Merge branch 'for-john' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next

33 files changed, 1673 insertions, 639 deletions

diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 95667b088c5b..754069cbb756 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -133,7 +133,9 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
                              struct key_params *params)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = sdata->local;
         struct sta_info *sta = NULL;
+        const struct ieee80211_cipher_scheme *cs = NULL;
         struct ieee80211_key *key;
         int err;
 
@@ -145,22 +147,28 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
         case WLAN_CIPHER_SUITE_WEP40:
         case WLAN_CIPHER_SUITE_TKIP:
         case WLAN_CIPHER_SUITE_WEP104:
-                if (IS_ERR(sdata->local->wep_tx_tfm))
+                if (IS_ERR(local->wep_tx_tfm))
                         return -EINVAL;
                 break;
+        case WLAN_CIPHER_SUITE_CCMP:
+        case WLAN_CIPHER_SUITE_AES_CMAC:
+        case WLAN_CIPHER_SUITE_GCMP:
+                break;
         default:
+                cs = ieee80211_cs_get(local, params->cipher, sdata->vif.type);
                 break;
         }
 
         key = ieee80211_key_alloc(params->cipher, key_idx, params->key_len,
-                                  params->key, params->seq_len, params->seq);
+                                  params->key, params->seq_len, params->seq,
+                                  cs);
         if (IS_ERR(key))
                 return PTR_ERR(key);
 
         if (pairwise)
                 key->conf.flags |= IEEE80211_KEY_FLAG_PAIRWISE;
 
-        mutex_lock(&sdata->local->sta_mtx);
+        mutex_lock(&local->sta_mtx);
 
         if (mac_addr) {
                 if (ieee80211_vif_is_mesh(&sdata->vif))
@@ -216,10 +224,13 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
                 break;
         }
 
+        if (sta)
+                sta->cipher_scheme = cs;
+
         err = ieee80211_key_link(key, sdata, sta);
 
  out_unlock:
-        mutex_unlock(&sdata->local->sta_mtx);
+        mutex_unlock(&local->sta_mtx);
 
         return err;
 }
@@ -244,7 +255,7 @@ static int ieee80211_del_key(struct wiphy *wiphy, struct net_device *dev,
                         goto out_unlock;
 
                 if (pairwise)
-                        key = key_mtx_dereference(local, sta->ptk);
+                        key = key_mtx_dereference(local, sta->ptk[key_idx]);
                 else
                         key = key_mtx_dereference(local, sta->gtk[key_idx]);
         } else
@@ -291,7 +302,7 @@ static int ieee80211_get_key(struct wiphy *wiphy, struct net_device *dev,
                         goto out;
 
                 if (pairwise)
-                        key = rcu_dereference(sta->ptk);
+                        key = rcu_dereference(sta->ptk[key_idx]);
                 else if (key_idx < NUM_DEFAULT_KEYS)
                         key = rcu_dereference(sta->gtk[key_idx]);
         } else
@@ -521,8 +532,8 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
                                  STATION_INFO_PEER_PM |
                                  STATION_INFO_NONPEER_PM;
 
-                sinfo->llid = le16_to_cpu(sta->llid);
-                sinfo->plid = le16_to_cpu(sta->plid);
+                sinfo->llid = sta->llid;
+                sinfo->plid = sta->plid;
                 sinfo->plink_state = sta->plink_state;
                 if (test_sta_flag(sta, WLAN_STA_TOFFSET_KNOWN)) {
                         sinfo->filled |= STATION_INFO_T_OFFSET;
@@ -846,7 +857,7 @@ static int ieee80211_set_probe_resp(struct ieee80211_sub_if_data *sdata,
         if (!resp || !resp_len)
                 return 1;
 
-        old = rtnl_dereference(sdata->u.ap.probe_resp);
+        old = sdata_dereference(sdata->u.ap.probe_resp, sdata);
 
         new = kzalloc(sizeof(struct probe_resp) + resp_len, GFP_KERNEL);
         if (!new)
@@ -870,7 +881,8 @@ int ieee80211_assign_beacon(struct ieee80211_sub_if_data *sdata,
         int size, err;
         u32 changed = BSS_CHANGED_BEACON;
 
-        old = rtnl_dereference(sdata->u.ap.beacon);
+        old = sdata_dereference(sdata->u.ap.beacon, sdata);
+
 
         /* Need to have a beacon head if we don't have one yet */
         if (!params->head && !old)
@@ -947,7 +959,7 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
                       BSS_CHANGED_P2P_PS;
         int err;
 
-        old = rtnl_dereference(sdata->u.ap.beacon);
+        old = sdata_dereference(sdata->u.ap.beacon, sdata);
         if (old)
                 return -EALREADY;
 
@@ -968,11 +980,19 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
          */
         sdata->control_port_protocol = params->crypto.control_port_ethertype;
         sdata->control_port_no_encrypt = params->crypto.control_port_no_encrypt;
+        sdata->encrypt_headroom = ieee80211_cs_headroom(sdata->local,
+                                                        &params->crypto,
+                                                        sdata->vif.type);
+
         list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list) {
                 vlan->control_port_protocol =
                         params->crypto.control_port_ethertype;
                 vlan->control_port_no_encrypt =
                         params->crypto.control_port_no_encrypt;
+                vlan->encrypt_headroom =
+                        ieee80211_cs_headroom(sdata->local,
+                                              &params->crypto,
+                                              vlan->vif.type);
         }
 
         sdata->vif.bss_conf.beacon_int = params->beacon_interval;
@@ -1001,7 +1021,8 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
 
         err = drv_start_ap(sdata->local, sdata);
         if (err) {
-                old = rtnl_dereference(sdata->u.ap.beacon);
+                old = sdata_dereference(sdata->u.ap.beacon, sdata);
+
                 if (old)
                         kfree_rcu(old, rcu_head);
                 RCU_INIT_POINTER(sdata->u.ap.beacon, NULL);
@@ -1032,7 +1053,7 @@ static int ieee80211_change_beacon(struct wiphy *wiphy, struct net_device *dev,
         if (sdata->vif.csa_active)
                 return -EBUSY;
 
-        old = rtnl_dereference(sdata->u.ap.beacon);
+        old = sdata_dereference(sdata->u.ap.beacon, sdata);
         if (!old)
                 return -ENOENT;
 
@@ -1050,15 +1071,18 @@ static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
         struct ieee80211_local *local = sdata->local;
         struct beacon_data *old_beacon;
         struct probe_resp *old_probe_resp;
+        struct cfg80211_chan_def chandef;
 
-        old_beacon = rtnl_dereference(sdata->u.ap.beacon);
+        old_beacon = sdata_dereference(sdata->u.ap.beacon, sdata);
         if (!old_beacon)
                 return -ENOENT;
-        old_probe_resp = rtnl_dereference(sdata->u.ap.probe_resp);
+        old_probe_resp = sdata_dereference(sdata->u.ap.probe_resp, sdata);
 
         /* abort any running channel switch */
         sdata->vif.csa_active = false;
-        cancel_work_sync(&sdata->csa_finalize_work);
+        kfree(sdata->u.ap.next_beacon);
+        sdata->u.ap.next_beacon = NULL;
+
         cancel_work_sync(&sdata->u.ap.request_smps_work);
 
         /* turn off carrier for this interface and dependent VLANs */
@@ -1091,8 +1115,10 @@ static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED);
 
         if (sdata->wdev.cac_started) {
+                chandef = sdata->vif.bss_conf.chandef;
                 cancel_delayed_work_sync(&sdata->dfs_cac_timer_work);
-                cfg80211_cac_event(sdata->dev, NL80211_RADAR_CAC_ABORTED,
+                cfg80211_cac_event(sdata->dev, &chandef,
+                                   NL80211_RADAR_CAC_ABORTED,
                                    GFP_KERNEL);
         }
 
@@ -1953,7 +1979,7 @@ static int ieee80211_change_bss(struct wiphy *wiphy,
         enum ieee80211_band band;
         u32 changed = 0;
 
-        if (!rtnl_dereference(sdata->u.ap.beacon))
+        if (!sdata_dereference(sdata->u.ap.beacon, sdata))
                 return -ENOENT;
 
         band = ieee80211_get_sdata_band(sdata);
@@ -2964,27 +2990,33 @@ void ieee80211_csa_finalize_work(struct work_struct *work)
         struct ieee80211_local *local = sdata->local;
         int err, changed = 0;
 
+        sdata_lock(sdata);
+        /* AP might have been stopped while waiting for the lock. */
+        if (!sdata->vif.csa_active)
+                goto unlock;
+
         if (!ieee80211_sdata_running(sdata))
-                return;
+                goto unlock;
 
         sdata->radar_required = sdata->csa_radar_required;
-        err = ieee80211_vif_change_channel(sdata, &local->csa_chandef,
-                                           &changed);
+        err = ieee80211_vif_change_channel(sdata, &changed);
         if (WARN_ON(err < 0))
-                return;
+                goto unlock;
 
         if (!local->use_chanctx) {
-                local->_oper_chandef = local->csa_chandef;
+                local->_oper_chandef = sdata->csa_chandef;
                 ieee80211_hw_config(local, 0);
         }
 
         ieee80211_bss_info_change_notify(sdata, changed);
 
+        sdata->vif.csa_active = false;
         switch (sdata->vif.type) {
         case NL80211_IFTYPE_AP:
                 err = ieee80211_assign_beacon(sdata, sdata->u.ap.next_beacon);
                 if (err < 0)
-                        return;
+                        goto unlock;
+
                 changed |= err;
                 kfree(sdata->u.ap.next_beacon);
                 sdata->u.ap.next_beacon = NULL;
@@ -2998,20 +3030,22 @@ void ieee80211_csa_finalize_work(struct work_struct *work)
         case NL80211_IFTYPE_MESH_POINT:
                 err = ieee80211_mesh_finish_csa(sdata);
                 if (err < 0)
-                        return;
+                        goto unlock;
                 break;
 #endif
         default:
                 WARN_ON(1);
-                return;
+                goto unlock;
         }
-        sdata->vif.csa_active = false;
 
         ieee80211_wake_queues_by_reason(&sdata->local->hw,
                                         IEEE80211_MAX_QUEUE_MAP,
                                         IEEE80211_QUEUE_STOP_REASON_CSA);
 
-        cfg80211_ch_switch_notify(sdata->dev, &local->csa_chandef);
+        cfg80211_ch_switch_notify(sdata->dev, &sdata->csa_chandef);
+
+unlock:
+        sdata_unlock(sdata);
 }
 
 static int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
@@ -3024,6 +3058,8 @@ static int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
         struct ieee80211_if_mesh __maybe_unused *ifmsh;
         int err, num_chanctx;
 
+        lockdep_assert_held(&sdata->wdev.mtx);
+
         if (!list_empty(&local->roc_list) || local->scanning)
                 return -EBUSY;
 
@@ -3136,7 +3172,7 @@ static int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
                                 IEEE80211_MAX_QUEUE_MAP,
                                 IEEE80211_QUEUE_STOP_REASON_CSA);
 
-        local->csa_chandef = params->chandef;
+        sdata->csa_chandef = params->chandef;
         sdata->vif.csa_active = true;
 
         ieee80211_bss_info_change_notify(sdata, err);
@@ -3146,26 +3182,25 @@ static int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
 }
 
 static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
-                             struct ieee80211_channel *chan, bool offchan,
-                             unsigned int wait, const u8 *buf, size_t len,
-                             bool no_cck, bool dont_wait_for_ack, u64 *cookie)
+                             struct cfg80211_mgmt_tx_params *params,
+                             u64 *cookie)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb;
         struct sta_info *sta;
-        const struct ieee80211_mgmt *mgmt = (void *)buf;
+        const struct ieee80211_mgmt *mgmt = (void *)params->buf;
         bool need_offchan = false;
         u32 flags;
         int ret;
 
-        if (dont_wait_for_ack)
+        if (params->dont_wait_for_ack)
                 flags = IEEE80211_TX_CTL_NO_ACK;
         else
                 flags = IEEE80211_TX_INTFL_NL80211_FRAME_TX |
                         IEEE80211_TX_CTL_REQ_TX_STATUS;
 
-        if (no_cck)
+        if (params->no_cck)
                 flags |= IEEE80211_TX_CTL_NO_CCK_RATE;
 
         switch (sdata->vif.type) {
@@ -3213,7 +3248,7 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
         /* configurations requiring offchan cannot work if no channel has been
          * specified
          */
-        if (need_offchan && !chan)
+        if (need_offchan && !params->chan)
                 return -EINVAL;
 
         mutex_lock(&local->mtx);
@@ -3226,8 +3261,10 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
                 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
 
                 if (chanctx_conf) {
-                        need_offchan = chan && (chan != chanctx_conf->def.chan);
-                } else if (!chan) {
+                        need_offchan = params->chan &&
+                                       (params->chan !=
+                                        chanctx_conf->def.chan);
+                } else if (!params->chan) {
                         ret = -EINVAL;
                         rcu_read_unlock();
                         goto out_unlock;
@@ -3237,19 +3274,19 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
                 rcu_read_unlock();
         }
 
-        if (need_offchan && !offchan) {
+        if (need_offchan && !params->offchan) {
                 ret = -EBUSY;
                 goto out_unlock;
         }
 
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom + len);
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom + params->len);
         if (!skb) {
                 ret = -ENOMEM;
                 goto out_unlock;
         }
         skb_reserve(skb, local->hw.extra_tx_headroom);
 
-        memcpy(skb_put(skb, len), buf, len);
+        memcpy(skb_put(skb, params->len), params->buf, params->len);
 
         IEEE80211_SKB_CB(skb)->flags = flags;
 
@@ -3269,8 +3306,8 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
                         local->hw.offchannel_tx_hw_queue;
 
         /* This will handle all kinds of coalescing and immediate TX */
-        ret = ieee80211_start_roc_work(local, sdata, chan,
-                                       wait, cookie, skb,
+        ret = ieee80211_start_roc_work(local, sdata, params->chan,
+                                       params->wait, cookie, skb,
                                        IEEE80211_ROC_TYPE_MGMT_TX);
         if (ret)
                 kfree_skb(skb);
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index 03ba6b5c5373..a57d5d9466bc 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -9,6 +9,140 @@
 #include "ieee80211_i.h"
 #include "driver-ops.h"
 
+static enum nl80211_chan_width ieee80211_get_sta_bw(struct ieee80211_sta *sta)
+{
+        switch (sta->bandwidth) {
+        case IEEE80211_STA_RX_BW_20:
+                if (sta->ht_cap.ht_supported)
+                        return NL80211_CHAN_WIDTH_20;
+                else
+                        return NL80211_CHAN_WIDTH_20_NOHT;
+        case IEEE80211_STA_RX_BW_40:
+                return NL80211_CHAN_WIDTH_40;
+        case IEEE80211_STA_RX_BW_80:
+                return NL80211_CHAN_WIDTH_80;
+        case IEEE80211_STA_RX_BW_160:
+                /*
+                 * This applied for both 160 and 80+80. since we use
+                 * the returned value to consider degradation of
+                 * ctx->conf.min_def, we have to make sure to take
+                 * the bigger one (NL80211_CHAN_WIDTH_160).
+                 * Otherwise we might try degrading even when not
+                 * needed, as the max required sta_bw returned (80+80)
+                 * might be smaller than the configured bw (160).
+                 */
+                return NL80211_CHAN_WIDTH_160;
+        default:
+                WARN_ON(1);
+                return NL80211_CHAN_WIDTH_20;
+        }
+}
+
+static enum nl80211_chan_width
+ieee80211_get_max_required_bw(struct ieee80211_sub_if_data *sdata)
+{
+        enum nl80211_chan_width max_bw = NL80211_CHAN_WIDTH_20_NOHT;
+        struct sta_info *sta;
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(sta, &sdata->local->sta_list, list) {
+                if (sdata != sta->sdata &&
+                    !(sta->sdata->bss && sta->sdata->bss == sdata->bss))
+                        continue;
+
+                if (!sta->uploaded)
+                        continue;
+
+                max_bw = max(max_bw, ieee80211_get_sta_bw(&sta->sta));
+        }
+        rcu_read_unlock();
+
+        return max_bw;
+}
+
+static enum nl80211_chan_width
+ieee80211_get_chanctx_max_required_bw(struct ieee80211_local *local,
+                                      struct ieee80211_chanctx_conf *conf)
+{
+        struct ieee80211_sub_if_data *sdata;
+        enum nl80211_chan_width max_bw = NL80211_CHAN_WIDTH_20_NOHT;
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+                struct ieee80211_vif *vif = &sdata->vif;
+                enum nl80211_chan_width width = NL80211_CHAN_WIDTH_20_NOHT;
+
+                if (!ieee80211_sdata_running(sdata))
+                        continue;
+
+                if (rcu_access_pointer(sdata->vif.chanctx_conf) != conf)
+                        continue;
+
+                switch (vif->type) {
+                case NL80211_IFTYPE_AP:
+                case NL80211_IFTYPE_AP_VLAN:
+                        width = ieee80211_get_max_required_bw(sdata);
+                        break;
+                case NL80211_IFTYPE_P2P_DEVICE:
+                        continue;
+                case NL80211_IFTYPE_STATION:
+                case NL80211_IFTYPE_ADHOC:
+                case NL80211_IFTYPE_WDS:
+                case NL80211_IFTYPE_MESH_POINT:
+                        width = vif->bss_conf.chandef.width;
+                        break;
+                case NL80211_IFTYPE_UNSPECIFIED:
+                case NUM_NL80211_IFTYPES:
+                case NL80211_IFTYPE_MONITOR:
+                case NL80211_IFTYPE_P2P_CLIENT:
+                case NL80211_IFTYPE_P2P_GO:
+                        WARN_ON_ONCE(1);
+                }
+                max_bw = max(max_bw, width);
+        }
+        rcu_read_unlock();
+
+        return max_bw;
+}
+
+/*
+ * recalc the min required chan width of the channel context, which is
+ * the max of min required widths of all the interfaces bound to this
+ * channel context.
+ */
+void ieee80211_recalc_chanctx_min_def(struct ieee80211_local *local,
+                                      struct ieee80211_chanctx *ctx)
+{
+        enum nl80211_chan_width max_bw;
+        struct cfg80211_chan_def min_def;
+
+        lockdep_assert_held(&local->chanctx_mtx);
+
+        /* don't optimize 5MHz, 10MHz, and radar_enabled confs */
+        if (ctx->conf.def.width == NL80211_CHAN_WIDTH_5 ||
+            ctx->conf.def.width == NL80211_CHAN_WIDTH_10 ||
+            ctx->conf.radar_enabled) {
+                ctx->conf.min_def = ctx->conf.def;
+                return;
+        }
+
+        max_bw = ieee80211_get_chanctx_max_required_bw(local, &ctx->conf);
+
+        /* downgrade chandef up to max_bw */
+        min_def = ctx->conf.def;
+        while (min_def.width > max_bw)
+                ieee80211_chandef_downgrade(&min_def);
+
+        if (cfg80211_chandef_identical(&ctx->conf.min_def, &min_def))
+                return;
+
+        ctx->conf.min_def = min_def;
+        if (!ctx->driver_present)
+                return;
+
+        drv_change_chanctx(local, ctx, IEEE80211_CHANCTX_CHANGE_MIN_WIDTH);
+}
+
 static void ieee80211_change_chanctx(struct ieee80211_local *local,
                                      struct ieee80211_chanctx *ctx,
                                      const struct cfg80211_chan_def *chandef)
@@ -20,6 +154,7 @@ static void ieee80211_change_chanctx(struct ieee80211_local *local,
 
         ctx->conf.def = *chandef;
         drv_change_chanctx(local, ctx, IEEE80211_CHANCTX_CHANGE_WIDTH);
+        ieee80211_recalc_chanctx_min_def(local, ctx);
 
         if (!local->use_chanctx) {
                 local->_oper_chandef = *chandef;
@@ -93,6 +228,7 @@ ieee80211_new_chanctx(struct ieee80211_local *local,
         ctx->conf.rx_chains_dynamic = 1;
         ctx->mode = mode;
         ctx->conf.radar_enabled = ieee80211_is_radar_required(local);
+        ieee80211_recalc_chanctx_min_def(local, ctx);
         if (!local->use_chanctx)
                 local->hw.conf.radar_enabled = ctx->conf.radar_enabled;
 
