Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next-2.6

46 files changed, 1960 insertions, 607 deletions

diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 7f5ad8a2b22d..3163330cd4f1 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -623,6 +623,23 @@ encrypt:
 }
 EXPORT_SYMBOL(hci_conn_security);
 
+/* Check secure link requirement */
+int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
+{
+        BT_DBG("conn %p", conn);
+
+        if (sec_level != BT_SECURITY_HIGH)
+                return 1; /* Accept if non-secure is required */
+
+        if (conn->key_type == HCI_LK_AUTH_COMBINATION ||
+                        (conn->key_type == HCI_LK_COMBINATION &&
+                        conn->pin_length == 16))
+                return 1;
+
+        return 0; /* Reject not secure link */
+}
+EXPORT_SYMBOL(hci_conn_check_secure);
+
 /* Change link key */
 int hci_conn_change_link_key(struct hci_conn *conn)
 {
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index d5aa97ee6ffa..f13ddbf858ba 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -1440,7 +1440,7 @@ static inline void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff
 
         conn->state = BT_CLOSED;
 
-        if (conn->type == ACL_LINK)
+        if (conn->type == ACL_LINK || conn->type == LE_LINK)
                 mgmt_disconnected(hdev->id, &conn->dst);
 
         hci_proto_disconn_cfm(conn, ev->reason);
@@ -2659,12 +2659,15 @@ static inline void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff
         }
 
         if (ev->status) {
+                mgmt_connect_failed(hdev->id, &ev->bdaddr, ev->status);
                 hci_proto_connect_cfm(conn, ev->status);
                 conn->state = BT_CLOSED;
                 hci_conn_del(conn);
                 goto unlock;
         }
 
+        mgmt_connected(hdev->id, &ev->bdaddr);
+
         conn->handle = __le16_to_cpu(ev->handle);
         conn->state = BT_CONNECTED;
 
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index a378acc491ec..4f3bc741183c 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -62,9 +62,8 @@ static u8 l2cap_fixed_chan[8] = { 0x02, };
 
 static struct workqueue_struct *_busy_wq;
 
-struct bt_sock_list l2cap_sk_list = {
-        .lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
-};
+LIST_HEAD(chan_list);
+DEFINE_RWLOCK(chan_list_lock);
 
 static void l2cap_busy_work(struct work_struct *work);
 
@@ -135,6 +134,64 @@ static inline struct l2cap_chan *l2cap_get_chan_by_ident(struct l2cap_conn *conn
         return c;
 }
 
+static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src)
+{
+        struct l2cap_chan *c;
+
+        list_for_each_entry(c, &chan_list, global_l) {
+                if (c->sport == psm && !bacmp(&bt_sk(c->sk)->src, src))
+                        goto found;
+        }
+
+        c = NULL;
+found:
+        return c;
+}
+
+int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm)
+{
+        int err;
+
+        write_lock_bh(&chan_list_lock);
+
+        if (psm && __l2cap_global_chan_by_addr(psm, src)) {
+                err = -EADDRINUSE;
+                goto done;
+        }
+
+        if (psm) {
+                chan->psm = psm;
+                chan->sport = psm;
+                err = 0;
+        } else {
+                u16 p;
+
+                err = -EINVAL;
+                for (p = 0x1001; p < 0x1100; p += 2)
+                        if (!__l2cap_global_chan_by_addr(cpu_to_le16(p), src)) {
+                                chan->psm   = cpu_to_le16(p);
+                                chan->sport = cpu_to_le16(p);
+                                err = 0;
+                                break;
+                        }
+        }
+
+done:
+        write_unlock_bh(&chan_list_lock);
+        return err;
+}
+
+int l2cap_add_scid(struct l2cap_chan *chan,  __u16 scid)
+{
+        write_lock_bh(&chan_list_lock);
+
+        chan->scid = scid;
+
+        write_unlock_bh(&chan_list_lock);
+
+        return 0;
+}
+
 static u16 l2cap_alloc_cid(struct l2cap_conn *conn)
 {
         u16 cid = L2CAP_CID_DYN_START;
@@ -147,7 +204,7 @@ static u16 l2cap_alloc_cid(struct l2cap_conn *conn)
         return 0;
 }
 
-struct l2cap_chan *l2cap_chan_alloc(struct sock *sk)
+struct l2cap_chan *l2cap_chan_create(struct sock *sk)
 {
         struct l2cap_chan *chan;
 
@@ -157,11 +214,19 @@ struct l2cap_chan *l2cap_chan_alloc(struct sock *sk)
 
         chan->sk = sk;
 
+        write_lock_bh(&chan_list_lock);
+        list_add(&chan->global_l, &chan_list);
+        write_unlock_bh(&chan_list_lock);
+
         return chan;
 }
 
-void l2cap_chan_free(struct l2cap_chan *chan)
+void l2cap_chan_destroy(struct l2cap_chan *chan)
 {
+        write_lock_bh(&chan_list_lock);
+        list_del(&chan->global_l);
+        write_unlock_bh(&chan_list_lock);
+
         kfree(chan);
 }
 
@@ -591,48 +656,51 @@ static void l2cap_conn_start(struct l2cap_conn *conn)
 /* Find socket with cid and source bdaddr.
  * Returns closest match, locked.
  */
-static struct sock *l2cap_get_sock_by_scid(int state, __le16 cid, bdaddr_t *src)
+static struct l2cap_chan *l2cap_global_chan_by_scid(int state, __le16 cid, bdaddr_t *src)
 {
-        struct sock *sk = NULL, *sk1 = NULL;
-        struct hlist_node *node;
+        struct l2cap_chan *c, *c1 = NULL;
 
-        read_lock(&l2cap_sk_list.lock);
+        read_lock(&chan_list_lock);
 
-        sk_for_each(sk, node, &l2cap_sk_list.head) {
-                struct l2cap_chan *chan = l2cap_pi(sk)->chan;
+        list_for_each_entry(c, &chan_list, global_l) {
+                struct sock *sk = c->sk;
 
                 if (state && sk->sk_state != state)
                         continue;
 
-                if (chan->scid == cid) {
+                if (c->scid == cid) {
                         /* Exact match. */
-                        if (!bacmp(&bt_sk(sk)->src, src))
-                                break;
+                        if (!bacmp(&bt_sk(sk)->src, src)) {
+                                read_unlock(&chan_list_lock);
+                                return c;
+                        }
 
                         /* Closest match */
                         if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
-                                sk1 = sk;
+                                c1 = c;
                 }
         }
 
-        read_unlock(&l2cap_sk_list.lock);
+        read_unlock(&chan_list_lock);
 
-        return node ? sk : sk1;
+        return c1;
 }
 
 static void l2cap_le_conn_ready(struct l2cap_conn *conn)
 {
         struct sock *parent, *sk;
-        struct l2cap_chan *chan;
+        struct l2cap_chan *chan, *pchan;
 
         BT_DBG("");
 
         /* Check if we have socket listening on cid */
-        parent = l2cap_get_sock_by_scid(BT_LISTEN, L2CAP_CID_LE_DATA,
+        pchan = l2cap_global_chan_by_scid(BT_LISTEN, L2CAP_CID_LE_DATA,
                                                         conn->src);
-        if (!parent)
+        if (!pchan)
                 return;
 
+        parent = pchan->sk;
+
         bh_lock_sock(parent);
 
         /* Check for backlog size */
@@ -645,7 +713,7 @@ static void l2cap_le_conn_ready(struct l2cap_conn *conn)
         if (!sk)
                 goto clean;
 
-        chan = l2cap_chan_alloc(sk);
+        chan = l2cap_chan_create(sk);
         if (!chan) {
                 l2cap_sock_kill(sk);
                 goto clean;
@@ -823,33 +891,34 @@ static inline void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *ch
 /* Find socket with psm and source bdaddr.
  * Returns closest match.
  */
-static struct sock *l2cap_get_sock_by_psm(int state, __le16 psm, bdaddr_t *src)
+static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm, bdaddr_t *src)
 {
-        struct sock *sk = NULL, *sk1 = NULL;
-        struct hlist_node *node;
+        struct l2cap_chan *c, *c1 = NULL;
 
-        read_lock(&l2cap_sk_list.lock);
+        read_lock(&chan_list_lock);
 
-        sk_for_each(sk, node, &l2cap_sk_list.head) {
-                struct l2cap_chan *chan = l2cap_pi(sk)->chan;
+        list_for_each_entry(c, &chan_list, global_l) {
+                struct sock *sk = c->sk;
 
                 if (state && sk->sk_state != state)
                         continue;
 
-                if (chan->psm == psm) {
+                if (c->psm == psm) {
                         /* Exact match. */
-                        if (!bacmp(&bt_sk(sk)->src, src))
-                                break;
+                        if (!bacmp(&bt_sk(sk)->src, src)) {
+                                read_unlock_bh(&chan_list_lock);
+                                return c;
+                        }
 
                         /* Closest match */
                         if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
-                                sk1 = sk;
+                                c1 = c;
                 }
         }
 
-        read_unlock(&l2cap_sk_list.lock);
+        read_unlock(&chan_list_lock);
 
-        return node ? sk : sk1;
+        return c1;
 }
 
 int l2cap_chan_connect(struct l2cap_chan *chan)
@@ -2019,7 +2088,7 @@ static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hd
 {
         struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
         struct l2cap_conn_rsp rsp;
-        struct l2cap_chan *chan = NULL;
+        struct l2cap_chan *chan = NULL, *pchan;
         struct sock *parent, *sk = NULL;
         int result, status = L2CAP_CS_NO_INFO;
 
@@ -2029,12 +2098,14 @@ static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hd
         BT_DBG("psm 0x%2.2x scid 0x%4.4x", psm, scid);
 
         /* Check if we have socket listening on psm */
-        parent = l2cap_get_sock_by_psm(BT_LISTEN, psm, conn->src);
-        if (!parent) {
+        pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, conn->src);
+        if (!pchan) {
                 result = L2CAP_CR_BAD_PSM;
                 goto sendresp;
         }
 
+        parent = pchan->sk;
+
         bh_lock_sock(parent);
 
         /* Check if the ACL is secure enough (if not SDP) */
@@ -2057,7 +2128,7 @@ static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hd
         if (!sk)
                 goto response;
 
-        chan = l2cap_chan_alloc(sk);
+        chan = l2cap_chan_create(sk);
         if (!chan) {
                 l2cap_sock_kill(sk);
                 goto response;
@@ -3685,11 +3756,14 @@ done:
 static inline int l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm, struct sk_buff *skb)
 {
         struct sock *sk;
+        struct l2cap_chan *chan;
 
-        sk = l2cap_get_sock_by_psm(0, psm, conn->src);
-        if (!sk)
+        chan = l2cap_global_chan_by_psm(0, psm, conn->src);
+        if (!chan)
                 goto drop;
 
+        sk = chan->sk;
+
         bh_lock_sock(sk);
 
         BT_DBG("sk %p, len %d", sk, skb->len);
@@ -3715,11 +3789,14 @@ done:
 static inline int l2cap_att_channel(struct l2cap_conn *conn, __le16 cid, struct sk_buff *skb)
 {
         struct sock *sk;
+        struct l2cap_chan *chan;
 
-        sk = l2cap_get_sock_by_scid(0, cid, conn->src);
-        if (!sk)
+        chan = l2cap_global_chan_by_scid(0, cid, conn->src);
+        if (!chan)
                 goto drop;
 
+        sk = chan->sk;
+
         bh_lock_sock(sk);
 
         BT_DBG("sk %p, len %d", sk, skb->len);
@@ -3786,8 +3863,7 @@ static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
 static int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
 {
         int exact = 0, lm1 = 0, lm2 = 0;
-        register struct sock *sk;
-        struct hlist_node *node;
+        struct l2cap_chan *c;
 
         if (type != ACL_LINK)
                 return -EINVAL;
@@ -3795,25 +3871,25 @@ static int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
         BT_DBG("hdev %s, bdaddr %s", hdev->name, batostr(bdaddr));
 
         /* Find listening sockets and check their link_mode */
-        read_lock(&l2cap_sk_list.lock);
-        sk_for_each(sk, node, &l2cap_sk_list.head) {
-                struct l2cap_chan *chan = l2cap_pi(sk)->chan;
+        read_lock(&chan_list_lock);
+        list_for_each_entry(c, &chan_list, global_l) {
+                struct sock *sk = c->sk;
 
                 if (sk->sk_state != BT_LISTEN)
                         continue;
 
                 if (!bacmp(&bt_sk(sk)->src, &hdev->bdaddr)) {
                         lm1 |= HCI_LM_ACCEPT;
-                        if (chan->role_switch)
+                        if (c->role_switch)
                                 lm1 |= HCI_LM_MASTER;
                         exact++;
                 } else if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY)) {
                         lm2 |= HCI_LM_ACCEPT;
-                        if (chan->role_switch)
+                        if (c->role_switch)
                                 lm2 |= HCI_LM_MASTER;
                 }
         }
-        read_unlock(&l2cap_sk_list.lock);
+        read_unlock(&chan_list_lock);
 
         return exact ? lm1 : lm2;
 }
@@ -4066,25 +4142,22 @@ drop:
 
 static int l2cap_debugfs_show(struct seq_file *f, void *p)
 {
-        struct sock *sk;
-        struct hlist_node *node;
+        struct l2cap_chan *c;
 
-        read_lock_bh(&l2cap_sk_list.lock);
+        read_lock_bh(&chan_list_lock);
 
-        sk_for_each(sk, node, &l2cap_sk_list.head) {
-                struct l2cap_pinfo *pi = l2cap_pi(sk);
-                struct l2cap_chan *chan = pi->chan;
+        list_for_each_entry(c, &chan_list, global_l) {
+                struct sock *sk = c->sk;
 
                 seq_printf(f, "%s %s %d %d 0x%4.4x 0x%4.4x %d %d %d %d\n",
                                         batostr(&bt_sk(sk)->src),
                                         batostr(&bt_sk(sk)->dst),
-                                        sk->sk_state, __le16_to_cpu(chan->psm),
-                                        chan->scid, chan->dcid,
-                                        chan->imtu, chan->omtu, chan->sec_level,
-                                        chan->mode);
+                                        sk->sk_state, __le16_to_cpu(c->psm),
+                                        c->scid, c->dcid, c->imtu, c->omtu,
+                                        c->sec_level, c->mode);
         }
 
-        read_unlock_bh(&l2cap_sk_list.lock);
+        read_unlock_bh(&chan_list_lock);
 
         return 0;
 }
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 7c4a9ae9b3ce..18dc9888d8c2 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -78,22 +78,6 @@ void l2cap_sock_clear_timer(struct sock *sk)
         sk_stop_timer(sk, &sk->sk_timer);
 }
 
-static struct sock *__l2cap_get_sock_by_addr(__le16 psm, bdaddr_t *src)
-{
-        struct sock *sk;
-        struct hlist_node *node;
-        sk_for_each(sk, node, &l2cap_sk_list.head) {
-                struct l2cap_chan *chan = l2cap_pi(sk)->chan;
-
-                if (chan->sport == psm && !bacmp(&bt_sk(sk)->src, src))
-                        goto found;
-        }
-
-        sk = NULL;
-found:
-        return sk;
-}
-
 static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
 {
         struct sock *sk = sock->sk;
@@ -136,26 +120,20 @@ static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
                 }
         }
 
-        write_lock_bh(&l2cap_sk_list.lock);
+        if (la.l2_cid)
+                err = l2cap_add_scid(chan, la.l2_cid);
+        else
+                err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm);
 
-        if (la.l2_psm && __l2cap_get_sock_by_addr(la.l2_psm, &la.l2_bdaddr)) {
-                err = -EADDRINUSE;
-        } else {
-                /* Save source address */
-                bacpy(&bt_sk(sk)->src, &la.l2_bdaddr);
-                chan->psm   = la.l2_psm;
-                chan->sport = la.l2_psm;
-                sk->sk_state = BT_BOUND;
-
-                if (__le16_to_cpu(la.l2_psm) == 0x0001 ||
-                                        __le16_to_cpu(la.l2_psm) == 0x0003)
-                        chan->sec_level = BT_SECURITY_SDP;
-        }
+        if (err < 0)
+                goto done;
 
-        if (la.l2_cid)
-                chan->scid = la.l2_cid;
+        if (__le16_to_cpu(la.l2_psm) == 0x0001 ||
+                                __le16_to_cpu(la.l2_psm) == 0x0003)
+                chan->sec_level = BT_SECURITY_SDP;
 
-        write_unlock_bh(&l2cap_sk_list.lock);
+        bacpy(&bt_sk(sk)->src, &la.l2_bdaddr);
+        sk->sk_state = BT_BOUND;
 
 done:
         release_sock(sk);
@@ -278,28 +256,6 @@ static int l2cap_sock_listen(struct socket *sock, int backlog)
                 goto done;
         }
 
-        if (!chan->psm && !chan->scid) {
-                bdaddr_t *src = &bt_sk(sk)->src;
-                u16 psm;
-
-                err = -EINVAL;
-
-                write_lock_bh(&l2cap_sk_list.lock);
-
-                for (psm = 0x1001; psm < 0x1100; psm += 2)
-                        if (!__l2cap_get_sock_by_addr(cpu_to_le16(psm), src)) {
-                                chan->psm   = cpu_to_le16(psm);
-                                chan->sport = cpu_to_le16(psm);
-                                err = 0;
-                                break;
-                        }
-
-                write_unlock_bh(&l2cap_sk_list.lock);
-
-                if (err < 0)
-                        goto done;
-        }
-
         sk->sk_max_ack_backlog = backlog;
         sk->sk_ack_backlog = 0;
         sk->sk_state = BT_LISTEN;
@@ -852,8 +808,7 @@ void l2cap_sock_kill(struct sock *sk)
 
         /* Kill poor orphan */
 
-        l2cap_chan_free(l2cap_pi(sk)->chan);
-        bt_sock_unlink(&l2cap_sk_list, sk);
+        l2cap_chan_destroy(l2cap_pi(sk)->chan);
         sock_set_flag(sk, SOCK_DEAD);
         sock_put(sk);
 }
@@ -1069,7 +1024,6 @@ struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, int proto, g
 
         setup_timer(&sk->sk_timer, l2cap_sock_timeout, (unsigned long) sk);
 
-        bt_sock_link(&l2cap_sk_list, sk);
         return sk;
 }
 
@@ -1096,7 +1050,7 @@ static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
         if (!sk)
                 return -ENOMEM;
 
-        chan = l2cap_chan_alloc(sk);
+        chan = l2cap_chan_create(sk);
         if (!chan) {
                 l2cap_sock_kill(sk);
                 return -ENOMEM;
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 2481d257ed98..dae382ce7020 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -1033,6 +1033,9 @@ static int disconnect(struct sock *sk, u16 index, unsigned char *data, u16 len)
         }
 
         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
+        if (!conn)
+                conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->bdaddr);
+
         if (!conn) {
                 err = cmd_status(sk, index, MGMT_OP_DISCONNECT, ENOTCONN);
                 goto failed;
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 121a5c13b989..5759bb7054f7 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -2096,7 +2096,7 @@ static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
                 if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags))
                         continue;
 
-                if (!status)
+                if (!status && hci_conn_check_secure(conn, d->sec_level))
                         set_bit(RFCOMM_AUTH_ACCEPT, &d->flags);
                 else
                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 0c9d0c07eae6..9c0d76cdca92 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -63,7 +63,8 @@ void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
 
         lockdep_assert_held(&sta->ampdu_mlme.mtx);
 
-        tid_rx = sta->ampdu_mlme.tid_rx[tid];
+        tid_rx = rcu_dereference_protected(sta->ampdu_mlme.tid_rx[tid],
+                                        lockdep_is_held(&sta->ampdu_mlme.mtx));
 
         if (!tid_rx)
                 return;
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 63d852cb4ca2..cd5125f77cc5 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -136,6 +136,14 @@ void ieee80211_send_bar(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid, u1
         ieee80211_tx_skb(sdata, skb);
 }
 
+void ieee80211_assign_tid_tx(struct sta_info *sta, int tid,
+                             struct tid_ampdu_tx *tid_tx)
+{
+        lockdep_assert_held(&sta->ampdu_mlme.mtx);
+        lockdep_assert_held(&sta->lock);
+        rcu_assign_pointer(sta->ampdu_mlme.tid_tx[tid], tid_tx);
+}
+
 static void kfree_tid_tx(struct rcu_head *rcu_head)
 {
         struct tid_ampdu_tx *tid_tx =
@@ -149,19 +157,22 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
                                     bool tx)
 {
         struct ieee80211_local *local = sta->local;
-        struct tid_ampdu_tx *tid_tx = sta->ampdu_mlme.tid_tx[tid];
+        struct tid_ampdu_tx *tid_tx;
         int ret;
 
         lockdep_assert_held(&sta->ampdu_mlme.mtx);
 
