1 files changed, 246 insertions, 152 deletions

diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 05f3a313db88..c46d4ee1c298 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -372,10 +372,11 @@ static int ieee80211_config_default_mgmt_key(struct wiphy *wiphy,
 
 static void rate_idx_to_bitrate(struct rate_info *rate, struct sta_info *sta, int idx)
 {
+        enum ieee80211_band band = ieee80211_get_sdata_band(sta->sdata);
+
         if (!(rate->flags & RATE_INFO_FLAGS_MCS)) {
                 struct ieee80211_supported_band *sband;
-                sband = sta->local->hw.wiphy->bands[
-                                sta->local->oper_channel->band];
+                sband = sta->local->hw.wiphy->bands[band];
                 rate->legacy = sband->bitrates[idx].bitrate;
         } else
                 rate->mcs = idx;
@@ -532,6 +533,8 @@ static void ieee80211_get_et_stats(struct wiphy *wiphy,
                                    u64 *data)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_chanctx_conf *chanctx_conf;
+        struct ieee80211_channel *channel;
         struct sta_info *sta;
         struct ieee80211_local *local = sdata->local;
         struct station_info sinfo;
@@ -607,19 +610,26 @@ static void ieee80211_get_et_stats(struct wiphy *wiphy,
 do_survey:
         i = STA_STATS_LEN - STA_STATS_SURVEY_LEN;
         /* Get survey stats for current channel */
-        q = 0;
-        while (true) {
-                survey.filled = 0;
-                if (drv_get_survey(local, q, &survey) != 0) {
-                        survey.filled = 0;
-                        break;
-                }
+        survey.filled = 0;
 
-                if (survey.channel &&
-                    (local->oper_channel->center_freq ==
-                     survey.channel->center_freq))
-                        break;
-                q++;
+        rcu_read_lock();
+        chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
+        if (chanctx_conf)
+                channel = chanctx_conf->channel;
+        else
+                channel = NULL;
+        rcu_read_unlock();
+
+        if (channel) {
+                q = 0;
+                do {
+                        survey.filled = 0;
+                        if (drv_get_survey(local, q, &survey) != 0) {
+                                survey.filled = 0;
+                                break;
+                        }
+                        q++;
+                } while (channel != survey.channel);
         }
 
         if (survey.filled)
@@ -724,47 +734,42 @@ static int ieee80211_get_station(struct wiphy *wiphy, struct net_device *dev,
         return ret;
 }
 
-static int ieee80211_set_channel(struct wiphy *wiphy,
-                                 struct net_device *netdev,
-                                 struct ieee80211_channel *chan,
-                                 enum nl80211_channel_type channel_type)
+static int ieee80211_set_monitor_channel(struct wiphy *wiphy,
+                                         struct ieee80211_channel *chan,
+                                         enum nl80211_channel_type channel_type)
 {
         struct ieee80211_local *local = wiphy_priv(wiphy);
-        struct ieee80211_sub_if_data *sdata = NULL;
-
-        if (netdev)
-                sdata = IEEE80211_DEV_TO_SUB_IF(netdev);
-
-        switch (ieee80211_get_channel_mode(local, NULL)) {
-        case CHAN_MODE_HOPPING:
-                return -EBUSY;
-        case CHAN_MODE_FIXED:
-                if (local->oper_channel != chan ||
-                    (!sdata && local->_oper_channel_type != channel_type))
-                        return -EBUSY;
-                if (!sdata && local->_oper_channel_type == channel_type)
-                        return 0;
-                break;
-        case CHAN_MODE_UNDEFINED:
-                break;
-        }
-
-        if (!ieee80211_set_channel_type(local, sdata, channel_type))
-                return -EBUSY;
+        struct ieee80211_sub_if_data *sdata;
+        int ret = 0;
 
-        local->oper_channel = chan;
+        if (local->monitor_channel == chan &&
+            local->monitor_channel_type == channel_type)
+                return 0;
 