@@ -179,6 +315,7 @@ static int ieee80211_assign_vif_chanctx(struct ieee80211_sub_if_data *sdata,
         ctx->refcount++;
 
         ieee80211_recalc_txpower(sdata);
+        ieee80211_recalc_chanctx_min_def(local, ctx);
         sdata->vif.bss_conf.idle = false;
 
         if (sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE &&
@@ -243,6 +380,7 @@ static void ieee80211_unassign_vif_chanctx(struct ieee80211_sub_if_data *sdata,
                 ieee80211_recalc_chanctx_chantype(sdata->local, ctx);
                 ieee80211_recalc_smps_chanctx(local, ctx);
                 ieee80211_recalc_radar_chanctx(local, ctx);
+                ieee80211_recalc_chanctx_min_def(local, ctx);
         }
 }
 
@@ -411,12 +549,12 @@ int ieee80211_vif_use_channel(struct ieee80211_sub_if_data *sdata,
 }
 
 int ieee80211_vif_change_channel(struct ieee80211_sub_if_data *sdata,
-                                 const struct cfg80211_chan_def *chandef,
                                  u32 *changed)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_chanctx_conf *conf;
         struct ieee80211_chanctx *ctx;
+        const struct cfg80211_chan_def *chandef = &sdata->csa_chandef;
         int ret;
         u32 chanctx_changed = 0;
 
@@ -456,6 +594,7 @@ int ieee80211_vif_change_channel(struct ieee80211_sub_if_data *sdata,
         ieee80211_recalc_chanctx_chantype(local, ctx);
         ieee80211_recalc_smps_chanctx(local, ctx);
         ieee80211_recalc_radar_chanctx(local, ctx);
+        ieee80211_recalc_chanctx_min_def(local, ctx);
 
         ret = 0;
  out:
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index 5c090e41d9bb..fa16e54980a1 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -17,6 +17,172 @@
 
 #define DEBUGFS_FORMAT_BUFFER_SIZE 100
 
+#define TX_LATENCY_BIN_DELIMTER_C ','
+#define TX_LATENCY_BIN_DELIMTER_S ","
+#define TX_LATENCY_BINS_DISABLED "enable(bins disabled)\n"
+#define TX_LATENCY_DISABLED "disable\n"
+
+
+/*
+ * Display if Tx latency statistics & bins are enabled/disabled
+ */
+static ssize_t sta_tx_latency_stat_read(struct file *file,
+                                        char __user *userbuf,
+                                        size_t count, loff_t *ppos)
+{
+        struct ieee80211_local *local = file->private_data;
+        struct ieee80211_tx_latency_bin_ranges  *tx_latency;
+        char *buf;
+        int bufsz, i, ret;
+        int pos = 0;
+
+        rcu_read_lock();
+
+        tx_latency = rcu_dereference(local->tx_latency);
+
+        if (tx_latency && tx_latency->n_ranges) {
+                bufsz = tx_latency->n_ranges * 15;
+                buf = kzalloc(bufsz, GFP_ATOMIC);
+                if (!buf)
+                        goto err;
+
+                for (i = 0; i < tx_latency->n_ranges; i++)
+                        pos += scnprintf(buf + pos, bufsz - pos, "%d,",
+                                         tx_latency->ranges[i]);
+                pos += scnprintf(buf + pos, bufsz - pos, "\n");
+        } else if (tx_latency) {
+                bufsz = sizeof(TX_LATENCY_BINS_DISABLED) + 1;
+                buf = kzalloc(bufsz, GFP_ATOMIC);
+                if (!buf)
+                        goto err;
+
+                pos += scnprintf(buf + pos, bufsz - pos, "%s\n",
+                                 TX_LATENCY_BINS_DISABLED);
+        } else {
+                bufsz = sizeof(TX_LATENCY_DISABLED) + 1;
+                buf = kzalloc(bufsz, GFP_ATOMIC);
+                if (!buf)
+                        goto err;
+
+                pos += scnprintf(buf + pos, bufsz - pos, "%s\n",
+                                 TX_LATENCY_DISABLED);
+        }
+
+        rcu_read_unlock();
+
+        ret = simple_read_from_buffer(userbuf, count, ppos, buf, pos);
+        kfree(buf);
+
+        return ret;
+err:
+        rcu_read_unlock();
+        return -ENOMEM;
+}
+
+/*
+ * Receive input from user regarding Tx latency statistics
+ * The input should indicate if Tx latency statistics and bins are
+ * enabled/disabled.
+ * If bins are enabled input should indicate the amount of different bins and
+ * their ranges. Each bin will count how many Tx frames transmitted within the
+ * appropriate latency.
+ * Legal input is:
+ * a) "enable(bins disabled)" - to enable only general statistics
+ * b) "a,b,c,d,...z" - to enable general statistics and bins, where all are
+ * numbers and a < b < c < d.. < z
+ * c) "disable" - disable all statistics
+ * NOTE: must configure Tx latency statistics bins before stations connected.
+ */
+
+static ssize_t sta_tx_latency_stat_write(struct file *file,
+                                         const char __user *userbuf,
+                                         size_t count, loff_t *ppos)
+{
+        struct ieee80211_local *local = file->private_data;
+        char buf[128] = {};
+        char *bins = buf;
+        char *token;
+        int buf_size, i, alloc_size;
+        int prev_bin = 0;
+        int n_ranges = 0;
+        int ret = count;
+        struct ieee80211_tx_latency_bin_ranges  *tx_latency;
+
+        if (sizeof(buf) <= count)
+                return -EINVAL;
+        buf_size = count;
+        if (copy_from_user(buf, userbuf, buf_size))
+                return -EFAULT;
+
+        mutex_lock(&local->sta_mtx);
+
+        /* cannot change config once we have stations */
+        if (local->num_sta)
+                goto unlock;
+
+        tx_latency =
+                rcu_dereference_protected(local->tx_latency,
+                                          lockdep_is_held(&local->sta_mtx));
+
+        /* disable Tx statistics */
+        if (!strcmp(buf, TX_LATENCY_DISABLED)) {
+                if (!tx_latency)
+                        goto unlock;
+                rcu_assign_pointer(local->tx_latency, NULL);
+                synchronize_rcu();
+                kfree(tx_latency);
+                goto unlock;
+        }
+
+        /* Tx latency already enabled */
+        if (tx_latency)
+                goto unlock;
+
+        if (strcmp(TX_LATENCY_BINS_DISABLED, buf)) {
+                /* check how many bins and between what ranges user requested */
+                token = buf;
+                while (*token != '\0') {
+                        if (*token == TX_LATENCY_BIN_DELIMTER_C)
+                                n_ranges++;
+                        token++;
+                }
+                n_ranges++;
+        }
+
+        alloc_size = sizeof(struct ieee80211_tx_latency_bin_ranges) +
+                     n_ranges * sizeof(u32);
+        tx_latency = kzalloc(alloc_size, GFP_ATOMIC);
+        if (!tx_latency) {
+                ret = -ENOMEM;
+                goto unlock;
+        }
+        tx_latency->n_ranges = n_ranges;
+        for (i = 0; i < n_ranges; i++) { /* setting bin ranges */
+                token = strsep(&bins, TX_LATENCY_BIN_DELIMTER_S);
+                sscanf(token, "%d", &tx_latency->ranges[i]);
+                /* bins values should be in ascending order */
+                if (prev_bin >= tx_latency->ranges[i]) {
+                        ret = -EINVAL;
+                        kfree(tx_latency);
+                        goto unlock;
+                }
+                prev_bin = tx_latency->ranges[i];
+        }
+        rcu_assign_pointer(local->tx_latency, tx_latency);
+
+unlock:
+        mutex_unlock(&local->sta_mtx);
+
+        return ret;
+}
+
+static const struct file_operations stats_tx_latency_ops = {
+        .write = sta_tx_latency_stat_write,
+        .read = sta_tx_latency_stat_read,
+        .open = simple_open,
+        .llseek = generic_file_llseek,
+};
+
 int mac80211_format_buffer(char __user *userbuf, size_t count,
                                   loff_t *ppos, char *fmt, ...)
 {
@@ -315,4 +481,6 @@ void debugfs_hw_add(struct ieee80211_local *local)
         DEBUGFS_DEVSTATS_ADD(dot11RTSFailureCount);
         DEBUGFS_DEVSTATS_ADD(dot11FCSErrorCount);
         DEBUGFS_DEVSTATS_ADD(dot11RTSSuccessCount);
+
+        DEBUGFS_DEVSTATS_ADD(tx_latency);
 }
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index 19c54a44ed47..80194b557a0c 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -38,6 +38,13 @@ static const struct file_operations sta_ ##name## _ops = {		\
         .llseek = generic_file_llseek,                                  \
 }
 
+#define STA_OPS_W(name)                                                 \
+static const struct file_operations sta_ ##name## _ops = {              \
+        .write = sta_##name##_write,                                    \
+        .open = simple_open,                                            \
+        .llseek = generic_file_llseek,                                  \
+}
+
 #define STA_OPS_RW(name)                                                \
 static const struct file_operations sta_ ##name## _ops = {              \
         .read = sta_##name##_read,                                      \
@@ -388,6 +395,131 @@ static ssize_t sta_last_rx_rate_read(struct file *file, char __user *userbuf,
 }
 STA_OPS(last_rx_rate);
 
+static int
+sta_tx_latency_stat_header(struct ieee80211_tx_latency_bin_ranges *tx_latency,
+                           char *buf, int pos, int bufsz)
+{
+        int i;
+        int range_count = tx_latency->n_ranges;
+        u32 *bin_ranges = tx_latency->ranges;
+
+        pos += scnprintf(buf + pos, bufsz - pos,
+                          "Station\t\t\tTID\tMax\tAvg");
+        if (range_count) {
+                pos += scnprintf(buf + pos, bufsz - pos,
+                                  "\t<=%d", bin_ranges[0]);
+                for (i = 0; i < range_count - 1; i++)
+                        pos += scnprintf(buf + pos, bufsz - pos, "\t%d-%d",
+                                          bin_ranges[i], bin_ranges[i+1]);
+                pos += scnprintf(buf + pos, bufsz - pos,
+                                  "\t%d<", bin_ranges[range_count - 1]);
+        }
+
+        pos += scnprintf(buf + pos, bufsz - pos, "\n");
+
+        return pos;
+}
+
+static int
+sta_tx_latency_stat_table(struct ieee80211_tx_latency_bin_ranges *tx_lat_range,
+                          struct ieee80211_tx_latency_stat *tx_lat,
+                          char *buf, int pos, int bufsz, int tid)
+{
+        u32 avg = 0;
+        int j;
+        int bin_count = tx_lat->bin_count;
+
+        pos += scnprintf(buf + pos, bufsz - pos, "\t\t\t%d", tid);
+        /* make sure you don't divide in 0 */
+        if (tx_lat->counter)
+                avg = tx_lat->sum / tx_lat->counter;
+
+        pos += scnprintf(buf + pos, bufsz - pos, "\t%d\t%d",
+                          tx_lat->max, avg);
+
+        if (tx_lat_range->n_ranges && tx_lat->bins)
+                for (j = 0; j < bin_count; j++)
+                        pos += scnprintf(buf + pos, bufsz - pos,
+                                          "\t%d", tx_lat->bins[j]);
+        pos += scnprintf(buf + pos, bufsz - pos, "\n");
+
+        return pos;
+}
+
+/*
+ * Output Tx latency statistics station && restart all statistics information
+ */
+static ssize_t sta_tx_latency_stat_read(struct file *file,
+                                        char __user *userbuf,
+                                        size_t count, loff_t *ppos)
+{
+        struct sta_info *sta = file->private_data;
+        struct ieee80211_local *local = sta->local;
+        struct ieee80211_tx_latency_bin_ranges *tx_latency;
+        char *buf;
+        int bufsz, ret, i;
+        int pos = 0;
+
+        bufsz = 20 * IEEE80211_NUM_TIDS *
+                sizeof(struct ieee80211_tx_latency_stat);
+        buf = kzalloc(bufsz, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        rcu_read_lock();
+
+        tx_latency = rcu_dereference(local->tx_latency);
+
+        if (!sta->tx_lat) {
+                pos += scnprintf(buf + pos, bufsz - pos,
+                                 "Tx latency statistics are not enabled\n");
+                goto unlock;
+        }
+
+        pos = sta_tx_latency_stat_header(tx_latency, buf, pos, bufsz);
+
+        pos += scnprintf(buf + pos, bufsz - pos, "%pM\n", sta->sta.addr);
+        for (i = 0; i < IEEE80211_NUM_TIDS; i++)
+                pos = sta_tx_latency_stat_table(tx_latency, &sta->tx_lat[i],
+                                                buf, pos, bufsz, i);
+unlock:
+        rcu_read_unlock();
+
+        ret = simple_read_from_buffer(userbuf, count, ppos, buf, pos);
+        kfree(buf);
+
+        return ret;
+}
+STA_OPS(tx_latency_stat);
+
+static ssize_t sta_tx_latency_stat_reset_write(struct file *file,
+                                               const char __user *userbuf,
+                                               size_t count, loff_t *ppos)
+{
+        u32 *bins;
+        int bin_count;
+        struct sta_info *sta = file->private_data;
+        int i;
+
+        if (!sta->tx_lat)
+                return -EINVAL;
+
+        for (i = 0; i < IEEE80211_NUM_TIDS; i++) {
+                bins = sta->tx_lat[i].bins;
+                bin_count = sta->tx_lat[i].bin_count;
+
+                sta->tx_lat[i].max = 0;
+                sta->tx_lat[i].sum = 0;
+                sta->tx_lat[i].counter = 0;
+
+                if (bin_count)
+                        memset(bins, 0, bin_count * sizeof(u32));
+        }
+
+        return count;
+}
+STA_OPS_W(tx_latency_stat_reset);
+
 #define DEBUGFS_ADD(name) \
         debugfs_create_file(#name, 0400, \
                 sta->debugfs.dir, sta, &sta_ ##name## _ops);
@@ -441,6 +573,8 @@ void ieee80211_sta_debugfs_add(struct sta_info *sta)
         DEBUGFS_ADD(last_ack_signal);
         DEBUGFS_ADD(current_tx_rate);
         DEBUGFS_ADD(last_rx_rate);
+        DEBUGFS_ADD(tx_latency_stat);
+        DEBUGFS_ADD(tx_latency_stat_reset);
 
         DEBUGFS_ADD_COUNTER(rx_packets, rx_packets);
         DEBUGFS_ADD_COUNTER(tx_packets, tx_packets);
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 531be040b9ae..0f1fb5db4bdb 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -550,12 +550,12 @@ int ieee80211_ibss_finish_csa(struct ieee80211_sub_if_data *sdata)
                                         capability);
                 /* XXX: should not really modify cfg80211 data */
                 if (cbss) {
-                        cbss->channel = sdata->local->csa_chandef.chan;
+                        cbss->channel = sdata->csa_chandef.chan;
                         cfg80211_put_bss(sdata->local->hw.wiphy, cbss);
                 }
         }
 
-        ifibss->chandef = sdata->local->csa_chandef;
+        ifibss->chandef = sdata->csa_chandef;
 
         /* generate the beacon */
         err = ieee80211_ibss_csa_beacon(sdata, NULL);
@@ -922,7 +922,7 @@ ieee80211_ibss_process_chanswitch(struct ieee80211_sub_if_data *sdata,
                                 IEEE80211_MAX_QUEUE_MAP,
                                 IEEE80211_QUEUE_STOP_REASON_CSA);
 
-        sdata->local->csa_chandef = params.chandef;
+        sdata->csa_chandef = params.chandef;
         sdata->vif.csa_active = true;
 
         ieee80211_bss_info_change_notify(sdata, err);
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 29dc505be125..32bae218d6e5 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -728,6 +728,7 @@ struct ieee80211_sub_if_data {
         u16 sequence_number;
         __be16 control_port_protocol;
         bool control_port_no_encrypt;
+        int encrypt_headroom;
 
         struct ieee80211_tx_queue_params tx_conf[IEEE80211_NUM_ACS];
 
@@ -735,6 +736,7 @@ struct ieee80211_sub_if_data {
         int csa_counter_offset_beacon;
         int csa_counter_offset_presp;
         bool csa_radar_required;
+        struct cfg80211_chan_def csa_chandef;
 
         /* used to reconfigure hardware SM PS */
         struct work_struct recalc_smps;
@@ -811,6 +813,9 @@ static inline void sdata_unlock(struct ieee80211_sub_if_data *sdata)
         __release(&sdata->wdev.mtx);
 }
 
+#define sdata_dereference(p, sdata) \
+        rcu_dereference_protected(p, lockdep_is_held(&sdata->wdev.mtx))
+
 static inline void
 sdata_assert_lock(struct ieee80211_sub_if_data *sdata)
 {
@@ -896,6 +901,24 @@ struct tpt_led_trigger {
 };
 #endif
 
+/*
+ * struct ieee80211_tx_latency_bin_ranges - Tx latency statistics bins ranges
+ *
+ * Measuring Tx latency statistics. Counts how many Tx frames transmitted in a
+ * certain latency range (in Milliseconds). Each station that uses these
+ * ranges will have bins to count the amount of frames received in that range.
+ * The user can configure the ranges via debugfs.
+ * If ranges is NULL then Tx latency statistics bins are disabled for all
+ * stations.
+ *
+ * @n_ranges: number of ranges that are taken in account
+ * @ranges: the ranges that the user requested or NULL if disabled.
+ */
+struct ieee80211_tx_latency_bin_ranges {
+        int n_ranges;
+        u32 ranges[];
+};
+
 /**
  * mac80211 scan flags - currently active scan mode
  *
@@ -1048,6 +1071,12 @@ struct ieee80211_local {
         struct timer_list sta_cleanup;
         int sta_generation;
 
+        /*
+         * Tx latency statistics parameters for all stations.
+         * Can enable via debugfs (NULL when disabled).
+         */
+        struct ieee80211_tx_latency_bin_ranges __rcu *tx_latency;
+
         struct sk_buff_head pending[IEEE80211_MAX_QUEUES];
         struct tasklet_struct tx_pending_tasklet;
 
@@ -1093,7 +1122,6 @@ struct ieee80211_local {
         enum mac80211_scan_state next_scan_state;
         struct delayed_work scan_work;
         struct ieee80211_sub_if_data __rcu *scan_sdata;
-        struct cfg80211_chan_def csa_chandef;
         /* For backward compatibility only -- do not use */
         struct cfg80211_chan_def _oper_chandef;
 
@@ -1692,6 +1720,7 @@ int __ieee80211_request_smps_mgd(struct ieee80211_sub_if_data *sdata,
 int __ieee80211_request_smps_ap(struct ieee80211_sub_if_data *sdata,
                                 enum ieee80211_smps_mode smps_mode);
 void ieee80211_recalc_smps(struct ieee80211_sub_if_data *sdata);
+void ieee80211_recalc_min_chandef(struct ieee80211_sub_if_data *sdata);
 
 size_t ieee80211_ie_split(const u8 *ies, size_t ielen,
                           const u8 *ids, int n_ids, size_t offset);
@@ -1730,7 +1759,6 @@ ieee80211_vif_change_bandwidth(struct ieee80211_sub_if_data *sdata,
 /* NOTE: only use ieee80211_vif_change_channel() for channel switch */
 int __must_check
 ieee80211_vif_change_channel(struct ieee80211_sub_if_data *sdata,
-                             const struct cfg80211_chan_def *chandef,
                              u32 *changed);
 void ieee80211_vif_release_channel(struct ieee80211_sub_if_data *sdata);
 void ieee80211_vif_vlan_copy_chanctx(struct ieee80211_sub_if_data *sdata);
@@ -1741,6 +1769,8 @@ void ieee80211_recalc_smps_chanctx(struct ieee80211_local *local,
                                    struct ieee80211_chanctx *chanctx);
 void ieee80211_recalc_radar_chanctx(struct ieee80211_local *local,
                                     struct ieee80211_chanctx *chanctx);
+void ieee80211_recalc_chanctx_min_def(struct ieee80211_local *local,
+                                      struct ieee80211_chanctx *ctx);
 
 void ieee80211_dfs_cac_timer(unsigned long data);
 void ieee80211_dfs_cac_timer_work(struct work_struct *work);
@@ -1749,6 +1779,15 @@ void ieee80211_dfs_radar_detected_work(struct work_struct *work);
 int ieee80211_send_action_csa(struct ieee80211_sub_if_data *sdata,
                               struct cfg80211_csa_settings *csa_settings);
 