-        if (!tid_tx)
-                return -ENOENT;
-
         spin_lock_bh(&sta->lock);
 
+        tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
+        if (!tid_tx) {
+                spin_unlock_bh(&sta->lock);
+                return -ENOENT;
+        }
+
         if (test_bit(HT_AGG_STATE_WANT_START, &tid_tx->state)) {
                 /* not even started yet! */
-                rcu_assign_pointer(sta->ampdu_mlme.tid_tx[tid], NULL);
+                ieee80211_assign_tid_tx(sta, tid, NULL);
                 spin_unlock_bh(&sta->lock);
                 call_rcu(&tid_tx->rcu_head, kfree_tid_tx);
                 return 0;
@@ -283,13 +294,13 @@ ieee80211_wake_queue_agg(struct ieee80211_local *local, int tid)
 
 void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid)
 {
-        struct tid_ampdu_tx *tid_tx = sta->ampdu_mlme.tid_tx[tid];
+        struct tid_ampdu_tx *tid_tx;
         struct ieee80211_local *local = sta->local;
         struct ieee80211_sub_if_data *sdata = sta->sdata;
         u16 start_seq_num;
         int ret;
 
-        lockdep_assert_held(&sta->ampdu_mlme.mtx);
+        tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
 
         /*
          * While we're asking the driver about the aggregation,
@@ -318,7 +329,7 @@ void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid)
                                         " tid %d\n", tid);
 #endif
                 spin_lock_bh(&sta->lock);
-                rcu_assign_pointer(sta->ampdu_mlme.tid_tx[tid], NULL);
+                ieee80211_assign_tid_tx(sta, tid, NULL);
                 spin_unlock_bh(&sta->lock);
 
                 ieee80211_wake_queue_agg(local, tid);
@@ -396,9 +407,9 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
                 goto err_unlock_sta;
         }
 
-        tid_tx = sta->ampdu_mlme.tid_tx[tid];
+        tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
         /* check if the TID is not in aggregation flow already */
-        if (tid_tx) {
+        if (tid_tx || sta->ampdu_mlme.tid_start_tx[tid]) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "BA request denied - session is not "
                                  "idle on tid %u\n", tid);
@@ -433,8 +444,11 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
         sta->ampdu_mlme.dialog_token_allocator++;
         tid_tx->dialog_token = sta->ampdu_mlme.dialog_token_allocator;
 
-        /* finally, assign it to the array */
-        rcu_assign_pointer(sta->ampdu_mlme.tid_tx[tid], tid_tx);
+        /*
+         * Finally, assign it to the start array; the work item will
+         * collect it and move it to the normal array.
+         */
+        sta->ampdu_mlme.tid_start_tx[tid] = tid_tx;
 
         ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);
 
@@ -480,16 +494,19 @@ ieee80211_agg_splice_finish(struct ieee80211_local *local, u16 tid)
 static void ieee80211_agg_tx_operational(struct ieee80211_local *local,
                                          struct sta_info *sta, u16 tid)
 {
+        struct tid_ampdu_tx *tid_tx;
+
         lockdep_assert_held(&sta->ampdu_mlme.mtx);
 
+        tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
+
 #ifdef CONFIG_MAC80211_HT_DEBUG
         printk(KERN_DEBUG "Aggregation is on for tid %d\n", tid);
 #endif
 
         drv_ampdu_action(local, sta->sdata,
                          IEEE80211_AMPDU_TX_OPERATIONAL,
-                         &sta->sta, tid, NULL,
-                         sta->ampdu_mlme.tid_tx[tid]->buf_size);
+                         &sta->sta, tid, NULL, tid_tx->buf_size);
 
         /*
          * synchronize with TX path, while splicing the TX path
@@ -497,13 +514,13 @@ static void ieee80211_agg_tx_operational(struct ieee80211_local *local,
          */
         spin_lock_bh(&sta->lock);
 
-        ieee80211_agg_splice_packets(local, sta->ampdu_mlme.tid_tx[tid], tid);
+        ieee80211_agg_splice_packets(local, tid_tx, tid);
         /*
          * Now mark as operational. This will be visible
          * in the TX path, and lets it go lock-free in
          * the common case.
          */
-        set_bit(HT_AGG_STATE_OPERATIONAL, &sta->ampdu_mlme.tid_tx[tid]->state);
+        set_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state);
         ieee80211_agg_splice_finish(local, tid);
 
         spin_unlock_bh(&sta->lock);
@@ -537,7 +554,7 @@ void ieee80211_start_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u16 tid)
         }
 
         mutex_lock(&sta->ampdu_mlme.mtx);
-        tid_tx = sta->ampdu_mlme.tid_tx[tid];
+        tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
 
         if (WARN_ON(!tid_tx)) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
@@ -615,7 +632,7 @@ int ieee80211_stop_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid)
                 return -EINVAL;
 
         spin_lock_bh(&sta->lock);
-        tid_tx = sta->ampdu_mlme.tid_tx[tid];
+        tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
 
         if (!tid_tx) {
                 ret = -ENOENT;
@@ -671,7 +688,7 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid)
 
         mutex_lock(&sta->ampdu_mlme.mtx);
         spin_lock_bh(&sta->lock);
-        tid_tx = sta->ampdu_mlme.tid_tx[tid];
+        tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
 
         if (!tid_tx || !test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
@@ -697,7 +714,7 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid)
         ieee80211_agg_splice_packets(local, tid_tx, tid);
 
         /* future packets must not find the tid_tx struct any more */
-        rcu_assign_pointer(sta->ampdu_mlme.tid_tx[tid], NULL);
+        ieee80211_assign_tid_tx(sta, tid, NULL);
 
         ieee80211_agg_splice_finish(local, tid);
 
@@ -752,7 +769,7 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
 
         mutex_lock(&sta->ampdu_mlme.mtx);
 
-        tid_tx = sta->ampdu_mlme.tid_tx[tid];
+        tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
         if (!tid_tx)
                 goto out;
 
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 12d52cec9515..be70c70d3f5b 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -136,7 +136,10 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
         mutex_lock(&sdata->local->sta_mtx);
 
         if (mac_addr) {
-                sta = sta_info_get_bss(sdata, mac_addr);
+                if (ieee80211_vif_is_mesh(&sdata->vif))
+                        sta = sta_info_get(sdata, mac_addr);
+                else
+                        sta = sta_info_get_bss(sdata, mac_addr);
                 if (!sta) {
                         ieee80211_key_free(sdata->local, key);
                         err = -ENOENT;
@@ -157,13 +160,14 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
 static int ieee80211_del_key(struct wiphy *wiphy, struct net_device *dev,
                              u8 key_idx, bool pairwise, const u8 *mac_addr)
 {
-        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
+        struct ieee80211_key *key = NULL;
         int ret;
 
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
-        mutex_lock(&sdata->local->sta_mtx);
+        mutex_lock(&local->sta_mtx);
+        mutex_lock(&local->key_mtx);
 
         if (mac_addr) {
                 ret = -ENOENT;
@@ -172,33 +176,24 @@ static int ieee80211_del_key(struct wiphy *wiphy, struct net_device *dev,
                 if (!sta)
                         goto out_unlock;
 
-                if (pairwise) {
-                        if (sta->ptk) {
-                                ieee80211_key_free(sdata->local, sta->ptk);
-                                ret = 0;
-                        }
-                } else {
-                        if (sta->gtk[key_idx]) {
-                                ieee80211_key_free(sdata->local,
-                                                   sta->gtk[key_idx]);
-                                ret = 0;
-                        }
-                }
-
-                goto out_unlock;
-        }
+                if (pairwise)
+                        key = key_mtx_dereference(local, sta->ptk);
+                else
+                        key = key_mtx_dereference(local, sta->gtk[key_idx]);
+        } else
+                key = key_mtx_dereference(local, sdata->keys[key_idx]);
 
-        if (!sdata->keys[key_idx]) {
+        if (!key) {
                 ret = -ENOENT;
                 goto out_unlock;
         }
 
-        ieee80211_key_free(sdata->local, sdata->keys[key_idx]);
-        WARN_ON(sdata->keys[key_idx]);
+        __ieee80211_key_free(key);
 
         ret = 0;
  out_unlock:
-        mutex_unlock(&sdata->local->sta_mtx);
+        mutex_unlock(&local->key_mtx);
+        mutex_unlock(&local->sta_mtx);
 
         return ret;
 }
@@ -228,11 +223,11 @@ static int ieee80211_get_key(struct wiphy *wiphy, struct net_device *dev,
                         goto out;
 
                 if (pairwise)
-                        key = sta->ptk;
+                        key = rcu_dereference(sta->ptk);
                 else if (key_idx < NUM_DEFAULT_KEYS)
-                        key = sta->gtk[key_idx];
+                        key = rcu_dereference(sta->gtk[key_idx]);
         } else
-                key = sdata->keys[key_idx];
+                key = rcu_dereference(sdata->keys[key_idx]);
 
         if (!key)
                 goto out;
@@ -468,7 +463,7 @@ static int ieee80211_config_beacon(struct ieee80211_sub_if_data *sdata,
         int size;
         int err = -EINVAL;
 
-        old = sdata->u.ap.beacon;
+        old = rtnl_dereference(sdata->u.ap.beacon);
 
         /* head must not be zero-length */
         if (params->head && !params->head_len)
@@ -563,8 +558,7 @@ static int ieee80211_add_beacon(struct wiphy *wiphy, struct net_device *dev,
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        old = sdata->u.ap.beacon;
-
+        old = rtnl_dereference(sdata->u.ap.beacon);
         if (old)
                 return -EALREADY;
 
@@ -579,8 +573,7 @@ static int ieee80211_set_beacon(struct wiphy *wiphy, struct net_device *dev,
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        old = sdata->u.ap.beacon;
-
+        old = rtnl_dereference(sdata->u.ap.beacon);
         if (!old)
                 return -ENOENT;
 
@@ -594,8 +587,7 @@ static int ieee80211_del_beacon(struct wiphy *wiphy, struct net_device *dev)
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        old = sdata->u.ap.beacon;
-
+        old = rtnl_dereference(sdata->u.ap.beacon);
         if (!old)
                 return -ENOENT;
 
@@ -734,15 +726,29 @@ static void sta_apply_parameters(struct ieee80211_local *local,
                                                   params->ht_capa,
                                                   &sta->sta.ht_cap);
 
-        if (ieee80211_vif_is_mesh(&sdata->vif) && params->plink_action) {
-                switch (params->plink_action) {
-                case PLINK_ACTION_OPEN:
-                        mesh_plink_open(sta);
-                        break;
-                case PLINK_ACTION_BLOCK:
-                        mesh_plink_block(sta);
-                        break;
-                }
+        if (ieee80211_vif_is_mesh(&sdata->vif)) {
+#ifdef CONFIG_MAC80211_MESH
+                if (sdata->u.mesh.security & IEEE80211_MESH_SEC_SECURED)
+                        switch (params->plink_state) {
+                        case NL80211_PLINK_LISTEN:
+                        case NL80211_PLINK_ESTAB:
+                        case NL80211_PLINK_BLOCKED:
+                                sta->plink_state = params->plink_state;
+                                break;
+                        default:
+                                /*  nothing  */
+                                break;
+                        }
+                else
+                        switch (params->plink_action) {
+                        case PLINK_ACTION_OPEN:
+                                mesh_plink_open(sta);
+                                break;
+                        case PLINK_ACTION_BLOCK:
+                                mesh_plink_block(sta);
+                                break;
+                        }
+#endif
         }
 }
 
@@ -943,8 +949,10 @@ static int ieee80211_change_mpath(struct wiphy *wiphy,
 static void mpath_set_pinfo(struct mesh_path *mpath, u8 *next_hop,
                             struct mpath_info *pinfo)
 {
-        if (mpath->next_hop)
-                memcpy(next_hop, mpath->next_hop->sta.addr, ETH_ALEN);
+        struct sta_info *next_hop_sta = rcu_dereference(mpath->next_hop);
+
+        if (next_hop_sta)
+                memcpy(next_hop, next_hop_sta->sta.addr, ETH_ALEN);
         else
                 memset(next_hop, 0, ETH_ALEN);
 
@@ -1064,7 +1072,11 @@ static int copy_mesh_setup(struct ieee80211_if_mesh *ifmsh,
         memcpy(ifmsh->mesh_id, setup->mesh_id, ifmsh->mesh_id_len);
         ifmsh->mesh_pp_id = setup->path_sel_proto;
         ifmsh->mesh_pm_id = setup->path_metric;
-        ifmsh->is_secure = setup->is_secure;
+        ifmsh->security = IEEE80211_MESH_SEC_NONE;
+        if (setup->is_authenticated)
+                ifmsh->security |= IEEE80211_MESH_SEC_AUTHED;
+        if (setup->is_secure)
+                ifmsh->security |= IEEE80211_MESH_SEC_SECURED;
 
         return 0;
 }
@@ -1297,9 +1309,10 @@ static int ieee80211_set_channel(struct wiphy *wiphy,
 }
 
 #ifdef CONFIG_PM
-static int ieee80211_suspend(struct wiphy *wiphy)
+static int ieee80211_suspend(struct wiphy *wiphy,
+                             struct cfg80211_wowlan *wowlan)
 {
-        return __ieee80211_suspend(wiphy_priv(wiphy));
+        return __ieee80211_suspend(wiphy_priv(wiphy), wowlan);
 }
 
 static int ieee80211_resume(struct wiphy *wiphy)
@@ -1342,6 +1355,30 @@ static int ieee80211_scan(struct wiphy *wiphy,
         return ieee80211_request_scan(sdata, req);
 }
 
+static int
+ieee80211_sched_scan_start(struct wiphy *wiphy,
+                           struct net_device *dev,
+                           struct cfg80211_sched_scan_request *req)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+        if (!sdata->local->ops->sched_scan_start)
+                return -EOPNOTSUPP;
+
+        return ieee80211_request_sched_scan_start(sdata, req);
+}
+
+static int
+ieee80211_sched_scan_stop(struct wiphy *wiphy, struct net_device *dev)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+        if (!sdata->local->ops->sched_scan_stop)
+                return -EOPNOTSUPP;
+
+        return ieee80211_request_sched_scan_stop(sdata);
+}
+
 static int ieee80211_auth(struct wiphy *wiphy, struct net_device *dev,
                           struct cfg80211_auth_request *req)
 {
@@ -2083,6 +2120,8 @@ struct cfg80211_ops mac80211_config_ops = {
         .suspend = ieee80211_suspend,
         .resume = ieee80211_resume,
         .scan = ieee80211_scan,
+        .sched_scan_start = ieee80211_sched_scan_start,
+        .sched_scan_stop = ieee80211_sched_scan_stop,
         .auth = ieee80211_auth,
         .assoc = ieee80211_assoc,
         .deauth = ieee80211_deauth,
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index 0a602dbfdb2b..186e02f7cc32 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -135,7 +135,7 @@ static ssize_t reset_write(struct file *file, const char __user *user_buf,
         struct ieee80211_local *local = file->private_data;
 
         rtnl_lock();
-        __ieee80211_suspend(&local->hw);
+        __ieee80211_suspend(&local->hw, NULL);
         __ieee80211_resume(&local->hw);
         rtnl_unlock();
 
diff --git a/net/mac80211/debugfs_key.c b/net/mac80211/debugfs_key.c
index f7ef3477c24a..33c58b85c911 100644
--- a/net/mac80211/debugfs_key.c
+++ b/net/mac80211/debugfs_key.c
@@ -241,16 +241,12 @@ void ieee80211_debugfs_key_add(struct ieee80211_key *key)
         if (!key->debugfs.dir)
                 return;
 
-        rcu_read_lock();
-        sta = rcu_dereference(key->sta);
-        if (sta)
+        sta = key->sta;
+        if (sta) {
                 sprintf(buf, "../../stations/%pM", sta->sta.addr);
-        rcu_read_unlock();
-
-        /* using sta as a boolean is fine outside RCU lock */
-        if (sta)
                 key->debugfs.stalink =
                         debugfs_create_symlink("station", key->debugfs.dir, buf);
+        }
 
         DEBUGFS_ADD(keylen);
         DEBUGFS_ADD(flags);
@@ -286,7 +282,8 @@ void ieee80211_debugfs_key_update_default(struct ieee80211_sub_if_data *sdata)
         lockdep_assert_held(&sdata->local->key_mtx);
 
         if (sdata->default_unicast_key) {
-                key = sdata->default_unicast_key;
+                key = key_mtx_dereference(sdata->local,
+                                          sdata->default_unicast_key);
                 sprintf(buf, "../keys/%d", key->debugfs.cnt);
                 sdata->debugfs.default_unicast_key =
                         debugfs_create_symlink("default_unicast_key",
@@ -297,7 +294,8 @@ void ieee80211_debugfs_key_update_default(struct ieee80211_sub_if_data *sdata)
         }
 
         if (sdata->default_multicast_key) {
-                key = sdata->default_multicast_key;
+                key = key_mtx_dereference(sdata->local,
+                                          sdata->default_multicast_key);
                 sprintf(buf, "../keys/%d", key->debugfs.cnt);
                 sdata->debugfs.default_multicast_key =
                         debugfs_create_symlink("default_multicast_key",
@@ -316,9 +314,8 @@ void ieee80211_debugfs_key_add_mgmt_default(struct ieee80211_sub_if_data *sdata)
         if (!sdata->debugfs.dir)
                 return;
 
-        /* this is running under the key lock */
-
-        key = sdata->default_mgmt_key;
+        key = key_mtx_dereference(sdata->local,
+                                  sdata->default_mgmt_key);
         if (key) {
                 sprintf(buf, "../keys/%d", key->debugfs.cnt);
                 sdata->debugfs.default_mgmt_key =
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 2ddb56e5b51f..eebf7a67daf7 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -41,6 +41,33 @@ static inline void drv_stop(struct ieee80211_local *local)
         local->started = false;
 }
 
+#ifdef CONFIG_PM
+static inline int drv_suspend(struct ieee80211_local *local,
+                              struct cfg80211_wowlan *wowlan)
+{
+        int ret;
+
+        might_sleep();
+
+        trace_drv_suspend(local);
+        ret = local->ops->suspend(&local->hw, wowlan);
+        trace_drv_return_int(local, ret);
+        return ret;
+}
+
+static inline int drv_resume(struct ieee80211_local *local)
+{
+        int ret;
+
+        might_sleep();
+
+        trace_drv_resume(local);
+        ret = local->ops->resume(&local->hw);
+        trace_drv_return_int(local, ret);
+        return ret;
+}
+#endif
+
 static inline int drv_add_interface(struct ieee80211_local *local,
                                     struct ieee80211_vif *vif)
 {
@@ -185,12 +212,39 @@ static inline int drv_hw_scan(struct ieee80211_local *local,
 
         might_sleep();
 
-        trace_drv_hw_scan(local, sdata, req);
+        trace_drv_hw_scan(local, sdata);
         ret = local->ops->hw_scan(&local->hw, &sdata->vif, req);
         trace_drv_return_int(local, ret);
         return ret;
 }
 
+static inline int
+drv_sched_scan_start(struct ieee80211_local *local,
+                     struct ieee80211_sub_if_data *sdata,
+                     struct cfg80211_sched_scan_request *req,
+                     struct ieee80211_sched_scan_ies *ies)
+{
+        int ret;
+
+        might_sleep();
+
+        trace_drv_sched_scan_start(local, sdata);
+        ret = local->ops->sched_scan_start(&local->hw, &sdata->vif,
+                                              req, ies);
+        trace_drv_return_int(local, ret);
+        return ret;
+}
+
+static inline void drv_sched_scan_stop(struct ieee80211_local *local,
+                                       struct ieee80211_sub_if_data *sdata)
+{
+        might_sleep();
+
+        trace_drv_sched_scan_stop(local, sdata);
+        local->ops->sched_scan_stop(&local->hw, &sdata->vif);
+        trace_drv_return_void(local);
+}
+
 static inline void drv_sw_scan_start(struct ieee80211_local *local)
 {
         might_sleep();
diff --git a/net/mac80211/driver-trace.h b/net/mac80211/driver-trace.h
index 191e834ec46b..ed9edcbd9aa5 100644
--- a/net/mac80211/driver-trace.h
+++ b/net/mac80211/driver-trace.h
@@ -55,6 +55,70 @@ DECLARE_EVENT_CLASS(local_only_evt,
         TP_printk(LOCAL_PR_FMT, LOCAL_PR_ARG)
 );
 
