Merge tag 'mac80211-next-for-john-2014-08-29' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next

Johannes Berg <johannes@sipsolutions.net> says:

"Not that much content this time. Some RCU cleanups, crypto
performance improvements, and various patches all over,
rather than listing them one might as well look into the
git log instead."

Signed-off-by: John W. Linville <linville@tuxdriver.com>

Conflicts:
	drivers/net/wireless/ath/wil6210/wmi.c

21 files changed, 179 insertions, 170 deletions

diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 927b4ea0128b..4d8989b87960 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1011,15 +1011,8 @@ static int sta_apply_parameters(struct ieee80211_local *local,
                         clear_sta_flag(sta, WLAN_STA_SHORT_PREAMBLE);
         }
 
-        if (mask & BIT(NL80211_STA_FLAG_WME)) {
-                if (set & BIT(NL80211_STA_FLAG_WME)) {
-                        set_sta_flag(sta, WLAN_STA_WME);
-                        sta->sta.wme = true;
-                } else {
-                        clear_sta_flag(sta, WLAN_STA_WME);
-                        sta->sta.wme = false;
-                }
-        }
+        if (mask & BIT(NL80211_STA_FLAG_WME))
+                sta->sta.wme = set & BIT(NL80211_STA_FLAG_WME);
 
         if (mask & BIT(NL80211_STA_FLAG_MFP)) {
                 if (set & BIT(NL80211_STA_FLAG_MFP))
@@ -3352,7 +3345,7 @@ static int ieee80211_probe_client(struct wiphy *wiphy, struct net_device *dev,
         band = chanctx_conf->def.chan->band;
         sta = sta_info_get_bss(sdata, peer);
         if (sta) {
-                qos = test_sta_flag(sta, WLAN_STA_WME);
+                qos = sta->sta.wme;
         } else {
                 rcu_read_unlock();
                 return -ENOLINK;
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index 0375009ddc0d..0da6f3a027e7 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -547,12 +547,12 @@ static void ieee80211_recalc_chanctx_chantype(struct ieee80211_local *local,
 
                 compat = cfg80211_chandef_compatible(
                                 &sdata->vif.bss_conf.chandef, compat);
-                if (!compat)
+                if (WARN_ON_ONCE(!compat))
                         break;
         }
         rcu_read_unlock();
 
-        if (WARN_ON_ONCE(!compat))
+        if (!compat)
                 return;
 
         ieee80211_change_chanctx(local, ctx, compat);
@@ -637,41 +637,6 @@ out:
         return ret;
 }
 
-static void __ieee80211_vif_release_channel(struct ieee80211_sub_if_data *sdata)
-{
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_chanctx_conf *conf;
-        struct ieee80211_chanctx *ctx;
-        bool use_reserved_switch = false;
-
-        lockdep_assert_held(&local->chanctx_mtx);
-
-        conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
-                                         lockdep_is_held(&local->chanctx_mtx));
-        if (!conf)
-                return;
-
-        ctx = container_of(conf, struct ieee80211_chanctx, conf);
-
-        if (sdata->reserved_chanctx) {
-                if (sdata->reserved_chanctx->replace_state ==
-                    IEEE80211_CHANCTX_REPLACES_OTHER &&
-                    ieee80211_chanctx_num_reserved(local,
-                                                   sdata->reserved_chanctx) > 1)
-                        use_reserved_switch = true;
-
-                ieee80211_vif_unreserve_chanctx(sdata);
-        }
-
-        ieee80211_assign_vif_chanctx(sdata, NULL);
-        if (ieee80211_chanctx_refcount(local, ctx) == 0)
-                ieee80211_free_chanctx(local, ctx);
-
-        /* Unreserving may ready an in-place reservation. */
-        if (use_reserved_switch)
-                ieee80211_vif_use_reserved_switch(local);
-}
-
 void ieee80211_recalc_smps_chanctx(struct ieee80211_local *local,
                                    struct ieee80211_chanctx *chanctx)
 {
@@ -762,63 +727,6 @@ void ieee80211_recalc_smps_chanctx(struct ieee80211_local *local,
         drv_change_chanctx(local, chanctx, IEEE80211_CHANCTX_CHANGE_RX_CHAINS);
 }
 
