u32 drv_get_expected_throughput(struct ieee80211_local *local,
+                                              struct ieee80211_sta *sta)
+{
+        u32 ret = 0;
+
+        trace_drv_get_expected_throughput(sta);
+        if (local->ops->get_expected_throughput)
+                ret = local->ops->get_expected_throughput(sta);
+        trace_drv_return_u32(local, ret);
+
+        return ret;
+}
+
 #endif /* __MAC80211_DRIVER_OPS */
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index ff4d4155a84d..1bbac94da58d 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -143,7 +143,7 @@ ieee80211_ibss_build_presp(struct ieee80211_sub_if_data *sdata,
                 *pos++ = csa_settings->block_tx ? 1 : 0;
                 *pos++ = ieee80211_frequency_to_channel(
                                 csa_settings->chandef.chan->center_freq);
-                sdata->csa_counter_offset_beacon = (pos - presp->head);
+                sdata->csa_counter_offset_beacon[0] = (pos - presp->head);
                 *pos++ = csa_settings->count;
         }
 
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index b455f62d357a..ed2b817d5ece 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -753,9 +753,10 @@ struct ieee80211_sub_if_data {
         struct mac80211_qos_map __rcu *qos_map;
 
         struct work_struct csa_finalize_work;
-        int csa_counter_offset_beacon;
-        int csa_counter_offset_presp;
+        u16 csa_counter_offset_beacon[IEEE80211_MAX_CSA_COUNTERS_NUM];
+        u16 csa_counter_offset_presp[IEEE80211_MAX_CSA_COUNTERS_NUM];
         bool csa_radar_required;
+        bool csa_block_tx; /* write-protected by sdata_lock and local->mtx */
         struct cfg80211_chan_def csa_chandef;
 
         struct list_head assigned_chanctx_list; /* protected by chanctx_mtx */
@@ -765,6 +766,7 @@ struct ieee80211_sub_if_data {
         struct ieee80211_chanctx *reserved_chanctx;
         struct cfg80211_chan_def reserved_chandef;
         bool reserved_radar_required;
+        u8 csa_current_counter;
 
         /* used to reconfigure hardware SM PS */
         struct work_struct recalc_smps;
@@ -1458,6 +1460,7 @@ __ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
 int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
                                        struct cfg80211_sched_scan_request *req);
 int ieee80211_request_sched_scan_stop(struct ieee80211_sub_if_data *sdata);
+void ieee80211_sched_scan_end(struct ieee80211_local *local);
 void ieee80211_sched_scan_stopped_work(struct work_struct *work);
 
 /* off-channel helpers */
@@ -1472,6 +1475,7 @@ void ieee80211_sw_roc_work(struct work_struct *work);
 void ieee80211_handle_roc_started(struct ieee80211_roc_work *roc);
 
 /* channel switch handling */
+bool ieee80211_csa_needs_block_tx(struct ieee80211_local *local);
 void ieee80211_csa_finalize_work(struct work_struct *work);
 int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
                              struct cfg80211_csa_settings *params);
@@ -1833,6 +1837,15 @@ int ieee80211_check_combinations(struct ieee80211_sub_if_data *sdata,
                                  u8 radar_detect);
 int ieee80211_max_num_channels(struct ieee80211_local *local);
 
+/* TDLS */
+int ieee80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
+                        const u8 *peer, u8 action_code, u8 dialog_token,
+                        u16 status_code, u32 peer_capability,
+                        const u8 *extra_ies, size_t extra_ies_len);
+int ieee80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev,
+                        const u8 *peer, enum nl80211_tdls_operation oper);
+
+
 #ifdef CONFIG_MAC80211_NOINLINE
 #define debug_noinline noinline
 #else
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 7fff3dcaac43..79fc98815da8 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -838,8 +838,15 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
 
         cancel_work_sync(&sdata->recalc_smps);
         sdata_lock(sdata);
+        mutex_lock(&local->mtx);
         sdata->vif.csa_active = false;
+        if (!ieee80211_csa_needs_block_tx(local))
+                ieee80211_wake_queues_by_reason(&local->hw,
+                                        IEEE80211_MAX_QUEUE_MAP,
+                                        IEEE80211_QUEUE_STOP_REASON_CSA);
+        mutex_unlock(&local->mtx);
         sdata_unlock(sdata);
+
         cancel_work_sync(&sdata->csa_finalize_work);
 
         cancel_delayed_work_sync(&sdata->dfs_cac_timer_work);
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 6ff65a1ebaa9..16d97f044a20 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -325,7 +325,8 @@ ieee80211_key_alloc(u32 cipher, int idx, size_t key_len,
         struct ieee80211_key *key;
         int i, j, err;
 
-        BUG_ON(idx < 0 || idx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS);
+        if (WARN_ON(idx < 0 || idx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS))
+                return ERR_PTR(-EINVAL);
 
         key = kzalloc(sizeof(struct ieee80211_key) + key_len, GFP_KERNEL);
         if (!key)
@@ -481,8 +482,8 @@ int ieee80211_key_link(struct ieee80211_key *key,
         int idx, ret;
         bool pairwise;
 
-        BUG_ON(!sdata);
-        BUG_ON(!key);
+        if (WARN_ON(!sdata || !key))
+                return -EINVAL;
 
         pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE;
         idx = key->conf.keyidx;
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 27b9364cdf17..d17c26d6e369 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -956,6 +956,8 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         if (local->hw.wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS)
                 local->hw.wiphy->flags |= WIPHY_FLAG_TDLS_EXTERNAL_SETUP;
 
