Merge branch 'for-john' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next

12 files changed, 304 insertions, 158 deletions

diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 808338a1bce5..31bf2586fb84 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -83,8 +83,8 @@ void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
         if (drv_ampdu_action(local, sta->sdata, IEEE80211_AMPDU_RX_STOP,
                              &sta->sta, tid, NULL, 0))
                 sdata_info(sta->sdata,
-                           "HW problem - can not stop rx aggregation for tid %d\n",
-                           tid);
+                           "HW problem - can not stop rx aggregation for %pM tid %d\n",
+                           sta->sta.addr, tid);
 
         /* check if this is a self generated aggregation halt */
         if (initiator == WLAN_BACK_RECIPIENT && tx)
@@ -159,7 +159,8 @@ static void sta_rx_agg_session_timer_expired(unsigned long data)
         }
         rcu_read_unlock();
 
-        ht_dbg(sta->sdata, "rx session timer expired on tid %d\n", (u16)*ptid);
+        ht_dbg(sta->sdata, "RX session timer expired on %pM tid %d\n",
+               sta->sta.addr, (u16)*ptid);
 
         set_bit(*ptid, sta->ampdu_mlme.tid_rx_timer_expired);
         ieee80211_queue_work(&sta->local->hw, &sta->ampdu_mlme.work);
@@ -247,7 +248,9 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
         status = WLAN_STATUS_REQUEST_DECLINED;
 
         if (test_sta_flag(sta, WLAN_STA_BLOCK_BA)) {
-                ht_dbg(sta->sdata, "Suspend in progress - Denying ADDBA request\n");
+                ht_dbg(sta->sdata,
+                       "Suspend in progress - Denying ADDBA request (%pM tid %d)\n",
+                       sta->sta.addr, tid);
                 goto end_no_lock;
         }
 
@@ -317,7 +320,8 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
 
         ret = drv_ampdu_action(local, sta->sdata, IEEE80211_AMPDU_RX_START,
                                &sta->sta, tid, &start_seq_num, 0);
-        ht_dbg(sta->sdata, "Rx A-MPDU request on tid %d result %d\n", tid, ret);
+        ht_dbg(sta->sdata, "Rx A-MPDU request on %pM tid %d result %d\n",
+               sta->sta.addr, tid, ret);
         if (ret) {
                 kfree(tid_agg_rx->reorder_buf);
                 kfree(tid_agg_rx->reorder_time);
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 2f0ccbc5f13e..13b7683de5a4 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -296,7 +296,7 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
                                        IEEE80211_AMPDU_TX_STOP_FLUSH_CONT,
                                        &sta->sta, tid, NULL, 0);
                 WARN_ON_ONCE(ret);
-                goto remove_tid_tx;
+                return 0;
         }
 
         if (test_bit(HT_AGG_STATE_WANT_START, &tid_tx->state)) {
@@ -354,12 +354,15 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
                  */
         }
 
-        if (reason == AGG_STOP_DESTROY_STA) {
- remove_tid_tx:
-                spin_lock_bh(&sta->lock);
-                ieee80211_remove_tid_tx(sta, tid);
-                spin_unlock_bh(&sta->lock);
-        }
+        /*
+         * In the case of AGG_STOP_DESTROY_STA, the driver won't
+         * necessarily call ieee80211_stop_tx_ba_cb(), so this may
+         * seem like we can leave the tid_tx data pending forever.
+         * This is true, in a way, but "forever" is only until the
+         * station struct is actually destroyed. In the meantime,
+         * leaving it around ensures that we don't transmit packets
+         * to the driver on this TID which might confuse it.
+         */
 
         return 0;
 }
@@ -387,12 +390,13 @@ static void sta_addba_resp_timer_expired(unsigned long data)
             test_bit(HT_AGG_STATE_RESPONSE_RECEIVED, &tid_tx->state)) {
                 rcu_read_unlock();
                 ht_dbg(sta->sdata,
-                       "timer expired on tid %d but we are not (or no longer) expecting addBA response there\n",
-                       tid);
+                       "timer expired on %pM tid %d but we are not (or no longer) expecting addBA response there\n",
+                       sta->sta.addr, tid);
                 return;
         }
 