-int ieee80211_vif_use_channel(struct ieee80211_sub_if_data *sdata,
-                              const struct cfg80211_chan_def *chandef,
-                              enum ieee80211_chanctx_mode mode)
-{
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_chanctx *ctx;
-        u8 radar_detect_width = 0;
-        int ret;
-
-        lockdep_assert_held(&local->mtx);
-
-        WARN_ON(sdata->dev && netif_carrier_ok(sdata->dev));
-
-        mutex_lock(&local->chanctx_mtx);
-
-        ret = cfg80211_chandef_dfs_required(local->hw.wiphy,
-                                            chandef,
-                                            sdata->wdev.iftype);
-        if (ret < 0)
-                goto out;
-        if (ret > 0)
-                radar_detect_width = BIT(chandef->width);
-
-        sdata->radar_required = ret;
-
-        ret = ieee80211_check_combinations(sdata, chandef, mode,
-                                           radar_detect_width);
-        if (ret < 0)
-                goto out;
-
-        __ieee80211_vif_release_channel(sdata);
-
-        ctx = ieee80211_find_chanctx(local, chandef, mode);
-        if (!ctx)
-                ctx = ieee80211_new_chanctx(local, chandef, mode);
-        if (IS_ERR(ctx)) {
-                ret = PTR_ERR(ctx);
-                goto out;
-        }
-
-        sdata->vif.bss_conf.chandef = *chandef;
-
-        ret = ieee80211_assign_vif_chanctx(sdata, ctx);
-        if (ret) {
-                /* if assign fails refcount stays the same */
-                if (ieee80211_chanctx_refcount(local, ctx) == 0)
-                        ieee80211_free_chanctx(local, ctx);
-                goto out;
-        }
-
-        ieee80211_recalc_smps_chanctx(local, ctx);
-        ieee80211_recalc_radar_chanctx(local, ctx);
- out:
-        mutex_unlock(&local->chanctx_mtx);
-        return ret;
-}
-
 static void
 __ieee80211_vif_copy_chanctx_to_vlans(struct ieee80211_sub_if_data *sdata,
                                       bool clear)
@@ -1267,8 +1175,7 @@ err:
         return err;
 }
 
-int
-ieee80211_vif_use_reserved_switch(struct ieee80211_local *local)
+static int ieee80211_vif_use_reserved_switch(struct ieee80211_local *local)
 {
         struct ieee80211_sub_if_data *sdata, *sdata_tmp;
         struct ieee80211_chanctx *ctx, *ctx_tmp, *old_ctx;
@@ -1520,6 +1427,98 @@ err:
         return err;
 }
 