+        local->hw.wiphy->max_num_csa_counters = IEEE80211_MAX_CSA_COUNTERS_NUM;
+
         result = wiphy_register(local->hw.wiphy);
         if (result < 0)
                 goto fail_wiphy_register;
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index b06ddc9519ce..6495a3f0428d 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -679,7 +679,7 @@ ieee80211_mesh_build_beacon(struct ieee80211_if_mesh *ifmsh)
                 *pos++ = 0x0;
                 *pos++ = ieee80211_frequency_to_channel(
                                 csa->settings.chandef.chan->center_freq);
-                sdata->csa_counter_offset_beacon = hdr_len + 6;
+                sdata->csa_counter_offset_beacon[0] = hdr_len + 6;
                 *pos++ = csa->settings.count;
                 *pos++ = WLAN_EID_CHAN_SWITCH_PARAM;
                 *pos++ = 6;
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 7d050ed6fe5a..cf032a8db9d7 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -287,8 +287,10 @@ static void mesh_path_move_to_queue(struct mesh_path *gate_mpath,
         struct sk_buff_head failq;
         unsigned long flags;
 
-        BUG_ON(gate_mpath == from_mpath);
-        BUG_ON(!gate_mpath->next_hop);
+        if (WARN_ON(gate_mpath == from_mpath))
+                return;
+        if (WARN_ON(!gate_mpath->next_hop))
+                return;
 
         __skb_queue_head_init(&failq);
 
diff --git a/net/mac80211/mesh_sync.c b/net/mac80211/mesh_sync.c
index 2bc5dc25d5ad..09625d6205c3 100644
--- a/net/mac80211/mesh_sync.c
+++ b/net/mac80211/mesh_sync.c
@@ -171,7 +171,7 @@ static void mesh_sync_offset_adjust_tbtt(struct ieee80211_sub_if_data *sdata,
         u8 cap;
 
         WARN_ON(ifmsh->mesh_sp_id != IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET);
-        BUG_ON(!rcu_read_lock_held());
+        WARN_ON(!rcu_read_lock_held());
         cap = beacon->meshconf->meshconf_cap;
 
         spin_lock_bh(&ifmsh->sync_offset_lock);
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 488826f188a7..7f073ef1e0a6 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -975,16 +975,23 @@ static void ieee80211_chswitch_work(struct work_struct *work)
         /* XXX: shouldn't really modify cfg80211-owned data! */
         ifmgd->associated->channel = sdata->csa_chandef.chan;
 
+        ieee80211_bss_info_change_notify(sdata, changed);
+
+        mutex_lock(&local->mtx);
+        sdata->vif.csa_active = false;
         /* XXX: wait for a beacon first? */
-        ieee80211_wake_queues_by_reason(&local->hw,
+        if (!ieee80211_csa_needs_block_tx(local))
+                ieee80211_wake_queues_by_reason(&local->hw,
                                         IEEE80211_MAX_QUEUE_MAP,
                                         IEEE80211_QUEUE_STOP_REASON_CSA);
+        mutex_unlock(&local->mtx);
 
-        ieee80211_bss_info_change_notify(sdata, changed);
-
- out:
-        sdata->vif.csa_active = false;
         ifmgd->flags &= ~IEEE80211_STA_CSA_RECEIVED;
+
+        ieee80211_sta_reset_beacon_monitor(sdata);
+        ieee80211_sta_reset_conn_monitor(sdata);
+
+out:
         sdata_unlock(sdata);
 }
 
@@ -1100,12 +1107,16 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
         mutex_unlock(&local->chanctx_mtx);
 
         sdata->csa_chandef = csa_ie.chandef;
+
+        mutex_lock(&local->mtx);
         sdata->vif.csa_active = true;
+        sdata->csa_block_tx = csa_ie.mode;
 
-        if (csa_ie.mode)
+        if (sdata->csa_block_tx)
                 ieee80211_stop_queues_by_reason(&local->hw,
-                                IEEE80211_MAX_QUEUE_MAP,
-                                IEEE80211_QUEUE_STOP_REASON_CSA);
+                                        IEEE80211_MAX_QUEUE_MAP,
+                                        IEEE80211_QUEUE_STOP_REASON_CSA);
+        mutex_unlock(&local->mtx);
 
         if (local->ops->channel_switch) {
                 /* use driver's channel switch callback */
@@ -1817,6 +1828,12 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         ifmgd->flags = 0;
         mutex_lock(&local->mtx);
         ieee80211_vif_release_channel(sdata);
+
+        sdata->vif.csa_active = false;
+        if (!ieee80211_csa_needs_block_tx(local))
+                ieee80211_wake_queues_by_reason(&local->hw,
+                                        IEEE80211_MAX_QUEUE_MAP,
+                                        IEEE80211_QUEUE_STOP_REASON_CSA);
         mutex_unlock(&local->mtx);
 
         sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
@@ -2045,6 +2062,7 @@ EXPORT_SYMBOL(ieee80211_ap_probereq_get);
 
 static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
 {
+        struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
 
@@ -2058,10 +2076,14 @@ static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
                                WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
                                true, frame_buf);
         ifmgd->flags &= ~IEEE80211_STA_CSA_RECEIVED;
+
+        mutex_lock(&local->mtx);
         sdata->vif.csa_active = false;
-        ieee80211_wake_queues_by_reason(&sdata->local->hw,
+        if (!ieee80211_csa_needs_block_tx(local))
+                ieee80211_wake_queues_by_reason(&local->hw,
                                         IEEE80211_MAX_QUEUE_MAP,
                                         IEEE80211_QUEUE_STOP_REASON_CSA);
+        mutex_unlock(&local->mtx);
 
         cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
                               IEEE80211_DEAUTH_FRAME_LEN);
@@ -3546,6 +3568,9 @@ static void ieee80211_sta_bcn_mon_timer(unsigned long data)
         if (local->quiescing)
                 return;
 