-        /* auto-detects changes */
-        ieee80211_hw_config(local, 0);
+        mutex_lock(&local->iflist_mtx);
+        if (local->use_chanctx) {
+                sdata = rcu_dereference_protected(
+                                local->monitor_sdata,
+                                lockdep_is_held(&local->iflist_mtx));
+                if (sdata) {
+                        ieee80211_vif_release_channel(sdata);
+                        ret = ieee80211_vif_use_channel(
+                                        sdata, chan, channel_type,
+                                        IEEE80211_CHANCTX_EXCLUSIVE);
+                }
+        } else if (local->open_count == local->monitors) {
+                local->_oper_channel = chan;
+                local->_oper_channel_type = channel_type;
+                ieee80211_hw_config(local, 0);
+        }
 
-        return 0;
-}
+        if (ret == 0) {
+                local->monitor_channel = chan;
+                local->monitor_channel_type = channel_type;
+        }
+        mutex_unlock(&local->iflist_mtx);
 
-static int ieee80211_set_monitor_channel(struct wiphy *wiphy,
-                                         struct ieee80211_channel *chan,
-                                         enum nl80211_channel_type channel_type)
-{
-        return ieee80211_set_channel(wiphy, NULL, chan, channel_type);
+        return ret;
 }
 
 static int ieee80211_set_probe_resp(struct ieee80211_sub_if_data *sdata,
@@ -879,8 +884,13 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
         if (old)
                 return -EALREADY;
 
-        err = ieee80211_set_channel(wiphy, dev, params->channel,
-                                    params->channel_type);
+        /* TODO: make hostapd tell us what it wants */
+        sdata->smps_mode = IEEE80211_SMPS_OFF;
+        sdata->needed_rx_chains = sdata->local->rx_chains;
+
+        err = ieee80211_vif_use_channel(sdata, params->channel,
+                                        params->channel_type,
+                                        IEEE80211_CHANCTX_SHARED);
         if (err)
                 return err;
 
@@ -912,6 +922,15 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
                 return err;
         changed |= err;
 
+        err = drv_start_ap(sdata->local, sdata);
+        if (err) {
+                old = rtnl_dereference(sdata->u.ap.beacon);
+                if (old)
+                        kfree_rcu(old, rcu_head);
+                RCU_INIT_POINTER(sdata->u.ap.beacon, NULL);
+                return err;
+        }
+
         ieee80211_bss_info_change_notify(sdata, changed);
 
         netif_carrier_on(dev);
@@ -943,26 +962,40 @@ static int ieee80211_change_beacon(struct wiphy *wiphy, struct net_device *dev,
 
 static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
 {
-        struct ieee80211_sub_if_data *sdata, *vlan;
-        struct beacon_data *old;
-
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_sub_if_data *vlan;
+        struct ieee80211_local *local = sdata->local;
+        struct beacon_data *old_beacon;
+        struct probe_resp *old_probe_resp;
 
-        old = rtnl_dereference(sdata->u.ap.beacon);
-        if (!old)
+        old_beacon = rtnl_dereference(sdata->u.ap.beacon);
+        if (!old_beacon)
                 return -ENOENT;
+        old_probe_resp = rtnl_dereference(sdata->u.ap.probe_resp);
 
+        /* turn off carrier for this interface and dependent VLANs */
         list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
                 netif_carrier_off(vlan->dev);
         netif_carrier_off(dev);
 
+        /* remove beacon and probe response */
         RCU_INIT_POINTER(sdata->u.ap.beacon, NULL);
+        RCU_INIT_POINTER(sdata->u.ap.probe_resp, NULL);
+        kfree_rcu(old_beacon, rcu_head);
+        if (old_probe_resp)
+                kfree_rcu(old_probe_resp, rcu_head);
 
-        kfree_rcu(old, rcu_head);
-
-        sta_info_flush(sdata->local, sdata);
+        sta_info_flush(local, sdata);
         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED);
 
+        drv_stop_ap(sdata->local, sdata);
+
+        /* free all potentially still buffered bcast frames */
+        local->total_ps_buffered -= skb_queue_len(&sdata->u.ap.ps.bc_buf);
+        skb_queue_purge(&sdata->u.ap.ps.bc_buf);
+
+        ieee80211_vif_release_channel(sdata);
+
         return 0;
 }
 