+static void __ieee80211_vif_release_channel(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_chanctx_conf *conf;
+        struct ieee80211_chanctx *ctx;
+        bool use_reserved_switch = false;
+
+        lockdep_assert_held(&local->chanctx_mtx);
+
+        conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
+                                         lockdep_is_held(&local->chanctx_mtx));
+        if (!conf)
+                return;
+
+        ctx = container_of(conf, struct ieee80211_chanctx, conf);
+
+        if (sdata->reserved_chanctx) {
+                if (sdata->reserved_chanctx->replace_state ==
+                    IEEE80211_CHANCTX_REPLACES_OTHER &&
+                    ieee80211_chanctx_num_reserved(local,
+                                                   sdata->reserved_chanctx) > 1)
+                        use_reserved_switch = true;
+
+                ieee80211_vif_unreserve_chanctx(sdata);
+        }
+
+        ieee80211_assign_vif_chanctx(sdata, NULL);
+        if (ieee80211_chanctx_refcount(local, ctx) == 0)
+                ieee80211_free_chanctx(local, ctx);
+
+        /* Unreserving may ready an in-place reservation. */
+        if (use_reserved_switch)
+                ieee80211_vif_use_reserved_switch(local);
+}
+
+int ieee80211_vif_use_channel(struct ieee80211_sub_if_data *sdata,
+                              const struct cfg80211_chan_def *chandef,
+                              enum ieee80211_chanctx_mode mode)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_chanctx *ctx;
+        u8 radar_detect_width = 0;
+        int ret;
+
+        lockdep_assert_held(&local->mtx);
+
+        WARN_ON(sdata->dev && netif_carrier_ok(sdata->dev));
+
+        mutex_lock(&local->chanctx_mtx);
+
+        ret = cfg80211_chandef_dfs_required(local->hw.wiphy,
+                                            chandef,
+                                            sdata->wdev.iftype);
+        if (ret < 0)
+                goto out;
+        if (ret > 0)
+                radar_detect_width = BIT(chandef->width);
+
+        sdata->radar_required = ret;
+
+        ret = ieee80211_check_combinations(sdata, chandef, mode,
+                                           radar_detect_width);
+        if (ret < 0)
+                goto out;
+
+        __ieee80211_vif_release_channel(sdata);
+
+        ctx = ieee80211_find_chanctx(local, chandef, mode);
+        if (!ctx)
+                ctx = ieee80211_new_chanctx(local, chandef, mode);
+        if (IS_ERR(ctx)) {
+                ret = PTR_ERR(ctx);
+                goto out;
+        }
+
+        sdata->vif.bss_conf.chandef = *chandef;
+
+        ret = ieee80211_assign_vif_chanctx(sdata, ctx);
+        if (ret) {
+                /* if assign fails refcount stays the same */
+                if (ieee80211_chanctx_refcount(local, ctx) == 0)
+                        ieee80211_free_chanctx(local, ctx);
+                goto out;
+        }
+
+        ieee80211_recalc_smps_chanctx(local, ctx);
+        ieee80211_recalc_radar_chanctx(local, ctx);
+ out:
+        mutex_unlock(&local->chanctx_mtx);
+        return ret;
+}
+
 int ieee80211_vif_use_reserved_context(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_local *local = sdata->local;
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index 3db96648b45a..4a20fb8f1e23 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -77,7 +77,8 @@ static ssize_t sta_flags_read(struct file *file, char __user *userbuf,
                             TEST(AUTH), TEST(ASSOC), TEST(PS_STA),
                             TEST(PS_DRIVER), TEST(AUTHORIZED),
                             TEST(SHORT_PREAMBLE),
-                            TEST(WME), TEST(WDS), TEST(CLEAR_PS_FILT),
+                            sta->sta.wme ? "WME\n" : "",
+                            TEST(WDS), TEST(CLEAR_PS_FILT),
                             TEST(MFP), TEST(BLOCK_BA), TEST(PSPOLL),
                             TEST(UAPSD), TEST(SP), TEST(TDLS_PEER),
                             TEST(TDLS_PEER_AUTH), TEST(4ADDR_EVENT),
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 9713dc54ea4b..5f9654d31a8d 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -1038,7 +1038,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                 }
 
                 if (sta && elems->wmm_info)
-                        set_sta_flag(sta, WLAN_STA_WME);
+                        sta->sta.wme = true;
 
                 if (sta && elems->ht_operation && elems->ht_cap_elem &&
                     sdata->u.ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index ef7a089ac546..ffb20e5e6cf3 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1869,7 +1869,6 @@ ieee80211_vif_reserve_chanctx(struct ieee80211_sub_if_data *sdata,
 int __must_check
 ieee80211_vif_use_reserved_context(struct ieee80211_sub_if_data *sdata);
 int ieee80211_vif_unreserve_chanctx(struct ieee80211_sub_if_data *sdata);
-int ieee80211_vif_use_reserved_switch(struct ieee80211_local *local);
 
 int __must_check
 ieee80211_vif_change_bandwidth(struct ieee80211_sub_if_data *sdata,
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index d808cff80153..6429d0e1d4a1 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -130,9 +130,7 @@ static int ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
         if (!ret) {
                 key->flags |= KEY_FLAG_UPLOADED_TO_HARDWARE;
 
-                if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) ||
-                      (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) ||
-                      (key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)))
+                if (!(key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC))
                         sdata->crypto_tx_tailroom_needed_cnt--;
 
                 WARN_ON((key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) &&
@@ -180,9 +178,7 @@ static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
         sta = key->sta;
         sdata = key->sdata;
 
-        if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) ||
-              (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) ||
-              (key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)))
+        if (!(key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC))
                 increment_tailroom_need_count(sdata);
 
         ret = drv_set_key(key->local, DISABLE_KEY, sdata,
@@ -878,9 +874,7 @@ void ieee80211_remove_key(struct ieee80211_key_conf *keyconf)
         if (key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) {
                 key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
 