+bool ieee80211_cs_valid(const struct ieee80211_cipher_scheme *cs);
+bool ieee80211_cs_list_valid(const struct ieee80211_cipher_scheme *cs, int n);
+const struct ieee80211_cipher_scheme *
+ieee80211_cs_get(struct ieee80211_local *local, u32 cipher,
+                 enum nl80211_iftype iftype);
+int ieee80211_cs_headroom(struct ieee80211_local *local,
+                          struct cfg80211_crypto_settings *crypto,
+                          enum nl80211_iftype iftype);
+
 #ifdef CONFIG_MAC80211_NOINLINE
 #define debug_noinline noinline
 #else
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index ff101ea1d9ae..d226751ba63a 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -401,6 +401,8 @@ int ieee80211_add_virtual_monitor(struct ieee80211_local *local)
         snprintf(sdata->name, IFNAMSIZ, "%s-monitor",
                  wiphy_name(local->hw.wiphy));
 
+        sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
+
         ieee80211_set_default_queues(sdata);
 
         ret = drv_add_interface(local, sdata);
@@ -749,6 +751,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
         u32 hw_reconf_flags = 0;
         int i, flushed;
         struct ps_data *ps;
+        struct cfg80211_chan_def chandef;
 
         clear_bit(SDATA_STATE_RUNNING, &sdata->state);
 
@@ -823,11 +826,13 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
         cancel_delayed_work_sync(&sdata->dfs_cac_timer_work);
 
         if (sdata->wdev.cac_started) {
+                chandef = sdata->vif.bss_conf.chandef;
                 WARN_ON(local->suspended);
                 mutex_lock(&local->iflist_mtx);
                 ieee80211_vif_release_channel(sdata);
                 mutex_unlock(&local->iflist_mtx);
-                cfg80211_cac_event(sdata->dev, NL80211_RADAR_CAC_ABORTED,
+                cfg80211_cac_event(sdata->dev, &chandef,
+                                   NL80211_RADAR_CAC_ABORTED,
                                    GFP_KERNEL);
         }
 
@@ -1036,7 +1041,6 @@ static void ieee80211_set_multicast_list(struct net_device *dev)
  */
 static void ieee80211_teardown_sdata(struct ieee80211_sub_if_data *sdata)
 {
-        int flushed;
         int i;
 
         /* free extra data */
@@ -1050,9 +1054,6 @@ static void ieee80211_teardown_sdata(struct ieee80211_sub_if_data *sdata)
 
         if (ieee80211_vif_is_mesh(&sdata->vif))
                 mesh_rmc_free(sdata);
-
-        flushed = sta_info_flush(sdata);
-        WARN_ON(flushed);
 }
 
 static void ieee80211_uninit(struct net_device *dev)
@@ -1270,6 +1271,7 @@ static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
 
         sdata->control_port_protocol = cpu_to_be16(ETH_P_PAE);
         sdata->control_port_no_encrypt = false;
+        sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
 
         sdata->noack_map = 0;
 
@@ -1686,6 +1688,8 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
         sdata->ap_power_level = IEEE80211_UNSET_POWER_LEVEL;
         sdata->user_power_level = local->user_power_level;
 
+        sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
+
         /* setup type-dependent data */
         ieee80211_setup_sdata(sdata, type);
 
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 3e51dd7d98b3..e568d98167d0 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -260,25 +260,29 @@ static void ieee80211_key_replace(struct ieee80211_sub_if_data *sdata,
         int idx;
         bool defunikey, defmultikey, defmgmtkey;
 
+        /* caller must provide at least one old/new */
+        if (WARN_ON(!new && !old))
+                return;
+
         if (new)
                 list_add_tail(&new->list, &sdata->key_list);
 
-        if (sta && pairwise) {
-                rcu_assign_pointer(sta->ptk, new);
-        } else if (sta) {
-                if (old)
-                        idx = old->conf.keyidx;
-                else
-                        idx = new->conf.keyidx;
-                rcu_assign_pointer(sta->gtk[idx], new);
-        } else {
-                WARN_ON(new && old && new->conf.keyidx != old->conf.keyidx);
+        WARN_ON(new && old && new->conf.keyidx != old->conf.keyidx);
 
-                if (old)
-                        idx = old->conf.keyidx;
-                else
-                        idx = new->conf.keyidx;
+        if (old)
+                idx = old->conf.keyidx;
+        else
+                idx = new->conf.keyidx;
 
+        if (sta) {
+                if (pairwise) {
+                        rcu_assign_pointer(sta->ptk[idx], new);
+                        sta->ptk_idx = idx;
+                } else {
+                        rcu_assign_pointer(sta->gtk[idx], new);
+                        sta->gtk_idx = idx;
+                }
+        } else {
                 defunikey = old &&
                         old == key_mtx_dereference(sdata->local,
                                                 sdata->default_unicast_key);
@@ -312,9 +316,11 @@ static void ieee80211_key_replace(struct ieee80211_sub_if_data *sdata,
                 list_del(&old->list);
 }
 
-struct ieee80211_key *ieee80211_key_alloc(u32 cipher, int idx, size_t key_len,
-                                          const u8 *key_data,
-                                          size_t seq_len, const u8 *seq)
+struct ieee80211_key *
+ieee80211_key_alloc(u32 cipher, int idx, size_t key_len,
+                    const u8 *key_data,
+                    size_t seq_len, const u8 *seq,
+                    const struct ieee80211_cipher_scheme *cs)
 {
         struct ieee80211_key *key;
         int i, j, err;
@@ -393,6 +399,18 @@ struct ieee80211_key *ieee80211_key_alloc(u32 cipher, int idx, size_t key_len,
                         return ERR_PTR(err);
                 }
                 break;
+        default:
+                if (cs) {
+                        size_t len = (seq_len > MAX_PN_LEN) ?
+                                                MAX_PN_LEN : seq_len;
+
+                        key->conf.iv_len = cs->hdr_len;
+                        key->conf.icv_len = cs->mic_len;
+                        for (i = 0; i < IEEE80211_NUM_TIDS + 1; i++)
+                                for (j = 0; j < len; j++)
+                                        key->u.gen.rx_pn[i][j] =
+                                                        seq[len - j - 1];
+                }
         }
         memcpy(key->conf.key, key_data, key_len);
         INIT_LIST_HEAD(&key->list);
@@ -475,7 +493,7 @@ int ieee80211_key_link(struct ieee80211_key *key,
         mutex_lock(&sdata->local->key_mtx);
 
         if (sta && pairwise)
-                old_key = key_mtx_dereference(sdata->local, sta->ptk);
+                old_key = key_mtx_dereference(sdata->local, sta->ptk[idx]);
         else if (sta)
                 old_key = key_mtx_dereference(sdata->local, sta->gtk[idx]);
         else
@@ -625,8 +643,10 @@ void ieee80211_free_sta_keys(struct ieee80211_local *local,
                 list_add(&key->list, &keys);
         }
 
-        key = key_mtx_dereference(local, sta->ptk);
-        if (key) {
+        for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
+                key = key_mtx_dereference(local, sta->ptk[i]);
+                if (!key)
+                        continue;
                 ieee80211_key_replace(key->sdata, key->sta,
                                 key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE,
                                 key, NULL);
@@ -877,7 +897,7 @@ ieee80211_gtk_rekey_add(struct ieee80211_vif *vif,
 
         key = ieee80211_key_alloc(keyconf->cipher, keyconf->keyidx,
                                   keyconf->keylen, keyconf->key,
-                                  0, NULL);
+                                  0, NULL, NULL);
         if (IS_ERR(key))
                 return ERR_CAST(key);
 
diff --git a/net/mac80211/key.h b/net/mac80211/key.h
index aaae0ed37004..0aebb889caba 100644
--- a/net/mac80211/key.h
+++ b/net/mac80211/key.h
@@ -18,6 +18,7 @@
 
 #define NUM_DEFAULT_KEYS 4
 #define NUM_DEFAULT_MGMT_KEYS 2
+#define MAX_PN_LEN 16
 
 struct ieee80211_local;
 struct ieee80211_sub_if_data;
@@ -93,6 +94,10 @@ struct ieee80211_key {
                         u32 replays; /* dot11RSNAStatsCMACReplays */
                         u32 icverrors; /* dot11RSNAStatsCMACICVErrors */
                 } aes_cmac;
+                struct {
+                        /* generic cipher scheme */
+                        u8 rx_pn[IEEE80211_NUM_TIDS + 1][MAX_PN_LEN];
+                } gen;
         } u;
 
         /* number of times this key has been used */
@@ -113,9 +118,11 @@ struct ieee80211_key {
         struct ieee80211_key_conf conf;
 };
 
-struct ieee80211_key *ieee80211_key_alloc(u32 cipher, int idx, size_t key_len,
-                                          const u8 *key_data,
-                                          size_t seq_len, const u8 *seq);
+struct ieee80211_key *
+ieee80211_key_alloc(u32 cipher, int idx, size_t key_len,
+                    const u8 *key_data,
+                    size_t seq_len, const u8 *seq,
+                    const struct ieee80211_cipher_scheme *cs);
 /*
  * Insert a key into data structures (sdata, sta if necessary)
  * to make it used, free old key. On failure, also free the new key.
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 21d5d44444d0..8af75f0eed6d 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -651,15 +651,14 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
 }
 EXPORT_SYMBOL(ieee80211_alloc_hw);
 
-int ieee80211_register_hw(struct ieee80211_hw *hw)
+static int ieee80211_init_cipher_suites(struct ieee80211_local *local)
 {
-        struct ieee80211_local *local = hw_to_local(hw);
-        int result, i;
-        enum ieee80211_band band;
-        int channels, max_bitrates;
-        bool supp_ht, supp_vht;
-        netdev_features_t feature_whitelist;
-        struct cfg80211_chan_def dflt_chandef = {};
+        bool have_wep = !(IS_ERR(local->wep_tx_tfm) ||
+                          IS_ERR(local->wep_rx_tfm));
+        bool have_mfp = local->hw.flags & IEEE80211_HW_MFP_CAPABLE;
+        const struct ieee80211_cipher_scheme *cs = local->hw.cipher_schemes;
+        int n_suites = 0, r = 0, w = 0;
+        u32 *suites;
         static const u32 cipher_suites[] = {
                 /* keep WEP first, it may be removed below */
                 WLAN_CIPHER_SUITE_WEP40,
@@ -671,6 +670,93 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                 WLAN_CIPHER_SUITE_AES_CMAC
         };
 
+        /* Driver specifies the ciphers, we have nothing to do... */
+        if (local->hw.wiphy->cipher_suites && have_wep)
+                return 0;
+
+        /* Set up cipher suites if driver relies on mac80211 cipher defs */
+        if (!local->hw.wiphy->cipher_suites && !cs) {
+                local->hw.wiphy->cipher_suites = cipher_suites;
+                local->hw.wiphy->n_cipher_suites = ARRAY_SIZE(cipher_suites);
+
+                if (!have_mfp)
+                        local->hw.wiphy->n_cipher_suites--;
+
+                if (!have_wep) {
+                        local->hw.wiphy->cipher_suites += 2;
+                        local->hw.wiphy->n_cipher_suites -= 2;
+                }
+
+                return 0;
+        }
+
+        if (!local->hw.wiphy->cipher_suites) {
+                /*
+                 * Driver specifies cipher schemes only
+                 * We start counting ciphers defined by schemes, TKIP and CCMP
+                 */
+                n_suites = local->hw.n_cipher_schemes + 2;
+
+                /* check if we have WEP40 and WEP104 */
+                if (have_wep)
+                        n_suites += 2;
+
+                /* check if we have AES_CMAC */
+                if (have_mfp)
+                        n_suites++;
+
+                suites = kmalloc(sizeof(u32) * n_suites, GFP_KERNEL);
+                if (!suites)
+                        return -ENOMEM;
+
+                suites[w++] = WLAN_CIPHER_SUITE_CCMP;
+                suites[w++] = WLAN_CIPHER_SUITE_TKIP;
+
+                if (have_wep) {
+                        suites[w++] = WLAN_CIPHER_SUITE_WEP40;
+                        suites[w++] = WLAN_CIPHER_SUITE_WEP104;
+                }
+
+                if (have_mfp)
+                        suites[w++] = WLAN_CIPHER_SUITE_AES_CMAC;
+
+                for (r = 0; r < local->hw.n_cipher_schemes; r++)
+                        suites[w++] = cs[r].cipher;
+        } else {
+                /* Driver provides cipher suites, but we need to exclude WEP */
+                suites = kmemdup(local->hw.wiphy->cipher_suites,
+                                 sizeof(u32) * local->hw.wiphy->n_cipher_suites,
+                                 GFP_KERNEL);
+                if (!suites)
+                        return -ENOMEM;
+
+                for (r = 0; r < local->hw.wiphy->n_cipher_suites; r++) {
+                        u32 suite = local->hw.wiphy->cipher_suites[r];
+
+                        if (suite == WLAN_CIPHER_SUITE_WEP40 ||
+                            suite == WLAN_CIPHER_SUITE_WEP104)
+                                continue;
+                        suites[w++] = suite;
+                }
+        }
+
+        local->hw.wiphy->cipher_suites = suites;
+        local->hw.wiphy->n_cipher_suites = w;
+        local->wiphy_ciphers_allocated = true;
+
+        return 0;
+}
+
+int ieee80211_register_hw(struct ieee80211_hw *hw)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+        int result, i;
+        enum ieee80211_band band;
+        int channels, max_bitrates;
+        bool supp_ht, supp_vht;
+        netdev_features_t feature_whitelist;
+        struct cfg80211_chan_def dflt_chandef = {};
+
         if (hw->flags & IEEE80211_HW_QUEUE_CONTROL &&
             (local->hw.offchannel_tx_hw_queue == IEEE80211_INVAL_HW_QUEUE ||
              local->hw.offchannel_tx_hw_queue >= local->hw.queues))
@@ -851,43 +937,12 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         if (local->hw.wiphy->max_scan_ie_len)
                 local->hw.wiphy->max_scan_ie_len -= local->scan_ies_len;
 
-        /* Set up cipher suites unless driver already did */
-        if (!local->hw.wiphy->cipher_suites) {
-                local->hw.wiphy->cipher_suites = cipher_suites;
-                local->hw.wiphy->n_cipher_suites = ARRAY_SIZE(cipher_suites);
-                if (!(local->hw.flags & IEEE80211_HW_MFP_CAPABLE))
-                        local->hw.wiphy->n_cipher_suites--;
-        }
-        if (IS_ERR(local->wep_tx_tfm) || IS_ERR(local->wep_rx_tfm)) {
-                if (local->hw.wiphy->cipher_suites == cipher_suites) {
-                        local->hw.wiphy->cipher_suites += 2;
-                        local->hw.wiphy->n_cipher_suites -= 2;
-                } else {
-                        u32 *suites;
-                        int r, w = 0;
-
-                        /* Filter out WEP */
-
-                        suites = kmemdup(
-                                local->hw.wiphy->cipher_suites,
-                                sizeof(u32) * local->hw.wiphy->n_cipher_suites,
-                                GFP_KERNEL);
-                        if (!suites) {
-                                result = -ENOMEM;
-                                goto fail_wiphy_register;
-                        }
-                        for (r = 0; r < local->hw.wiphy->n_cipher_suites; r++) {
-                                u32 suite = local->hw.wiphy->cipher_suites[r];
-                                if (suite == WLAN_CIPHER_SUITE_WEP40 ||
-                                    suite == WLAN_CIPHER_SUITE_WEP104)
-                                        continue;
-                                suites[w++] = suite;
-                        }
-                        local->hw.wiphy->cipher_suites = suites;
-                        local->hw.wiphy->n_cipher_suites = w;
-                        local->wiphy_ciphers_allocated = true;
-                }
-        }
+        WARN_ON(!ieee80211_cs_list_valid(local->hw.cipher_schemes,
+                                         local->hw.n_cipher_schemes));
+
+        result = ieee80211_init_cipher_suites(local);
+        if (result < 0)
+                goto fail_wiphy_register;
 
         if (!local->ops->remain_on_channel)
                 local->hw.wiphy->max_remain_on_channel_duration = 5000;
@@ -1087,6 +1142,8 @@ void ieee80211_free_hw(struct ieee80211_hw *hw)
                      ieee80211_free_ack_frame, NULL);
         idr_destroy(&local->ack_status_frames);
 
+        kfree(rcu_access_pointer(local->tx_latency));
+
         wiphy_free(local->hw.wiphy);
 }
 EXPORT_SYMBOL(ieee80211_free_hw);
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 896fe3bd599e..330d1f71c0c9 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -674,8 +674,6 @@ ieee80211_mesh_build_beacon(struct ieee80211_if_mesh *ifmsh)
         rcu_read_lock();
         csa = rcu_dereference(ifmsh->csa);
         if (csa) {
-                __le16 pre_value;
-
                 pos = skb_put(skb, 13);
                 memset(pos, 0, 13);
                 *pos++ = WLAN_EID_CHANNEL_SWITCH;
@@ -697,8 +695,7 @@ ieee80211_mesh_build_beacon(struct ieee80211_if_mesh *ifmsh)
                           WLAN_EID_CHAN_SWITCH_PARAM_TX_RESTRICT : 0x00;
                 put_unaligned_le16(WLAN_REASON_MESH_CHAN, pos);
                 pos += 2;
-                pre_value = cpu_to_le16(ifmsh->pre_value);
-                memcpy(pos, &pre_value, 2);
+                put_unaligned_le16(ifmsh->pre_value, pos);
                 pos += 2;
         }
         rcu_read_unlock();
@@ -959,7 +956,7 @@ ieee80211_mesh_process_chnswitch(struct ieee80211_sub_if_data *sdata,
                                 IEEE80211_MAX_QUEUE_MAP,
                                 IEEE80211_QUEUE_STOP_REASON_CSA);
 
-        sdata->local->csa_chandef = params.chandef;
+        sdata->csa_chandef = params.chandef;
         sdata->vif.csa_active = true;
 
         ieee80211_bss_info_change_notify(sdata, err);
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index 2bc7fd2f787d..f39a19f9090f 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -215,8 +215,6 @@ int mesh_rmc_check(struct ieee80211_sub_if_data *sdata,
 bool mesh_matches_local(struct ieee80211_sub_if_data *sdata,
                         struct ieee802_11_elems *ie);
 void mesh_ids_set_default(struct ieee80211_if_mesh *mesh);
-void mesh_mgmt_ies_add(struct ieee80211_sub_if_data *sdata,
-                       struct sk_buff *skb);
 int mesh_add_meshconf_ie(struct ieee80211_sub_if_data *sdata,
                          struct sk_buff *skb);
 int mesh_add_meshid_ie(struct ieee80211_sub_if_data *sdata,
@@ -303,8 +301,8 @@ void mesh_mpath_table_grow(void);
 void mesh_mpp_table_grow(void);
 /* Mesh paths */
 int mesh_path_error_tx(struct ieee80211_sub_if_data *sdata,
-                       u8 ttl, const u8 *target, __le32 target_sn,
-                       __le16 target_rcode, const u8 *ra);
+                       u8 ttl, const u8 *target, u32 target_sn,
+                       u16 target_rcode, const u8 *ra);
 void mesh_path_assign_nexthop(struct mesh_path *mpath, struct sta_info *sta);
 void mesh_path_flush_pending(struct mesh_path *mpath);
 void mesh_path_tx_pending(struct mesh_path *mpath);
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 486819cd02cd..f9514685d45a 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -102,12 +102,11 @@ enum mpath_frame_type {
 static const u8 broadcast_addr[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
 
 static int mesh_path_sel_frame_tx(enum mpath_frame_type action, u8 flags,
-                                  const u8 *orig_addr, __le32 orig_sn,
+                                  const u8 *orig_addr, u32 orig_sn,
                                   u8 target_flags, const u8 *target,
-                                  __le32 target_sn, const u8 *da,
+                                  u32 target_sn, const u8 *da,
                                   u8 hop_count, u8 ttl,
-                                  __le32 lifetime, __le32 metric,
-                                  __le32 preq_id,
+                                  u32 lifetime, u32 metric, u32 preq_id,
                                   struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_local *local = sdata->local;
@@ -167,33 +166,33 @@ static int mesh_path_sel_frame_tx(enum mpath_frame_type action, u8 flags,
         if (action == MPATH_PREP) {
                 memcpy(pos, target, ETH_ALEN);
                 pos += ETH_ALEN;
-                memcpy(pos, &target_sn, 4);
+                put_unaligned_le32(target_sn, pos);
                 pos += 4;
         } else {
                 if (action == MPATH_PREQ) {
-                        memcpy(pos, &preq_id, 4);
+                        put_unaligned_le32(preq_id, pos);
                         pos += 4;
                 }
                 memcpy(pos, orig_addr, ETH_ALEN);
                 pos += ETH_ALEN;
-                memcpy(pos, &orig_sn, 4);
+                put_unaligned_le32(orig_sn, pos);
                 pos += 4;
         }
-        memcpy(pos, &lifetime, 4);      /* interval for RANN */
+        put_unaligned_le32(lifetime, pos); /* interval for RANN */
         pos += 4;
-        memcpy(pos, &metric, 4);
+        put_unaligned_le32(metric, pos);
         pos += 4;
         if (action == MPATH_PREQ) {
                 *pos++ = 1; /* destination count */
                 *pos++ = target_flags;
                 memcpy(pos, target, ETH_ALEN);
                 pos += ETH_ALEN;
-                memcpy(pos, &target_sn, 4);
+                put_unaligned_le32(target_sn, pos);
                 pos += 4;
         } else if (action == MPATH_PREP) {
                 memcpy(pos, orig_addr, ETH_ALEN);
                 pos += ETH_ALEN;
-                memcpy(pos, &orig_sn, 4);
+                put_unaligned_le32(orig_sn, pos);
                 pos += 4;
         }
 