@@ -1019,9 +1052,10 @@ static int sta_apply_parameters(struct ieee80211_local *local,
         int i, j;
         struct ieee80211_supported_band *sband;
         struct ieee80211_sub_if_data *sdata = sta->sdata;
+        enum ieee80211_band band = ieee80211_get_sdata_band(sdata);
         u32 mask, set;
 
-        sband = local->hw.wiphy->bands[local->oper_channel->band];
+        sband = local->hw.wiphy->bands[band];
 
         mask = params->sta_flags_mask;
         set = params->sta_flags_set;
@@ -1136,7 +1170,7 @@ static int sta_apply_parameters(struct ieee80211_local *local,
                                         rates |= BIT(j);
                         }
                 }
-                sta->sta.supp_rates[local->oper_channel->band] = rates;
+                sta->sta.supp_rates[band] = rates;
         }
 
         if (params->ht_capa)
@@ -1144,6 +1178,11 @@ static int sta_apply_parameters(struct ieee80211_local *local,
                                                   params->ht_capa,
                                                   &sta->sta.ht_cap);
 
+        if (params->vht_capa)
+                ieee80211_vht_cap_ie_to_sta_vht_cap(sdata, sband,
+                                                    params->vht_capa,
+                                                    &sta->sta.vht_cap);
+
         if (ieee80211_vif_is_mesh(&sdata->vif)) {
 #ifdef CONFIG_MAC80211_MESH
                 if (sdata->u.mesh.security & IEEE80211_MESH_SEC_SECURED)
@@ -1664,8 +1703,13 @@ static int ieee80211_join_mesh(struct wiphy *wiphy, struct net_device *dev,
         if (err)
                 return err;
 
-        err = ieee80211_set_channel(wiphy, dev, setup->channel,
-                                    setup->channel_type);
+        /* can mesh use other SMPS modes? */
+        sdata->smps_mode = IEEE80211_SMPS_OFF;
+        sdata->needed_rx_chains = sdata->local->rx_chains;
+
+        err = ieee80211_vif_use_channel(sdata, setup->channel,
+                                        setup->channel_type,
+                                        IEEE80211_CHANCTX_SHARED);
         if (err)
                 return err;
 
@@ -1679,6 +1723,7 @@ static int ieee80211_leave_mesh(struct wiphy *wiphy, struct net_device *dev)
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
         ieee80211_stop_mesh(sdata);
+        ieee80211_vif_release_channel(sdata);
 
         return 0;
 }
@@ -1688,10 +1733,14 @@ static int ieee80211_change_bss(struct wiphy *wiphy,
                                 struct net_device *dev,
                                 struct bss_parameters *params)
 {
-        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        enum ieee80211_band band;
         u32 changed = 0;
 
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        if (!rtnl_dereference(sdata->u.ap.beacon))
+                return -ENOENT;
+
+        band = ieee80211_get_sdata_band(sdata);
 
         if (params->use_cts_prot >= 0) {
                 sdata->vif.bss_conf.use_cts_prot = params->use_cts_prot;
@@ -1704,7 +1753,7 @@ static int ieee80211_change_bss(struct wiphy *wiphy,
         }
 
         if (!sdata->vif.bss_conf.use_short_slot &&
-            sdata->local->oper_channel->band == IEEE80211_BAND_5GHZ) {
+            band == IEEE80211_BAND_5GHZ) {
                 sdata->vif.bss_conf.use_short_slot = true;
                 changed |= BSS_CHANGED_ERP_SLOT;
         }
@@ -1718,9 +1767,7 @@ static int ieee80211_change_bss(struct wiphy *wiphy,
         if (params->basic_rates) {
                 int i, j;
                 u32 rates = 0;
-                struct ieee80211_local *local = wiphy_priv(wiphy);
-                struct ieee80211_supported_band *sband =
-                        wiphy->bands[local->oper_channel->band];
+                struct ieee80211_supported_band *sband = wiphy->bands[band];
 