-        ht_dbg(sta->sdata, "addBA response timer expired on tid %d\n", tid);
+        ht_dbg(sta->sdata, "addBA response timer expired on %pM tid %d\n",
+               sta->sta.addr, tid);
 
         ieee80211_stop_tx_ba_session(&sta->sta, tid);
         rcu_read_unlock();
@@ -429,7 +433,8 @@ void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid)
                                &sta->sta, tid, &start_seq_num, 0);
         if (ret) {
                 ht_dbg(sdata,
-                       "BA request denied - HW unavailable for tid %d\n", tid);
+                       "BA request denied - HW unavailable for %pM tid %d\n",
+                       sta->sta.addr, tid);
                 spin_lock_bh(&sta->lock);
                 ieee80211_agg_splice_packets(sdata, tid_tx, tid);
                 ieee80211_assign_tid_tx(sta, tid, NULL);
@@ -442,7 +447,8 @@ void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid)
 
         /* activate the timer for the recipient's addBA response */
         mod_timer(&tid_tx->addba_resp_timer, jiffies + ADDBA_RESP_INTERVAL);
-        ht_dbg(sdata, "activated addBA response timer on tid %d\n", tid);
+        ht_dbg(sdata, "activated addBA response timer on %pM tid %d\n",
+               sta->sta.addr, tid);
 
         spin_lock_bh(&sta->lock);
         sta->ampdu_mlme.last_addba_req_time[tid] = jiffies;
@@ -489,7 +495,8 @@ static void sta_tx_agg_session_timer_expired(unsigned long data)
 
         rcu_read_unlock();
 
-        ht_dbg(sta->sdata, "tx session timer expired on tid %d\n", (u16)*ptid);
+        ht_dbg(sta->sdata, "tx session timer expired on %pM tid %d\n",
+               sta->sta.addr, (u16)*ptid);
 
         ieee80211_stop_tx_ba_session(&sta->sta, *ptid);
 }
@@ -525,7 +532,8 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
 
         if (test_sta_flag(sta, WLAN_STA_BLOCK_BA)) {
                 ht_dbg(sdata,
-                       "BA sessions blocked - Denying BA session request\n");
+                       "BA sessions blocked - Denying BA session request %pM tid %d\n",
+                       sta->sta.addr, tid);
                 return -EINVAL;
         }
 
@@ -566,8 +574,8 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
             time_before(jiffies, sta->ampdu_mlme.last_addba_req_time[tid] +
                         HT_AGG_RETRIES_PERIOD)) {
                 ht_dbg(sdata,
-                       "BA request denied - waiting a grace period after %d failed requests on tid %u\n",
-                       sta->ampdu_mlme.addba_req_num[tid], tid);
+                       "BA request denied - waiting a grace period after %d failed requests on %pM tid %u\n",
+                       sta->ampdu_mlme.addba_req_num[tid], sta->sta.addr, tid);
                 ret = -EBUSY;
                 goto err_unlock_sta;
         }
@@ -576,8 +584,8 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
         /* check if the TID is not in aggregation flow already */
         if (tid_tx || sta->ampdu_mlme.tid_start_tx[tid]) {
                 ht_dbg(sdata,
-                       "BA request denied - session is not idle on tid %u\n",
-                       tid);
+                       "BA request denied - session is not idle on %pM tid %u\n",
+                       sta->sta.addr, tid);
                 ret = -EAGAIN;
                 goto err_unlock_sta;
         }
@@ -632,7 +640,8 @@ static void ieee80211_agg_tx_operational(struct ieee80211_local *local,
 
         tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
 
-        ht_dbg(sta->sdata, "Aggregation is on for tid %d\n", tid);
+        ht_dbg(sta->sdata, "Aggregation is on for %pM tid %d\n",
+               sta->sta.addr, tid);
 
         drv_ampdu_action(local, sta->sdata,
                          IEEE80211_AMPDU_TX_OPERATIONAL,
@@ -802,7 +811,9 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid)
         tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
 
         if (!tid_tx || !test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
-                ht_dbg(sdata, "unexpected callback to A-MPDU stop\n");
+                ht_dbg(sdata,
+                       "unexpected callback to A-MPDU stop for %pM tid %d\n",
+                       sta->sta.addr, tid);
                 goto unlock_sta;
         }
 
@@ -861,13 +872,15 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
                 goto out;
 
         if (mgmt->u.action.u.addba_resp.dialog_token != tid_tx->dialog_token) {
-                ht_dbg(sta->sdata, "wrong addBA response token, tid %d\n", tid);
+                ht_dbg(sta->sdata, "wrong addBA response token, %pM tid %d\n",
+                       sta->sta.addr, tid);
                 goto out;
         }
 
         del_timer_sync(&tid_tx->addba_resp_timer);
 
-        ht_dbg(sta->sdata, "switched off addBA timer for tid %d\n", tid);
+        ht_dbg(sta->sdata, "switched off addBA timer for %pM tid %d\n",
+               sta->sta.addr, tid);
 