+        if (sdata->vif.csa_active)
+                return;
+
         sdata->u.mgd.connection_loss = false;
         ieee80211_queue_work(&sdata->local->hw,
                              &sdata->u.mgd.beacon_connection_loss_work);
@@ -3561,6 +3586,9 @@ static void ieee80211_sta_conn_mon_timer(unsigned long data)
         if (local->quiescing)
                 return;
 
+        if (sdata->vif.csa_active)
+                return;
+
         ieee80211_queue_work(&local->hw, &ifmgd->monitor_work);
 }
 
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index 26fd94fa0aed..1c1469c36dca 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -657,6 +657,17 @@ minstrel_free(void *priv)
         kfree(priv);
 }
 
+static u32 minstrel_get_expected_throughput(void *priv_sta)
+{
+        struct minstrel_sta_info *mi = priv_sta;
+        int idx = mi->max_tp_rate[0];
+
+        /* convert pkt per sec in kbps (1200 is the average pkt size used for
+         * computing cur_tp
+         */
+        return MINSTREL_TRUNC(mi->r[idx].cur_tp) * 1200 * 8 / 1024;
+}
+
 const struct rate_control_ops mac80211_minstrel = {
         .name = "minstrel",
         .tx_status = minstrel_tx_status,
@@ -670,6 +681,7 @@ const struct rate_control_ops mac80211_minstrel = {
         .add_sta_debugfs = minstrel_add_sta_debugfs,
         .remove_sta_debugfs = minstrel_remove_sta_debugfs,
 #endif
+        .get_expected_throughput = minstrel_get_expected_throughput,
 };
 
 int __init
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index bccaf854a309..85c1e74b7714 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -22,7 +22,7 @@
 #define MCS_NBITS (AVG_PKT_SIZE << 3)
 
 /* Number of symbols for a packet with (bps) bits per symbol */
-#define MCS_NSYMS(bps) ((MCS_NBITS + (bps) - 1) / (bps))
+#define MCS_NSYMS(bps) DIV_ROUND_UP(MCS_NBITS, (bps))
 
 /* Transmission time (nanoseconds) for a packet containing (syms) symbols */
 #define MCS_SYMBOL_TIME(sgi, syms)                                      \
@@ -226,8 +226,9 @@ minstrel_ht_calc_tp(struct minstrel_ht_sta *mi, int group, int rate)
                 nsecs = 1000 * mi->overhead / MINSTREL_TRUNC(mi->avg_ampdu_len);
 
         nsecs += minstrel_mcs_groups[group].duration[rate];
-        tp = 1000000 * ((prob * 1000) / nsecs);
 
+        /* prob is scaled - see MINSTREL_FRAC above */
+        tp = 1000000 * ((prob * 1000) / nsecs);
         mr->cur_tp = MINSTREL_TRUNC(tp);
 }
 
@@ -1031,6 +1032,22 @@ minstrel_ht_free(void *priv)
         mac80211_minstrel.free(priv);
 }
 
+static u32 minstrel_ht_get_expected_throughput(void *priv_sta)
+{
+        struct minstrel_ht_sta_priv *msp = priv_sta;
+        struct minstrel_ht_sta *mi = &msp->ht;
+        int i, j;
+
+        if (!msp->is_ht)
+                return mac80211_minstrel.get_expected_throughput(priv_sta);
+
+        i = mi->max_tp_rate / MCS_GROUP_RATES;
+        j = mi->max_tp_rate % MCS_GROUP_RATES;
+
+        /* convert cur_tp from pkt per second in kbps */
+        return mi->groups[i].rates[j].cur_tp * AVG_PKT_SIZE * 8 / 1024;
+}
+
 static const struct rate_control_ops mac80211_minstrel_ht = {
         .name = "minstrel_ht",
         .tx_status = minstrel_ht_tx_status,
@@ -1045,6 +1062,7 @@ static const struct rate_control_ops mac80211_minstrel_ht = {
         .add_sta_debugfs = minstrel_ht_add_sta_debugfs,
         .remove_sta_debugfs = minstrel_ht_remove_sta_debugfs,
 #endif
+        .get_expected_throughput = minstrel_ht_get_expected_throughput,
 };
 
 
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 28185c8dc19a..f40661eb75b5 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -1076,12 +1076,8 @@ void ieee80211_sched_scan_results(struct ieee80211_hw *hw)
 }
 EXPORT_SYMBOL(ieee80211_sched_scan_results);
 
-void ieee80211_sched_scan_stopped_work(struct work_struct *work)
+void ieee80211_sched_scan_end(struct ieee80211_local *local)
 {
-        struct ieee80211_local *local =
-                container_of(work, struct ieee80211_local,
-                             sched_scan_stopped_work);
-
         mutex_lock(&local->mtx);
 
         if (!rcu_access_pointer(local->sched_scan_sdata)) {
@@ -1099,6 +1095,15 @@ void ieee80211_sched_scan_stopped_work(struct work_struct *work)
         cfg80211_sched_scan_stopped(local->hw.wiphy);
 }
 