                 for (i = 0; i < params->basic_rates_len; i++) {
                         int rate = (params->basic_rates[i] & 0x7f) * 5;
@@ -1829,7 +1876,16 @@ static int ieee80211_scan(struct wiphy *wiphy,
                  * beaconing hasn't been configured yet
                  */
         case NL80211_IFTYPE_AP:
-                if (sdata->u.ap.beacon)
+                /*
+                 * If the scan has been forced (and the driver supports
+                 * forcing), don't care about being beaconing already.
+                 * This will create problems to the attached stations (e.g. all
+                 * the  frames sent while scanning on other channel will be
+                 * lost)
+                 */
+                if (sdata->u.ap.beacon &&
+                    (!(wiphy->features & NL80211_FEATURE_AP_SCAN) ||
+                     !(req->flags & NL80211_SCAN_FLAG_AP)))
                         return -EOPNOTSUPP;
                 break;
         default:
@@ -1872,20 +1928,6 @@ static int ieee80211_auth(struct wiphy *wiphy, struct net_device *dev,
 static int ieee80211_assoc(struct wiphy *wiphy, struct net_device *dev,
                            struct cfg80211_assoc_request *req)
 {
-        struct ieee80211_local *local = wiphy_priv(wiphy);
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
-        switch (ieee80211_get_channel_mode(local, sdata)) {
-        case CHAN_MODE_HOPPING:
-                return -EBUSY;
-        case CHAN_MODE_FIXED:
-                if (local->oper_channel == req->bss->channel)
-                        break;
-                return -EBUSY;
-        case CHAN_MODE_UNDEFINED:
-                break;
-        }
-
         return ieee80211_mgd_assoc(IEEE80211_DEV_TO_SUB_IF(dev), req);
 }
 
@@ -1904,30 +1946,22 @@ static int ieee80211_disassoc(struct wiphy *wiphy, struct net_device *dev,
 static int ieee80211_join_ibss(struct wiphy *wiphy, struct net_device *dev,
                                struct cfg80211_ibss_params *params)
 {
-        struct ieee80211_local *local = wiphy_priv(wiphy);
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
-        switch (ieee80211_get_channel_mode(local, sdata)) {
-        case CHAN_MODE_HOPPING:
-                return -EBUSY;
-        case CHAN_MODE_FIXED:
-                if (!params->channel_fixed)
-                        return -EBUSY;
-                if (local->oper_channel == params->channel)
-                        break;
-                return -EBUSY;
-        case CHAN_MODE_UNDEFINED:
-                break;
-        }
-
-        return ieee80211_ibss_join(sdata, params);
+        return ieee80211_ibss_join(IEEE80211_DEV_TO_SUB_IF(dev), params);
 }
 
 static int ieee80211_leave_ibss(struct wiphy *wiphy, struct net_device *dev)
 {
+        return ieee80211_ibss_leave(IEEE80211_DEV_TO_SUB_IF(dev));
+}
+
+static int ieee80211_set_mcast_rate(struct wiphy *wiphy, struct net_device *dev,
+                                    int rate[IEEE80211_NUM_BANDS])
+{
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        return ieee80211_ibss_leave(sdata);
+        memcpy(sdata->vif.bss_conf.mcast_rate, rate, sizeof(rate));
+
+        return 0;
 }
 
 static int ieee80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
@@ -1968,41 +2002,65 @@ static int ieee80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
 }
 
 static int ieee80211_set_tx_power(struct wiphy *wiphy,
+                                  struct wireless_dev *wdev,
                                   enum nl80211_tx_power_setting type, int mbm)
 {
         struct ieee80211_local *local = wiphy_priv(wiphy);
-        struct ieee80211_channel *chan = local->oper_channel;
-        u32 changes = 0;
+        struct ieee80211_sub_if_data *sdata;
+
+        if (wdev) {
+                sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
+
+                switch (type) {
+                case NL80211_TX_POWER_AUTOMATIC:
+                        sdata->user_power_level = IEEE80211_UNSET_POWER_LEVEL;
+                        break;
+                case NL80211_TX_POWER_LIMITED:
+                case NL80211_TX_POWER_FIXED:
+                        if (mbm < 0 || (mbm % 100))
+                                return -EOPNOTSUPP;
+                        sdata->user_power_level = MBM_TO_DBM(mbm);
+                        break;
+                }
+
+                ieee80211_recalc_txpower(sdata);
+
+                return 0;
+        }
 