         /*
          * addba_resp_timer may have fired before we got here, and
@@ -877,8 +890,8 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
         if (test_bit(HT_AGG_STATE_WANT_STOP, &tid_tx->state) ||
             test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
                 ht_dbg(sta->sdata,
-                       "got addBA resp for tid %d but we already gave up\n",
-                       tid);
+                       "got addBA resp for %pM tid %d but we already gave up\n",
+                       sta->sta.addr, tid);
                 goto out;
         }
 
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 0c07f94c5378..434b3c4f31b5 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -569,7 +569,8 @@ static inline void drv_sta_rc_update(struct ieee80211_local *local,
         check_sdata_in_driver(sdata);
 
         WARN_ON(changed & IEEE80211_RC_SUPP_RATES_CHANGED &&
-                sdata->vif.type != NL80211_IFTYPE_ADHOC);
+                (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
+                 sdata->vif.type != NL80211_IFTYPE_MESH_POINT));
 
         trace_drv_sta_rc_update(local, sdata, sta, changed);
         if (local->ops->sta_rc_update)
@@ -845,11 +846,12 @@ static inline void drv_set_rekey_data(struct ieee80211_local *local,
 }
 
 static inline void drv_rssi_callback(struct ieee80211_local *local,
+                                     struct ieee80211_sub_if_data *sdata,
                                      const enum ieee80211_rssi_event event)
 {
-        trace_drv_rssi_callback(local, event);
+        trace_drv_rssi_callback(local, sdata, event);
         if (local->ops->rssi_callback)
-                local->ops->rssi_callback(&local->hw, event);
+                local->ops->rssi_callback(&local->hw, &sdata->vif, event);
         trace_drv_return_void(local);
 }
 
@@ -1020,4 +1022,32 @@ static inline void drv_restart_complete(struct ieee80211_local *local)
         trace_drv_return_void(local);
 }
 
+static inline void
+drv_set_default_unicast_key(struct ieee80211_local *local,
+                            struct ieee80211_sub_if_data *sdata,
+                            int key_idx)
+{
+        check_sdata_in_driver(sdata);
+
+        WARN_ON_ONCE(key_idx < -1 || key_idx > 3);
+
+        trace_drv_set_default_unicast_key(local, sdata, key_idx);
+        if (local->ops->set_default_unicast_key)
+                local->ops->set_default_unicast_key(&local->hw, &sdata->vif,
+                                                    key_idx);
+        trace_drv_return_void(local);
+}
+
+#if IS_ENABLED(CONFIG_IPV6)
+static inline void drv_ipv6_addr_change(struct ieee80211_local *local,
+                                        struct ieee80211_sub_if_data *sdata,
+                                        struct inet6_dev *idev)
+{
+        trace_drv_ipv6_addr_change(local, sdata);
+        if (local->ops->ipv6_addr_change)
+                local->ops->ipv6_addr_change(&local->hw, &sdata->vif, idev);
+        trace_drv_return_void(local);
+}
+#endif
+
 #endif /* __MAC80211_DRIVER_OPS */
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 63f0430c131e..5fba867d9e2e 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -747,8 +747,6 @@ struct ieee80211_sub_if_data {
         struct work_struct work;
         struct sk_buff_head skb_queue;
 
-        bool arp_filter_state;
-
         u8 needed_rx_chains;
         enum ieee80211_smps_mode smps_mode;
 
@@ -1129,6 +1127,7 @@ struct ieee80211_local {
         struct timer_list dynamic_ps_timer;
         struct notifier_block network_latency_notifier;
         struct notifier_block ifa_notifier;
+        struct notifier_block ifa6_notifier;
 
         /*
          * The dynamic ps timeout configured from user space via WEXT -
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 06fac2991d40..0a36dc6346bb 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1574,9 +1574,6 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
         /* initialise type-independent data */
         sdata->wdev.wiphy = local->hw.wiphy;
         sdata->local = local;
-#ifdef CONFIG_INET
-        sdata->arp_filter_state = true;
-#endif
 
         for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++)
                 skb_queue_head_init(&sdata->fragments[i].skb_list);
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 619c5d697999..ef252eb58c36 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -204,8 +204,11 @@ static void __ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata,
         if (idx >= 0 && idx < NUM_DEFAULT_KEYS)
                 key = key_mtx_dereference(sdata->local, sdata->keys[idx]);
 