+DECLARE_EVENT_CLASS(local_sdata_addr_evt,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata),
+        TP_ARGS(local, sdata),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                VIF_ENTRY
+                __array(char, addr, 6)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                VIF_ASSIGN;
+                memcpy(__entry->addr, sdata->vif.addr, 6);
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT  VIF_PR_FMT " addr:%pM",
+                LOCAL_PR_ARG, VIF_PR_ARG, __entry->addr
+        )
+);
+
+DECLARE_EVENT_CLASS(local_u32_evt,
+        TP_PROTO(struct ieee80211_local *local, u32 value),
+        TP_ARGS(local, value),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(u32, value)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->value = value;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT " value:%d",
+                LOCAL_PR_ARG, __entry->value
+        )
+);
+
+DECLARE_EVENT_CLASS(local_sdata_evt,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata),
+        TP_ARGS(local, sdata),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                VIF_ENTRY
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                VIF_ASSIGN;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT VIF_PR_FMT,
+                LOCAL_PR_ARG, VIF_PR_ARG
+        )
+);
+
 DEFINE_EVENT(local_only_evt, drv_return_void,
         TP_PROTO(struct ieee80211_local *local),
         TP_ARGS(local)
@@ -108,33 +172,25 @@ DEFINE_EVENT(local_only_evt, drv_start,
         TP_ARGS(local)
 );
 
+DEFINE_EVENT(local_only_evt, drv_suspend,
+        TP_PROTO(struct ieee80211_local *local),
+        TP_ARGS(local)
+);
+
+DEFINE_EVENT(local_only_evt, drv_resume,
+        TP_PROTO(struct ieee80211_local *local),
+        TP_ARGS(local)
+);
+
 DEFINE_EVENT(local_only_evt, drv_stop,
         TP_PROTO(struct ieee80211_local *local),
         TP_ARGS(local)
 );
 
-TRACE_EVENT(drv_add_interface,
+DEFINE_EVENT(local_sdata_addr_evt, drv_add_interface,
         TP_PROTO(struct ieee80211_local *local,
                  struct ieee80211_sub_if_data *sdata),
-
-        TP_ARGS(local, sdata),
-
-        TP_STRUCT__entry(
-                LOCAL_ENTRY
-                VIF_ENTRY
-                __array(char, addr, 6)
-        ),
-
-        TP_fast_assign(
-                LOCAL_ASSIGN;
-                VIF_ASSIGN;
-                memcpy(__entry->addr, sdata->vif.addr, 6);
-        ),
-
-        TP_printk(
-                LOCAL_PR_FMT  VIF_PR_FMT " addr:%pM",
-                LOCAL_PR_ARG, VIF_PR_ARG, __entry->addr
-        )
+        TP_ARGS(local, sdata)
 );
 
 TRACE_EVENT(drv_change_interface,
@@ -165,27 +221,10 @@ TRACE_EVENT(drv_change_interface,
         )
 );
 
-TRACE_EVENT(drv_remove_interface,
-        TP_PROTO(struct ieee80211_local *local, struct ieee80211_sub_if_data *sdata),
-
-        TP_ARGS(local, sdata),
-
-        TP_STRUCT__entry(
-                LOCAL_ENTRY
-                VIF_ENTRY
-                __array(char, addr, 6)
-        ),
-
-        TP_fast_assign(
-                LOCAL_ASSIGN;
-                VIF_ASSIGN;
-                memcpy(__entry->addr, sdata->vif.addr, 6);
-        ),
-
-        TP_printk(
-                LOCAL_PR_FMT  VIF_PR_FMT " addr:%pM",
-                LOCAL_PR_ARG, VIF_PR_ARG, __entry->addr
-        )
+DEFINE_EVENT(local_sdata_addr_evt, drv_remove_interface,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata),
+        TP_ARGS(local, sdata)
 );
 
 TRACE_EVENT(drv_config,
@@ -415,27 +454,22 @@ TRACE_EVENT(drv_update_tkip_key,
         )
 );
 
-TRACE_EVENT(drv_hw_scan,
+DEFINE_EVENT(local_sdata_evt, drv_hw_scan,
         TP_PROTO(struct ieee80211_local *local,
-                 struct ieee80211_sub_if_data *sdata,
-                 struct cfg80211_scan_request *req),
-
-        TP_ARGS(local, sdata, req),
-
-        TP_STRUCT__entry(
-                LOCAL_ENTRY
-                VIF_ENTRY
-        ),
+                 struct ieee80211_sub_if_data *sdata),
+        TP_ARGS(local, sdata)
+);
 
-        TP_fast_assign(
-                LOCAL_ASSIGN;
-                VIF_ASSIGN;
-        ),
+DEFINE_EVENT(local_sdata_evt, drv_sched_scan_start,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata),
+        TP_ARGS(local, sdata)
+);
 
-        TP_printk(
-                LOCAL_PR_FMT VIF_PR_FMT,
-                LOCAL_PR_ARG,VIF_PR_ARG
-        )
+DEFINE_EVENT(local_sdata_evt, drv_sched_scan_stop,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata),
+        TP_ARGS(local, sdata)
 );
 
 DEFINE_EVENT(local_only_evt, drv_sw_scan_start,
@@ -504,46 +538,14 @@ TRACE_EVENT(drv_get_tkip_seq,
         )
 );
 
-TRACE_EVENT(drv_set_frag_threshold,
+DEFINE_EVENT(local_u32_evt, drv_set_frag_threshold,
         TP_PROTO(struct ieee80211_local *local, u32 value),
-
-        TP_ARGS(local, value),
-
-        TP_STRUCT__entry(
-                LOCAL_ENTRY
-                __field(u32, value)
-        ),
-
-        TP_fast_assign(
-                LOCAL_ASSIGN;
-                __entry->value = value;
-        ),
-
-        TP_printk(
-                LOCAL_PR_FMT " value:%d",
-                LOCAL_PR_ARG, __entry->value
-        )
+        TP_ARGS(local, value)
 );
 
-TRACE_EVENT(drv_set_rts_threshold,
+DEFINE_EVENT(local_u32_evt, drv_set_rts_threshold,
         TP_PROTO(struct ieee80211_local *local, u32 value),
-
-        TP_ARGS(local, value),
-
-        TP_STRUCT__entry(
-                LOCAL_ENTRY
-                __field(u32, value)
-        ),
-
-        TP_fast_assign(
-                LOCAL_ASSIGN;
-                __entry->value = value;
-        ),
-
-        TP_printk(
-                LOCAL_PR_FMT " value:%d",
-                LOCAL_PR_ARG, __entry->value
-        )
+        TP_ARGS(local, value)
 );
 
 TRACE_EVENT(drv_set_coverage_class,
@@ -1194,6 +1196,42 @@ TRACE_EVENT(api_scan_completed,
         )
 );
 
+TRACE_EVENT(api_sched_scan_results,
+        TP_PROTO(struct ieee80211_local *local),
+
+        TP_ARGS(local),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT, LOCAL_PR_ARG
+        )
+);
+
+TRACE_EVENT(api_sched_scan_stopped,
+        TP_PROTO(struct ieee80211_local *local),
+
+        TP_ARGS(local),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT, LOCAL_PR_ARG
+        )
+);
+
 TRACE_EVENT(api_sta_block_awake,
         TP_PROTO(struct ieee80211_local *local,
                  struct ieee80211_sta *sta, bool block),
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index b9e4b9bd2179..591add22bcc0 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -140,14 +140,29 @@ void ieee80211_ba_session_work(struct work_struct *work)
                                 sta, tid, WLAN_BACK_RECIPIENT,
                                 WLAN_REASON_QSTA_TIMEOUT, true);
 
-                tid_tx = sta->ampdu_mlme.tid_tx[tid];
-                if (!tid_tx)
-                        continue;
+                tid_tx = sta->ampdu_mlme.tid_start_tx[tid];
+                if (tid_tx) {
+                        /*
+                         * Assign it over to the normal tid_tx array
+                         * where it "goes live".
+                         */
+                        spin_lock_bh(&sta->lock);
+
+                        sta->ampdu_mlme.tid_start_tx[tid] = NULL;
+                        /* could there be a race? */
+                        if (sta->ampdu_mlme.tid_tx[tid])
+                                kfree(tid_tx);
+                        else
+                                ieee80211_assign_tid_tx(sta, tid, tid_tx);
+                        spin_unlock_bh(&sta->lock);
 
-                if (test_bit(HT_AGG_STATE_WANT_START, &tid_tx->state))
                         ieee80211_tx_ba_session_handle_start(sta, tid);
-                else if (test_and_clear_bit(HT_AGG_STATE_WANT_STOP,
-                                            &tid_tx->state))
+                        continue;
+                }
+
+                tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
+                if (tid_tx && test_and_clear_bit(HT_AGG_STATE_WANT_STOP,
+                                                 &tid_tx->state))
                         ___ieee80211_stop_tx_ba_session(sta, tid,
                                                         WLAN_BACK_INITIATOR,
                                                         true);
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index b81860c94698..421eaa6b0c2b 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -662,12 +662,16 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
         int tx_last_beacon, len = req->len;
         struct sk_buff *skb;
         struct ieee80211_mgmt *resp;
+        struct sk_buff *presp;
         u8 *pos, *end;
 
         lockdep_assert_held(&ifibss->mtx);
 
+        presp = rcu_dereference_protected(ifibss->presp,
+                                          lockdep_is_held(&ifibss->mtx));
+
         if (ifibss->state != IEEE80211_IBSS_MLME_JOINED ||
-            len < 24 + 2 || !ifibss->presp)
+            len < 24 + 2 || !presp)
                 return;
 
         tx_last_beacon = drv_tx_last_beacon(local);
@@ -705,7 +709,7 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
         }
 
         /* Reply with ProbeResp */
-        skb = skb_copy(ifibss->presp, GFP_KERNEL);
+        skb = skb_copy(presp, GFP_KERNEL);
         if (!skb)
                 return;
 
@@ -985,7 +989,8 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
 
         /* remove beacon */
         kfree(sdata->u.ibss.ie);
-        skb = sdata->u.ibss.presp;
+        skb = rcu_dereference_protected(sdata->u.ibss.presp,
+                                        lockdep_is_held(&sdata->u.ibss.mtx));
         rcu_assign_pointer(sdata->u.ibss.presp, NULL);
         sdata->vif.bss_conf.ibss_joined = false;
         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED |
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 027c0467d7a3..2025af52b195 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -214,7 +214,7 @@ struct beacon_data {
 };
 
 struct ieee80211_if_ap {
-        struct beacon_data *beacon;
+        struct beacon_data __rcu *beacon;
 
         struct list_head vlans;
 
@@ -237,7 +237,7 @@ struct ieee80211_if_vlan {
         struct list_head list;
 
         /* used for all tx if the VLAN is configured to 4-addr mode */
-        struct sta_info *sta;
+        struct sta_info __rcu *sta;
 };
 
 struct mesh_stats {
@@ -442,7 +442,8 @@ struct ieee80211_if_ibss {
 
         unsigned long ibss_join_req;
         /* probe response/beacon for IBSS */
-        struct sk_buff *presp, *skb;
+        struct sk_buff __rcu *presp;
+        struct sk_buff *skb;
 
         enum {
                 IEEE80211_IBSS_MLME_SEARCH,
@@ -490,7 +491,11 @@ struct ieee80211_if_mesh {
         bool accepting_plinks;
         const u8 *ie;
         u8 ie_len;
-        bool is_secure;
+        enum {
+                IEEE80211_MESH_SEC_NONE = 0x0,
+                IEEE80211_MESH_SEC_AUTHED = 0x1,
+                IEEE80211_MESH_SEC_SECURED = 0x2,
+        } security;
 };
 
 #ifdef CONFIG_MAC80211_MESH
@@ -563,9 +568,10 @@ struct ieee80211_sub_if_data {
         struct ieee80211_fragment_entry fragments[IEEE80211_FRAGMENT_MAX];
         unsigned int fragment_next;
 
-        struct ieee80211_key *keys[NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS];
-        struct ieee80211_key *default_unicast_key, *default_multicast_key;
-        struct ieee80211_key *default_mgmt_key;
+        struct ieee80211_key __rcu *keys[NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS];
+        struct ieee80211_key __rcu *default_unicast_key;
+        struct ieee80211_key __rcu *default_multicast_key;
+        struct ieee80211_key __rcu *default_mgmt_key;
 
         u16 sequence_number;
         __be16 control_port_protocol;
@@ -764,6 +770,9 @@ struct ieee80211_local {
         /* device is started */
         bool started;
 
+        /* wowlan is enabled -- don't reconfig on resume */
+        bool wowlan;
+
         int tx_headroom; /* required headroom for hardware/radiotap */
 
         /* count for keys needing tailroom space allocation */
@@ -798,7 +807,7 @@ struct ieee80211_local {
         spinlock_t sta_lock;
         unsigned long num_sta;
         struct list_head sta_list, sta_pending_list;
-        struct sta_info *sta_hash[STA_HASH_SIZE];
+        struct sta_info __rcu *sta_hash[STA_HASH_SIZE];
         struct timer_list sta_cleanup;
         struct work_struct sta_finish_work;
         int sta_generation;
@@ -840,6 +849,10 @@ struct ieee80211_local {
         int scan_channel_idx;
         int scan_ies_len;
 
+        bool sched_scanning;
+        struct ieee80211_sched_scan_ies sched_scan_ies;
+        struct work_struct sched_scan_stopped_work;
+
         unsigned long leave_oper_channel_time;
         enum mac80211_scan_state next_scan_state;
         struct delayed_work scan_work;
@@ -1147,6 +1160,12 @@ ieee80211_rx_bss_get(struct ieee80211_local *local, u8 *bssid, int freq,
 void ieee80211_rx_bss_put(struct ieee80211_local *local,
                           struct ieee80211_bss *bss);
 
+/* scheduled scan handling */
+int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
+                                       struct cfg80211_sched_scan_request *req);
+int ieee80211_request_sched_scan_stop(struct ieee80211_sub_if_data *sdata);
+void ieee80211_sched_scan_stopped_work(struct work_struct *work);
+
 /* off-channel helpers */
 bool ieee80211_cfg_on_oper_channel(struct ieee80211_local *local);
 void ieee80211_offchannel_enable_all_ps(struct ieee80211_local *local,
@@ -1250,7 +1269,8 @@ int ieee80211_reconfig(struct ieee80211_local *local);
 void ieee80211_stop_device(struct ieee80211_local *local);
 
 #ifdef CONFIG_PM
-int __ieee80211_suspend(struct ieee80211_hw *hw);
+int __ieee80211_suspend(struct ieee80211_hw *hw,
+                        struct cfg80211_wowlan *wowlan);
 
 static inline int __ieee80211_resume(struct ieee80211_hw *hw)
 {
@@ -1263,7 +1283,8 @@ static inline int __ieee80211_resume(struct ieee80211_hw *hw)
         return ieee80211_reconfig(hw_to_local(hw));
 }
 #else
-static inline int __ieee80211_suspend(struct ieee80211_hw *hw)
+static inline int __ieee80211_suspend(struct ieee80211_hw *hw,
+                                      struct cfg80211_wowlan *wowlan)
 {
         return 0;
 }
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 80c29d626aa4..7dfbe71dc637 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -449,7 +449,8 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
         /* APs need special treatment */
         if (sdata->vif.type == NL80211_IFTYPE_AP) {
                 struct ieee80211_sub_if_data *vlan, *tmpsdata;
-                struct beacon_data *old_beacon = sdata->u.ap.beacon;
+                struct beacon_data *old_beacon =
+                        rtnl_dereference(sdata->u.ap.beacon);
 
                 /* sdata_running will return false, so this will disable */
                 ieee80211_bss_info_change_notify(sdata,
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index b510721e3b3d..31afd712930d 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -195,7 +195,7 @@ static void __ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata,
         assert_key_lock(sdata->local);
 
         if (idx >= 0 && idx < NUM_DEFAULT_KEYS)
-                key = sdata->keys[idx];
+                key = key_mtx_dereference(sdata->local, sdata->keys[idx]);
 
         if (uni)
                 rcu_assign_pointer(sdata->default_unicast_key, key);
@@ -222,7 +222,7 @@ __ieee80211_set_default_mgmt_key(struct ieee80211_sub_if_data *sdata, int idx)
 
         if (idx >= NUM_DEFAULT_KEYS &&
             idx < NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
-                key = sdata->keys[idx];
+                key = key_mtx_dereference(sdata->local, sdata->keys[idx]);
 
         rcu_assign_pointer(sdata->default_mgmt_key, key);
 
@@ -266,9 +266,15 @@ static void __ieee80211_key_replace(struct ieee80211_sub_if_data *sdata,
                 else
                         idx = new->conf.keyidx;
 
-                defunikey = old && sdata->default_unicast_key == old;
-                defmultikey = old && sdata->default_multicast_key == old;
-                defmgmtkey = old && sdata->default_mgmt_key == old;
+                defunikey = old &&
+                        old == key_mtx_dereference(sdata->local,
+                                                sdata->default_unicast_key);
+                defmultikey = old &&
+                        old == key_mtx_dereference(sdata->local,
+                                                sdata->default_multicast_key);
+                defmgmtkey = old &&
+                        old == key_mtx_dereference(sdata->local,
+                                                sdata->default_mgmt_key);
 
                 if (defunikey && !new)
                         __ieee80211_set_default_key(sdata, -1, true, false);
@@ -451,11 +457,11 @@ int ieee80211_key_link(struct ieee80211_key *key,
         mutex_lock(&sdata->local->key_mtx);
 
         if (sta && pairwise)
-                old_key = sta->ptk;
+                old_key = key_mtx_dereference(sdata->local, sta->ptk);
         else if (sta)
-                old_key = sta->gtk[idx];
+                old_key = key_mtx_dereference(sdata->local, sta->gtk[idx]);
         else
-                old_key = sdata->keys[idx];
+                old_key = key_mtx_dereference(sdata->local, sdata->keys[idx]);
 
         __ieee80211_key_replace(sdata, sta, pairwise, old_key, key);
         __ieee80211_key_destroy(old_key);
@@ -471,8 +477,11 @@ int ieee80211_key_link(struct ieee80211_key *key,
         return ret;
 }
 
-static void __ieee80211_key_free(struct ieee80211_key *key)
+void __ieee80211_key_free(struct ieee80211_key *key)
 {
+        if (!key)
+                return;
+
         /*
          * Replace key with nothingness if it was ever used.
          */
@@ -486,9 +495,6 @@ static void __ieee80211_key_free(struct ieee80211_key *key)
 void ieee80211_key_free(struct ieee80211_local *local,
                         struct ieee80211_key *key)
 {
-        if (!key)
-                return;
-
         mutex_lock(&local->key_mtx);
         __ieee80211_key_free(key);
         mutex_unlock(&local->key_mtx);
diff --git a/net/mac80211/key.h b/net/mac80211/key.h
index 4ddbe27eb570..d801d5351336 100644
--- a/net/mac80211/key.h
+++ b/net/mac80211/key.h
@@ -135,6 +135,7 @@ struct ieee80211_key *ieee80211_key_alloc(u32 cipher, int idx, size_t key_len,
 int __must_check ieee80211_key_link(struct ieee80211_key *key,
                                     struct ieee80211_sub_if_data *sdata,
                                     struct sta_info *sta);
+void __ieee80211_key_free(struct ieee80211_key *key);
 void ieee80211_key_free(struct ieee80211_local *local,
                         struct ieee80211_key *key);
 void ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata, int idx,
@@ -145,4 +146,7 @@ void ieee80211_free_keys(struct ieee80211_sub_if_data *sdata);
 void ieee80211_enable_keys(struct ieee80211_sub_if_data *sdata);
 void ieee80211_disable_keys(struct ieee80211_sub_if_data *sdata);
 
+#define key_mtx_dereference(local, ref) \
+        rcu_dereference_protected(ref, lockdep_is_held(&((local)->key_mtx)))
+
 #endif /* IEEE80211_KEY_H */
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 61877662e8f8..0d7b08db8e56 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -358,7 +358,8 @@ static void ieee80211_restart_work(struct work_struct *work)
         flush_workqueue(local->workqueue);
 
         mutex_lock(&local->mtx);
-        WARN(test_bit(SCAN_HW_SCANNING, &local->scanning),
+        WARN(test_bit(SCAN_HW_SCANNING, &local->scanning) ||
+             local->sched_scanning,
                 "%s called with hardware scan in progress\n", __func__);
         mutex_unlock(&local->mtx);
 
@@ -580,8 +581,7 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
 
         wiphy->flags |= WIPHY_FLAG_NETNS_OK |
                         WIPHY_FLAG_4ADDR_AP |
-                        WIPHY_FLAG_4ADDR_STATION |
-                        WIPHY_FLAG_SUPPORTS_SEPARATE_DEFAULT_KEYS;
+                        WIPHY_FLAG_4ADDR_STATION;
 
         if (!ops->set_key)
                 wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
@@ -652,6 +652,9 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
         setup_timer(&local->dynamic_ps_timer,
                     ieee80211_dynamic_ps_timer, (unsigned long) local);
 