@@ -239,8 +238,8 @@ static void prepare_frame_for_deferred_tx(struct ieee80211_sub_if_data *sdata,
  * frame directly but add it to the pending queue instead.
  */
 int mesh_path_error_tx(struct ieee80211_sub_if_data *sdata,
-                       u8 ttl, const u8 *target, __le32 target_sn,
-                       __le16 target_rcode, const u8 *ra)
+                       u8 ttl, const u8 *target, u32 target_sn,
+                       u16 target_rcode, const u8 *ra)
 {
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb;
@@ -254,13 +253,13 @@ int mesh_path_error_tx(struct ieee80211_sub_if_data *sdata,
                 return -EAGAIN;
 
         skb = dev_alloc_skb(local->tx_headroom +
-                            IEEE80211_ENCRYPT_HEADROOM +
+                            sdata->encrypt_headroom +
                             IEEE80211_ENCRYPT_TAILROOM +
                             hdr_len +
                             2 + 15 /* PERR IE */);
         if (!skb)
                 return -1;
-        skb_reserve(skb, local->tx_headroom + IEEE80211_ENCRYPT_HEADROOM);
+        skb_reserve(skb, local->tx_headroom + sdata->encrypt_headroom);
         mgmt = (struct ieee80211_mgmt *) skb_put(skb, hdr_len);
         memset(mgmt, 0, hdr_len);
         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
@@ -293,9 +292,9 @@ int mesh_path_error_tx(struct ieee80211_sub_if_data *sdata,
         pos++;
         memcpy(pos, target, ETH_ALEN);
         pos += ETH_ALEN;
-        memcpy(pos, &target_sn, 4);
+        put_unaligned_le32(target_sn, pos);
         pos += 4;
-        memcpy(pos, &target_rcode, 2);
+        put_unaligned_le16(target_rcode, pos);
 
         /* see note in function header */
         prepare_frame_for_deferred_tx(sdata, skb);
@@ -592,10 +591,9 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
                 if (ttl != 0) {
                         mhwmp_dbg(sdata, "replying to the PREQ\n");
                         mesh_path_sel_frame_tx(MPATH_PREP, 0, orig_addr,
-                                cpu_to_le32(orig_sn), 0, target_addr,
-                                cpu_to_le32(target_sn), mgmt->sa, 0, ttl,
-                                cpu_to_le32(lifetime), cpu_to_le32(metric),
-                                0, sdata);
+                                               orig_sn, 0, target_addr,
+                                               target_sn, mgmt->sa, 0, ttl,
+                                               lifetime, metric, 0, sdata);
                 } else {
                         ifmsh->mshstats.dropped_frames_ttl++;
                 }
@@ -625,11 +623,9 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
                 }
 
                 mesh_path_sel_frame_tx(MPATH_PREQ, flags, orig_addr,
-                                cpu_to_le32(orig_sn), target_flags, target_addr,
-                                cpu_to_le32(target_sn), da,
-                                hopcount, ttl, cpu_to_le32(lifetime),
-                                cpu_to_le32(metric), cpu_to_le32(preq_id),
-                                sdata);
+                                       orig_sn, target_flags, target_addr,
+                                       target_sn, da, hopcount, ttl, lifetime,
+                                       metric, preq_id, sdata);
                 if (!is_multicast_ether_addr(da))
                         ifmsh->mshstats.fwded_unicast++;
                 else
@@ -695,11 +691,9 @@ static void hwmp_prep_frame_process(struct ieee80211_sub_if_data *sdata,
         target_sn = PREP_IE_TARGET_SN(prep_elem);
         orig_sn = PREP_IE_ORIG_SN(prep_elem);
 
-        mesh_path_sel_frame_tx(MPATH_PREP, flags, orig_addr,
-                cpu_to_le32(orig_sn), 0, target_addr,
-                cpu_to_le32(target_sn), next_hop, hopcount,
-                ttl, cpu_to_le32(lifetime), cpu_to_le32(metric),
-                0, sdata);
+        mesh_path_sel_frame_tx(MPATH_PREP, flags, orig_addr, orig_sn, 0,
+                               target_addr, target_sn, next_hop, hopcount,
+                               ttl, lifetime, metric, 0, sdata);
         rcu_read_unlock();
 
         sdata->u.mesh.mshstats.fwded_unicast++;
@@ -750,8 +744,7 @@ static void hwmp_perr_frame_process(struct ieee80211_sub_if_data *sdata,
                         if (!ifmsh->mshcfg.dot11MeshForwarding)
                                 goto endperr;
                         mesh_path_error_tx(sdata, ttl, target_addr,
-                                           cpu_to_le32(target_sn),
-                                           cpu_to_le16(target_rcode),
+                                           target_sn, target_rcode,
                                            broadcast_addr);
                 } else
                         spin_unlock_bh(&mpath->state_lock);
@@ -847,11 +840,9 @@ static void hwmp_rann_frame_process(struct ieee80211_sub_if_data *sdata,
 
         if (ifmsh->mshcfg.dot11MeshForwarding) {
                 mesh_path_sel_frame_tx(MPATH_RANN, flags, orig_addr,
-                                       cpu_to_le32(orig_sn),
-                                       0, NULL, 0, broadcast_addr,
-                                       hopcount, ttl, cpu_to_le32(interval),
-                                       cpu_to_le32(metric + metric_txsta),
-                                       0, sdata);
+                                       orig_sn, 0, NULL, 0, broadcast_addr,
+                                       hopcount, ttl, interval,
+                                       metric + metric_txsta, 0, sdata);
         }
 
         rcu_read_unlock();
@@ -1049,11 +1040,9 @@ void mesh_path_start_discovery(struct ieee80211_sub_if_data *sdata)
 
         spin_unlock_bh(&mpath->state_lock);
         da = (mpath->is_root) ? mpath->rann_snd_addr : broadcast_addr;
-        mesh_path_sel_frame_tx(MPATH_PREQ, 0, sdata->vif.addr,
-                        cpu_to_le32(ifmsh->sn), target_flags, mpath->dst,
-                        cpu_to_le32(mpath->sn), da, 0,
-                        ttl, cpu_to_le32(lifetime), 0,
-                        cpu_to_le32(ifmsh->preq_id++), sdata);
+        mesh_path_sel_frame_tx(MPATH_PREQ, 0, sdata->vif.addr, ifmsh->sn,
+                               target_flags, mpath->dst, mpath->sn, da, 0,
+                               ttl, lifetime, 0, ifmsh->preq_id++, sdata);
         mod_timer(&mpath->timer, jiffies + mpath->discovery_timeout);
 
 enddiscovery:
@@ -1212,10 +1201,9 @@ void mesh_path_tx_root_frame(struct ieee80211_sub_if_data *sdata)
         switch (ifmsh->mshcfg.dot11MeshHWMPRootMode) {
         case IEEE80211_PROACTIVE_RANN:
                 mesh_path_sel_frame_tx(MPATH_RANN, flags, sdata->vif.addr,
-                               cpu_to_le32(++ifmsh->sn),
-                               0, NULL, 0, broadcast_addr,
-                               0, ifmsh->mshcfg.element_ttl,
-                               cpu_to_le32(interval), 0, 0, sdata);
+                                       ++ifmsh->sn, 0, NULL, 0, broadcast_addr,
+                                       0, ifmsh->mshcfg.element_ttl,
+                                       interval, 0, 0, sdata);
                 break;
         case IEEE80211_PROACTIVE_PREQ_WITH_PREP:
                 flags |= IEEE80211_PREQ_PROACTIVE_PREP_FLAG;
@@ -1224,11 +1212,10 @@ void mesh_path_tx_root_frame(struct ieee80211_sub_if_data *sdata)
                 target_flags |= IEEE80211_PREQ_TO_FLAG |
                                 IEEE80211_PREQ_USN_FLAG;
                 mesh_path_sel_frame_tx(MPATH_PREQ, flags, sdata->vif.addr,
-                                cpu_to_le32(++ifmsh->sn), target_flags,
-                                (u8 *) broadcast_addr, 0, broadcast_addr,
-                                0, ifmsh->mshcfg.element_ttl,
-                                cpu_to_le32(interval),
-                                0, cpu_to_le32(ifmsh->preq_id++), sdata);
+                                       ++ifmsh->sn, target_flags,
+                                       (u8 *) broadcast_addr, 0, broadcast_addr,
+                                       0, ifmsh->mshcfg.element_ttl, interval,
+                                       0, ifmsh->preq_id++, sdata);
                 break;
         default:
                 mhwmp_dbg(sdata, "Proactive mechanism not supported\n");
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 89aacfd2756d..7d050ed6fe5a 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -722,7 +722,6 @@ void mesh_plink_broken(struct sta_info *sta)
         struct mpath_node *node;
         struct ieee80211_sub_if_data *sdata = sta->sdata;
         int i;
-        __le16 reason = cpu_to_le16(WLAN_REASON_MESH_PATH_DEST_UNREACHABLE);
 
         rcu_read_lock();
         tbl = rcu_dereference(mesh_paths);
@@ -736,9 +735,9 @@ void mesh_plink_broken(struct sta_info *sta)
                         ++mpath->sn;
                         spin_unlock_bh(&mpath->state_lock);
                         mesh_path_error_tx(sdata,
-                                           sdata->u.mesh.mshcfg.element_ttl,
-                                           mpath->dst, cpu_to_le32(mpath->sn),
-                                           reason, bcast);
+                                sdata->u.mesh.mshcfg.element_ttl,
+                                mpath->dst, mpath->sn,
+                                WLAN_REASON_MESH_PATH_DEST_UNREACHABLE, bcast);
                 }
         }
         rcu_read_unlock();
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index 4301aa5aa227..cf83217103f9 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -19,12 +19,6 @@
 #define mod_plink_timer(s, t) (mod_timer(&s->plink_timer, \
                                 jiffies + HZ * t / 1000))
 
-/* We only need a valid sta if user configured a minimum rssi_threshold. */
-#define rssi_threshold_check(sta, sdata) \
-                (sdata->u.mesh.mshcfg.rssi_threshold == 0 ||\
-                (sta && (s8) -ewma_read(&sta->avg_signal) > \
-                sdata->u.mesh.mshcfg.rssi_threshold))
-
 enum plink_event {
         PLINK_UNDEFINED,
         OPN_ACPT,
@@ -61,7 +55,17 @@ static const char * const mplevents[] = {
 
 static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
                                enum ieee80211_self_protected_actioncode action,
-                               u8 *da, __le16 llid, __le16 plid, __le16 reason);
+                               u8 *da, u16 llid, u16 plid, u16 reason);
+
+
+/* We only need a valid sta if user configured a minimum rssi_threshold. */
+static bool rssi_threshold_check(struct ieee80211_sub_if_data *sdata,
+                                 struct sta_info *sta)
+{
+        s32 rssi_threshold = sdata->u.mesh.mshcfg.rssi_threshold;
+        return rssi_threshold == 0 ||
+               (sta && (s8) -ewma_read(&sta->avg_signal) > rssi_threshold);
+}
 
 /**
  * mesh_plink_fsm_restart - restart a mesh peer link finite state machine
@@ -242,7 +246,7 @@ u32 mesh_plink_deactivate(struct sta_info *sta)
 
         spin_lock_bh(&sta->lock);
         changed = __mesh_plink_deactivate(sta);
-        sta->reason = cpu_to_le16(WLAN_REASON_MESH_PEER_CANCELED);
+        sta->reason = WLAN_REASON_MESH_PEER_CANCELED;
         mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE,
                             sta->sta.addr, sta->llid, sta->plid,
                             sta->reason);
@@ -253,7 +257,7 @@ u32 mesh_plink_deactivate(struct sta_info *sta)
 
 static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
                                enum ieee80211_self_protected_actioncode action,
-                               u8 *da, __le16 llid, __le16 plid, __le16 reason)
+                               u8 *da, u16 llid, u16 plid, u16 reason)
 {
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb;
@@ -279,7 +283,7 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
                             2 + 8 + /* peering IE */
                             sdata->u.mesh.ie_len);
         if (!skb)
-                return -1;
+                return err;
         info = IEEE80211_SKB_CB(skb);
         skb_reserve(skb, local->tx_headroom);
         mgmt = (struct ieee80211_mgmt *) skb_put(skb, hdr_len);
@@ -301,7 +305,7 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
                 if (action == WLAN_SP_MESH_PEERING_CONFIRM) {
                         /* AID */
                         pos = skb_put(skb, 2);
-                        memcpy(pos + 2, &plid, 2);
+                        put_unaligned_le16(plid, pos + 2);
                 }
                 if (ieee80211_add_srates_ie(sdata, skb, true, band) ||
                     ieee80211_add_ext_srates_ie(sdata, skb, true, band) ||
@@ -343,14 +347,14 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
         *pos++ = ie_len;
         memcpy(pos, &peering_proto, 2);
         pos += 2;
-        memcpy(pos, &llid, 2);
+        put_unaligned_le16(llid, pos);
         pos += 2;
         if (include_plid) {
-                memcpy(pos, &plid, 2);
+                put_unaligned_le16(plid, pos);
                 pos += 2;
         }
         if (action == WLAN_SP_MESH_PEERING_CLOSE) {
-                memcpy(pos, &reason, 2);
+                put_unaligned_le16(reason, pos);
                 pos += 2;
         }
 
@@ -518,7 +522,7 @@ void mesh_neighbour_update(struct ieee80211_sub_if_data *sdata,
             sta->plink_state == NL80211_PLINK_LISTEN &&
             sdata->u.mesh.accepting_plinks &&
             sdata->u.mesh.mshcfg.auto_open_plinks &&
-            rssi_threshold_check(sta, sdata))
+            rssi_threshold_check(sdata, sta))
                 changed = mesh_plink_open(sta);
 
         ieee80211_mps_frame_release(sta, elems);
@@ -530,9 +534,10 @@ out:
 static void mesh_plink_timer(unsigned long data)
 {
         struct sta_info *sta;
-        __le16 llid, plid, reason;
+        u16 reason = 0;
         struct ieee80211_sub_if_data *sdata;
         struct mesh_config *mshcfg;
+        enum ieee80211_self_protected_actioncode action = 0;
 
         /*
          * This STA is valid because sta_info_destroy() will
@@ -553,9 +558,6 @@ static void mesh_plink_timer(unsigned long data)
         mpl_dbg(sta->sdata,
                 "Mesh plink timer for %pM fired on state %s\n",
                 sta->sta.addr, mplstates[sta->plink_state]);
-        reason = 0;
-        llid = sta->llid;
-        plid = sta->plid;
         sdata = sta->sdata;
         mshcfg = &sdata->u.mesh.mshcfg;
 
@@ -574,33 +576,31 @@ static void mesh_plink_timer(unsigned long data)
                                              rand % sta->plink_timeout;
                         ++sta->plink_retries;
                         mod_plink_timer(sta, sta->plink_timeout);
-                        spin_unlock_bh(&sta->lock);
-                        mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_OPEN,
-                                            sta->sta.addr, llid, 0, 0);
+                        action = WLAN_SP_MESH_PEERING_OPEN;
                         break;
                 }
-                reason = cpu_to_le16(WLAN_REASON_MESH_MAX_RETRIES);
+                reason = WLAN_REASON_MESH_MAX_RETRIES;
                 /* fall through on else */
         case NL80211_PLINK_CNF_RCVD:
                 /* confirm timer */
                 if (!reason)
-                        reason = cpu_to_le16(WLAN_REASON_MESH_CONFIRM_TIMEOUT);
+                        reason = WLAN_REASON_MESH_CONFIRM_TIMEOUT;
                 sta->plink_state = NL80211_PLINK_HOLDING;
                 mod_plink_timer(sta, mshcfg->dot11MeshHoldingTimeout);
-                spin_unlock_bh(&sta->lock);
-                mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE,
-                                    sta->sta.addr, llid, plid, reason);
+                action = WLAN_SP_MESH_PEERING_CLOSE;
                 break;
         case NL80211_PLINK_HOLDING:
                 /* holding timer */
                 del_timer(&sta->plink_timer);
                 mesh_plink_fsm_restart(sta);
-                spin_unlock_bh(&sta->lock);
                 break;
         default:
-                spin_unlock_bh(&sta->lock);
                 break;
         }
+        spin_unlock_bh(&sta->lock);
+        if (action)
+                mesh_plink_frame_tx(sdata, action, sta->sta.addr,
+                                    sta->llid, sta->plid, reason);
 }
 
 static inline void mesh_plink_timer_set(struct sta_info *sta, int timeout)
@@ -612,9 +612,40 @@ static inline void mesh_plink_timer_set(struct sta_info *sta, int timeout)
         add_timer(&sta->plink_timer);
 }
 
+static bool llid_in_use(struct ieee80211_sub_if_data *sdata,
+                        u16 llid)
+{
+        struct ieee80211_local *local = sdata->local;
+        bool in_use = false;
+        struct sta_info *sta;
+
+        rcu_read_lock();
+        list_for_each_entry_rcu(sta, &local->sta_list, list) {
+                if (!memcmp(&sta->llid, &llid, sizeof(llid))) {
+                        in_use = true;
+                        break;
+                }
+        }
+        rcu_read_unlock();
+
+        return in_use;
+}
+
+static u16 mesh_get_new_llid(struct ieee80211_sub_if_data *sdata)
+{
+        u16 llid;
+
+        do {
+                get_random_bytes(&llid, sizeof(llid));
+                /* for mesh PS we still only have the AID range for TIM bits */
+                llid = (llid % IEEE80211_MAX_AID) + 1;
+        } while (llid_in_use(sdata, llid));
+
+        return llid;
+}
+
 u32 mesh_plink_open(struct sta_info *sta)
 {
-        __le16 llid;
         struct ieee80211_sub_if_data *sdata = sta->sdata;
         u32 changed;
 
@@ -622,8 +653,7 @@ u32 mesh_plink_open(struct sta_info *sta)
                 return 0;
 
         spin_lock_bh(&sta->lock);
-        get_random_bytes(&llid, 2);
-        sta->llid = llid;
+        sta->llid = mesh_get_new_llid(sdata);
         if (sta->plink_state != NL80211_PLINK_LISTEN &&
             sta->plink_state != NL80211_PLINK_BLOCKED) {
                 spin_unlock_bh(&sta->lock);
@@ -640,7 +670,7 @@ u32 mesh_plink_open(struct sta_info *sta)
         changed = ieee80211_mps_local_status_update(sdata);
 
         mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_OPEN,
-                            sta->sta.addr, llid, 0, 0);
+                            sta->sta.addr, sta->llid, 0, 0);
         return changed;
 }
 
@@ -656,390 +686,147 @@ u32 mesh_plink_block(struct sta_info *sta)
         return changed;
 }
 