-        if (uni)
+        if (uni) {
                 rcu_assign_pointer(sdata->default_unicast_key, key);
+                drv_set_default_unicast_key(sdata->local, sdata, idx);
+        }
+
         if (multi)
                 rcu_assign_pointer(sdata->default_multicast_key, key);
 
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 39cfe8f10ad2..2bdd454e8bcf 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -23,6 +23,7 @@
 #include <linux/inetdevice.h>
 #include <net/net_namespace.h>
 #include <net/cfg80211.h>
+#include <net/addrconf.h>
 
 #include "ieee80211_i.h"
 #include "driver-ops.h"
@@ -349,27 +350,19 @@ static int ieee80211_ifa_changed(struct notifier_block *nb,
 
         /* Copy the addresses to the bss_conf list */
         ifa = idev->ifa_list;
-        while (c < IEEE80211_BSS_ARP_ADDR_LIST_LEN && ifa) {
-                bss_conf->arp_addr_list[c] = ifa->ifa_address;
+        while (ifa) {
+                if (c < IEEE80211_BSS_ARP_ADDR_LIST_LEN)
+                        bss_conf->arp_addr_list[c] = ifa->ifa_address;
                 ifa = ifa->ifa_next;
                 c++;
         }
 
-        /* If not all addresses fit the list, disable filtering */
-        if (ifa) {
-                sdata->arp_filter_state = false;
-                c = 0;
-        } else {
-                sdata->arp_filter_state = true;
-        }
         bss_conf->arp_addr_cnt = c;
 
         /* Configure driver only if associated (which also implies it is up) */
-        if (ifmgd->associated) {
-                bss_conf->arp_filter_enabled = sdata->arp_filter_state;
+        if (ifmgd->associated)
                 ieee80211_bss_info_change_notify(sdata,
                                                  BSS_CHANGED_ARP_FILTER);
-        }
 
         mutex_unlock(&ifmgd->mtx);
 
@@ -377,6 +370,37 @@ static int ieee80211_ifa_changed(struct notifier_block *nb,
 }
 #endif
 
+#if IS_ENABLED(CONFIG_IPV6)
+static int ieee80211_ifa6_changed(struct notifier_block *nb,
+                                  unsigned long data, void *arg)
+{
+        struct inet6_ifaddr *ifa = (struct inet6_ifaddr *)arg;
+        struct inet6_dev *idev = ifa->idev;
+        struct net_device *ndev = ifa->idev->dev;
+        struct ieee80211_local *local =
+                container_of(nb, struct ieee80211_local, ifa6_notifier);
+        struct wireless_dev *wdev = ndev->ieee80211_ptr;
+        struct ieee80211_sub_if_data *sdata;
+
+        /* Make sure it's our interface that got changed */
+        if (!wdev || wdev->wiphy != local->hw.wiphy)
+                return NOTIFY_DONE;
+
+        sdata = IEEE80211_DEV_TO_SUB_IF(ndev);
+
+        /*
+         * For now only support station mode. This is mostly because
+         * doing AP would have to handle AP_VLAN in some way ...
+         */
+        if (sdata->vif.type != NL80211_IFTYPE_STATION)
+                return NOTIFY_DONE;
+
+        drv_ipv6_addr_change(local, sdata, idev);
+
+        return NOTIFY_DONE;
+}
+#endif
+
 static int ieee80211_napi_poll(struct napi_struct *napi, int budget)
 {
         struct ieee80211_local *local =
@@ -985,12 +1009,25 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                 goto fail_ifa;
 #endif
 
+#if IS_ENABLED(CONFIG_IPV6)
+        local->ifa6_notifier.notifier_call = ieee80211_ifa6_changed;
+        result = register_inet6addr_notifier(&local->ifa6_notifier);
+        if (result)
+                goto fail_ifa6;
+#endif
+
         netif_napi_add(&local->napi_dev, &local->napi, ieee80211_napi_poll,
                         local->hw.napi_weight);
 
         return 0;
 
+#if IS_ENABLED(CONFIG_IPV6)
+ fail_ifa6:
 #ifdef CONFIG_INET
+        unregister_inetaddr_notifier(&local->ifa_notifier);
+#endif
+#endif
+#if defined(CONFIG_INET) || defined(CONFIG_IPV6)
  fail_ifa:
         pm_qos_remove_notifier(PM_QOS_NETWORK_LATENCY,
                                &local->network_latency_notifier);
@@ -1026,6 +1063,9 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
 #ifdef CONFIG_INET
         unregister_inetaddr_notifier(&local->ifa_notifier);
 #endif
+#if IS_ENABLED(CONFIG_IPV6)
+        unregister_inet6addr_notifier(&local->ifa6_notifier);
+#endif
 
         rtnl_lock();
 