         switch (type) {
         case NL80211_TX_POWER_AUTOMATIC:
-                local->user_power_level = -1;
+                local->user_power_level = IEEE80211_UNSET_POWER_LEVEL;
                 break;
         case NL80211_TX_POWER_LIMITED:
-                if (mbm < 0 || (mbm % 100))
-                        return -EOPNOTSUPP;
-                local->user_power_level = MBM_TO_DBM(mbm);
-                break;
         case NL80211_TX_POWER_FIXED:
                 if (mbm < 0 || (mbm % 100))
                         return -EOPNOTSUPP;
-                /* TODO: move to cfg80211 when it knows the channel */
-                if (MBM_TO_DBM(mbm) > chan->max_power)
-                        return -EINVAL;
                 local->user_power_level = MBM_TO_DBM(mbm);
                 break;
         }
 
-        ieee80211_hw_config(local, changes);
+        mutex_lock(&local->iflist_mtx);
+        list_for_each_entry(sdata, &local->interfaces, list)
+                sdata->user_power_level = local->user_power_level;
+        list_for_each_entry(sdata, &local->interfaces, list)
+                ieee80211_recalc_txpower(sdata);
+        mutex_unlock(&local->iflist_mtx);
 
         return 0;
 }
 
-static int ieee80211_get_tx_power(struct wiphy *wiphy, int *dbm)
+static int ieee80211_get_tx_power(struct wiphy *wiphy,
+                                  struct wireless_dev *wdev,
+                                  int *dbm)
 {
         struct ieee80211_local *local = wiphy_priv(wiphy);
+        struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
 
-        *dbm = local->hw.conf.power_level;
+        if (!local->use_chanctx)
+                *dbm = local->hw.conf.power_level;
+        else
+                *dbm = sdata->vif.bss_conf.txpower;
 
         return 0;
 }
@@ -2067,13 +2125,12 @@ int __ieee80211_request_smps(struct ieee80211_sub_if_data *sdata,
 
         /*
          * If not associated, or current association is not an HT
-         * association, there's no need to send an action frame.
+         * association, there's no need to do anything, just store
+         * the new value until we associate.
          */
         if (!sdata->u.mgd.associated ||
-            sdata->vif.bss_conf.channel_type == NL80211_CHAN_NO_HT) {
-                ieee80211_recalc_smps(sdata->local);
+            sdata->vif.bss_conf.channel_type == NL80211_CHAN_NO_HT)
                 return 0;
-        }
 
         ap = sdata->u.mgd.associated->bssid;
 
@@ -2189,6 +2246,9 @@ static int ieee80211_start_roc_work(struct ieee80211_local *local,
 
         lockdep_assert_held(&local->mtx);
 
+        if (local->use_chanctx && !local->ops->remain_on_channel)
+                return -EOPNOTSUPP;
+
         roc = kzalloc(sizeof(*roc), GFP_KERNEL);
         if (!roc)
                 return -ENOMEM;
@@ -2332,13 +2392,22 @@ static int ieee80211_start_roc_work(struct ieee80211_local *local,
                 list_add_tail(&roc->list, &local->roc_list);
 
         /*
-         * cookie is either the roc (for normal roc)
+         * cookie is either the roc cookie (for normal roc)
          * or the SKB (for mgmt TX)
          */
-        if (txskb)
+        if (!txskb) {
+                /* local->mtx protects this */
+                local->roc_cookie_counter++;
+                roc->cookie = local->roc_cookie_counter;
+                /* wow, you wrapped 64 bits ... more likely a bug */
+                if (WARN_ON(roc->cookie == 0)) {
+                        roc->cookie = 1;
+                        local->roc_cookie_counter++;
+                }
+                *cookie = roc->cookie;
+        } else {
                 *cookie = (unsigned long)txskb;
-        else
-                *cookie = (unsigned long)roc;
+        }
 
         return 0;
 }
@@ -2373,7 +2442,7 @@ static int ieee80211_cancel_roc(struct ieee80211_local *local,
                 struct ieee80211_roc_work *dep, *tmp2;
 
                 list_for_each_entry_safe(dep, tmp2, &roc->dependents, list) {
-                        if (!mgmt_tx && (unsigned long)dep != cookie)
+                        if (!mgmt_tx && dep->cookie != cookie)
                                 continue;
                         else if (mgmt_tx && dep->mgmt_tx_cookie != cookie)
                                 continue;
@@ -2385,7 +2454,7 @@ static int ieee80211_cancel_roc(struct ieee80211_local *local,
                         return 0;
                 }
 