+void ieee80211_sched_scan_stopped_work(struct work_struct *work)
+{
+        struct ieee80211_local *local =
+                container_of(work, struct ieee80211_local,
+                             sched_scan_stopped_work);
+
+        ieee80211_sched_scan_end(local);
+}
+
 void ieee80211_sched_scan_stopped(struct ieee80211_hw *hw)
 {
         struct ieee80211_local *local = hw_to_local(hw);
diff --git a/net/mac80211/tdls.c b/net/mac80211/tdls.c
new file mode 100644
index 000000000000..652813b2d3df
--- /dev/null
+++ b/net/mac80211/tdls.c
@@ -0,0 +1,325 @@
+/*
+ * mac80211 TDLS handling code
+ *
+ * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2014, Intel Corporation
+ *
+ * This file is GPLv2 as found in COPYING.
+ */
+
+#include <linux/ieee80211.h>
+#include "ieee80211_i.h"
+
+static void ieee80211_tdls_add_ext_capab(struct sk_buff *skb)
+{
+        u8 *pos = (void *)skb_put(skb, 7);
+
+        *pos++ = WLAN_EID_EXT_CAPABILITY;
+        *pos++ = 5; /* len */
+        *pos++ = 0x0;
+        *pos++ = 0x0;
+        *pos++ = 0x0;
+        *pos++ = 0x0;
+        *pos++ = WLAN_EXT_CAPA5_TDLS_ENABLED;
+}
+
+static u16 ieee80211_get_tdls_sta_capab(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+        u16 capab;
+
+        capab = 0;
+        if (ieee80211_get_sdata_band(sdata) != IEEE80211_BAND_2GHZ)
+                return capab;
+
+        if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE))
+                capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
+        if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE))
+                capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
+
+        return capab;
+}
+
+static void ieee80211_tdls_add_link_ie(struct sk_buff *skb, const u8 *src_addr,
+                                       const u8 *peer, const u8 *bssid)
+{
+        struct ieee80211_tdls_lnkie *lnkid;
+
+        lnkid = (void *)skb_put(skb, sizeof(struct ieee80211_tdls_lnkie));
+
+        lnkid->ie_type = WLAN_EID_LINK_ID;
+        lnkid->ie_len = sizeof(struct ieee80211_tdls_lnkie) - 2;
+
+        memcpy(lnkid->bssid, bssid, ETH_ALEN);
+        memcpy(lnkid->init_sta, src_addr, ETH_ALEN);
+        memcpy(lnkid->resp_sta, peer, ETH_ALEN);
+}
+
+static int
+ieee80211_prep_tdls_encap_data(struct wiphy *wiphy, struct net_device *dev,
+                               const u8 *peer, u8 action_code, u8 dialog_token,
+                               u16 status_code, struct sk_buff *skb)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        enum ieee80211_band band = ieee80211_get_sdata_band(sdata);
+        struct ieee80211_tdls_data *tf;
+
+        tf = (void *)skb_put(skb, offsetof(struct ieee80211_tdls_data, u));
+
+        memcpy(tf->da, peer, ETH_ALEN);
+        memcpy(tf->sa, sdata->vif.addr, ETH_ALEN);
+        tf->ether_type = cpu_to_be16(ETH_P_TDLS);
+        tf->payload_type = WLAN_TDLS_SNAP_RFTYPE;
+
+        switch (action_code) {
+        case WLAN_TDLS_SETUP_REQUEST:
+                tf->category = WLAN_CATEGORY_TDLS;
+                tf->action_code = WLAN_TDLS_SETUP_REQUEST;
+
+                skb_put(skb, sizeof(tf->u.setup_req));
+                tf->u.setup_req.dialog_token = dialog_token;
+                tf->u.setup_req.capability =
+                        cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata));
+
+                ieee80211_add_srates_ie(sdata, skb, false, band);
+                ieee80211_add_ext_srates_ie(sdata, skb, false, band);
+                ieee80211_tdls_add_ext_capab(skb);
+                break;
+        case WLAN_TDLS_SETUP_RESPONSE:
+                tf->category = WLAN_CATEGORY_TDLS;
+                tf->action_code = WLAN_TDLS_SETUP_RESPONSE;
+
+                skb_put(skb, sizeof(tf->u.setup_resp));
+                tf->u.setup_resp.status_code = cpu_to_le16(status_code);
+                tf->u.setup_resp.dialog_token = dialog_token;
+                tf->u.setup_resp.capability =
+                        cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata));
+
+                ieee80211_add_srates_ie(sdata, skb, false, band);
+                ieee80211_add_ext_srates_ie(sdata, skb, false, band);
+                ieee80211_tdls_add_ext_capab(skb);
+                break;
+        case WLAN_TDLS_SETUP_CONFIRM:
+                tf->category = WLAN_CATEGORY_TDLS;
+                tf->action_code = WLAN_TDLS_SETUP_CONFIRM;
+
+                skb_put(skb, sizeof(tf->u.setup_cfm));
+                tf->u.setup_cfm.status_code = cpu_to_le16(status_code);
+                tf->u.setup_cfm.dialog_token = dialog_token;
+                break;
+        case WLAN_TDLS_TEARDOWN:
+                tf->category = WLAN_CATEGORY_TDLS;
+                tf->action_code = WLAN_TDLS_TEARDOWN;
+
+                skb_put(skb, sizeof(tf->u.teardown));
+                tf->u.teardown.reason_code = cpu_to_le16(status_code);
+                break;
+        case WLAN_TDLS_DISCOVERY_REQUEST:
+                tf->category = WLAN_CATEGORY_TDLS;
+                tf->action_code = WLAN_TDLS_DISCOVERY_REQUEST;
+
+                skb_put(skb, sizeof(tf->u.discover_req));
+                tf->u.discover_req.dialog_token = dialog_token;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static int
+ieee80211_prep_tdls_direct(struct wiphy *wiphy, struct net_device *dev,
+                           const u8 *peer, u8 action_code, u8 dialog_token,
+                           u16 status_code, struct sk_buff *skb)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        enum ieee80211_band band = ieee80211_get_sdata_band(sdata);
+        struct ieee80211_mgmt *mgmt;
+
+        mgmt = (void *)skb_put(skb, 24);
+        memset(mgmt, 0, 24);
+        memcpy(mgmt->da, peer, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
+        memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
+
+        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                          IEEE80211_STYPE_ACTION);
+
+        switch (action_code) {
+        case WLAN_PUB_ACTION_TDLS_DISCOVER_RES:
+                skb_put(skb, 1 + sizeof(mgmt->u.action.u.tdls_discover_resp));
+                mgmt->u.action.category = WLAN_CATEGORY_PUBLIC;
+                mgmt->u.action.u.tdls_discover_resp.action_code =