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index 9e0416696a83..81e612682bc3 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -55,30 +55,6 @@ static inline void mesh_plink_fsm_restart(struct sta_info *sta)
         sta->plink_retries = 0;
 }
 
-/*
- * Allocate mesh sta entry and insert into station table
- */
-static struct sta_info *mesh_plink_alloc(struct ieee80211_sub_if_data *sdata,
-                                         u8 *hw_addr)
-{
-        struct sta_info *sta;
-
-        if (sdata->local->num_sta >= MESH_MAX_PLINKS)
-                return NULL;
-
-        sta = sta_info_alloc(sdata, hw_addr, GFP_KERNEL);
-        if (!sta)
-                return NULL;
-
-        sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
-        sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
-        sta_info_pre_move_state(sta, IEEE80211_STA_AUTHORIZED);
-
-        set_sta_flag(sta, WLAN_STA_WME);
-
-        return sta;
-}
-
 /**
  * mesh_set_ht_prot_mode - set correct HT protection mode
  *
@@ -309,53 +285,27 @@ free:
         return err;
 }
 
-/**
- * mesh_peer_init - initialize new mesh peer and return resulting sta_info
- *
- * @sdata: local meshif
- * @addr: peer's address
- * @elems: IEs from beacon or mesh peering frame
- *
- * call under RCU
- */
-static struct sta_info *mesh_peer_init(struct ieee80211_sub_if_data *sdata,
-                                       u8 *addr,
-                                       struct ieee802_11_elems *elems)
+static void mesh_sta_info_init(struct ieee80211_sub_if_data *sdata,
+                               struct sta_info *sta,
+                               struct ieee802_11_elems *elems, bool insert)
 {
         struct ieee80211_local *local = sdata->local;
         enum ieee80211_band band = ieee80211_get_sdata_band(sdata);
         struct ieee80211_supported_band *sband;
-        u32 rates, basic_rates = 0;
-        struct sta_info *sta;
-        bool insert = false;
+        u32 rates, basic_rates = 0, changed = 0;
 
         sband = local->hw.wiphy->bands[band];
         rates = ieee80211_sta_get_rates(local, elems, band, &basic_rates);
 
-        sta = sta_info_get(sdata, addr);
-        if (!sta) {
-                /* Userspace handles peer allocation when security is enabled */
-                if (sdata->u.mesh.security & IEEE80211_MESH_SEC_AUTHED) {
-                        cfg80211_notify_new_peer_candidate(sdata->dev, addr,
-                                                           elems->ie_start,
-                                                           elems->total_len,
-                                                           GFP_ATOMIC);
-                        return NULL;
-                }
-
-                sta = mesh_plink_alloc(sdata, addr);
-                if (!sta)
-                        return NULL;
-                insert = true;
-        }
-
         spin_lock_bh(&sta->lock);
         sta->last_rx = jiffies;
-        if (sta->plink_state == NL80211_PLINK_ESTAB) {
-                spin_unlock_bh(&sta->lock);
-                return sta;
-        }
 
+        /* rates and capabilities don't change during peering */
+        if (sta->plink_state == NL80211_PLINK_ESTAB)
+                goto out;
+
+        if (sta->sta.supp_rates[band] != rates)
+                changed |= IEEE80211_RC_SUPP_RATES_CHANGED;
         sta->sta.supp_rates[band] = rates;
         if (elems->ht_cap_elem &&
             sdata->vif.bss_conf.chandef.width != NL80211_CHAN_WIDTH_20_NOHT)
@@ -374,27 +324,115 @@ static struct sta_info *mesh_peer_init(struct ieee80211_sub_if_data *sdata,
                                             ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
                 ieee80211_ht_oper_to_chandef(sdata->vif.bss_conf.chandef.chan,
                                              elems->ht_operation, &chandef);
+                if (sta->ch_width != chandef.width)
+                        changed |= IEEE80211_RC_BW_CHANGED;
                 sta->ch_width = chandef.width;
         }
 
         if (insert)
                 rate_control_rate_init(sta);
+        else
+                rate_control_rate_update(local, sband, sta, changed);
+out:
         spin_unlock_bh(&sta->lock);
+}
+
+static struct sta_info *
+__mesh_sta_info_alloc(struct ieee80211_sub_if_data *sdata, u8 *hw_addr)
+{
+        struct sta_info *sta;
 
-        if (insert && sta_info_insert(sta))
+        if (sdata->local->num_sta >= MESH_MAX_PLINKS)
                 return NULL;
 