-                if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) ||
-                      (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) ||
-                      (key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)))
+                if (!(key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC))
                         increment_tailroom_need_count(key->sdata);
         }
 
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index cf032a8db9d7..a6699dceae7c 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -729,7 +729,7 @@ void mesh_plink_broken(struct sta_info *sta)
         tbl = rcu_dereference(mesh_paths);
         for_each_mesh_entry(tbl, node, i) {
                 mpath = node->mpath;
-                if (rcu_dereference(mpath->next_hop) == sta &&
+                if (rcu_access_pointer(mpath->next_hop) == sta &&
                     mpath->flags & MESH_PATH_ACTIVE &&
                     !(mpath->flags & MESH_PATH_FIXED)) {
                         spin_lock_bh(&mpath->state_lock);
@@ -794,7 +794,7 @@ void mesh_path_flush_by_nexthop(struct sta_info *sta)
         tbl = resize_dereference_mesh_paths();
         for_each_mesh_entry(tbl, node, i) {
                 mpath = node->mpath;
-                if (rcu_dereference(mpath->next_hop) == sta) {
+                if (rcu_access_pointer(mpath->next_hop) == sta) {
                         spin_lock(&tbl->hashwlock[i]);
                         __mesh_path_del(tbl, node);
                         spin_unlock(&tbl->hashwlock[i]);
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index 63b874101b27..8f0887fc7128 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -431,14 +431,12 @@ __mesh_sta_info_alloc(struct ieee80211_sub_if_data *sdata, u8 *hw_addr)
                 return NULL;
 
         sta->plink_state = NL80211_PLINK_LISTEN;
+        sta->sta.wme = true;
 
         sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
         sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
         sta_info_pre_move_state(sta, IEEE80211_STA_AUTHORIZED);
 
-        set_sta_flag(sta, WLAN_STA_WME);
-        sta->sta.wme = true;
-
         return sta;
 }
 
@@ -1003,7 +1001,6 @@ mesh_process_plink_frame(struct ieee80211_sub_if_data *sdata,
         enum ieee80211_self_protected_actioncode ftype;
         u32 changed = 0;
         u8 ie_len = elems->peering_len;
-        __le16 _plid, _llid;
         u16 plid, llid = 0;
 
         if (!elems->peering) {
@@ -1038,13 +1035,10 @@ mesh_process_plink_frame(struct ieee80211_sub_if_data *sdata,
         /* Note the lines below are correct, the llid in the frame is the plid
          * from the point of view of this host.
          */
-        memcpy(&_plid, PLINK_GET_LLID(elems->peering), sizeof(__le16));
-        plid = le16_to_cpu(_plid);
+        plid = get_unaligned_le16(PLINK_GET_LLID(elems->peering));
         if (ftype == WLAN_SP_MESH_PEERING_CONFIRM ||
-            (ftype == WLAN_SP_MESH_PEERING_CLOSE && ie_len == 8)) {
-                memcpy(&_llid, PLINK_GET_PLID(elems->peering), sizeof(__le16));
-                llid = le16_to_cpu(_llid);
-        }
+            (ftype == WLAN_SP_MESH_PEERING_CLOSE && ie_len == 8))
+                llid = get_unaligned_le16(PLINK_GET_PLID(elems->peering));
 
         /* WARNING: Only for sta pointer, is dropped & re-acquired */
         rcu_read_lock();
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 31a8afaf7332..29fe91d6a094 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -149,6 +149,7 @@ static u32
 ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
                              struct ieee80211_supported_band *sband,
                              struct ieee80211_channel *channel,
+                             const struct ieee80211_ht_cap *ht_cap,
                              const struct ieee80211_ht_operation *ht_oper,
                              const struct ieee80211_vht_operation *vht_oper,
                              struct cfg80211_chan_def *chandef, bool tracking)
@@ -162,13 +163,19 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
         chandef->center_freq1 = channel->center_freq;
         chandef->center_freq2 = 0;
 
-        if (!ht_oper || !sband->ht_cap.ht_supported) {
+        if (!ht_cap || !ht_oper || !sband->ht_cap.ht_supported) {
                 ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
                 goto out;
         }
 
         chandef->width = NL80211_CHAN_WIDTH_20;
 