+                        WLAN_PUB_ACTION_TDLS_DISCOVER_RES;
+                mgmt->u.action.u.tdls_discover_resp.dialog_token =
+                        dialog_token;
+                mgmt->u.action.u.tdls_discover_resp.capability =
+                        cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata));
+
+                ieee80211_add_srates_ie(sdata, skb, false, band);
+                ieee80211_add_ext_srates_ie(sdata, skb, false, band);
+                ieee80211_tdls_add_ext_capab(skb);
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+int ieee80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
+                        const u8 *peer, u8 action_code, u8 dialog_token,
+                        u16 status_code, u32 peer_capability,
+                        const u8 *extra_ies, size_t extra_ies_len)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = sdata->local;
+        struct sk_buff *skb = NULL;
+        bool send_direct;
+        int ret;
+
+        if (!(wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS))
+                return -ENOTSUPP;
+
+        /* make sure we are in managed mode, and associated */
+        if (sdata->vif.type != NL80211_IFTYPE_STATION ||
+            !sdata->u.mgd.associated)
+                return -EINVAL;
+
+        tdls_dbg(sdata, "TDLS mgmt action %d peer %pM\n",
+                 action_code, peer);
+
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom +
+                            max(sizeof(struct ieee80211_mgmt),
+                                sizeof(struct ieee80211_tdls_data)) +
+                            50 + /* supported rates */
+                            7 + /* ext capab */
+                            extra_ies_len +
+                            sizeof(struct ieee80211_tdls_lnkie));
+        if (!skb)
+                return -ENOMEM;
+
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+
+        switch (action_code) {
+        case WLAN_TDLS_SETUP_REQUEST:
+        case WLAN_TDLS_SETUP_RESPONSE:
+        case WLAN_TDLS_SETUP_CONFIRM:
+        case WLAN_TDLS_TEARDOWN:
+        case WLAN_TDLS_DISCOVERY_REQUEST:
+                ret = ieee80211_prep_tdls_encap_data(wiphy, dev, peer,
+                                                     action_code, dialog_token,
+                                                     status_code, skb);
+                send_direct = false;
+                break;
+        case WLAN_PUB_ACTION_TDLS_DISCOVER_RES:
+                ret = ieee80211_prep_tdls_direct(wiphy, dev, peer, action_code,
+                                                 dialog_token, status_code,
+                                                 skb);
+                send_direct = true;
+                break;
+        default:
+                ret = -ENOTSUPP;
+                break;
+        }
+
+        if (ret < 0)
+                goto fail;
+
+        if (extra_ies_len)
+                memcpy(skb_put(skb, extra_ies_len), extra_ies, extra_ies_len);
+
+        /* the TDLS link IE is always added last */
+        switch (action_code) {
+        case WLAN_TDLS_SETUP_REQUEST:
+        case WLAN_TDLS_SETUP_CONFIRM:
+        case WLAN_TDLS_TEARDOWN:
+        case WLAN_TDLS_DISCOVERY_REQUEST:
+                /* we are the initiator */
+                ieee80211_tdls_add_link_ie(skb, sdata->vif.addr, peer,
+                                           sdata->u.mgd.bssid);
+                break;
+        case WLAN_TDLS_SETUP_RESPONSE:
+        case WLAN_PUB_ACTION_TDLS_DISCOVER_RES:
+                /* we are the responder */
+                ieee80211_tdls_add_link_ie(skb, peer, sdata->vif.addr,
+                                           sdata->u.mgd.bssid);
+                break;
+        default:
+                ret = -ENOTSUPP;
+                goto fail;
+        }
+
+        if (send_direct) {
+                ieee80211_tx_skb(sdata, skb);
+                return 0;
+        }
+
+        /*
+         * According to 802.11z: Setup req/resp are sent in AC_BK, otherwise
+         * we should default to AC_VI.
+         */
+        switch (action_code) {
+        case WLAN_TDLS_SETUP_REQUEST:
+        case WLAN_TDLS_SETUP_RESPONSE:
+                skb_set_queue_mapping(skb, IEEE80211_AC_BK);
+                skb->priority = 2;
+                break;
+        default:
+                skb_set_queue_mapping(skb, IEEE80211_AC_VI);
+                skb->priority = 5;
+                break;
+        }
+
+        /* disable bottom halves when entering the Tx path */
+        local_bh_disable();
+        ret = ieee80211_subif_start_xmit(skb, dev);
+        local_bh_enable();
+
+        return ret;
+
+fail:
+        dev_kfree_skb(skb);
+        return ret;
+}
+
+int ieee80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev,
+                        const u8 *peer, enum nl80211_tdls_operation oper)
+{
+        struct sta_info *sta;
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+        if (!(wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS))
+                return -ENOTSUPP;
+
+        if (sdata->vif.type != NL80211_IFTYPE_STATION)
+                return -EINVAL;
+
+        tdls_dbg(sdata, "TDLS oper %d peer %pM\n", oper, peer);
+
+        switch (oper) {
+        case NL80211_TDLS_ENABLE_LINK:
+                rcu_read_lock();
+                sta = sta_info_get(sdata, peer);
+                if (!sta) {
+                        rcu_read_unlock();
+                        return -ENOLINK;
+                }
+
+                set_sta_flag(sta, WLAN_STA_TDLS_PEER_AUTH);
+                rcu_read_unlock();
+                break;
+        case NL80211_TDLS_DISABLE_LINK:
+                return sta_info_destroy_addr(sdata, peer);
+        case NL80211_TDLS_TEARDOWN:
+        case NL80211_TDLS_SETUP:
+        case NL80211_TDLS_DISCOVERY_REQ:
+                /* We don't support in-driver setup/teardown/discovery */
+                return -ENOTSUPP;
+        default:
+                return -ENOTSUPP;
+        }
+
+        return 0;
+}
diff --git a/net/mac80211/trace.h b/net/mac80211/trace.h
index cec5b60487a4..762e4cd16386 100644
--- a/net/mac80211/trace.h
+++ b/net/mac80211/trace.h
@@ -184,6 +184,20 @@ TRACE_EVENT(drv_return_bool,
                   "true" : "false")
 );
 
+TRACE_EVENT(drv_return_u32,
+        TP_PROTO(struct ieee80211_local *local, u32 ret),
+        TP_ARGS(local, ret),
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(u32, ret)
+        ),
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->ret = ret;
+        ),
+        TP_printk(LOCAL_PR_FMT " - %u", LOCAL_PR_ARG, __entry->ret)
+);
+
 TRACE_EVENT(drv_return_u64,
         TP_PROTO(struct ieee80211_local *local, u64 ret),
         TP_ARGS(local, ret),
@@ -1499,6 +1513,24 @@ DEFINE_EVENT(local_sdata_evt, drv_leave_ibss,
         TP_ARGS(local, sdata)
 );
 
+TRACE_EVENT(drv_get_expected_throughput,
+        TP_PROTO(struct ieee80211_sta *sta),
+
+        TP_ARGS(sta),
+
+        TP_STRUCT__entry(
+                STA_ENTRY
+        ),
+
+        TP_fast_assign(
+                STA_ASSIGN;
+        ),
+
+        TP_printk(
+                STA_PR_FMT, STA_PR_ARG
+        )
+);
+
 /*
  * Tracing for API calls that drivers call.
  */
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 19d36d4117e0..5214686d9fd1 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -2328,7 +2328,8 @@ void ieee80211_tx_pending(unsigned long data)
 /* functions for drivers to get certain frames */
 
 static void __ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata,
-                                       struct ps_data *ps, struct sk_buff *skb)
+                                       struct ps_data *ps, struct sk_buff *skb,
+                                       bool is_template)
 {
         u8 *pos, *tim;
         int aid0 = 0;
@@ -2341,11 +2342,12 @@ static void __ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata,
                  * checking byte-for-byte */
                 have_bits = !bitmap_empty((unsigned long *)ps->tim,
                                           IEEE80211_MAX_AID+1);
-
-        if (ps->dtim_count == 0)
-                ps->dtim_count = sdata->vif.bss_conf.dtim_period - 1;
-        else
-                ps->dtim_count--;
+        if (!is_template) {
+                if (ps->dtim_count == 0)
+                        ps->dtim_count = sdata->vif.bss_conf.dtim_period - 1;
+                else
+                        ps->dtim_count--;
+        }
 
         tim = pos = (u8 *) skb_put(skb, 6);
         *pos++ = WLAN_EID_TIM;
@@ -2391,7 +2393,8 @@ static void __ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata,
 }
 
 static int ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata,
-                                    struct ps_data *ps, struct sk_buff *skb)
+                                    struct ps_data *ps, struct sk_buff *skb,
+                                    bool is_template)
 {
         struct ieee80211_local *local = sdata->local;
 
@@ -2403,24 +2406,24 @@ static int ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata,
          * of the tim bitmap in mac80211 and the driver.
          */
         if (local->tim_in_locked_section) {
-                __ieee80211_beacon_add_tim(sdata, ps, skb);
+                __ieee80211_beacon_add_tim(sdata, ps, skb, is_template);
         } else {
                 spin_lock_bh(&local->tim_lock);
-                __ieee80211_beacon_add_tim(sdata, ps, skb);
+                __ieee80211_beacon_add_tim(sdata, ps, skb, is_template);
                 spin_unlock_bh(&local->tim_lock);
         }
 
         return 0;
 }
 
-static void ieee80211_update_csa(struct ieee80211_sub_if_data *sdata,
-                                 struct beacon_data *beacon)
+static void ieee80211_set_csa(struct ieee80211_sub_if_data *sdata,
+                              struct beacon_data *beacon)
 {
         struct probe_resp *resp;
-        int counter_offset_beacon = sdata->csa_counter_offset_beacon;
-        int counter_offset_presp = sdata->csa_counter_offset_presp;
         u8 *beacon_data;
         size_t beacon_data_len;
+        int i;
+        u8 count = sdata->csa_current_counter;
 
         switch (sdata->vif.type) {
         case NL80211_IFTYPE_AP:
@@ -2438,40 +2441,57 @@ static void ieee80211_update_csa(struct ieee80211_sub_if_data *sdata,
         default:
                 return;
         }
-        if (WARN_ON(counter_offset_beacon >= beacon_data_len))
-                return;
 
-        /* Warn if the driver did not check for/react to csa
-         * completeness.  A beacon with CSA counter set to 0 should
-         * never occur, because a counter of 1 means switch just
-         * before the next beacon.
-         */
-        if (WARN_ON(beacon_data[counter_offset_beacon] == 1))
-                return;
+        for (i = 0; i < IEEE80211_MAX_CSA_COUNTERS_NUM; ++i) {
+                u16 counter_offset_beacon =
+                        sdata->csa_counter_offset_beacon[i];
+                u16 counter_offset_presp = sdata->csa_counter_offset_presp[i];
 
-        beacon_data[counter_offset_beacon]--;
+                if (counter_offset_beacon) {
+                        if (WARN_ON(counter_offset_beacon >= beacon_data_len))
+                                return;
 
-        if (sdata->vif.type == NL80211_IFTYPE_AP && counter_offset_presp) {
-                rcu_read_lock();
-                resp = rcu_dereference(sdata->u.ap.probe_resp);
+                        beacon_data[counter_offset_beacon] = count;
+                }
+
+                if (sdata->vif.type == NL80211_IFTYPE_AP &&
+                    counter_offset_presp) {
+                        rcu_read_lock();
+                        resp = rcu_dereference(sdata->u.ap.probe_resp);
 
-                /* if nl80211 accepted the offset, this should not happen. */
-                if (WARN_ON(!resp)) {
+                        /* If nl80211 accepted the offset, this should
+                         * not happen.
+                         */
+                        if (WARN_ON(!resp)) {
+                                rcu_read_unlock();
+                                return;
+                        }
+                        resp->data[counter_offset_presp] = count;
                         rcu_read_unlock();
-                        return;
                 }
-                resp->data[counter_offset_presp]--;
-                rcu_read_unlock();
         }
 }
 
+u8 ieee80211_csa_update_counter(struct ieee80211_vif *vif)
+{
+        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+
+        sdata->csa_current_counter--;
+
+        /* the counter should never reach 0 */
+        WARN_ON(!sdata->csa_current_counter);
+
+        return sdata->csa_current_counter;
+}
+EXPORT_SYMBOL(ieee80211_csa_update_counter);
+
 bool ieee80211_csa_is_complete(struct ieee80211_vif *vif)
 {
         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
         struct beacon_data *beacon = NULL;
         u8 *beacon_data;
         size_t beacon_data_len;
-        int counter_beacon = sdata->csa_counter_offset_beacon;
+        int counter_beacon = sdata->csa_counter_offset_beacon[0];
         int ret = false;
 
         if (!ieee80211_sdata_running(sdata))
@@ -2521,9 +2541,11 @@ bool ieee80211_csa_is_complete(struct ieee80211_vif *vif)
 }
 EXPORT_SYMBOL(ieee80211_csa_is_complete);
 
-struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
-                                         struct ieee80211_vif *vif,
-                                         u16 *tim_offset, u16 *tim_length)
+static struct sk_buff *
+__ieee80211_beacon_get(struct ieee80211_hw *hw,
+                       struct ieee80211_vif *vif,
+                       struct ieee80211_mutable_offsets *offs,
+                       bool is_template)
 {
         struct ieee80211_local *local = hw_to_local(hw);
         struct sk_buff *skb = NULL;
@@ -2532,6 +2554,7 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
         enum ieee80211_band band;
         struct ieee80211_tx_rate_control txrc;
         struct ieee80211_chanctx_conf *chanctx_conf;
+        int csa_off_base = 0;
 
         rcu_read_lock();
 
@@ -2541,18 +2564,20 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
         if (!ieee80211_sdata_running(sdata) || !chanctx_conf)
                 goto out;
 
-        if (tim_offset)
-                *tim_offset = 0;
-        if (tim_length)
-                *tim_length = 0;
+        if (offs)
+                memset(offs, 0, sizeof(*offs));
 
         if (sdata->vif.type == NL80211_IFTYPE_AP) {
                 struct ieee80211_if_ap *ap = &sdata->u.ap;
                 struct beacon_data *beacon = rcu_dereference(ap->beacon);
 
                 if (beacon) {
-                        if (sdata->vif.csa_active)
-                                ieee80211_update_csa(sdata, beacon);
+                        if (sdata->vif.csa_active) {
+                                if (!is_template)
+                                        ieee80211_csa_update_counter(vif);
+
+                                ieee80211_set_csa(sdata, beacon);
+                        }
 
                         /*
                          * headroom, head length,
@@ -2569,12 +2594,16 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                         memcpy(skb_put(skb, beacon->head_len), beacon->head,
                                beacon->head_len);
 
-                        ieee80211_beacon_add_tim(sdata, &ap->ps, skb);
+                        ieee80211_beacon_add_tim(sdata, &ap->ps, skb,
+                                                 is_template);
 
-                        if (tim_offset)
-                                *tim_offset = beacon->head_len;
-                        if (tim_length)
-                                *tim_length = skb->len - beacon->head_len;
+                        if (offs) {
+                                offs->tim_offset = beacon->head_len;
+                                offs->tim_length = skb->len - beacon->head_len;
+
+                                /* for AP the csa offsets are from tail */
+                                csa_off_base = skb->len;
+                        }
 
                         if (beacon->tail)
                                 memcpy(skb_put(skb, beacon->tail_len),
@@ -2589,9 +2618,12 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                 if (!presp)
                         goto out;
 