-
-void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata,
-                         struct ieee80211_mgmt *mgmt, size_t len,
-                         struct ieee80211_rx_status *rx_status)
+static void mesh_plink_close(struct ieee80211_sub_if_data *sdata,
+                             struct sta_info *sta,
+                             enum plink_event event)
 {
         struct mesh_config *mshcfg = &sdata->u.mesh.mshcfg;
-        struct ieee802_11_elems elems;
-        struct sta_info *sta;
-        enum plink_event event;
-        enum ieee80211_self_protected_actioncode ftype;
-        size_t baselen;
-        bool matches_local = true;
-        u8 ie_len;
-        u8 *baseaddr;
-        u32 changed = 0;
-        __le16 plid, llid, reason;
-
-        /* need action_code, aux */
-        if (len < IEEE80211_MIN_ACTION_SIZE + 3)
-                return;
-
-        if (sdata->u.mesh.user_mpm)
-                /* userspace must register for these */
-                return;
-
-        if (is_multicast_ether_addr(mgmt->da)) {
-                mpl_dbg(sdata,
-                        "Mesh plink: ignore frame from multicast address\n");
-                return;
-        }
-
-        baseaddr = mgmt->u.action.u.self_prot.variable;
-        baselen = (u8 *) mgmt->u.action.u.self_prot.variable - (u8 *) mgmt;
-        if (mgmt->u.action.u.self_prot.action_code ==
-                                                WLAN_SP_MESH_PEERING_CONFIRM) {
-                baseaddr += 4;
-                baselen += 4;
-        }
-        ieee802_11_parse_elems(baseaddr, len - baselen, true, &elems);
-
-        if (!elems.peering) {
-                mpl_dbg(sdata,
-                        "Mesh plink: missing necessary peer link ie\n");
-                return;
-        }
 
-        if (elems.rsn_len &&
-            sdata->u.mesh.security == IEEE80211_MESH_SEC_NONE) {
-                mpl_dbg(sdata,
-                        "Mesh plink: can't establish link with secure peer\n");
-                return;
-        }
+        u16 reason = (event == CLS_ACPT) ?
+                     WLAN_REASON_MESH_CLOSE : WLAN_REASON_MESH_CONFIG;
 
-        ftype = mgmt->u.action.u.self_prot.action_code;
-        ie_len = elems.peering_len;
-        if ((ftype == WLAN_SP_MESH_PEERING_OPEN && ie_len != 4) ||
-            (ftype == WLAN_SP_MESH_PEERING_CONFIRM && ie_len != 6) ||
-            (ftype == WLAN_SP_MESH_PEERING_CLOSE && ie_len != 6
-                                                        && ie_len != 8)) {
-                mpl_dbg(sdata,
-                        "Mesh plink: incorrect plink ie length %d %d\n",
-                        ftype, ie_len);
-                return;
-        }
-
-        if (ftype != WLAN_SP_MESH_PEERING_CLOSE &&
-            (!elems.mesh_id || !elems.mesh_config)) {
-                mpl_dbg(sdata, "Mesh plink: missing necessary ie\n");
-                return;
-        }
-        /* Note the lines below are correct, the llid in the frame is the plid
-         * from the point of view of this host.
-         */
-        memcpy(&plid, PLINK_GET_LLID(elems.peering), 2);
-        if (ftype == WLAN_SP_MESH_PEERING_CONFIRM ||
-            (ftype == WLAN_SP_MESH_PEERING_CLOSE && ie_len == 8))
-                memcpy(&llid, PLINK_GET_PLID(elems.peering), 2);
-
-        /* WARNING: Only for sta pointer, is dropped & re-acquired */
-        rcu_read_lock();
-
-        sta = sta_info_get(sdata, mgmt->sa);
-        if (!sta && ftype != WLAN_SP_MESH_PEERING_OPEN) {
-                mpl_dbg(sdata, "Mesh plink: cls or cnf from unknown peer\n");
-                rcu_read_unlock();
-                return;
-        }
-
-        if (ftype == WLAN_SP_MESH_PEERING_OPEN &&
-            !rssi_threshold_check(sta, sdata)) {
-                mpl_dbg(sdata, "Mesh plink: %pM does not meet rssi threshold\n",
-                        mgmt->sa);
-                rcu_read_unlock();
-                return;
-        }
-
-        if (sta && !test_sta_flag(sta, WLAN_STA_AUTH)) {
-                mpl_dbg(sdata, "Mesh plink: Action frame from non-authed peer\n");
-                rcu_read_unlock();
-                return;
-        }
+        sta->reason = reason;
+        sta->plink_state = NL80211_PLINK_HOLDING;
+        mod_plink_timer(sta, mshcfg->dot11MeshHoldingTimeout);
+}
 
-        if (sta && sta->plink_state == NL80211_PLINK_BLOCKED) {
-                rcu_read_unlock();
-                return;
-        }
+static u32 mesh_plink_establish(struct ieee80211_sub_if_data *sdata,
+                                struct sta_info *sta)
+{
+        struct mesh_config *mshcfg = &sdata->u.mesh.mshcfg;
+        u32 changed = 0;
 
-        /* Now we will figure out the appropriate event... */
-        event = PLINK_UNDEFINED;
-        if (ftype != WLAN_SP_MESH_PEERING_CLOSE &&
-            !mesh_matches_local(sdata, &elems)) {
-                matches_local = false;
-                switch (ftype) {
-                case WLAN_SP_MESH_PEERING_OPEN:
-                        event = OPN_RJCT;
-                        break;
-                case WLAN_SP_MESH_PEERING_CONFIRM:
-                        event = CNF_RJCT;
-                        break;
-                default:
-                        break;
-                }
-        }
+        del_timer(&sta->plink_timer);
+        sta->plink_state = NL80211_PLINK_ESTAB;
+        changed |= mesh_plink_inc_estab_count(sdata);
+        changed |= mesh_set_ht_prot_mode(sdata);
+        changed |= mesh_set_short_slot_time(sdata);
+        mpl_dbg(sdata, "Mesh plink with %pM ESTABLISHED\n", sta->sta.addr);
+        ieee80211_mps_sta_status_update(sta);
+        changed |= ieee80211_mps_set_sta_local_pm(sta, mshcfg->power_mode);
+        return changed;
+}
 
-        if (!sta && !matches_local) {
-                rcu_read_unlock();
-                reason = cpu_to_le16(WLAN_REASON_MESH_CONFIG);
-                llid = 0;
-                mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE,
-                                    mgmt->sa, llid, plid, reason);
-                return;
-        } else if (!sta) {
-                /* ftype == WLAN_SP_MESH_PEERING_OPEN */
-                if (!mesh_plink_free_count(sdata)) {
-                        mpl_dbg(sdata, "Mesh plink error: no more free plinks\n");
-                        rcu_read_unlock();
-                        return;
-                }
-                event = OPN_ACPT;
-        } else if (matches_local) {
-                switch (ftype) {
-                case WLAN_SP_MESH_PEERING_OPEN:
-                        if (!mesh_plink_free_count(sdata) ||
-                            (sta->plid && sta->plid != plid))
-                                event = OPN_IGNR;
-                        else
-                                event = OPN_ACPT;
-                        break;
-                case WLAN_SP_MESH_PEERING_CONFIRM:
-                        if (!mesh_plink_free_count(sdata) ||
-                            (sta->llid != llid || sta->plid != plid))
-                                event = CNF_IGNR;
-                        else
-                                event = CNF_ACPT;
-                        break;
-                case WLAN_SP_MESH_PEERING_CLOSE:
-                        if (sta->plink_state == NL80211_PLINK_ESTAB)
-                                /* Do not check for llid or plid. This does not
-                                 * follow the standard but since multiple plinks
-                                 * per sta are not supported, it is necessary in
-                                 * order to avoid a livelock when MP A sees an
-                                 * establish peer link to MP B but MP B does not
-                                 * see it. This can be caused by a timeout in
-                                 * B's peer link establishment or B beign
-                                 * restarted.
-                                 */
-                                event = CLS_ACPT;
-                        else if (sta->plid != plid)
-                                event = CLS_IGNR;
-                        else if (ie_len == 7 && sta->llid != llid)
-                                event = CLS_IGNR;
-                        else
-                                event = CLS_ACPT;
-                        break;
-                default:
-                        mpl_dbg(sdata, "Mesh plink: unknown frame subtype\n");
-                        rcu_read_unlock();
-                        return;
-                }
-        }
+/**
+ * mesh_plink_fsm - step @sta MPM based on @event
+ *
+ * @sdata: interface
+ * @sta: mesh neighbor
+ * @event: peering event
+ *
+ * Return: changed MBSS flags
+ */
+static u32 mesh_plink_fsm(struct ieee80211_sub_if_data *sdata,
+                          struct sta_info *sta, enum plink_event event)
+{
+        struct mesh_config *mshcfg = &sdata->u.mesh.mshcfg;
+        enum ieee80211_self_protected_actioncode action = 0;
+        u32 changed = 0;
 
-        if (event == OPN_ACPT) {
-                rcu_read_unlock();
-                /* allocate sta entry if necessary and update info */
-                sta = mesh_sta_info_get(sdata, mgmt->sa, &elems);
-                if (!sta) {
-                        mpl_dbg(sdata, "Mesh plink: failed to init peer!\n");
-                        rcu_read_unlock();
-                        return;
-                }
-        }
+        mpl_dbg(sdata, "peer %pM in state %s got event %s\n", sta->sta.addr,
+                mplstates[sta->plink_state], mplevents[event]);
 
-        mpl_dbg(sdata, "peer %pM in state %s got event %s\n", mgmt->sa,
-                       mplstates[sta->plink_state], mplevents[event]);
-        reason = 0;
         spin_lock_bh(&sta->lock);
         switch (sta->plink_state) {
-                /* spin_unlock as soon as state is updated at each case */
         case NL80211_PLINK_LISTEN:
                 switch (event) {
                 case CLS_ACPT:
                         mesh_plink_fsm_restart(sta);
-                        spin_unlock_bh(&sta->lock);
                         break;
                 case OPN_ACPT:
                         sta->plink_state = NL80211_PLINK_OPN_RCVD;
-                        sta->plid = plid;
-                        get_random_bytes(&llid, 2);
-                        sta->llid = llid;
+                        sta->llid = mesh_get_new_llid(sdata);
                         mesh_plink_timer_set(sta,
                                              mshcfg->dot11MeshRetryTimeout);
 
                         /* set the non-peer mode to active during peering */
                         changed |= ieee80211_mps_local_status_update(sdata);
-
-                        spin_unlock_bh(&sta->lock);
-                        mesh_plink_frame_tx(sdata,
-                                            WLAN_SP_MESH_PEERING_OPEN,
-                                            sta->sta.addr, llid, 0, 0);
-                        mesh_plink_frame_tx(sdata,
-                                            WLAN_SP_MESH_PEERING_CONFIRM,
-                                            sta->sta.addr, llid, plid, 0);
+                        action = WLAN_SP_MESH_PEERING_OPEN;
                         break;
                 default:
-                        spin_unlock_bh(&sta->lock);
                         break;
                 }
                 break;
-
         case NL80211_PLINK_OPN_SNT:
                 switch (event) {
                 case OPN_RJCT:
                 case CNF_RJCT:
-                        reason = cpu_to_le16(WLAN_REASON_MESH_CONFIG);
                 case CLS_ACPT:
-                        if (!reason)
-                                reason = cpu_to_le16(WLAN_REASON_MESH_CLOSE);
-                        sta->reason = reason;
-                        sta->plink_state = NL80211_PLINK_HOLDING;
-                        if (!mod_plink_timer(sta,
-                                             mshcfg->dot11MeshHoldingTimeout))
-                                sta->ignore_plink_timer = true;
-
-                        llid = sta->llid;
-                        spin_unlock_bh(&sta->lock);
-                        mesh_plink_frame_tx(sdata,
-                                            WLAN_SP_MESH_PEERING_CLOSE,
-                                            sta->sta.addr, llid, plid, reason);
+                        mesh_plink_close(sdata, sta, event);
+                        action = WLAN_SP_MESH_PEERING_CLOSE;
                         break;
                 case OPN_ACPT:
                         /* retry timer is left untouched */
                         sta->plink_state = NL80211_PLINK_OPN_RCVD;
-                        sta->plid = plid;
-                        llid = sta->llid;
-                        spin_unlock_bh(&sta->lock);
-                        mesh_plink_frame_tx(sdata,
-                                            WLAN_SP_MESH_PEERING_CONFIRM,
-                                            sta->sta.addr, llid, plid, 0);
+                        action = WLAN_SP_MESH_PEERING_CONFIRM;
                         break;
                 case CNF_ACPT:
                         sta->plink_state = NL80211_PLINK_CNF_RCVD;
                         if (!mod_plink_timer(sta,
                                              mshcfg->dot11MeshConfirmTimeout))
                                 sta->ignore_plink_timer = true;
-
-                        spin_unlock_bh(&sta->lock);
                         break;
                 default:
-                        spin_unlock_bh(&sta->lock);
                         break;
                 }
                 break;
-
         case NL80211_PLINK_OPN_RCVD:
                 switch (event) {
                 case OPN_RJCT:
                 case CNF_RJCT:
-                        reason = cpu_to_le16(WLAN_REASON_MESH_CONFIG);
                 case CLS_ACPT:
-                        if (!reason)
-                                reason = cpu_to_le16(WLAN_REASON_MESH_CLOSE);
-                        sta->reason = reason;
-                        sta->plink_state = NL80211_PLINK_HOLDING;
-                        if (!mod_plink_timer(sta,
-                                             mshcfg->dot11MeshHoldingTimeout))
-                                sta->ignore_plink_timer = true;
-
-                        llid = sta->llid;
-                        spin_unlock_bh(&sta->lock);
-                        mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE,
-                                            sta->sta.addr, llid, plid, reason);
+                        mesh_plink_close(sdata, sta, event);
+                        action = WLAN_SP_MESH_PEERING_CLOSE;
                         break;
                 case OPN_ACPT:
-                        llid = sta->llid;
-                        spin_unlock_bh(&sta->lock);
-                        mesh_plink_frame_tx(sdata,
-                                            WLAN_SP_MESH_PEERING_CONFIRM,
-                                            sta->sta.addr, llid, plid, 0);
+                        action = WLAN_SP_MESH_PEERING_CONFIRM;
                         break;
                 case CNF_ACPT:
-                        del_timer(&sta->plink_timer);
-                        sta->plink_state = NL80211_PLINK_ESTAB;
-                        spin_unlock_bh(&sta->lock);
-                        changed |= mesh_plink_inc_estab_count(sdata);
-                        changed |= mesh_set_ht_prot_mode(sdata);
-                        changed |= mesh_set_short_slot_time(sdata);
-                        mpl_dbg(sdata, "Mesh plink with %pM ESTABLISHED\n",
-                                sta->sta.addr);
-                        ieee80211_mps_sta_status_update(sta);
-                        changed |= ieee80211_mps_set_sta_local_pm(sta,
-                                                       mshcfg->power_mode);
+                        changed |= mesh_plink_establish(sdata, sta);
                         break;
                 default:
-                        spin_unlock_bh(&sta->lock);
                         break;
                 }
                 break;
-
         case NL80211_PLINK_CNF_RCVD:
                 switch (event) {
                 case OPN_RJCT:
                 case CNF_RJCT:
-                        reason = cpu_to_le16(WLAN_REASON_MESH_CONFIG);
                 case CLS_ACPT:
-                        if (!reason)
-                                reason = cpu_to_le16(WLAN_REASON_MESH_CLOSE);
-                        sta->reason = reason;
-                        sta->plink_state = NL80211_PLINK_HOLDING;
-                        if (!mod_plink_timer(sta,
-                                             mshcfg->dot11MeshHoldingTimeout))
-                                sta->ignore_plink_timer = true;
-
-                        llid = sta->llid;
-                        spin_unlock_bh(&sta->lock);
-                        mesh_plink_frame_tx(sdata,
-                                            WLAN_SP_MESH_PEERING_CLOSE,
-                                            sta->sta.addr, llid, plid, reason);
+                        mesh_plink_close(sdata, sta, event);
+                        action = WLAN_SP_MESH_PEERING_CLOSE;
                         break;
                 case OPN_ACPT:
-                        del_timer(&sta->plink_timer);
-                        sta->plink_state = NL80211_PLINK_ESTAB;
-                        spin_unlock_bh(&sta->lock);
-                        changed |= mesh_plink_inc_estab_count(sdata);
-                        changed |= mesh_set_ht_prot_mode(sdata);
-                        changed |= mesh_set_short_slot_time(sdata);
-                        mpl_dbg(sdata, "Mesh plink with %pM ESTABLISHED\n",
-                                sta->sta.addr);
-                        mesh_plink_frame_tx(sdata,
-                                            WLAN_SP_MESH_PEERING_CONFIRM,
-                                            sta->sta.addr, llid, plid, 0);
-                        ieee80211_mps_sta_status_update(sta);
-                        changed |= ieee80211_mps_set_sta_local_pm(sta,
-                                                        mshcfg->power_mode);
+                        changed |= mesh_plink_establish(sdata, sta);
+                        action = WLAN_SP_MESH_PEERING_CONFIRM;
                         break;
                 default:
-                        spin_unlock_bh(&sta->lock);
                         break;
                 }
                 break;
-
         case NL80211_PLINK_ESTAB:
                 switch (event) {
                 case CLS_ACPT:
-                        reason = cpu_to_le16(WLAN_REASON_MESH_CLOSE);
-                        sta->reason = reason;
                         changed |= __mesh_plink_deactivate(sta);
-                        sta->plink_state = NL80211_PLINK_HOLDING;
-                        llid = sta->llid;
-                        mod_plink_timer(sta, mshcfg->dot11MeshHoldingTimeout);
-                        spin_unlock_bh(&sta->lock);
                         changed |= mesh_set_ht_prot_mode(sdata);
                         changed |= mesh_set_short_slot_time(sdata);
-                        mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE,
-                                            sta->sta.addr, llid, plid, reason);
+                        mesh_plink_close(sdata, sta, event);
+                        action = WLAN_SP_MESH_PEERING_CLOSE;
                         break;
                 case OPN_ACPT:
-                        llid = sta->llid;
-                        spin_unlock_bh(&sta->lock);
-                        mesh_plink_frame_tx(sdata,
-                                            WLAN_SP_MESH_PEERING_CONFIRM,
-                                            sta->sta.addr, llid, plid, 0);
+                        action = WLAN_SP_MESH_PEERING_CONFIRM;
                         break;
                 default:
-                        spin_unlock_bh(&sta->lock);
                         break;
                 }
                 break;
@@ -1049,32 +836,271 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata,
                         if (del_timer(&sta->plink_timer))
                                 sta->ignore_plink_timer = 1;
                         mesh_plink_fsm_restart(sta);
-                        spin_unlock_bh(&sta->lock);
                         break;
                 case OPN_ACPT:
                 case CNF_ACPT:
                 case OPN_RJCT:
                 case CNF_RJCT:
-                        llid = sta->llid;
-                        reason = sta->reason;
-                        spin_unlock_bh(&sta->lock);
-                        mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE,
-                                            sta->sta.addr, llid, plid, reason);
+                        action = WLAN_SP_MESH_PEERING_CLOSE;
                         break;
                 default:
-                        spin_unlock_bh(&sta->lock);
+                        break;
                 }
                 break;
         default:
                 /* should not get here, PLINK_BLOCKED is dealt with at the
                  * beginning of the function
                  */
-                spin_unlock_bh(&sta->lock);
                 break;
         }
+        spin_unlock_bh(&sta->lock);
+        if (action) {
+                mesh_plink_frame_tx(sdata, action, sta->sta.addr,
+                                    sta->llid, sta->plid, sta->reason);
+
+                /* also send confirm in open case */
+                if (action == WLAN_SP_MESH_PEERING_OPEN) {
+                        mesh_plink_frame_tx(sdata,
+                                            WLAN_SP_MESH_PEERING_CONFIRM,
+                                            sta->sta.addr, sta->llid,
+                                            sta->plid, 0);
+                }
+        }
+
+        return changed;
+}
+
+/*
+ * mesh_plink_get_event - get correct MPM event
+ *
+ * @sdata: interface
+ * @sta: peer, leave NULL if processing a frame from a new suitable peer
+ * @elems: peering management IEs
+ * @ftype: frame type
+ * @llid: peer's peer link ID
+ * @plid: peer's local link ID
+ *
+ * Return: new peering event for @sta, but PLINK_UNDEFINED should be treated as
+ * an error.
+ */
+static enum plink_event
+mesh_plink_get_event(struct ieee80211_sub_if_data *sdata,
+                     struct sta_info *sta,
+                     struct ieee802_11_elems *elems,
+                     enum ieee80211_self_protected_actioncode ftype,
+                     u16 llid, u16 plid)
+{
+        enum plink_event event = PLINK_UNDEFINED;
+        u8 ie_len = elems->peering_len;
+        bool matches_local;
+
+        matches_local = (ftype == WLAN_SP_MESH_PEERING_CLOSE ||
+                         mesh_matches_local(sdata, elems));
+
+        /* deny open request from non-matching peer */
+        if (!matches_local && !sta) {
+                event = OPN_RJCT;
+                goto out;
+        }
+
+        if (!sta) {
+                if (ftype != WLAN_SP_MESH_PEERING_OPEN) {
+                        mpl_dbg(sdata, "Mesh plink: cls or cnf from unknown peer\n");
+                        goto out;
+                }
+                /* ftype == WLAN_SP_MESH_PEERING_OPEN */
+                if (!mesh_plink_free_count(sdata)) {
+                        mpl_dbg(sdata, "Mesh plink error: no more free plinks\n");
+                        goto out;
+                }
+        } else {
+                if (!test_sta_flag(sta, WLAN_STA_AUTH)) {
+                        mpl_dbg(sdata, "Mesh plink: Action frame from non-authed peer\n");
+                        goto out;
+                }
+                if (sta->plink_state == NL80211_PLINK_BLOCKED)
+                        goto out;
+        }
+
+        /* new matching peer */
+        if (!sta) {
+                event = OPN_ACPT;
+                goto out;
+        }
+
+        switch (ftype) {
+        case WLAN_SP_MESH_PEERING_OPEN:
+                if (!matches_local)
+                        event = OPN_RJCT;
+                if (!mesh_plink_free_count(sdata) ||
+                    (sta->plid && sta->plid != plid))
+                        event = OPN_IGNR;
+                else
+                        event = OPN_ACPT;
+                break;
+        case WLAN_SP_MESH_PEERING_CONFIRM:
+                if (!matches_local)
+                        event = CNF_RJCT;
+                if (!mesh_plink_free_count(sdata) ||
+                    (sta->llid != llid || sta->plid != plid))
+                        event = CNF_IGNR;
+                else
+                        event = CNF_ACPT;
+                break;
+        case WLAN_SP_MESH_PEERING_CLOSE:
+                if (sta->plink_state == NL80211_PLINK_ESTAB)
+                        /* Do not check for llid or plid. This does not
+                         * follow the standard but since multiple plinks
+                         * per sta are not supported, it is necessary in
+                         * order to avoid a livelock when MP A sees an
+                         * establish peer link to MP B but MP B does not
+                         * see it. This can be caused by a timeout in
+                         * B's peer link establishment or B beign
+                         * restarted.
+                         */
+                        event = CLS_ACPT;
+                else if (sta->plid != plid)
+                        event = CLS_IGNR;
+                else if (ie_len == 8 && sta->llid != llid)
+                        event = CLS_IGNR;
+                else
+                        event = CLS_ACPT;
+                break;
+        default:
+                mpl_dbg(sdata, "Mesh plink: unknown frame subtype\n");
+                break;
+        }
+
+out:
+        return event;
+}
 