-                if (!mgmt_tx && (unsigned long)roc != cookie)
+                if (!mgmt_tx && roc->cookie != cookie)
                         continue;
                 else if (mgmt_tx && roc->mgmt_tx_cookie != cookie)
                         continue;
@@ -2515,10 +2584,20 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
 
         /* Check if the operating channel is the requested channel */
         if (!need_offchan) {
-                need_offchan = chan != local->oper_channel;
-                if (channel_type_valid &&
-                    channel_type != local->_oper_channel_type)
+                struct ieee80211_chanctx_conf *chanctx_conf;
+
+                rcu_read_lock();
+                chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
+
+                if (chanctx_conf) {
+                        need_offchan = chan != chanctx_conf->channel;
+                        if (channel_type_valid &&
+                            channel_type != chanctx_conf->channel_type)
+                                need_offchan = true;
+                } else {
                         need_offchan = true;
+                }
+                rcu_read_unlock();
         }
 
         if (need_offchan && !offchan) {
@@ -2594,6 +2673,9 @@ static void ieee80211_mgmt_frame_register(struct wiphy *wiphy,
                 else
                         local->probe_req_reg--;
 
+                if (!local->open_count)
+                        break;
+
                 ieee80211_queue_work(&local->hw, &local->reconfig_filter);
                 break;
         default:
@@ -2667,7 +2749,7 @@ static u16 ieee80211_get_tdls_sta_capab(struct ieee80211_sub_if_data *sdata)
         u16 capab;
 
         capab = 0;
-        if (local->oper_channel->band != IEEE80211_BAND_2GHZ)
+        if (ieee80211_get_sdata_band(sdata) != IEEE80211_BAND_2GHZ)
                 return capab;
 
         if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE))
@@ -2699,7 +2781,7 @@ ieee80211_prep_tdls_encap_data(struct wiphy *wiphy, struct net_device *dev,
                                u16 status_code, struct sk_buff *skb)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct ieee80211_local *local = sdata->local;
+        enum ieee80211_band band = ieee80211_get_sdata_band(sdata);
         struct ieee80211_tdls_data *tf;
 
         tf = (void *)skb_put(skb, offsetof(struct ieee80211_tdls_data, u));
@@ -2719,10 +2801,8 @@ ieee80211_prep_tdls_encap_data(struct wiphy *wiphy, struct net_device *dev,
                 tf->u.setup_req.capability =
                         cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata));
 
-                ieee80211_add_srates_ie(sdata, skb, false,
-                                        local->oper_channel->band);
-                ieee80211_add_ext_srates_ie(sdata, skb, false,
-                                            local->oper_channel->band);
+                ieee80211_add_srates_ie(sdata, skb, false, band);
+                ieee80211_add_ext_srates_ie(sdata, skb, false, band);
                 ieee80211_tdls_add_ext_capab(skb);
                 break;
         case WLAN_TDLS_SETUP_RESPONSE:
@@ -2735,10 +2815,8 @@ ieee80211_prep_tdls_encap_data(struct wiphy *wiphy, struct net_device *dev,
                 tf->u.setup_resp.capability =
                         cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata));
 
-                ieee80211_add_srates_ie(sdata, skb, false,
-                                        local->oper_channel->band);
-                ieee80211_add_ext_srates_ie(sdata, skb, false,
-                                            local->oper_channel->band);
+                ieee80211_add_srates_ie(sdata, skb, false, band);
+                ieee80211_add_ext_srates_ie(sdata, skb, false, band);
                 ieee80211_tdls_add_ext_capab(skb);
                 break;
         case WLAN_TDLS_SETUP_CONFIRM:
@@ -2776,7 +2854,7 @@ ieee80211_prep_tdls_direct(struct wiphy *wiphy, struct net_device *dev,
                            u16 status_code, struct sk_buff *skb)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-        struct ieee80211_local *local = sdata->local;
+        enum ieee80211_band band = ieee80211_get_sdata_band(sdata);
         struct ieee80211_mgmt *mgmt;
 
         mgmt = (void *)skb_put(skb, 24);
@@ -2799,10 +2877,8 @@ ieee80211_prep_tdls_direct(struct wiphy *wiphy, struct net_device *dev,
                 mgmt->u.action.u.tdls_discover_resp.capability =
                         cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata));
 