+        if (!(ht_cap->cap_info &
+              cpu_to_le16(IEEE80211_HT_CAP_SUP_WIDTH_20_40))) {
+                ret = IEEE80211_STA_DISABLE_40MHZ | IEEE80211_STA_DISABLE_VHT;
+                goto out;
+        }
+
         ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
                                                   channel->band);
         /* check that channel matches the right operating channel */
@@ -328,6 +335,7 @@ out:
 
 static int ieee80211_config_bw(struct ieee80211_sub_if_data *sdata,
                                struct sta_info *sta,
+                               const struct ieee80211_ht_cap *ht_cap,
                                const struct ieee80211_ht_operation *ht_oper,
                                const struct ieee80211_vht_operation *vht_oper,
                                const u8 *bssid, u32 *changed)
@@ -367,8 +375,9 @@ static int ieee80211_config_bw(struct ieee80211_sub_if_data *sdata,
         sband = local->hw.wiphy->bands[chan->band];
 
         /* calculate new channel (type) based on HT/VHT operation IEs */
-        flags = ieee80211_determine_chantype(sdata, sband, chan, ht_oper,
-                                             vht_oper, &chandef, true);
+        flags = ieee80211_determine_chantype(sdata, sband, chan,
+                                             ht_cap, ht_oper, vht_oper,
+                                             &chandef, true);
 
         /*
          * Downgrade the new channel if we associated with restricted
@@ -2677,8 +2686,7 @@ static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
         if (ifmgd->flags & IEEE80211_STA_MFP_ENABLED)
                 set_sta_flag(sta, WLAN_STA_MFP);
 
-        if (elems.wmm_param)
-                set_sta_flag(sta, WLAN_STA_WME);
+        sta->sta.wme = elems.wmm_param;
 
         err = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
         if (!err && !(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
@@ -3174,7 +3182,8 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
         mutex_lock(&local->sta_mtx);
         sta = sta_info_get(sdata, bssid);
 
-        if (ieee80211_config_bw(sdata, sta, elems.ht_operation,
+        if (ieee80211_config_bw(sdata, sta,
+                                elems.ht_cap_elem, elems.ht_operation,
                                 elems.vht_operation, bssid, &changed)) {
                 mutex_unlock(&local->sta_mtx);
                 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
@@ -3808,6 +3817,7 @@ static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        const struct ieee80211_ht_cap *ht_cap = NULL;
         const struct ieee80211_ht_operation *ht_oper = NULL;
         const struct ieee80211_vht_operation *vht_oper = NULL;
         struct ieee80211_supported_band *sband;
@@ -3824,14 +3834,17 @@ static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
 
         if (!(ifmgd->flags & IEEE80211_STA_DISABLE_HT) &&
             sband->ht_cap.ht_supported) {
-                const u8 *ht_oper_ie, *ht_cap;
+                const u8 *ht_oper_ie, *ht_cap_ie;
 
                 ht_oper_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_OPERATION);
                 if (ht_oper_ie && ht_oper_ie[1] >= sizeof(*ht_oper))
                         ht_oper = (void *)(ht_oper_ie + 2);
 
-                ht_cap = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
-                if (!ht_cap || ht_cap[1] < sizeof(struct ieee80211_ht_cap)) {
+                ht_cap_ie = ieee80211_bss_get_ie(cbss, WLAN_EID_HT_CAPABILITY);
+                if (ht_cap_ie && ht_cap_ie[1] >= sizeof(*ht_cap))
+                        ht_cap = (void *)(ht_cap_ie + 2);
+
+                if (!ht_cap) {
                         ifmgd->flags |= IEEE80211_STA_DISABLE_HT;
                         ht_oper = NULL;
                 }
@@ -3862,7 +3875,7 @@ static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
 
         ifmgd->flags |= ieee80211_determine_chantype(sdata, sband,
                                                      cbss->channel,
-                                                     ht_oper, vht_oper,
+                                                     ht_cap, ht_oper, vht_oper,
                                                      &chandef, false);
 
         sdata->needed_rx_chains = min(ieee80211_ht_vht_rx_chains(sdata, cbss),
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index bd2c9b22c945..a8d862f9183c 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2725,7 +2725,7 @@ ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx)
                 sig = status->signal;
 