+static void
+mesh_process_plink_frame(struct ieee80211_sub_if_data *sdata,
+                         struct ieee80211_mgmt *mgmt,
+                         struct ieee802_11_elems *elems)
+{
+
+        struct sta_info *sta;
+        enum plink_event event;
+        enum ieee80211_self_protected_actioncode ftype;
+        u32 changed = 0;
+        u8 ie_len = elems->peering_len;
+        __le16 _plid, _llid;
+        u16 plid, llid = 0;
+
+        if (!elems->peering) {
+                mpl_dbg(sdata,
+                        "Mesh plink: missing necessary peer link ie\n");
+                return;
+        }
+
+        if (elems->rsn_len &&
+            sdata->u.mesh.security == IEEE80211_MESH_SEC_NONE) {
+                mpl_dbg(sdata,
+                        "Mesh plink: can't establish link with secure peer\n");
+                return;
+        }
+
+        ftype = mgmt->u.action.u.self_prot.action_code;
+        if ((ftype == WLAN_SP_MESH_PEERING_OPEN && ie_len != 4) ||
+            (ftype == WLAN_SP_MESH_PEERING_CONFIRM && ie_len != 6) ||
+            (ftype == WLAN_SP_MESH_PEERING_CLOSE && ie_len != 6
+                                                        && ie_len != 8)) {
+                mpl_dbg(sdata,
+                        "Mesh plink: incorrect plink ie length %d %d\n",
+                        ftype, ie_len);
+                return;
+        }
+
+        if (ftype != WLAN_SP_MESH_PEERING_CLOSE &&
+            (!elems->mesh_id || !elems->mesh_config)) {
+                mpl_dbg(sdata, "Mesh plink: missing necessary ie\n");
+                return;
+        }
+        /* Note the lines below are correct, the llid in the frame is the plid
+         * from the point of view of this host.
+         */
+        memcpy(&_plid, PLINK_GET_LLID(elems->peering), sizeof(__le16));
+        plid = le16_to_cpu(_plid);
+        if (ftype == WLAN_SP_MESH_PEERING_CONFIRM ||
+            (ftype == WLAN_SP_MESH_PEERING_CLOSE && ie_len == 8)) {
+                memcpy(&_llid, PLINK_GET_PLID(elems->peering), sizeof(__le16));
+                llid = le16_to_cpu(_llid);
+        }
+
+        /* WARNING: Only for sta pointer, is dropped & re-acquired */
+        rcu_read_lock();
+
+        sta = sta_info_get(sdata, mgmt->sa);
+
+        if (ftype == WLAN_SP_MESH_PEERING_OPEN &&
+            !rssi_threshold_check(sdata, sta)) {
+                mpl_dbg(sdata, "Mesh plink: %pM does not meet rssi threshold\n",
+                        mgmt->sa);
+                goto unlock_rcu;
+        }
+
+        /* Now we will figure out the appropriate event... */
+        event = mesh_plink_get_event(sdata, sta, elems, ftype, llid, plid);
+
+        if (event == OPN_ACPT) {
+                rcu_read_unlock();
+                /* allocate sta entry if necessary and update info */
+                sta = mesh_sta_info_get(sdata, mgmt->sa, elems);
+                if (!sta) {
+                        mpl_dbg(sdata, "Mesh plink: failed to init peer!\n");
+                        goto unlock_rcu;
+                }
+                sta->plid = plid;
+        } else if (!sta && event == OPN_RJCT) {
+                mesh_plink_frame_tx(sdata, WLAN_SP_MESH_PEERING_CLOSE,
+                                    mgmt->sa, 0, plid,
+                                    WLAN_REASON_MESH_CONFIG);
+                goto unlock_rcu;
+        } else if (!sta || event == PLINK_UNDEFINED) {
+                /* something went wrong */
+                goto unlock_rcu;
+        }
+
+        changed |= mesh_plink_fsm(sdata, sta, event);
+
+unlock_rcu:
         rcu_read_unlock();
 
         if (changed)
                 ieee80211_mbss_info_change_notify(sdata, changed);
 }
+
+void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata,
+                         struct ieee80211_mgmt *mgmt, size_t len,
+                         struct ieee80211_rx_status *rx_status)
+{
+        struct ieee802_11_elems elems;
+        size_t baselen;
+        u8 *baseaddr;
+
+        /* need action_code, aux */
+        if (len < IEEE80211_MIN_ACTION_SIZE + 3)
+                return;
+
+        if (sdata->u.mesh.user_mpm)
+                /* userspace must register for these */
+                return;
+
+        if (is_multicast_ether_addr(mgmt->da)) {
+                mpl_dbg(sdata,
+                        "Mesh plink: ignore frame from multicast address\n");
+                return;
+        }
+
+        baseaddr = mgmt->u.action.u.self_prot.variable;
+        baselen = (u8 *) mgmt->u.action.u.self_prot.variable - (u8 *) mgmt;
+        if (mgmt->u.action.u.self_prot.action_code ==
+                                                WLAN_SP_MESH_PEERING_CONFIRM) {
+                baseaddr += 4;
+                baselen += 4;
+        }
+        ieee802_11_parse_elems(baseaddr, len - baselen, true, &elems);
+        mesh_process_plink_frame(sdata, mgmt, &elems);
+}
diff --git a/net/mac80211/mesh_ps.c b/net/mac80211/mesh_ps.c
index 0f79b78b5e86..2802f9d9279d 100644
--- a/net/mac80211/mesh_ps.c
+++ b/net/mac80211/mesh_ps.c
@@ -576,10 +576,9 @@ void ieee80211_mps_frame_release(struct sta_info *sta,
         int ac, buffer_local = 0;
         bool has_buffered = false;
 
-        /* TIM map only for LLID <= IEEE80211_MAX_AID */
         if (sta->plink_state == NL80211_PLINK_ESTAB)
                 has_buffered = ieee80211_check_tim(elems->tim, elems->tim_len,
-                                le16_to_cpu(sta->llid) % IEEE80211_MAX_AID);
+                                                   sta->llid);
 
         if (has_buffered)
                 mps_dbg(sta->sdata, "%pM indicates buffered frames\n",
diff --git a/net/mac80211/mesh_sync.c b/net/mac80211/mesh_sync.c
index 05a256b38e24..d1cf2d553499 100644
--- a/net/mac80211/mesh_sync.c
+++ b/net/mac80211/mesh_sync.c
@@ -92,12 +92,20 @@ static void mesh_sync_offset_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
         if (stype != IEEE80211_STYPE_BEACON)
                 return;
 
-        /* The current tsf is a first approximation for the timestamp
-         * for the received beacon.  Further down we try to get a
-         * better value from the rx_status->mactime field if
-         * available. Also we have to call drv_get_tsf() before
-         * entering the rcu-read section.*/
-        t_r = drv_get_tsf(local, sdata);
+        /*
+         * Get time when timestamp field was received.  If we don't
+         * have rx timestamps, then use current tsf as an approximation.
+         * drv_get_tsf() must be called before entering the rcu-read
+         * section.
+         */
+        if (ieee80211_have_rx_timestamp(rx_status))
+                t_r = ieee80211_calculate_rx_timestamp(local, rx_status,
+                                                       24 + 12 +
+                                                       elems->total_len +
+                                                       FCS_LEN,
+                                                       24);
+        else
+                t_r = drv_get_tsf(local, sdata);
 
         rcu_read_lock();
         sta = sta_info_get(sdata, mgmt->sa);
@@ -117,14 +125,6 @@ static void mesh_sync_offset_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
                 goto no_sync;
         }
 
-        if (ieee80211_have_rx_timestamp(rx_status))
-                /* time when timestamp field was received */
-                t_r = ieee80211_calculate_rx_timestamp(local, rx_status,
-                                                       24 + 12 +
-                                                       elems->total_len +
-                                                       FCS_LEN,
-                                                       24);
-
         /* Timing offset calculation (see 13.13.2.2.2) */
         t_t = le64_to_cpu(mgmt->u.beacon.timestamp);
         sta->t_offset = t_t - t_r;
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index d7504ab61a34..33bcf8018d8e 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -330,6 +330,16 @@ static int ieee80211_config_bw(struct ieee80211_sub_if_data *sdata,
         if (WARN_ON_ONCE(!sta))
                 return -EINVAL;
 
+        /*
+         * if bss configuration changed store the new one -
+         * this may be applicable even if channel is identical
+         */
+        ht_opmode = le16_to_cpu(ht_oper->operation_mode);
+        if (sdata->vif.bss_conf.ht_operation_mode != ht_opmode) {
+                *changed |= BSS_CHANGED_HT;
+                sdata->vif.bss_conf.ht_operation_mode = ht_opmode;
+        }
+
         chan = sdata->vif.bss_conf.chandef.chan;
         sband = local->hw.wiphy->bands[chan->band];
 
@@ -416,14 +426,6 @@ static int ieee80211_config_bw(struct ieee80211_sub_if_data *sdata,
                                          IEEE80211_RC_BW_CHANGED);
         }
 
-        ht_opmode = le16_to_cpu(ht_oper->operation_mode);
-
-        /* if bss configuration changed store the new one */
-        if (sdata->vif.bss_conf.ht_operation_mode != ht_opmode) {
-                *changed |= BSS_CHANGED_HT;
-                sdata->vif.bss_conf.ht_operation_mode = ht_opmode;
-        }
-
         return 0;
 }
 
@@ -714,7 +716,7 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
         }
 
         /* if present, add any custom IEs that go before HT */
-        if (assoc_data->ie_len && assoc_data->ie) {
+        if (assoc_data->ie_len) {
                 static const u8 before_ht[] = {
                         WLAN_EID_SSID,
                         WLAN_EID_SUPP_RATES,
@@ -748,7 +750,7 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
                                      &assoc_data->ap_vht_cap);
 
         /* if present, add any custom non-vendor IEs that go after HT */
-        if (assoc_data->ie_len && assoc_data->ie) {
+        if (assoc_data->ie_len) {
                 noffset = ieee80211_ie_split_vendor(assoc_data->ie,
                                                     assoc_data->ie_len,
                                                     offset);
@@ -779,7 +781,7 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
         }
 
         /* add any remaining custom (i.e. vendor specific here) IEs */
-        if (assoc_data->ie_len && assoc_data->ie) {
+        if (assoc_data->ie_len) {
                 noffset = assoc_data->ie_len;
                 pos = skb_put(skb, noffset - offset);
                 memcpy(pos, assoc_data->ie + offset, noffset - offset);
@@ -886,8 +888,7 @@ static void ieee80211_chswitch_work(struct work_struct *work)
         if (!ifmgd->associated)
                 goto out;
 
-        ret = ieee80211_vif_change_channel(sdata, &local->csa_chandef,
-                                           &changed);
+        ret = ieee80211_vif_change_channel(sdata, &changed);
         if (ret) {
                 sdata_info(sdata,
                            "vif channel switch failed, disconnecting\n");
@@ -897,7 +898,7 @@ static void ieee80211_chswitch_work(struct work_struct *work)
         }
 
         if (!local->use_chanctx) {
-                local->_oper_chandef = local->csa_chandef;
+                local->_oper_chandef = sdata->csa_chandef;
                 /* Call "hw_config" only if doing sw channel switch.
                  * Otherwise update the channel directly
                  */
@@ -908,7 +909,7 @@ static void ieee80211_chswitch_work(struct work_struct *work)
         }
 
         /* XXX: shouldn't really modify cfg80211-owned data! */
-        ifmgd->associated->channel = local->csa_chandef.chan;
+        ifmgd->associated->channel = sdata->csa_chandef.chan;
 
         /* XXX: wait for a beacon first? */
         ieee80211_wake_queues_by_reason(&local->hw,
@@ -1035,7 +1036,7 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
         }
         mutex_unlock(&local->chanctx_mtx);
 
-        local->csa_chandef = csa_ie.chandef;
+        sdata->csa_chandef = csa_ie.chandef;
 
         if (csa_ie.mode)
                 ieee80211_stop_queues_by_reason(&local->hw,
@@ -1398,10 +1399,12 @@ void ieee80211_dfs_cac_timer_work(struct work_struct *work)
         struct ieee80211_sub_if_data *sdata =
                 container_of(delayed_work, struct ieee80211_sub_if_data,
                              dfs_cac_timer_work);
+        struct cfg80211_chan_def chandef = sdata->vif.bss_conf.chandef;
 
         ieee80211_vif_release_channel(sdata);
-
-        cfg80211_cac_event(sdata->dev, NL80211_RADAR_CAC_FINISHED, GFP_KERNEL);
+        cfg80211_cac_event(sdata->dev, &chandef,
+                           NL80211_RADAR_CAC_FINISHED,
+                           GFP_KERNEL);
 }
 
 /* MLME */
@@ -1745,6 +1748,8 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
 
         ifmgd->flags = 0;
         ieee80211_vif_release_channel(sdata);
+
+        sdata->encrypt_headroom = IEEE80211_ENCRYPT_HEADROOM;
 }
 
 void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
@@ -4189,6 +4194,8 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
 
         sdata->control_port_protocol = req->crypto.control_port_ethertype;
         sdata->control_port_no_encrypt = req->crypto.control_port_no_encrypt;
+        sdata->encrypt_headroom = ieee80211_cs_headroom(local, &req->crypto,
+                                                        sdata->vif.type);
 
         /* kick off associate process */
 
diff --git a/net/mac80211/rate.h b/net/mac80211/rate.h
index 505bc0dea074..b95e16c07081 100644
--- a/net/mac80211/rate.h
+++ b/net/mac80211/rate.h
@@ -54,6 +54,8 @@ static inline void rate_control_rate_init(struct sta_info *sta)
         struct ieee80211_supported_band *sband;
         struct ieee80211_chanctx_conf *chanctx_conf;
 
+        ieee80211_sta_set_rx_nss(sta);
+
         if (!ref)
                 return;
 
@@ -67,8 +69,6 @@ static inline void rate_control_rate_init(struct sta_info *sta)
 
         sband = local->hw.wiphy->bands[chanctx_conf->def.chan->band];
 
-        ieee80211_sta_set_rx_nss(sta);
-
         ref->ops->rate_init(ref->priv, sband, &chanctx_conf->def, ista,
                             priv_sta);
         rcu_read_unlock();
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index 7fa1b36e6202..d2f19f7e7091 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -422,10 +422,9 @@ init_sample_table(struct minstrel_sta_info *mi)
         memset(mi->sample_table, 0xff, SAMPLE_COLUMNS * mi->n_rates);
 
         for (col = 0; col < SAMPLE_COLUMNS; col++) {
+                prandom_bytes(rnd, sizeof(rnd));
                 for (i = 0; i < mi->n_rates; i++) {
-                        get_random_bytes(rnd, sizeof(rnd));
                         new_idx = (i + rnd[i & 7]) % mi->n_rates;
-
                         while (SAMPLE_TBL(mi, new_idx, col) != 0xff)
                                 new_idx = (new_idx + 1) % mi->n_rates;
 
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index 5d60779a0c1b..b91655a0d8f0 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -135,7 +135,7 @@ minstrel_ht_update_rates(struct minstrel_priv *mp, struct minstrel_ht_sta *mi);
 static int
 minstrel_ht_get_group_idx(struct ieee80211_tx_rate *rate)
 {
-        return GROUP_IDX((rate->idx / MCS_GROUP_RATES) + 1,
+        return GROUP_IDX((rate->idx / 8) + 1,
                          !!(rate->flags & IEEE80211_TX_RC_SHORT_GI),
                          !!(rate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH));
 }
@@ -148,7 +148,7 @@ minstrel_ht_get_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
 
         if (rate->flags & IEEE80211_TX_RC_MCS) {
                 group = minstrel_ht_get_group_idx(rate);
-                idx = rate->idx % MCS_GROUP_RATES;
+                idx = rate->idx % 8;
         } else {
                 group = MINSTREL_CCK_GROUP;
 
@@ -636,8 +636,7 @@ minstrel_ht_set_rate(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
                 idx = mp->cck_rates[index % ARRAY_SIZE(mp->cck_rates)];
                 flags = 0;
         } else {
-                idx = index % MCS_GROUP_RATES +
-                      (group->streams - 1) * MCS_GROUP_RATES;
+                idx = index % MCS_GROUP_RATES + (group->streams - 1) * 8;
                 flags = IEEE80211_TX_RC_MCS | group->flags;
         }
 
@@ -701,12 +700,16 @@ minstrel_get_sample_rate(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
         if (!mi->sample_tries)
                 return -1;
 
-        mg = &mi->groups[mi->sample_group];
+        sample_group = mi->sample_group;
+        mg = &mi->groups[sample_group];
         sample_idx = sample_table[mg->column][mg->index];
+        minstrel_next_sample_idx(mi);
+
+        if (!(mg->supported & BIT(sample_idx)))
+                return -1;
+
         mr = &mg->rates[sample_idx];
-        sample_group = mi->sample_group;
         sample_idx += sample_group * MCS_GROUP_RATES;
-        minstrel_next_sample_idx(mi);
 