+        sta = sta_info_alloc(sdata, hw_addr, GFP_KERNEL);
+        if (!sta)
+                return NULL;
+
+        sta->plink_state = NL80211_PLINK_LISTEN;
+        init_timer(&sta->plink_timer);
+
+        sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
+        sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
+        sta_info_pre_move_state(sta, IEEE80211_STA_AUTHORIZED);
+
+        set_sta_flag(sta, WLAN_STA_WME);
+
+        return sta;
+}
+
+static struct sta_info *
+mesh_sta_info_alloc(struct ieee80211_sub_if_data *sdata, u8 *addr,
+                    struct ieee802_11_elems *elems)
+{
+        struct sta_info *sta = NULL;
+
+        /* Userspace handles peer allocation when security is enabled */
+        if (sdata->u.mesh.security & IEEE80211_MESH_SEC_AUTHED)
+                cfg80211_notify_new_peer_candidate(sdata->dev, addr,
+                                                   elems->ie_start,
+                                                   elems->total_len,
+                                                   GFP_KERNEL);
+        else
+                sta = __mesh_sta_info_alloc(sdata, addr);
+
+        return sta;
+}
+
+/*
+ * mesh_sta_info_get - return mesh sta info entry for @addr.
+ *
+ * @sdata: local meshif
+ * @addr: peer's address
+ * @elems: IEs from beacon or mesh peering frame.
+ *
+ * Return existing or newly allocated sta_info under RCU read lock.
+ * (re)initialize with given IEs.
+ */
+static struct sta_info *
+mesh_sta_info_get(struct ieee80211_sub_if_data *sdata,
+                  u8 *addr, struct ieee802_11_elems *elems) __acquires(RCU)
+{
+        struct sta_info *sta = NULL;
+
+        rcu_read_lock();
+        sta = sta_info_get(sdata, addr);
+        if (sta) {
+                mesh_sta_info_init(sdata, sta, elems, false);
+        } else {
+                rcu_read_unlock();
+                /* can't run atomic */
+                sta = mesh_sta_info_alloc(sdata, addr, elems);
+                if (!sta) {
+                        rcu_read_lock();
+                        return NULL;
+                }
+
+                mesh_sta_info_init(sdata, sta, elems, true);
+
+                if (sta_info_insert_rcu(sta))
+                        return NULL;
+        }
+
         return sta;
 }
 
+/*
+ * mesh_neighbour_update - update or initialize new mesh neighbor.
+ *
+ * @sdata: local meshif
+ * @addr: peer's address
+ * @elems: IEs from beacon or mesh peering frame
+ *
+ * Initiates peering if appropriate.
+ */
 void mesh_neighbour_update(struct ieee80211_sub_if_data *sdata,
                            u8 *hw_addr,
                            struct ieee802_11_elems *elems)
 {
         struct sta_info *sta;
 
-        rcu_read_lock();
-        sta = mesh_peer_init(sdata, hw_addr, elems);
+        sta = mesh_sta_info_get(sdata, hw_addr, elems);
         if (!sta)
                 goto out;
 
@@ -632,6 +670,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
             (ftype == WLAN_SP_MESH_PEERING_CLOSE && ie_len == 8))
                 memcpy(&llid, PLINK_GET_PLID(elems.peering), 2);
 
+        /* WARNING: Only for sta pointer, is dropped & re-acquired */
         rcu_read_lock();
 
         sta = sta_info_get(sdata, mgmt->sa);
@@ -735,8 +774,9 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
         }
 
         if (event == OPN_ACPT) {
+                rcu_read_unlock();
                 /* allocate sta entry if necessary and update info */
-                sta = mesh_peer_init(sdata, mgmt->sa, &elems);
+                sta = mesh_sta_info_get(sdata, mgmt->sa, &elems);
                 if (!sta) {
                         mpl_dbg(sdata, "Mesh plink: failed to init peer!\n");
                         rcu_read_unlock();
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index e930175771ff..5913fb924b12 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1465,10 +1465,8 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
                 bss_info_changed |= BSS_CHANGED_CQM;
 
         /* Enable ARP filtering */
-        if (bss_conf->arp_filter_enabled != sdata->arp_filter_state) {
-                bss_conf->arp_filter_enabled = sdata->arp_filter_state;
+        if (bss_conf->arp_addr_cnt)
                 bss_info_changed |= BSS_CHANGED_ARP_FILTER;
-        }
 
         ieee80211_bss_info_change_notify(sdata, bss_info_changed);
 