         if (cfg80211_rx_mgmt(&rx->sdata->wdev, status->freq, sig,
-                             rx->skb->data, rx->skb->len, 0, GFP_ATOMIC)) {
+                             rx->skb->data, rx->skb->len, 0)) {
                 if (rx->sta)
                         rx->sta->rx_packets++;
                 dev_kfree_skb(rx->skb);
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index a0a938145dcc..a9bb6eb8c3e0 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -1094,7 +1094,7 @@ int ieee80211_request_sched_scan_stop(struct ieee80211_sub_if_data *sdata)
         if (rcu_access_pointer(local->sched_scan_sdata)) {
                 ret = drv_sched_scan_stop(local, sdata);
                 if (!ret)
-                        rcu_assign_pointer(local->sched_scan_sdata, NULL);
+                        RCU_INIT_POINTER(local->sched_scan_sdata, NULL);
         }
 out:
         mutex_unlock(&local->mtx);
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index c6ee2139fbc5..e1f957d5935e 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -1179,7 +1179,7 @@ static void ieee80211_send_null_response(struct ieee80211_sub_if_data *sdata,
         struct sk_buff *skb;
         int size = sizeof(*nullfunc);
         __le16 fc;
-        bool qos = test_sta_flag(sta, WLAN_STA_WME);
+        bool qos = sta->sta.wme;
         struct ieee80211_tx_info *info;
         struct ieee80211_chanctx_conf *chanctx_conf;
 
@@ -1834,7 +1834,7 @@ void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
                 sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_AUTHORIZED);
         if (test_sta_flag(sta, WLAN_STA_SHORT_PREAMBLE))
                 sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_SHORT_PREAMBLE);
-        if (test_sta_flag(sta, WLAN_STA_WME))
+        if (sta->sta.wme)
                 sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_WME);
         if (test_sta_flag(sta, WLAN_STA_MFP))
                 sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_MFP);
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index d411bcc8ef08..89c40d5c0633 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -31,7 +31,6 @@
  *      when virtual port control is not in use.
  * @WLAN_STA_SHORT_PREAMBLE: Station is capable of receiving short-preamble
  *      frames.
- * @WLAN_STA_WME: Station is a QoS-STA.
  * @WLAN_STA_WDS: Station is one of our WDS peers.
  * @WLAN_STA_CLEAR_PS_FILT: Clear PS filter in hardware (using the
  *      IEEE80211_TX_CTL_CLEAR_PS_FILT control flag) when the next
@@ -69,7 +68,6 @@ enum ieee80211_sta_info_flags {
         WLAN_STA_PS_STA,
         WLAN_STA_AUTHORIZED,
         WLAN_STA_SHORT_PREAMBLE,
-        WLAN_STA_WME,
         WLAN_STA_WDS,
         WLAN_STA_CLEAR_PS_FILT,
         WLAN_STA_MFP,
diff --git a/net/mac80211/tdls.c b/net/mac80211/tdls.c
index 1b21050be174..f2cb3b6c1871 100644
--- a/net/mac80211/tdls.c
+++ b/net/mac80211/tdls.c
@@ -316,8 +316,7 @@ ieee80211_tdls_add_setup_cfm_ies(struct ieee80211_sub_if_data *sdata,
         }
 
         /* add the QoS param IE if both the peer and we support it */
-        if (local->hw.queues >= IEEE80211_NUM_ACS &&
-            test_sta_flag(sta, WLAN_STA_WME))
+        if (local->hw.queues >= IEEE80211_NUM_ACS && sta->sta.wme)
                 ieee80211_tdls_add_wmm_param_ie(sdata, skb);
 
         /* add any custom IEs that go before HT operation */
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 464106c023d8..925c39f4099e 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1478,7 +1478,10 @@ static int ieee80211_skb_resize(struct ieee80211_sub_if_data *sdata,
                 tail_need = max_t(int, tail_need, 0);
         }
 