         /*
          * Sampling might add some overhead (RTS, no aggregation)
@@ -817,7 +820,7 @@ minstrel_ht_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
         }
 
         rate->idx = sample_idx % MCS_GROUP_RATES +
-                    (sample_group->streams - 1) * MCS_GROUP_RATES;
+                    (sample_group->streams - 1) * 8;
         rate->flags = IEEE80211_TX_RC_MCS | sample_group->flags;
 }
 
@@ -1052,10 +1055,9 @@ init_sample_table(void)
 
         memset(sample_table, 0xff, sizeof(sample_table));
         for (col = 0; col < SAMPLE_COLUMNS; col++) {
+                prandom_bytes(rnd, sizeof(rnd));
                 for (i = 0; i < MCS_GROUP_RATES; i++) {
-                        get_random_bytes(rnd, sizeof(rnd));
                         new_idx = (i + rnd[i]) % MCS_GROUP_RATES;
-
                         while (sample_table[col][new_idx] != 0xff)
                                 new_idx = (new_idx + 1) % MCS_GROUP_RATES;
 
diff --git a/net/mac80211/rc80211_minstrel_ht_debugfs.c b/net/mac80211/rc80211_minstrel_ht_debugfs.c
index df44a5ad8270..3e7d793de0c3 100644
--- a/net/mac80211/rc80211_minstrel_ht_debugfs.c
+++ b/net/mac80211/rc80211_minstrel_ht_debugfs.c
@@ -54,8 +54,7 @@ minstrel_ht_stats_dump(struct minstrel_ht_sta *mi, int i, char *p)
                         int r = bitrates[j % 4];
                         p += sprintf(p, " %2u.%1uM", r / 10, r % 10);
                 } else {
-                        p += sprintf(p, " MCS%-2u", (mg->streams - 1) *
-                                         MCS_GROUP_RATES + j);
+                        p += sprintf(p, " MCS%-2u", (mg->streams - 1) * 8 + j);
                 }
 
                 tp = mr->cur_tp / 10;
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index caecef870c0e..30ac6099da06 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -638,6 +638,27 @@ static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
         return le16_to_cpu(mmie->key_id);
 }
 
+static int iwl80211_get_cs_keyid(const struct ieee80211_cipher_scheme *cs,
+                                 struct sk_buff *skb)
+{
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        __le16 fc;
+        int hdrlen;
+        u8 keyid;
+
+        fc = hdr->frame_control;
+        hdrlen = ieee80211_hdrlen(fc);
+
+        if (skb->len < hdrlen + cs->hdr_len)
+                return -EINVAL;
+
+        skb_copy_bits(skb, hdrlen + cs->key_idx_off, &keyid, 1);
+        keyid &= cs->key_idx_mask;
+        keyid >>= cs->key_idx_shift;
+
+        return keyid;
+}
+
 static ieee80211_rx_result ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
@@ -729,9 +750,7 @@ static void ieee80211_release_reorder_frames(struct ieee80211_sub_if_data *sdata
         lockdep_assert_held(&tid_agg_rx->reorder_lock);
 
         while (ieee80211_sn_less(tid_agg_rx->head_seq_num, head_seq_num)) {
-                index = ieee80211_sn_sub(tid_agg_rx->head_seq_num,
-                                         tid_agg_rx->ssn) %
-                                                        tid_agg_rx->buf_size;
+                index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
                 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
                                                 frames);
         }
@@ -757,8 +776,7 @@ static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata,
         lockdep_assert_held(&tid_agg_rx->reorder_lock);
 
         /* release the buffer until next missing frame */
-        index = ieee80211_sn_sub(tid_agg_rx->head_seq_num,
-                                 tid_agg_rx->ssn) % tid_agg_rx->buf_size;
+        index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
         if (!tid_agg_rx->reorder_buf[index] &&
             tid_agg_rx->stored_mpdu_num) {
                 /*
@@ -793,15 +811,11 @@ static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata,
         } else while (tid_agg_rx->reorder_buf[index]) {
                 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
                                                 frames);
-                index = ieee80211_sn_sub(tid_agg_rx->head_seq_num,
-                                         tid_agg_rx->ssn) %
-                                                        tid_agg_rx->buf_size;
+                index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
         }
 
         if (tid_agg_rx->stored_mpdu_num) {
-                j = index = ieee80211_sn_sub(tid_agg_rx->head_seq_num,
-                                             tid_agg_rx->ssn) %
-                                                        tid_agg_rx->buf_size;
+                j = index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
 
                 for (; j != (index - 1) % tid_agg_rx->buf_size;
                      j = (j + 1) % tid_agg_rx->buf_size) {
@@ -861,8 +875,7 @@ static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata
 
         /* Now the new frame is always in the range of the reordering buffer */
 
-        index = ieee80211_sn_sub(mpdu_seq_num,
-                                 tid_agg_rx->ssn) % tid_agg_rx->buf_size;
+        index = mpdu_seq_num % tid_agg_rx->buf_size;
 
         /* check if we already stored this frame */
         if (tid_agg_rx->reorder_buf[index]) {
@@ -1368,6 +1381,7 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
         struct ieee80211_key *sta_ptk = NULL;
         int mmie_keyidx = -1;
         __le16 fc;
+        const struct ieee80211_cipher_scheme *cs = NULL;
 
         /*
          * Key selection 101
@@ -1405,11 +1419,19 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
 
         /* start without a key */
         rx->key = NULL;
+        fc = hdr->frame_control;
 
-        if (rx->sta)
-                sta_ptk = rcu_dereference(rx->sta->ptk);
+        if (rx->sta) {
+                int keyid = rx->sta->ptk_idx;
 
-        fc = hdr->frame_control;
+                if (ieee80211_has_protected(fc) && rx->sta->cipher_scheme) {
+                        cs = rx->sta->cipher_scheme;
+                        keyid = iwl80211_get_cs_keyid(cs, rx->skb);
+                        if (unlikely(keyid < 0))
+                                return RX_DROP_UNUSABLE;
+                }
+                sta_ptk = rcu_dereference(rx->sta->ptk[keyid]);
+        }
 
         if (!ieee80211_has_protected(fc))
                 mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);
@@ -1471,6 +1493,7 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
                 return RX_CONTINUE;
         } else {
                 u8 keyid;
+
                 /*
                  * The device doesn't give us the IV so we won't be
                  * able to look up the key. That's ok though, we
@@ -1486,15 +1509,21 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
 
                 hdrlen = ieee80211_hdrlen(fc);
 
-                if (rx->skb->len < 8 + hdrlen)
-                        return RX_DROP_UNUSABLE; /* TODO: count this? */
+                if (cs) {
+                        keyidx = iwl80211_get_cs_keyid(cs, rx->skb);
 
-                /*
-                 * no need to call ieee80211_wep_get_keyidx,
-                 * it verifies a bunch of things we've done already
-                 */
-                skb_copy_bits(rx->skb, hdrlen + 3, &keyid, 1);
-                keyidx = keyid >> 6;
+                        if (unlikely(keyidx < 0))
+                                return RX_DROP_UNUSABLE;
+                } else {
+                        if (rx->skb->len < 8 + hdrlen)
+                                return RX_DROP_UNUSABLE; /* TODO: count this? */
+                        /*
+                         * no need to call ieee80211_wep_get_keyidx,
+                         * it verifies a bunch of things we've done already
+                         */
+                        skb_copy_bits(rx->skb, hdrlen + 3, &keyid, 1);
+                        keyidx = keyid >> 6;
+                }
 
                 /* check per-station GTK first, if multicast packet */
                 if (is_multicast_ether_addr(hdr->addr1) && rx->sta)
@@ -1542,11 +1571,7 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
                 result = ieee80211_crypto_aes_cmac_decrypt(rx);
                 break;
         default:
-                /*
-                 * We can reach here only with HW-only algorithms
-                 * but why didn't it decrypt the frame?!
-                 */
-                return RX_DROP_UNUSABLE;
+                result = ieee80211_crypto_hw_decrypt(rx);
         }
 
         /* the hdr variable is invalid after the decrypt handlers */
@@ -2056,7 +2081,6 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
         struct ieee80211_sub_if_data *sdata = rx->sdata;
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
-        __le16 reason = cpu_to_le16(WLAN_REASON_MESH_PATH_NOFORWARD);
         u16 q, hdrlen;
 
         hdr = (struct ieee80211_hdr *) skb->data;
@@ -2164,7 +2188,9 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
         } else {
                 /* unable to resolve next hop */
                 mesh_path_error_tx(sdata, ifmsh->mshcfg.element_ttl,
-                                   fwd_hdr->addr3, 0, reason, fwd_hdr->addr2);
+                                   fwd_hdr->addr3, 0,
+                                   WLAN_REASON_MESH_PATH_NOFORWARD,
+                                   fwd_hdr->addr2);
                 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_no_route);
                 kfree_skb(fwd_skb);
                 return RX_DROP_MONITOR;
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 5ad66a83ef7f..c22cbb57b49d 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -526,7 +526,7 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
                 ieee80211_hw_config(local, 0);
 
                 if ((req->channels[0]->flags &
-                     IEEE80211_CHAN_PASSIVE_SCAN) ||
+                     IEEE80211_CHAN_NO_IR) ||
                     !local->scan_req->n_ssids) {
                         next_delay = IEEE80211_PASSIVE_CHANNEL_TIME;
                 } else {
@@ -572,7 +572,7 @@ ieee80211_scan_get_channel_time(struct ieee80211_channel *chan)
          * TODO: channel switching also consumes quite some time,
          * add that delay as well to get a better estimation
          */
-        if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
+        if (chan->flags & IEEE80211_CHAN_NO_IR)
                 return IEEE80211_PASSIVE_CHANNEL_TIME;
         return IEEE80211_PROBE_DELAY + IEEE80211_CHANNEL_TIME;
 }
@@ -696,7 +696,7 @@ static void ieee80211_scan_state_set_channel(struct ieee80211_local *local,
          *
          * In any case, it is not necessary for a passive scan.
          */
-        if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN ||
+        if (chan->flags & IEEE80211_CHAN_NO_IR ||
             !local->scan_req->n_ssids) {
                 *next_delay = IEEE80211_PASSIVE_CHANNEL_TIME;
                 local->next_scan_state = SCAN_DECISION;
@@ -881,7 +881,7 @@ int ieee80211_request_ibss_scan(struct ieee80211_sub_if_data *sdata,
                                 struct ieee80211_channel *tmp_ch =
                                     &local->hw.wiphy->bands[band]->channels[i];
 
-                                if (tmp_ch->flags & (IEEE80211_CHAN_NO_IBSS |
+                                if (tmp_ch->flags & (IEEE80211_CHAN_NO_IR |
                                                      IEEE80211_CHAN_DISABLED))
                                         continue;
 
@@ -895,7 +895,7 @@ int ieee80211_request_ibss_scan(struct ieee80211_sub_if_data *sdata,
 
                 local->int_scan_req->n_channels = n_ch;
         } else {
-                if (WARN_ON_ONCE(chan->flags & (IEEE80211_CHAN_NO_IBSS |
+                if (WARN_ON_ONCE(chan->flags & (IEEE80211_CHAN_NO_IR |
                                                 IEEE80211_CHAN_DISABLED)))
                         goto unlock;
 
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 1eb66e26e49d..8ed97f76c3cf 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -266,9 +266,17 @@ struct sta_info *sta_info_get_by_idx(struct ieee80211_sub_if_data *sdata,
  */
 void sta_info_free(struct ieee80211_local *local, struct sta_info *sta)
 {
+        int i;
+
         if (sta->rate_ctrl)
                 rate_control_free_sta(sta);
 
+        if (sta->tx_lat) {
+                for (i = 0; i < IEEE80211_NUM_TIDS; i++)
+                        kfree(sta->tx_lat[i].bins);
+                kfree(sta->tx_lat);
+        }
+
         sta_dbg(sta->sdata, "Destroyed STA %pM\n", sta->sta.addr);
 
         kfree(sta);
@@ -333,6 +341,7 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
         struct timespec uptime;
+        struct ieee80211_tx_latency_bin_ranges *tx_latency;
         int i;
 
         sta = kzalloc(sizeof(*sta) + local->hw.sta_data_size, gfp);
@@ -410,6 +419,31 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
                 }
         }
 
+        rcu_read_lock();
+
+        tx_latency = rcu_dereference(local->tx_latency);
+        /* init stations Tx latency statistics && TID bins */
+        if (tx_latency)
+                sta->tx_lat = kzalloc(IEEE80211_NUM_TIDS *
+                                      sizeof(struct ieee80211_tx_latency_stat),
+                                      GFP_ATOMIC);
+
+        /*
+         * if Tx latency and bins are enabled and the previous allocation
+         * succeeded
+         */
+        if (tx_latency && tx_latency->n_ranges && sta->tx_lat)
+                for (i = 0; i < IEEE80211_NUM_TIDS; i++) {
+                        /* size of bins is size of the ranges +1 */
+                        sta->tx_lat[i].bin_count =
+                                tx_latency->n_ranges + 1;
+                        sta->tx_lat[i].bins  = kcalloc(sta->tx_lat[i].bin_count,
+                                                       sizeof(u32),
+                                                       GFP_ATOMIC);
+                }
+
+        rcu_read_unlock();
+
         sta_dbg(sdata, "Allocated STA %pM\n", sta->sta.addr);
 
         return sta;
@@ -507,6 +541,7 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU)
 
         set_sta_flag(sta, WLAN_STA_INSERTED);
 
+        ieee80211_recalc_min_chandef(sdata);
         ieee80211_sta_debugfs_add(sta);
         rate_control_add_sta_debugfs(sta);
 
@@ -630,8 +665,8 @@ void sta_info_recalc_tim(struct sta_info *sta)
 #ifdef CONFIG_MAC80211_MESH
         } else if (ieee80211_vif_is_mesh(&sta->sdata->vif)) {
                 ps = &sta->sdata->u.mesh.ps;
-                /* TIM map only for PLID <= IEEE80211_MAX_AID */
-                id = le16_to_cpu(sta->plid) % IEEE80211_MAX_AID;
+                /* TIM map only for 1 <= PLID <= IEEE80211_MAX_AID */
+                id = sta->plid % (IEEE80211_MAX_AID + 1);
 #endif
         } else {
                 return;
@@ -869,6 +904,7 @@ int __must_check __sta_info_destroy(struct sta_info *sta)
 
         rate_control_remove_sta_debugfs(sta);
         ieee80211_sta_debugfs_remove(sta);
+        ieee80211_recalc_min_chandef(sdata);
 
         call_rcu(&sta->rcu_head, free_sta_rcu);
 
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 3ef06a26b9cb..0218caf5c14a 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -220,6 +220,25 @@ struct sta_ampdu_mlme {
         u8 dialog_token_allocator;
 };
 
+/*
+ * struct ieee80211_tx_latency_stat - Tx latency statistics
+ *
+ * Measures TX latency and jitter for a station per TID.
+ *
+ * @max: worst case latency
+ * @sum: sum of all latencies
+ * @counter: amount of Tx frames sent from interface
+ * @bins: each bin counts how many frames transmitted within a certain
+ * latency range. when disabled it is NULL.
+ * @bin_count: amount of bins.
+ */
+struct ieee80211_tx_latency_stat {
+        u32 max;
+        u32 sum;
+        u32 counter;
+        u32 *bins;
+        u32 bin_count;
+};
 
 /**
  * struct sta_info - STA information
@@ -231,8 +250,10 @@ struct sta_ampdu_mlme {
  * @hnext: hash table linked list pointer
  * @local: pointer to the global information
  * @sdata: virtual interface this station belongs to
- * @ptk: peer key negotiated with this station, if any
+ * @ptk: peer keys negotiated with this station, if any
+ * @ptk_idx: last installed peer key index
  * @gtk: group keys negotiated with this station, if any
+ * @gtk_idx: last installed group key index
  * @rate_ctrl: rate control algorithm reference
  * @rate_ctrl_priv: rate control private per-STA pointer
  * @last_tx_rate: rate used for last transmit, to report to userspace as
@@ -274,6 +295,7 @@ struct sta_ampdu_mlme {
  * @tid_seq: per-TID sequence numbers for sending to this STA
  * @ampdu_mlme: A-MPDU state machine state
  * @timer_to_tid: identity mapping to ID timers
+ * @tx_lat: Tx latency statistics
  * @llid: Local link ID
  * @plid: Peer link ID
  * @reason: Cancel reason on PLINK_HOLDING state
@@ -303,6 +325,7 @@ struct sta_ampdu_mlme {
  * @chain_signal_avg: signal average (per chain)
  * @known_smps_mode: the smps_mode the client thinks we are in. Relevant for
  *      AP only.
+ * @cipher_scheme: optional cipher scheme for this station
  */
 struct sta_info {
         /* General information, mostly static */
@@ -312,7 +335,9 @@ struct sta_info {
         struct ieee80211_local *local;
         struct ieee80211_sub_if_data *sdata;
         struct ieee80211_key __rcu *gtk[NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS];
-        struct ieee80211_key __rcu *ptk;
+        struct ieee80211_key __rcu *ptk[NUM_DEFAULT_KEYS];
+        u8 gtk_idx;
+        u8 ptk_idx;
         struct rate_control_ref *rate_ctrl;
         void *rate_ctrl_priv;
         spinlock_t lock;
@@ -380,14 +405,16 @@ struct sta_info {
         struct sta_ampdu_mlme ampdu_mlme;
         u8 timer_to_tid[IEEE80211_NUM_TIDS];
 
+        struct ieee80211_tx_latency_stat *tx_lat;
+
 #ifdef CONFIG_MAC80211_MESH
         /*
          * Mesh peer link attributes
          * TODO: move to a sub-structure that is referenced with pointer?
          */
-        __le16 llid;
-        __le16 plid;
-        __le16 reason;
+        u16 llid;
+        u16 plid;
+        u16 reason;
         u8 plink_retries;
         bool ignore_plink_timer;
         enum nl80211_plink_state plink_state;
@@ -414,6 +441,7 @@ struct sta_info {
         unsigned int beacon_loss_count;
 
         enum ieee80211_smps_mode known_smps_mode;
+        const struct ieee80211_cipher_scheme *cipher_scheme;
 
         /* keep last! */
         struct ieee80211_sta sta;
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 52a152b01b06..1ee85c402439 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -11,6 +11,7 @@
 
 #include <linux/export.h>
 #include <linux/etherdevice.h>
+#include <linux/time.h>
 #include <net/mac80211.h>
 #include <asm/unaligned.h>
 #include "ieee80211_i.h"
@@ -463,6 +464,77 @@ static void ieee80211_report_used_skb(struct ieee80211_local *local,
 }
 
 /*
+ * Measure Tx frame completion and removal time for Tx latency statistics
+ * calculation. A single Tx frame latency should be measured from when it
+ * is entering the Kernel until we receive Tx complete confirmation indication
+ * and remove the skb.
+ */
+static void ieee80211_tx_latency_end_msrmnt(struct ieee80211_local *local,
+                                            struct sk_buff *skb,
+                                            struct sta_info *sta,
+                                            struct ieee80211_hdr *hdr)
+{
+        ktime_t skb_dprt;
+        struct timespec dprt_time;
+        u32 msrmnt;
+        u16 tid;
+        u8 *qc;
+        int i, bin_range_count, bin_count;
+        u32 *bin_ranges;
+        __le16 fc;
+        struct ieee80211_tx_latency_stat *tx_lat;
+        struct ieee80211_tx_latency_bin_ranges *tx_latency;
+        ktime_t skb_arv = skb->tstamp;
+
+        tx_latency = rcu_dereference(local->tx_latency);
+
+        /* assert Tx latency stats are enabled & frame arrived when enabled */
+        if (!tx_latency || !ktime_to_ns(skb_arv))
+                return;
+
+        fc = hdr->frame_control;
+
+        if (!ieee80211_is_data(fc)) /* make sure it is a data frame */
+                return;
+
+        /* get frame tid */
+        if (ieee80211_is_data_qos(hdr->frame_control)) {
+                qc = ieee80211_get_qos_ctl(hdr);
+                tid = qc[0] & IEEE80211_QOS_CTL_TID_MASK;
+        } else {
+                tid = 0;
+        }
+
+        tx_lat = &sta->tx_lat[tid];
+
+        ktime_get_ts(&dprt_time); /* time stamp completion time */
+        skb_dprt = ktime_set(dprt_time.tv_sec, dprt_time.tv_nsec);
+        msrmnt = ktime_to_ms(ktime_sub(skb_dprt, skb_arv));
+
+        if (tx_lat->max < msrmnt) /* update stats */
+                tx_lat->max = msrmnt;
+        tx_lat->counter++;
+        tx_lat->sum += msrmnt;
+
+        if (!tx_lat->bins) /* bins not activated */
+                return;
+
+        /* count how many Tx frames transmitted with the appropriate latency */
+        bin_range_count = tx_latency->n_ranges;
+        bin_ranges = tx_latency->ranges;
+        bin_count = tx_lat->bin_count;
+
+        for (i = 0; i < bin_range_count; i++) {
+                if (msrmnt <= bin_ranges[i]) {
+                        tx_lat->bins[i]++;
+                        break;
+                }
+        }
+        if (i == bin_range_count) /* msrmnt is bigger than the biggest range */
+                tx_lat->bins[i]++;
+}
+
+/*
  * Use a static threshold for now, best value to be determined
  * by testing ...
  * Should it depend on:
@@ -620,6 +692,12 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
 
                 if (acked)
                         sta->last_ack_signal = info->status.ack_signal;
+
+                /*
+                 * Measure frame removal for tx latency
+                 * statistics calculation
+                 */
+                ieee80211_tx_latency_end_msrmnt(local, skb, sta, hdr);
         }
 
         rcu_read_unlock();
diff --git a/net/mac80211/trace.h b/net/mac80211/trace.h
index d4cee98533fd..e9ccf22f6dd9 100644
--- a/net/mac80211/trace.h
+++ b/net/mac80211/trace.h
@@ -41,14 +41,31 @@
 #define CHANDEF_PR_ARG  __entry->control_freq, __entry->chan_width,                     \
                         __entry->center_freq1, __entry->center_freq2
 
+#define MIN_CHANDEF_ENTRY                                                               \
+                        __field(u32, min_control_freq)                                  \
+                        __field(u32, min_chan_width)                                    \
+                        __field(u32, min_center_freq1)                                  \
+                        __field(u32, min_center_freq2)
+
+#define MIN_CHANDEF_ASSIGN(c)                                                           \
+                        __entry->min_control_freq = (c)->chan ? (c)->chan->center_freq : 0;     \
+                        __entry->min_chan_width = (c)->width;                           \
+                        __entry->min_center_freq1 = (c)->center_freq1;                  \
+                        __entry->min_center_freq2 = (c)->center_freq2;
+#define MIN_CHANDEF_PR_FMT      " min_control:%d MHz min_width:%d min_center: %d/%d MHz"
+#define MIN_CHANDEF_PR_ARG      __entry->min_control_freq, __entry->min_chan_width,     \
+                        __entry->min_center_freq1, __entry->min_center_freq2
+
 #define CHANCTX_ENTRY   CHANDEF_ENTRY                                                   \
+                        MIN_CHANDEF_ENTRY                                               \
                         __field(u8, rx_chains_static)                                   \
                         __field(u8, rx_chains_dynamic)
 #define CHANCTX_ASSIGN  CHANDEF_ASSIGN(&ctx->conf.def)                                  \
+                        MIN_CHANDEF_ASSIGN(&ctx->conf.min_def)                          \
                         __entry->rx_chains_static = ctx->conf.rx_chains_static;         \
                         __entry->rx_chains_dynamic = ctx->conf.rx_chains_dynamic
-#define CHANCTX_PR_FMT  CHANDEF_PR_FMT " chains:%d/%d"
-#define CHANCTX_PR_ARG  CHANDEF_PR_ARG,                                                 \
+#define CHANCTX_PR_FMT  CHANDEF_PR_FMT MIN_CHANDEF_PR_FMT " chains:%d/%d"
+#define CHANCTX_PR_ARG  CHANDEF_PR_ARG, MIN_CHANDEF_PR_ARG,                             \
                         __entry->rx_chains_static, __entry->rx_chains_dynamic
 
 
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index c558b246ef00..6d59e21cdb9f 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -19,6 +19,7 @@
 #include <linux/bitmap.h>
 #include <linux/rcupdate.h>
 #include <linux/export.h>
+#include <linux/time.h>
 #include <net/net_namespace.h>
 #include <net/ieee80211_radiotap.h>
 #include <net/cfg80211.h>
@@ -557,7 +558,8 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
 
         if (unlikely(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT))
                 tx->key = NULL;
-        else if (tx->sta && (key = rcu_dereference(tx->sta->ptk)))
+        else if (tx->sta &&
+                 (key = rcu_dereference(tx->sta->ptk[tx->sta->ptk_idx])))
                 tx->key = key;
         else if (ieee80211_is_mgmt(hdr->frame_control) &&
                  is_multicast_ether_addr(hdr->addr1) &&
@@ -840,15 +842,16 @@ static int ieee80211_fragment(struct ieee80211_tx_data *tx,
                 rem -= fraglen;
                 tmp = dev_alloc_skb(local->tx_headroom +
                                     frag_threshold +
-                                    IEEE80211_ENCRYPT_HEADROOM +
+                                    tx->sdata->encrypt_headroom +
                                     IEEE80211_ENCRYPT_TAILROOM);
                 if (!tmp)
                         return -ENOMEM;
 
                 __skb_queue_tail(&tx->skbs, tmp);
 
-                skb_reserve(tmp, local->tx_headroom +
-                                 IEEE80211_ENCRYPT_HEADROOM);
+                skb_reserve(tmp,
+                            local->tx_headroom + tx->sdata->encrypt_headroom);
+
                 /* copy control information */
                 memcpy(tmp->cb, skb->cb, sizeof(tmp->cb));
 
@@ -1485,7 +1488,7 @@ void ieee80211_xmit(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
 
         headroom = local->tx_headroom;
         if (may_encrypt)
-                headroom += IEEE80211_ENCRYPT_HEADROOM;
+                headroom += sdata->encrypt_headroom;
         headroom -= skb_headroom(skb);
         headroom = max_t(int, 0, headroom);
 
@@ -1724,8 +1727,7 @@ netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
          * radar detection by itself. We can do that later by adding a
          * monitor flag interfaces used for AP support.
          */
-        if ((chan->flags & (IEEE80211_CHAN_NO_IBSS | IEEE80211_CHAN_RADAR |
-                            IEEE80211_CHAN_PASSIVE_SCAN)))
+        if ((chan->flags & (IEEE80211_CHAN_NO_IR | IEEE80211_CHAN_RADAR)))
                 goto fail_rcu;
 
         ieee80211_xmit(sdata, skb, chan->band);
@@ -1740,6 +1742,26 @@ fail:
         return NETDEV_TX_OK; /* meaning, we dealt with the skb */
 }
 
+/*
+ * Measure Tx frame arrival time for Tx latency statistics calculation
+ * A single Tx frame latency should be measured from when it is entering the
+ * Kernel until we receive Tx complete confirmation indication and the skb is
+ * freed.
+ */
+static void ieee80211_tx_latency_start_msrmnt(struct ieee80211_local *local,
+                                              struct sk_buff *skb)
+{
+        struct timespec skb_arv;
+        struct ieee80211_tx_latency_bin_ranges *tx_latency;
+
+        tx_latency = rcu_dereference(local->tx_latency);
+        if (!tx_latency)
+                return;
+
+        ktime_get_ts(&skb_arv);
+        skb->tstamp = ktime_set(skb_arv.tv_sec, skb_arv.tv_nsec);
+}
+
 /**
  * ieee80211_subif_start_xmit - netif start_xmit function for Ethernet-type
  * subinterfaces (wlan#, WDS, and VLAN interfaces)
@@ -1790,6 +1812,9 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
 
         rcu_read_lock();
 
+        /* Measure frame arrival for Tx latency statistics calculation */
+        ieee80211_tx_latency_start_msrmnt(local, skb);
+
         switch (sdata->vif.type) {
         case NL80211_IFTYPE_AP_VLAN:
                 sta = rcu_dereference(sdata->u.vlan.sta);
@@ -2109,7 +2134,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
          */
 
         if (head_need > 0 || skb_cloned(skb)) {
-                head_need += IEEE80211_ENCRYPT_HEADROOM;
+                head_need += sdata->encrypt_headroom;
                 head_need += local->tx_headroom;
                 head_need = max_t(int, 0, head_need);
                 if (ieee80211_skb_resize(sdata, skb, head_need, true)) {
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 592a18171f95..06265d7f8cc3 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1804,6 +1804,26 @@ void ieee80211_recalc_smps(struct ieee80211_sub_if_data *sdata)
         mutex_unlock(&local->chanctx_mtx);
 }
 
+void ieee80211_recalc_min_chandef(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_chanctx_conf *chanctx_conf;
+        struct ieee80211_chanctx *chanctx;
+
+        mutex_lock(&local->chanctx_mtx);
+
+        chanctx_conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
+                                        lockdep_is_held(&local->chanctx_mtx));
+
+        if (WARN_ON_ONCE(!chanctx_conf))
+                goto unlock;
+
+        chanctx = container_of(chanctx_conf, struct ieee80211_chanctx, conf);
+        ieee80211_recalc_chanctx_min_def(local, chanctx);
+ unlock:
+        mutex_unlock(&local->chanctx_mtx);
+}
+
 static bool ieee80211_id_in_list(const u8 *ids, int n_ids, u8 id)
 {
         int i;
@@ -2259,14 +2279,17 @@ u64 ieee80211_calculate_rx_timestamp(struct ieee80211_local *local,
 void ieee80211_dfs_cac_cancel(struct ieee80211_local *local)
 {
         struct ieee80211_sub_if_data *sdata;
+        struct cfg80211_chan_def chandef;
 
         mutex_lock(&local->iflist_mtx);
         list_for_each_entry(sdata, &local->interfaces, list) {
                 cancel_delayed_work_sync(&sdata->dfs_cac_timer_work);
 
                 if (sdata->wdev.cac_started) {
+                        chandef = sdata->vif.bss_conf.chandef;
                         ieee80211_vif_release_channel(sdata);
                         cfg80211_cac_event(sdata->dev,
+                                           &chandef,
                                            NL80211_RADAR_CAC_ABORTED,
                                            GFP_KERNEL);
                 }
@@ -2447,7 +2470,6 @@ int ieee80211_send_action_csa(struct ieee80211_sub_if_data *sdata,
 
         if (ieee80211_vif_is_mesh(&sdata->vif)) {
                 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
-                __le16 pre_value;
 
                 skb_put(skb, 8);
                 *pos++ = WLAN_EID_CHAN_SWITCH_PARAM;            /* EID */
@@ -2463,8 +2485,7 @@ int ieee80211_send_action_csa(struct ieee80211_sub_if_data *sdata,
                         ifmsh->pre_value = 1;
                 else
                         ifmsh->pre_value++;
-                pre_value = cpu_to_le16(ifmsh->pre_value);
-                memcpy(pos, &pre_value, 2);             /* Precedence Value */
+                put_unaligned_le16(ifmsh->pre_value, pos);/* Precedence Value */
                 pos += 2;
                 ifmsh->chsw_init = true;
         }
@@ -2472,3 +2493,71 @@ int ieee80211_send_action_csa(struct ieee80211_sub_if_data *sdata,
         ieee80211_tx_skb(sdata, skb);
         return 0;
 }
+
+bool ieee80211_cs_valid(const struct ieee80211_cipher_scheme *cs)
+{
+        return !(cs == NULL || cs->cipher == 0 ||
+                 cs->hdr_len < cs->pn_len + cs->pn_off ||
+                 cs->hdr_len <= cs->key_idx_off ||
+                 cs->key_idx_shift > 7 ||
+                 cs->key_idx_mask == 0);
+}
+
+bool ieee80211_cs_list_valid(const struct ieee80211_cipher_scheme *cs, int n)
+{
+        int i;
+
+        /* Ensure we have enough iftype bitmap space for all iftype values */
+        WARN_ON((NUM_NL80211_IFTYPES / 8 + 1) > sizeof(cs[0].iftype));
+
+        for (i = 0; i < n; i++)
+                if (!ieee80211_cs_valid(&cs[i]))
+                        return false;
+
+        return true;
+}
+
+const struct ieee80211_cipher_scheme *
+ieee80211_cs_get(struct ieee80211_local *local, u32 cipher,
+                 enum nl80211_iftype iftype)
+{
+        const struct ieee80211_cipher_scheme *l = local->hw.cipher_schemes;
+        int n = local->hw.n_cipher_schemes;
+        int i;
+        const struct ieee80211_cipher_scheme *cs = NULL;
+
+        for (i = 0; i < n; i++) {
+                if (l[i].cipher == cipher) {
+                        cs = &l[i];
+                        break;
+                }
+        }
+
+        if (!cs || !(cs->iftype & BIT(iftype)))
+                return NULL;
+
+        return cs;
+}
+
+int ieee80211_cs_headroom(struct ieee80211_local *local,
+                          struct cfg80211_crypto_settings *crypto,
+                          enum nl80211_iftype iftype)
+{
+        const struct ieee80211_cipher_scheme *cs;
+        int headroom = IEEE80211_ENCRYPT_HEADROOM;
+        int i;
+
+        for (i = 0; i < crypto->n_ciphers_pairwise; i++) {
+                cs = ieee80211_cs_get(local, crypto->ciphers_pairwise[i],
+                                      iftype);
+
+                if (cs && headroom < cs->hdr_len)
+                        headroom = cs->hdr_len;
+        }
+
+        cs = ieee80211_cs_get(local, crypto->cipher_group, iftype);
+        if (cs && headroom < cs->hdr_len)
+                headroom = cs->hdr_len;
+
+        return headroom;
+}
diff --git a/net/mac80211/vht.c b/net/mac80211/vht.c
index de0112785aae..d75f35c6e1a0 100644
--- a/net/mac80211/vht.c
+++ b/net/mac80211/vht.c
@@ -182,16 +182,15 @@ ieee80211_vht_cap_ie_to_sta_vht_cap(struct ieee80211_sub_if_data *sdata,
                          IEEE80211_VHT_CAP_SHORT_GI_160);
 
         /* remaining ones */
-        if (own_cap.cap & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE) {
+        if (own_cap.cap & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE)
                 vht_cap->cap |= cap_info &
                                 (IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE |
-                                 IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MAX);
-        }
+                                 IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MASK);
 
         if (own_cap.cap & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)
                 vht_cap->cap |= cap_info &
                                 (IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
-                                 IEEE80211_VHT_CAP_BEAMFORMEE_STS_MAX);
+                                 IEEE80211_VHT_CAP_BEAMFORMEE_STS_MASK);
 
         if (own_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE)
                 vht_cap->cap |= cap_info &
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index d65728220763..7313d379c0d3 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -545,6 +545,106 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx)
         return RX_CONTINUE;
 }
 
+static ieee80211_tx_result
+ieee80211_crypto_cs_encrypt(struct ieee80211_tx_data *tx,
+                            struct sk_buff *skb)
+{
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        struct ieee80211_key *key = tx->key;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        const struct ieee80211_cipher_scheme *cs = key->sta->cipher_scheme;
+        int hdrlen;
+        u8 *pos;
+
+        if (info->control.hw_key &&
+            !(info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)) {
+                /* hwaccel has no need for preallocated head room */
+                return TX_CONTINUE;
+        }
+
+        if (unlikely(skb_headroom(skb) < cs->hdr_len &&
+                     pskb_expand_head(skb, cs->hdr_len, 0, GFP_ATOMIC)))
+                return TX_DROP;
+
+        hdrlen = ieee80211_hdrlen(hdr->frame_control);
+
+        pos = skb_push(skb, cs->hdr_len);
+        memmove(pos, pos + cs->hdr_len, hdrlen);
+        skb_set_network_header(skb, skb_network_offset(skb) + cs->hdr_len);
+
+        return TX_CONTINUE;
+}
+
+static inline int ieee80211_crypto_cs_pn_compare(u8 *pn1, u8 *pn2, int len)
+{
+        int i;
+
+        /* pn is little endian */
+        for (i = len - 1; i >= 0; i--) {
+                if (pn1[i] < pn2[i])
+                        return -1;
+                else if (pn1[i] > pn2[i])
+                        return 1;
+        }
+
+        return 0;
+}
+
+static ieee80211_rx_result
+ieee80211_crypto_cs_decrypt(struct ieee80211_rx_data *rx)
+{
+        struct ieee80211_key *key = rx->key;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
+        const struct ieee80211_cipher_scheme *cs = NULL;
+        int hdrlen = ieee80211_hdrlen(hdr->frame_control);
+        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
+        int data_len;
+        u8 *rx_pn;
+        u8 *skb_pn;
+        u8 qos_tid;
+
+        if (!rx->sta || !rx->sta->cipher_scheme ||
+            !(status->flag & RX_FLAG_DECRYPTED))
+                return RX_DROP_UNUSABLE;
+
+        if (!ieee80211_is_data(hdr->frame_control))
+                return RX_CONTINUE;
+
+        cs = rx->sta->cipher_scheme;
+
+        data_len = rx->skb->len - hdrlen - cs->hdr_len;
+
+        if (data_len < 0)
+                return RX_DROP_UNUSABLE;
+
+        if (ieee80211_is_data_qos(hdr->frame_control))
+                qos_tid = *ieee80211_get_qos_ctl(hdr) &
+                                IEEE80211_QOS_CTL_TID_MASK;
+        else
+                qos_tid = 0;
+
+        if (skb_linearize(rx->skb))
+                return RX_DROP_UNUSABLE;
+
+        hdr = (struct ieee80211_hdr *)rx->skb->data;
+
+        rx_pn = key->u.gen.rx_pn[qos_tid];
+        skb_pn = rx->skb->data + hdrlen + cs->pn_off;
+
+        if (ieee80211_crypto_cs_pn_compare(skb_pn, rx_pn, cs->pn_len) <= 0)
+                return RX_DROP_UNUSABLE;
+
+        memcpy(rx_pn, skb_pn, cs->pn_len);
+
+        /* remove security header and MIC */
+        if (pskb_trim(rx->skb, rx->skb->len - cs->mic_len))
+                return RX_DROP_UNUSABLE;
+
+        memmove(rx->skb->data + cs->hdr_len, rx->skb->data, hdrlen);
+        skb_pull(rx->skb, cs->hdr_len);
+
+        return RX_CONTINUE;
+}
 
 static void bip_aad(struct sk_buff *skb, u8 *aad)
 {
@@ -685,6 +785,7 @@ ieee80211_crypto_hw_encrypt(struct ieee80211_tx_data *tx)
 {
         struct sk_buff *skb;
         struct ieee80211_tx_info *info = NULL;
+        ieee80211_tx_result res;
 
         skb_queue_walk(&tx->skbs, skb) {
                 info  = IEEE80211_SKB_CB(skb);
@@ -692,9 +793,24 @@ ieee80211_crypto_hw_encrypt(struct ieee80211_tx_data *tx)
                 /* handle hw-only algorithm */
                 if (!info->control.hw_key)
                         return TX_DROP;
+
+                if (tx->key->sta->cipher_scheme) {
+                        res = ieee80211_crypto_cs_encrypt(tx, skb);
+                        if (res != TX_CONTINUE)
+                                return res;
+                }
         }
 
         ieee80211_tx_set_protected(tx);
 
         return TX_CONTINUE;
 }
+
+ieee80211_rx_result
+ieee80211_crypto_hw_decrypt(struct ieee80211_rx_data *rx)
+{
+        if (rx->sta->cipher_scheme)
+                return ieee80211_crypto_cs_decrypt(rx);
+
+        return RX_DROP_UNUSABLE;
+}
diff --git a/net/mac80211/wpa.h b/net/mac80211/wpa.h
index 07e33f899c71..62e5a12dfe0a 100644
--- a/net/mac80211/wpa.h
+++ b/net/mac80211/wpa.h
@@ -34,5 +34,7 @@ ieee80211_rx_result
 ieee80211_crypto_aes_cmac_decrypt(struct ieee80211_rx_data *rx);
 ieee80211_tx_result
 ieee80211_crypto_hw_encrypt(struct ieee80211_tx_data *tx);
+ieee80211_rx_result
+ieee80211_crypto_hw_decrypt(struct ieee80211_rx_data *rx);
 
 #endif /* WPA_H */