@@ -1489,7 +1487,6 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
-        struct sta_info *sta;
         u32 changed = 0;
 
         ASSERT_MGD_MTX(ifmgd);
@@ -1521,14 +1518,6 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         netif_tx_stop_all_queues(sdata->dev);
         netif_carrier_off(sdata->dev);
 
-        mutex_lock(&local->sta_mtx);
-        sta = sta_info_get(sdata, ifmgd->bssid);
-        if (sta) {
-                set_sta_flag(sta, WLAN_STA_BLOCK_BA);
-                ieee80211_sta_tear_down_BA_sessions(sta, AGG_STOP_DESTROY_STA);
-        }
-        mutex_unlock(&local->sta_mtx);
-
         /*
          * if we want to get out of ps before disassoc (why?) we have
          * to do it before sending disassoc, as otherwise the null-packet
@@ -1582,10 +1571,8 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         cancel_work_sync(&local->dynamic_ps_enable_work);
 
         /* Disable ARP filtering */
-        if (sdata->vif.bss_conf.arp_filter_enabled) {
-                sdata->vif.bss_conf.arp_filter_enabled = false;
+        if (sdata->vif.bss_conf.arp_addr_cnt)
                 changed |= BSS_CHANGED_ARP_FILTER;
-        }
 
         sdata->vif.bss_conf.qos = false;
         changed |= BSS_CHANGED_QOS;
@@ -2608,12 +2595,12 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                 if (sig > ifmgd->rssi_max_thold &&
                     (last_sig <= ifmgd->rssi_min_thold || last_sig == 0)) {
                         ifmgd->last_ave_beacon_signal = sig;
-                        drv_rssi_callback(local, RSSI_EVENT_HIGH);
+                        drv_rssi_callback(local, sdata, RSSI_EVENT_HIGH);
                 } else if (sig < ifmgd->rssi_min_thold &&
                            (last_sig >= ifmgd->rssi_max_thold ||
                            last_sig == 0)) {
                         ifmgd->last_ave_beacon_signal = sig;
-                        drv_rssi_callback(local, RSSI_EVENT_LOW);
+                        drv_rssi_callback(local, sdata, RSSI_EVENT_LOW);
                 }
         }
 
@@ -3169,23 +3156,22 @@ void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
-        if (!ifmgd->associated)
+        mutex_lock(&ifmgd->mtx);
+        if (!ifmgd->associated) {
+                mutex_unlock(&ifmgd->mtx);
                 return;
+        }
 
         if (sdata->flags & IEEE80211_SDATA_DISCONNECT_RESUME) {
                 sdata->flags &= ~IEEE80211_SDATA_DISCONNECT_RESUME;
-                mutex_lock(&ifmgd->mtx);
-                if (ifmgd->associated) {
-                        mlme_dbg(sdata,
-                                 "driver requested disconnect after resume\n");
-                        ieee80211_sta_connection_lost(sdata,
-                                ifmgd->associated->bssid,
-                                WLAN_REASON_UNSPECIFIED);
-                        mutex_unlock(&ifmgd->mtx);
-                        return;
-                }
+                mlme_dbg(sdata, "driver requested disconnect after resume\n");
+                ieee80211_sta_connection_lost(sdata,
+                                              ifmgd->associated->bssid,
+                                              WLAN_REASON_UNSPECIFIED);
                 mutex_unlock(&ifmgd->mtx);
+                return;
         }
+        mutex_unlock(&ifmgd->mtx);
 
         if (test_and_clear_bit(TMR_RUNNING_TIMER, &ifmgd->timers_running))
                 add_timer(&ifmgd->timer);
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 9d864ed5f3da..227233c3ff7f 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -380,11 +380,6 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
 
         sta_dbg(sdata, "Allocated STA %pM\n", sta->sta.addr);
 
-#ifdef CONFIG_MAC80211_MESH
-        sta->plink_state = NL80211_PLINK_LISTEN;
-        init_timer(&sta->plink_timer);
-#endif
-
         return sta;
 }
 