-        if (skb_cloned(skb))
+        if (skb_cloned(skb) &&
+            (!(local->hw.flags & IEEE80211_HW_SUPPORTS_CLONED_SKBS) ||
+             !skb_clone_writable(skb, ETH_HLEN) ||
+             sdata->crypto_tx_tailroom_needed_cnt))
                 I802_DEBUG_INC(local->tx_expand_skb_head_cloned);
         else if (head_need || tail_need)
                 I802_DEBUG_INC(local->tx_expand_skb_head);
@@ -1844,7 +1847,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                         memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
                         hdrlen = 30;
                         authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
-                        wme_sta = test_sta_flag(sta, WLAN_STA_WME);
+                        wme_sta = sta->sta.wme;
                 }
                 ap_sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
                                         u.ap);
@@ -1957,7 +1960,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                         if (sta) {
                                 authorized = test_sta_flag(sta,
                                                         WLAN_STA_AUTHORIZED);
-                                wme_sta = test_sta_flag(sta, WLAN_STA_WME);
+                                wme_sta = sta->sta.wme;
                                 tdls_peer = test_sta_flag(sta,
                                                           WLAN_STA_TDLS_PEER);
                                 tdls_auth = test_sta_flag(sta,
@@ -2035,7 +2038,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                 sta = sta_info_get(sdata, hdr.addr1);
                 if (sta) {
                         authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
-                        wme_sta = test_sta_flag(sta, WLAN_STA_WME);
+                        wme_sta = sta->sta.wme;
                 }
         }
 
diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c
index d51422c778de..6459946f0b74 100644
--- a/net/mac80211/wme.c
+++ b/net/mac80211/wme.c
@@ -118,7 +118,7 @@ u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
         case NL80211_IFTYPE_AP_VLAN:
                 sta = rcu_dereference(sdata->u.vlan.sta);
                 if (sta) {
-                        qos = test_sta_flag(sta, WLAN_STA_WME);
+                        qos = sta->sta.wme;
                         break;
                 }
         case NL80211_IFTYPE_AP:
@@ -145,7 +145,7 @@ u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
         if (!sta && ra && !is_multicast_ether_addr(ra)) {
                 sta = sta_info_get(sdata, ra);
                 if (sta)
-                        qos = test_sta_flag(sta, WLAN_STA_WME);
+                        qos = sta->sta.wme;
         }
         rcu_read_unlock();
 
diff --git a/net/rfkill/rfkill-gpio.c b/net/rfkill/rfkill-gpio.c
index 14c98e48f261..02a86a27fd84 100644
--- a/net/rfkill/rfkill-gpio.c
+++ b/net/rfkill/rfkill-gpio.c
@@ -158,6 +158,7 @@ static const struct acpi_device_id rfkill_acpi_match[] = {
         { "BCM2E1A", RFKILL_TYPE_BLUETOOTH },
         { "BCM2E39", RFKILL_TYPE_BLUETOOTH },
         { "BCM2E3D", RFKILL_TYPE_BLUETOOTH },
+        { "BCM2E64", RFKILL_TYPE_BLUETOOTH },
         { "BCM4752", RFKILL_TYPE_GPS },
         { "LNV4752", RFKILL_TYPE_GPS },
         { },
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 682babde4aa5..c6620aa679e0 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -492,12 +492,6 @@ int wiphy_register(struct wiphy *wiphy)
         int i;
         u16 ifmodes = wiphy->interface_modes;
 
-        /*
-         * There are major locking problems in nl80211/mac80211 for CSA,
-         * disable for all drivers until this has been reworked.
-         */
-        wiphy->flags &= ~WIPHY_FLAG_HAS_CHANNEL_SWITCH;
-
 #ifdef CONFIG_PM
         if (WARN_ON(wiphy->wowlan &&
                     (wiphy->wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 266766b8d80b..369fc334fdad 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -605,7 +605,7 @@ int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
 }
 
 bool cfg80211_rx_mgmt(struct wireless_dev *wdev, int freq, int sig_mbm,
-                      const u8 *buf, size_t len, u32 flags, gfp_t gfp)
+                      const u8 *buf, size_t len, u32 flags)
 {
         struct wiphy *wiphy = wdev->wiphy;
         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
@@ -648,7 +648,7 @@ bool cfg80211_rx_mgmt(struct wireless_dev *wdev, int freq, int sig_mbm,
                 /* Indicate the received Action frame to user space */
                 if (nl80211_send_mgmt(rdev, wdev, reg->nlportid,
                                       freq, sig_mbm,
-                                      buf, len, flags, gfp))
+                                      buf, len, flags, GFP_ATOMIC))
                         continue;
 
                 result = true;
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index df7b1332a1ec..3011401f52c0 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -6033,7 +6033,6 @@ static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
         const struct cfg80211_bss_ies *ies;
         void *hdr;
         struct nlattr *bss;
-        bool tsf = false;
 
         ASSERT_WDEV_LOCK(wdev);
 
@@ -6060,18 +6059,27 @@ static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
                 goto nla_put_failure;
 
         rcu_read_lock();
+        /* indicate whether we have probe response data or not */
+        if (rcu_access_pointer(res->proberesp_ies) &&
+            nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
+                goto fail_unlock_rcu;
+
+        /* this pointer prefers to be pointed to probe response data
+         * but is always valid
+         */
         ies = rcu_dereference(res->ies);
         if (ies) {
                 if (nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
                         goto fail_unlock_rcu;
-                tsf = true;
                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
                                         ies->len, ies->data))
                         goto fail_unlock_rcu;
         }
+
+        /* and this pointer is always (unless driver didn't know) beacon data */
         ies = rcu_dereference(res->beacon_ies);
-        if (ies) {
-                if (!tsf && nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
+        if (ies && ies->from_beacon) {
+                if (nla_put_u64(msg, NL80211_BSS_BEACON_TSF, ies->tsf))
                         goto fail_unlock_rcu;
                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
                                         ies->len, ies->data))
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 0798c62e6085..620a4b40d466 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -884,6 +884,7 @@ struct cfg80211_bss*
 cfg80211_inform_bss_width(struct wiphy *wiphy,
                           struct ieee80211_channel *rx_channel,
                           enum nl80211_bss_scan_width scan_width,
+                          enum cfg80211_bss_frame_type ftype,
                           const u8 *bssid, u64 tsf, u16 capability,
                           u16 beacon_interval, const u8 *ie, size_t ielen,
                           s32 signal, gfp_t gfp)
@@ -911,21 +912,32 @@ cfg80211_inform_bss_width(struct wiphy *wiphy,
         tmp.pub.beacon_interval = beacon_interval;
         tmp.pub.capability = capability;
         /*
-         * Since we do not know here whether the IEs are from a Beacon or Probe
+         * If we do not know here whether the IEs are from a Beacon or Probe
          * Response frame, we need to pick one of the options and only use it
          * with the driver that does not provide the full Beacon/Probe Response
          * frame. Use Beacon frame pointer to avoid indicating that this should
          * override the IEs pointer should we have received an earlier
          * indication of Probe Response data.
          */
-        ies = kmalloc(sizeof(*ies) + ielen, gfp);
+        ies = kzalloc(sizeof(*ies) + ielen, gfp);
         if (!ies)
                 return NULL;
         ies->len = ielen;
         ies->tsf = tsf;
+        ies->from_beacon = false;
         memcpy(ies->data, ie, ielen);
 
-        rcu_assign_pointer(tmp.pub.beacon_ies, ies);
+        switch (ftype) {
+        case CFG80211_BSS_FTYPE_BEACON:
+                ies->from_beacon = true;
+                /* fall through to assign */
+        case CFG80211_BSS_FTYPE_UNKNOWN:
+                rcu_assign_pointer(tmp.pub.beacon_ies, ies);
+                break;
+        case CFG80211_BSS_FTYPE_PRESP:
+                rcu_assign_pointer(tmp.pub.proberesp_ies, ies);
+                break;
+        }
         rcu_assign_pointer(tmp.pub.ies, ies);
 
         signal_valid = abs(rx_channel->center_freq - channel->center_freq) <=
@@ -982,11 +994,12 @@ cfg80211_inform_bss_width_frame(struct wiphy *wiphy,
         if (!channel)
                 return NULL;
 
-        ies = kmalloc(sizeof(*ies) + ielen, gfp);
+        ies = kzalloc(sizeof(*ies) + ielen, gfp);
         if (!ies)
                 return NULL;
         ies->len = ielen;
         ies->tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
+        ies->from_beacon = ieee80211_is_beacon(mgmt->frame_control);
         memcpy(ies->data, mgmt->u.probe_resp.variable, ielen);
 
         if (ieee80211_is_probe_resp(mgmt->frame_control))