-                ieee80211_add_srates_ie(sdata, skb, false,
-                                        local->oper_channel->band);
-                ieee80211_add_ext_srates_ie(sdata, skb, false,
-                                            local->oper_channel->band);
+                ieee80211_add_srates_ie(sdata, skb, false, band);
+                ieee80211_add_ext_srates_ie(sdata, skb, false, band);
                 ieee80211_tdls_add_ext_capab(skb);
                 break;
         default:
@@ -2819,7 +2895,6 @@ static int ieee80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_tx_info *info;
         struct sk_buff *skb = NULL;
         bool send_direct;
         int ret;
@@ -2845,7 +2920,6 @@ static int ieee80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
         if (!skb)
                 return -ENOMEM;
 
-        info = IEEE80211_SKB_CB(skb);
         skb_reserve(skb, local->hw.extra_tx_headroom);
 
         switch (action_code) {
@@ -2982,12 +3056,19 @@ static int ieee80211_probe_client(struct wiphy *wiphy, struct net_device *dev,
         bool qos;
         struct ieee80211_tx_info *info;
         struct sta_info *sta;
+        struct ieee80211_chanctx_conf *chanctx_conf;
+        enum ieee80211_band band;
 
         rcu_read_lock();
+        chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
+        if (WARN_ON(!chanctx_conf)) {
+                rcu_read_unlock();
+                return -EINVAL;
+        }
+        band = chanctx_conf->channel->band;
         sta = sta_info_get(sdata, peer);
         if (sta) {
                 qos = test_sta_flag(sta, WLAN_STA_WME);
-                rcu_read_unlock();
         } else {
                 rcu_read_unlock();
                 return -ENOLINK;
@@ -3005,8 +3086,10 @@ static int ieee80211_probe_client(struct wiphy *wiphy, struct net_device *dev,
         }
 
         skb = dev_alloc_skb(local->hw.extra_tx_headroom + size);
-        if (!skb)
+        if (!skb) {
+                rcu_read_unlock();
                 return -ENOMEM;
+        }
 
         skb->dev = dev;
 
@@ -3031,8 +3114,9 @@ static int ieee80211_probe_client(struct wiphy *wiphy, struct net_device *dev,
                 nullfunc->qos_ctrl = cpu_to_le16(7);
 
         local_bh_disable();
-        ieee80211_xmit(sdata, skb);
+        ieee80211_xmit(sdata, skb, band);
         local_bh_enable();
+        rcu_read_unlock();
 
         *cookie = (unsigned long) skb;
         return 0;
@@ -3042,10 +3126,19 @@ static struct ieee80211_channel *
 ieee80211_cfg_get_channel(struct wiphy *wiphy, struct wireless_dev *wdev,
                           enum nl80211_channel_type *type)
 {
-        struct ieee80211_local *local = wiphy_priv(wiphy);
+        struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
+        struct ieee80211_chanctx_conf *chanctx_conf;
+        struct ieee80211_channel *chan = NULL;
+
+        rcu_read_lock();
+        chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
+        if (chanctx_conf) {
+                *type = chanctx_conf->channel_type;
+                chan = chanctx_conf->channel;
+        }
+        rcu_read_unlock();
 
-        *type = local->_oper_channel_type;
-        return local->oper_channel;
+        return chan;
 }
 
 #ifdef CONFIG_PM
@@ -3100,6 +3193,7 @@ struct cfg80211_ops mac80211_config_ops = {
         .disassoc = ieee80211_disassoc,
         .join_ibss = ieee80211_join_ibss,
         .leave_ibss = ieee80211_leave_ibss,
+        .set_mcast_rate = ieee80211_set_mcast_rate,
         .set_wiphy_params = ieee80211_set_wiphy_params,
         .set_tx_power = ieee80211_set_tx_power,
         .get_tx_power = ieee80211_get_tx_power,