+        INIT_WORK(&local->sched_scan_stopped_work,
+                  ieee80211_sched_scan_stopped_work);
+
         sta_info_init(local);
 
         for (i = 0; i < IEEE80211_MAX_QUEUES; i++) {
@@ -682,7 +685,7 @@ EXPORT_SYMBOL(ieee80211_alloc_hw);
 int ieee80211_register_hw(struct ieee80211_hw *hw)
 {
         struct ieee80211_local *local = hw_to_local(hw);
-        int result;
+        int result, i;
         enum ieee80211_band band;
         int channels, max_bitrates;
         bool supp_ht;
@@ -697,6 +700,13 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                 WLAN_CIPHER_SUITE_AES_CMAC
         };
 
+        if ((hw->wiphy->wowlan.flags || hw->wiphy->wowlan.n_patterns)
+#ifdef CONFIG_PM
+            && (!local->ops->suspend || !local->ops->resume)
+#endif
+            )
+                return -EINVAL;
+
         if (hw->max_report_rates == 0)
                 hw->max_report_rates = hw->max_rates;
 
@@ -733,11 +743,19 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                 return -ENOMEM;
 
         /* if low-level driver supports AP, we also support VLAN */
-        if (local->hw.wiphy->interface_modes & BIT(NL80211_IFTYPE_AP))
-                local->hw.wiphy->interface_modes |= BIT(NL80211_IFTYPE_AP_VLAN);
+        if (local->hw.wiphy->interface_modes & BIT(NL80211_IFTYPE_AP)) {
+                hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_AP_VLAN);
+                hw->wiphy->software_iftypes |= BIT(NL80211_IFTYPE_AP_VLAN);
+        }
 
         /* mac80211 always supports monitor */
-        local->hw.wiphy->interface_modes |= BIT(NL80211_IFTYPE_MONITOR);
+        hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_MONITOR);
+        hw->wiphy->software_iftypes |= BIT(NL80211_IFTYPE_MONITOR);
+
+        /* mac80211 doesn't support more than 1 channel */
+        for (i = 0; i < hw->wiphy->n_iface_combinations; i++)
+                if (hw->wiphy->iface_combinations[i].num_different_channels > 1)
+                        return -EINVAL;
 
 #ifndef CONFIG_MAC80211_MESH
         /* mesh depends on Kconfig, but drivers should set it if they want */
@@ -827,6 +845,9 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         if (!local->ops->remain_on_channel)
                 local->hw.wiphy->max_remain_on_channel_duration = 5000;
 
+        if (local->ops->sched_scan_start)
+                local->hw.wiphy->flags |= WIPHY_FLAG_SUPPORTS_SCHED_SCAN;
+
         result = wiphy_register(local->hw.wiphy);
         if (result < 0)
                 goto fail_wiphy_register;
@@ -850,8 +871,10 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
          * and we need some headroom for passing the frame to monitor
          * interfaces, but never both at the same time.
          */
+#ifndef __CHECKER__
         BUILD_BUG_ON(IEEE80211_TX_STATUS_HEADROOM !=
                         sizeof(struct ieee80211_tx_status_rtap_hdr));
+#endif
         local->tx_headroom = max_t(unsigned int , local->hw.extra_tx_headroom,
                                    sizeof(struct ieee80211_tx_status_rtap_hdr));
 
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index c1299e249541..29e9980c8e60 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -287,49 +287,6 @@ void mesh_mgmt_ies_add(struct sk_buff *skb, struct ieee80211_sub_if_data *sdata)
         }
 }
 
-u32 mesh_table_hash(u8 *addr, struct ieee80211_sub_if_data *sdata, struct mesh_table *tbl)
-{
-        /* Use last four bytes of hw addr and interface index as hash index */
-        return jhash_2words(*(u32 *)(addr+2), sdata->dev->ifindex, tbl->hash_rnd)
-                & tbl->hash_mask;
-}
-
-struct mesh_table *mesh_table_alloc(int size_order)
-{
-        int i;
-        struct mesh_table *newtbl;
-
-        newtbl = kmalloc(sizeof(struct mesh_table), GFP_KERNEL);
-        if (!newtbl)
-                return NULL;
-
-        newtbl->hash_buckets = kzalloc(sizeof(struct hlist_head) *
-                        (1 << size_order), GFP_KERNEL);
-
-        if (!newtbl->hash_buckets) {
-                kfree(newtbl);
-                return NULL;
-        }
-
-        newtbl->hashwlock = kmalloc(sizeof(spinlock_t) *
-                        (1 << size_order), GFP_KERNEL);
-        if (!newtbl->hashwlock) {
-                kfree(newtbl->hash_buckets);
-                kfree(newtbl);
-                return NULL;
-        }
-
-        newtbl->size_order = size_order;
-        newtbl->hash_mask = (1 << size_order) - 1;
-        atomic_set(&newtbl->entries,  0);
-        get_random_bytes(&newtbl->hash_rnd,
-                        sizeof(newtbl->hash_rnd));
-        for (i = 0; i <= newtbl->hash_mask; i++)
-                spin_lock_init(&newtbl->hashwlock[i]);
-
-        return newtbl;
-}
-
 
 static void ieee80211_mesh_path_timer(unsigned long data)
 {
@@ -574,7 +531,7 @@ static void ieee80211_mesh_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
                                &elems);
 
         /* ignore beacons from secure mesh peers if our security is off */
-        if (elems.rsn_len && !sdata->u.mesh.is_secure)
+        if (elems.rsn_len && sdata->u.mesh.security == IEEE80211_MESH_SEC_NONE)
                 return;
 
         if (elems.ds_params && elems.ds_params_len == 1)
@@ -600,7 +557,7 @@ static void ieee80211_mesh_rx_mgmt_action(struct ieee80211_sub_if_data *sdata,
                                           struct ieee80211_rx_status *rx_status)
 {
         switch (mgmt->u.action.category) {
-        case WLAN_CATEGORY_MESH_PLINK:
+        case WLAN_CATEGORY_MESH_ACTION:
                 mesh_rx_plink_frame(sdata, mgmt, len, rx_status);
                 break;
         case WLAN_CATEGORY_MESH_PATH_SEL:
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index 10acf1cc8082..e7c5fddb4804 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -92,7 +92,7 @@ struct mesh_path {
         u8 dst[ETH_ALEN];
         u8 mpp[ETH_ALEN];       /* used for MPP or MAP */
         struct ieee80211_sub_if_data *sdata;
-        struct sta_info *next_hop;
+        struct sta_info __rcu *next_hop;
         struct timer_list timer;
         struct sk_buff_head frame_queue;
         struct rcu_head rcu;
@@ -240,12 +240,8 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata,
 
 /* Private interfaces */
 /* Mesh tables */
-struct mesh_table *mesh_table_alloc(int size_order);
-void mesh_table_free(struct mesh_table *tbl, bool free_leafs);
 void mesh_mpath_table_grow(void);
 void mesh_mpp_table_grow(void);
-u32 mesh_table_hash(u8 *addr, struct ieee80211_sub_if_data *sdata,
-                struct mesh_table *tbl);
 /* Mesh paths */
 int mesh_path_error_tx(u8 ttl, u8 *target, __le32 target_sn, __le16 target_rcode,
                        const u8 *ra, struct ieee80211_sub_if_data *sdata);
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index e57f2e728cfe..2b18053070c1 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -391,7 +391,6 @@ static u32 hwmp_route_info_get(struct ieee80211_sub_if_data *sdata,
                             (mpath->flags & MESH_PATH_SN_VALID)) {
                                 if (SN_GT(mpath->sn, orig_sn) ||
                                     (mpath->sn == orig_sn &&
-                                     action == MPATH_PREQ &&
                                      new_metric >= mpath->metric)) {
                                         process = false;
                                         fresh_info = false;
@@ -561,6 +560,14 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
 }
 
 
+static inline struct sta_info *
+next_hop_deref_protected(struct mesh_path *mpath)
+{
+        return rcu_dereference_protected(mpath->next_hop,
+                                         lockdep_is_held(&mpath->state_lock));
+}
+
+
 static void hwmp_prep_frame_process(struct ieee80211_sub_if_data *sdata,
                                     struct ieee80211_mgmt *mgmt,
                                     u8 *prep_elem, u32 metric)
@@ -600,7 +607,7 @@ static void hwmp_prep_frame_process(struct ieee80211_sub_if_data *sdata,
                 spin_unlock_bh(&mpath->state_lock);
                 goto fail;
         }
-        memcpy(next_hop, mpath->next_hop->sta.addr, ETH_ALEN);
+        memcpy(next_hop, next_hop_deref_protected(mpath)->sta.addr, ETH_ALEN);
         spin_unlock_bh(&mpath->state_lock);
         --ttl;
         flags = PREP_IE_FLAGS(prep_elem);
@@ -652,7 +659,8 @@ static void hwmp_perr_frame_process(struct ieee80211_sub_if_data *sdata,
         if (mpath) {
                 spin_lock_bh(&mpath->state_lock);
                 if (mpath->flags & MESH_PATH_ACTIVE &&
-                    memcmp(ta, mpath->next_hop->sta.addr, ETH_ALEN) == 0 &&
+                    memcmp(ta, next_hop_deref_protected(mpath)->sta.addr,
+                                                        ETH_ALEN) == 0 &&
                     (!(mpath->flags & MESH_PATH_SN_VALID) ||
                     SN_GT(target_sn, mpath->sn))) {
                         mpath->flags &= ~MESH_PATH_ACTIVE;
@@ -914,6 +922,7 @@ int mesh_nexthop_lookup(struct sk_buff *skb,
 {
         struct sk_buff *skb_to_free = NULL;
         struct mesh_path *mpath;
+        struct sta_info *next_hop;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
         u8 *target_addr = hdr->addr3;
         int err = 0;
@@ -941,7 +950,11 @@ int mesh_nexthop_lookup(struct sk_buff *skb,
                         mesh_queue_preq(mpath,
                                         PREQ_Q_F_START | PREQ_Q_F_REFRESH);
                 }
-                memcpy(hdr->addr1, mpath->next_hop->sta.addr, ETH_ALEN);
+                next_hop = rcu_dereference(mpath->next_hop);
+                if (next_hop)
+                        memcpy(hdr->addr1, next_hop->sta.addr, ETH_ALEN);
+                else
+                        err = -ENOENT;
         } else {
                 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
                 if (!(mpath->flags & MESH_PATH_RESOLVING)) {
@@ -967,20 +980,11 @@ endlookup:
 
 void mesh_path_timer(unsigned long data)
 {
-        struct ieee80211_sub_if_data *sdata;
-        struct mesh_path *mpath;
-
-        rcu_read_lock();
-        mpath = (struct mesh_path *) data;
-        mpath = rcu_dereference(mpath);
-        if (!mpath)
-                goto endmpathtimer;
-        sdata = mpath->sdata;
+        struct mesh_path *mpath = (void *) data;
+        struct ieee80211_sub_if_data *sdata = mpath->sdata;
 
-        if (sdata->local->quiescing) {
-                rcu_read_unlock();
+        if (sdata->local->quiescing)
                 return;
-        }
 
         spin_lock_bh(&mpath->state_lock);
         if (mpath->flags & MESH_PATH_RESOLVED ||
@@ -997,8 +1001,6 @@ void mesh_path_timer(unsigned long data)
         }
 
         spin_unlock_bh(&mpath->state_lock);
-endmpathtimer:
-        rcu_read_unlock();
 }
 
 void
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 35c715adaae2..83ce48e31913 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -40,6 +40,50 @@ static struct mesh_table *mesh_paths;
 static struct mesh_table *mpp_paths; /* Store paths for MPP&MAP */
 
 int mesh_paths_generation;
+
+/* This lock will have the grow table function as writer and add / delete nodes
+ * as readers. When reading the table (i.e. doing lookups) we are well protected
+ * by RCU
+ */
+static DEFINE_RWLOCK(pathtbl_resize_lock);
+
+
+static struct mesh_table *mesh_table_alloc(int size_order)
+{
+        int i;
+        struct mesh_table *newtbl;
+
+        newtbl = kmalloc(sizeof(struct mesh_table), GFP_KERNEL);
+        if (!newtbl)
+                return NULL;
+
+        newtbl->hash_buckets = kzalloc(sizeof(struct hlist_head) *
+                        (1 << size_order), GFP_KERNEL);
+
+        if (!newtbl->hash_buckets) {
+                kfree(newtbl);
+                return NULL;
+        }
+
+        newtbl->hashwlock = kmalloc(sizeof(spinlock_t) *
+                        (1 << size_order), GFP_KERNEL);
+        if (!newtbl->hashwlock) {
+                kfree(newtbl->hash_buckets);
+                kfree(newtbl);
+                return NULL;
+        }
+
+        newtbl->size_order = size_order;
+        newtbl->hash_mask = (1 << size_order) - 1;
+        atomic_set(&newtbl->entries,  0);
+        get_random_bytes(&newtbl->hash_rnd,
+                        sizeof(newtbl->hash_rnd));
+        for (i = 0; i <= newtbl->hash_mask; i++)
+                spin_lock_init(&newtbl->hashwlock[i]);
+
+        return newtbl;
+}
+
 static void __mesh_table_free(struct mesh_table *tbl)
 {
         kfree(tbl->hash_buckets);
@@ -47,7 +91,7 @@ static void __mesh_table_free(struct mesh_table *tbl)
         kfree(tbl);
 }
 
-void mesh_table_free(struct mesh_table *tbl, bool free_leafs)
+static void mesh_table_free(struct mesh_table *tbl, bool free_leafs)
 {
         struct hlist_head *mesh_hash;
         struct hlist_node *p, *q;
@@ -55,18 +99,18 @@ void mesh_table_free(struct mesh_table *tbl, bool free_leafs)
 
         mesh_hash = tbl->hash_buckets;
         for (i = 0; i <= tbl->hash_mask; i++) {
-                spin_lock(&tbl->hashwlock[i]);
+                spin_lock_bh(&tbl->hashwlock[i]);
                 hlist_for_each_safe(p, q, &mesh_hash[i]) {
                         tbl->free_node(p, free_leafs);
                         atomic_dec(&tbl->entries);
                 }
-                spin_unlock(&tbl->hashwlock[i]);
+                spin_unlock_bh(&tbl->hashwlock[i]);
         }
         __mesh_table_free(tbl);
 }
 
 static int mesh_table_grow(struct mesh_table *oldtbl,
-                struct mesh_table *newtbl)
+                           struct mesh_table *newtbl)
 {
         struct hlist_head *oldhash;
         struct hlist_node *p, *q;
@@ -76,7 +120,6 @@ static int mesh_table_grow(struct mesh_table *oldtbl,
                         < oldtbl->mean_chain_len * (oldtbl->hash_mask + 1))
                 return -EAGAIN;
 
-
         newtbl->free_node = oldtbl->free_node;
         newtbl->mean_chain_len = oldtbl->mean_chain_len;
         newtbl->copy_node = oldtbl->copy_node;
@@ -98,12 +141,14 @@ errcopy:
         return -ENOMEM;
 }
 
+static u32 mesh_table_hash(u8 *addr, struct ieee80211_sub_if_data *sdata,
+                           struct mesh_table *tbl)
+{
+        /* Use last four bytes of hw addr and interface index as hash index */
+        return jhash_2words(*(u32 *)(addr+2), sdata->dev->ifindex, tbl->hash_rnd)
+                & tbl->hash_mask;
+}
 
-/* This lock will have the grow table function as writer and add / delete nodes
- * as readers. When reading the table (i.e. doing lookups) we are well protected
- * by RCU
- */
-static DEFINE_RWLOCK(pathtbl_resize_lock);
 
 /**
  *
@@ -275,7 +320,7 @@ int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata)
         if (!new_node)
                 goto err_node_alloc;
 
-        read_lock(&pathtbl_resize_lock);
+        read_lock_bh(&pathtbl_resize_lock);
         memcpy(new_mpath->dst, dst, ETH_ALEN);
         new_mpath->sdata = sdata;
         new_mpath->flags = 0;
@@ -290,7 +335,7 @@ int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata)
         hash_idx = mesh_table_hash(dst, sdata, mesh_paths);
         bucket = &mesh_paths->hash_buckets[hash_idx];
 
-        spin_lock(&mesh_paths->hashwlock[hash_idx]);
+        spin_lock_bh(&mesh_paths->hashwlock[hash_idx]);
 
         err = -EEXIST;
         hlist_for_each_entry(node, n, bucket, list) {
@@ -306,8 +351,8 @@ int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata)
 
         mesh_paths_generation++;
 
-        spin_unlock(&mesh_paths->hashwlock[hash_idx]);
-        read_unlock(&pathtbl_resize_lock);
+        spin_unlock_bh(&mesh_paths->hashwlock[hash_idx]);
+        read_unlock_bh(&pathtbl_resize_lock);
         if (grow) {
                 set_bit(MESH_WORK_GROW_MPATH_TABLE,  &ifmsh->wrkq_flags);
                 ieee80211_queue_work(&local->hw, &sdata->work);
@@ -315,8 +360,8 @@ int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata)
         return 0;
 
 err_exists:
-        spin_unlock(&mesh_paths->hashwlock[hash_idx]);
-        read_unlock(&pathtbl_resize_lock);
+        spin_unlock_bh(&mesh_paths->hashwlock[hash_idx]);
+        read_unlock_bh(&pathtbl_resize_lock);
         kfree(new_node);
 err_node_alloc:
         kfree(new_mpath);
@@ -329,18 +374,21 @@ void mesh_mpath_table_grow(void)
 {
         struct mesh_table *oldtbl, *newtbl;
 
-        newtbl = mesh_table_alloc(mesh_paths->size_order + 1);
+        rcu_read_lock();
+        newtbl = mesh_table_alloc(rcu_dereference(mesh_paths)->size_order + 1);
         if (!newtbl)
                 return;
-        write_lock(&pathtbl_resize_lock);
+        write_lock_bh(&pathtbl_resize_lock);
         oldtbl = mesh_paths;
         if (mesh_table_grow(mesh_paths, newtbl) < 0) {
+                rcu_read_unlock();
                 __mesh_table_free(newtbl);
-                write_unlock(&pathtbl_resize_lock);
+                write_unlock_bh(&pathtbl_resize_lock);
                 return;
         }
+        rcu_read_unlock();
         rcu_assign_pointer(mesh_paths, newtbl);
-        write_unlock(&pathtbl_resize_lock);
+        write_unlock_bh(&pathtbl_resize_lock);
 
         synchronize_rcu();
         mesh_table_free(oldtbl, false);
@@ -350,18 +398,21 @@ void mesh_mpp_table_grow(void)
 {
         struct mesh_table *oldtbl, *newtbl;
 
-        newtbl = mesh_table_alloc(mpp_paths->size_order + 1);
+        rcu_read_lock();
+        newtbl = mesh_table_alloc(rcu_dereference(mpp_paths)->size_order + 1);
         if (!newtbl)
                 return;
-        write_lock(&pathtbl_resize_lock);
+        write_lock_bh(&pathtbl_resize_lock);
         oldtbl = mpp_paths;
         if (mesh_table_grow(mpp_paths, newtbl) < 0) {
+                rcu_read_unlock();
                 __mesh_table_free(newtbl);
-                write_unlock(&pathtbl_resize_lock);
+                write_unlock_bh(&pathtbl_resize_lock);
                 return;
         }
+        rcu_read_unlock();
         rcu_assign_pointer(mpp_paths, newtbl);
-        write_unlock(&pathtbl_resize_lock);
+        write_unlock_bh(&pathtbl_resize_lock);
 
         synchronize_rcu();
         mesh_table_free(oldtbl, false);
@@ -395,7 +446,7 @@ int mpp_path_add(u8 *dst, u8 *mpp, struct ieee80211_sub_if_data *sdata)
         if (!new_node)
                 goto err_node_alloc;
 
-        read_lock(&pathtbl_resize_lock);
+        read_lock_bh(&pathtbl_resize_lock);
         memcpy(new_mpath->dst, dst, ETH_ALEN);
         memcpy(new_mpath->mpp, mpp, ETH_ALEN);
         new_mpath->sdata = sdata;
@@ -408,7 +459,7 @@ int mpp_path_add(u8 *dst, u8 *mpp, struct ieee80211_sub_if_data *sdata)
         hash_idx = mesh_table_hash(dst, sdata, mpp_paths);
         bucket = &mpp_paths->hash_buckets[hash_idx];
 
-        spin_lock(&mpp_paths->hashwlock[hash_idx]);
+        spin_lock_bh(&mpp_paths->hashwlock[hash_idx]);
 
         err = -EEXIST;
         hlist_for_each_entry(node, n, bucket, list) {
@@ -422,8 +473,8 @@ int mpp_path_add(u8 *dst, u8 *mpp, struct ieee80211_sub_if_data *sdata)
                 mpp_paths->mean_chain_len * (mpp_paths->hash_mask + 1))
                 grow = 1;
 
-        spin_unlock(&mpp_paths->hashwlock[hash_idx]);
-        read_unlock(&pathtbl_resize_lock);
+        spin_unlock_bh(&mpp_paths->hashwlock[hash_idx]);
+        read_unlock_bh(&pathtbl_resize_lock);
         if (grow) {
                 set_bit(MESH_WORK_GROW_MPP_TABLE,  &ifmsh->wrkq_flags);
                 ieee80211_queue_work(&local->hw, &sdata->work);
@@ -431,8 +482,8 @@ int mpp_path_add(u8 *dst, u8 *mpp, struct ieee80211_sub_if_data *sdata)
         return 0;
 
 err_exists:
-        spin_unlock(&mpp_paths->hashwlock[hash_idx]);
-        read_unlock(&pathtbl_resize_lock);
+        spin_unlock_bh(&mpp_paths->hashwlock[hash_idx]);
+        read_unlock_bh(&pathtbl_resize_lock);
         kfree(new_node);
 err_node_alloc:
         kfree(new_mpath);
@@ -545,11 +596,11 @@ int mesh_path_del(u8 *addr, struct ieee80211_sub_if_data *sdata)
         int hash_idx;
         int err = 0;
 
-        read_lock(&pathtbl_resize_lock);
+        read_lock_bh(&pathtbl_resize_lock);
         hash_idx = mesh_table_hash(addr, sdata, mesh_paths);
         bucket = &mesh_paths->hash_buckets[hash_idx];
 
-        spin_lock(&mesh_paths->hashwlock[hash_idx]);
+        spin_lock_bh(&mesh_paths->hashwlock[hash_idx]);
         hlist_for_each_entry(node, n, bucket, list) {
                 mpath = node->mpath;
                 if (mpath->sdata == sdata &&
@@ -567,8 +618,8 @@ int mesh_path_del(u8 *addr, struct ieee80211_sub_if_data *sdata)
         err = -ENXIO;
 enddel:
         mesh_paths_generation++;
-        spin_unlock(&mesh_paths->hashwlock[hash_idx]);
-        read_unlock(&pathtbl_resize_lock);
+        spin_unlock_bh(&mesh_paths->hashwlock[hash_idx]);
+        read_unlock_bh(&pathtbl_resize_lock);
         return err;
 }
 
@@ -720,7 +771,7 @@ void mesh_path_expire(struct ieee80211_sub_if_data *sdata)
         struct hlist_node *p;
         int i;
 
-        read_lock(&pathtbl_resize_lock);
+        read_lock_bh(&pathtbl_resize_lock);
         for_each_mesh_entry(mesh_paths, p, node, i) {
                 if (node->mpath->sdata != sdata)
                         continue;
@@ -735,7 +786,7 @@ void mesh_path_expire(struct ieee80211_sub_if_data *sdata)
                 } else
                         spin_unlock_bh(&mpath->state_lock);
         }
-        read_unlock(&pathtbl_resize_lock);
+        read_unlock_bh(&pathtbl_resize_lock);
 }
 
 void mesh_pathtbl_unregister(void)
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index 84e5b056af02..f4adc0917888 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -43,7 +43,7 @@
 #define dot11MeshMaxPeerLinks(s) (s->u.mesh.mshcfg.dot11MeshMaxPeerLinks)
 
 enum plink_frame_type {
-        PLINK_OPEN = 0,
+        PLINK_OPEN = 1,
         PLINK_CONFIRM,
         PLINK_CLOSE
 };
@@ -83,7 +83,7 @@ void mesh_plink_dec_estab_count(struct ieee80211_sub_if_data *sdata)
  */
 static inline void mesh_plink_fsm_restart(struct sta_info *sta)
 {
-        sta->plink_state = PLINK_LISTEN;
+        sta->plink_state = NL80211_PLINK_LISTEN;
         sta->llid = sta->plid = sta->reason = 0;
         sta->plink_retries = 0;
 }
@@ -126,11 +126,11 @@ static bool __mesh_plink_deactivate(struct sta_info *sta)
         struct ieee80211_sub_if_data *sdata = sta->sdata;
         bool deactivated = false;
 
-        if (sta->plink_state == PLINK_ESTAB) {
+        if (sta->plink_state == NL80211_PLINK_ESTAB) {
                 mesh_plink_dec_estab_count(sdata);
                 deactivated = true;
         }
-        sta->plink_state = PLINK_BLOCKED;
+        sta->plink_state = NL80211_PLINK_BLOCKED;
         mesh_path_flush_by_nexthop(sta);
 
         return deactivated;
@@ -181,8 +181,8 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
                                           IEEE80211_STYPE_ACTION);
         memcpy(mgmt->da, da, ETH_ALEN);
         memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
-        /* BSSID is left zeroed, wildcard value */
-        mgmt->u.action.category = WLAN_CATEGORY_MESH_PLINK;
+        memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
+        mgmt->u.action.category = WLAN_CATEGORY_MESH_ACTION;
         mgmt->u.action.u.plink_action.action_code = action;
 
         if (action == PLINK_CLOSE)
@@ -251,7 +251,7 @@ void mesh_neighbour_update(u8 *hw_addr, u32 rates,
                 rcu_read_unlock();
                 /* Userspace handles peer allocation when security is enabled
                  * */
-                if (sdata->u.mesh.is_secure)
+                if (sdata->u.mesh.security & IEEE80211_MESH_SEC_AUTHED)
                         cfg80211_notify_new_peer_candidate(sdata->dev, hw_addr,
                                         elems->ie_start, elems->total_len,
                                         GFP_KERNEL);
@@ -268,7 +268,7 @@ void mesh_neighbour_update(u8 *hw_addr, u32 rates,
         sta->last_rx = jiffies;
         sta->sta.supp_rates[local->hw.conf.channel->band] = rates;
         if (mesh_peer_accepts_plinks(elems) &&
-                        sta->plink_state == PLINK_LISTEN &&
+                        sta->plink_state == NL80211_PLINK_LISTEN &&
                         sdata->u.mesh.accepting_plinks &&
                         sdata->u.mesh.mshcfg.auto_open_plinks)
                 mesh_plink_open(sta);
@@ -308,8 +308,8 @@ static void mesh_plink_timer(unsigned long data)
         sdata = sta->sdata;
 
         switch (sta->plink_state) {
-        case PLINK_OPN_RCVD:
-        case PLINK_OPN_SNT:
+        case NL80211_PLINK_OPN_RCVD:
+        case NL80211_PLINK_OPN_SNT:
                 /* retry timer */
                 if (sta->plink_retries < dot11MeshMaxRetries(sdata)) {
                         u32 rand;
@@ -328,17 +328,17 @@ static void mesh_plink_timer(unsigned long data)
                 }
                 reason = cpu_to_le16(MESH_MAX_RETRIES);
                 /* fall through on else */
-        case PLINK_CNF_RCVD:
+        case NL80211_PLINK_CNF_RCVD:
                 /* confirm timer */
                 if (!reason)
                         reason = cpu_to_le16(MESH_CONFIRM_TIMEOUT);
-                sta->plink_state = PLINK_HOLDING;
+                sta->plink_state = NL80211_PLINK_HOLDING;
                 mod_plink_timer(sta, dot11MeshHoldingTimeout(sdata));
                 spin_unlock_bh(&sta->lock);
                 mesh_plink_frame_tx(sdata, PLINK_CLOSE, sta->sta.addr, llid, plid,
                                     reason);
                 break;
-        case PLINK_HOLDING:
+        case NL80211_PLINK_HOLDING:
                 /* holding timer */
                 del_timer(&sta->plink_timer);
                 mesh_plink_fsm_restart(sta);
@@ -386,11 +386,11 @@ int mesh_plink_open(struct sta_info *sta)
         spin_lock_bh(&sta->lock);
         get_random_bytes(&llid, 2);
         sta->llid = llid;
-        if (sta->plink_state != PLINK_LISTEN) {
+        if (sta->plink_state != NL80211_PLINK_LISTEN) {
                 spin_unlock_bh(&sta->lock);
                 return -EBUSY;
         }
-        sta->plink_state = PLINK_OPN_SNT;
+        sta->plink_state = NL80211_PLINK_OPN_SNT;
         mesh_plink_timer_set(sta, dot11MeshRetryTimeout(sdata));
         spin_unlock_bh(&sta->lock);
         mpl_dbg("Mesh plink: starting establishment with %pM\n",
@@ -407,7 +407,7 @@ void mesh_plink_block(struct sta_info *sta)
 
         spin_lock_bh(&sta->lock);
         deactivated = __mesh_plink_deactivate(sta);
-        sta->plink_state = PLINK_BLOCKED;
+        sta->plink_state = NL80211_PLINK_BLOCKED;
         spin_unlock_bh(&sta->lock);
 
         if (deactivated)
@@ -430,13 +430,13 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
         __le16 plid, llid, reason;
 #ifdef CONFIG_MAC80211_VERBOSE_MPL_DEBUG
         static const char *mplstates[] = {
-                [PLINK_LISTEN] = "LISTEN",
-                [PLINK_OPN_SNT] = "OPN-SNT",
-                [PLINK_OPN_RCVD] = "OPN-RCVD",
-                [PLINK_CNF_RCVD] = "CNF_RCVD",
-                [PLINK_ESTAB] = "ESTAB",
-                [PLINK_HOLDING] = "HOLDING",
-                [PLINK_BLOCKED] = "BLOCKED"
+                [NL80211_PLINK_LISTEN] = "LISTEN",
+                [NL80211_PLINK_OPN_SNT] = "OPN-SNT",
+                [NL80211_PLINK_OPN_RCVD] = "OPN-RCVD",
+                [NL80211_PLINK_CNF_RCVD] = "CNF_RCVD",
+                [NL80211_PLINK_ESTAB] = "ESTAB",
+                [NL80211_PLINK_HOLDING] = "HOLDING",
+                [NL80211_PLINK_BLOCKED] = "BLOCKED"
         };
 #endif
 
@@ -460,7 +460,8 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 mpl_dbg("Mesh plink: missing necessary peer link ie\n");
                 return;
         }
-        if (elems.rsn_len && !sdata->u.mesh.is_secure) {
+        if (elems.rsn_len &&
+                        sdata->u.mesh.security == IEEE80211_MESH_SEC_NONE) {
                 mpl_dbg("Mesh plink: can't establish link with secure peer\n");
                 return;
         }
@@ -501,7 +502,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 return;
         }
 
-        if (sta && sta->plink_state == PLINK_BLOCKED) {
+        if (sta && sta->plink_state == NL80211_PLINK_BLOCKED) {
                 rcu_read_unlock();
                 return;
         }
@@ -571,7 +572,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                                 event = CNF_ACPT;
                         break;
                 case PLINK_CLOSE:
-                        if (sta->plink_state == PLINK_ESTAB)
+                        if (sta->plink_state == NL80211_PLINK_ESTAB)
                                 /* Do not check for llid or plid. This does not
                                  * follow the standard but since multiple plinks
                                  * per sta are not supported, it is necessary in
@@ -606,14 +607,14 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
         reason = 0;
         switch (sta->plink_state) {
                 /* spin_unlock as soon as state is updated at each case */
-        case PLINK_LISTEN:
+        case NL80211_PLINK_LISTEN:
                 switch (event) {
                 case CLS_ACPT:
                         mesh_plink_fsm_restart(sta);
                         spin_unlock_bh(&sta->lock);
                         break;
                 case OPN_ACPT:
-                        sta->plink_state = PLINK_OPN_RCVD;
+                        sta->plink_state = NL80211_PLINK_OPN_RCVD;
                         sta->plid = plid;
                         get_random_bytes(&llid, 2);
                         sta->llid = llid;
@@ -630,7 +631,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 }
                 break;
 
-        case PLINK_OPN_SNT:
+        case NL80211_PLINK_OPN_SNT:
                 switch (event) {
                 case OPN_RJCT:
                 case CNF_RJCT:
@@ -639,7 +640,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                         if (!reason)
                                 reason = cpu_to_le16(MESH_CLOSE_RCVD);
                         sta->reason = reason;
-                        sta->plink_state = PLINK_HOLDING;
+                        sta->plink_state = NL80211_PLINK_HOLDING;
                         if (!mod_plink_timer(sta,
                                              dot11MeshHoldingTimeout(sdata)))
                                 sta->ignore_plink_timer = true;
@@ -651,7 +652,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                         break;
                 case OPN_ACPT:
                         /* retry timer is left untouched */
-                        sta->plink_state = PLINK_OPN_RCVD;
+                        sta->plink_state = NL80211_PLINK_OPN_RCVD;
                         sta->plid = plid;
                         llid = sta->llid;
                         spin_unlock_bh(&sta->lock);
@@ -659,7 +660,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                                             plid, 0);
                         break;
                 case CNF_ACPT:
-                        sta->plink_state = PLINK_CNF_RCVD;
+                        sta->plink_state = NL80211_PLINK_CNF_RCVD;
                         if (!mod_plink_timer(sta,
                                              dot11MeshConfirmTimeout(sdata)))
                                 sta->ignore_plink_timer = true;
@@ -672,7 +673,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 }
                 break;
 
-        case PLINK_OPN_RCVD:
+        case NL80211_PLINK_OPN_RCVD:
                 switch (event) {
                 case OPN_RJCT:
                 case CNF_RJCT:
@@ -681,7 +682,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                         if (!reason)
                                 reason = cpu_to_le16(MESH_CLOSE_RCVD);
                         sta->reason = reason;
-                        sta->plink_state = PLINK_HOLDING;
+                        sta->plink_state = NL80211_PLINK_HOLDING;
                         if (!mod_plink_timer(sta,
                                              dot11MeshHoldingTimeout(sdata)))
                                 sta->ignore_plink_timer = true;
@@ -699,7 +700,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                         break;
                 case CNF_ACPT:
                         del_timer(&sta->plink_timer);
-                        sta->plink_state = PLINK_ESTAB;
+                        sta->plink_state = NL80211_PLINK_ESTAB;
                         spin_unlock_bh(&sta->lock);
                         mesh_plink_inc_estab_count(sdata);
                         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
@@ -712,7 +713,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 }
                 break;
 
-        case PLINK_CNF_RCVD:
+        case NL80211_PLINK_CNF_RCVD:
                 switch (event) {
                 case OPN_RJCT:
                 case CNF_RJCT:
@@ -721,7 +722,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                         if (!reason)
                                 reason = cpu_to_le16(MESH_CLOSE_RCVD);
                         sta->reason = reason;
-                        sta->plink_state = PLINK_HOLDING;
+                        sta->plink_state = NL80211_PLINK_HOLDING;
                         if (!mod_plink_timer(sta,
                                              dot11MeshHoldingTimeout(sdata)))
                                 sta->ignore_plink_timer = true;
@@ -733,7 +734,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                         break;
                 case OPN_ACPT:
                         del_timer(&sta->plink_timer);
-                        sta->plink_state = PLINK_ESTAB;
+                        sta->plink_state = NL80211_PLINK_ESTAB;
                         spin_unlock_bh(&sta->lock);
                         mesh_plink_inc_estab_count(sdata);
                         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON);
@@ -748,13 +749,13 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                 }
                 break;
 
-        case PLINK_ESTAB:
+        case NL80211_PLINK_ESTAB:
                 switch (event) {
                 case CLS_ACPT:
                         reason = cpu_to_le16(MESH_CLOSE_RCVD);
                         sta->reason = reason;
                         deactivated = __mesh_plink_deactivate(sta);
-                        sta->plink_state = PLINK_HOLDING;
+                        sta->plink_state = NL80211_PLINK_HOLDING;
                         llid = sta->llid;
                         mod_plink_timer(sta, dot11MeshHoldingTimeout(sdata));
                         spin_unlock_bh(&sta->lock);
@@ -774,7 +775,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
                         break;
                 }
                 break;
-        case PLINK_HOLDING:
+        case NL80211_PLINK_HOLDING:
                 switch (event) {
                 case CLS_ACPT:
                         if (del_timer(&sta->plink_timer))
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index a41f234bd486..4f6b2675e41d 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -750,6 +750,8 @@ void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
                              dynamic_ps_enable_work);
         struct ieee80211_sub_if_data *sdata = local->ps_sdata;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        unsigned long flags;
+        int q;
 
         /* can only happen when PS was just disabled anyway */
         if (!sdata)
@@ -758,6 +760,24 @@ void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
         if (local->hw.conf.flags & IEEE80211_CONF_PS)
                 return;
 
+        /*
+         * transmission can be stopped by others which leads to
+         * dynamic_ps_timer expiry. Postpond the ps timer if it
+         * is not the actual idle state.
+         */
+        spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
+        for (q = 0; q < local->hw.queues; q++) {
+                if (local->queue_stop_reasons[q]) {
+                        spin_unlock_irqrestore(&local->queue_stop_reason_lock,
+                                               flags);
+                        mod_timer(&local->dynamic_ps_timer, jiffies +
+                                  msecs_to_jiffies(
+                                  local->hw.conf.dynamic_ps_timeout));
+                        return;
+                }
+        }
+        spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+
         if ((local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) &&
             (!(ifmgd->flags & IEEE80211_STA_NULLFUNC_ACKED))) {
                 netif_tx_stop_all_queues(sdata->dev);
@@ -781,7 +801,7 @@ void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
         }
 
-        netif_tx_start_all_queues(sdata->dev);
+        netif_tx_wake_all_queues(sdata->dev);
 }
 
 void ieee80211_dynamic_ps_timer(unsigned long data)
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index 042461710880..730778a2c90c 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -6,7 +6,7 @@
 #include "driver-ops.h"
 #include "led.h"
 
-int __ieee80211_suspend(struct ieee80211_hw *hw)
+int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
 {
         struct ieee80211_local *local = hw_to_local(hw);
         struct ieee80211_sub_if_data *sdata;
@@ -47,6 +47,16 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
         cancel_work_sync(&local->dynamic_ps_enable_work);
         del_timer_sync(&local->dynamic_ps_timer);
 
+        local->wowlan = wowlan && local->open_count;
+        if (local->wowlan) {
+                int err = drv_suspend(local, wowlan);
+                if (err) {
+                        local->quiescing = false;
+                        return err;
+                }
+                goto suspend;
+        }
+
         /* disable keys */
         list_for_each_entry(sdata, &local->interfaces, list)
                 ieee80211_disable_keys(sdata);
@@ -104,6 +114,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
         if (local->open_count)
                 ieee80211_stop_device(local);
 
+ suspend:
         local->suspended = true;
         /* need suspended to be visible before quiescing is false */
         barrier();
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index 778c604d7939..8adac67395f7 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -417,8 +417,8 @@ minstrel_rate_init(void *priv, struct ieee80211_supported_band *sband,
                         tx_time_single = mr->ack_time + mr->perfect_tx_time;
 
                         /* contention window */
-                        tx_time_single += t_slot + min(cw, mp->cw_max);
-                        cw = (cw << 1) | 1;
+                        tx_time_single += (t_slot * cw) >> 1;
+                        cw = min((cw << 1) | 1, mp->cw_max);
 
                         tx_time += tx_time_single;
                         tx_time_cts += tx_time_single + mi->sp_ack_dur;
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index c06aa3ac6b9d..333b5118be6d 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -464,6 +464,7 @@ minstrel_calc_retransmit(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
         const struct mcs_group *group;
         unsigned int tx_time, tx_time_rtscts, tx_time_data;
         unsigned int cw = mp->cw_min;
+        unsigned int ctime = 0;
         unsigned int t_slot = 9; /* FIXME */
         unsigned int ampdu_len = MINSTREL_TRUNC(mi->avg_ampdu_len);
 
@@ -480,13 +481,27 @@ minstrel_calc_retransmit(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
 
         group = &minstrel_mcs_groups[index / MCS_GROUP_RATES];
         tx_time_data = group->duration[index % MCS_GROUP_RATES] * ampdu_len;
-        tx_time = 2 * (t_slot + mi->overhead + tx_time_data);
-        tx_time_rtscts = 2 * (t_slot + mi->overhead_rtscts + tx_time_data);
+
+        /* Contention time for first 2 tries */
+        ctime = (t_slot * cw) >> 1;
+        cw = min((cw << 1) | 1, mp->cw_max);
+        ctime += (t_slot * cw) >> 1;
+        cw = min((cw << 1) | 1, mp->cw_max);
+
+        /* Total TX time for data and Contention after first 2 tries */
+        tx_time = ctime + 2 * (mi->overhead + tx_time_data);
+        tx_time_rtscts = ctime + 2 * (mi->overhead_rtscts + tx_time_data);
+
+        /* See how many more tries we can fit inside segment size */
         do {
-                cw = (cw << 1) | 1;
-                cw = min(cw, mp->cw_max);
-                tx_time += cw + t_slot + mi->overhead;
-                tx_time_rtscts += cw + t_slot + mi->overhead_rtscts;
+                /* Contention time for this try */
+                ctime = (t_slot * cw) >> 1;
+                cw = min((cw << 1) | 1, mp->cw_max);
+
+                /* Total TX time after this try */
+                tx_time += ctime + mi->overhead + tx_time_data;
+                tx_time_rtscts += ctime + mi->overhead_rtscts + tx_time_data;
+
                 if (tx_time_rtscts < mp->segment_size)
                         mr->retry_count_rtscts++;
         } while ((tx_time < mp->segment_size) &&
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 13a6697651ad..7fa8c6be7bf0 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -404,11 +404,13 @@ ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
         struct sk_buff *skb = rx->skb;
 
-        if (likely(!(status->rx_flags & IEEE80211_RX_IN_SCAN)))
+        if (likely(!(status->rx_flags & IEEE80211_RX_IN_SCAN) &&
+                   !local->sched_scanning))
                 return RX_CONTINUE;
 
         if (test_bit(SCAN_HW_SCANNING, &local->scanning) ||
-            test_bit(SCAN_SW_SCANNING, &local->scanning))
+            test_bit(SCAN_SW_SCANNING, &local->scanning) ||
+            local->sched_scanning)
                 return ieee80211_scan_rx(rx->sdata, skb);
 
         /* scanning finished during invoking of handlers */
@@ -488,15 +490,18 @@ ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
          * establisment frame, beacon or probe, drop the frame.
          */
 
-        if (!rx->sta || sta_plink_state(rx->sta) != PLINK_ESTAB) {
+        if (!rx->sta || sta_plink_state(rx->sta) != NL80211_PLINK_ESTAB) {
                 struct ieee80211_mgmt *mgmt;
 
                 if (!ieee80211_is_mgmt(hdr->frame_control))
                         return RX_DROP_MONITOR;
 
                 if (ieee80211_is_action(hdr->frame_control)) {
+                        u8 category;
                         mgmt = (struct ieee80211_mgmt *)hdr;
-                        if (mgmt->u.action.category != WLAN_CATEGORY_MESH_PLINK)
+                        category = mgmt->u.action.category;
+                        if (category != WLAN_CATEGORY_MESH_ACTION &&
+                                category != WLAN_CATEGORY_SELF_PROTECTED)
                                 return RX_DROP_MONITOR;
                         return RX_CONTINUE;
                 }
@@ -1778,7 +1783,7 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
 
         ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
                                  rx->sdata->vif.type,
-                                 rx->local->hw.extra_tx_headroom);
+                                 rx->local->hw.extra_tx_headroom, true);
 
         while (!skb_queue_empty(&frame_list)) {
                 rx->skb = __skb_dequeue(&frame_list);
@@ -2205,7 +2210,7 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                         goto handled;
                 }
                 break;
-        case WLAN_CATEGORY_MESH_PLINK:
+        case WLAN_CATEGORY_MESH_ACTION:
                 if (!ieee80211_vif_is_mesh(&sdata->vif))
                         break;
                 goto queue;
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 489b6ad200d4..d20046b5d8f4 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -15,6 +15,7 @@
 #include <linux/if_arp.h>
 #include <linux/rtnetlink.h>
 #include <linux/pm_qos_params.h>
+#include <linux/slab.h>
 #include <net/sch_generic.h>
 #include <linux/slab.h>
 #include <net/mac80211.h>
@@ -170,7 +171,7 @@ ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
                 return RX_CONTINUE;
 
         if (skb->len < 24)
-                return RX_DROP_MONITOR;
+                return RX_CONTINUE;
 
         presp = ieee80211_is_probe_resp(fc);
         if (presp) {
@@ -850,3 +851,122 @@ void ieee80211_scan_cancel(struct ieee80211_local *local)
         }
         mutex_unlock(&local->mtx);
 }
+
+int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
+                                       struct cfg80211_sched_scan_request *req)
+{
+        struct ieee80211_local *local = sdata->local;
+        int ret, i;
+
+        mutex_lock(&sdata->local->mtx);
+
+        if (local->sched_scanning) {
+                ret = -EBUSY;
+                goto out;
+        }
+
+        if (!local->ops->sched_scan_start) {
+                ret = -ENOTSUPP;
+                goto out;
+        }
+
+        for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
+                local->sched_scan_ies.ie[i] = kzalloc(2 +
+                                                      IEEE80211_MAX_SSID_LEN +
+                                                      local->scan_ies_len,
+                                                      GFP_KERNEL);
+                if (!local->sched_scan_ies.ie[i]) {
+                        ret = -ENOMEM;
+                        goto out_free;
+                }
+
+                local->sched_scan_ies.len[i] =
+                        ieee80211_build_preq_ies(local,
+                                                 local->sched_scan_ies.ie[i],
+                                                 req->ie, req->ie_len, i,
+                                                 (u32) -1, 0);
+        }
+
+        ret = drv_sched_scan_start(local, sdata, req,
+                                   &local->sched_scan_ies);
+        if (ret == 0) {
+                local->sched_scanning = true;
+                goto out;
+        }
+
+out_free:
+        while (i > 0)
+                kfree(local->sched_scan_ies.ie[--i]);
+out:
+        mutex_unlock(&sdata->local->mtx);
+        return ret;
+}
+
+int ieee80211_request_sched_scan_stop(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+        int ret = 0, i;
+
+        mutex_lock(&sdata->local->mtx);
+
+        if (!local->ops->sched_scan_stop) {
+                ret = -ENOTSUPP;
+                goto out;
+        }
+
+        if (local->sched_scanning) {
+                for (i = 0; i < IEEE80211_NUM_BANDS; i++)
+                        kfree(local->sched_scan_ies.ie[i]);
+
+                drv_sched_scan_stop(local, sdata);
+                local->sched_scanning = false;
+        }
+out:
+        mutex_unlock(&sdata->local->mtx);
+
+        return ret;
+}
+
+void ieee80211_sched_scan_results(struct ieee80211_hw *hw)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+
+        trace_api_sched_scan_results(local);
+
+        cfg80211_sched_scan_results(hw->wiphy);
+}
+EXPORT_SYMBOL(ieee80211_sched_scan_results);
+
+void ieee80211_sched_scan_stopped_work(struct work_struct *work)
+{
+        struct ieee80211_local *local =
+                container_of(work, struct ieee80211_local,
+                             sched_scan_stopped_work);
+        int i;
+
+        mutex_lock(&local->mtx);
+
+        if (!local->sched_scanning) {
+                mutex_unlock(&local->mtx);
+                return;
+        }
+
+        for (i = 0; i < IEEE80211_NUM_BANDS; i++)
+                kfree(local->sched_scan_ies.ie[i]);
+
+        local->sched_scanning = false;
+
+        mutex_unlock(&local->mtx);
+
+        cfg80211_sched_scan_stopped(local->hw.wiphy);
+}
+
+void ieee80211_sched_scan_stopped(struct ieee80211_hw *hw)
+{
+        struct ieee80211_local *local = hw_to_local(hw);
+
+        trace_api_sched_scan_stopped(local);
+
+        ieee80211_queue_work(&local->hw, &local->sched_scan_stopped_work);
+}
+EXPORT_SYMBOL(ieee80211_sched_scan_stopped);
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index d9e6e81ff6b2..b83870bf60fa 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -67,7 +67,8 @@ static int sta_info_hash_del(struct ieee80211_local *local,
 {
         struct sta_info *s;
 
-        s = local->sta_hash[STA_HASH(sta->sta.addr)];
+        s = rcu_dereference_protected(local->sta_hash[STA_HASH(sta->sta.addr)],
+                                      lockdep_is_held(&local->sta_lock));
         if (!s)
                 return -ENOENT;
         if (s == sta) {
@@ -76,9 +77,11 @@ static int sta_info_hash_del(struct ieee80211_local *local,
                 return 0;
         }
 
-        while (s->hnext && s->hnext != sta)
-                s = s->hnext;
-        if (s->hnext) {
+        while (rcu_access_pointer(s->hnext) &&
+               rcu_access_pointer(s->hnext) != sta)
+                s = rcu_dereference_protected(s->hnext,
+                                        lockdep_is_held(&local->sta_lock));
+        if (rcu_access_pointer(s->hnext)) {
                 rcu_assign_pointer(s->hnext, sta->hnext);
                 return 0;
         }
@@ -274,7 +277,7 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
 #endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
 
 #ifdef CONFIG_MAC80211_MESH
-        sta->plink_state = PLINK_LISTEN;
+        sta->plink_state = NL80211_PLINK_LISTEN;
         init_timer(&sta->plink_timer);
 #endif
 
@@ -652,10 +655,12 @@ static int __must_check __sta_info_destroy(struct sta_info *sta)
         if (ret)
                 return ret;
 
+        mutex_lock(&local->key_mtx);
         for (i = 0; i < NUM_DEFAULT_KEYS; i++)
-                ieee80211_key_free(local, sta->gtk[i]);
+                __ieee80211_key_free(key_mtx_dereference(local, sta->gtk[i]));
         if (sta->ptk)
-                ieee80211_key_free(local, sta->ptk);
+                __ieee80211_key_free(key_mtx_dereference(local, sta->ptk));
+        mutex_unlock(&local->key_mtx);
 
         sta->dead = true;
 
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index aa0adcbf3a93..c6ae8718bd57 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -152,6 +152,7 @@ struct tid_ampdu_rx {
  *
  * @tid_rx: aggregation info for Rx per TID -- RCU protected
  * @tid_tx: aggregation info for Tx per TID
+ * @tid_start_tx: sessions where start was requested
  * @addba_req_num: number of times addBA request has been sent.
  * @dialog_token_allocator: dialog token enumerator for each new session;
  * @work: work struct for starting/stopping aggregation
@@ -163,40 +164,18 @@ struct tid_ampdu_rx {
 struct sta_ampdu_mlme {
         struct mutex mtx;
         /* rx */
-        struct tid_ampdu_rx *tid_rx[STA_TID_NUM];
+        struct tid_ampdu_rx __rcu *tid_rx[STA_TID_NUM];
         unsigned long tid_rx_timer_expired[BITS_TO_LONGS(STA_TID_NUM)];
         /* tx */
         struct work_struct work;
-        struct tid_ampdu_tx *tid_tx[STA_TID_NUM];
+        struct tid_ampdu_tx __rcu *tid_tx[STA_TID_NUM];
+        struct tid_ampdu_tx *tid_start_tx[STA_TID_NUM];
         u8 addba_req_num[STA_TID_NUM];
         u8 dialog_token_allocator;
 };
 
 
 /**
- * enum plink_state - state of a mesh peer link finite state machine
- *
- * @PLINK_LISTEN: initial state, considered the implicit state of non existent
- *      mesh peer links
- * @PLINK_OPN_SNT: mesh plink open frame has been sent to this mesh peer
- * @PLINK_OPN_RCVD: mesh plink open frame has been received from this mesh peer
- * @PLINK_CNF_RCVD: mesh plink confirm frame has been received from this mesh
- *      peer
- * @PLINK_ESTAB: mesh peer link is established
- * @PLINK_HOLDING: mesh peer link is being closed or cancelled
- * @PLINK_BLOCKED: all frames transmitted from this mesh plink are discarded
- */
-enum plink_state {
-        PLINK_LISTEN,
-        PLINK_OPN_SNT,
-        PLINK_OPN_RCVD,
-        PLINK_CNF_RCVD,
-        PLINK_ESTAB,
-        PLINK_HOLDING,
-        PLINK_BLOCKED
-};
-
-/**
  * struct sta_info - STA information
  *
  * This structure collects information about a station that
@@ -264,11 +243,11 @@ enum plink_state {
 struct sta_info {
         /* General information, mostly static */
         struct list_head list;
-        struct sta_info *hnext;
+        struct sta_info __rcu *hnext;
         struct ieee80211_local *local;
         struct ieee80211_sub_if_data *sdata;
-        struct ieee80211_key *gtk[NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS];
-        struct ieee80211_key *ptk;
+        struct ieee80211_key __rcu *gtk[NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS];
+        struct ieee80211_key __rcu *ptk;
         struct rate_control_ref *rate_ctrl;
         void *rate_ctrl_priv;
         spinlock_t lock;
@@ -339,7 +318,7 @@ struct sta_info {
         u8 plink_retries;
         bool ignore_plink_timer;
         bool plink_timer_was_running;
-        enum plink_state plink_state;
+        enum nl80211_plink_state plink_state;
         u32 plink_timeout;
         struct timer_list plink_timer;
 #endif
@@ -357,12 +336,12 @@ struct sta_info {
         struct ieee80211_sta sta;
 };
 
-static inline enum plink_state sta_plink_state(struct sta_info *sta)
+static inline enum nl80211_plink_state sta_plink_state(struct sta_info *sta)
 {
 #ifdef CONFIG_MAC80211_MESH
         return sta->plink_state;
 #endif
-        return PLINK_LISTEN;
+        return NL80211_PLINK_LISTEN;
 }
 
 static inline void set_sta_flags(struct sta_info *sta, const u32 flags)
@@ -421,7 +400,16 @@ static inline u32 get_sta_flags(struct sta_info *sta)
         return ret;
 }
 
+void ieee80211_assign_tid_tx(struct sta_info *sta, int tid,
+                             struct tid_ampdu_tx *tid_tx);
 
+static inline struct tid_ampdu_tx *
+rcu_dereference_protected_tid_tx(struct sta_info *sta, int tid)
+{
+        return rcu_dereference_protected(sta->ampdu_mlme.tid_tx[tid],
+                                         lockdep_is_held(&sta->lock) ||
+                                         lockdep_is_held(&sta->ampdu_mlme.mtx));
+}
 
 #define STA_HASH_SIZE 256
 #define STA_HASH(sta) (sta[5])
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index e3e3aa173af0..6eeaaa2bbafe 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1147,7 +1147,7 @@ static bool ieee80211_tx_prep_agg(struct ieee80211_tx_data *tx,
                  *     packet pass through because splicing the frames
                  *     back is already done.
                  */
-                tid_tx = tx->sta->ampdu_mlme.tid_tx[tid];
+                tid_tx = rcu_dereference_protected_tid_tx(tx->sta, tid);
 
                 if (!tid_tx) {
                         /* do nothing, let packet pass through */
@@ -1751,6 +1751,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                         ret = NETDEV_TX_OK;
                         goto fail;
                 }
+                rcu_read_lock();
                 if (!is_multicast_ether_addr(skb->data))
                         mppath = mpp_path_lookup(skb->data, sdata);
 
@@ -1765,13 +1766,13 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                     !(mppath && compare_ether_addr(mppath->mpp, skb->data))) {
                         hdrlen = ieee80211_fill_mesh_addresses(&hdr, &fc,
                                         skb->data, skb->data + ETH_ALEN);
+                        rcu_read_unlock();
                         meshhdrlen = ieee80211_new_mesh_header(&mesh_hdr,
                                         sdata, NULL, NULL);
                 } else {
                         int is_mesh_mcast = 1;
                         const u8 *mesh_da;
 
-                        rcu_read_lock();
                         if (is_multicast_ether_addr(skb->data))
                                 /* DA TA mSA AE:SA */
                                 mesh_da = skb->data;
@@ -2534,8 +2535,9 @@ void ieee80211_tx_skb(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
         skb_set_network_header(skb, 0);
         skb_set_transport_header(skb, 0);
 
-        /* send all internal mgmt frames on VO */
-        skb_set_queue_mapping(skb, 0);
+        /* Send all internal mgmt frames on VO. Accordingly set TID to 7. */
+        skb_set_queue_mapping(skb, IEEE80211_AC_VO);
+        skb->priority = 7;
 
         /*
          * The other path calling ieee80211_xmit is from the tasklet,
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index ef0560a2346a..d3fe2d237485 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1125,9 +1125,27 @@ int ieee80211_reconfig(struct ieee80211_local *local)
         struct sta_info *sta;
         int res;
 
+#ifdef CONFIG_PM
         if (local->suspended)
                 local->resuming = true;
 
+        if (local->wowlan) {
+                local->wowlan = false;
+                res = drv_resume(local);
+                if (res < 0) {
+                        local->resuming = false;
+                        return res;
+                }
+                if (res == 0)
+                        goto wake_up;
+                WARN_ON(res > 1);
+                /*
+                 * res is 1, which means the driver requested
+                 * to go through a regular reset on wakeup.
+                 */
+        }
+#endif
+
         /* restart hardware */
         if (local->open_count) {
                 /*
@@ -1258,6 +1276,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                 if (ieee80211_sdata_running(sdata))
                         ieee80211_enable_keys(sdata);
 
+ wake_up:
         ieee80211_wake_queues_by_reason(hw,
                         IEEE80211_QUEUE_STOP_REASON_SUSPEND);
 
diff --git a/net/rfkill/core.c b/net/rfkill/core.c
index 0198191b756d..be90640a2774 100644
--- a/net/rfkill/core.c
+++ b/net/rfkill/core.c
@@ -1024,7 +1024,6 @@ static int rfkill_fop_open(struct inode *inode, struct file *file)
          * start getting events from elsewhere but hold mtx to get
          * startup events added first
          */
-        list_add(&data->list, &rfkill_fds);
 
         list_for_each_entry(rfkill, &rfkill_list, node) {
                 ev = kzalloc(sizeof(*ev), GFP_KERNEL);
@@ -1033,6 +1032,7 @@ static int rfkill_fop_open(struct inode *inode, struct file *file)
                 rfkill_fill_event(&ev->ev, rfkill, RFKILL_OP_ADD);
                 list_add_tail(&ev->list, &data->events);
         }
+        list_add(&data->list, &rfkill_fds);
         mutex_unlock(&data->mtx);
         mutex_unlock(&rfkill_global_mutex);
 
diff --git a/net/wireless/core.c b/net/wireless/core.c
index bbf1fa11107a..c22ef3492ee6 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -370,7 +370,7 @@ struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv)
         spin_lock_init(&rdev->bss_lock);
         INIT_LIST_HEAD(&rdev->bss_list);
         INIT_WORK(&rdev->scan_done_wk, __cfg80211_scan_done);
-
+        INIT_WORK(&rdev->sched_scan_results_wk, __cfg80211_sched_scan_results);
 #ifdef CONFIG_CFG80211_WEXT
         rdev->wiphy.wext = &cfg80211_wext_handler;
 #endif
@@ -416,6 +416,67 @@ struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv)
 }
 EXPORT_SYMBOL(wiphy_new);
 
+static int wiphy_verify_combinations(struct wiphy *wiphy)
+{
+        const struct ieee80211_iface_combination *c;
+        int i, j;
+
+        /* If we have combinations enforce them */
+        if (wiphy->n_iface_combinations)
+                wiphy->flags |= WIPHY_FLAG_ENFORCE_COMBINATIONS;
+
+        for (i = 0; i < wiphy->n_iface_combinations; i++) {
+                u32 cnt = 0;
+                u16 all_iftypes = 0;
+
+                c = &wiphy->iface_combinations[i];
+
+                /* Combinations with just one interface aren't real */
+                if (WARN_ON(c->max_interfaces < 2))
+                        return -EINVAL;
+
+                /* Need at least one channel */
+                if (WARN_ON(!c->num_different_channels))
+                        return -EINVAL;
+
+                if (WARN_ON(!c->n_limits))
+                        return -EINVAL;
+
+                for (j = 0; j < c->n_limits; j++) {
+                        u16 types = c->limits[j].types;
+
+                        /*
+                         * interface types shouldn't overlap, this is
+                         * used in cfg80211_can_change_interface()
+                         */
+                        if (WARN_ON(types & all_iftypes))
+                                return -EINVAL;
+                        all_iftypes |= types;
+
+                        if (WARN_ON(!c->limits[j].max))
+                                return -EINVAL;
+
+                        /* Shouldn't list software iftypes in combinations! */
+                        if (WARN_ON(wiphy->software_iftypes & types))
+                                return -EINVAL;
+
+                        cnt += c->limits[j].max;
+                        /*
+                         * Don't advertise an unsupported type
+                         * in a combination.
+                         */
+                        if (WARN_ON((wiphy->interface_modes & types) != types))
+                                return -EINVAL;
+                }
+
+                /* You can't even choose that many! */
+                if (WARN_ON(cnt < c->max_interfaces))
+                        return -EINVAL;
+        }
+
+        return 0;
+}
+
 int wiphy_register(struct wiphy *wiphy)
 {
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
@@ -444,6 +505,10 @@ int wiphy_register(struct wiphy *wiphy)
         if (WARN_ON(ifmodes != wiphy->interface_modes))
                 wiphy->interface_modes = ifmodes;
 
+        res = wiphy_verify_combinations(wiphy);
+        if (res)
+                return res;
+
         /* sanity check supported bands/channels */
         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                 sband = wiphy->bands[band];
@@ -493,6 +558,13 @@ int wiphy_register(struct wiphy *wiphy)
                 return -EINVAL;
         }
 
+        if (rdev->wiphy.wowlan.n_patterns) {
+                if (WARN_ON(!rdev->wiphy.wowlan.pattern_min_len ||
+                            rdev->wiphy.wowlan.pattern_min_len >
+                            rdev->wiphy.wowlan.pattern_max_len))
+                        return -EINVAL;
+        }
+
         /* check and set up bitrates */
         ieee80211_set_bitrate_flags(wiphy);
 
@@ -631,6 +703,7 @@ void cfg80211_dev_free(struct cfg80211_registered_device *rdev)
         mutex_destroy(&rdev->devlist_mtx);
         list_for_each_entry_safe(scan, tmp, &rdev->bss_list, list)
                 cfg80211_put_bss(&scan->pub);
+        cfg80211_rdev_free_wowlan(rdev);
         kfree(rdev);
 }
 
@@ -664,6 +737,11 @@ static void wdev_cleanup_work(struct work_struct *work)
                 ___cfg80211_scan_done(rdev, true);
         }
 
+        if (WARN_ON(rdev->sched_scan_req &&
+                    rdev->sched_scan_req->dev == wdev->netdev)) {
+                __cfg80211_stop_sched_scan(rdev, false);
+        }
+
         cfg80211_unlock_rdev(rdev);
 
         mutex_lock(&rdev->devlist_mtx);
@@ -685,6 +763,7 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
         struct net_device *dev = ndev;
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_registered_device *rdev;
+        int ret;
 
         if (!wdev)
                 return NOTIFY_DONE;
@@ -751,6 +830,10 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                         break;
                 case NL80211_IFTYPE_P2P_CLIENT:
                 case NL80211_IFTYPE_STATION:
+                        cfg80211_lock_rdev(rdev);
+                        __cfg80211_stop_sched_scan(rdev, false);
+                        cfg80211_unlock_rdev(rdev);
+
                         wdev_lock(wdev);
 #ifdef CONFIG_CFG80211_WEXT
                         kfree(wdev->wext.ie);
@@ -769,6 +852,7 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                 default:
                         break;
                 }
+                wdev->beacon_interval = 0;
                 break;
         case NETDEV_DOWN:
                 dev_hold(dev);
@@ -875,6 +959,9 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                         return notifier_from_errno(-EOPNOTSUPP);
                 if (rfkill_blocked(rdev->rfkill))
                         return notifier_from_errno(-ERFKILL);
+                ret = cfg80211_can_add_interface(rdev, wdev->iftype);
+                if (ret)
+                        return notifier_from_errno(ret);
                 break;
         }
 
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 26a0a084e16b..bf0fb40e3c8b 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -60,8 +60,10 @@ struct cfg80211_registered_device {
         struct rb_root bss_tree;
         u32 bss_generation;
         struct cfg80211_scan_request *scan_req; /* protected by RTNL */
+        struct cfg80211_sched_scan_request *sched_scan_req;
         unsigned long suspend_at;
         struct work_struct scan_done_wk;
+        struct work_struct sched_scan_results_wk;
 
 #ifdef CONFIG_NL80211_TESTMODE
         struct genl_info *testmode_info;
@@ -70,6 +72,8 @@ struct cfg80211_registered_device {
         struct work_struct conn_work;
         struct work_struct event_work;
 
+        struct cfg80211_wowlan *wowlan;
+
         /* must be last because of the way we do wiphy_priv(),
          * and it should at least be aligned to NETDEV_ALIGN */
         struct wiphy wiphy __attribute__((__aligned__(NETDEV_ALIGN)));
@@ -89,6 +93,18 @@ bool wiphy_idx_valid(int wiphy_idx)
         return wiphy_idx >= 0;
 }
 
+static inline void
+cfg80211_rdev_free_wowlan(struct cfg80211_registered_device *rdev)
+{
+        int i;
+
+        if (!rdev->wowlan)
+                return;
+        for (i = 0; i < rdev->wowlan->n_patterns; i++)
+                kfree(rdev->wowlan->patterns[i].mask);
+        kfree(rdev->wowlan->patterns);
+        kfree(rdev->wowlan);
+}
 
 extern struct workqueue_struct *cfg80211_wq;
 extern struct mutex cfg80211_mutex;
@@ -397,12 +413,26 @@ void cfg80211_sme_rx_auth(struct net_device *dev, const u8 *buf, size_t len);
 void cfg80211_sme_disassoc(struct net_device *dev, int idx);
 void __cfg80211_scan_done(struct work_struct *wk);
 void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev, bool leak);
+void __cfg80211_sched_scan_results(struct work_struct *wk);
+int __cfg80211_stop_sched_scan(struct cfg80211_registered_device *rdev,
+                               bool driver_initiated);
 void cfg80211_upload_connect_keys(struct wireless_dev *wdev);
 int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
                           struct net_device *dev, enum nl80211_iftype ntype,
                           u32 *flags, struct vif_params *params);
 void cfg80211_process_rdev_events(struct cfg80211_registered_device *rdev);
 
+int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
+                                  struct wireless_dev *wdev,
+                                  enum nl80211_iftype iftype);
+
+static inline int
+cfg80211_can_add_interface(struct cfg80211_registered_device *rdev,
+                           enum nl80211_iftype iftype)
+{
+        return cfg80211_can_change_interface(rdev, NULL, iftype);
+}
+
 struct ieee80211_channel *
 rdev_freq_to_chan(struct cfg80211_registered_device *rdev,
                   int freq, enum nl80211_channel_type channel_type);
@@ -412,6 +442,9 @@ int cfg80211_set_freq(struct cfg80211_registered_device *rdev,
 
 u16 cfg80211_calculate_bitrate(struct rate_info *rate);
 
+int cfg80211_validate_beacon_int(struct cfg80211_registered_device *rdev,
+                                 u32 beacon_int);
+
 #ifdef CONFIG_CFG80211_DEVELOPER_WARNINGS
 #define CFG80211_DEV_WARN_ON(cond)      WARN_ON(cond)
 #else
diff --git a/net/wireless/lib80211_crypt_wep.c b/net/wireless/lib80211_crypt_wep.c
index e2e88878ba35..2f265e033ae2 100644
--- a/net/wireless/lib80211_crypt_wep.c
+++ b/net/wireless/lib80211_crypt_wep.c
@@ -96,13 +96,12 @@ static int lib80211_wep_build_iv(struct sk_buff *skb, int hdr_len,
                                u8 *key, int keylen, void *priv)
 {
         struct lib80211_wep_data *wep = priv;
-        u32 klen, len;
+        u32 klen;
         u8 *pos;
 
         if (skb_headroom(skb) < 4 || skb->len < hdr_len)
                 return -1;
 
-        len = skb->len - hdr_len;
         pos = skb_push(skb, 4);
         memmove(pos, pos + 4, hdr_len);
         pos += hdr_len;
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 16881fea4ce6..493b939970cd 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -963,6 +963,16 @@ int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
                         if (memcmp(mgmt->bssid, dev->dev_addr, ETH_ALEN))
                                 err = -EINVAL;
                         break;
+                case NL80211_IFTYPE_MESH_POINT:
+                        if (memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN)) {
+                                err = -EINVAL;
+                                break;
+                        }
+                        /*
+                         * check for mesh DA must be done by driver as
+                         * cfg80211 doesn't track the stations
+                         */
+                        break;
                 default:
                         err = -EOPNOTSUPP;
                         break;
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 0efa7fd01150..2222ce08ee91 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -173,6 +173,9 @@ static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
+        [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
+        [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
+        [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 };
 
 /* policy for the key attributes */
@@ -194,6 +197,15 @@ nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 };
 
+/* policy for WoWLAN attributes */
+static const struct nla_policy
+nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
+        [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
+        [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
+        [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
+        [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
+};
+
 /* ifidx get helper */
 static int nl80211_get_ifidx(struct netlink_callback *cb)
 {
@@ -534,6 +546,7 @@ static int nl80211_key_allowed(struct wireless_dev *wdev)
         case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_AP_VLAN:
         case NL80211_IFTYPE_P2P_GO:
+        case NL80211_IFTYPE_MESH_POINT:
                 break;
         case NL80211_IFTYPE_ADHOC:
                 if (!wdev->current_bss)
@@ -551,6 +564,88 @@ static int nl80211_key_allowed(struct wireless_dev *wdev)
         return 0;
 }
 
+static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
+{
+        struct nlattr *nl_modes = nla_nest_start(msg, attr);
+        int i;
+
+        if (!nl_modes)
+                goto nla_put_failure;
+
+        i = 0;
+        while (ifmodes) {
+                if (ifmodes & 1)
+                        NLA_PUT_FLAG(msg, i);
+                ifmodes >>= 1;
+                i++;
+        }
+
+        nla_nest_end(msg, nl_modes);
+        return 0;
+
+nla_put_failure:
+        return -ENOBUFS;
+}
+
+static int nl80211_put_iface_combinations(struct wiphy *wiphy,
+                                          struct sk_buff *msg)
+{
+        struct nlattr *nl_combis;
+        int i, j;
+
+        nl_combis = nla_nest_start(msg,
+                                NL80211_ATTR_INTERFACE_COMBINATIONS);
+        if (!nl_combis)
+                goto nla_put_failure;
+
+        for (i = 0; i < wiphy->n_iface_combinations; i++) {
+                const struct ieee80211_iface_combination *c;
+                struct nlattr *nl_combi, *nl_limits;
+
+                c = &wiphy->iface_combinations[i];
+
+                nl_combi = nla_nest_start(msg, i + 1);
+                if (!nl_combi)
+                        goto nla_put_failure;
+
+                nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
+                if (!nl_limits)
+                        goto nla_put_failure;
+
+                for (j = 0; j < c->n_limits; j++) {
+                        struct nlattr *nl_limit;
+
+                        nl_limit = nla_nest_start(msg, j + 1);
+                        if (!nl_limit)
+                                goto nla_put_failure;
+                        NLA_PUT_U32(msg, NL80211_IFACE_LIMIT_MAX,
+                                    c->limits[j].max);
+                        if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
+                                                c->limits[j].types))
+                                goto nla_put_failure;
+                        nla_nest_end(msg, nl_limit);
+                }
+
+                nla_nest_end(msg, nl_limits);
+
+                if (c->beacon_int_infra_match)
+                        NLA_PUT_FLAG(msg,
+                                NL80211_IFACE_COMB_STA_AP_BI_MATCH);
+                NLA_PUT_U32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
+                            c->num_different_channels);
+                NLA_PUT_U32(msg, NL80211_IFACE_COMB_MAXNUM,
+                            c->max_interfaces);
+
+                nla_nest_end(msg, nl_combi);
+        }
+
+        nla_nest_end(msg, nl_combis);
+
+        return 0;
+nla_put_failure:
+        return -ENOBUFS;
+}
+
 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                               struct cfg80211_registered_device *dev)
 {
@@ -558,13 +653,11 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
         struct nlattr *nl_bands, *nl_band;
         struct nlattr *nl_freqs, *nl_freq;
         struct nlattr *nl_rates, *nl_rate;
-        struct nlattr *nl_modes;
         struct nlattr *nl_cmds;
         enum ieee80211_band band;
         struct ieee80211_channel *chan;
         struct ieee80211_rate *rate;
         int i;
-        u16 ifmodes = dev->wiphy.interface_modes;
         const struct ieee80211_txrx_stypes *mgmt_stypes =
                                 dev->wiphy.mgmt_stypes;
 
@@ -624,20 +717,10 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                 }
         }
 
-        nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
-        if (!nl_modes)
+        if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
+                                dev->wiphy.interface_modes))
                 goto nla_put_failure;
 
-        i = 0;
-        while (ifmodes) {
-                if (ifmodes & 1)
-                        NLA_PUT_FLAG(msg, i);
-                ifmodes >>= 1;
-                i++;
-        }
-
-        nla_nest_end(msg, nl_modes);
-
         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
         if (!nl_bands)
                 goto nla_put_failure;
@@ -749,6 +832,8 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
         }
         CMD(set_channel, SET_CHANNEL);
         CMD(set_wds_peer, SET_WDS_PEER);
+        if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
+                CMD(sched_scan_start, START_SCHED_SCAN);
 
 #undef CMD
 
@@ -821,6 +906,42 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                 nla_nest_end(msg, nl_ifs);
         }
 
+        if (dev->wiphy.wowlan.flags || dev->wiphy.wowlan.n_patterns) {
+                struct nlattr *nl_wowlan;
+
+                nl_wowlan = nla_nest_start(msg,
+                                NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
+                if (!nl_wowlan)
+                        goto nla_put_failure;
+
+                if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_ANY)
+                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_ANY);
+                if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_DISCONNECT)
+                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_DISCONNECT);
+                if (dev->wiphy.wowlan.flags & WIPHY_WOWLAN_MAGIC_PKT)
+                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT);
+                if (dev->wiphy.wowlan.n_patterns) {
+                        struct nl80211_wowlan_pattern_support pat = {
+                                .max_patterns = dev->wiphy.wowlan.n_patterns,
+                                .min_pattern_len =
+                                        dev->wiphy.wowlan.pattern_min_len,
+                                .max_pattern_len =
+                                        dev->wiphy.wowlan.pattern_max_len,
+                        };
+                        NLA_PUT(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
+                                sizeof(pat), &pat);
+                }
+
+                nla_nest_end(msg, nl_wowlan);
+        }
+
+        if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
+                                dev->wiphy.software_iftypes))
+                goto nla_put_failure;
+
+        if (nl80211_put_iface_combinations(&dev->wiphy, msg))
+                goto nla_put_failure;
+
         return genlmsg_end(msg, hdr);
 
  nla_put_failure:
@@ -1682,14 +1803,6 @@ static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
                 if (err)
                         goto out;
 
-                if (!(rdev->wiphy.flags &
-                                WIPHY_FLAG_SUPPORTS_SEPARATE_DEFAULT_KEYS)) {
-                        if (!key.def_uni || !key.def_multi) {
-                                err = -EOPNOTSUPP;
-                                goto out;
-                        }
-                }
-
                 err = rdev->ops->set_default_key(&rdev->wiphy, dev, key.idx,
                                                  key.def_uni, key.def_multi);
 
@@ -1840,8 +1953,9 @@ static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
                     struct beacon_parameters *info);
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
         struct net_device *dev = info->user_ptr[1];
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct beacon_parameters params;
-        int haveinfo = 0;
+        int haveinfo = 0, err;
 
         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]))
                 return -EINVAL;
@@ -1850,6 +1964,8 @@ static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
                 return -EOPNOTSUPP;
 
+        memset(&params, 0, sizeof(params));
+
         switch (info->genlhdr->cmd) {
         case NL80211_CMD_NEW_BEACON:
                 /* these are required for NEW_BEACON */
@@ -1858,6 +1974,15 @@ static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
                     !info->attrs[NL80211_ATTR_BEACON_HEAD])
                         return -EINVAL;
 
+                params.interval =
+                        nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
+                params.dtim_period =
+                        nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
+
+                err = cfg80211_validate_beacon_int(rdev, params.interval);
+                if (err)
+                        return err;
+
                 call = rdev->ops->add_beacon;
                 break;
         case NL80211_CMD_SET_BEACON:
@@ -1871,20 +1996,6 @@ static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
         if (!call)
                 return -EOPNOTSUPP;
 
-        memset(&params, 0, sizeof(params));
-
-        if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
-                params.interval =
-                    nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
-                haveinfo = 1;
-        }
-
-        if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
-                params.dtim_period =
-                    nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
-                haveinfo = 1;
-        }
-
         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
                 params.head_len =
@@ -1902,13 +2013,18 @@ static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
         if (!haveinfo)
                 return -EINVAL;
 
-        return call(&rdev->wiphy, dev, &params);
+        err = call(&rdev->wiphy, dev, &params);
+        if (!err && params.interval)
+                wdev->beacon_interval = params.interval;
+        return err;
 }
 
 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
 {
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
         struct net_device *dev = info->user_ptr[1];
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        int err;
 
         if (!rdev->ops->del_beacon)
                 return -EOPNOTSUPP;
@@ -1917,7 +2033,10 @@ static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
                 return -EOPNOTSUPP;
 
-        return rdev->ops->del_beacon(&rdev->wiphy, dev);
+        err = rdev->ops->del_beacon(&rdev->wiphy, dev);
+        if (!err)
+                wdev->beacon_interval = 0;
+        return err;
 }
 
 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
@@ -2216,6 +2335,7 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
         memset(&params, 0, sizeof(params));
 
         params.listen_interval = -1;
+        params.plink_state = -1;
 
         if (info->attrs[NL80211_ATTR_STA_AID])
                 return -EINVAL;
@@ -2247,6 +2367,10 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
                 params.plink_action =
                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
 
+        if (info->attrs[NL80211_ATTR_STA_PLINK_STATE])
+                params.plink_state =
+                    nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
+
         err = get_vlan(info, rdev, &params.vlan);
         if (err)
                 goto out;
@@ -2286,10 +2410,9 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
                         err = -EINVAL;
                 if (params.listen_interval >= 0)
                         err = -EINVAL;
-                if (params.supported_rates)
-                        err = -EINVAL;
                 if (params.sta_flags_mask &
                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
+                                  BIT(NL80211_STA_FLAG_MFP) |
                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
                         err = -EINVAL;
                 break;
@@ -2840,6 +2963,7 @@ static const struct nla_policy
         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
                 .len = IEEE80211_MAX_DATA_LEN },
+        [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
 };
 
 static int nl80211_parse_mesh_config(struct genl_info *info,
@@ -2949,7 +3073,8 @@ static int nl80211_parse_mesh_setup(struct genl_info *info,
                 setup->ie = nla_data(ieattr);
                 setup->ie_len = nla_len(ieattr);
         }
-        setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
+        setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
+        setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
 
         return 0;
 }
@@ -3318,6 +3443,188 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
         return err;
 }
 
+static int nl80211_start_sched_scan(struct sk_buff *skb,
+                                    struct genl_info *info)
+{
+        struct cfg80211_sched_scan_request *request;
+        struct cfg80211_registered_device *rdev = info->user_ptr[0];
+        struct net_device *dev = info->user_ptr[1];
+        struct cfg80211_ssid *ssid;
+        struct ieee80211_channel *channel;
+        struct nlattr *attr;
+        struct wiphy *wiphy;
+        int err, tmp, n_ssids = 0, n_channels, i;
+        u32 interval;
+        enum ieee80211_band band;
+        size_t ie_len;
+
+        if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
+            !rdev->ops->sched_scan_start)
+                return -EOPNOTSUPP;
+
+        if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
+                return -EINVAL;
+
+        if (rdev->sched_scan_req)
+                return -EINPROGRESS;
+
+        if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
+                return -EINVAL;
+
+        interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
+        if (interval == 0)
+                return -EINVAL;
+
+        wiphy = &rdev->wiphy;
+
+        if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
+                n_channels = validate_scan_freqs(
+                                info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
+                if (!n_channels)
+                        return -EINVAL;
+        } else {
+                n_channels = 0;
+
+                for (band = 0; band < IEEE80211_NUM_BANDS; band++)
+                        if (wiphy->bands[band])
+                                n_channels += wiphy->bands[band]->n_channels;
+        }
+
+        if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
+                nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
+                                    tmp)
+                        n_ssids++;
+
+        if (n_ssids > wiphy->max_scan_ssids)
+                return -EINVAL;
+
+        if (info->attrs[NL80211_ATTR_IE])
+                ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
+        else
+                ie_len = 0;
+
+        if (ie_len > wiphy->max_scan_ie_len)
+                return -EINVAL;
+
+        request = kzalloc(sizeof(*request)
+                        + sizeof(*ssid) * n_ssids
+                        + sizeof(channel) * n_channels
+                        + ie_len, GFP_KERNEL);
+        if (!request)
+                return -ENOMEM;
+
+        if (n_ssids)
+                request->ssids = (void *)&request->channels[n_channels];
+        request->n_ssids = n_ssids;
+        if (ie_len) {
+                if (request->ssids)
+                        request->ie = (void *)(request->ssids + n_ssids);
+                else
+                        request->ie = (void *)(request->channels + n_channels);
+        }
+
+        i = 0;
+        if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
+                /* user specified, bail out if channel not found */
+                nla_for_each_nested(attr,
+                                    info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
+                                    tmp) {
+                        struct ieee80211_channel *chan;
+
+                        chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
+
+                        if (!chan) {
+                                err = -EINVAL;
+                                goto out_free;
+                        }
+
+                        /* ignore disabled channels */
+                        if (chan->flags & IEEE80211_CHAN_DISABLED)
+                                continue;
+
+                        request->channels[i] = chan;
+                        i++;
+                }
+        } else {
+                /* all channels */
+                for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+                        int j;
+                        if (!wiphy->bands[band])
+                                continue;
+                        for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
+                                struct ieee80211_channel *chan;
+
+                                chan = &wiphy->bands[band]->channels[j];
+
+                                if (chan->flags & IEEE80211_CHAN_DISABLED)
+                                        continue;
+
+                                request->channels[i] = chan;
+                                i++;
+                        }
+                }
+        }
+
+        if (!i) {
+                err = -EINVAL;
+                goto out_free;
+        }
+
+        request->n_channels = i;
+
+        i = 0;
+        if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
+                nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
+                                    tmp) {
+                        if (request->ssids[i].ssid_len >
+                            IEEE80211_MAX_SSID_LEN) {
+                                err = -EINVAL;
+                                goto out_free;
+                        }
+                        memcpy(request->ssids[i].ssid, nla_data(attr),
+                               nla_len(attr));
+                        request->ssids[i].ssid_len = nla_len(attr);
+                        i++;
+                }
+        }
+
+        if (info->attrs[NL80211_ATTR_IE]) {
+                request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
+                memcpy((void *)request->ie,
+                       nla_data(info->attrs[NL80211_ATTR_IE]),
+                       request->ie_len);
+        }
+
+        request->dev = dev;
+        request->wiphy = &rdev->wiphy;
+        request->interval = interval;
+
+        err = rdev->ops->sched_scan_start(&rdev->wiphy, dev, request);
+        if (!err) {
+                rdev->sched_scan_req = request;
+                nl80211_send_sched_scan(rdev, dev,
+                                        NL80211_CMD_START_SCHED_SCAN);
+                goto out;
+        }
+
+out_free:
+        kfree(request);
+out:
+        return err;
+}
+
+static int nl80211_stop_sched_scan(struct sk_buff *skb,
+                                   struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev = info->user_ptr[0];
+
+        if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
+            !rdev->ops->sched_scan_stop)
+                return -EOPNOTSUPP;
+
+        return __cfg80211_stop_sched_scan(rdev, false);
+}
+
 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                             struct cfg80211_registered_device *rdev,
                             struct wireless_dev *wdev,
@@ -4816,6 +5123,194 @@ static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
         return cfg80211_leave_mesh(rdev, dev);
 }
 
+static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev = info->user_ptr[0];
+        struct sk_buff *msg;
+        void *hdr;
+
+        if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns)
+                return -EOPNOTSUPP;
+
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+        if (!msg)
+                return -ENOMEM;
+
+        hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
+                             NL80211_CMD_GET_WOWLAN);
+        if (!hdr)
+                goto nla_put_failure;
+
+        if (rdev->wowlan) {
+                struct nlattr *nl_wowlan;
+
+                nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
+                if (!nl_wowlan)
+                        goto nla_put_failure;
+
+                if (rdev->wowlan->any)
+                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_ANY);
+                if (rdev->wowlan->disconnect)
+                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_DISCONNECT);
+                if (rdev->wowlan->magic_pkt)
+                        NLA_PUT_FLAG(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT);
+                if (rdev->wowlan->n_patterns) {
+                        struct nlattr *nl_pats, *nl_pat;
+                        int i, pat_len;
+
+                        nl_pats = nla_nest_start(msg,
+                                        NL80211_WOWLAN_TRIG_PKT_PATTERN);
+                        if (!nl_pats)
+                                goto nla_put_failure;
+
+                        for (i = 0; i < rdev->wowlan->n_patterns; i++) {
+                                nl_pat = nla_nest_start(msg, i + 1);
+                                if (!nl_pat)
+                                        goto nla_put_failure;
+                                pat_len = rdev->wowlan->patterns[i].pattern_len;
+                                NLA_PUT(msg, NL80211_WOWLAN_PKTPAT_MASK,
+                                        DIV_ROUND_UP(pat_len, 8),
+                                        rdev->wowlan->patterns[i].mask);
+                                NLA_PUT(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
+                                        pat_len,
+                                        rdev->wowlan->patterns[i].pattern);
+                                nla_nest_end(msg, nl_pat);
+                        }
+                        nla_nest_end(msg, nl_pats);
+                }
+
+                nla_nest_end(msg, nl_wowlan);
+        }
+
+        genlmsg_end(msg, hdr);
+        return genlmsg_reply(msg, info);
+
+nla_put_failure:
+        nlmsg_free(msg);
+        return -ENOBUFS;
+}
+
+static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev = info->user_ptr[0];
+        struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
+        struct cfg80211_wowlan no_triggers = {};
+        struct cfg80211_wowlan new_triggers = {};
+        struct wiphy_wowlan_support *wowlan = &rdev->wiphy.wowlan;
+        int err, i;
+
+        if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns)
+                return -EOPNOTSUPP;
+
+        if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS])
+                goto no_triggers;
+
+        err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
+                        nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
+                        nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
+                        nl80211_wowlan_policy);
+        if (err)
+                return err;
+
+        if (tb[NL80211_WOWLAN_TRIG_ANY]) {
+                if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
+                        return -EINVAL;
+                new_triggers.any = true;
+        }
+
+        if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
+                if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
+                        return -EINVAL;
+                new_triggers.disconnect = true;
+        }
+
+        if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
+                if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
+                        return -EINVAL;
+                new_triggers.magic_pkt = true;
+        }
+
+        if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
+                struct nlattr *pat;
+                int n_patterns = 0;
+                int rem, pat_len, mask_len;
+                struct nlattr *pat_tb[NUM_NL80211_WOWLAN_PKTPAT];
+
+                nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
+                                    rem)
+                        n_patterns++;
+                if (n_patterns > wowlan->n_patterns)
+                        return -EINVAL;
+
+                new_triggers.patterns = kcalloc(n_patterns,
+                                                sizeof(new_triggers.patterns[0]),
+                                                GFP_KERNEL);
+                if (!new_triggers.patterns)
+                        return -ENOMEM;
+
+                new_triggers.n_patterns = n_patterns;
+                i = 0;
+
+                nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
+                                    rem) {
+                        nla_parse(pat_tb, MAX_NL80211_WOWLAN_PKTPAT,
+                                  nla_data(pat), nla_len(pat), NULL);
+                        err = -EINVAL;
+                        if (!pat_tb[NL80211_WOWLAN_PKTPAT_MASK] ||
+                            !pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN])
+                                goto error;
+                        pat_len = nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]);
+                        mask_len = DIV_ROUND_UP(pat_len, 8);
+                        if (nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]) !=
+                            mask_len)
+                                goto error;
+                        if (pat_len > wowlan->pattern_max_len ||
+                            pat_len < wowlan->pattern_min_len)
+                                goto error;
+
+                        new_triggers.patterns[i].mask =
+                                kmalloc(mask_len + pat_len, GFP_KERNEL);
+                        if (!new_triggers.patterns[i].mask) {
+                                err = -ENOMEM;
+                                goto error;
+                        }
+                        new_triggers.patterns[i].pattern =
+                                new_triggers.patterns[i].mask + mask_len;
+                        memcpy(new_triggers.patterns[i].mask,
+                               nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]),
+                               mask_len);
+                        new_triggers.patterns[i].pattern_len = pat_len;
+                        memcpy(new_triggers.patterns[i].pattern,
+                               nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]),
+                               pat_len);
+                        i++;
+                }
+        }
+
+        if (memcmp(&new_triggers, &no_triggers, sizeof(new_triggers))) {
+                struct cfg80211_wowlan *ntrig;
+                ntrig = kmemdup(&new_triggers, sizeof(new_triggers),
+                                GFP_KERNEL);
+                if (!ntrig) {
+                        err = -ENOMEM;
+                        goto error;
+                }
+                cfg80211_rdev_free_wowlan(rdev);
+                rdev->wowlan = ntrig;
+        } else {
+ no_triggers:
+                cfg80211_rdev_free_wowlan(rdev);
+                rdev->wowlan = NULL;
+        }
+
+        return 0;
+ error:
+        for (i = 0; i < new_triggers.n_patterns; i++)
+                kfree(new_triggers.patterns[i].mask);
+        kfree(new_triggers.patterns);
+        return err;
+}
+
 #define NL80211_FLAG_NEED_WIPHY         0x01
 #define NL80211_FLAG_NEED_NETDEV        0x02
 #define NL80211_FLAG_NEED_RTNL          0x04
@@ -5100,6 +5595,22 @@ static struct genl_ops nl80211_ops[] = {
                 .dumpit = nl80211_dump_scan,
         },
         {
+                .cmd = NL80211_CMD_START_SCHED_SCAN,
+                .doit = nl80211_start_sched_scan,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
+                                  NL80211_FLAG_NEED_RTNL,
+        },
+        {
+                .cmd = NL80211_CMD_STOP_SCHED_SCAN,
+                .doit = nl80211_stop_sched_scan,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
+                                  NL80211_FLAG_NEED_RTNL,
+        },
+        {
                 .cmd = NL80211_CMD_AUTHENTICATE,
                 .doit = nl80211_authenticate,
                 .policy = nl80211_policy,
@@ -5314,6 +5825,22 @@ static struct genl_ops nl80211_ops[] = {
                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
+        {
+                .cmd = NL80211_CMD_GET_WOWLAN,
+                .doit = nl80211_get_wowlan,
+                .policy = nl80211_policy,
+                /* can be retrieved by unprivileged users */
+                .internal_flags = NL80211_FLAG_NEED_WIPHY |
+                                  NL80211_FLAG_NEED_RTNL,
+        },
+        {
+                .cmd = NL80211_CMD_SET_WOWLAN,
+                .doit = nl80211_set_wowlan,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+                .internal_flags = NL80211_FLAG_NEED_WIPHY |
+                                  NL80211_FLAG_NEED_RTNL,
+        },
 };
 
 static struct genl_multicast_group nl80211_mlme_mcgrp = {
@@ -5409,6 +5936,28 @@ static int nl80211_send_scan_msg(struct sk_buff *msg,
         return -EMSGSIZE;
 }
 
+static int
+nl80211_send_sched_scan_msg(struct sk_buff *msg,
+                            struct cfg80211_registered_device *rdev,
+                            struct net_device *netdev,
+                            u32 pid, u32 seq, int flags, u32 cmd)
+{
+        void *hdr;
+
+        hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
+        if (!hdr)
+                return -1;
+
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
+        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
+
+        return genlmsg_end(msg, hdr);
+
+ nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        return -EMSGSIZE;
+}
+
 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
                              struct net_device *netdev)
 {
@@ -5466,6 +6015,43 @@ void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
 }
 
+void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
+                                     struct net_device *netdev)
+{
+        struct sk_buff *msg;
+
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+        if (!msg)
+                return;
+
+        if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
+                                        NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+                                nl80211_scan_mcgrp.id, GFP_KERNEL);
+}
+
+void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
+                             struct net_device *netdev, u32 cmd)
+{
+        struct sk_buff *msg;
+
+        msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
+        if (!msg)
+                return;
+
+        if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+                                nl80211_scan_mcgrp.id, GFP_KERNEL);
+}
+
 /*
  * This can happen on global regulatory changes or device specific settings
  * based on custom world regulatory domains.
diff --git a/net/wireless/nl80211.h b/net/wireless/nl80211.h
index f2af6955a665..2f1bfb87a651 100644
--- a/net/wireless/nl80211.h
+++ b/net/wireless/nl80211.h
@@ -12,6 +12,10 @@ void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
                             struct net_device *netdev);
 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
                                struct net_device *netdev);
+void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
+                             struct net_device *netdev, u32 cmd);
+void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
+                                     struct net_device *netdev);
 void nl80211_send_reg_change_event(struct regulatory_request *request);
 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
                           struct net_device *netdev,
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 1613080a96b9..1ad0f39fe091 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -672,11 +672,9 @@ static int freq_reg_info_regd(struct wiphy *wiphy,
         for (i = 0; i < regd->n_reg_rules; i++) {
                 const struct ieee80211_reg_rule *rr;
                 const struct ieee80211_freq_range *fr = NULL;
-                const struct ieee80211_power_rule *pr = NULL;
 
                 rr = &regd->reg_rules[i];
                 fr = &rr->freq_range;
-                pr = &rr->power_rule;
 
                 /*
                  * We only need to know if one frequency rule was
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index fbf6f33ae4d0..73a441d237b5 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -93,6 +93,69 @@ void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
 }
 EXPORT_SYMBOL(cfg80211_scan_done);
 
+void __cfg80211_sched_scan_results(struct work_struct *wk)
+{
+        struct cfg80211_registered_device *rdev;
+
+        rdev = container_of(wk, struct cfg80211_registered_device,
+                            sched_scan_results_wk);
+
+        cfg80211_lock_rdev(rdev);
+
+        /* we don't have sched_scan_req anymore if the scan is stopping */
+        if (rdev->sched_scan_req)
+                nl80211_send_sched_scan_results(rdev,
+                                                rdev->sched_scan_req->dev);
+
+        cfg80211_unlock_rdev(rdev);
+}
+
+void cfg80211_sched_scan_results(struct wiphy *wiphy)
+{
+        /* ignore if we're not scanning */
+        if (wiphy_to_dev(wiphy)->sched_scan_req)
+                queue_work(cfg80211_wq,
+                           &wiphy_to_dev(wiphy)->sched_scan_results_wk);
+}
+EXPORT_SYMBOL(cfg80211_sched_scan_results);
+
+void cfg80211_sched_scan_stopped(struct wiphy *wiphy)
+{
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+
+        cfg80211_lock_rdev(rdev);
+        __cfg80211_stop_sched_scan(rdev, true);
+        cfg80211_unlock_rdev(rdev);
+}
+EXPORT_SYMBOL(cfg80211_sched_scan_stopped);
+
+int __cfg80211_stop_sched_scan(struct cfg80211_registered_device *rdev,
+                               bool driver_initiated)
+{
+        int err;
+        struct net_device *dev;
+
+        ASSERT_RDEV_LOCK(rdev);
+
+        if (!rdev->sched_scan_req)
+                return 0;
+
+        dev = rdev->sched_scan_req->dev;
+
+        if (!driver_initiated) {
+                err = rdev->ops->sched_scan_stop(&rdev->wiphy, dev);
+                if (err)
+                        return err;
+        }
+
+        nl80211_send_sched_scan(rdev, dev, NL80211_CMD_SCHED_SCAN_STOPPED);
+
+        kfree(rdev->sched_scan_req);
+        rdev->sched_scan_req = NULL;
+
+        return err;
+}
+
 static void bss_release(struct kref *ref)
 {
         struct cfg80211_internal_bss *bss;
@@ -210,7 +273,7 @@ static bool is_mesh(struct cfg80211_bss *a,
 {
         const u8 *ie;
 
-        if (!is_zero_ether_addr(a->bssid))
+        if (!WLAN_CAPABILITY_IS_MBSS(a->capability))
                 return false;
 
         ie = cfg80211_find_ie(WLAN_EID_MESH_ID,
@@ -248,11 +311,7 @@ static int cmp_bss(struct cfg80211_bss *a,
         if (a->channel != b->channel)
                 return b->channel->center_freq - a->channel->center_freq;
 
-        r = memcmp(a->bssid, b->bssid, ETH_ALEN);
-        if (r)
-                return r;
-
-        if (is_zero_ether_addr(a->bssid)) {
+        if (WLAN_CAPABILITY_IS_MBSS(a->capability | b->capability)) {
                 r = cmp_ies(WLAN_EID_MESH_ID,
                             a->information_elements,
                             a->len_information_elements,
@@ -267,6 +326,10 @@ static int cmp_bss(struct cfg80211_bss *a,
                                b->len_information_elements);
         }
 
+        r = memcmp(a->bssid, b->bssid, ETH_ALEN);
+        if (r)
+                return r;
+
         return cmp_ies(WLAN_EID_SSID,
                        a->information_elements,
                        a->len_information_elements,
@@ -407,7 +470,7 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
 
         res->ts = jiffies;
 
-        if (is_zero_ether_addr(res->pub.bssid)) {
+        if (WLAN_CAPABILITY_IS_MBSS(res->pub.capability)) {
                 /* must be mesh, verify */
                 meshid = cfg80211_find_ie(WLAN_EID_MESH_ID,
                                           res->pub.information_elements,
diff --git a/net/wireless/sysfs.c b/net/wireless/sysfs.c
index 4294fa22bb2d..c6e4ca6a7d2e 100644
--- a/net/wireless/sysfs.c
+++ b/net/wireless/sysfs.c
@@ -93,7 +93,7 @@ static int wiphy_suspend(struct device *dev, pm_message_t state)
 
         if (rdev->ops->suspend) {
                 rtnl_lock();
-                ret = rdev->ops->suspend(&rdev->wiphy);
+                ret = rdev->ops->suspend(&rdev->wiphy, rdev->wowlan);
                 rtnl_unlock();
         }
 
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 6a750bc6bcfe..f0536d44d43c 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -544,7 +544,8 @@ EXPORT_SYMBOL(ieee80211_data_from_8023);
 
 void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list,
                               const u8 *addr, enum nl80211_iftype iftype,
-                              const unsigned int extra_headroom)
+                              const unsigned int extra_headroom,
+                              bool has_80211_header)
 {
         struct sk_buff *frame = NULL;
         u16 ethertype;
@@ -553,14 +554,18 @@ void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list,
         int remaining, err;
         u8 dst[ETH_ALEN], src[ETH_ALEN];
 
-        err = ieee80211_data_to_8023(skb, addr, iftype);
-        if (err)
-                goto out;
+        if (has_80211_header) {
+                err = ieee80211_data_to_8023(skb, addr, iftype);
+                if (err)
+                        goto out;
 
-        /* skip the wrapping header */
-        eth = (struct ethhdr *) skb_pull(skb, sizeof(struct ethhdr));
-        if (!eth)
-                goto out;
+                /* skip the wrapping header */
+                eth = (struct ethhdr *) skb_pull(skb, sizeof(struct ethhdr));
+                if (!eth)
+                        goto out;
+        } else {
+                eth = (struct ethhdr *) skb->data;
+        }
 
         while (skb != frame) {
                 u8 padding;
@@ -803,6 +808,11 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
                 return -EBUSY;
 
         if (ntype != otype) {
+                err = cfg80211_can_change_interface(rdev, dev->ieee80211_ptr,
+                                                    ntype);
+                if (err)
+                        return err;
+
                 dev->ieee80211_ptr->use_4addr = false;
                 dev->ieee80211_ptr->mesh_id_up_len = 0;
 
@@ -896,3 +906,103 @@ u16 cfg80211_calculate_bitrate(struct rate_info *rate)
         /* do NOT round down here */
         return (bitrate + 50000) / 100000;
 }
+
+int cfg80211_validate_beacon_int(struct cfg80211_registered_device *rdev,
+                                 u32 beacon_int)
+{
+        struct wireless_dev *wdev;
+        int res = 0;
+
+        if (!beacon_int)
+                return -EINVAL;
+
+        mutex_lock(&rdev->devlist_mtx);
+
+        list_for_each_entry(wdev, &rdev->netdev_list, list) {
+                if (!wdev->beacon_interval)
+                        continue;
+                if (wdev->beacon_interval != beacon_int) {
+                        res = -EINVAL;
+                        break;
+                }
+        }
+
+        mutex_unlock(&rdev->devlist_mtx);
+
+        return res;
+}
+
+int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
+                                  struct wireless_dev *wdev,
+                                  enum nl80211_iftype iftype)
+{
+        struct wireless_dev *wdev_iter;
+        int num[NUM_NL80211_IFTYPES];
+        int total = 1;
+        int i, j;
+
+        ASSERT_RTNL();
+
+        /* Always allow software iftypes */
+        if (rdev->wiphy.software_iftypes & BIT(iftype))
+                return 0;
+
+        /*
+         * Drivers will gradually all set this flag, until all
+         * have it we only enforce for those that set it.
+         */
+        if (!(rdev->wiphy.flags & WIPHY_FLAG_ENFORCE_COMBINATIONS))
+                return 0;
+
+        memset(num, 0, sizeof(num));
+
+        num[iftype] = 1;
+
+        mutex_lock(&rdev->devlist_mtx);
+        list_for_each_entry(wdev_iter, &rdev->netdev_list, list) {
+                if (wdev_iter == wdev)
+                        continue;
+                if (!netif_running(wdev_iter->netdev))
+                        continue;
+
+                if (rdev->wiphy.software_iftypes & BIT(wdev_iter->iftype))
+                        continue;
+
+                num[wdev_iter->iftype]++;
+                total++;
+        }
+        mutex_unlock(&rdev->devlist_mtx);
+
+        for (i = 0; i < rdev->wiphy.n_iface_combinations; i++) {
+                const struct ieee80211_iface_combination *c;
+                struct ieee80211_iface_limit *limits;
+
+                c = &rdev->wiphy.iface_combinations[i];
+
+                limits = kmemdup(c->limits, sizeof(limits[0]) * c->n_limits,
+                                 GFP_KERNEL);
+                if (!limits)
+                        return -ENOMEM;
+                if (total > c->max_interfaces)
+                        goto cont;
+
+                for (iftype = 0; iftype < NUM_NL80211_IFTYPES; iftype++) {
+                        if (rdev->wiphy.software_iftypes & BIT(iftype))
+                                continue;
+                        for (j = 0; j < c->n_limits; j++) {
+                                if (!(limits[j].types & iftype))
+                                        continue;
+                                if (limits[j].max < num[iftype])
+                                        goto cont;
+                                limits[j].max -= num[iftype];
+                        }
+                }
+                /* yay, it fits */
+                kfree(limits);
+                return 0;
+ cont:
+                kfree(limits);
+        }
+
+        return -EBUSY;
+}