Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem

author: John W. Linville <linville@tuxdriver.com> 2013-01-28 14:43:00 -0500
committer: John W. Linville <linville@tuxdriver.com> 2013-01-28 14:43:00 -0500
commit: 4205e6ef4ee747aa81930537b6035086ba5f1e28 (patch)
tree: b2ebe2b4621f5f531f283cb9bf0005cd3c04ca7b /net
parent: cef401de7be8c4e155c6746bfccf721a4fa5fab9 (diff)
parent: 9ebea3829fac7505e0cd2642fbd13cfa9c038831 (diff)
49 files changed, 1672 insertions, 1362 deletions
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 596660d37c5e..0f78e34220c9 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -2810,14 +2810,6 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
        if (conn) {
                hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
-                hci_dev_lock(hdev);
-                if (test_bit(HCI_MGMT, &hdev->dev_flags) &&
-                    !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
-                        mgmt_device_connected(hdev, &conn->dst, conn->type,
-                                              conn->dst_type, 0, NULL, 0,
-                                              conn->dev_class);
-                hci_dev_unlock(hdev);
                /* Send to upper protocol */
                l2cap_recv_acldata(conn, skb, flags);
                return;
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 705078a0cc39..81b44481d0d9 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -2688,7 +2688,7 @@ static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
        if (ev->opcode != HCI_OP_NOP)
                del_timer(&hdev->cmd_timer);
-        if (ev->ncmd) {
+        if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
                atomic_set(&hdev->cmd_cnt, 1);
                if (!skb_queue_empty(&hdev->cmd_q))
                        queue_work(hdev->workqueue, &hdev->cmd_work);
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index b2bcbe2dc328..a7352ff3fd1e 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -931,7 +931,7 @@ static int hidp_setup_hid(struct hidp_session *session,
        hid->version = req->version;
        hid->country = req->country;
-        strncpy(hid->name, req->name, 128);
+        strncpy(hid->name, req->name, sizeof(req->name) - 1);
        snprintf(hid->phys, sizeof(hid->phys), "%pMR",
                 &bt_sk(session->ctrl_sock->sk)->src);
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 2c78208d793e..22e658322845 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -3727,6 +3727,17 @@ sendresp:
 static int l2cap_connect_req(struct l2cap_conn *conn,
                             struct l2cap_cmd_hdr *cmd, u8 *data)
 {
+        struct hci_dev *hdev = conn->hcon->hdev;
+        struct hci_conn *hcon = conn->hcon;
+        hci_dev_lock(hdev);
+        if (test_bit(HCI_MGMT, &hdev->dev_flags) &&
+            !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &hcon->flags))
+                mgmt_device_connected(hdev, &hcon->dst, hcon->type,
+                                      hcon->dst_type, 0, NULL, 0,
+                                      hcon->dev_class);
+        hci_dev_unlock(hdev);
        l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP, 0);
        return 0;
 }
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 531a93d613d4..57f250c20e39 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -352,7 +352,7 @@ static void __sco_sock_close(struct sock *sk)
        case BT_CONNECTED:
        case BT_CONFIG:
-                if (sco_pi(sk)->conn) {
+                if (sco_pi(sk)->conn->hcon) {
                        sk->sk_state = BT_DISCONN;
                        sco_sock_set_timer(sk, SCO_DISCONN_TIMEOUT);
                        hci_conn_put(sco_pi(sk)->conn->hcon);
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index eb9df22418f0..2f0ccbc5f13e 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -149,16 +149,133 @@ void ieee80211_assign_tid_tx(struct sta_info *sta, int tid,
        rcu_assign_pointer(sta->ampdu_mlme.tid_tx[tid], tid_tx);
 }
+static inline int ieee80211_ac_from_tid(int tid)
+{
+        return ieee802_1d_to_ac[tid & 7];
+}
+/*
+ * When multiple aggregation sessions on multiple stations
+ * are being created/destroyed simultaneously, we need to
+ * refcount the global queue stop caused by that in order
+ * to not get into a situation where one of the aggregation
+ * setup or teardown re-enables queues before the other is
+ * ready to handle that.
+ *
+ * These two functions take care of this issue by keeping
+ * a global "agg_queue_stop" refcount.
+ */
+static void __acquires(agg_queue)
+ieee80211_stop_queue_agg(struct ieee80211_sub_if_data *sdata, int tid)
+{
+        int queue = sdata->vif.hw_queue[ieee80211_ac_from_tid(tid)];
+        if (atomic_inc_return(&sdata->local->agg_queue_stop[queue]) == 1)
+                ieee80211_stop_queue_by_reason(
+                        &sdata->local->hw, queue,
+                        IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
+        __acquire(agg_queue);
+}
+static void __releases(agg_queue)
+ieee80211_wake_queue_agg(struct ieee80211_sub_if_data *sdata, int tid)
+{
+        int queue = sdata->vif.hw_queue[ieee80211_ac_from_tid(tid)];
+        if (atomic_dec_return(&sdata->local->agg_queue_stop[queue]) == 0)
+                ieee80211_wake_queue_by_reason(
+                        &sdata->local->hw, queue,
+                        IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
+        __release(agg_queue);
+}
+/*
+ * splice packets from the STA's pending to the local pending,
+ * requires a call to ieee80211_agg_splice_finish later
+ */
+static void __acquires(agg_queue)
+ieee80211_agg_splice_packets(struct ieee80211_sub_if_data *sdata,
+                             struct tid_ampdu_tx *tid_tx, u16 tid)
+{
+        struct ieee80211_local *local = sdata->local;
+        int queue = sdata->vif.hw_queue[ieee80211_ac_from_tid(tid)];
+        unsigned long flags;
+        ieee80211_stop_queue_agg(sdata, tid);
+        if (WARN(!tid_tx,
+                 "TID %d gone but expected when splicing aggregates from the pending queue\n",
+                 tid))
+                return;
+        if (!skb_queue_empty(&tid_tx->pending)) {
+                spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
+                /* copy over remaining packets */
+                skb_queue_splice_tail_init(&tid_tx->pending,
+                                           &local->pending[queue]);
+                spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+        }
+}
+static void __releases(agg_queue)
+ieee80211_agg_splice_finish(struct ieee80211_sub_if_data *sdata, u16 tid)
+{
+        ieee80211_wake_queue_agg(sdata, tid);
+}
+static void ieee80211_remove_tid_tx(struct sta_info *sta, int tid)
+{
+        struct tid_ampdu_tx *tid_tx;
+        lockdep_assert_held(&sta->ampdu_mlme.mtx);
+        lockdep_assert_held(&sta->lock);
+        tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
+        /*
+         * When we get here, the TX path will not be lockless any more wrt.
+         * aggregation, since the OPERATIONAL bit has long been cleared.
+         * Thus it will block on getting the lock, if it occurs. So if we
+         * stop the queue now, we will not get any more packets, and any
+         * that might be being processed will wait for us here, thereby
+         * guaranteeing that no packets go to the tid_tx pending queue any
+         * more.
+         */
+        ieee80211_agg_splice_packets(sta->sdata, tid_tx, tid);
+        /* future packets must not find the tid_tx struct any more */
+        ieee80211_assign_tid_tx(sta, tid, NULL);
+        ieee80211_agg_splice_finish(sta->sdata, tid);
+        kfree_rcu(tid_tx, rcu_head);
+}
 int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
-                                    enum ieee80211_back_parties initiator,
+                                    enum ieee80211_agg_stop_reason reason)
-                                    bool tx)
 {
        struct ieee80211_local *local = sta->local;
        struct tid_ampdu_tx *tid_tx;
+        enum ieee80211_ampdu_mlme_action action;
        int ret;
        lockdep_assert_held(&sta->ampdu_mlme.mtx);
+        switch (reason) {
+        case AGG_STOP_DECLINED:
+        case AGG_STOP_LOCAL_REQUEST:
+        case AGG_STOP_PEER_REQUEST:
+                action = IEEE80211_AMPDU_TX_STOP_CONT;
+                break;
+        case AGG_STOP_DESTROY_STA:
+                action = IEEE80211_AMPDU_TX_STOP_FLUSH;
+                break;
+        default:
+                WARN_ON_ONCE(1);
+                return -EINVAL;
+        }
        spin_lock_bh(&sta->lock);
        tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
@@ -167,10 +284,19 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
                return -ENOENT;
        }
-        /* if we're already stopping ignore any new requests to stop */
+        /*
+         * if we're already stopping ignore any new requests to stop
+         * unless we're destroying it in which case notify the driver
+         */
        if (test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
                spin_unlock_bh(&sta->lock);
-                return -EALREADY;
+                if (reason != AGG_STOP_DESTROY_STA)
+                        return -EALREADY;
+                ret = drv_ampdu_action(local, sta->sdata,
+                                       IEEE80211_AMPDU_TX_STOP_FLUSH_CONT,
+                                       &sta->sta, tid, NULL, 0);
+                WARN_ON_ONCE(ret);
+                goto remove_tid_tx;
        }
        if (test_bit(HT_AGG_STATE_WANT_START, &tid_tx->state)) {
@@ -212,11 +338,12 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
         */
        synchronize_net();
-        tid_tx->stop_initiator = initiator;
+        tid_tx->stop_initiator = reason == AGG_STOP_PEER_REQUEST ?
-        tid_tx->tx_stop = tx;
+                                        WLAN_BACK_RECIPIENT :
+                                        WLAN_BACK_INITIATOR;
+        tid_tx->tx_stop = reason == AGG_STOP_LOCAL_REQUEST;
-        ret = drv_ampdu_action(local, sta->sdata,
+        ret = drv_ampdu_action(local, sta->sdata, action,
-                               IEEE80211_AMPDU_TX_STOP,
                               &sta->sta, tid, NULL, 0);
        /* HW shall not deny going back to legacy */
@@ -227,7 +354,14 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
                 */
        }
-        return ret;
+        if (reason == AGG_STOP_DESTROY_STA) {
+ remove_tid_tx:
+                spin_lock_bh(&sta->lock);
+                ieee80211_remove_tid_tx(sta, tid);
+                spin_unlock_bh(&sta->lock);
+        }
+        return 0;
 }
 /*
@@ -264,80 +398,6 @@ static void sta_addba_resp_timer_expired(unsigned long data)
        rcu_read_unlock();
 }
-static inline int ieee80211_ac_from_tid(int tid)
-{
-        return ieee802_1d_to_ac[tid & 7];
-}
-/*
- * When multiple aggregation sessions on multiple stations
- * are being created/destroyed simultaneously, we need to
- * refcount the global queue stop caused by that in order
- * to not get into a situation where one of the aggregation
- * setup or teardown re-enables queues before the other is
- * ready to handle that.
- *
- * These two functions take care of this issue by keeping
- * a global "agg_queue_stop" refcount.
- */
-static void __acquires(agg_queue)
-ieee80211_stop_queue_agg(struct ieee80211_sub_if_data *sdata, int tid)
-{
-        int queue = sdata->vif.hw_queue[ieee80211_ac_from_tid(tid)];
-        if (atomic_inc_return(&sdata->local->agg_queue_stop[queue]) == 1)
-                ieee80211_stop_queue_by_reason(
-                        &sdata->local->hw, queue,
-                        IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
-        __acquire(agg_queue);
-}
-static void __releases(agg_queue)
-ieee80211_wake_queue_agg(struct ieee80211_sub_if_data *sdata, int tid)
-{
-        int queue = sdata->vif.hw_queue[ieee80211_ac_from_tid(tid)];
-        if (atomic_dec_return(&sdata->local->agg_queue_stop[queue]) == 0)
-                ieee80211_wake_queue_by_reason(
-                        &sdata->local->hw, queue,
-                        IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
-        __release(agg_queue);
-}
-/*
- * splice packets from the STA's pending to the local pending,
- * requires a call to ieee80211_agg_splice_finish later
- */
-static void __acquires(agg_queue)
-ieee80211_agg_splice_packets(struct ieee80211_sub_if_data *sdata,
-                             struct tid_ampdu_tx *tid_tx, u16 tid)
-{
-        struct ieee80211_local *local = sdata->local;
-        int queue = sdata->vif.hw_queue[ieee80211_ac_from_tid(tid)];
-        unsigned long flags;
-        ieee80211_stop_queue_agg(sdata, tid);
-        if (WARN(!tid_tx,
-                 "TID %d gone but expected when splicing aggregates from the pending queue\n",
-                 tid))
-                return;
-        if (!skb_queue_empty(&tid_tx->pending)) {
-                spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
-                /* copy over remaining packets */
-                skb_queue_splice_tail_init(&tid_tx->pending,
-                                           &local->pending[queue]);
-                spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
-        }
-}
-static void __releases(agg_queue)
-ieee80211_agg_splice_finish(struct ieee80211_sub_if_data *sdata, u16 tid)
-{
-        ieee80211_wake_queue_agg(sdata, tid);
-}
 void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid)
 {
        struct tid_ampdu_tx *tid_tx;
@@ -660,14 +720,13 @@ void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
 EXPORT_SYMBOL(ieee80211_start_tx_ba_cb_irqsafe);
 int __ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
-                                   enum ieee80211_back_parties initiator,
+                                   enum ieee80211_agg_stop_reason reason)
-                                   bool tx)
 {
        int ret;
        mutex_lock(&sta->ampdu_mlme.mtx);
-        ret = ___ieee80211_stop_tx_ba_session(sta, tid, initiator, tx);
+        ret = ___ieee80211_stop_tx_ba_session(sta, tid, reason);
        mutex_unlock(&sta->ampdu_mlme.mtx);
@@ -751,24 +810,7 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid)
                ieee80211_send_delba(sta->sdata, ra, tid,
                        WLAN_BACK_INITIATOR, WLAN_REASON_QSTA_NOT_USE);
-        /*
+        ieee80211_remove_tid_tx(sta, tid);
-         * When we get here, the TX path will not be lockless any more wrt.
-         * aggregation, since the OPERATIONAL bit has long been cleared.
-         * Thus it will block on getting the lock, if it occurs. So if we
-         * stop the queue now, we will not get any more packets, and any
-         * that might be being processed will wait for us here, thereby
-         * guaranteeing that no packets go to the tid_tx pending queue any
-         * more.
-         */
-        ieee80211_agg_splice_packets(sta->sdata, tid_tx, tid);
-        /* future packets must not find the tid_tx struct any more */
-        ieee80211_assign_tid_tx(sta, tid, NULL);
-        ieee80211_agg_splice_finish(sta->sdata, tid);
-        kfree_rcu(tid_tx, rcu_head);
 unlock_sta:
        spin_unlock_bh(&sta->lock);
@@ -868,8 +910,7 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
                }
        } else {
-                ___ieee80211_stop_tx_ba_session(sta, tid, WLAN_BACK_INITIATOR,
+                ___ieee80211_stop_tx_ba_session(sta, tid, AGG_STOP_DECLINED);
-                                                false);
        }
 out:
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 47e0aca614b7..661b878bd19c 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -164,7 +164,17 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
                        sta = sta_info_get(sdata, mac_addr);
                else
                        sta = sta_info_get_bss(sdata, mac_addr);
-                if (!sta) {
+                /*
+                 * The ASSOC test makes sure the driver is ready to
+                 * receive the key. When wpa_supplicant has roamed
+                 * using FT, it attempts to set the key before
+                 * association has completed, this rejects that attempt
+                 * so it will set the key again after assocation.
+                 *
+                 * TODO: accept the key if we have a station entry and
+                 *       add it to the device after the station.
+                 */
+                if (!sta || !test_sta_flag(sta, WLAN_STA_ASSOC)) {
                        ieee80211_key_free(sdata->local, key);
                        err = -ENOENT;
                        goto out_unlock;
@@ -510,6 +520,7 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
                                BIT(NL80211_STA_FLAG_WME) |
                                BIT(NL80211_STA_FLAG_MFP) |
                                BIT(NL80211_STA_FLAG_AUTHENTICATED) |
+                                BIT(NL80211_STA_FLAG_ASSOCIATED) |
                                BIT(NL80211_STA_FLAG_TDLS_PEER);
        if (test_sta_flag(sta, WLAN_STA_AUTHORIZED))
                sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_AUTHORIZED);
@@ -521,6 +532,8 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
                sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_MFP);
        if (test_sta_flag(sta, WLAN_STA_AUTH))
                sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
+        if (test_sta_flag(sta, WLAN_STA_ASSOC))
+                sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_ASSOCIATED);
        if (test_sta_flag(sta, WLAN_STA_TDLS_PEER))
                sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_TDLS_PEER);
 }
@@ -930,6 +943,7 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
        sdata->vif.bss_conf.beacon_int = params->beacon_interval;
        sdata->vif.bss_conf.dtim_period = params->dtim_period;
+        sdata->vif.bss_conf.enable_beacon = true;
        sdata->vif.bss_conf.ssid_len = params->ssid_len;
        if (params->ssid_len)
@@ -1010,8 +1024,15 @@ static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
                kfree_rcu(old_probe_resp, rcu_head);
        list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
-                sta_info_flush(local, vlan);
+                sta_info_flush_defer(vlan);
-        sta_info_flush(local, sdata);
+        sta_info_flush_defer(sdata);
+        rcu_barrier();
+        list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
+                sta_info_flush_cleanup(vlan);
+        sta_info_flush_cleanup(sdata);
+        sdata->vif.bss_conf.enable_beacon = false;
+        clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, &sdata->state);
        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED);
        drv_stop_ap(sdata->local, sdata);
@@ -1069,6 +1090,58 @@ static void ieee80211_send_layer2_update(struct sta_info *sta)
        netif_rx_ni(skb);
 }
+static int sta_apply_auth_flags(struct ieee80211_local *local,
+                                struct sta_info *sta,
+                                u32 mask, u32 set)
+{
+        int ret;
+        if (mask & BIT(NL80211_STA_FLAG_AUTHENTICATED) &&
+            set & BIT(NL80211_STA_FLAG_AUTHENTICATED) &&
+            !test_sta_flag(sta, WLAN_STA_AUTH)) {
+                ret = sta_info_move_state(sta, IEEE80211_STA_AUTH);
+                if (ret)
+                        return ret;
+        }
+        if (mask & BIT(NL80211_STA_FLAG_ASSOCIATED) &&
+            set & BIT(NL80211_STA_FLAG_ASSOCIATED) &&
+            !test_sta_flag(sta, WLAN_STA_ASSOC)) {
+                ret = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
+                if (ret)
+                        return ret;
+        }
+        if (mask & BIT(NL80211_STA_FLAG_AUTHORIZED)) {
+                if (set & BIT(NL80211_STA_FLAG_AUTHORIZED))
+                        ret = sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
+                else if (test_sta_flag(sta, WLAN_STA_AUTHORIZED))
+                        ret = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
+                else
+                        ret = 0;
+                if (ret)
+                        return ret;
+        }
+        if (mask & BIT(NL80211_STA_FLAG_ASSOCIATED) &&
+            !(set & BIT(NL80211_STA_FLAG_ASSOCIATED)) &&
+            test_sta_flag(sta, WLAN_STA_ASSOC)) {
+                ret = sta_info_move_state(sta, IEEE80211_STA_AUTH);
+                if (ret)
+                        return ret;
+        }
+        if (mask & BIT(NL80211_STA_FLAG_AUTHENTICATED) &&
+            !(set & BIT(NL80211_STA_FLAG_AUTHENTICATED)) &&
+            test_sta_flag(sta, WLAN_STA_AUTH)) {
+                ret = sta_info_move_state(sta, IEEE80211_STA_NONE);
+                if (ret)
+                        return ret;
+        }
+        return 0;
+}
 static int sta_apply_parameters(struct ieee80211_local *local,
                                struct sta_info *sta,
                                struct station_parameters *params)
@@ -1086,52 +1159,20 @@ static int sta_apply_parameters(struct ieee80211_local *local,
        mask = params->sta_flags_mask;
        set = params->sta_flags_set;
-        /*
+        if (ieee80211_vif_is_mesh(&sdata->vif)) {
-         * In mesh mode, we can clear AUTHENTICATED flag but must
+                /*
-         * also make ASSOCIATED follow appropriately for the driver
+                 * In mesh mode, ASSOCIATED isn't part of the nl80211
-         * API. See also below, after AUTHORIZED changes.
+                 * API but must follow AUTHENTICATED for driver state.
-         */
+                 */
-        if (mask & BIT(NL80211_STA_FLAG_AUTHENTICATED)) {
+                if (mask & BIT(NL80211_STA_FLAG_AUTHENTICATED))
-                /* cfg80211 should not allow this in non-mesh modes */
+                        mask |= BIT(NL80211_STA_FLAG_ASSOCIATED);
-                if (WARN_ON(!ieee80211_vif_is_mesh(&sdata->vif)))
+                if (set & BIT(NL80211_STA_FLAG_AUTHENTICATED))
-                        return -EINVAL;
+                        set |= BIT(NL80211_STA_FLAG_ASSOCIATED);
-                if (set & BIT(NL80211_STA_FLAG_AUTHENTICATED) &&
-                    !test_sta_flag(sta, WLAN_STA_AUTH)) {
-                        ret = sta_info_move_state(sta, IEEE80211_STA_AUTH);
-                        if (ret)
-                                return ret;
-                        ret = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
-                        if (ret)
-                                return ret;
-                }
-        }
-        if (mask & BIT(NL80211_STA_FLAG_AUTHORIZED)) {
-                if (set & BIT(NL80211_STA_FLAG_AUTHORIZED))
-                        ret = sta_info_move_state(sta, IEEE80211_STA_AUTHORIZED);
-                else if (test_sta_flag(sta, WLAN_STA_AUTHORIZED))
-                        ret = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
-                if (ret)
-                        return ret;
-        }
-        if (mask & BIT(NL80211_STA_FLAG_AUTHENTICATED)) {
-                /* cfg80211 should not allow this in non-mesh modes */
-                if (WARN_ON(!ieee80211_vif_is_mesh(&sdata->vif)))
-                        return -EINVAL;
-                if (!(set & BIT(NL80211_STA_FLAG_AUTHENTICATED)) &&
-                    test_sta_flag(sta, WLAN_STA_AUTH)) {
-                        ret = sta_info_move_state(sta, IEEE80211_STA_AUTH);
-                        if (ret)
-                                return ret;
-                        ret = sta_info_move_state(sta, IEEE80211_STA_NONE);
-                        if (ret)
-                                return ret;
-                }
        }
+        ret = sta_apply_auth_flags(local, sta, mask, set);
+        if (ret)
+                return ret;
        if (mask & BIT(NL80211_STA_FLAG_SHORT_PREAMBLE)) {
                if (set & BIT(NL80211_STA_FLAG_SHORT_PREAMBLE))
@@ -1177,10 +1218,11 @@ static int sta_apply_parameters(struct ieee80211_local *local,
                sta->sta.aid = params->aid;
        /*
-         * FIXME: updating the following information is racy when this
+         * Some of the following updates would be racy if called on an
-         *        function is called from ieee80211_change_station().
+         * existing station, via ieee80211_change_station(). However,
-         *        However, all this information should be static so
+         * all such changes are rejected by cfg80211 except for updates
-         *        maybe we should just reject attemps to change it.
+         * changing the supported rates on an existing but not yet used
+         * TDLS peer.
         */
        if (params->listen_interval >= 0)
@@ -1211,18 +1253,33 @@ static int sta_apply_parameters(struct ieee80211_local *local,
        if (ieee80211_vif_is_mesh(&sdata->vif)) {
 #ifdef CONFIG_MAC80211_MESH
-                if (sdata->u.mesh.security & IEEE80211_MESH_SEC_SECURED)
+                if (sdata->u.mesh.security & IEEE80211_MESH_SEC_SECURED) {
+                        u32 changed = 0;
                        switch (params->plink_state) {
-                        case NL80211_PLINK_LISTEN:
                        case NL80211_PLINK_ESTAB:
+                                if (sta->plink_state != NL80211_PLINK_ESTAB)
+                                        changed = mesh_plink_inc_estab_count(
+                                                        sdata);
+                                sta->plink_state = params->plink_state;
+                                break;
+                        case NL80211_PLINK_LISTEN:
                        case NL80211_PLINK_BLOCKED:
+                        case NL80211_PLINK_OPN_SNT:
+                        case NL80211_PLINK_OPN_RCVD:
+                        case NL80211_PLINK_CNF_RCVD:
+                        case NL80211_PLINK_HOLDING:
+                                if (sta->plink_state == NL80211_PLINK_ESTAB)
+                                        changed = mesh_plink_dec_estab_count(
+                                                        sdata);
                                sta->plink_state = params->plink_state;
                                break;
                        default:
                                /*  nothing  */
                                break;
                        }
-                else
+                        ieee80211_bss_info_change_notify(sdata, changed);
+                } else {
                        switch (params->plink_action) {
                        case PLINK_ACTION_OPEN:
                                mesh_plink_open(sta);
@@ -1231,6 +1288,7 @@ static int sta_apply_parameters(struct ieee80211_local *local,
                                mesh_plink_block(sta);
                                break;
                        }
+                }
 #endif
        }
@@ -1265,6 +1323,10 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
        if (!sta)
                return -ENOMEM;
+        /*
+         * defaults -- if userspace wants something else we'll
+         * change it accordingly in sta_apply_parameters()
+         */
        sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
        sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
@@ -1301,7 +1363,6 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
 static int ieee80211_del_station(struct wiphy *wiphy, struct net_device *dev,
                                 u8 *mac)
 {
-        struct ieee80211_local *local = wiphy_priv(wiphy);
        struct ieee80211_sub_if_data *sdata;
        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
@@ -1309,7 +1370,7 @@ static int ieee80211_del_station(struct wiphy *wiphy, struct net_device *dev,
        if (mac)
                return sta_info_destroy_addr_bss(sdata, mac);
-        sta_info_flush(local, sdata);
+        sta_info_flush(sdata);
        return 0;
 }
@@ -1615,6 +1676,9 @@ static int copy_mesh_setup(struct ieee80211_if_mesh *ifmsh,
        memcpy(sdata->vif.bss_conf.mcast_rate, setup->mcast_rate,
                                                sizeof(setup->mcast_rate));
+        sdata->vif.bss_conf.beacon_int = setup->beacon_interval;
+        sdata->vif.bss_conf.dtim_period = setup->dtim_period;
        return 0;
 }
@@ -2197,7 +2261,8 @@ static int ieee80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *dev,
        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        if (sdata->vif.type != NL80211_IFTYPE_STATION)
+        if (sdata->vif.type != NL80211_IFTYPE_STATION &&
+            sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
                return -EOPNOTSUPP;
        if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS))
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index 80e55527504b..1bfe0a8b19d2 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -381,7 +381,8 @@ void ieee80211_iter_chan_contexts_atomic(
        rcu_read_lock();
        list_for_each_entry_rcu(ctx, &local->chanctx_list, list)
-                iter(hw, &ctx->conf, iter_data);
+                if (ctx->driver_present)
+                        iter(hw, &ctx->conf, iter_data);
        rcu_read_unlock();
 }
 EXPORT_SYMBOL_GPL(ieee80211_iter_chan_contexts_atomic);
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 698dc7e6f309..0c07f94c5378 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -207,6 +207,14 @@ static inline void drv_bss_info_changed(struct ieee80211_local *local,
 {
        might_sleep();
+        WARN_ON_ONCE(changed & (BSS_CHANGED_BEACON |
+                                BSS_CHANGED_BEACON_ENABLED) &&
+                     sdata->vif.type != NL80211_IFTYPE_AP &&
+                     sdata->vif.type != NL80211_IFTYPE_ADHOC &&
+                     sdata->vif.type != NL80211_IFTYPE_MESH_POINT);
+        WARN_ON_ONCE(sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE &&
+                     changed & ~BSS_CHANGED_IDLE);
        check_sdata_in_driver(sdata);
        trace_drv_bss_info_changed(local, sdata, info, changed);
@@ -913,6 +921,8 @@ static inline int drv_add_chanctx(struct ieee80211_local *local,
        if (local->ops->add_chanctx)
                ret = local->ops->add_chanctx(&local->hw, &ctx->conf);
        trace_drv_return_int(local, ret);
+        if (!ret)
+                ctx->driver_present = true;
        return ret;
 }
@@ -924,6 +934,7 @@ static inline void drv_remove_chanctx(struct ieee80211_local *local,
        if (local->ops->remove_chanctx)
                local->ops->remove_chanctx(&local->hw, &ctx->conf);
        trace_drv_return_void(local);
+        ctx->driver_present = false;
 }
 static inline void drv_change_chanctx(struct ieee80211_local *local,
@@ -931,8 +942,10 @@ static inline void drv_change_chanctx(struct ieee80211_local *local,
                                      u32 changed)
 {
        trace_drv_change_chanctx(local, ctx, changed);
-        if (local->ops->change_chanctx)
+        if (local->ops->change_chanctx) {
+                WARN_ON_ONCE(!ctx->driver_present);
                local->ops->change_chanctx(&local->hw, &ctx->conf, changed);
+        }
        trace_drv_return_void(local);
 }
@@ -945,10 +958,12 @@ static inline int drv_assign_vif_chanctx(struct ieee80211_local *local,
        check_sdata_in_driver(sdata);
        trace_drv_assign_vif_chanctx(local, sdata, ctx);
-        if (local->ops->assign_vif_chanctx)
+        if (local->ops->assign_vif_chanctx) {
+                WARN_ON_ONCE(!ctx->driver_present);
                ret = local->ops->assign_vif_chanctx(&local->hw,
                                                     &sdata->vif,
                                                     &ctx->conf);
+        }
        trace_drv_return_int(local, ret);
        return ret;
@@ -961,10 +976,12 @@ static inline void drv_unassign_vif_chanctx(struct ieee80211_local *local,
        check_sdata_in_driver(sdata);
        trace_drv_unassign_vif_chanctx(local, sdata, ctx);
-        if (local->ops->unassign_vif_chanctx)
+        if (local->ops->unassign_vif_chanctx) {
+                WARN_ON_ONCE(!ctx->driver_present);
                local->ops->unassign_vif_chanctx(&local->hw,
                                                 &sdata->vif,
                                                 &ctx->conf);
+        }
        trace_drv_return_void(local);
 }
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index a71d891794a4..61ac7c48ac0c 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -62,6 +62,9 @@ void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
        __check_htcap_disable(sdata, ht_cap, IEEE80211_HT_CAP_SUP_WIDTH_20_40);
        __check_htcap_disable(sdata, ht_cap, IEEE80211_HT_CAP_SGI_40);
+        /* Allow user to disable SGI-20 (SGI-40 is handled above) */
+        __check_htcap_disable(sdata, ht_cap, IEEE80211_HT_CAP_SGI_20);
        /* Allow user to disable the max-AMSDU bit. */
        __check_htcap_disable(sdata, ht_cap, IEEE80211_HT_CAP_MAX_AMSDU);
@@ -117,6 +120,21 @@ void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_sub_if_data *sdata,
                   IEEE80211_HT_CAP_SGI_20 |
                   IEEE80211_HT_CAP_SGI_40 |
                   IEEE80211_HT_CAP_DSSSCCK40));
+        /* Unset 40 MHz if we're not using a 40 MHz channel */
+        switch (sdata->vif.bss_conf.chandef.width) {
+        case NL80211_CHAN_WIDTH_20_NOHT:
+        case NL80211_CHAN_WIDTH_20:
+                ht_cap->cap &= ~IEEE80211_HT_CAP_SGI_40;
+                ht_cap->cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+                break;
+        case NL80211_CHAN_WIDTH_40:
+        case NL80211_CHAN_WIDTH_80:
+        case NL80211_CHAN_WIDTH_80P80:
+        case NL80211_CHAN_WIDTH_160:
+                break;
+        }
        /*
         * The STBC bits are asymmetric -- if we don't have
         * TX then mask out the peer's RX and vice versa.
@@ -179,16 +197,19 @@ void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_sub_if_data *sdata,
        ieee80211_apply_htcap_overrides(sdata, ht_cap);
 }
-void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta, bool tx)
+void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta,
+                                         enum ieee80211_agg_stop_reason reason)
 {
        int i;
        cancel_work_sync(&sta->ampdu_mlme.work);
        for (i = 0; i <  IEEE80211_NUM_TIDS; i++) {
-                __ieee80211_stop_tx_ba_session(sta, i, WLAN_BACK_INITIATOR, tx);
+                __ieee80211_stop_tx_ba_session(sta, i, reason);
                __ieee80211_stop_rx_ba_session(sta, i, WLAN_BACK_RECIPIENT,
-                                               WLAN_REASON_QSTA_LEAVE_QBSS, tx);
+                                               WLAN_REASON_QSTA_LEAVE_QBSS,
+                                               reason != AGG_STOP_DESTROY_STA &&
+                                               reason != AGG_STOP_PEER_REQUEST);
        }
 }
@@ -245,8 +266,7 @@ void ieee80211_ba_session_work(struct work_struct *work)
                if (tid_tx && test_and_clear_bit(HT_AGG_STATE_WANT_STOP,
                                                 &tid_tx->state))
                        ___ieee80211_stop_tx_ba_session(sta, tid,
-                                                        WLAN_BACK_INITIATOR,
+                                                        AGG_STOP_LOCAL_REQUEST);
-                                                        true);
        }
        mutex_unlock(&sta->ampdu_mlme.mtx);
 }
@@ -314,8 +334,7 @@ void ieee80211_process_delba(struct ieee80211_sub_if_data *sdata,
                __ieee80211_stop_rx_ba_session(sta, tid, WLAN_BACK_INITIATOR, 0,
                                               true);
        else
-                __ieee80211_stop_tx_ba_session(sta, tid, WLAN_BACK_RECIPIENT,
+                __ieee80211_stop_tx_ba_session(sta, tid, AGG_STOP_PEER_REQUEST);
-                                               true);
 }
 int ieee80211_send_smps_action(struct ieee80211_sub_if_data *sdata,
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 6b7644e818d8..b4b866f41919 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -67,7 +67,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
        skb_reserve(skb, sdata->local->hw.extra_tx_headroom);
        if (!ether_addr_equal(ifibss->bssid, bssid))
-                sta_info_flush(sdata->local, sdata);
+                sta_info_flush(sdata);
        /* if merging, indicate to driver that we leave the old IBSS */
        if (sdata->vif.bss_conf.ibss_joined) {
@@ -191,6 +191,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
        rcu_assign_pointer(ifibss->presp, skb);
+        sdata->vif.bss_conf.enable_beacon = true;
        sdata->vif.bss_conf.beacon_int = beacon_int;
        sdata->vif.bss_conf.basic_rates = basic_rates;
        bss_change = BSS_CHANGED_BEACON_INT;
@@ -425,11 +426,9 @@ static void ieee80211_rx_mgmt_auth_ibss(struct ieee80211_sub_if_data *sdata,
 }
 static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
-                                  struct ieee80211_mgmt *mgmt,
+                                  struct ieee80211_mgmt *mgmt, size_t len,
-                                  size_t len,
                                  struct ieee80211_rx_status *rx_status,
-                                  struct ieee802_11_elems *elems,
+                                  struct ieee802_11_elems *elems)
-                                  bool beacon)
 {
        struct ieee80211_local *local = sdata->local;
        int freq;
@@ -530,7 +529,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
        }
        bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, elems,
-                                        channel, beacon);
+                                        channel);
        if (!bss)
                return;
@@ -877,14 +876,21 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
        ieee80211_tx_skb(sdata, skb);
 }
-static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
+static
-                                         struct ieee80211_mgmt *mgmt,
+void ieee80211_rx_mgmt_probe_beacon(struct ieee80211_sub_if_data *sdata,
-                                         size_t len,
+                                    struct ieee80211_mgmt *mgmt, size_t len,
-                                         struct ieee80211_rx_status *rx_status)
+                                    struct ieee80211_rx_status *rx_status)
 {
        size_t baselen;
        struct ieee802_11_elems elems;
+        BUILD_BUG_ON(offsetof(typeof(mgmt->u.probe_resp), variable) !=
+                     offsetof(typeof(mgmt->u.beacon), variable));
+        /*
+         * either beacon or probe_resp but the variable field is at the
+         * same offset
+         */
        baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
        if (baselen > len)
                return;
@@ -892,25 +898,7 @@ static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
        ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
                                &elems);
-        ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems, false);
+        ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
-}
-static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
-                                     struct ieee80211_mgmt *mgmt,
-                                     size_t len,
-                                     struct ieee80211_rx_status *rx_status)
-{
-        size_t baselen;
-        struct ieee802_11_elems elems;
-        /* Process beacon from the current BSS */
-        baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
-        if (baselen > len)
-                return;
-        ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen, &elems);
-        ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems, true);
 }
 void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
@@ -934,12 +922,9 @@ void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                ieee80211_rx_mgmt_probe_req(sdata, skb);
                break;
        case IEEE80211_STYPE_PROBE_RESP:
-                ieee80211_rx_mgmt_probe_resp(sdata, mgmt, skb->len,
-                                             rx_status);
-                break;
        case IEEE80211_STYPE_BEACON:
-                ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len,
+                ieee80211_rx_mgmt_probe_beacon(sdata, mgmt, skb->len,
-                                         rx_status);
+                                               rx_status);
                break;
        case IEEE80211_STYPE_AUTH:
                ieee80211_rx_mgmt_auth_ibss(sdata, mgmt, skb->len);
@@ -1182,7 +1167,7 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
        memset(ifibss->bssid, 0, ETH_ALEN);
        ifibss->ssid_len = 0;
-        sta_info_flush(sdata->local, sdata);
+        sta_info_flush(sdata);
        spin_lock_bh(&ifibss->incomplete_lock);
        while (!list_empty(&ifibss->incomplete_stations)) {
@@ -1205,6 +1190,8 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
        RCU_INIT_POINTER(sdata->u.ibss.presp, NULL);
        sdata->vif.bss_conf.ibss_joined = false;
        sdata->vif.bss_conf.ibss_creator = false;
+        sdata->vif.bss_conf.enable_beacon = false;
+        clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, &sdata->state);
        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED |
                                                BSS_CHANGED_IBSS);
        synchronize_rcu();
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 8563b9a5cac3..63f0430c131e 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -405,6 +405,8 @@ struct ieee80211_mgd_assoc_data {
        u8 ap_ht_param;
+        struct ieee80211_vht_cap ap_vht_cap;
        size_t ie_len;
        u8 ie[];
 };
@@ -659,10 +661,13 @@ enum ieee80211_sub_if_data_flags {
 *      change handling while the interface is up
 * @SDATA_STATE_OFFCHANNEL: This interface is currently in offchannel
 *      mode, so queues are stopped
+ * @SDATA_STATE_OFFCHANNEL_BEACON_STOPPED: Beaconing was stopped due
+ *      to offchannel, reset when offchannel returns
 */
 enum ieee80211_sdata_state_bits {
        SDATA_STATE_RUNNING,
        SDATA_STATE_OFFCHANNEL,
+        SDATA_STATE_OFFCHANNEL_BEACON_STOPPED,
 };
 /**
@@ -685,6 +690,7 @@ struct ieee80211_chanctx {
        enum ieee80211_chanctx_mode mode;
        int refcount;
+        bool driver_present;
        struct ieee80211_chanctx_conf conf;
 };
@@ -783,6 +789,11 @@ struct ieee80211_sub_if_data {
                struct dentry *default_mgmt_key;
        } debugfs;
 #endif
+#ifdef CONFIG_PM
+        struct ieee80211_bss_conf suspend_bss_conf;
+#endif
        /* must be last, dynamically sized area in this! */
        struct ieee80211_vif vif;
 };
@@ -1346,8 +1357,7 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
                          struct ieee80211_mgmt *mgmt,
                          size_t len,
                          struct ieee802_11_elems *elems,
-                          struct ieee80211_channel *channel,
+                          struct ieee80211_channel *channel);
-                          bool beacon);
 void ieee80211_rx_bss_put(struct ieee80211_local *local,
                          struct ieee80211_bss *bss);
@@ -1358,10 +1368,8 @@ int ieee80211_request_sched_scan_stop(struct ieee80211_sub_if_data *sdata);
 void ieee80211_sched_scan_stopped_work(struct work_struct *work);
 /* off-channel helpers */
-void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local,
+void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local);
-                                    bool offchannel_ps_enable);
+void ieee80211_offchannel_return(struct ieee80211_local *local);
-void ieee80211_offchannel_return(struct ieee80211_local *local,
-                                 bool offchannel_ps_disable);
 void ieee80211_roc_setup(struct ieee80211_local *local);
 void ieee80211_start_next_roc(struct ieee80211_local *local);
 void ieee80211_roc_purge(struct ieee80211_sub_if_data *sdata);
@@ -1422,7 +1430,8 @@ void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
                                     u16 initiator, u16 reason, bool stop);
 void __ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
                                    u16 initiator, u16 reason, bool stop);
-void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta, bool tx);
+void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta,
+                                         enum ieee80211_agg_stop_reason reason);
 void ieee80211_process_delba(struct ieee80211_sub_if_data *sdata,
                             struct sta_info *sta,
                             struct ieee80211_mgmt *mgmt, size_t len);
@@ -1436,11 +1445,9 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
                                     size_t len);
 int __ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
-                                   enum ieee80211_back_parties initiator,
+                                   enum ieee80211_agg_stop_reason reason);
-                                   bool tx);
 int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
-                                    enum ieee80211_back_parties initiator,
+                                    enum ieee80211_agg_stop_reason reason);
-                                    bool tx);
 void ieee80211_start_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u16 tid);
 void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid);
 void ieee80211_ba_session_work(struct work_struct *work);
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 8be854e86cd9..06fac2991d40 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -747,7 +747,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
        unsigned long flags;
        struct sk_buff *skb, *tmp;
        u32 hw_reconf_flags = 0;
-        int i;
+        int i, flushed;
        clear_bit(SDATA_STATE_RUNNING, &sdata->state);
@@ -772,11 +772,15 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
         * (because if we remove a STA after ops->remove_interface()
         * the driver will have removed the vif info already!)
         *
-         * This is relevant only in AP, WDS and mesh modes, since in
+         * This is relevant only in WDS mode, in all other modes we've
-         * all other modes we've already removed all stations when
+         * already removed all stations when disconnecting or similar,
-         * disconnecting etc.
+         * so warn otherwise.
+         *
+         * We call sta_info_flush_cleanup() later, to combine RCU waits.
         */
-        sta_info_flush(local, sdata);
+        flushed = sta_info_flush_defer(sdata);
+        WARN_ON_ONCE((sdata->vif.type != NL80211_IFTYPE_WDS && flushed > 0) ||
+                     (sdata->vif.type == NL80211_IFTYPE_WDS && flushed != 1));
        /*
         * Don't count this interface for promisc/allmulti while it
@@ -859,11 +863,17 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                cancel_work_sync(&sdata->work);
                /*
                 * When we get here, the interface is marked down.
-                 * Call synchronize_rcu() to wait for the RX path
+                 *
-                 * should it be using the interface and enqueuing
+                 * sta_info_flush_cleanup() requires rcu_barrier()
-                 * frames at this very time on another CPU.
+                 * first to wait for the station call_rcu() calls
+                 * to complete, here we need at least sychronize_rcu()
+                 * it to wait for the RX path in case it is using the
+                 * interface and enqueuing frames at this very time on
+                 * another CPU.
                 */
-                synchronize_rcu();
+                rcu_barrier();
+                sta_info_flush_cleanup(sdata);
                skb_queue_purge(&sdata->skb_queue);
                /*
@@ -961,7 +971,6 @@ static void ieee80211_set_multicast_list(struct net_device *dev)
 */
 static void ieee80211_teardown_sdata(struct ieee80211_sub_if_data *sdata)
 {
-        struct ieee80211_local *local = sdata->local;
        int flushed;
        int i;
@@ -977,7 +986,7 @@ static void ieee80211_teardown_sdata(struct ieee80211_sub_if_data *sdata)
        if (ieee80211_vif_is_mesh(&sdata->vif))
                mesh_rmc_free(sdata);
-        flushed = sta_info_flush(local, sdata);
+        flushed = sta_info_flush(sdata);
        WARN_ON(flushed);
 }
@@ -1218,6 +1227,7 @@ static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
        case NL80211_IFTYPE_AP:
                skb_queue_head_init(&sdata->u.ap.ps.bc_buf);
                INIT_LIST_HEAD(&sdata->u.ap.vlans);
+                sdata->vif.bss_conf.bssid = sdata->vif.addr;
                break;
        case NL80211_IFTYPE_P2P_CLIENT:
                type = NL80211_IFTYPE_STATION;
@@ -1225,9 +1235,11 @@ static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
                sdata->vif.p2p = true;
                /* fall through */
        case NL80211_IFTYPE_STATION:
+                sdata->vif.bss_conf.bssid = sdata->u.mgd.bssid;
                ieee80211_sta_setup_sdata(sdata);
                break;
        case NL80211_IFTYPE_ADHOC:
+                sdata->vif.bss_conf.bssid = sdata->u.ibss.bssid;
                ieee80211_ibss_setup_sdata(sdata);
                break;
        case NL80211_IFTYPE_MESH_POINT:
@@ -1241,8 +1253,12 @@ static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
                                      MONITOR_FLAG_OTHER_BSS;
                break;
        case NL80211_IFTYPE_WDS:
+                sdata->vif.bss_conf.bssid = NULL;
+                break;
        case NL80211_IFTYPE_AP_VLAN:
+                break;
        case NL80211_IFTYPE_P2P_DEVICE:
+                sdata->vif.bss_conf.bssid = sdata->vif.addr;
                break;
        case NL80211_IFTYPE_UNSPECIFIED:
        case NUM_NL80211_IFTYPES:
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 1b087fff93e7..39cfe8f10ad2 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -207,76 +207,10 @@ void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
                                      u32 changed)
 {
        struct ieee80211_local *local = sdata->local;
-        static const u8 zero[ETH_ALEN] = { 0 };
        if (!changed)
                return;
-        if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                sdata->vif.bss_conf.bssid = sdata->u.mgd.bssid;
-        } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
-                sdata->vif.bss_conf.bssid = sdata->u.ibss.bssid;
-        else if (sdata->vif.type == NL80211_IFTYPE_AP)
-                sdata->vif.bss_conf.bssid = sdata->vif.addr;
-        else if (sdata->vif.type == NL80211_IFTYPE_WDS)
-                sdata->vif.bss_conf.bssid = NULL;
-        else if (ieee80211_vif_is_mesh(&sdata->vif)) {
-                sdata->vif.bss_conf.bssid = zero;
-        } else if (sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) {
-                sdata->vif.bss_conf.bssid = sdata->vif.addr;
-                WARN_ONCE(changed & ~(BSS_CHANGED_IDLE),
-                          "P2P Device BSS changed %#x", changed);
-        } else {
-                WARN_ON(1);
-                return;
-        }
-        switch (sdata->vif.type) {
-        case NL80211_IFTYPE_AP:
-        case NL80211_IFTYPE_ADHOC:
-        case NL80211_IFTYPE_WDS:
-        case NL80211_IFTYPE_MESH_POINT:
-                break;
-        default:
-                /* do not warn to simplify caller in scan.c */
-                changed &= ~BSS_CHANGED_BEACON_ENABLED;
-                if (WARN_ON(changed & BSS_CHANGED_BEACON))
-                        return;
-                break;
-        }
-        if (changed & BSS_CHANGED_BEACON_ENABLED) {
-                if (local->quiescing || !ieee80211_sdata_running(sdata) ||
-                    test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state)) {
-                        sdata->vif.bss_conf.enable_beacon = false;
-                } else {
-                        /*
-                         * Beacon should be enabled, but AP mode must
-                         * check whether there is a beacon configured.
-                         */
-                        switch (sdata->vif.type) {
-                        case NL80211_IFTYPE_AP:
-                                sdata->vif.bss_conf.enable_beacon =
-                                        !!sdata->u.ap.beacon;
-                                break;
-                        case NL80211_IFTYPE_ADHOC:
-                                sdata->vif.bss_conf.enable_beacon =
-                                        !!sdata->u.ibss.presp;
-                                break;
-#ifdef CONFIG_MAC80211_MESH
-                        case NL80211_IFTYPE_MESH_POINT:
-                                sdata->vif.bss_conf.enable_beacon =
-                                        !!sdata->u.mesh.mesh_id_len;
-                                break;
-#endif
-                        default:
-                                /* not reached */
-                                WARN_ON(1);
-                                break;
-                        }
-                }
-        }
        drv_bss_info_changed(local, sdata, &sdata->vif.bss_conf, changed);
 }
@@ -537,6 +471,7 @@ static const struct ieee80211_ht_cap mac80211_ht_capa_mod_mask = {
        .cap_info = cpu_to_le16(IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
                                IEEE80211_HT_CAP_MAX_AMSDU |
+                                IEEE80211_HT_CAP_SGI_20 |
                                IEEE80211_HT_CAP_SGI_40),
        .mcs = {
                .rx_mask = { 0xff, 0xff, 0xff, 0xff, 0xff,
@@ -606,7 +541,8 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
        wiphy->features |= NL80211_FEATURE_SK_TX_STATUS |
                           NL80211_FEATURE_SAE |
                           NL80211_FEATURE_HT_IBSS |
-                           NL80211_FEATURE_VIF_TXPOWER;
+                           NL80211_FEATURE_VIF_TXPOWER |
+                           NL80211_FEATURE_FULL_AP_CLIENT_STATE;
        if (!ops->hw_scan)
                wiphy->features |= NL80211_FEATURE_LOW_PRIORITY_SCAN |
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 649ad513547f..694e27376afa 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -20,16 +20,11 @@
 int mesh_allocated;
 static struct kmem_cache *rm_cache;
-#ifdef CONFIG_MAC80211_MESH
 bool mesh_action_is_path_sel(struct ieee80211_mgmt *mgmt)
 {
        return (mgmt->u.action.u.mesh_action.action_code ==
                        WLAN_MESH_ACTION_HWMP_PATH_SELECTION);
 }
-#else
-bool mesh_action_is_path_sel(struct ieee80211_mgmt *mgmt)
-{ return false; }
-#endif
 void ieee80211s_init(void)
 {
@@ -607,6 +602,12 @@ void ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
 {
        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
        struct ieee80211_local *local = sdata->local;
+        u32 changed = BSS_CHANGED_BEACON |
+                      BSS_CHANGED_BEACON_ENABLED |
+                      BSS_CHANGED_HT |
+                      BSS_CHANGED_BASIC_RATES |
+                      BSS_CHANGED_BEACON_INT;
+        enum ieee80211_band band = ieee80211_get_sdata_band(sdata);
        local->fif_other_bss++;
        /* mesh ifaces must set allmulti to forward mcast traffic */
@@ -624,15 +625,16 @@ void ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
        ieee80211_queue_work(&local->hw, &sdata->work);
        sdata->vif.bss_conf.ht_operation_mode =
                                ifmsh->mshcfg.ht_opmode;
-        sdata->vif.bss_conf.beacon_int = MESH_DEFAULT_BEACON_INTERVAL;
+        sdata->vif.bss_conf.enable_beacon = true;
        sdata->vif.bss_conf.basic_rates =
-                ieee80211_mandatory_rates(sdata->local,
+                ieee80211_mandatory_rates(local, band);
-                                          ieee80211_get_sdata_band(sdata));
-        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON |
+        if (band == IEEE80211_BAND_5GHZ) {
-                                                BSS_CHANGED_BEACON_ENABLED |
+                sdata->vif.bss_conf.use_short_slot = true;
-                                                BSS_CHANGED_HT |
+                changed |= BSS_CHANGED_ERP_SLOT;
-                                                BSS_CHANGED_BASIC_RATES |
+        }
-                                                BSS_CHANGED_BEACON_INT);
+        ieee80211_bss_info_change_notify(sdata, changed);
        netif_carrier_on(sdata->dev);
 }
@@ -646,10 +648,12 @@ void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
        /* stop the beacon */
        ifmsh->mesh_id_len = 0;
+        sdata->vif.bss_conf.enable_beacon = false;
+        clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, &sdata->state);
        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED);
        /* flush STAs and mpaths on this iface */
-        sta_info_flush(sdata->local, sdata);
+        sta_info_flush(sdata);
        mesh_path_flush_by_iface(sdata);
        del_timer_sync(&sdata->u.mesh.housekeeping_timer);
@@ -805,6 +809,7 @@ void ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local)
 void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata)
 {
        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+        static u8 zero_addr[ETH_ALEN] = {};
        setup_timer(&ifmsh->housekeeping_timer,
                    ieee80211_mesh_housekeeping_timer,
@@ -830,4 +835,6 @@ void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata)
        INIT_LIST_HEAD(&ifmsh->preq_queue.list);
        spin_lock_init(&ifmsh->mesh_preq_queue_lock);
        spin_lock_init(&ifmsh->sync_offset_lock);
+        sdata->vif.bss_conf.bssid = zero_addr;
 }
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index 84c28c6101cd..aff301544c7f 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -191,8 +191,6 @@ struct mesh_rmc {
 #define IEEE80211_MESH_PEER_INACTIVITY_LIMIT (1800 * HZ)
 #define IEEE80211_MESH_HOUSEKEEPING_INTERVAL (60 * HZ)
-#define MESH_DEFAULT_BEACON_INTERVAL            1000    /* in 1024 us units */
 #define MESH_PATH_EXPIRE (600 * HZ)
 /* Default maximum number of plinks per interface */
@@ -307,6 +305,20 @@ extern int mesh_paths_generation;
 #ifdef CONFIG_MAC80211_MESH
 extern int mesh_allocated;
+static inline
+u32 mesh_plink_inc_estab_count(struct ieee80211_sub_if_data *sdata)
+{
+        atomic_inc(&sdata->u.mesh.estab_plinks);
+        return mesh_accept_plinks_update(sdata);
+}
+static inline
+u32 mesh_plink_dec_estab_count(struct ieee80211_sub_if_data *sdata)
+{
+        atomic_dec(&sdata->u.mesh.estab_plinks);
+        return mesh_accept_plinks_update(sdata);
+}
 static inline int mesh_plink_free_count(struct ieee80211_sub_if_data *sdata)
 {
        return sdata->u.mesh.mshcfg.dot11MeshMaxPeerLinks -
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 47aeee2d8db1..6b4603a90031 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -215,16 +215,19 @@ static void prepare_frame_for_deferred_tx(struct ieee80211_sub_if_data *sdata,
        skb->priority = 7;
        info->control.vif = &sdata->vif;
+        info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
        ieee80211_set_qos_hdr(sdata, skb);
 }
 /**
- * mesh_send_path error - Sends a PERR mesh management frame
+ * mesh_path_error_tx - Sends a PERR mesh management frame
 *
+ * @ttl: allowed remaining hops
 * @target: broken destination
 * @target_sn: SN of the broken destination
 * @target_rcode: reason code for this PERR
 * @ra: node this frame is addressed to
+ * @sdata: local mesh subif
 *
 * Note: This function may be called with driver locks taken that the driver
 * also acquires in the TX path.  To avoid a deadlock we don't transmit the
@@ -246,11 +249,13 @@ int mesh_path_error_tx(u8 ttl, u8 *target, __le32 target_sn,
                return -EAGAIN;
        skb = dev_alloc_skb(local->tx_headroom +
+                            IEEE80211_ENCRYPT_HEADROOM +
+                            IEEE80211_ENCRYPT_TAILROOM +
                            hdr_len +
                            2 + 15 /* PERR IE */);
        if (!skb)
                return -1;
-        skb_reserve(skb, local->tx_headroom);
+        skb_reserve(skb, local->tx_headroom + IEEE80211_ENCRYPT_HEADROOM);
        mgmt = (struct ieee80211_mgmt *) skb_put(skb, hdr_len);
        memset(mgmt, 0, hdr_len);
        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
@@ -350,6 +355,7 @@ static u32 airtime_link_metric_get(struct ieee80211_local *local,
 * @sdata: local mesh subif
 * @mgmt: mesh management frame
 * @hwmp_ie: hwmp information element (PREP or PREQ)
+ * @action: type of hwmp ie
 *
 * This function updates the path routing information to the originator and the
 * transmitter of a HWMP PREQ or PREP frame.
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index 4b274e9c91a5..9e0416696a83 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -41,20 +41,6 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
                enum ieee80211_self_protected_actioncode action,
                u8 *da, __le16 llid, __le16 plid, __le16 reason);
-static inline
-u32 mesh_plink_inc_estab_count(struct ieee80211_sub_if_data *sdata)
-{
-        atomic_inc(&sdata->u.mesh.estab_plinks);
-        return mesh_accept_plinks_update(sdata);
-}
-static inline
-u32 mesh_plink_dec_estab_count(struct ieee80211_sub_if_data *sdata)
-{
-        atomic_dec(&sdata->u.mesh.estab_plinks);
-        return mesh_accept_plinks_update(sdata);
-}
 /**
 * mesh_plink_fsm_restart - restart a mesh peer link finite state machine
 *
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index a3552929a21d..e930175771ff 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -199,11 +199,11 @@ static u32 ieee80211_config_ht_tx(struct ieee80211_sub_if_data *sdata,
        case NL80211_CHAN_WIDTH_40:
                if (sdata->vif.bss_conf.chandef.chan->center_freq >
                                sdata->vif.bss_conf.chandef.center_freq1 &&
-                    chan->flags & IEEE80211_CHAN_NO_HT40PLUS)
+                    chan->flags & IEEE80211_CHAN_NO_HT40MINUS)
                        disable_40 = true;
                if (sdata->vif.bss_conf.chandef.chan->center_freq <
                                sdata->vif.bss_conf.chandef.center_freq1 &&
-                    chan->flags & IEEE80211_CHAN_NO_HT40MINUS)
+                    chan->flags & IEEE80211_CHAN_NO_HT40PLUS)
                        disable_40 = true;
                break;
        default:
@@ -341,11 +341,13 @@ static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata,
 static void ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,
                                 struct sk_buff *skb,
-                                 struct ieee80211_supported_band *sband)
+                                 struct ieee80211_supported_band *sband,
+                                 struct ieee80211_vht_cap *ap_vht_cap)
 {
        u8 *pos;
        u32 cap;
        struct ieee80211_sta_vht_cap vht_cap;
+        int i;
        BUILD_BUG_ON(sizeof(vht_cap) != sizeof(sband->vht_cap));
@@ -364,6 +366,42 @@ static void ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,
                cap &= ~IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
        }
+        /*
+         * Some APs apparently get confused if our capabilities are better
+         * than theirs, so restrict what we advertise in the assoc request.
+         */
+        if (!(ap_vht_cap->vht_cap_info &
+                        cpu_to_le32(IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)))
+                cap &= ~IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;
+        if (!(ap_vht_cap->vht_cap_info &
+                        cpu_to_le32(IEEE80211_VHT_CAP_TXSTBC)))
+                cap &= ~(IEEE80211_VHT_CAP_RXSTBC_1 |
+                         IEEE80211_VHT_CAP_RXSTBC_3 |
+                         IEEE80211_VHT_CAP_RXSTBC_4);
+        for (i = 0; i < 8; i++) {
+                int shift = i * 2;
+                u16 mask = IEEE80211_VHT_MCS_NOT_SUPPORTED << shift;
+                u16 ap_mcs, our_mcs;
+                ap_mcs = (le16_to_cpu(ap_vht_cap->supp_mcs.tx_mcs_map) &
+                                                                mask) >> shift;
+                our_mcs = (le16_to_cpu(vht_cap.vht_mcs.rx_mcs_map) &
+                                                                mask) >> shift;
+                switch (ap_mcs) {
+                default:
+                        if (our_mcs <= ap_mcs)
+                                break;
+                        /* fall through */
+                case IEEE80211_VHT_MCS_NOT_SUPPORTED:
+                        vht_cap.vht_mcs.rx_mcs_map &= cpu_to_le16(~mask);
+                        vht_cap.vht_mcs.rx_mcs_map |=
+                                cpu_to_le16(ap_mcs << shift);
+                }
+        }
        /* reserve and fill IE */
        pos = skb_put(skb, sizeof(struct ieee80211_vht_cap) + 2);
        ieee80211_ie_build_vht_cap(pos, &vht_cap, cap);
@@ -562,7 +600,8 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
                                    sband, chan, sdata->smps_mode);
        if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
-                ieee80211_add_vht_ie(sdata, skb, sband);
+                ieee80211_add_vht_ie(sdata, skb, sband,
+                                     &assoc_data->ap_vht_cap);
        /* if present, add any custom non-vendor IEs that go after HT */
        if (assoc_data->ie_len && assoc_data->ie) {
@@ -1486,7 +1525,7 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
        sta = sta_info_get(sdata, ifmgd->bssid);
        if (sta) {
                set_sta_flag(sta, WLAN_STA_BLOCK_BA);
-                ieee80211_sta_tear_down_BA_sessions(sta, false);
+                ieee80211_sta_tear_down_BA_sessions(sta, AGG_STOP_DESTROY_STA);
        }
        mutex_unlock(&local->sta_mtx);
@@ -1521,7 +1560,7 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
        memset(ifmgd->bssid, 0, ETH_ALEN);
        /* remove AP and TDLS peers */
-        sta_info_flush(local, sdata);
+        sta_info_flush_defer(sdata);
        /* finally reset all BSS / config parameters */
        changed |= ieee80211_reset_erp_info(sdata);
@@ -2369,8 +2408,7 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
 static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                                  struct ieee80211_mgmt *mgmt, size_t len,
                                  struct ieee80211_rx_status *rx_status,
-                                  struct ieee802_11_elems *elems,
+                                  struct ieee802_11_elems *elems)
-                                  bool beacon)
 {
        struct ieee80211_local *local = sdata->local;
        int freq;
@@ -2404,7 +2442,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                return;
        bss = ieee80211_bss_info_update(local, rx_status, mgmt, len, elems,
-                                        channel, beacon);
+                                        channel);
        if (bss)
                ieee80211_rx_bss_put(local, bss);
@@ -2447,7 +2485,7 @@ static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
        ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - baselen,
                                &elems);
-        ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems, false);
+        ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
        if (ifmgd->associated &&
            ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
@@ -2528,8 +2566,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                ieee802_11_parse_elems(mgmt->u.beacon.variable,
                                       len - baselen, &elems);
-                ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems,
+                ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
-                                      false);
                ifmgd->assoc_data->have_beacon = true;
                ifmgd->assoc_data->sent_assoc = false;
                /* continue assoc process */
@@ -2682,8 +2719,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
        ifmgd->beacon_crc = ncrc;
        ifmgd->beacon_crc_valid = true;
-        ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems,
+        ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems);
-                              true);
        if (ieee80211_sta_wmm_params(local, sdata, elems.wmm_param,
                                     elems.wmm_param_len))
@@ -3756,7 +3792,7 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
        struct ieee80211_bss *bss = (void *)req->bss->priv;
        struct ieee80211_mgd_assoc_data *assoc_data;
        struct ieee80211_supported_band *sband;
-        const u8 *ssidie, *ht_ie;
+        const u8 *ssidie, *ht_ie, *vht_ie;
        int i, err;
        assoc_data = kzalloc(sizeof(*assoc_data) + req->ie_len, GFP_KERNEL);
@@ -3875,6 +3911,12 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
                        ((struct ieee80211_ht_operation *)(ht_ie + 2))->ht_param;
        else
                ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
+        vht_ie = ieee80211_bss_get_ie(req->bss, WLAN_EID_VHT_CAPABILITY);
+        if (vht_ie && vht_ie[1] >= sizeof(struct ieee80211_vht_cap))
+                memcpy(&assoc_data->ap_vht_cap, vht_ie + 2,
+                       sizeof(struct ieee80211_vht_cap));
+        else
+                ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
        rcu_read_unlock();
        if (bss->wmm_used && bss->uapsd_supported &&
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index a5379aea7d09..82baf5b6ecf4 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -102,8 +102,7 @@ static void ieee80211_offchannel_ps_disable(struct ieee80211_sub_if_data *sdata)
        ieee80211_sta_reset_conn_monitor(sdata);
 }
-void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local,
+void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local)
-                                    bool offchannel_ps_enable)
 {
        struct ieee80211_sub_if_data *sdata;
@@ -126,16 +125,17 @@ void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local,
                        set_bit(SDATA_STATE_OFFCHANNEL, &sdata->state);
                /* Check to see if we should disable beaconing. */
-                if (sdata->vif.type == NL80211_IFTYPE_AP ||
+                if (sdata->vif.bss_conf.enable_beacon) {
-                    sdata->vif.type == NL80211_IFTYPE_ADHOC ||
+                        set_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED,
-                    sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
+                                &sdata->state);
+                        sdata->vif.bss_conf.enable_beacon = false;
                        ieee80211_bss_info_change_notify(
                                sdata, BSS_CHANGED_BEACON_ENABLED);
+                }
                if (sdata->vif.type != NL80211_IFTYPE_MONITOR) {
                        netif_tx_stop_all_queues(sdata->dev);
-                        if (offchannel_ps_enable &&
+                        if (sdata->vif.type == NL80211_IFTYPE_STATION &&
-                            (sdata->vif.type == NL80211_IFTYPE_STATION) &&
                            sdata->u.mgd.associated)
                                ieee80211_offchannel_ps_enable(sdata);
                }
@@ -143,8 +143,7 @@ void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local,
        mutex_unlock(&local->iflist_mtx);
 }
-void ieee80211_offchannel_return(struct ieee80211_local *local,
+void ieee80211_offchannel_return(struct ieee80211_local *local)
-                                 bool offchannel_ps_disable)
 {
        struct ieee80211_sub_if_data *sdata;
@@ -163,11 +162,9 @@ void ieee80211_offchannel_return(struct ieee80211_local *local,
                        continue;
                /* Tell AP we're back */
-                if (offchannel_ps_disable &&
+                if (sdata->vif.type == NL80211_IFTYPE_STATION &&
-                    sdata->vif.type == NL80211_IFTYPE_STATION) {
+                    sdata->u.mgd.associated)
-                        if (sdata->u.mgd.associated)
+                        ieee80211_offchannel_ps_disable(sdata);
-                                ieee80211_offchannel_ps_disable(sdata);
-                }
                if (sdata->vif.type != NL80211_IFTYPE_MONITOR) {
                        /*
@@ -183,11 +180,12 @@ void ieee80211_offchannel_return(struct ieee80211_local *local,
                        netif_tx_wake_all_queues(sdata->dev);
                }
-                if (sdata->vif.type == NL80211_IFTYPE_AP ||
+                if (test_and_clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED,
-                    sdata->vif.type == NL80211_IFTYPE_ADHOC ||
+                                       &sdata->state)) {
-                    sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
+                        sdata->vif.bss_conf.enable_beacon = true;
                        ieee80211_bss_info_change_notify(
                                sdata, BSS_CHANGED_BEACON_ENABLED);
+                }
        }
        mutex_unlock(&local->iflist_mtx);
 }
@@ -385,7 +383,7 @@ void ieee80211_sw_roc_work(struct work_struct *work)
                        local->tmp_channel = NULL;
                        ieee80211_hw_config(local, 0);
-                        ieee80211_offchannel_return(local, true);
+                        ieee80211_offchannel_return(local);
                }
                ieee80211_recalc_idle(local);
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index 79a48f37d409..e45b83610e85 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -7,25 +7,23 @@
 #include "led.h"
 /* return value indicates whether the driver should be further notified */
-static bool ieee80211_quiesce(struct ieee80211_sub_if_data *sdata)
+static void ieee80211_quiesce(struct ieee80211_sub_if_data *sdata)
 {
        switch (sdata->vif.type) {
        case NL80211_IFTYPE_STATION:
                ieee80211_sta_quiesce(sdata);
-                return true;
+                break;
        case NL80211_IFTYPE_ADHOC:
                ieee80211_ibss_quiesce(sdata);
-                return true;
+                break;
        case NL80211_IFTYPE_MESH_POINT:
                ieee80211_mesh_quiesce(sdata);
-                return true;
+                break;
-        case NL80211_IFTYPE_AP_VLAN:
-        case NL80211_IFTYPE_MONITOR:
-                /* don't tell driver about this */
-                return false;
        default:
-                return true;
+                break;
        }
+        cancel_work_sync(&sdata->work);
 }
 int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
@@ -44,7 +42,8 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
                mutex_lock(&local->sta_mtx);
                list_for_each_entry(sta, &local->sta_list, list) {
                        set_sta_flag(sta, WLAN_STA_BLOCK_BA);
-                        ieee80211_sta_tear_down_BA_sessions(sta, true);
+                        ieee80211_sta_tear_down_BA_sessions(
+                                        sta, AGG_STOP_LOCAL_REQUEST);
                }
                mutex_unlock(&local->sta_mtx);
        }
@@ -94,10 +93,9 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
                        WARN_ON(err != 1);
                        local->wowlan = false;
                } else {
-                        list_for_each_entry(sdata, &local->interfaces, list) {
+                        list_for_each_entry(sdata, &local->interfaces, list)
-                                cancel_work_sync(&sdata->work);
+                                if (ieee80211_sdata_running(sdata))
-                                ieee80211_quiesce(sdata);
+                                        ieee80211_quiesce(sdata);
-                        }
                        goto suspend;
                }
        }
@@ -124,17 +122,43 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
        /* remove all interfaces */
        list_for_each_entry(sdata, &local->interfaces, list) {
-                cancel_work_sync(&sdata->work);
+                static u8 zero_addr[ETH_ALEN] = {};
+                u32 changed = 0;
-                if (!ieee80211_quiesce(sdata))
+                if (!ieee80211_sdata_running(sdata))
                        continue;
-                if (!ieee80211_sdata_running(sdata))
+                switch (sdata->vif.type) {
+                case NL80211_IFTYPE_AP_VLAN:
+                case NL80211_IFTYPE_MONITOR:
+                        /* skip these */
                        continue;
+                case NL80211_IFTYPE_STATION:
+                        if (sdata->vif.bss_conf.assoc)
+                                changed = BSS_CHANGED_ASSOC |
+                                          BSS_CHANGED_BSSID |
+                                          BSS_CHANGED_IDLE;
+                        break;
+                case NL80211_IFTYPE_AP:
+                case NL80211_IFTYPE_ADHOC:
+                case NL80211_IFTYPE_MESH_POINT:
+                        if (sdata->vif.bss_conf.enable_beacon)
+                                changed = BSS_CHANGED_BEACON_ENABLED;
+                        break;
+                default:
+                        break;
+                }
+                ieee80211_quiesce(sdata);
+                sdata->suspend_bss_conf = sdata->vif.bss_conf;
+                memset(&sdata->vif.bss_conf, 0, sizeof(sdata->vif.bss_conf));
+                sdata->vif.bss_conf.idle = true;
+                if (sdata->suspend_bss_conf.bssid)
+                        sdata->vif.bss_conf.bssid = zero_addr;
-                /* disable beaconing */
+                /* disable beaconing or remove association */
-                ieee80211_bss_info_change_notify(sdata,
+                ieee80211_bss_info_change_notify(sdata, changed);
-                        BSS_CHANGED_BEACON_ENABLED);
                if (sdata->vif.type == NL80211_IFTYPE_AP &&
                    rcu_access_pointer(sdata->u.ap.beacon))
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 580704eba8b8..a19089565c4b 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2353,7 +2353,7 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                    sdata->vif.type != NL80211_IFTYPE_ADHOC)
                        break;
-                /* verify action & smps_control are present */
+                /* verify action & smps_control/chanwidth are present */
                if (len < IEEE80211_MIN_ACTION_SIZE + 2)
                        goto invalid;
@@ -2392,6 +2392,35 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                                                 IEEE80211_RC_SMPS_CHANGED);
                        goto handled;
                }
+                case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: {
+                        struct ieee80211_supported_band *sband;
+                        u8 chanwidth = mgmt->u.action.u.ht_notify_cw.chanwidth;
+                        bool old_40mhz, new_40mhz;
+                        /* If it doesn't support 40 MHz it can't change ... */
+                        if (!rx->sta->supports_40mhz)
+                                goto handled;
+                        old_40mhz = rx->sta->sta.ht_cap.cap &
+                                        IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+                        new_40mhz = chanwidth == IEEE80211_HT_CHANWIDTH_ANY;
+                        if (old_40mhz == new_40mhz)
+                                goto handled;
+                        if (new_40mhz)
+                                rx->sta->sta.ht_cap.cap |=
+                                        IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+                        else
+                                rx->sta->sta.ht_cap.cap &=
+                                        ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+                        sband = rx->local->hw.wiphy->bands[status->band];
+                        rate_control_rate_update(local, sband, rx->sta,
+                                                 IEEE80211_RC_BW_CHANGED);
+                        goto handled;
+                }
                default:
                        goto invalid;
                }
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index d59fc6818b1c..607684c47d55 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -65,12 +65,11 @@ static bool is_uapsd_supported(struct ieee802_11_elems *elems)
 struct ieee80211_bss *
 ieee80211_bss_info_update(struct ieee80211_local *local,
                          struct ieee80211_rx_status *rx_status,
-                          struct ieee80211_mgmt *mgmt,
+                          struct ieee80211_mgmt *mgmt, size_t len,
-                          size_t len,
                          struct ieee802_11_elems *elems,
-                          struct ieee80211_channel *channel,
+                          struct ieee80211_channel *channel)
-                          bool beacon)
 {
+        bool beacon = ieee80211_is_beacon(mgmt->frame_control);
        struct cfg80211_bss *cbss;
        struct ieee80211_bss *bss;
        int clen, srlen;
@@ -203,7 +202,7 @@ void ieee80211_scan_rx(struct ieee80211_local *local, struct sk_buff *skb)
        bss = ieee80211_bss_info_update(local, rx_status,
                                        mgmt, skb->len, &elems,
-                                        channel, beacon);
+                                        channel);
        if (bss)
                ieee80211_rx_bss_put(local, bss);
 }
@@ -292,7 +291,7 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted,
        if (!was_hw_scan) {
                ieee80211_configure_filter(local);
                drv_sw_scan_complete(local);
-                ieee80211_offchannel_return(local, true);
+                ieee80211_offchannel_return(local);
        }
        ieee80211_recalc_idle(local);
@@ -341,7 +340,7 @@ static int ieee80211_start_sw_scan(struct ieee80211_local *local)
        local->next_scan_state = SCAN_DECISION;
        local->scan_channel_idx = 0;
-        ieee80211_offchannel_stop_vifs(local, true);
+        ieee80211_offchannel_stop_vifs(local);
        ieee80211_configure_filter(local);
@@ -678,12 +677,8 @@ static void ieee80211_scan_state_suspend(struct ieee80211_local *local,
        local->scan_channel = NULL;
        ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
-        /*
+        /* disable PS */
-         * Re-enable vifs and beaconing.  Leave PS
+        ieee80211_offchannel_return(local);
-         * in off-channel state..will put that back
-         * on-channel at the end of scanning.
-         */
-        ieee80211_offchannel_return(local, false);
        *next_delay = HZ / 5;
        /* afterwards, resume scan & go to next channel */
@@ -693,8 +688,7 @@ static void ieee80211_scan_state_suspend(struct ieee80211_local *local,
 static void ieee80211_scan_state_resume(struct ieee80211_local *local,
                                        unsigned long *next_delay)
 {
-        /* PS already is in off-channel mode */
+        ieee80211_offchannel_stop_vifs(local);
-        ieee80211_offchannel_stop_vifs(local, false);
        if (local->ops->flush) {
                drv_flush(local, false);
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index ca9fde198188..9d864ed5f3da 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -104,6 +104,16 @@ static void cleanup_single_sta(struct sta_info *sta)
         * neither mac80211 nor the driver can reference this
         * sta struct any more except by still existing timers
         * associated with this station that we clean up below.
+         *
+         * Note though that this still uses the sdata and even
+         * calls the driver in AP and mesh mode, so interfaces
+         * of those types mush use call sta_info_flush_cleanup()
+         * (typically via sta_info_flush()) before deconfiguring
+         * the driver.
+         *
+         * In station mode, nothing happens here so it doesn't
+         * have to (and doesn't) do that, this is intentional to
+         * speed up roaming.
         */
        if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
@@ -774,7 +784,7 @@ int __must_check __sta_info_destroy(struct sta_info *sta)
         * will be sufficient.
         */
        set_sta_flag(sta, WLAN_STA_BLOCK_BA);
-        ieee80211_sta_tear_down_BA_sessions(sta, false);
+        ieee80211_sta_tear_down_BA_sessions(sta, AGG_STOP_DESTROY_STA);
        ret = sta_info_hash_del(local, sta);
        if (ret)
@@ -885,20 +895,12 @@ void sta_info_init(struct ieee80211_local *local)
 void sta_info_stop(struct ieee80211_local *local)
 {
        del_timer_sync(&local->sta_cleanup);
-        sta_info_flush(local, NULL);
 }
-/**
- * sta_info_flush - flush matching STA entries from the STA table
+int sta_info_flush_defer(struct ieee80211_sub_if_data *sdata)
- *
- * Returns the number of removed STA entries.
- *
- * @local: local interface data
- * @sdata: matching rule for the net device (sta->dev) or %NULL to match all STAs
- */
-int sta_info_flush(struct ieee80211_local *local,
-                   struct ieee80211_sub_if_data *sdata)
 {
+        struct ieee80211_local *local = sdata->local;
        struct sta_info *sta, *tmp;
        int ret = 0;
@@ -906,30 +908,22 @@ int sta_info_flush(struct ieee80211_local *local,
        mutex_lock(&local->sta_mtx);
        list_for_each_entry_safe(sta, tmp, &local->sta_list, list) {
-                if (!sdata || sdata == sta->sdata) {
+                if (sdata == sta->sdata) {
                        WARN_ON(__sta_info_destroy(sta));
                        ret++;
                }
        }
        mutex_unlock(&local->sta_mtx);
-        rcu_barrier();
-        if (sdata) {
-                ieee80211_cleanup_sdata_stas(sdata);
-                cancel_work_sync(&sdata->cleanup_stations_wk);
-        } else {
-                mutex_lock(&local->iflist_mtx);
-                list_for_each_entry(sdata, &local->interfaces, list) {
-                        ieee80211_cleanup_sdata_stas(sdata);
-                        cancel_work_sync(&sdata->cleanup_stations_wk);
-                }
-                mutex_unlock(&local->iflist_mtx);
-        }
        return ret;
 }
+void sta_info_flush_cleanup(struct ieee80211_sub_if_data *sdata)
+{
+        ieee80211_cleanup_sdata_stas(sdata);
+        cancel_work_sync(&sdata->cleanup_stations_wk);
+}
 void ieee80211_sta_expire(struct ieee80211_sub_if_data *sdata,
                          unsigned long exp_time)
 {
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 37c1889afd3a..af7d78aa5523 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -92,6 +92,13 @@ enum ieee80211_sta_info_flags {
 #define HT_AGG_STATE_WANT_START         4
 #define HT_AGG_STATE_WANT_STOP          5
+enum ieee80211_agg_stop_reason {
+        AGG_STOP_DECLINED,
+        AGG_STOP_LOCAL_REQUEST,
+        AGG_STOP_PEER_REQUEST,
+        AGG_STOP_DESTROY_STA,
+};
 /**
 * struct tid_ampdu_tx - TID aggregation information (Tx).
 *
@@ -548,8 +555,39 @@ void sta_info_recalc_tim(struct sta_info *sta);
 void sta_info_init(struct ieee80211_local *local);
 void sta_info_stop(struct ieee80211_local *local);
-int sta_info_flush(struct ieee80211_local *local,
+int sta_info_flush_defer(struct ieee80211_sub_if_data *sdata);
-                   struct ieee80211_sub_if_data *sdata);
+/**
+ * sta_info_flush_cleanup - flush the sta_info cleanup queue
+ * @sdata: the interface
+ *
+ * Flushes the sta_info cleanup queue for a given interface;
+ * this is necessary before the interface is removed or, for
+ * AP/mesh interfaces, before it is deconfigured.
+ *
+ * Note an rcu_barrier() must precede the function, after all
+ * stations have been flushed/removed to ensure the call_rcu()
+ * calls that add stations to the cleanup queue have completed.
+ */
+void sta_info_flush_cleanup(struct ieee80211_sub_if_data *sdata);
+/**
+ * sta_info_flush - flush matching STA entries from the STA table
+ *
+ * Returns the number of removed STA entries.
+ *
+ * @sdata: sdata to remove all stations from
+ */
+static inline int sta_info_flush(struct ieee80211_sub_if_data *sdata)
+{
+        int ret = sta_info_flush_defer(sdata);
+        rcu_barrier();
+        sta_info_flush_cleanup(sdata);
+        return ret;
+}
 void sta_set_rate_info_tx(struct sta_info *sta,
                          const struct ieee80211_tx_rate *rate,
                          struct rate_info *rinfo);
diff --git a/net/mac80211/trace.h b/net/mac80211/trace.h
index a8270b441a6f..41861b91daa3 100644
--- a/net/mac80211/trace.h
+++ b/net/mac80211/trace.h
@@ -28,21 +28,27 @@
 #define VIF_PR_FMT      " vif:%s(%d%s)"
 #define VIF_PR_ARG      __get_str(vif_name), __entry->vif_type, __entry->p2p ? "/p2p" : ""
-#define CHANCTX_ENTRY   __field(u32, control_freq)                              \
+#define CHANDEF_ENTRY   __field(u32, control_freq)                              \
                        __field(u32, chan_width)                                \
                        __field(u32, center_freq1)                              \
-                        __field(u32, center_freq2)                              \
+                        __field(u32, center_freq2)
+#define CHANDEF_ASSIGN(c)                                                       \
+                        __entry->control_freq = (c)->chan->center_freq;         \
+                        __entry->chan_width = (c)->width;                       \
+                        __entry->center_freq1 = (c)->center_freq1;              \
+                        __entry->center_freq1 = (c)->center_freq2;
+#define CHANDEF_PR_FMT  " control:%d MHz width:%d center: %d/%d MHz"
+#define CHANDEF_PR_ARG  __entry->control_freq, __entry->chan_width,             \
+                        __entry->center_freq1, __entry->center_freq2
+#define CHANCTX_ENTRY   CHANDEF_ENTRY                                           \
                        __field(u8, rx_chains_static)                           \
                        __field(u8, rx_chains_dynamic)
-#define CHANCTX_ASSIGN  __entry->control_freq = ctx->conf.def.chan->center_freq;\
+#define CHANCTX_ASSIGN  CHANDEF_ASSIGN(&ctx->conf.def)                          \
-                        __entry->chan_width = ctx->conf.def.width;              \
-                        __entry->center_freq1 = ctx->conf.def.center_freq1;     \
-                        __entry->center_freq2 = ctx->conf.def.center_freq2;     \
                        __entry->rx_chains_static = ctx->conf.rx_chains_static; \
                        __entry->rx_chains_dynamic = ctx->conf.rx_chains_dynamic
-#define CHANCTX_PR_FMT  " control:%d MHz width:%d center: %d/%d MHz chains:%d/%d"
+#define CHANCTX_PR_FMT  CHANDEF_PR_FMT " chains:%d/%d"
-#define CHANCTX_PR_ARG  __entry->control_freq, __entry->chan_width,             \
+#define CHANCTX_PR_ARG  CHANDEF_PR_ARG,                                         \
-                        __entry->center_freq1, __entry->center_freq2,           \
                        __entry->rx_chains_static, __entry->rx_chains_dynamic
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index e9eadc40c09c..f32d68186dbc 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1673,10 +1673,13 @@ netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
                        chanctx_conf =
                                rcu_dereference(tmp_sdata->vif.chanctx_conf);
        }
-        if (!chanctx_conf)
-                goto fail_rcu;
-        chan = chanctx_conf->def.chan;
+        if (chanctx_conf)
+                chan = chanctx_conf->def.chan;
+        else if (!local->use_chanctx)
+                chan = local->_oper_channel;
+        else
+                goto fail_rcu;
        /*
         * Frame injection is not allowed if beaconing is not allowed
@@ -2261,9 +2264,8 @@ void ieee80211_tx_pending(unsigned long data)
 /* functions for drivers to get certain frames */
-static void ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata,
+static void __ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata,
-                                     struct ps_data *ps,
+                                       struct ps_data *ps, struct sk_buff *skb)
-                                     struct sk_buff *skb)
 {
        u8 *pos, *tim;
        int aid0 = 0;
@@ -2325,6 +2327,31 @@ static void ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata,
        }
 }
+static int ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata,
+                                    struct ps_data *ps, struct sk_buff *skb)
+{
+        struct ieee80211_local *local = sdata->local;
+        /*
+         * Not very nice, but we want to allow the driver to call
+         * ieee80211_beacon_get() as a response to the set_tim()
+         * callback. That, however, is already invoked under the
+         * sta_lock to guarantee consistent and race-free update
+         * of the tim bitmap in mac80211 and the driver.
+         */
+        if (local->tim_in_locked_section) {
+                __ieee80211_beacon_add_tim(sdata, ps, skb);
+        } else {
+                unsigned long flags;
+                spin_lock_irqsave(&local->tim_lock, flags);
+                __ieee80211_beacon_add_tim(sdata, ps, skb);
+                spin_unlock_irqrestore(&local->tim_lock, flags);
+        }
+        return 0;
+}
 struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                                         struct ieee80211_vif *vif,
                                         u16 *tim_offset, u16 *tim_length)
@@ -2369,22 +2396,7 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                        memcpy(skb_put(skb, beacon->head_len), beacon->head,
                               beacon->head_len);
-                        /*
+                        ieee80211_beacon_add_tim(sdata, &ap->ps, skb);
-                         * Not very nice, but we want to allow the driver to call
-                         * ieee80211_beacon_get() as a response to the set_tim()
-                         * callback. That, however, is already invoked under the
-                         * sta_lock to guarantee consistent and race-free update
-                         * of the tim bitmap in mac80211 and the driver.
-                         */
-                        if (local->tim_in_locked_section) {
-                                ieee80211_beacon_add_tim(sdata, &ap->ps, skb);
-                        } else {
-                                unsigned long flags;
-                                spin_lock_irqsave(&local->tim_lock, flags);
-                                ieee80211_beacon_add_tim(sdata, &ap->ps, skb);
-                                spin_unlock_irqrestore(&local->tim_lock, flags);
-                        }
                        if (tim_offset)
                                *tim_offset = beacon->head_len;
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index f11e8c540db4..7519018ff71a 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1358,6 +1358,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
        struct ieee80211_chanctx *ctx;
        struct sta_info *sta;
        int res, i;
+        bool reconfig_due_to_wowlan = false;
 #ifdef CONFIG_PM
        if (local->suspended)
@@ -1377,6 +1378,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                 * res is 1, which means the driver requested
                 * to go through a regular reset on wakeup.
                 */
+                reconfig_due_to_wowlan = true;
        }
 #endif
        /* everything else happens only if HW was up & running */
@@ -1526,6 +1528,11 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                          BSS_CHANGED_IDLE |
                          BSS_CHANGED_TXPOWER;
+#ifdef CONFIG_PM
+                if (local->resuming && !reconfig_due_to_wowlan)
+                        sdata->vif.bss_conf = sdata->suspend_bss_conf;
+#endif
                switch (sdata->vif.type) {
                case NL80211_IFTYPE_STATION:
                        changed |= BSS_CHANGED_ASSOC |
@@ -1550,9 +1557,11 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                        /* fall through */
                case NL80211_IFTYPE_MESH_POINT:
-                        changed |= BSS_CHANGED_BEACON |
+                        if (sdata->vif.bss_conf.enable_beacon) {
-                                   BSS_CHANGED_BEACON_ENABLED;
+                                changed |= BSS_CHANGED_BEACON |
-                        ieee80211_bss_info_change_notify(sdata, changed);
+                                           BSS_CHANGED_BEACON_ENABLED;
+                                ieee80211_bss_info_change_notify(sdata, changed);
+                        }
                        break;
                case NL80211_IFTYPE_WDS:
                        break;
@@ -1632,7 +1641,8 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                mutex_lock(&local->sta_mtx);
                list_for_each_entry(sta, &local->sta_list, list) {
-                        ieee80211_sta_tear_down_BA_sessions(sta, true);
+                        ieee80211_sta_tear_down_BA_sessions(
+                                        sta, AGG_STOP_LOCAL_REQUEST);
                        clear_sta_flag(sta, WLAN_STA_BLOCK_BA);
                }
@@ -1646,10 +1656,11 @@ int ieee80211_reconfig(struct ieee80211_local *local)
         * If this is for hw restart things are still running.
         * We may want to change that later, however.
         */
-        if (!local->suspended) {
+        if (!local->suspended || reconfig_due_to_wowlan)
                drv_restart_complete(local);
+        if (!local->suspended)
                return 0;
-        }
 #ifdef CONFIG_PM
        /* first set suspended false, then resuming */
@@ -1864,7 +1875,7 @@ u8 *ieee80211_ie_build_ht_cap(u8 *pos, struct ieee80211_sta_ht_cap *ht_cap,
 }
 u8 *ieee80211_ie_build_vht_cap(u8 *pos, struct ieee80211_sta_vht_cap *vht_cap,
-                                                           u32 cap)
+                               u32 cap)
 {
        __le32 tmp;
diff --git a/net/nfc/core.c b/net/nfc/core.c
index aa64ea441676..25522e56d350 100644
--- a/net/nfc/core.c
+++ b/net/nfc/core.c
@@ -338,7 +338,7 @@ int nfc_activate_target(struct nfc_dev *dev, u32 target_idx, u32 protocol)
                dev->active_target = target;
                dev->rf_mode = NFC_RF_INITIATOR;
-                if (dev->ops->check_presence)
+                if (dev->ops->check_presence && !dev->shutting_down)
                        mod_timer(&dev->check_pres_timer, jiffies +
                                  msecs_to_jiffies(NFC_CHECK_PRES_FREQ_MS));
        }
@@ -429,7 +429,7 @@ int nfc_data_exchange(struct nfc_dev *dev, u32 target_idx, struct sk_buff *skb,
                rc = dev->ops->im_transceive(dev, dev->active_target, skb, cb,
                                             cb_context);
-                if (!rc && dev->ops->check_presence)
+                if (!rc && dev->ops->check_presence && !dev->shutting_down)
                        mod_timer(&dev->check_pres_timer, jiffies +
                                  msecs_to_jiffies(NFC_CHECK_PRES_FREQ_MS));
        } else if (dev->rf_mode == NFC_RF_TARGET && dev->ops->tm_send != NULL) {
@@ -684,11 +684,6 @@ static void nfc_release(struct device *d)
        pr_debug("dev_name=%s\n", dev_name(&dev->dev));
-        if (dev->ops->check_presence) {
-                del_timer_sync(&dev->check_pres_timer);
-                cancel_work_sync(&dev->check_pres_work);
-        }
        nfc_genl_data_exit(&dev->genl_data);
        kfree(dev->targets);
        kfree(dev);
@@ -706,15 +701,16 @@ static void nfc_check_pres_work(struct work_struct *work)
                rc = dev->ops->check_presence(dev, dev->active_target);
                if (rc == -EOPNOTSUPP)
                        goto exit;
-                if (!rc) {
+                if (rc) {
-                        mod_timer(&dev->check_pres_timer, jiffies +
-                                  msecs_to_jiffies(NFC_CHECK_PRES_FREQ_MS));
-                } else {
                        u32 active_target_idx = dev->active_target->idx;
                        device_unlock(&dev->dev);
                        nfc_target_lost(dev, active_target_idx);
                        return;
                }
+                if (!dev->shutting_down)
+                        mod_timer(&dev->check_pres_timer, jiffies +
+                                  msecs_to_jiffies(NFC_CHECK_PRES_FREQ_MS));
        }
 exit:
@@ -761,6 +757,7 @@ struct nfc_dev *nfc_get_device(unsigned int idx)
 */
 struct nfc_dev *nfc_allocate_device(struct nfc_ops *ops,
                                    u32 supported_protocols,
+                                    u32 supported_se,
                                    int tx_headroom, int tx_tailroom)
 {
        struct nfc_dev *dev;
@@ -778,6 +775,8 @@ struct nfc_dev *nfc_allocate_device(struct nfc_ops *ops,
        dev->ops = ops;
        dev->supported_protocols = supported_protocols;
+        dev->supported_se = supported_se;
+        dev->active_se = NFC_SE_NONE;
        dev->tx_headroom = tx_headroom;
        dev->tx_tailroom = tx_tailroom;
@@ -853,26 +852,27 @@ void nfc_unregister_device(struct nfc_dev *dev)
        id = dev->idx;
-        mutex_lock(&nfc_devlist_mutex);
+        if (dev->ops->check_presence) {
-        nfc_devlist_generation++;
+                device_lock(&dev->dev);
+                dev->shutting_down = true;
-        /* lock to avoid unregistering a device while an operation
+                device_unlock(&dev->dev);
-           is in progress */
+                del_timer_sync(&dev->check_pres_timer);
-        device_lock(&dev->dev);
+                cancel_work_sync(&dev->check_pres_work);
-        device_del(&dev->dev);
+        }
-        device_unlock(&dev->dev);
-        mutex_unlock(&nfc_devlist_mutex);
+        rc = nfc_genl_device_removed(dev);
+        if (rc)
+                pr_debug("The userspace won't be notified that the device %s "
+                         "was removed\n", dev_name(&dev->dev));
        nfc_llcp_unregister_device(dev);
-        rc = nfc_genl_device_removed(dev);
+        mutex_lock(&nfc_devlist_mutex);
-        if (rc)
+        nfc_devlist_generation++;
-                pr_debug("The userspace won't be notified that the device %s was removed\n",
+        device_del(&dev->dev);
-                         dev_name(&dev->dev));
+        mutex_unlock(&nfc_devlist_mutex);
        ida_simple_remove(&nfc_index_ida, id);
 }
 EXPORT_SYMBOL(nfc_unregister_device);
diff --git a/net/nfc/hci/command.c b/net/nfc/hci/command.c
index 7d99410e6c1a..64f922be9281 100644
--- a/net/nfc/hci/command.c
+++ b/net/nfc/hci/command.c
@@ -280,14 +280,19 @@ static int nfc_hci_delete_pipe(struct nfc_hci_dev *hdev, u8 pipe)
 static int nfc_hci_clear_all_pipes(struct nfc_hci_dev *hdev)
 {
        u8 param[2];
+        size_t param_len = 2;
        /* TODO: Find out what the identity reference data is
         * and fill param with it. HCI spec 6.1.3.5 */
        pr_debug("\n");
+        if (test_bit(NFC_HCI_QUIRK_SHORT_CLEAR, &hdev->quirks))
+                param_len = 0;
        return nfc_hci_execute_cmd(hdev, NFC_HCI_ADMIN_PIPE,
-                                   NFC_HCI_ADM_CLEAR_ALL_PIPE, param, 2, NULL);
+                                   NFC_HCI_ADM_CLEAR_ALL_PIPE, param, param_len,
+                                   NULL);
 }
 int nfc_hci_disconnect_gate(struct nfc_hci_dev *hdev, u8 gate)
diff --git a/net/nfc/hci/core.c b/net/nfc/hci/core.c
index 7bea574d5934..91020b210d87 100644
--- a/net/nfc/hci/core.c
+++ b/net/nfc/hci/core.c
@@ -57,6 +57,8 @@ static void nfc_hci_msg_tx_work(struct work_struct *work)
        int r = 0;
        mutex_lock(&hdev->msg_tx_mutex);
+        if (hdev->shutting_down)
+                goto exit;
        if (hdev->cmd_pending_msg) {
                if (timer_pending(&hdev->cmd_timer) == 0) {
@@ -295,6 +297,12 @@ void nfc_hci_event_received(struct nfc_hci_dev *hdev, u8 pipe, u8 event,
                goto exit;
        }
+        if (hdev->ops->event_received) {
+                r = hdev->ops->event_received(hdev, gate, event, skb);
+                if (r <= 0)
+                        goto exit_noskb;
+        }
        switch (event) {
        case NFC_HCI_EVT_TARGET_DISCOVERED:
                if (skb->len < 1) {     /* no status data? */
@@ -320,17 +328,15 @@ void nfc_hci_event_received(struct nfc_hci_dev *hdev, u8 pipe, u8 event,
                r = nfc_hci_target_discovered(hdev, gate);
                break;
        default:
-                if (hdev->ops->event_received) {
+                pr_info("Discarded unknown event %x to gate %x\n", event, gate);
-                        hdev->ops->event_received(hdev, gate, event, skb);
+                r = -EINVAL;
-                        return;
-                }
                break;
        }
 exit:
        kfree_skb(skb);
+exit_noskb:
        if (r) {
                /* TODO: There was an error dispatching the event,
                 * how to propagate up to nfc core?
@@ -669,8 +675,10 @@ static int hci_tm_send(struct nfc_dev *nfc_dev, struct sk_buff *skb)
        if (hdev->ops->tm_send)
                return hdev->ops->tm_send(hdev, skb);
-        else
-                return -ENOTSUPP;
+        kfree_skb(skb);
+        return -ENOTSUPP;
 }
 static int hci_check_presence(struct nfc_dev *nfc_dev,
@@ -787,7 +795,9 @@ static struct nfc_ops hci_nfc_ops = {
 struct nfc_hci_dev *nfc_hci_allocate_device(struct nfc_hci_ops *ops,
                                            struct nfc_hci_init_data *init_data,
+                                            unsigned long quirks,
                                            u32 protocols,
+                                            u32 supported_se,
                                            const char *llc_name,
                                            int tx_headroom,
                                            int tx_tailroom,
@@ -813,7 +823,7 @@ struct nfc_hci_dev *nfc_hci_allocate_device(struct nfc_hci_ops *ops,
                return NULL;
        }
-        hdev->ndev = nfc_allocate_device(&hci_nfc_ops, protocols,
+        hdev->ndev = nfc_allocate_device(&hci_nfc_ops, protocols, supported_se,
                                         tx_headroom + HCI_CMDS_HEADROOM,
                                         tx_tailroom);
        if (!hdev->ndev) {
@@ -830,6 +840,8 @@ struct nfc_hci_dev *nfc_hci_allocate_device(struct nfc_hci_ops *ops,
        memset(hdev->gate2pipe, NFC_HCI_INVALID_PIPE, sizeof(hdev->gate2pipe));
+        hdev->quirks = quirks;
        return hdev;
 }
 EXPORT_SYMBOL(nfc_hci_allocate_device);
@@ -868,6 +880,28 @@ void nfc_hci_unregister_device(struct nfc_hci_dev *hdev)
 {
        struct hci_msg *msg, *n;
+        mutex_lock(&hdev->msg_tx_mutex);
+        if (hdev->cmd_pending_msg) {
+                if (hdev->cmd_pending_msg->cb)
+                        hdev->cmd_pending_msg->cb(
+                                             hdev->cmd_pending_msg->cb_context,
+                                             NULL, -ESHUTDOWN);
+                kfree(hdev->cmd_pending_msg);
+                hdev->cmd_pending_msg = NULL;
+        }
+        hdev->shutting_down = true;
+        mutex_unlock(&hdev->msg_tx_mutex);
+        del_timer_sync(&hdev->cmd_timer);
+        cancel_work_sync(&hdev->msg_tx_work);
+        cancel_work_sync(&hdev->msg_rx_work);
+        nfc_unregister_device(hdev->ndev);
        skb_queue_purge(&hdev->rx_hcp_frags);
        skb_queue_purge(&hdev->msg_rx_queue);
@@ -876,13 +910,6 @@ void nfc_hci_unregister_device(struct nfc_hci_dev *hdev)
                skb_queue_purge(&msg->msg_frags);
                kfree(msg);
        }
-        del_timer_sync(&hdev->cmd_timer);
-        nfc_unregister_device(hdev->ndev);
-        cancel_work_sync(&hdev->msg_tx_work);
-        cancel_work_sync(&hdev->msg_rx_work);
 }
 EXPORT_SYMBOL(nfc_hci_unregister_device);
diff --git a/net/nfc/hci/hcp.c b/net/nfc/hci/hcp.c
index bc308a7ca609..b6b4109f2343 100644
--- a/net/nfc/hci/hcp.c
+++ b/net/nfc/hci/hcp.c
@@ -105,6 +105,13 @@ int nfc_hci_hcp_message_tx(struct nfc_hci_dev *hdev, u8 pipe,
        }
        mutex_lock(&hdev->msg_tx_mutex);
+        if (hdev->shutting_down) {
+                err = -ESHUTDOWN;
+                mutex_unlock(&hdev->msg_tx_mutex);
+                goto out_skb_err;
+        }
        list_add_tail(&cmd->msg_l, &hdev->msg_tx_queue);
        mutex_unlock(&hdev->msg_tx_mutex);
diff --git a/net/nfc/llcp/commands.c b/net/nfc/llcp/commands.c
index df24be48d4da..c6bc3bd95052 100644
--- a/net/nfc/llcp/commands.c
+++ b/net/nfc/llcp/commands.c
@@ -304,6 +304,8 @@ int nfc_llcp_send_symm(struct nfc_dev *dev)
        skb = llcp_add_header(skb, 0, 0, LLCP_PDU_SYMM);
+        __net_timestamp(skb);
        nfc_llcp_send_to_raw_sock(local, skb, NFC_LLCP_DIRECTION_TX);
        return nfc_data_exchange(dev, local->target_idx, skb,
diff --git a/net/nfc/llcp/llcp.c b/net/nfc/llcp/llcp.c
index ec43914c92a9..85bc75c38dea 100644
--- a/net/nfc/llcp/llcp.c
+++ b/net/nfc/llcp/llcp.c
@@ -54,7 +54,6 @@ static void nfc_llcp_socket_purge(struct nfc_llcp_sock *sock)
        skb_queue_purge(&sock->tx_queue);
        skb_queue_purge(&sock->tx_pending_queue);
-        skb_queue_purge(&sock->tx_backlog_queue);
        if (local == NULL)
                return;
@@ -668,6 +667,8 @@ static void nfc_llcp_tx_work(struct work_struct *work)
                        if (ptype == LLCP_PDU_I)
                                copy_skb = skb_copy(skb, GFP_ATOMIC);
+                        __net_timestamp(skb);
                        nfc_llcp_send_to_raw_sock(local, skb,
                                                  NFC_LLCP_DIRECTION_TX);
@@ -781,9 +782,15 @@ static void nfc_llcp_recv_ui(struct nfc_llcp_local *local,
        /* There is no sequence with UI frames */
        skb_pull(skb, LLCP_HEADER_SIZE);
-        if (sock_queue_rcv_skb(&llcp_sock->sk, skb)) {
+        if (!sock_queue_rcv_skb(&llcp_sock->sk, skb)) {
-                pr_err("receive queue is full\n");
+                /*
-                skb_queue_head(&llcp_sock->tx_backlog_queue, skb);
+                 * UI frames will be freed from the socket layer, so we
+                 * need to keep them alive until someone receives them.
+                 */
+                skb_get(skb);
+        } else {
+                pr_err("Receive queue is full\n");
+                kfree_skb(skb);
        }
        nfc_llcp_sock_put(llcp_sock);
@@ -976,9 +983,15 @@ static void nfc_llcp_recv_hdlc(struct nfc_llcp_local *local,
                        pr_err("Received out of sequence I PDU\n");
                skb_pull(skb, LLCP_HEADER_SIZE + LLCP_SEQUENCE_SIZE);
-                if (sock_queue_rcv_skb(&llcp_sock->sk, skb)) {
+                if (!sock_queue_rcv_skb(&llcp_sock->sk, skb)) {
-                        pr_err("receive queue is full\n");
+                        /*
-                        skb_queue_head(&llcp_sock->tx_backlog_queue, skb);
+                         * I frames will be freed from the socket layer, so we
+                         * need to keep them alive until someone receives them.
+                         */
+                        skb_get(skb);
+                } else {
+                        pr_err("Receive queue is full\n");
+                        kfree_skb(skb);
                }
        }
@@ -1245,6 +1258,8 @@ static void nfc_llcp_rx_work(struct work_struct *work)
                print_hex_dump(KERN_DEBUG, "LLCP Rx: ", DUMP_PREFIX_OFFSET,
                               16, 1, skb->data, skb->len, true);
+        __net_timestamp(skb);
        nfc_llcp_send_to_raw_sock(local, skb, NFC_LLCP_DIRECTION_RX);
        switch (ptype) {
@@ -1296,6 +1311,13 @@ static void nfc_llcp_rx_work(struct work_struct *work)
        local->rx_pending = NULL;
 }
+static void __nfc_llcp_recv(struct nfc_llcp_local *local, struct sk_buff *skb)
+{
+        local->rx_pending = skb;
+        del_timer(&local->link_timer);
+        schedule_work(&local->rx_work);
+}
 void nfc_llcp_recv(void *data, struct sk_buff *skb, int err)
 {
        struct nfc_llcp_local *local = (struct nfc_llcp_local *) data;
@@ -1306,9 +1328,7 @@ void nfc_llcp_recv(void *data, struct sk_buff *skb, int err)
                return;
        }
-        local->rx_pending = skb_get(skb);
+        __nfc_llcp_recv(local, skb);
-        del_timer(&local->link_timer);
-        schedule_work(&local->rx_work);
 }
 int nfc_llcp_data_received(struct nfc_dev *dev, struct sk_buff *skb)
@@ -1319,9 +1339,7 @@ int nfc_llcp_data_received(struct nfc_dev *dev, struct sk_buff *skb)
        if (local == NULL)
                return -ENODEV;
-        local->rx_pending = skb_get(skb);
+        __nfc_llcp_recv(local, skb);
-        del_timer(&local->link_timer);
-        schedule_work(&local->rx_work);
        return 0;
 }
diff --git a/net/nfc/llcp/llcp.h b/net/nfc/llcp/llcp.h
index 0d62366f8cc3..0eae5c509504 100644
--- a/net/nfc/llcp/llcp.h
+++ b/net/nfc/llcp/llcp.h
@@ -121,7 +121,6 @@ struct nfc_llcp_sock {
        struct sk_buff_head tx_queue;
        struct sk_buff_head tx_pending_queue;
-        struct sk_buff_head tx_backlog_queue;
        struct list_head accept_queue;
        struct sock *parent;
diff --git a/net/nfc/llcp/sock.c b/net/nfc/llcp/sock.c
index fea22eb41b82..5332751943a9 100644
--- a/net/nfc/llcp/sock.c
+++ b/net/nfc/llcp/sock.c
@@ -672,25 +672,27 @@ static int llcp_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
        copied = min_t(unsigned int, rlen, len);
        cskb = skb;
-        if (memcpy_toiovec(msg->msg_iov, cskb->data, copied)) {
+        if (skb_copy_datagram_iovec(cskb, 0, msg->msg_iov, copied)) {
                if (!(flags & MSG_PEEK))
                        skb_queue_head(&sk->sk_receive_queue, skb);
                return -EFAULT;
        }
+        sock_recv_timestamp(msg, sk, skb);
        if (sk->sk_type == SOCK_DGRAM && msg->msg_name) {
                struct nfc_llcp_ui_cb *ui_cb = nfc_llcp_ui_skb_cb(skb);
-                struct sockaddr_nfc_llcp sockaddr;
+                struct sockaddr_nfc_llcp *sockaddr =
+                        (struct sockaddr_nfc_llcp *) msg->msg_name;
-                pr_debug("Datagram socket %d %d\n", ui_cb->dsap, ui_cb->ssap);
+                msg->msg_namelen = sizeof(struct sockaddr_nfc_llcp);
-                sockaddr.sa_family = AF_NFC;
+                pr_debug("Datagram socket %d %d\n", ui_cb->dsap, ui_cb->ssap);
-                sockaddr.nfc_protocol = NFC_PROTO_NFC_DEP;
-                sockaddr.dsap = ui_cb->dsap;
-                sockaddr.ssap = ui_cb->ssap;
-                memcpy(msg->msg_name, &sockaddr, sizeof(sockaddr));
+                sockaddr->sa_family = AF_NFC;
-                msg->msg_namelen = sizeof(sockaddr);
+                sockaddr->nfc_protocol = NFC_PROTO_NFC_DEP;
+                sockaddr->dsap = ui_cb->dsap;
+                sockaddr->ssap = ui_cb->ssap;
        }
        /* Mark read part of skb as used */
@@ -806,7 +808,6 @@ struct sock *nfc_llcp_sock_alloc(struct socket *sock, int type, gfp_t gfp)
        llcp_sock->reserved_ssap = LLCP_SAP_MAX;
        skb_queue_head_init(&llcp_sock->tx_queue);
        skb_queue_head_init(&llcp_sock->tx_pending_queue);
-        skb_queue_head_init(&llcp_sock->tx_backlog_queue);
        INIT_LIST_HEAD(&llcp_sock->accept_queue);
        if (sock != NULL)
@@ -821,7 +822,6 @@ void nfc_llcp_sock_free(struct nfc_llcp_sock *sock)
        skb_queue_purge(&sock->tx_queue);
        skb_queue_purge(&sock->tx_pending_queue);
-        skb_queue_purge(&sock->tx_backlog_queue);
        list_del_init(&sock->accept_queue);
diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
index 5f98dc1bf039..48ada0ec749e 100644
--- a/net/nfc/nci/core.c
+++ b/net/nfc/nci/core.c
@@ -658,6 +658,7 @@ static struct nfc_ops nci_nfc_ops = {
 */
 struct nci_dev *nci_allocate_device(struct nci_ops *ops,
                                    __u32 supported_protocols,
+                                    __u32 supported_se,
                                    int tx_headroom, int tx_tailroom)
 {
        struct nci_dev *ndev;
@@ -680,6 +681,7 @@ struct nci_dev *nci_allocate_device(struct nci_ops *ops,
        ndev->nfc_dev = nfc_allocate_device(&nci_nfc_ops,
                                            supported_protocols,
+                                            supported_se,
                                            tx_headroom + NCI_DATA_HDR_SIZE,
                                            tx_tailroom);
        if (!ndev->nfc_dev)
diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
index 3568ae16786d..504b883439f1 100644
--- a/net/nfc/netlink.c
+++ b/net/nfc/netlink.c
@@ -366,6 +366,7 @@ static int nfc_genl_send_device(struct sk_buff *msg, struct nfc_dev *dev,
        if (nla_put_string(msg, NFC_ATTR_DEVICE_NAME, nfc_device_name(dev)) ||
            nla_put_u32(msg, NFC_ATTR_DEVICE_INDEX, dev->idx) ||
            nla_put_u32(msg, NFC_ATTR_PROTOCOLS, dev->supported_protocols) ||
+            nla_put_u32(msg, NFC_ATTR_SE, dev->supported_se) ||
            nla_put_u8(msg, NFC_ATTR_DEVICE_POWERED, dev->dev_up) ||
            nla_put_u8(msg, NFC_ATTR_RF_MODE, dev->rf_mode))
                goto nla_put_failure;
diff --git a/net/wireless/ap.c b/net/wireless/ap.c
index 324e8d851dc4..a4a14e8f55cc 100644
--- a/net/wireless/ap.c
+++ b/net/wireless/ap.c
@@ -46,3 +46,65 @@ int cfg80211_stop_ap(struct cfg80211_registered_device *rdev,
        return err;
 }
+void cfg80211_ch_switch_notify(struct net_device *dev,
+                               struct cfg80211_chan_def *chandef)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct wiphy *wiphy = wdev->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        trace_cfg80211_ch_switch_notify(dev, chandef);
+        wdev_lock(wdev);
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
+                    wdev->iftype != NL80211_IFTYPE_P2P_GO))
+                goto out;
+        wdev->channel = chandef->chan;
+        nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL);
+out:
+        wdev_unlock(wdev);
+        return;
+}
+EXPORT_SYMBOL(cfg80211_ch_switch_notify);
+bool cfg80211_rx_spurious_frame(struct net_device *dev,
+                                const u8 *addr, gfp_t gfp)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        bool ret;
+        trace_cfg80211_rx_spurious_frame(dev, addr);
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
+                    wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
+                trace_cfg80211_return_bool(false);
+                return false;
+        }
+        ret = nl80211_unexpected_frame(dev, addr, gfp);
+        trace_cfg80211_return_bool(ret);
+        return ret;
+}
+EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
+bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
+                                        const u8 *addr, gfp_t gfp)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        bool ret;
+        trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
+                    wdev->iftype != NL80211_IFTYPE_P2P_GO &&
+                    wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
+                trace_cfg80211_return_bool(false);
+                return false;
+        }
+        ret = nl80211_unexpected_4addr_frame(dev, addr, gfp);
+        trace_cfg80211_return_bool(ret);
+        return ret;
+}
+EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index a7990bb16529..396373f3ec26 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -76,6 +76,10 @@ bool cfg80211_chandef_valid(const struct cfg80211_chan_def *chandef)
                        return false;
                if (!chandef->center_freq2)
                        return false;
+                /* adjacent is not allowed -- that's a 160 MHz channel */
+                if (chandef->center_freq1 - chandef->center_freq2 == 80 ||
+                    chandef->center_freq2 - chandef->center_freq1 == 80)
+                        return false;
                break;
        case NL80211_CHAN_WIDTH_80:
                if (chandef->center_freq1 != control_freq + 30 &&
diff --git a/net/wireless/core.c b/net/wireless/core.c
index b677eab55b68..9245729694d2 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -57,9 +57,6 @@ struct cfg80211_registered_device *cfg80211_rdev_by_wiphy_idx(int wiphy_idx)
 {
        struct cfg80211_registered_device *result = NULL, *rdev;
-        if (!wiphy_idx_valid(wiphy_idx))
-                return NULL;
        assert_cfg80211_lock();
        list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
@@ -74,10 +71,8 @@ struct cfg80211_registered_device *cfg80211_rdev_by_wiphy_idx(int wiphy_idx)
 int get_wiphy_idx(struct wiphy *wiphy)
 {
-        struct cfg80211_registered_device *rdev;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-        if (!wiphy)
-                return WIPHY_IDX_STALE;
-        rdev = wiphy_to_dev(wiphy);
        return rdev->wiphy_idx;
 }
@@ -86,9 +81,6 @@ struct wiphy *wiphy_idx_to_wiphy(int wiphy_idx)
 {
        struct cfg80211_registered_device *rdev;
-        if (!wiphy_idx_valid(wiphy_idx))
-                return NULL;
        assert_cfg80211_lock();
        rdev = cfg80211_rdev_by_wiphy_idx(wiphy_idx);
@@ -309,7 +301,7 @@ struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv)
        rdev->wiphy_idx = wiphy_counter++;
-        if (unlikely(!wiphy_idx_valid(rdev->wiphy_idx))) {
+        if (unlikely(rdev->wiphy_idx < 0)) {
                wiphy_counter--;
                mutex_unlock(&cfg80211_mutex);
                /* ugh, wrapped! */
@@ -390,8 +382,11 @@ static int wiphy_verify_combinations(struct wiphy *wiphy)
                c = &wiphy->iface_combinations[i];
-                /* Combinations with just one interface aren't real */
+                /*
-                if (WARN_ON(c->max_interfaces < 2))
+                 * Combinations with just one interface aren't real,
+                 * however we make an exception for DFS.
+                 */
+                if (WARN_ON((c->max_interfaces < 2) && !c->radar_detect_widths))
                        return -EINVAL;
                /* Need at least one channel */
@@ -406,6 +401,11 @@ static int wiphy_verify_combinations(struct wiphy *wiphy)
                                CFG80211_MAX_NUM_DIFFERENT_CHANNELS))
                        return -EINVAL;
+                /* DFS only works on one channel. */
+                if (WARN_ON(c->radar_detect_widths &&
+                            (c->num_different_channels > 1)))
+                        return -EINVAL;
                if (WARN_ON(!c->n_limits))
                        return -EINVAL;
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 3563097169cb..8396f7671c8d 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -18,6 +18,9 @@
 #include <net/cfg80211.h>
 #include "reg.h"
+#define WIPHY_IDX_INVALID       -1
 struct cfg80211_registered_device {
        const struct cfg80211_ops *ops;
        struct list_head list;
@@ -86,7 +89,7 @@ struct cfg80211_registered_device {
        /* must be last because of the way we do wiphy_priv(),
         * and it should at least be aligned to NETDEV_ALIGN */
-        struct wiphy wiphy __attribute__((__aligned__(NETDEV_ALIGN)));
+        struct wiphy wiphy __aligned(NETDEV_ALIGN);
 };
 static inline
@@ -96,13 +99,6 @@ struct cfg80211_registered_device *wiphy_to_dev(struct wiphy *wiphy)
        return container_of(wiphy, struct cfg80211_registered_device, wiphy);
 }
-/* Note 0 is valid, hence phy0 */
-static inline
-bool wiphy_idx_valid(int wiphy_idx)
-{
-        return wiphy_idx >= 0;
-}
 static inline void
 cfg80211_rdev_free_wowlan(struct cfg80211_registered_device *rdev)
 {
@@ -126,12 +122,6 @@ static inline void assert_cfg80211_lock(void)
        lockdep_assert_held(&cfg80211_mutex);
 }
-/*
- * You can use this to mark a wiphy_idx as not having an associated wiphy.
- * It guarantees cfg80211_rdev_by_wiphy_idx(wiphy_idx) will return NULL
- */
-#define WIPHY_IDX_STALE -1
 struct cfg80211_internal_bss {
        struct list_head list;
        struct rb_node rbn;
@@ -435,7 +425,8 @@ int cfg80211_can_use_iftype_chan(struct cfg80211_registered_device *rdev,
                                 struct wireless_dev *wdev,
                                 enum nl80211_iftype iftype,
                                 struct ieee80211_channel *chan,
-                                 enum cfg80211_chan_mode chanmode);
+                                 enum cfg80211_chan_mode chanmode,
+                                 u8 radar_detect);
 static inline int
 cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
@@ -443,7 +434,7 @@ cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
                              enum nl80211_iftype iftype)
 {
        return cfg80211_can_use_iftype_chan(rdev, wdev, iftype, NULL,
-                                            CHAN_MODE_UNDEFINED);
+                                            CHAN_MODE_UNDEFINED, 0);
 }
 static inline int
@@ -460,7 +451,7 @@ cfg80211_can_use_chan(struct cfg80211_registered_device *rdev,
                      enum cfg80211_chan_mode chanmode)
 {
        return cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
-                                            chan, chanmode);
+                                            chan, chanmode, 0);
 }
 void
diff --git a/net/wireless/mesh.c b/net/wireless/mesh.c
index f9d6ce5cfabb..55957a284f6c 100644
--- a/net/wireless/mesh.c
+++ b/net/wireless/mesh.c
@@ -44,6 +44,10 @@
 #define MESH_SYNC_NEIGHBOR_OFFSET_MAX 50
+#define MESH_DEFAULT_BEACON_INTERVAL    1000    /* in 1024 us units (=TUs) */
+#define MESH_DEFAULT_DTIM_PERIOD        2
+#define MESH_DEFAULT_AWAKE_WINDOW       10      /* in 1024 us units (=TUs) */
 const struct mesh_config default_mesh_config = {
        .dot11MeshRetryTimeout = MESH_RET_T,
        .dot11MeshConfirmTimeout = MESH_CONF_T,
@@ -69,6 +73,8 @@ const struct mesh_config default_mesh_config = {
        .dot11MeshHWMPactivePathToRootTimeout = MESH_PATH_TO_ROOT_TIMEOUT,
        .dot11MeshHWMProotInterval = MESH_ROOT_INTERVAL,
        .dot11MeshHWMPconfirmationInterval = MESH_ROOT_CONFIRMATION_INTERVAL,
+        .power_mode = NL80211_MESH_POWER_ACTIVE,
+        .dot11MeshAwakeWindowDuration = MESH_DEFAULT_AWAKE_WINDOW,
 };
 const struct mesh_setup default_mesh_setup = {
@@ -79,6 +85,8 @@ const struct mesh_setup default_mesh_setup = {
        .ie = NULL,
        .ie_len = 0,
        .is_secure = false,
+        .beacon_interval = MESH_DEFAULT_BEACON_INTERVAL,
+        .dtim_period = MESH_DEFAULT_DTIM_PERIOD,
 };
 int __cfg80211_join_mesh(struct cfg80211_registered_device *rdev,
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 5e8123ee63fd..461e692cdfec 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -987,65 +987,3 @@ void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
        nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
 }
 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
-void cfg80211_ch_switch_notify(struct net_device *dev,
-                               struct cfg80211_chan_def *chandef)
-{
-        struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct wiphy *wiphy = wdev->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-        trace_cfg80211_ch_switch_notify(dev, chandef);
-        wdev_lock(wdev);
-        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
-                    wdev->iftype != NL80211_IFTYPE_P2P_GO))
-                goto out;
-        wdev->channel = chandef->chan;
-        nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL);
-out:
-        wdev_unlock(wdev);
-        return;
-}
-EXPORT_SYMBOL(cfg80211_ch_switch_notify);
-bool cfg80211_rx_spurious_frame(struct net_device *dev,
-                                const u8 *addr, gfp_t gfp)
-{
-        struct wireless_dev *wdev = dev->ieee80211_ptr;
-        bool ret;
-        trace_cfg80211_rx_spurious_frame(dev, addr);
-        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
-                    wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
-                trace_cfg80211_return_bool(false);
-                return false;
-        }
-        ret = nl80211_unexpected_frame(dev, addr, gfp);
-        trace_cfg80211_return_bool(ret);
-        return ret;
-}
-EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
-bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
-                                        const u8 *addr, gfp_t gfp)
-{
-        struct wireless_dev *wdev = dev->ieee80211_ptr;
-        bool ret;
-        trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
-        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
-                    wdev->iftype != NL80211_IFTYPE_P2P_GO &&
-                    wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
-                trace_cfg80211_return_bool(false);
-                return false;
-        }
-        ret = nl80211_unexpected_4addr_frame(dev, addr, gfp);
-        trace_cfg80211_return_bool(ret);
-        return ret;
-}
-EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index f45706adaf34..33de80364c5c 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -856,6 +856,9 @@ static int nl80211_put_iface_combinations(struct wiphy *wiphy,
                    nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
                                c->max_interfaces))
                        goto nla_put_failure;
+                if (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
+                                c->radar_detect_widths))
+                        goto nla_put_failure;
                nla_nest_end(msg, nl_combi);
        }
@@ -2079,6 +2082,13 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
            !(rdev->wiphy.interface_modes & (1 << type)))
                return -EOPNOTSUPP;
+        if (type == NL80211_IFTYPE_P2P_DEVICE && info->attrs[NL80211_ATTR_MAC]) {
+                nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
+                           ETH_ALEN);
+                if (!is_valid_ether_addr(params.macaddr))
+                        return -EADDRNOTAVAIL;
+        }
        if (info->attrs[NL80211_ATTR_4ADDR]) {
                params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
                err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
@@ -3001,6 +3011,18 @@ static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
            nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
                        sinfo->beacon_loss_count))
                goto nla_put_failure;
+        if ((sinfo->filled & STATION_INFO_LOCAL_PM) &&
+            nla_put_u32(msg, NL80211_STA_INFO_LOCAL_PM,
+                        sinfo->local_pm))
+                goto nla_put_failure;
+        if ((sinfo->filled & STATION_INFO_PEER_PM) &&
+            nla_put_u32(msg, NL80211_STA_INFO_PEER_PM,
+                        sinfo->peer_pm))
+                goto nla_put_failure;
+        if ((sinfo->filled & STATION_INFO_NONPEER_PM) &&
+            nla_put_u32(msg, NL80211_STA_INFO_NONPEER_PM,
+                        sinfo->nonpeer_pm))
+                goto nla_put_failure;
        if (sinfo->filled & STATION_INFO_BSS_PARAM) {
                bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
                if (!bss_param)
@@ -3188,13 +3210,9 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
                        nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
        }
-        if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
+        if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL] ||
-                params.listen_interval =
+            info->attrs[NL80211_ATTR_HT_CAPABILITY])
-                    nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
+                return -EINVAL;
-        if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
-                params.ht_capa =
-                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
        if (!rdev->ops->change_station)
                return -EOPNOTSUPP;
@@ -3210,6 +3228,17 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
                params.plink_state =
                    nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
+        if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
+                enum nl80211_mesh_power_mode pm = nla_get_u32(
+                        info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
+                if (pm <= NL80211_MESH_POWER_UNKNOWN ||
+                    pm > NL80211_MESH_POWER_MAX)
+                        return -EINVAL;
+                params.local_pm = pm;
+        }
        switch (dev->ieee80211_ptr->iftype) {
        case NL80211_IFTYPE_AP:
        case NL80211_IFTYPE_AP_VLAN:
@@ -3217,6 +3246,8 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
                /* disallow mesh-specific things */
                if (params.plink_action)
                        return -EINVAL;
+                if (params.local_pm)
+                        return -EINVAL;
                /* TDLS can't be set, ... */
                if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
@@ -3231,11 +3262,25 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
                /* accept only the listed bits */
                if (params.sta_flags_mask &
                                ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
+                                  BIT(NL80211_STA_FLAG_AUTHENTICATED) |
+                                  BIT(NL80211_STA_FLAG_ASSOCIATED) |
                                  BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
                                  BIT(NL80211_STA_FLAG_WME) |
                                  BIT(NL80211_STA_FLAG_MFP)))
                        return -EINVAL;
+                /* but authenticated/associated only if driver handles it */
+                if (!(rdev->wiphy.features &
+                                NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
+                    params.sta_flags_mask &
+                                (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
+                                 BIT(NL80211_STA_FLAG_ASSOCIATED)))
+                        return -EINVAL;
+                /* reject other things that can't change */
+                if (params.supported_rates)
+                        return -EINVAL;
                /* must be last in here for error handling */
                params.vlan = get_vlan(info, rdev);
                if (IS_ERR(params.vlan))
@@ -3255,9 +3300,7 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
                /* disallow things sta doesn't support */
                if (params.plink_action)
                        return -EINVAL;
-                if (params.ht_capa)
+                if (params.local_pm)
-                        return -EINVAL;
-                if (params.listen_interval >= 0)
                        return -EINVAL;
                /* reject any changes other than AUTHORIZED */
                if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
@@ -3267,9 +3310,7 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
                /* disallow things mesh doesn't support */
                if (params.vlan)
                        return -EINVAL;
-                if (params.ht_capa)
+                if (params.supported_rates)
-                        return -EINVAL;
-                if (params.listen_interval >= 0)
                        return -EINVAL;
                /*
                 * No special handling for TDLS here -- the userspace
@@ -3393,17 +3434,31 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
                /* but don't bother the driver with it */
                params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
+                /* allow authenticated/associated only if driver handles it */
+                if (!(rdev->wiphy.features &
+                                NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
+                    params.sta_flags_mask &
+                                (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
+                                 BIT(NL80211_STA_FLAG_ASSOCIATED)))
+                        return -EINVAL;
                /* must be last in here for error handling */
                params.vlan = get_vlan(info, rdev);
                if (IS_ERR(params.vlan))
                        return PTR_ERR(params.vlan);
                break;
        case NL80211_IFTYPE_MESH_POINT:
+                /* associated is disallowed */
+                if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
+                        return -EINVAL;
                /* TDLS peers cannot be added */
                if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
                        return -EINVAL;
                break;
        case NL80211_IFTYPE_STATION:
+                /* associated is disallowed */
+                if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
+                        return -EINVAL;
                /* Only TDLS peers can be added */
                if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
                        return -EINVAL;
@@ -3787,12 +3842,8 @@ static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
         * window between nl80211_init() and regulatory_init(), if that is
         * even possible.
         */
-        mutex_lock(&cfg80211_mutex);
+        if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
-        if (unlikely(!cfg80211_regdomain)) {
-                mutex_unlock(&cfg80211_mutex);
                return -EINPROGRESS;
-        }
-        mutex_unlock(&cfg80211_mutex);
        if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
                return -EINVAL;
@@ -3908,7 +3959,11 @@ static int nl80211_get_mesh_config(struct sk_buff *skb,
            nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
                        cur_params.dot11MeshHWMProotInterval) ||
            nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
-                        cur_params.dot11MeshHWMPconfirmationInterval))
+                        cur_params.dot11MeshHWMPconfirmationInterval) ||
+            nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
+                        cur_params.power_mode) ||
+            nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
+                        cur_params.dot11MeshAwakeWindowDuration))
                goto nla_put_failure;
        nla_nest_end(msg, pinfoattr);
        genlmsg_end(msg, hdr);
@@ -3947,6 +4002,8 @@ static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_A
        [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
        [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
        [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
+        [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
+        [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
 };
 static const struct nla_policy
@@ -3967,13 +4024,15 @@ static int nl80211_parse_mesh_config(struct genl_info *info,
        struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
        u32 mask = 0;
-#define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
+#define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
-do {\
+do {                                                                        \
-        if (table[attr_num]) {\
+        if (tb[attr]) {                                                     \
-                cfg->param = nla_fn(table[attr_num]); \
+                if (fn(tb[attr]) < min || fn(tb[attr]) > max)               \
-                mask |= (1 << (attr_num - 1)); \
+                        return -EINVAL;                                     \
-        } \
+                cfg->param = fn(tb[attr]);                                  \
-} while (0);\
+                mask |= (1 << (attr - 1));                                  \
+        }                                                                   \
+} while (0)
        if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
@@ -3988,83 +4047,98 @@ do {\
        BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
        /* Fill in the params struct */
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
                                  mask, NL80211_MESHCONF_RETRY_TIMEOUT,
                                  nla_get_u16);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
                                  mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
                                  nla_get_u16);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
                                  mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
                                  nla_get_u16);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
                                  mask, NL80211_MESHCONF_MAX_PEER_LINKS,
                                  nla_get_u16);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
                                  mask, NL80211_MESHCONF_MAX_RETRIES,
                                  nla_get_u8);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
                                  mask, NL80211_MESHCONF_TTL, nla_get_u8);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
                                  mask, NL80211_MESHCONF_ELEMENT_TTL,
                                  nla_get_u8);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
                                  mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
                                  nla_get_u8);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor, mask,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
+                                  1, 255, mask,
                                  NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
                                  nla_get_u32);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
                                  mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
                                  nla_get_u8);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
                                  mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
                                  nla_get_u32);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
                                  mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
                                  nla_get_u16);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout, mask,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
+                                  1, 65535, mask,
                                  NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
                                  nla_get_u32);
        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
-                                  mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
+                                  1, 65535, mask,
+                                  NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
                                  nla_get_u16);
        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
-                                  mask, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
+                                  1, 65535, mask,
+                                  NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
                                  nla_get_u16);
        FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
-                                  dot11MeshHWMPnetDiameterTraversalTime, mask,
+                                  dot11MeshHWMPnetDiameterTraversalTime,
+                                  1, 65535, mask,
                                  NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
                                  nla_get_u16);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
-                                  NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8);
+                                  mask, NL80211_MESHCONF_HWMP_ROOTMODE,
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask,
+                                  nla_get_u8);
-                                  NL80211_MESHCONF_HWMP_RANN_INTERVAL,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
+                                  mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
                                  nla_get_u16);
        FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
-                                  dot11MeshGateAnnouncementProtocol, mask,
+                                  dot11MeshGateAnnouncementProtocol, 0, 1,
-                                  NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
+                                  mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
                                  nla_get_u8);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
                                  mask, NL80211_MESHCONF_FORWARDING,
                                  nla_get_u8);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, 1, 255,
                                  mask, NL80211_MESHCONF_RSSI_THRESHOLD,
                                  nla_get_u32);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
                                  mask, NL80211_MESHCONF_HT_OPMODE,
                                  nla_get_u16);
        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
-                                  mask,
+                                  1, 65535, mask,
                                  NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
                                  nla_get_u32);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
                                  mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
                                  nla_get_u16);
        FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
-                                  dot11MeshHWMPconfirmationInterval, mask,
+                                  dot11MeshHWMPconfirmationInterval,
+                                  1, 65535, mask,
                                  NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
                                  nla_get_u16);
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
+                                  NL80211_MESH_POWER_ACTIVE,
+                                  NL80211_MESH_POWER_MAX,
+                                  mask, NL80211_MESHCONF_POWER_MODE,
+                                  nla_get_u32);
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
+                                  0, 65535, mask,
+                                  NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
        if (mask_out)
                *mask_out = mask;
@@ -4152,6 +4226,7 @@ static int nl80211_update_mesh_config(struct sk_buff *skb,
 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
 {
+        const struct ieee80211_regdomain *regdom;
        struct sk_buff *msg;
        void *hdr = NULL;
        struct nlattr *nl_reg_rules;
@@ -4174,35 +4249,36 @@ static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
        if (!hdr)
                goto put_failure;
-        if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
-                           cfg80211_regdomain->alpha2) ||
-            (cfg80211_regdomain->dfs_region &&
-             nla_put_u8(msg, NL80211_ATTR_DFS_REGION,
-                        cfg80211_regdomain->dfs_region)))
-                goto nla_put_failure;
        if (reg_last_request_cell_base() &&
            nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
                        NL80211_USER_REG_HINT_CELL_BASE))
                goto nla_put_failure;
+        rcu_read_lock();
+        regdom = rcu_dereference(cfg80211_regdomain);
+        if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
+            (regdom->dfs_region &&
+             nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
+                goto nla_put_failure_rcu;
        nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
        if (!nl_reg_rules)
-                goto nla_put_failure;
+                goto nla_put_failure_rcu;
-        for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
+        for (i = 0; i < regdom->n_reg_rules; i++) {
                struct nlattr *nl_reg_rule;
                const struct ieee80211_reg_rule *reg_rule;
                const struct ieee80211_freq_range *freq_range;
                const struct ieee80211_power_rule *power_rule;
-                reg_rule = &cfg80211_regdomain->reg_rules[i];
+                reg_rule = &regdom->reg_rules[i];
                freq_range = &reg_rule->freq_range;
                power_rule = &reg_rule->power_rule;
                nl_reg_rule = nla_nest_start(msg, i);
                if (!nl_reg_rule)
-                        goto nla_put_failure;
+                        goto nla_put_failure_rcu;
                if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
                                reg_rule->flags) ||
@@ -4216,10 +4292,11 @@ static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
                                power_rule->max_antenna_gain) ||
                    nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
                                power_rule->max_eirp))
-                        goto nla_put_failure;
+                        goto nla_put_failure_rcu;
                nla_nest_end(msg, nl_reg_rule);
        }
+        rcu_read_unlock();
        nla_nest_end(msg, nl_reg_rules);
@@ -4227,6 +4304,8 @@ static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
        err = genlmsg_reply(msg, info);
        goto out;
+nla_put_failure_rcu:
+        rcu_read_unlock();
 nla_put_failure:
        genlmsg_cancel(msg, hdr);
 put_failure:
@@ -4259,27 +4338,18 @@ static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
                dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
        nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
-                        rem_reg_rules) {
+                            rem_reg_rules) {
                num_rules++;
                if (num_rules > NL80211_MAX_SUPP_REG_RULES)
                        return -EINVAL;
        }
-        mutex_lock(&cfg80211_mutex);
-        if (!reg_is_valid_request(alpha2)) {
-                r = -EINVAL;
-                goto bad_reg;
-        }
        size_of_regd = sizeof(struct ieee80211_regdomain) +
-                (num_rules * sizeof(struct ieee80211_reg_rule));
+                       num_rules * sizeof(struct ieee80211_reg_rule);
        rd = kzalloc(size_of_regd, GFP_KERNEL);
-        if (!rd) {
+        if (!rd)
-                r = -ENOMEM;
+                return -ENOMEM;
-                goto bad_reg;
-        }
        rd->n_reg_rules = num_rules;
        rd->alpha2[0] = alpha2[0];
@@ -4293,10 +4363,10 @@ static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
                rd->dfs_region = dfs_region;
        nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
-                        rem_reg_rules) {
+                            rem_reg_rules) {
                nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
-                        nla_data(nl_reg_rule), nla_len(nl_reg_rule),
+                          nla_data(nl_reg_rule), nla_len(nl_reg_rule),
-                        reg_rule_policy);
+                          reg_rule_policy);
                r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
                if (r)
                        goto bad_reg;
@@ -4309,16 +4379,14 @@ static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
                }
        }
-        BUG_ON(rule_idx != num_rules);
+        mutex_lock(&cfg80211_mutex);
        r = set_regdom(rd);
+        /* set_regdom took ownership */
+        rd = NULL;
        mutex_unlock(&cfg80211_mutex);
-        return r;
 bad_reg:
-        mutex_unlock(&cfg80211_mutex);
        kfree(rd);
        return r;
 }
@@ -5867,6 +5935,15 @@ static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
                connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
        }
+        if (info->attrs[NL80211_ATTR_USE_MFP]) {
+                connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
+                if (connect.mfp != NL80211_MFP_REQUIRED &&
+                    connect.mfp != NL80211_MFP_NO)
+                        return -EINVAL;
+        } else {
+                connect.mfp = NL80211_MFP_NO;
+        }
        if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
                connect.channel =
                        ieee80211_get_channel(wiphy,
@@ -6652,6 +6729,21 @@ static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
                            nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
                        return -EINVAL;
+        if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
+                setup.beacon_interval =
+                        nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
+                if (setup.beacon_interval < 10 ||
+                    setup.beacon_interval > 10000)
+                        return -EINVAL;
+        }
+        if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
+                setup.dtim_period =
+                        nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
+                if (setup.dtim_period < 1 || setup.dtim_period > 100)
+                        return -EINVAL;
+        }
        if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
                /* parse additional setup parameters if given */
                err = nl80211_parse_mesh_setup(info, &setup);
@@ -8051,7 +8143,7 @@ void nl80211_send_reg_change_event(struct regulatory_request *request)
                        goto nla_put_failure;
        }
-        if (wiphy_idx_valid(request->wiphy_idx) &&
+        if (request->wiphy_idx != WIPHY_IDX_INVALID &&
            nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
                goto nla_put_failure;
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 82c4fc7c994c..de02d633c212 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -48,7 +48,6 @@
 #include <linux/export.h>
 #include <linux/slab.h>
 #include <linux/list.h>
-#include <linux/random.h>
 #include <linux/ctype.h>
 #include <linux/nl80211.h>
 #include <linux/platform_device.h>
@@ -66,6 +65,13 @@
 #define REG_DBG_PRINT(args...)
 #endif
+enum reg_request_treatment {
+        REG_REQ_OK,
+        REG_REQ_IGNORE,
+        REG_REQ_INTERSECT,
+        REG_REQ_ALREADY_SET,
+};
 static struct regulatory_request core_request_world = {
        .initiator = NL80211_REGDOM_SET_BY_CORE,
        .alpha2[0] = '0',
@@ -76,7 +82,8 @@ static struct regulatory_request core_request_world = {
 };
 /* Receipt of information from last regulatory request */
-static struct regulatory_request *last_request = &core_request_world;
+static struct regulatory_request __rcu *last_request =
+        (void __rcu *)&core_request_world;
 /* To trigger userspace events */
 static struct platform_device *reg_pdev;
@@ -88,16 +95,16 @@ static struct device_type reg_device_type = {
 /*
 * Central wireless core regulatory domains, we only need two,
 * the current one and a world regulatory domain in case we have no
- * information to give us an alpha2
+ * information to give us an alpha2.
 */
-const struct ieee80211_regdomain *cfg80211_regdomain;
+const struct ieee80211_regdomain __rcu *cfg80211_regdomain;
 /*
 * Protects static reg.c components:
- *     - cfg80211_world_regdom
+ *      - cfg80211_regdomain (if not used with RCU)
- *     - cfg80211_regdom
+ *      - cfg80211_world_regdom
- *     - last_request
+ *      - last_request (if not used with RCU)
- *     - reg_num_devs_support_basehint
+ *      - reg_num_devs_support_basehint
 */
 static DEFINE_MUTEX(reg_mutex);
@@ -112,6 +119,31 @@ static inline void assert_reg_lock(void)
        lockdep_assert_held(&reg_mutex);
 }
+static const struct ieee80211_regdomain *get_cfg80211_regdom(void)
+{
+        return rcu_dereference_protected(cfg80211_regdomain,
+                                         lockdep_is_held(&reg_mutex));
+}
+static const struct ieee80211_regdomain *get_wiphy_regdom(struct wiphy *wiphy)
+{
+        return rcu_dereference_protected(wiphy->regd,
+                                         lockdep_is_held(&reg_mutex));
+}
+static void rcu_free_regdom(const struct ieee80211_regdomain *r)
+{
+        if (!r)
+                return;
+        kfree_rcu((struct ieee80211_regdomain *)r, rcu_head);
+}
+static struct regulatory_request *get_last_request(void)
+{
+        return rcu_dereference_check(last_request,
+                                     lockdep_is_held(&reg_mutex));
+}
 /* Used to queue up regulatory hints */
 static LIST_HEAD(reg_requests_list);
 static spinlock_t reg_requests_lock;
@@ -177,28 +209,37 @@ static char user_alpha2[2];
 module_param(ieee80211_regdom, charp, 0444);
 MODULE_PARM_DESC(ieee80211_regdom, "IEEE 802.11 regulatory domain code");
-static void reset_regdomains(bool full_reset)
+static void reset_regdomains(bool full_reset,
+                             const struct ieee80211_regdomain *new_regdom)
 {
+        const struct ieee80211_regdomain *r;
+        struct regulatory_request *lr;
+        assert_reg_lock();
+        r = get_cfg80211_regdom();
        /* avoid freeing static information or freeing something twice */
-        if (cfg80211_regdomain == cfg80211_world_regdom)
+        if (r == cfg80211_world_regdom)
-                cfg80211_regdomain = NULL;
+                r = NULL;
        if (cfg80211_world_regdom == &world_regdom)
                cfg80211_world_regdom = NULL;
-        if (cfg80211_regdomain == &world_regdom)
+        if (r == &world_regdom)
-                cfg80211_regdomain = NULL;
+                r = NULL;
-        kfree(cfg80211_regdomain);
+        rcu_free_regdom(r);
-        kfree(cfg80211_world_regdom);
+        rcu_free_regdom(cfg80211_world_regdom);
        cfg80211_world_regdom = &world_regdom;
-        cfg80211_regdomain = NULL;
+        rcu_assign_pointer(cfg80211_regdomain, new_regdom);
        if (!full_reset)
                return;
-        if (last_request != &core_request_world)
+        lr = get_last_request();
-                kfree(last_request);
+        if (lr != &core_request_world && lr)
-        last_request = &core_request_world;
+                kfree_rcu(lr, rcu_head);
+        rcu_assign_pointer(last_request, &core_request_world);
 }
 /*
@@ -207,30 +248,29 @@ static void reset_regdomains(bool full_reset)
 */
 static void update_world_regdomain(const struct ieee80211_regdomain *rd)
 {
-        BUG_ON(!last_request);
+        struct regulatory_request *lr;
+        lr = get_last_request();
+        WARN_ON(!lr);
-        reset_regdomains(false);
+        reset_regdomains(false, rd);
        cfg80211_world_regdom = rd;
-        cfg80211_regdomain = rd;
 }
 bool is_world_regdom(const char *alpha2)
 {
        if (!alpha2)
                return false;
-        if (alpha2[0] == '0' && alpha2[1] == '0')
+        return alpha2[0] == '0' && alpha2[1] == '0';
-                return true;
-        return false;
 }
 static bool is_alpha2_set(const char *alpha2)
 {
        if (!alpha2)
                return false;
-        if (alpha2[0] != 0 && alpha2[1] != 0)
+        return alpha2[0] && alpha2[1];
-                return true;
-        return false;
 }
 static bool is_unknown_alpha2(const char *alpha2)
@@ -241,9 +281,7 @@ static bool is_unknown_alpha2(const char *alpha2)
         * Special case where regulatory domain was built by driver
         * but a specific alpha2 cannot be determined
         */
-        if (alpha2[0] == '9' && alpha2[1] == '9')
+        return alpha2[0] == '9' && alpha2[1] == '9';
-                return true;
-        return false;
 }
 static bool is_intersected_alpha2(const char *alpha2)
@@ -255,39 +293,30 @@ static bool is_intersected_alpha2(const char *alpha2)
         * result of an intersection between two regulatory domain
         * structures
         */
-        if (alpha2[0] == '9' && alpha2[1] == '8')
+        return alpha2[0] == '9' && alpha2[1] == '8';
-                return true;
-        return false;
 }
 static bool is_an_alpha2(const char *alpha2)
 {
        if (!alpha2)
                return false;
-        if (isalpha(alpha2[0]) && isalpha(alpha2[1]))
+        return isalpha(alpha2[0]) && isalpha(alpha2[1]);
-                return true;
-        return false;
 }
 static bool alpha2_equal(const char *alpha2_x, const char *alpha2_y)
 {
        if (!alpha2_x || !alpha2_y)
                return false;
-        if (alpha2_x[0] == alpha2_y[0] &&
+        return alpha2_x[0] == alpha2_y[0] && alpha2_x[1] == alpha2_y[1];
-                alpha2_x[1] == alpha2_y[1])
-                return true;
-        return false;
 }
 static bool regdom_changes(const char *alpha2)
 {
-        assert_cfg80211_lock();
+        const struct ieee80211_regdomain *r = get_cfg80211_regdom();
-        if (!cfg80211_regdomain)
+        if (!r)
                return true;
-        if (alpha2_equal(cfg80211_regdomain->alpha2, alpha2))
+        return !alpha2_equal(r->alpha2, alpha2);
-                return false;
-        return true;
 }
 /*
@@ -301,38 +330,36 @@ static bool is_user_regdom_saved(void)
                return false;
        /* This would indicate a mistake on the design */
-        if (WARN((!is_world_regdom(user_alpha2) &&
+        if (WARN(!is_world_regdom(user_alpha2) && !is_an_alpha2(user_alpha2),
-                  !is_an_alpha2(user_alpha2)),
                 "Unexpected user alpha2: %c%c\n",
-                 user_alpha2[0],
+                 user_alpha2[0], user_alpha2[1]))
-                 user_alpha2[1]))
                return false;
        return true;
 }
-static int reg_copy_regd(const struct ieee80211_regdomain **dst_regd,
+static const struct ieee80211_regdomain *
-                         const struct ieee80211_regdomain *src_regd)
+reg_copy_regd(const struct ieee80211_regdomain *src_regd)
 {
        struct ieee80211_regdomain *regd;
-        int size_of_regd = 0;
+        int size_of_regd;
        unsigned int i;
-        size_of_regd = sizeof(struct ieee80211_regdomain) +
+        size_of_regd =
-          ((src_regd->n_reg_rules + 1) * sizeof(struct ieee80211_reg_rule));
+                sizeof(struct ieee80211_regdomain) +
+                src_regd->n_reg_rules * sizeof(struct ieee80211_reg_rule);
        regd = kzalloc(size_of_regd, GFP_KERNEL);
        if (!regd)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
        memcpy(regd, src_regd, sizeof(struct ieee80211_regdomain));
        for (i = 0; i < src_regd->n_reg_rules; i++)
                memcpy(&regd->reg_rules[i], &src_regd->reg_rules[i],
-                        sizeof(struct ieee80211_reg_rule));
+                       sizeof(struct ieee80211_reg_rule));
-        *dst_regd = regd;
+        return regd;
-        return 0;
 }
 #ifdef CONFIG_CFG80211_INTERNAL_REGDB
@@ -347,9 +374,8 @@ static DEFINE_MUTEX(reg_regdb_search_mutex);
 static void reg_regdb_search(struct work_struct *work)
 {
        struct reg_regdb_search_request *request;
-        const struct ieee80211_regdomain *curdom, *regdom;
+        const struct ieee80211_regdomain *curdom, *regdom = NULL;
-        int i, r;
+        int i;
-        bool set_reg = false;
        mutex_lock(&cfg80211_mutex);
@@ -360,14 +386,11 @@ static void reg_regdb_search(struct work_struct *work)
                                           list);
                list_del(&request->list);
-                for (i=0; i<reg_regdb_size; i++) {
+                for (i = 0; i < reg_regdb_size; i++) {
                        curdom = reg_regdb[i];
-                        if (!memcmp(request->alpha2, curdom->alpha2, 2)) {
+                        if (alpha2_equal(request->alpha2, curdom->alpha2)) {
-                                r = reg_copy_regd(&regdom, curdom);
+                                regdom = reg_copy_regd(curdom);
-                                if (r)
-                                        break;
-                                set_reg = true;
                                break;
                        }
                }
@@ -376,7 +399,7 @@ static void reg_regdb_search(struct work_struct *work)
        }
        mutex_unlock(&reg_regdb_search_mutex);
-        if (set_reg)
+        if (!IS_ERR_OR_NULL(regdom))
                set_regdom(regdom);
        mutex_unlock(&cfg80211_mutex);
@@ -434,15 +457,14 @@ static int call_crda(const char *alpha2)
        return kobject_uevent(&reg_pdev->dev.kobj, KOBJ_CHANGE);
 }
-/* Used by nl80211 before kmalloc'ing our regulatory domain */
+static bool reg_is_valid_request(const char *alpha2)
-bool reg_is_valid_request(const char *alpha2)
 {
-        assert_cfg80211_lock();
+        struct regulatory_request *lr = get_last_request();
-        if (!last_request)
+        if (!lr || lr->processed)
                return false;
-        return alpha2_equal(last_request->alpha2, alpha2);
+        return alpha2_equal(lr->alpha2, alpha2);
 }
 /* Sanity check on a regulatory rule */
@@ -460,7 +482,7 @@ static bool is_valid_reg_rule(const struct ieee80211_reg_rule *rule)
        freq_diff = freq_range->end_freq_khz - freq_range->start_freq_khz;
        if (freq_range->end_freq_khz <= freq_range->start_freq_khz ||
-                        freq_range->max_bandwidth_khz > freq_diff)
+            freq_range->max_bandwidth_khz > freq_diff)
                return false;
        return true;
@@ -487,8 +509,7 @@ static bool is_valid_rd(const struct ieee80211_regdomain *rd)
 }
 static bool reg_does_bw_fit(const struct ieee80211_freq_range *freq_range,
-                            u32 center_freq_khz,
+                            u32 center_freq_khz, u32 bw_khz)
-                            u32 bw_khz)
 {
        u32 start_freq_khz, end_freq_khz;
@@ -518,7 +539,7 @@ static bool reg_does_bw_fit(const struct ieee80211_freq_range *freq_range,
 * regulatory rule support for other "bands".
 **/
 static bool freq_in_rule_band(const struct ieee80211_freq_range *freq_range,
-        u32 freq_khz)
+                              u32 freq_khz)
 {
 #define ONE_GHZ_IN_KHZ  1000000
        /*
@@ -540,10 +561,9 @@ static bool freq_in_rule_band(const struct ieee80211_freq_range *freq_range,
 * Helper for regdom_intersect(), this does the real
 * mathematical intersection fun
 */
-static int reg_rules_intersect(
+static int reg_rules_intersect(const struct ieee80211_reg_rule *rule1,
-        const struct ieee80211_reg_rule *rule1,
+                               const struct ieee80211_reg_rule *rule2,
-        const struct ieee80211_reg_rule *rule2,
+                               struct ieee80211_reg_rule *intersected_rule)
-        struct ieee80211_reg_rule *intersected_rule)
 {
        const struct ieee80211_freq_range *freq_range1, *freq_range2;
        struct ieee80211_freq_range *freq_range;
@@ -560,11 +580,11 @@ static int reg_rules_intersect(
        power_rule = &intersected_rule->power_rule;
        freq_range->start_freq_khz = max(freq_range1->start_freq_khz,
-                freq_range2->start_freq_khz);
+                                         freq_range2->start_freq_khz);
        freq_range->end_freq_khz = min(freq_range1->end_freq_khz,
-                freq_range2->end_freq_khz);
+                                       freq_range2->end_freq_khz);
        freq_range->max_bandwidth_khz = min(freq_range1->max_bandwidth_khz,
-                freq_range2->max_bandwidth_khz);
+                                            freq_range2->max_bandwidth_khz);
        freq_diff = freq_range->end_freq_khz - freq_range->start_freq_khz;
        if (freq_range->max_bandwidth_khz > freq_diff)
@@ -575,7 +595,7 @@ static int reg_rules_intersect(
        power_rule->max_antenna_gain = min(power_rule1->max_antenna_gain,
                power_rule2->max_antenna_gain);
-        intersected_rule->flags = (rule1->flags | rule2->flags);
+        intersected_rule->flags = rule1->flags | rule2->flags;
        if (!is_valid_reg_rule(intersected_rule))
                return -EINVAL;
@@ -596,9 +616,9 @@ static int reg_rules_intersect(
 * resulting intersection of rules between rd1 and rd2. We will
 * kzalloc() this structure for you.
 */
-static struct ieee80211_regdomain *regdom_intersect(
+static struct ieee80211_regdomain *
-        const struct ieee80211_regdomain *rd1,
+regdom_intersect(const struct ieee80211_regdomain *rd1,
-        const struct ieee80211_regdomain *rd2)
+                 const struct ieee80211_regdomain *rd2)
 {
        int r, size_of_regd;
        unsigned int x, y;
@@ -607,12 +627,7 @@ static struct ieee80211_regdomain *regdom_intersect(
        struct ieee80211_reg_rule *intersected_rule;
        struct ieee80211_regdomain *rd;
        /* This is just a dummy holder to help us count */
-        struct ieee80211_reg_rule irule;
+        struct ieee80211_reg_rule dummy_rule;
-        /* Uses the stack temporarily for counter arithmetic */
-        intersected_rule = &irule;
-        memset(intersected_rule, 0, sizeof(struct ieee80211_reg_rule));
        if (!rd1 || !rd2)
                return NULL;
@@ -629,11 +644,8 @@ static struct ieee80211_regdomain *regdom_intersect(
                rule1 = &rd1->reg_rules[x];
                for (y = 0; y < rd2->n_reg_rules; y++) {
                        rule2 = &rd2->reg_rules[y];
-                        if (!reg_rules_intersect(rule1, rule2,
+                        if (!reg_rules_intersect(rule1, rule2, &dummy_rule))
-                                        intersected_rule))
                                num_rules++;
-                        memset(intersected_rule, 0,
-                                        sizeof(struct ieee80211_reg_rule));
                }
        }
@@ -641,15 +653,15 @@ static struct ieee80211_regdomain *regdom_intersect(
                return NULL;
        size_of_regd = sizeof(struct ieee80211_regdomain) +
-                ((num_rules + 1) * sizeof(struct ieee80211_reg_rule));
+                       num_rules * sizeof(struct ieee80211_reg_rule);
        rd = kzalloc(size_of_regd, GFP_KERNEL);
        if (!rd)
                return NULL;
-        for (x = 0; x < rd1->n_reg_rules; x++) {
+        for (x = 0; x < rd1->n_reg_rules && rule_idx < num_rules; x++) {
                rule1 = &rd1->reg_rules[x];
-                for (y = 0; y < rd2->n_reg_rules; y++) {
+                for (y = 0; y < rd2->n_reg_rules && rule_idx < num_rules; y++) {
                        rule2 = &rd2->reg_rules[y];
                        /*
                         * This time around instead of using the stack lets
@@ -657,8 +669,7 @@ static struct ieee80211_regdomain *regdom_intersect(
                         * a memcpy()
                         */
                        intersected_rule = &rd->reg_rules[rule_idx];
-                        r = reg_rules_intersect(rule1, rule2,
+                        r = reg_rules_intersect(rule1, rule2, intersected_rule);
-                                intersected_rule);
                        /*
                         * No need to memset here the intersected rule here as
                         * we're not using the stack anymore
@@ -699,34 +710,16 @@ static u32 map_regdom_flags(u32 rd_flags)
        return channel_flags;
 }
-static int freq_reg_info_regd(struct wiphy *wiphy,
+static const struct ieee80211_reg_rule *
-                              u32 center_freq,
+freq_reg_info_regd(struct wiphy *wiphy, u32 center_freq,
-                              u32 desired_bw_khz,
+                   const struct ieee80211_regdomain *regd)
-                              const struct ieee80211_reg_rule **reg_rule,
-                              const struct ieee80211_regdomain *custom_regd)
 {
        int i;
        bool band_rule_found = false;
-        const struct ieee80211_regdomain *regd;
        bool bw_fits = false;
-        if (!desired_bw_khz)
-                desired_bw_khz = MHZ_TO_KHZ(20);
-        regd = custom_regd ? custom_regd : cfg80211_regdomain;
-        /*
-         * Follow the driver's regulatory domain, if present, unless a country
-         * IE has been processed or a user wants to help complaince further
-         */
-        if (!custom_regd &&
-            last_request->initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE &&
-            last_request->initiator != NL80211_REGDOM_SET_BY_USER &&
-            wiphy->regd)
-                regd = wiphy->regd;
        if (!regd)
-                return -EINVAL;
+                return ERR_PTR(-EINVAL);
        for (i = 0; i < regd->n_reg_rules; i++) {
                const struct ieee80211_reg_rule *rr;
@@ -743,33 +736,36 @@ static int freq_reg_info_regd(struct wiphy *wiphy,
                if (!band_rule_found)
                        band_rule_found = freq_in_rule_band(fr, center_freq);
-                bw_fits = reg_does_bw_fit(fr,
+                bw_fits = reg_does_bw_fit(fr, center_freq, MHZ_TO_KHZ(20));
-                                          center_freq,
-                                          desired_bw_khz);
-                if (band_rule_found && bw_fits) {
+                if (band_rule_found && bw_fits)
-                        *reg_rule = rr;
+                        return rr;
-                        return 0;
-                }
        }
        if (!band_rule_found)
-                return -ERANGE;
+                return ERR_PTR(-ERANGE);
-        return -EINVAL;
+        return ERR_PTR(-EINVAL);
 }
-int freq_reg_info(struct wiphy *wiphy,
+const struct ieee80211_reg_rule *freq_reg_info(struct wiphy *wiphy,
-                  u32 center_freq,
+                                               u32 center_freq)
-                  u32 desired_bw_khz,
-                  const struct ieee80211_reg_rule **reg_rule)
 {
-        assert_cfg80211_lock();
+        const struct ieee80211_regdomain *regd;
-        return freq_reg_info_regd(wiphy,
+        struct regulatory_request *lr = get_last_request();
-                                  center_freq,
-                                  desired_bw_khz,
+        /*
-                                  reg_rule,
+         * Follow the driver's regulatory domain, if present, unless a country
-                                  NULL);
+         * IE has been processed or a user wants to help complaince further
+         */
+        if (lr->initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE &&
+            lr->initiator != NL80211_REGDOM_SET_BY_USER &&
+            wiphy->regd)
+                regd = get_wiphy_regdom(wiphy);
+        else
+                regd = get_cfg80211_regdom();
+        return freq_reg_info_regd(wiphy, center_freq, regd);
 }
 EXPORT_SYMBOL(freq_reg_info);
@@ -792,7 +788,6 @@ static const char *reg_initiator_name(enum nl80211_reg_initiator initiator)
 }
 static void chan_reg_rule_print_dbg(struct ieee80211_channel *chan,
-                                    u32 desired_bw_khz,
                                    const struct ieee80211_reg_rule *reg_rule)
 {
        const struct ieee80211_power_rule *power_rule;
@@ -807,21 +802,16 @@ static void chan_reg_rule_print_dbg(struct ieee80211_channel *chan,
        else
                snprintf(max_antenna_gain, 32, "%d", power_rule->max_antenna_gain);
-        REG_DBG_PRINT("Updating information on frequency %d MHz "
+        REG_DBG_PRINT("Updating information on frequency %d MHz with regulatory rule:\n",
-                      "for a %d MHz width channel with regulatory rule:\n",
+                      chan->center_freq);
-                      chan->center_freq,
-                      KHZ_TO_MHZ(desired_bw_khz));
        REG_DBG_PRINT("%d KHz - %d KHz @ %d KHz), (%s mBi, %d mBm)\n",
-                      freq_range->start_freq_khz,
+                      freq_range->start_freq_khz, freq_range->end_freq_khz,
-                      freq_range->end_freq_khz,
+                      freq_range->max_bandwidth_khz, max_antenna_gain,
-                      freq_range->max_bandwidth_khz,
-                      max_antenna_gain,
                      power_rule->max_eirp);
 }
 #else
 static void chan_reg_rule_print_dbg(struct ieee80211_channel *chan,
-                                    u32 desired_bw_khz,
                                    const struct ieee80211_reg_rule *reg_rule)
 {
        return;
@@ -831,43 +821,25 @@ static void chan_reg_rule_print_dbg(struct ieee80211_channel *chan,
 /*
 * Note that right now we assume the desired channel bandwidth
 * is always 20 MHz for each individual channel (HT40 uses 20 MHz
- * per channel, the primary and the extension channel). To support
+ * per channel, the primary and the extension channel).
- * smaller custom bandwidths such as 5 MHz or 10 MHz we'll need a
- * new ieee80211_channel.target_bw and re run the regulatory check
- * on the wiphy with the target_bw specified. Then we can simply use
- * that below for the desired_bw_khz below.
 */
 static void handle_channel(struct wiphy *wiphy,
                           enum nl80211_reg_initiator initiator,
-                           enum ieee80211_band band,
+                           struct ieee80211_channel *chan)
-                           unsigned int chan_idx)
 {
-        int r;
        u32 flags, bw_flags = 0;
-        u32 desired_bw_khz = MHZ_TO_KHZ(20);
        const struct ieee80211_reg_rule *reg_rule = NULL;
        const struct ieee80211_power_rule *power_rule = NULL;
        const struct ieee80211_freq_range *freq_range = NULL;
-        struct ieee80211_supported_band *sband;
-        struct ieee80211_channel *chan;
        struct wiphy *request_wiphy = NULL;
+        struct regulatory_request *lr = get_last_request();
-        assert_cfg80211_lock();
+        request_wiphy = wiphy_idx_to_wiphy(lr->wiphy_idx);
-        request_wiphy = wiphy_idx_to_wiphy(last_request->wiphy_idx);
-        sband = wiphy->bands[band];
-        BUG_ON(chan_idx >= sband->n_channels);
-        chan = &sband->channels[chan_idx];
        flags = chan->orig_flags;
-        r = freq_reg_info(wiphy,
+        reg_rule = freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq));
-                          MHZ_TO_KHZ(chan->center_freq),
+        if (IS_ERR(reg_rule)) {
-                          desired_bw_khz,
-                          &reg_rule);
-        if (r) {
                /*
                 * We will disable all channels that do not match our
                 * received regulatory rule unless the hint is coming
@@ -879,7 +851,7 @@ static void handle_channel(struct wiphy *wiphy,
                 * while 5 GHz is still supported.
                 */
                if (initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE &&
-                    r == -ERANGE)
+                    PTR_ERR(reg_rule) == -ERANGE)
                        return;
                REG_DBG_PRINT("Disabling freq %d MHz\n", chan->center_freq);
@@ -887,7 +859,7 @@ static void handle_channel(struct wiphy *wiphy,
                return;
        }
-        chan_reg_rule_print_dbg(chan, desired_bw_khz, reg_rule);
+        chan_reg_rule_print_dbg(chan, reg_rule);
        power_rule = &reg_rule->power_rule;
        freq_range = &reg_rule->freq_range;
@@ -895,7 +867,7 @@ static void handle_channel(struct wiphy *wiphy,
        if (freq_range->max_bandwidth_khz < MHZ_TO_KHZ(40))
                bw_flags = IEEE80211_CHAN_NO_HT40;
-        if (last_request->initiator == NL80211_REGDOM_SET_BY_DRIVER &&
+        if (lr->initiator == NL80211_REGDOM_SET_BY_DRIVER &&
            request_wiphy && request_wiphy == wiphy &&
            request_wiphy->flags & WIPHY_FLAG_STRICT_REGULATORY) {
                /*
@@ -914,8 +886,9 @@ static void handle_channel(struct wiphy *wiphy,
        chan->beacon_found = false;
        chan->flags = flags | bw_flags | map_regdom_flags(reg_rule->flags);
-        chan->max_antenna_gain = min(chan->orig_mag,
+        chan->max_antenna_gain =
-                (int) MBI_TO_DBI(power_rule->max_antenna_gain));
+                min_t(int, chan->orig_mag,
+                      MBI_TO_DBI(power_rule->max_antenna_gain));
        chan->max_reg_power = (int) MBM_TO_DBM(power_rule->max_eirp);
        if (chan->orig_mpwr) {
                /*
@@ -935,68 +908,65 @@ static void handle_channel(struct wiphy *wiphy,
 }
 static void handle_band(struct wiphy *wiphy,
-                        enum ieee80211_band band,
+                        enum nl80211_reg_initiator initiator,
-                        enum nl80211_reg_initiator initiator)
+                        struct ieee80211_supported_band *sband)
 {
        unsigned int i;
-        struct ieee80211_supported_band *sband;
-        BUG_ON(!wiphy->bands[band]);
+        if (!sband)
-        sband = wiphy->bands[band];
+                return;
        for (i = 0; i < sband->n_channels; i++)
-                handle_channel(wiphy, initiator, band, i);
+                handle_channel(wiphy, initiator, &sband->channels[i]);
 }
 static bool reg_request_cell_base(struct regulatory_request *request)
 {
        if (request->initiator != NL80211_REGDOM_SET_BY_USER)
                return false;
-        if (request->user_reg_hint_type != NL80211_USER_REG_HINT_CELL_BASE)
+        return request->user_reg_hint_type == NL80211_USER_REG_HINT_CELL_BASE;
-                return false;
-        return true;
 }
 bool reg_last_request_cell_base(void)
 {
        bool val;
-        assert_cfg80211_lock();
        mutex_lock(&reg_mutex);
-        val = reg_request_cell_base(last_request);
+        val = reg_request_cell_base(get_last_request());
        mutex_unlock(&reg_mutex);
        return val;
 }
 #ifdef CONFIG_CFG80211_CERTIFICATION_ONUS
 /* Core specific check */
-static int reg_ignore_cell_hint(struct regulatory_request *pending_request)
+static enum reg_request_treatment
+reg_ignore_cell_hint(struct regulatory_request *pending_request)
 {
+        struct regulatory_request *lr = get_last_request();
        if (!reg_num_devs_support_basehint)
-                return -EOPNOTSUPP;
+                return REG_REQ_IGNORE;
-        if (reg_request_cell_base(last_request)) {
+        if (reg_request_cell_base(lr) &&
-                if (!regdom_changes(pending_request->alpha2))
+            !regdom_changes(pending_request->alpha2))
-                        return -EALREADY;
+                return REG_REQ_ALREADY_SET;
-                return 0;
-        }
+        return REG_REQ_OK;
-        return 0;
 }
 /* Device specific check */
 static bool reg_dev_ignore_cell_hint(struct wiphy *wiphy)
 {
-        if (!(wiphy->features & NL80211_FEATURE_CELL_BASE_REG_HINTS))
+        return !(wiphy->features & NL80211_FEATURE_CELL_BASE_REG_HINTS);
-                return true;
-        return false;
 }
 #else
 static int reg_ignore_cell_hint(struct regulatory_request *pending_request)
 {
-        return -EOPNOTSUPP;
+        return REG_REQ_IGNORE;
 }
-static int reg_dev_ignore_cell_hint(struct wiphy *wiphy)
+static bool reg_dev_ignore_cell_hint(struct wiphy *wiphy)
 {
        return true;
 }
@@ -1006,18 +976,17 @@ static int reg_dev_ignore_cell_hint(struct wiphy *wiphy)
 static bool ignore_reg_update(struct wiphy *wiphy,
                              enum nl80211_reg_initiator initiator)
 {
-        if (!last_request) {
+        struct regulatory_request *lr = get_last_request();
-                REG_DBG_PRINT("Ignoring regulatory request %s since "
-                              "last_request is not set\n",
+        if (!lr) {
+                REG_DBG_PRINT("Ignoring regulatory request %s since last_request is not set\n",
                              reg_initiator_name(initiator));
                return true;
        }
        if (initiator == NL80211_REGDOM_SET_BY_CORE &&
            wiphy->flags & WIPHY_FLAG_CUSTOM_REGULATORY) {
-                REG_DBG_PRINT("Ignoring regulatory request %s "
+                REG_DBG_PRINT("Ignoring regulatory request %s since the driver uses its own custom regulatory domain\n",
-                              "since the driver uses its own custom "
-                              "regulatory domain\n",
                              reg_initiator_name(initiator));
                return true;
        }
@@ -1028,22 +997,35 @@ static bool ignore_reg_update(struct wiphy *wiphy,
         */
        if (wiphy->flags & WIPHY_FLAG_STRICT_REGULATORY && !wiphy->regd &&
            initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE &&
-            !is_world_regdom(last_request->alpha2)) {
+            !is_world_regdom(lr->alpha2)) {
-                REG_DBG_PRINT("Ignoring regulatory request %s "
+                REG_DBG_PRINT("Ignoring regulatory request %s since the driver requires its own regulatory domain to be set first\n",
-                              "since the driver requires its own regulatory "
-                              "domain to be set first\n",
                              reg_initiator_name(initiator));
                return true;
        }
-        if (reg_request_cell_base(last_request))
+        if (reg_request_cell_base(lr))
                return reg_dev_ignore_cell_hint(wiphy);
        return false;
 }
-static void handle_reg_beacon(struct wiphy *wiphy,
+static bool reg_is_world_roaming(struct wiphy *wiphy)
-                              unsigned int chan_idx,
+{
+        const struct ieee80211_regdomain *cr = get_cfg80211_regdom();
+        const struct ieee80211_regdomain *wr = get_wiphy_regdom(wiphy);
+        struct regulatory_request *lr = get_last_request();
+        if (is_world_regdom(cr->alpha2) || (wr && is_world_regdom(wr->alpha2)))
+                return true;
+        if (lr && lr->initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE &&
+            wiphy->flags & WIPHY_FLAG_CUSTOM_REGULATORY)
+                return true;
+        return false;
+}
+static void handle_reg_beacon(struct wiphy *wiphy, unsigned int chan_idx,
                              struct reg_beacon *reg_beacon)
 {
        struct ieee80211_supported_band *sband;
@@ -1051,8 +1033,6 @@ static void handle_reg_beacon(struct wiphy *wiphy,
        bool channel_changed = false;
        struct ieee80211_channel chan_before;
-        assert_cfg80211_lock();
        sband = wiphy->bands[reg_beacon->chan.band];
        chan = &sband->channels[chan_idx];
@@ -1064,6 +1044,9 @@ static void handle_reg_beacon(struct wiphy *wiphy,
        chan->beacon_found = true;
+        if (!reg_is_world_roaming(wiphy))
+                return;
        if (wiphy->flags & WIPHY_FLAG_DISABLE_BEACON_HINTS)
                return;
@@ -1094,8 +1077,6 @@ static void wiphy_update_new_beacon(struct wiphy *wiphy,
        unsigned int i;
        struct ieee80211_supported_band *sband;
-        assert_cfg80211_lock();
        if (!wiphy->bands[reg_beacon->chan.band])
                return;
@@ -1114,11 +1095,6 @@ static void wiphy_update_beacon_reg(struct wiphy *wiphy)
        struct ieee80211_supported_band *sband;
        struct reg_beacon *reg_beacon;
-        assert_cfg80211_lock();
-        if (list_empty(&reg_beacon_list))
-                return;
        list_for_each_entry(reg_beacon, &reg_beacon_list, list) {
                if (!wiphy->bands[reg_beacon->chan.band])
                        continue;
@@ -1128,18 +1104,6 @@ static void wiphy_update_beacon_reg(struct wiphy *wiphy)
        }
 }
-static bool reg_is_world_roaming(struct wiphy *wiphy)
-{
-        if (is_world_regdom(cfg80211_regdomain->alpha2) ||
-            (wiphy->regd && is_world_regdom(wiphy->regd->alpha2)))
-                return true;
-        if (last_request &&
-            last_request->initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE &&
-            wiphy->flags & WIPHY_FLAG_CUSTOM_REGULATORY)
-                return true;
-        return false;
-}
 /* Reap the advantages of previously found beacons */
 static void reg_process_beacons(struct wiphy *wiphy)
 {
@@ -1149,39 +1113,29 @@ static void reg_process_beacons(struct wiphy *wiphy)
         */
        if (!last_request)
                return;
-        if (!reg_is_world_roaming(wiphy))
-                return;
        wiphy_update_beacon_reg(wiphy);
 }
-static bool is_ht40_not_allowed(struct ieee80211_channel *chan)
+static bool is_ht40_allowed(struct ieee80211_channel *chan)
 {
        if (!chan)
-                return true;
+                return false;
        if (chan->flags & IEEE80211_CHAN_DISABLED)
-                return true;
+                return false;
        /* This would happen when regulatory rules disallow HT40 completely */
-        if (IEEE80211_CHAN_NO_HT40 == (chan->flags & (IEEE80211_CHAN_NO_HT40)))
+        if ((chan->flags & IEEE80211_CHAN_NO_HT40) == IEEE80211_CHAN_NO_HT40)
-                return true;
+                return false;
-        return false;
+        return true;
 }
 static void reg_process_ht_flags_channel(struct wiphy *wiphy,
-                                         enum ieee80211_band band,
+                                         struct ieee80211_channel *channel)
-                                         unsigned int chan_idx)
 {
-        struct ieee80211_supported_band *sband;
+        struct ieee80211_supported_band *sband = wiphy->bands[channel->band];
-        struct ieee80211_channel *channel;
        struct ieee80211_channel *channel_before = NULL, *channel_after = NULL;
        unsigned int i;
-        assert_cfg80211_lock();
+        if (!is_ht40_allowed(channel)) {
-        sband = wiphy->bands[band];
-        BUG_ON(chan_idx >= sband->n_channels);
-        channel = &sband->channels[chan_idx];
-        if (is_ht40_not_allowed(channel)) {
                channel->flags |= IEEE80211_CHAN_NO_HT40;
                return;
        }
@@ -1192,6 +1146,7 @@ static void reg_process_ht_flags_channel(struct wiphy *wiphy,
         */
        for (i = 0; i < sband->n_channels; i++) {
                struct ieee80211_channel *c = &sband->channels[i];
                if (c->center_freq == (channel->center_freq - 20))
                        channel_before = c;
                if (c->center_freq == (channel->center_freq + 20))
@@ -1203,28 +1158,27 @@ static void reg_process_ht_flags_channel(struct wiphy *wiphy,
         * if that ever changes we also need to change the below logic
         * to include that as well.
         */
-        if (is_ht40_not_allowed(channel_before))
+        if (!is_ht40_allowed(channel_before))
                channel->flags |= IEEE80211_CHAN_NO_HT40MINUS;
        else
                channel->flags &= ~IEEE80211_CHAN_NO_HT40MINUS;
-        if (is_ht40_not_allowed(channel_after))
+        if (!is_ht40_allowed(channel_after))
                channel->flags |= IEEE80211_CHAN_NO_HT40PLUS;
        else
                channel->flags &= ~IEEE80211_CHAN_NO_HT40PLUS;
 }
 static void reg_process_ht_flags_band(struct wiphy *wiphy,
-                                      enum ieee80211_band band)
+                                      struct ieee80211_supported_band *sband)
 {
        unsigned int i;
-        struct ieee80211_supported_band *sband;
-        BUG_ON(!wiphy->bands[band]);
+        if (!sband)
-        sband = wiphy->bands[band];
+                return;
        for (i = 0; i < sband->n_channels; i++)
-                reg_process_ht_flags_channel(wiphy, band, i);
+                reg_process_ht_flags_channel(wiphy, &sband->channels[i]);
 }
 static void reg_process_ht_flags(struct wiphy *wiphy)
@@ -1234,34 +1188,29 @@ static void reg_process_ht_flags(struct wiphy *wiphy)
        if (!wiphy)
                return;
-        for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+        for (band = 0; band < IEEE80211_NUM_BANDS; band++)
-                if (wiphy->bands[band])
+                reg_process_ht_flags_band(wiphy, wiphy->bands[band]);
-                        reg_process_ht_flags_band(wiphy, band);
-        }
 }
 static void wiphy_update_regulatory(struct wiphy *wiphy,
                                    enum nl80211_reg_initiator initiator)
 {
        enum ieee80211_band band;
+        struct regulatory_request *lr = get_last_request();
-        assert_reg_lock();
        if (ignore_reg_update(wiphy, initiator))
                return;
-        last_request->dfs_region = cfg80211_regdomain->dfs_region;
+        lr->dfs_region = get_cfg80211_regdom()->dfs_region;
-        for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+        for (band = 0; band < IEEE80211_NUM_BANDS; band++)
-                if (wiphy->bands[band])
+                handle_band(wiphy, initiator, wiphy->bands[band]);
-                        handle_band(wiphy, band, initiator);
-        }
        reg_process_beacons(wiphy);
        reg_process_ht_flags(wiphy);
        if (wiphy->reg_notifier)
-                wiphy->reg_notifier(wiphy, last_request);
+                wiphy->reg_notifier(wiphy, lr);
 }
 static void update_all_wiphy_regulatory(enum nl80211_reg_initiator initiator)
@@ -1269,6 +1218,8 @@ static void update_all_wiphy_regulatory(enum nl80211_reg_initiator initiator)
        struct cfg80211_registered_device *rdev;
        struct wiphy *wiphy;
+        assert_cfg80211_lock();
        list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
                wiphy = &rdev->wiphy;
                wiphy_update_regulatory(wiphy, initiator);
@@ -1280,47 +1231,30 @@ static void update_all_wiphy_regulatory(enum nl80211_reg_initiator initiator)
                if (initiator == NL80211_REGDOM_SET_BY_CORE &&
                    wiphy->flags & WIPHY_FLAG_CUSTOM_REGULATORY &&
                    wiphy->reg_notifier)
-                        wiphy->reg_notifier(wiphy, last_request);
+                        wiphy->reg_notifier(wiphy, get_last_request());
        }
 }
 static void handle_channel_custom(struct wiphy *wiphy,
-                                  enum ieee80211_band band,
+                                  struct ieee80211_channel *chan,
-                                  unsigned int chan_idx,
                                  const struct ieee80211_regdomain *regd)
 {
-        int r;
-        u32 desired_bw_khz = MHZ_TO_KHZ(20);
        u32 bw_flags = 0;
        const struct ieee80211_reg_rule *reg_rule = NULL;
        const struct ieee80211_power_rule *power_rule = NULL;
        const struct ieee80211_freq_range *freq_range = NULL;
-        struct ieee80211_supported_band *sband;
-        struct ieee80211_channel *chan;
-        assert_reg_lock();
-        sband = wiphy->bands[band];
+        reg_rule = freq_reg_info_regd(wiphy, MHZ_TO_KHZ(chan->center_freq),
-        BUG_ON(chan_idx >= sband->n_channels);
+                                      regd);
-        chan = &sband->channels[chan_idx];
-        r = freq_reg_info_regd(wiphy,
-                               MHZ_TO_KHZ(chan->center_freq),
-                               desired_bw_khz,
-                               &reg_rule,
-                               regd);
-        if (r) {
+        if (IS_ERR(reg_rule)) {
-                REG_DBG_PRINT("Disabling freq %d MHz as custom "
+                REG_DBG_PRINT("Disabling freq %d MHz as custom regd has no rule that fits it\n",
-                              "regd has no rule that fits a %d MHz "
+                              chan->center_freq);
-                              "wide channel\n",
-                              chan->center_freq,
-                              KHZ_TO_MHZ(desired_bw_khz));
                chan->flags = IEEE80211_CHAN_DISABLED;
                return;
        }
-        chan_reg_rule_print_dbg(chan, desired_bw_khz, reg_rule);
+        chan_reg_rule_print_dbg(chan, reg_rule);
        power_rule = &reg_rule->power_rule;
        freq_range = &reg_rule->freq_range;
@@ -1334,17 +1268,17 @@ static void handle_channel_custom(struct wiphy *wiphy,
                (int) MBM_TO_DBM(power_rule->max_eirp);
 }
-static void handle_band_custom(struct wiphy *wiphy, enum ieee80211_band band,
+static void handle_band_custom(struct wiphy *wiphy,
+                               struct ieee80211_supported_band *sband,
                               const struct ieee80211_regdomain *regd)
 {
        unsigned int i;
-        struct ieee80211_supported_band *sband;
-        BUG_ON(!wiphy->bands[band]);
+        if (!sband)
-        sband = wiphy->bands[band];
+                return;
        for (i = 0; i < sband->n_channels; i++)
-                handle_channel_custom(wiphy, band, i, regd);
+                handle_channel_custom(wiphy, &sband->channels[i], regd);
 }
 /* Used by drivers prior to wiphy registration */
@@ -1354,60 +1288,50 @@ void wiphy_apply_custom_regulatory(struct wiphy *wiphy,
        enum ieee80211_band band;
        unsigned int bands_set = 0;
-        mutex_lock(&reg_mutex);
        for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                if (!wiphy->bands[band])
                        continue;
-                handle_band_custom(wiphy, band, regd);
+                handle_band_custom(wiphy, wiphy->bands[band], regd);
                bands_set++;
        }
-        mutex_unlock(&reg_mutex);
        /*
         * no point in calling this if it won't have any effect
-         * on your device's supportd bands.
+         * on your device's supported bands.
         */
        WARN_ON(!bands_set);
 }
 EXPORT_SYMBOL(wiphy_apply_custom_regulatory);
-/*
- * Return value which can be used by ignore_request() to indicate
- * it has been determined we should intersect two regulatory domains
- */
-#define REG_INTERSECT   1
 /* This has the logic which determines when a new request
 * should be ignored. */
-static int ignore_request(struct wiphy *wiphy,
+static enum reg_request_treatment
+get_reg_request_treatment(struct wiphy *wiphy,
                          struct regulatory_request *pending_request)
 {
        struct wiphy *last_wiphy = NULL;
+        struct regulatory_request *lr = get_last_request();
-        assert_cfg80211_lock();
        /* All initial requests are respected */
-        if (!last_request)
+        if (!lr)
-                return 0;
+                return REG_REQ_OK;
        switch (pending_request->initiator) {
        case NL80211_REGDOM_SET_BY_CORE:
-                return 0;
+                return REG_REQ_OK;
        case NL80211_REGDOM_SET_BY_COUNTRY_IE:
+                if (reg_request_cell_base(lr)) {
-                if (reg_request_cell_base(last_request)) {
                        /* Trust a Cell base station over the AP's country IE */
                        if (regdom_changes(pending_request->alpha2))
-                                return -EOPNOTSUPP;
+                                return REG_REQ_IGNORE;
-                        return -EALREADY;
+                        return REG_REQ_ALREADY_SET;
                }
-                last_wiphy = wiphy_idx_to_wiphy(last_request->wiphy_idx);
+                last_wiphy = wiphy_idx_to_wiphy(lr->wiphy_idx);
                if (unlikely(!is_an_alpha2(pending_request->alpha2)))
                        return -EINVAL;
-                if (last_request->initiator ==
+                if (lr->initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE) {
-                    NL80211_REGDOM_SET_BY_COUNTRY_IE) {
                        if (last_wiphy != wiphy) {
                                /*
                                 * Two cards with two APs claiming different
@@ -1416,23 +1340,23 @@ static int ignore_request(struct wiphy *wiphy,
                                 * to be correct. Reject second one for now.
                                 */
                                if (regdom_changes(pending_request->alpha2))
-                                        return -EOPNOTSUPP;
+                                        return REG_REQ_IGNORE;
-                                return -EALREADY;
+                                return REG_REQ_ALREADY_SET;
                        }
                        /*
                         * Two consecutive Country IE hints on the same wiphy.
                         * This should be picked up early by the driver/stack
                         */
                        if (WARN_ON(regdom_changes(pending_request->alpha2)))
-                                return 0;
+                                return REG_REQ_OK;
-                        return -EALREADY;
+                        return REG_REQ_ALREADY_SET;
                }
                return 0;
        case NL80211_REGDOM_SET_BY_DRIVER:
-                if (last_request->initiator == NL80211_REGDOM_SET_BY_CORE) {
+                if (lr->initiator == NL80211_REGDOM_SET_BY_CORE) {
                        if (regdom_changes(pending_request->alpha2))
-                                return 0;
+                                return REG_REQ_OK;
-                        return -EALREADY;
+                        return REG_REQ_ALREADY_SET;
                }
                /*
@@ -1440,59 +1364,59 @@ static int ignore_request(struct wiphy *wiphy,
                 * back in or if you add a new device for which the previously
                 * loaded card also agrees on the regulatory domain.
                 */
-                if (last_request->initiator == NL80211_REGDOM_SET_BY_DRIVER &&
+                if (lr->initiator == NL80211_REGDOM_SET_BY_DRIVER &&
                    !regdom_changes(pending_request->alpha2))
-                        return -EALREADY;
+                        return REG_REQ_ALREADY_SET;
-                return REG_INTERSECT;
+                return REG_REQ_INTERSECT;
        case NL80211_REGDOM_SET_BY_USER:
                if (reg_request_cell_base(pending_request))
                        return reg_ignore_cell_hint(pending_request);
-                if (reg_request_cell_base(last_request))
+                if (reg_request_cell_base(lr))
-                        return -EOPNOTSUPP;
+                        return REG_REQ_IGNORE;
-                if (last_request->initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE)
+                if (lr->initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE)
-                        return REG_INTERSECT;
+                        return REG_REQ_INTERSECT;
                /*
                 * If the user knows better the user should set the regdom
                 * to their country before the IE is picked up
                 */
-                if (last_request->initiator == NL80211_REGDOM_SET_BY_USER &&
+                if (lr->initiator == NL80211_REGDOM_SET_BY_USER &&
-                          last_request->intersect)
+                    lr->intersect)
-                        return -EOPNOTSUPP;
+                        return REG_REQ_IGNORE;
                /*
                 * Process user requests only after previous user/driver/core
                 * requests have been processed
                 */
-                if (last_request->initiator == NL80211_REGDOM_SET_BY_CORE ||
+                if ((lr->initiator == NL80211_REGDOM_SET_BY_CORE ||
-                    last_request->initiator == NL80211_REGDOM_SET_BY_DRIVER ||
+                     lr->initiator == NL80211_REGDOM_SET_BY_DRIVER ||
-                    last_request->initiator == NL80211_REGDOM_SET_BY_USER) {
+                     lr->initiator == NL80211_REGDOM_SET_BY_USER) &&
-                        if (regdom_changes(last_request->alpha2))
+                    regdom_changes(lr->alpha2))
-                                return -EAGAIN;
+                        return REG_REQ_IGNORE;
-                }
                if (!regdom_changes(pending_request->alpha2))
-                        return -EALREADY;
+                        return REG_REQ_ALREADY_SET;
-                return 0;
+                return REG_REQ_OK;
        }
-        return -EINVAL;
+        return REG_REQ_IGNORE;
 }
 static void reg_set_request_processed(void)
 {
        bool need_more_processing = false;
+        struct regulatory_request *lr = get_last_request();
-        last_request->processed = true;
+        lr->processed = true;
        spin_lock(&reg_requests_lock);
        if (!list_empty(&reg_requests_list))
                need_more_processing = true;
        spin_unlock(&reg_requests_lock);
-        if (last_request->initiator == NL80211_REGDOM_SET_BY_USER)
+        if (lr->initiator == NL80211_REGDOM_SET_BY_USER)
                cancel_delayed_work(&reg_timeout);
        if (need_more_processing)
@@ -1508,116 +1432,122 @@ static void reg_set_request_processed(void)
 * The Wireless subsystem can use this function to hint to the wireless core
 * what it believes should be the current regulatory domain.
 *
- * Returns zero if all went fine, %-EALREADY if a regulatory domain had
+ * Returns one of the different reg request treatment values.
- * already been set or other standard error codes.
 *
- * Caller must hold &cfg80211_mutex and &reg_mutex
+ * Caller must hold &reg_mutex
 */
-static int __regulatory_hint(struct wiphy *wiphy,
+static enum reg_request_treatment
-                             struct regulatory_request *pending_request)
+__regulatory_hint(struct wiphy *wiphy,
+                  struct regulatory_request *pending_request)
 {
+        const struct ieee80211_regdomain *regd;
        bool intersect = false;
-        int r = 0;
+        enum reg_request_treatment treatment;
+        struct regulatory_request *lr;
-        assert_cfg80211_lock();
-        r = ignore_request(wiphy, pending_request);
+        treatment = get_reg_request_treatment(wiphy, pending_request);
-        if (r == REG_INTERSECT) {
+        switch (treatment) {
+        case REG_REQ_INTERSECT:
                if (pending_request->initiator ==
                    NL80211_REGDOM_SET_BY_DRIVER) {
-                        r = reg_copy_regd(&wiphy->regd, cfg80211_regdomain);
+                        regd = reg_copy_regd(get_cfg80211_regdom());
-                        if (r) {
+                        if (IS_ERR(regd)) {
                                kfree(pending_request);
-                                return r;
+                                return PTR_ERR(regd);
                        }
+                        rcu_assign_pointer(wiphy->regd, regd);
                }
                intersect = true;
-        } else if (r) {
+                break;
+        case REG_REQ_OK:
+                break;
+        default:
                /*
                 * If the regulatory domain being requested by the
                 * driver has already been set just copy it to the
                 * wiphy
                 */
-                if (r == -EALREADY &&
+                if (treatment == REG_REQ_ALREADY_SET &&
-                    pending_request->initiator ==
+                    pending_request->initiator == NL80211_REGDOM_SET_BY_DRIVER) {
-                    NL80211_REGDOM_SET_BY_DRIVER) {
+                        regd = reg_copy_regd(get_cfg80211_regdom());
-                        r = reg_copy_regd(&wiphy->regd, cfg80211_regdomain);
+                        if (IS_ERR(regd)) {
-                        if (r) {
                                kfree(pending_request);
-                                return r;
+                                return REG_REQ_IGNORE;
                        }
-                        r = -EALREADY;
+                        treatment = REG_REQ_ALREADY_SET;
+                        rcu_assign_pointer(wiphy->regd, regd);
                        goto new_request;
                }
                kfree(pending_request);
-                return r;
+                return treatment;
        }
 new_request:
-        if (last_request != &core_request_world)
+        lr = get_last_request();
-                kfree(last_request);
+        if (lr != &core_request_world && lr)
+                kfree_rcu(lr, rcu_head);
-        last_request = pending_request;
+        pending_request->intersect = intersect;
-        last_request->intersect = intersect;
+        pending_request->processed = false;
+        rcu_assign_pointer(last_request, pending_request);
+        lr = pending_request;
        pending_request = NULL;
-        if (last_request->initiator == NL80211_REGDOM_SET_BY_USER) {
+        if (lr->initiator == NL80211_REGDOM_SET_BY_USER) {
-                user_alpha2[0] = last_request->alpha2[0];
+                user_alpha2[0] = lr->alpha2[0];
-                user_alpha2[1] = last_request->alpha2[1];
+                user_alpha2[1] = lr->alpha2[1];
        }
-        /* When r == REG_INTERSECT we do need to call CRDA */
+        /* When r == REG_REQ_INTERSECT we do need to call CRDA */
-        if (r < 0) {
+        if (treatment != REG_REQ_OK && treatment != REG_REQ_INTERSECT) {
                /*
                 * Since CRDA will not be called in this case as we already
                 * have applied the requested regulatory domain before we just
                 * inform userspace we have processed the request
                 */
-                if (r == -EALREADY) {
+                if (treatment == REG_REQ_ALREADY_SET) {
-                        nl80211_send_reg_change_event(last_request);
+                        nl80211_send_reg_change_event(lr);
                        reg_set_request_processed();
                }
-                return r;
+                return treatment;
        }
-        return call_crda(last_request->alpha2);
+        if (call_crda(lr->alpha2))
+                return REG_REQ_IGNORE;
+        return REG_REQ_OK;
 }
 /* This processes *all* regulatory hints */
 static void reg_process_hint(struct regulatory_request *reg_request,
                             enum nl80211_reg_initiator reg_initiator)
 {
-        int r = 0;
        struct wiphy *wiphy = NULL;
-        BUG_ON(!reg_request->alpha2);
+        if (WARN_ON(!reg_request->alpha2))
+                return;
-        if (wiphy_idx_valid(reg_request->wiphy_idx))
+        if (reg_request->wiphy_idx != WIPHY_IDX_INVALID)
                wiphy = wiphy_idx_to_wiphy(reg_request->wiphy_idx);
-        if (reg_initiator == NL80211_REGDOM_SET_BY_DRIVER &&
+        if (reg_initiator == NL80211_REGDOM_SET_BY_DRIVER && !wiphy) {
-            !wiphy) {
                kfree(reg_request);
                return;
        }
-        r = __regulatory_hint(wiphy, reg_request);
+        switch (__regulatory_hint(wiphy, reg_request)) {
-        /* This is required so that the orig_* parameters are saved */
+        case REG_REQ_ALREADY_SET:
-        if (r == -EALREADY && wiphy &&
+                /* This is required so that the orig_* parameters are saved */
-            wiphy->flags & WIPHY_FLAG_STRICT_REGULATORY) {
+                if (wiphy && wiphy->flags & WIPHY_FLAG_STRICT_REGULATORY)
-                wiphy_update_regulatory(wiphy, reg_initiator);
+                        wiphy_update_regulatory(wiphy, reg_initiator);
-                return;
+                break;
+        default:
+                if (reg_initiator == NL80211_REGDOM_SET_BY_USER)
+                        schedule_delayed_work(&reg_timeout,
+                                              msecs_to_jiffies(3142));
+                break;
        }
-        /*
-         * We only time out user hints, given that they should be the only
-         * source of bogus requests.
-         */
-        if (r != -EALREADY &&
-            reg_initiator == NL80211_REGDOM_SET_BY_USER)
-                schedule_delayed_work(&reg_timeout, msecs_to_jiffies(3142));
 }
 /*
@@ -1627,15 +1557,15 @@ static void reg_process_hint(struct regulatory_request *reg_request,
 */
 static void reg_process_pending_hints(void)
 {
-        struct regulatory_request *reg_request;
+        struct regulatory_request *reg_request, *lr;
        mutex_lock(&cfg80211_mutex);
        mutex_lock(&reg_mutex);
+        lr = get_last_request();
        /* When last_request->processed becomes true this will be rescheduled */
-        if (last_request && !last_request->processed) {
+        if (lr && !lr->processed) {
-                REG_DBG_PRINT("Pending regulatory request, waiting "
+                REG_DBG_PRINT("Pending regulatory request, waiting for it to be processed...\n");
-                              "for it to be processed...\n");
                goto out;
        }
@@ -1666,23 +1596,14 @@ static void reg_process_pending_beacon_hints(void)
        struct cfg80211_registered_device *rdev;
        struct reg_beacon *pending_beacon, *tmp;
-        /*
-         * No need to hold the reg_mutex here as we just touch wiphys
-         * and do not read or access regulatory variables.
-         */
        mutex_lock(&cfg80211_mutex);
+        mutex_lock(&reg_mutex);
        /* This goes through the _pending_ beacon list */
        spin_lock_bh(&reg_pending_beacons_lock);
-        if (list_empty(&reg_pending_beacons)) {
-                spin_unlock_bh(&reg_pending_beacons_lock);
-                goto out;
-        }
        list_for_each_entry_safe(pending_beacon, tmp,
                                 &reg_pending_beacons, list) {
                list_del_init(&pending_beacon->list);
                /* Applies the beacon hint to current wiphys */
@@ -1694,7 +1615,7 @@ static void reg_process_pending_beacon_hints(void)
        }
        spin_unlock_bh(&reg_pending_beacons_lock);
-out:
+        mutex_unlock(&reg_mutex);
        mutex_unlock(&cfg80211_mutex);
 }
@@ -1706,10 +1627,8 @@ static void reg_todo(struct work_struct *work)
 static void queue_regulatory_request(struct regulatory_request *request)
 {
-        if (isalpha(request->alpha2[0]))
+        request->alpha2[0] = toupper(request->alpha2[0]);
-                request->alpha2[0] = toupper(request->alpha2[0]);
+        request->alpha2[1] = toupper(request->alpha2[1]);
-        if (isalpha(request->alpha2[1]))
-                request->alpha2[1] = toupper(request->alpha2[1]);
        spin_lock(&reg_requests_lock);
        list_add_tail(&request->list, &reg_requests_list);
@@ -1726,8 +1645,7 @@ static int regulatory_hint_core(const char *alpha2)
 {
        struct regulatory_request *request;
-        request = kzalloc(sizeof(struct regulatory_request),
+        request = kzalloc(sizeof(struct regulatory_request), GFP_KERNEL);
-                          GFP_KERNEL);
        if (!request)
                return -ENOMEM;
@@ -1746,13 +1664,14 @@ int regulatory_hint_user(const char *alpha2,
 {
        struct regulatory_request *request;
-        BUG_ON(!alpha2);
+        if (WARN_ON(!alpha2))
+                return -EINVAL;
        request = kzalloc(sizeof(struct regulatory_request), GFP_KERNEL);
        if (!request)
                return -ENOMEM;
-        request->wiphy_idx = WIPHY_IDX_STALE;
+        request->wiphy_idx = WIPHY_IDX_INVALID;
        request->alpha2[0] = alpha2[0];
        request->alpha2[1] = alpha2[1];
        request->initiator = NL80211_REGDOM_SET_BY_USER;
@@ -1768,8 +1687,8 @@ int regulatory_hint(struct wiphy *wiphy, const char *alpha2)
 {
        struct regulatory_request *request;
-        BUG_ON(!alpha2);
+        if (WARN_ON(!alpha2 || !wiphy))
-        BUG_ON(!wiphy);
+                return -EINVAL;
        request = kzalloc(sizeof(struct regulatory_request), GFP_KERNEL);
        if (!request)
@@ -1777,9 +1696,6 @@ int regulatory_hint(struct wiphy *wiphy, const char *alpha2)
        request->wiphy_idx = get_wiphy_idx(wiphy);
-        /* Must have registered wiphy first */
-        BUG_ON(!wiphy_idx_valid(request->wiphy_idx));
        request->alpha2[0] = alpha2[0];
        request->alpha2[1] = alpha2[1];
        request->initiator = NL80211_REGDOM_SET_BY_DRIVER;
@@ -1794,18 +1710,17 @@ EXPORT_SYMBOL(regulatory_hint);
 * We hold wdev_lock() here so we cannot hold cfg80211_mutex() and
 * therefore cannot iterate over the rdev list here.
 */
-void regulatory_hint_11d(struct wiphy *wiphy,
+void regulatory_hint_11d(struct wiphy *wiphy, enum ieee80211_band band,
-                         enum ieee80211_band band,
+                         const u8 *country_ie, u8 country_ie_len)
-                         const u8 *country_ie,
-                         u8 country_ie_len)
 {
        char alpha2[2];
        enum environment_cap env = ENVIRON_ANY;
-        struct regulatory_request *request;
+        struct regulatory_request *request, *lr;
        mutex_lock(&reg_mutex);
+        lr = get_last_request();
-        if (unlikely(!last_request))
+        if (unlikely(!lr))
                goto out;
        /* IE len must be evenly divisible by 2 */
@@ -1828,9 +1743,8 @@ void regulatory_hint_11d(struct wiphy *wiphy,
         * We leave conflict resolution to the workqueue, where can hold
         * cfg80211_mutex.
         */
-        if (likely(last_request->initiator ==
+        if (lr->initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE &&
-            NL80211_REGDOM_SET_BY_COUNTRY_IE &&
+            lr->wiphy_idx != WIPHY_IDX_INVALID)
-            wiphy_idx_valid(last_request->wiphy_idx)))
                goto out;
        request = kzalloc(sizeof(struct regulatory_request), GFP_KERNEL);
@@ -1843,12 +1757,7 @@ void regulatory_hint_11d(struct wiphy *wiphy,
        request->initiator = NL80211_REGDOM_SET_BY_COUNTRY_IE;
        request->country_ie_env = env;
-        mutex_unlock(&reg_mutex);
        queue_regulatory_request(request);
-        return;
 out:
        mutex_unlock(&reg_mutex);
 }
@@ -1863,8 +1772,7 @@ static void restore_alpha2(char *alpha2, bool reset_user)
        if (is_user_regdom_saved()) {
                /* Unless we're asked to ignore it and reset it */
                if (reset_user) {
-                        REG_DBG_PRINT("Restoring regulatory settings "
+                        REG_DBG_PRINT("Restoring regulatory settings including user preference\n");
-                               "including user preference\n");
                        user_alpha2[0] = '9';
                        user_alpha2[1] = '7';
@@ -1874,26 +1782,20 @@ static void restore_alpha2(char *alpha2, bool reset_user)
                         * back as they were for a full restore.
                         */
                        if (!is_world_regdom(ieee80211_regdom)) {
-                                REG_DBG_PRINT("Keeping preference on "
+                                REG_DBG_PRINT("Keeping preference on module parameter ieee80211_regdom: %c%c\n",
-                                       "module parameter ieee80211_regdom: %c%c\n",
+                                              ieee80211_regdom[0], ieee80211_regdom[1]);
-                                       ieee80211_regdom[0],
-                                       ieee80211_regdom[1]);
                                alpha2[0] = ieee80211_regdom[0];
                                alpha2[1] = ieee80211_regdom[1];
                        }
                } else {
-                        REG_DBG_PRINT("Restoring regulatory settings "
+                        REG_DBG_PRINT("Restoring regulatory settings while preserving user preference for: %c%c\n",
-                               "while preserving user preference for: %c%c\n",
+                                      user_alpha2[0], user_alpha2[1]);
-                               user_alpha2[0],
-                               user_alpha2[1]);
                        alpha2[0] = user_alpha2[0];
                        alpha2[1] = user_alpha2[1];
                }
        } else if (!is_world_regdom(ieee80211_regdom)) {
-                REG_DBG_PRINT("Keeping preference on "
+                REG_DBG_PRINT("Keeping preference on module parameter ieee80211_regdom: %c%c\n",
-                       "module parameter ieee80211_regdom: %c%c\n",
+                              ieee80211_regdom[0], ieee80211_regdom[1]);
-                       ieee80211_regdom[0],
-                       ieee80211_regdom[1]);
                alpha2[0] = ieee80211_regdom[0];
                alpha2[1] = ieee80211_regdom[1];
        } else
@@ -1948,7 +1850,7 @@ static void restore_regulatory_settings(bool reset_user)
        mutex_lock(&cfg80211_mutex);
        mutex_lock(&reg_mutex);
-        reset_regdomains(true);
+        reset_regdomains(true, &world_regdom);
        restore_alpha2(alpha2, reset_user);
        /*
@@ -1958,49 +1860,35 @@ static void restore_regulatory_settings(bool reset_user)
         * settings.
         */
        spin_lock(&reg_requests_lock);
-        if (!list_empty(&reg_requests_list)) {
+        list_for_each_entry_safe(reg_request, tmp, &reg_requests_list, list) {
-                list_for_each_entry_safe(reg_request, tmp,
+                if (reg_request->initiator != NL80211_REGDOM_SET_BY_USER)
-                                         &reg_requests_list, list) {
+                        continue;
-                        if (reg_request->initiator !=
+                list_move_tail(&reg_request->list, &tmp_reg_req_list);
-                            NL80211_REGDOM_SET_BY_USER)
-                                continue;
-                        list_move_tail(&reg_request->list, &tmp_reg_req_list);
-                }
        }
        spin_unlock(&reg_requests_lock);
        /* Clear beacon hints */
        spin_lock_bh(&reg_pending_beacons_lock);
-        if (!list_empty(&reg_pending_beacons)) {
+        list_for_each_entry_safe(reg_beacon, btmp, &reg_pending_beacons, list) {
-                list_for_each_entry_safe(reg_beacon, btmp,
+                list_del(&reg_beacon->list);
-                                         &reg_pending_beacons, list) {
+                kfree(reg_beacon);
-                        list_del(&reg_beacon->list);
-                        kfree(reg_beacon);
-                }
        }
        spin_unlock_bh(&reg_pending_beacons_lock);
-        if (!list_empty(&reg_beacon_list)) {
+        list_for_each_entry_safe(reg_beacon, btmp, &reg_beacon_list, list) {
-                list_for_each_entry_safe(reg_beacon, btmp,
+                list_del(&reg_beacon->list);
-                                         &reg_beacon_list, list) {
+                kfree(reg_beacon);
-                        list_del(&reg_beacon->list);
-                        kfree(reg_beacon);
-                }
        }
        /* First restore to the basic regulatory settings */
-        cfg80211_regdomain = cfg80211_world_regdom;
+        world_alpha2[0] = cfg80211_world_regdom->alpha2[0];
-        world_alpha2[0] = cfg80211_regdomain->alpha2[0];
+        world_alpha2[1] = cfg80211_world_regdom->alpha2[1];
-        world_alpha2[1] = cfg80211_regdomain->alpha2[1];
        list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
                if (rdev->wiphy.flags & WIPHY_FLAG_CUSTOM_REGULATORY)
                        restore_custom_reg_settings(&rdev->wiphy);
        }
-        mutex_unlock(&reg_mutex);
-        mutex_unlock(&cfg80211_mutex);
        regulatory_hint_core(world_alpha2);
        /*
@@ -2011,20 +1899,8 @@ static void restore_regulatory_settings(bool reset_user)
        if (is_an_alpha2(alpha2))
                regulatory_hint_user(user_alpha2, NL80211_USER_REG_HINT_USER);
-        if (list_empty(&tmp_reg_req_list))
-                return;
-        mutex_lock(&cfg80211_mutex);
-        mutex_lock(&reg_mutex);
        spin_lock(&reg_requests_lock);
-        list_for_each_entry_safe(reg_request, tmp, &tmp_reg_req_list, list) {
+        list_splice_tail_init(&tmp_reg_req_list, &reg_requests_list);
-                REG_DBG_PRINT("Adding request for country %c%c back "
-                              "into the queue\n",
-                              reg_request->alpha2[0],
-                              reg_request->alpha2[1]);
-                list_move_tail(&reg_request->list, &reg_requests_list);
-        }
        spin_unlock(&reg_requests_lock);
        mutex_unlock(&reg_mutex);
@@ -2037,8 +1913,7 @@ static void restore_regulatory_settings(bool reset_user)
 void regulatory_hint_disconnect(void)
 {
-        REG_DBG_PRINT("All devices are disconnected, going to "
+        REG_DBG_PRINT("All devices are disconnected, going to restore regulatory settings\n");
-                      "restore regulatory settings\n");
        restore_regulatory_settings(false);
 }
@@ -2051,31 +1926,48 @@ static bool freq_is_chan_12_13_14(u16 freq)
        return false;
 }
+static bool pending_reg_beacon(struct ieee80211_channel *beacon_chan)
+{
+        struct reg_beacon *pending_beacon;
+        list_for_each_entry(pending_beacon, &reg_pending_beacons, list)
+                if (beacon_chan->center_freq ==
+                    pending_beacon->chan.center_freq)
+                        return true;
+        return false;
+}
 int regulatory_hint_found_beacon(struct wiphy *wiphy,
                                 struct ieee80211_channel *beacon_chan,
                                 gfp_t gfp)
 {
        struct reg_beacon *reg_beacon;
+        bool processing;
-        if (likely((beacon_chan->beacon_found ||
+        if (beacon_chan->beacon_found ||
-            (beacon_chan->flags & IEEE80211_CHAN_RADAR) ||
+            beacon_chan->flags & IEEE80211_CHAN_RADAR ||
            (beacon_chan->band == IEEE80211_BAND_2GHZ &&
-             !freq_is_chan_12_13_14(beacon_chan->center_freq)))))
+             !freq_is_chan_12_13_14(beacon_chan->center_freq)))
+                return 0;
+        spin_lock_bh(&reg_pending_beacons_lock);
+        processing = pending_reg_beacon(beacon_chan);
+        spin_unlock_bh(&reg_pending_beacons_lock);
+        if (processing)
                return 0;
        reg_beacon = kzalloc(sizeof(struct reg_beacon), gfp);
        if (!reg_beacon)
                return -ENOMEM;
-        REG_DBG_PRINT("Found new beacon on "
+        REG_DBG_PRINT("Found new beacon on frequency: %d MHz (Ch %d) on %s\n",
-                      "frequency: %d MHz (Ch %d) on %s\n",
                      beacon_chan->center_freq,
                      ieee80211_frequency_to_channel(beacon_chan->center_freq),
                      wiphy_name(wiphy));
        memcpy(&reg_beacon->chan, beacon_chan,
-                sizeof(struct ieee80211_channel));
+               sizeof(struct ieee80211_channel));
        /*
         * Since we can be called from BH or and non-BH context
@@ -2155,21 +2047,19 @@ static void print_dfs_region(u8 dfs_region)
                pr_info(" DFS Master region JP");
                break;
        default:
-                pr_info(" DFS Master region Uknown");
+                pr_info(" DFS Master region Unknown");
                break;
        }
 }
 static void print_regdomain(const struct ieee80211_regdomain *rd)
 {
+        struct regulatory_request *lr = get_last_request();
        if (is_intersected_alpha2(rd->alpha2)) {
+                if (lr->initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE) {
-                if (last_request->initiator ==
-                    NL80211_REGDOM_SET_BY_COUNTRY_IE) {
                        struct cfg80211_registered_device *rdev;
-                        rdev = cfg80211_rdev_by_wiphy_idx(
+                        rdev = cfg80211_rdev_by_wiphy_idx(lr->wiphy_idx);
-                                last_request->wiphy_idx);
                        if (rdev) {
                                pr_info("Current regulatory domain updated by AP to: %c%c\n",
                                        rdev->country_ie_alpha2[0],
@@ -2178,22 +2068,21 @@ static void print_regdomain(const struct ieee80211_regdomain *rd)
                                pr_info("Current regulatory domain intersected:\n");
                } else
                        pr_info("Current regulatory domain intersected:\n");
-        } else if (is_world_regdom(rd->alpha2))
+        } else if (is_world_regdom(rd->alpha2)) {
                pr_info("World regulatory domain updated:\n");
-        else {
+        } else {
                if (is_unknown_alpha2(rd->alpha2))
                        pr_info("Regulatory domain changed to driver built-in settings (unknown country)\n");
                else {
-                        if (reg_request_cell_base(last_request))
+                        if (reg_request_cell_base(lr))
-                                pr_info("Regulatory domain changed "
+                                pr_info("Regulatory domain changed to country: %c%c by Cell Station\n",
-                                        "to country: %c%c by Cell Station\n",
                                        rd->alpha2[0], rd->alpha2[1]);
                        else
-                                pr_info("Regulatory domain changed "
+                                pr_info("Regulatory domain changed to country: %c%c\n",
-                                        "to country: %c%c\n",
                                        rd->alpha2[0], rd->alpha2[1]);
                }
        }
        print_dfs_region(rd->dfs_region);
        print_rd_rules(rd);
 }
@@ -2207,22 +2096,23 @@ static void print_regdomain_info(const struct ieee80211_regdomain *rd)
 /* Takes ownership of rd only if it doesn't fail */
 static int __set_regdom(const struct ieee80211_regdomain *rd)
 {
+        const struct ieee80211_regdomain *regd;
        const struct ieee80211_regdomain *intersected_rd = NULL;
        struct wiphy *request_wiphy;
+        struct regulatory_request *lr = get_last_request();
        /* Some basic sanity checks first */
+        if (!reg_is_valid_request(rd->alpha2))
+                return -EINVAL;
        if (is_world_regdom(rd->alpha2)) {
-                if (WARN_ON(!reg_is_valid_request(rd->alpha2)))
-                        return -EINVAL;
                update_world_regdomain(rd);
                return 0;
        }
        if (!is_alpha2_set(rd->alpha2) && !is_an_alpha2(rd->alpha2) &&
-                        !is_unknown_alpha2(rd->alpha2))
+            !is_unknown_alpha2(rd->alpha2))
-                return -EINVAL;
-        if (!last_request)
                return -EINVAL;
        /*
@@ -2230,7 +2120,7 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
         * rd is non static (it means CRDA was present and was used last)
         * and the pending request came in from a country IE
         */
-        if (last_request->initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE) {
+        if (lr->initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE) {
                /*
                 * If someone else asked us to change the rd lets only bother
                 * checking if the alpha2 changes if CRDA was already called
@@ -2246,29 +2136,23 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
         * internal EEPROM data
         */
-        if (WARN_ON(!reg_is_valid_request(rd->alpha2)))
-                return -EINVAL;
        if (!is_valid_rd(rd)) {
                pr_err("Invalid regulatory domain detected:\n");
                print_regdomain_info(rd);
                return -EINVAL;
        }
-        request_wiphy = wiphy_idx_to_wiphy(last_request->wiphy_idx);
+        request_wiphy = wiphy_idx_to_wiphy(lr->wiphy_idx);
        if (!request_wiphy &&
-            (last_request->initiator == NL80211_REGDOM_SET_BY_DRIVER ||
+            (lr->initiator == NL80211_REGDOM_SET_BY_DRIVER ||
-             last_request->initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE)) {
+             lr->initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE)) {
                schedule_delayed_work(&reg_timeout, 0);
                return -ENODEV;
        }
-        if (!last_request->intersect) {
+        if (!lr->intersect) {
-                int r;
+                if (lr->initiator != NL80211_REGDOM_SET_BY_DRIVER) {
+                        reset_regdomains(false, rd);
-                if (last_request->initiator != NL80211_REGDOM_SET_BY_DRIVER) {
-                        reset_regdomains(false);
-                        cfg80211_regdomain = rd;
                        return 0;
                }
@@ -2284,20 +2168,19 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
                if (request_wiphy->regd)
                        return -EALREADY;
-                r = reg_copy_regd(&request_wiphy->regd, rd);
+                regd = reg_copy_regd(rd);
-                if (r)
+                if (IS_ERR(regd))
-                        return r;
+                        return PTR_ERR(regd);
-                reset_regdomains(false);
+                rcu_assign_pointer(request_wiphy->regd, regd);
-                cfg80211_regdomain = rd;
+                reset_regdomains(false, rd);
                return 0;
        }
        /* Intersection requires a bit more work */
-        if (last_request->initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE) {
+        if (lr->initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE) {
+                intersected_rd = regdom_intersect(rd, get_cfg80211_regdom());
-                intersected_rd = regdom_intersect(rd, cfg80211_regdomain);
                if (!intersected_rd)
                        return -EINVAL;
@@ -2306,15 +2189,14 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
                 * However if a driver requested this specific regulatory
                 * domain we keep it for its private use
                 */
-                if (last_request->initiator == NL80211_REGDOM_SET_BY_DRIVER)
+                if (lr->initiator == NL80211_REGDOM_SET_BY_DRIVER)
-                        request_wiphy->regd = rd;
+                        rcu_assign_pointer(request_wiphy->regd, rd);
                else
                        kfree(rd);
                rd = NULL;
-                reset_regdomains(false);
+                reset_regdomains(false, intersected_rd);
-                cfg80211_regdomain = intersected_rd;
                return 0;
        }
@@ -2326,15 +2208,15 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
 /*
 * Use this call to set the current regulatory domain. Conflicts with
 * multiple drivers can be ironed out later. Caller must've already
- * kmalloc'd the rd structure. Caller must hold cfg80211_mutex
+ * kmalloc'd the rd structure.
 */
 int set_regdom(const struct ieee80211_regdomain *rd)
 {
+        struct regulatory_request *lr;
        int r;
-        assert_cfg80211_lock();
        mutex_lock(&reg_mutex);
+        lr = get_last_request();
        /* Note that this doesn't update the wiphys, this is done below */
        r = __set_regdom(rd);
@@ -2343,23 +2225,25 @@ int set_regdom(const struct ieee80211_regdomain *rd)
                        reg_set_request_processed();
                kfree(rd);
-                mutex_unlock(&reg_mutex);
+                goto out;
-                return r;
        }
        /* This would make this whole thing pointless */
-        if (!last_request->intersect)
+        if (WARN_ON(!lr->intersect && rd != get_cfg80211_regdom())) {
-                BUG_ON(rd != cfg80211_regdomain);
+                r = -EINVAL;
+                goto out;
+        }
        /* update all wiphys now with the new established regulatory domain */
-        update_all_wiphy_regulatory(last_request->initiator);
+        update_all_wiphy_regulatory(lr->initiator);
-        print_regdomain(cfg80211_regdomain);
+        print_regdomain(get_cfg80211_regdom());
-        nl80211_send_reg_change_event(last_request);
+        nl80211_send_reg_change_event(lr);
        reg_set_request_processed();
+ out:
        mutex_unlock(&reg_mutex);
        return r;
@@ -2367,20 +2251,26 @@ int set_regdom(const struct ieee80211_regdomain *rd)
 int reg_device_uevent(struct device *dev, struct kobj_uevent_env *env)
 {
-        if (last_request && !last_request->processed) {
+        struct regulatory_request *lr;
-                if (add_uevent_var(env, "COUNTRY=%c%c",
+        u8 alpha2[2];
-                                   last_request->alpha2[0],
+        bool add = false;
-                                   last_request->alpha2[1]))
-                        return -ENOMEM;
+        rcu_read_lock();
+        lr = get_last_request();
+        if (lr && !lr->processed) {
+                memcpy(alpha2, lr->alpha2, 2);
+                add = true;
        }
+        rcu_read_unlock();
+        if (add)
+                return add_uevent_var(env, "COUNTRY=%c%c",
+                                      alpha2[0], alpha2[1]);
        return 0;
 }
 void wiphy_regulatory_register(struct wiphy *wiphy)
 {
-        assert_cfg80211_lock();
        mutex_lock(&reg_mutex);
        if (!reg_dev_ignore_cell_hint(wiphy))
@@ -2395,32 +2285,32 @@ void wiphy_regulatory_register(struct wiphy *wiphy)
 void wiphy_regulatory_deregister(struct wiphy *wiphy)
 {
        struct wiphy *request_wiphy = NULL;
+        struct regulatory_request *lr;
-        assert_cfg80211_lock();
        mutex_lock(&reg_mutex);
+        lr = get_last_request();
        if (!reg_dev_ignore_cell_hint(wiphy))
                reg_num_devs_support_basehint--;
-        kfree(wiphy->regd);
+        rcu_free_regdom(get_wiphy_regdom(wiphy));
+        rcu_assign_pointer(wiphy->regd, NULL);
-        if (last_request)
+        if (lr)
-                request_wiphy = wiphy_idx_to_wiphy(last_request->wiphy_idx);
+                request_wiphy = wiphy_idx_to_wiphy(lr->wiphy_idx);
        if (!request_wiphy || request_wiphy != wiphy)
                goto out;
-        last_request->wiphy_idx = WIPHY_IDX_STALE;
+        lr->wiphy_idx = WIPHY_IDX_INVALID;
-        last_request->country_ie_env = ENVIRON_ANY;
+        lr->country_ie_env = ENVIRON_ANY;
 out:
        mutex_unlock(&reg_mutex);
 }
 static void reg_timeout_work(struct work_struct *work)
 {
-        REG_DBG_PRINT("Timeout while waiting for CRDA to reply, "
+        REG_DBG_PRINT("Timeout while waiting for CRDA to reply, restoring regulatory settings\n");
-                      "restoring regulatory settings\n");
        restore_regulatory_settings(true);
 }
@@ -2439,13 +2329,13 @@ int __init regulatory_init(void)
        reg_regdb_size_check();
-        cfg80211_regdomain = cfg80211_world_regdom;
+        rcu_assign_pointer(cfg80211_regdomain, cfg80211_world_regdom);
        user_alpha2[0] = '9';
        user_alpha2[1] = '7';
        /* We always try to get an update for the static regdomain */
-        err = regulatory_hint_core(cfg80211_regdomain->alpha2);
+        err = regulatory_hint_core(cfg80211_world_regdom->alpha2);
        if (err) {
                if (err == -ENOMEM)
                        return err;
@@ -2457,10 +2347,6 @@ int __init regulatory_init(void)
                 * errors as non-fatal.
                 */
                pr_err("kobject_uevent_env() was unable to call CRDA during init\n");
-#ifdef CONFIG_CFG80211_REG_DEBUG
-                /* We want to find out exactly why when debugging */
-                WARN_ON(err);
-#endif
        }
        /*
@@ -2474,7 +2360,7 @@ int __init regulatory_init(void)
        return 0;
 }
-void /* __init_or_exit */ regulatory_exit(void)
+void regulatory_exit(void)
 {
        struct regulatory_request *reg_request, *tmp;
        struct reg_beacon *reg_beacon, *btmp;
@@ -2482,43 +2368,27 @@ void /* __init_or_exit */ regulatory_exit(void)
        cancel_work_sync(&reg_work);
        cancel_delayed_work_sync(&reg_timeout);
-        mutex_lock(&cfg80211_mutex);
+        /* Lock to suppress warnings */
        mutex_lock(&reg_mutex);
+        reset_regdomains(true, NULL);
-        reset_regdomains(true);
+        mutex_unlock(&reg_mutex);
        dev_set_uevent_suppress(&reg_pdev->dev, true);
        platform_device_unregister(reg_pdev);
-        spin_lock_bh(&reg_pending_beacons_lock);
+        list_for_each_entry_safe(reg_beacon, btmp, &reg_pending_beacons, list) {
-        if (!list_empty(&reg_pending_beacons)) {
+                list_del(&reg_beacon->list);
-                list_for_each_entry_safe(reg_beacon, btmp,
+                kfree(reg_beacon);
-                                         &reg_pending_beacons, list) {
-                        list_del(&reg_beacon->list);
-                        kfree(reg_beacon);
-                }
        }
-        spin_unlock_bh(&reg_pending_beacons_lock);
-        if (!list_empty(&reg_beacon_list)) {
+        list_for_each_entry_safe(reg_beacon, btmp, &reg_beacon_list, list) {
-                list_for_each_entry_safe(reg_beacon, btmp,
+                list_del(&reg_beacon->list);
-                                         &reg_beacon_list, list) {
+                kfree(reg_beacon);
-                        list_del(&reg_beacon->list);
-                        kfree(reg_beacon);
-                }
        }
-        spin_lock(&reg_requests_lock);
+        list_for_each_entry_safe(reg_request, tmp, &reg_requests_list, list) {
-        if (!list_empty(&reg_requests_list)) {
+                list_del(&reg_request->list);
-                list_for_each_entry_safe(reg_request, tmp,
+                kfree(reg_request);
-                                         &reg_requests_list, list) {
-                        list_del(&reg_request->list);
-                        kfree(reg_request);
-                }
        }
-        spin_unlock(&reg_requests_lock);
-        mutex_unlock(&reg_mutex);
-        mutex_unlock(&cfg80211_mutex);
 }
diff --git a/net/wireless/reg.h b/net/wireless/reg.h
index 4c0a32ffd530..af2d5f8a5d82 100644
--- a/net/wireless/reg.h
+++ b/net/wireless/reg.h
@@ -16,10 +16,9 @@
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */
-extern const struct ieee80211_regdomain *cfg80211_regdomain;
+extern const struct ieee80211_regdomain __rcu *cfg80211_regdomain;
 bool is_world_regdom(const char *alpha2);
-bool reg_is_valid_request(const char *alpha2);
 bool reg_supported_dfs_region(u8 dfs_region);
 int regulatory_hint_user(const char *alpha2,
@@ -55,8 +54,8 @@ bool reg_last_request_cell_base(void);
 * set the wiphy->disable_beacon_hints to true.
 */
 int regulatory_hint_found_beacon(struct wiphy *wiphy,
-                                        struct ieee80211_channel *beacon_chan,
+                                 struct ieee80211_channel *beacon_chan,
-                                        gfp_t gfp);
+                                 gfp_t gfp);
 /**
 * regulatory_hint_11d - hints a country IE as a regulatory domain
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index f2431e41a373..a825dfe12cf7 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -192,7 +192,8 @@ static int cfg80211_conn_do_work(struct wireless_dev *wdev)
                                            prev_bssid,
                                            params->ssid, params->ssid_len,
                                            params->ie, params->ie_len,
-                                            false, &params->crypto,
+                                            params->mfp != NL80211_MFP_NO,
+                                            &params->crypto,
                                            params->flags, &params->ht_capa,
                                            &params->ht_capa_mask);
                if (err)
@@ -519,10 +520,8 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
         * - country_ie + 2, the start of the country ie data, and
         * - and country_ie[1] which is the IE length
         */
-        regulatory_hint_11d(wdev->wiphy,
+        regulatory_hint_11d(wdev->wiphy, bss->channel->band,
-                            bss->channel->band,
+                            country_ie + 2, country_ie[1]);
-                            country_ie + 2,
-                            country_ie[1]);
        kfree(country_ie);
 }
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 16d76a807c2f..1c2795d52db0 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -1184,7 +1184,8 @@ int cfg80211_can_use_iftype_chan(struct cfg80211_registered_device *rdev,
                                 struct wireless_dev *wdev,
                                 enum nl80211_iftype iftype,
                                 struct ieee80211_channel *chan,
-                                 enum cfg80211_chan_mode chanmode)
+                                 enum cfg80211_chan_mode chanmode,
+                                 u8 radar_detect)
 {
        struct wireless_dev *wdev_iter;
        u32 used_iftypes = BIT(iftype);
@@ -1195,14 +1196,45 @@ int cfg80211_can_use_iftype_chan(struct cfg80211_registered_device *rdev,
        enum cfg80211_chan_mode chmode;
        int num_different_channels = 0;
        int total = 1;
+        bool radar_required;
        int i, j;
        ASSERT_RTNL();
        lockdep_assert_held(&rdev->devlist_mtx);
+        if (WARN_ON(hweight32(radar_detect) > 1))
+                return -EINVAL;
+        switch (iftype) {
+        case NL80211_IFTYPE_ADHOC:
+        case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_AP_VLAN:
+        case NL80211_IFTYPE_MESH_POINT:
+        case NL80211_IFTYPE_P2P_GO:
+        case NL80211_IFTYPE_WDS:
+                radar_required = !!(chan->flags & IEEE80211_CHAN_RADAR);
+                break;
+        case NL80211_IFTYPE_P2P_CLIENT:
+        case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_MONITOR:
+                radar_required = false;
+                break;
+        case NL80211_IFTYPE_P2P_DEVICE:
+        case NUM_NL80211_IFTYPES:
+        case NL80211_IFTYPE_UNSPECIFIED:
+        default:
+                return -EINVAL;
+        }
+        if (radar_required && !radar_detect)
+                return -EINVAL;
        /* Always allow software iftypes */
-        if (rdev->wiphy.software_iftypes & BIT(iftype))
+        if (rdev->wiphy.software_iftypes & BIT(iftype)) {
+                if (radar_detect)
+                        return -EINVAL;
                return 0;
+        }
        memset(num, 0, sizeof(num));
        memset(used_channels, 0, sizeof(used_channels));
@@ -1275,7 +1307,7 @@ int cfg80211_can_use_iftype_chan(struct cfg80211_registered_device *rdev,
                used_iftypes |= BIT(wdev_iter->iftype);
        }
-        if (total == 1)
+        if (total == 1 && !radar_detect)
                return 0;
        for (i = 0; i < rdev->wiphy.n_iface_combinations; i++) {
@@ -1308,6 +1340,9 @@ int cfg80211_can_use_iftype_chan(struct cfg80211_registered_device *rdev,
                        }
                }
+                if (radar_detect && !(c->radar_detect_widths & radar_detect))
+                        goto cont;
                /*
                 * Finally check that all iftypes that we're currently
                 * using are actually part of this combination. If they
author	John W. Linville <linville@tuxdriver.com>	2013-01-28 14:43:00 -0500
committer	John W. Linville <linville@tuxdriver.com>	2013-01-28 14:43:00 -0500
commit	4205e6ef4ee747aa81930537b6035086ba5f1e28 (patch)
tree	b2ebe2b4621f5f531f283cb9bf0005cd3c04ca7b /net
parent	cef401de7be8c4e155c6746bfccf721a4fa5fab9 (diff)
parent	9ebea3829fac7505e0cd2642fbd13cfa9c038831 (diff)