-                if (sdata->vif.csa_active)
-                        ieee80211_update_csa(sdata, presp);
+                if (sdata->vif.csa_active) {
+                        if (!is_template)
+                                ieee80211_csa_update_counter(vif);
 
+                        ieee80211_set_csa(sdata, presp);
+                }
 
                 skb = dev_alloc_skb(local->tx_headroom + presp->head_len +
                                     local->hw.extra_beacon_tailroom);
@@ -2611,8 +2643,17 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                 if (!bcn)
                         goto out;
 
-                if (sdata->vif.csa_active)
-                        ieee80211_update_csa(sdata, bcn);
+                if (sdata->vif.csa_active) {
+                        if (!is_template)
+                                /* TODO: For mesh csa_counter is in TU, so
+                                 * decrementing it by one isn't correct, but
+                                 * for now we leave it consistent with overall
+                                 * mac80211's behavior.
+                                 */
+                                ieee80211_csa_update_counter(vif);
+
+                        ieee80211_set_csa(sdata, bcn);
+                }
 
                 if (ifmsh->sync_ops)
                         ifmsh->sync_ops->adjust_tbtt(sdata, bcn);
@@ -2626,13 +2667,33 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                         goto out;
                 skb_reserve(skb, local->tx_headroom);
                 memcpy(skb_put(skb, bcn->head_len), bcn->head, bcn->head_len);
-                ieee80211_beacon_add_tim(sdata, &ifmsh->ps, skb);
+                ieee80211_beacon_add_tim(sdata, &ifmsh->ps, skb, is_template);
+
+                if (offs) {
+                        offs->tim_offset = bcn->head_len;
+                        offs->tim_length = skb->len - bcn->head_len;
+                }
+
                 memcpy(skb_put(skb, bcn->tail_len), bcn->tail, bcn->tail_len);
         } else {
                 WARN_ON(1);
                 goto out;
         }
 
+        /* CSA offsets */
+        if (offs) {
+                int i;
+
+                for (i = 0; i < IEEE80211_MAX_CSA_COUNTERS_NUM; i++) {
+                        u16 csa_off = sdata->csa_counter_offset_beacon[i];
+
+                        if (!csa_off)
+                                continue;
+
+                        offs->csa_counter_offs[i] = csa_off_base + csa_off;
+                }
+        }
+
         band = chanctx_conf->def.chan->band;
 
         info = IEEE80211_SKB_CB(skb);
@@ -2663,6 +2724,32 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
  out:
         rcu_read_unlock();
         return skb;
+
+}
+
+struct sk_buff *
+ieee80211_beacon_get_template(struct ieee80211_hw *hw,
+                              struct ieee80211_vif *vif,
+                              struct ieee80211_mutable_offsets *offs)
+{
+        return __ieee80211_beacon_get(hw, vif, offs, true);
+}
+EXPORT_SYMBOL(ieee80211_beacon_get_template);
+
+struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
+                                         struct ieee80211_vif *vif,
+                                         u16 *tim_offset, u16 *tim_length)
+{
+        struct ieee80211_mutable_offsets offs = {};
+        struct sk_buff *bcn = __ieee80211_beacon_get(hw, vif, &offs, false);
+
+        if (tim_offset)
+                *tim_offset = offs.tim_offset;
+
+        if (tim_length)
+                *tim_length = offs.tim_length;
+
+        return bcn;
 }
 EXPORT_SYMBOL(ieee80211_beacon_get_tim);
 
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index c08bd4aca6bb..6886601afe1c 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1457,6 +1457,44 @@ void ieee80211_stop_device(struct ieee80211_local *local)
         drv_stop(local);
 }
 
+static void ieee80211_handle_reconfig_failure(struct ieee80211_local *local)
+{
+        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_chanctx *ctx;
+
+        /*
+         * We get here if during resume the device can't be restarted properly.
+         * We might also get here if this happens during HW reset, which is a
+         * slightly different situation and we need to drop all connections in
+         * the latter case.
+         *
+         * Ask cfg80211 to turn off all interfaces, this will result in more
+         * warnings but at least we'll then get into a clean stopped state.
+         */
+
+        local->resuming = false;
+        local->suspended = false;
+        local->started = false;
+
+        /* scheduled scan clearly can't be running any more, but tell
+         * cfg80211 and clear local state
+         */
+        ieee80211_sched_scan_end(local);
+
+        list_for_each_entry(sdata, &local->interfaces, list)
+                sdata->flags &= ~IEEE80211_SDATA_IN_DRIVER;
+
+        /* Mark channel contexts as not being in the driver any more to avoid
+         * removing them from the driver during the shutdown process...
+         */
+        mutex_lock(&local->chanctx_mtx);
+        list_for_each_entry(ctx, &local->chanctx_list, list)
+                ctx->driver_present = false;
+        mutex_unlock(&local->chanctx_mtx);
+
+        cfg80211_shutdown_all_interfaces(local->hw.wiphy);
+}
+
 static void ieee80211_assign_chanctx(struct ieee80211_local *local,
                                      struct ieee80211_sub_if_data *sdata)
 {
@@ -1520,9 +1558,11 @@ int ieee80211_reconfig(struct ieee80211_local *local)
          */
         res = drv_start(local);
         if (res) {
-                WARN(local->suspended, "Hardware became unavailable "
-                     "upon resume. This could be a software issue "
-                     "prior to suspend or a hardware issue.\n");
+                if (local->suspended)
+                        WARN(1, "Hardware became unavailable upon resume. This could be a software issue prior to suspend or a hardware issue.\n");
+                else
+                        WARN(1, "Hardware became unavailable during restart.\n");
+                ieee80211_handle_reconfig_failure(local);
                 return res;
         }