diff --git a/net/mac80211/trace.h b/net/mac80211/trace.h
index 41861b91daa3..6ca53d64cb28 100644
--- a/net/mac80211/trace.h
+++ b/net/mac80211/trace.h
@@ -347,8 +347,11 @@ TRACE_EVENT(drv_bss_info_changed,
                 __field(s32, cqm_rssi_hyst);
                 __field(u32, channel_width);
                 __field(u32, channel_cfreq1);
-                __dynamic_array(u32, arp_addr_list, info->arp_addr_cnt);
-                __field(bool, arp_filter_enabled);
+                __dynamic_array(u32, arp_addr_list,
+                                info->arp_addr_cnt > IEEE80211_BSS_ARP_ADDR_LIST_LEN ?
+                                        IEEE80211_BSS_ARP_ADDR_LIST_LEN :
+                                        info->arp_addr_cnt);
+                __field(int, arp_addr_cnt);
                 __field(bool, qos);
                 __field(bool, idle);
                 __field(bool, ps);
@@ -384,9 +387,11 @@ TRACE_EVENT(drv_bss_info_changed,
                 __entry->cqm_rssi_hyst = info->cqm_rssi_hyst;
                 __entry->channel_width = info->chandef.width;
                 __entry->channel_cfreq1 = info->chandef.center_freq1;
+                __entry->arp_addr_cnt = info->arp_addr_cnt;
                 memcpy(__get_dynamic_array(arp_addr_list), info->arp_addr_list,
-                       sizeof(u32) * info->arp_addr_cnt);
-                __entry->arp_filter_enabled = info->arp_filter_enabled;
+                       sizeof(u32) * (info->arp_addr_cnt > IEEE80211_BSS_ARP_ADDR_LIST_LEN ?
+                                        IEEE80211_BSS_ARP_ADDR_LIST_LEN :
+                                        info->arp_addr_cnt));
                 __entry->qos = info->qos;
                 __entry->idle = info->idle;
                 __entry->ps = info->ps;
@@ -1184,23 +1189,26 @@ TRACE_EVENT(drv_set_rekey_data,
 
 TRACE_EVENT(drv_rssi_callback,
         TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata,
                  enum ieee80211_rssi_event rssi_event),
 
-        TP_ARGS(local, rssi_event),
+        TP_ARGS(local, sdata, rssi_event),
 
         TP_STRUCT__entry(
                 LOCAL_ENTRY
+                VIF_ENTRY
                 __field(u32, rssi_event)
         ),
 
         TP_fast_assign(
                 LOCAL_ASSIGN;
+                VIF_ASSIGN;
                 __entry->rssi_event = rssi_event;
         ),
 
         TP_printk(
-                LOCAL_PR_FMT " rssi_event:%d",
-                LOCAL_PR_ARG, __entry->rssi_event
+                LOCAL_PR_FMT VIF_PR_FMT " rssi_event:%d",
+                LOCAL_PR_ARG, VIF_PR_ARG, __entry->rssi_event
         )
 );
 
@@ -1432,6 +1440,14 @@ DEFINE_EVENT(local_only_evt, drv_restart_complete,
         TP_ARGS(local)
 );
 
+#if IS_ENABLED(CONFIG_IPV6)
+DEFINE_EVENT(local_sdata_evt, drv_ipv6_addr_change,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata),
+        TP_ARGS(local, sdata)
+);
+#endif
+
 /*
  * Tracing for API calls that drivers call.
  */
@@ -1821,6 +1837,29 @@ TRACE_EVENT(stop_queue,
         )
 );
 
+TRACE_EVENT(drv_set_default_unicast_key,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata,
+                 int key_idx),
+
+        TP_ARGS(local, sdata, key_idx),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                VIF_ENTRY
+                __field(int, key_idx)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                VIF_ASSIGN;
+                __entry->key_idx = key_idx;
+        ),
+
+        TP_printk(LOCAL_PR_FMT VIF_PR_FMT " key_idx:%d",
+                  LOCAL_PR_ARG, VIF_PR_ARG, __entry->key_idx)
+);
+
 #ifdef CONFIG_MAC80211_MESSAGE_TRACING
 #undef TRACE_SYSTEM
 #define TRACE_SYSTEM mac80211_msg
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index f32d68186dbc..a2cb6a302cc7 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1787,16 +1787,16 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                         break;
                 /* fall through */
         case NL80211_IFTYPE_AP:
+                if (sdata->vif.type == NL80211_IFTYPE_AP)
+                        chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
+                if (!chanctx_conf)
+                        goto fail_rcu;
                 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS);
                 /* DA BSSID SA */
                 memcpy(hdr.addr1, skb->data, ETH_ALEN);
                 memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
                 memcpy(hdr.addr3, skb->data + ETH_ALEN, ETH_ALEN);
                 hdrlen = 24;
-                if (sdata->vif.type == NL80211_IFTYPE_AP)
-                        chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
-                if (!chanctx_conf)
-                        goto fail_rcu;
                 band = chanctx_conf->def.chan->band;
                 break;
         case NL80211_IFTYPE_WDS: