1 files changed, 270 insertions, 173 deletions

diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index f76b83341cf9..e714ed8bb198 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -88,8 +88,6 @@ MODULE_PARM_DESC(probe_wait_ms,
 #define TMR_RUNNING_TIMER       0
 #define TMR_RUNNING_CHANSW      1
 
-#define DEAUTH_DISASSOC_LEN     (24 /* hdr */ + 2 /* reason */)
-
 /*
  * All cfg80211 functions have to be called outside a locked
  * section so that they can acquire a lock themselves... This
@@ -146,6 +144,9 @@ void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata)
         if (sdata->vif.driver_flags & IEEE80211_VIF_BEACON_FILTER)
                 return;
 
+        if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
+                return;
+
         mod_timer(&sdata->u.mgd.bcn_mon_timer,
                   round_jiffies_up(jiffies + sdata->u.mgd.beacon_timeout));
 }
@@ -182,15 +183,15 @@ static u32 ieee80211_config_ht_tx(struct ieee80211_sub_if_data *sdata,
         u16 ht_opmode;
         bool disable_40 = false;
 
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+        sband = local->hw.wiphy->bands[local->oper_channel->band];
 
         switch (sdata->vif.bss_conf.channel_type) {
         case NL80211_CHAN_HT40PLUS:
-                if (local->hw.conf.channel->flags & IEEE80211_CHAN_NO_HT40PLUS)
+                if (local->oper_channel->flags & IEEE80211_CHAN_NO_HT40PLUS)
                         disable_40 = true;
                 break;
         case NL80211_CHAN_HT40MINUS:
-                if (local->hw.conf.channel->flags & IEEE80211_CHAN_NO_HT40MINUS)
+                if (local->oper_channel->flags & IEEE80211_CHAN_NO_HT40MINUS)
                         disable_40 = true;
                 break;
         default:
@@ -326,6 +327,26 @@ static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata,
         ieee80211_ie_build_ht_cap(pos, &ht_cap, cap);
 }
 
+static void ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,
+                                 struct sk_buff *skb,
+                                 struct ieee80211_supported_band *sband)
+{
+        u8 *pos;
+        u32 cap;
+        struct ieee80211_sta_vht_cap vht_cap;
+
+        BUILD_BUG_ON(sizeof(vht_cap) != sizeof(sband->vht_cap));
+
+        memcpy(&vht_cap, &sband->vht_cap, sizeof(vht_cap));
+
+        /* determine capability flags */
+        cap = vht_cap.cap;
+
+        /* reserve and fill IE */
+        pos = skb_put(skb, sizeof(struct ieee80211_vht_capabilities) + 2);
+        ieee80211_ie_build_vht_cap(pos, &vht_cap, cap);
+}
+
 static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_local *local = sdata->local;
@@ -371,6 +392,7 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
                         4 + /* power capability */
                         2 + 2 * sband->n_channels + /* supported channels */
                         2 + sizeof(struct ieee80211_ht_cap) + /* HT */
+                        2 + sizeof(struct ieee80211_vht_capabilities) + /* VHT */
                         assoc_data->ie_len + /* extra IEs */
                         9, /* WMM */
                         GFP_KERNEL);
@@ -503,6 +525,9 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
                 ieee80211_add_ht_ie(sdata, skb, assoc_data->ap_ht_param,
                                     sband, local->oper_channel, ifmgd->ap_smps);
 
+        if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
+                ieee80211_add_vht_ie(sdata, skb, sband);
+
         /* if present, add any custom non-vendor IEs that go after HT */
         if (assoc_data->ie_len && assoc_data->ie) {
                 noffset = ieee80211_ie_split_vendor(assoc_data->ie,
@@ -547,48 +572,6 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
         ieee80211_tx_skb(sdata, skb);
 }
 
-static void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
-                                           const u8 *bssid, u16 stype,
-                                           u16 reason, bool send_frame,
-                                           u8 *frame_buf)
-{
-        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        struct sk_buff *skb;
-        struct ieee80211_mgmt *mgmt = (void *)frame_buf;
-
-        /* build frame */
-        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | stype);
-        mgmt->duration = 0; /* initialize only */
-        mgmt->seq_ctrl = 0; /* initialize only */
-        memcpy(mgmt->da, bssid, ETH_ALEN);
-        memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
-        memcpy(mgmt->bssid, bssid, ETH_ALEN);
-        /* u.deauth.reason_code == u.disassoc.reason_code */
-        mgmt->u.deauth.reason_code = cpu_to_le16(reason);
-
-        if (send_frame) {
-                skb = dev_alloc_skb(local->hw.extra_tx_headroom +
-                                    DEAUTH_DISASSOC_LEN);
-                if (!skb)
-                        return;
-
-                skb_reserve(skb, local->hw.extra_tx_headroom);
-
-                /* copy in frame */
-                memcpy(skb_put(skb, DEAUTH_DISASSOC_LEN),
-                       mgmt, DEAUTH_DISASSOC_LEN);
-
-                if (!(ifmgd->flags & IEEE80211_STA_MFP_ENABLED))
-                        IEEE80211_SKB_CB(skb)->flags |=
-                                IEEE80211_TX_INTFL_DONT_ENCRYPT;
-
-                drv_mgd_prepare_tx(local, sdata);
-
-                ieee80211_tx_skb(sdata, skb);
-        }
-}
-
 void ieee80211_send_pspoll(struct ieee80211_local *local,
                            struct ieee80211_sub_if_data *sdata)
 {
@@ -687,6 +670,7 @@ static void ieee80211_chswitch_work(struct work_struct *work)
         /* XXX: shouldn't really modify cfg80211-owned data! */
         ifmgd->associated->channel = sdata->local->oper_channel;
 
+        /* XXX: wait for a beacon first? */
         ieee80211_wake_queues_by_reason(&sdata->local->hw,
                                         IEEE80211_QUEUE_STOP_REASON_CSA);
  out:
@@ -704,16 +688,13 @@ void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success)
 
         trace_api_chswitch_done(sdata, success);
         if (!success) {
-                /*
-                 * If the channel switch was not successful, stay
-                 * around on the old channel. We currently lack
-                 * good handling of this situation, possibly we
-                 * should just drop the association.
-                 */
-                sdata->local->csa_channel = sdata->local->oper_channel;
+                sdata_info(sdata,
+                           "driver channel switch failed, disconnecting\n");
+                ieee80211_queue_work(&sdata->local->hw,
+                                     &ifmgd->csa_connection_drop_work);
+        } else {
+                ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
         }
-
-        ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
 }
 EXPORT_SYMBOL(ieee80211_chswitch_done);
 
@@ -758,61 +739,111 @@ void ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
                 return;
 
         new_ch = ieee80211_get_channel(sdata->local->hw.wiphy, new_freq);
-        if (!new_ch || new_ch->flags & IEEE80211_CHAN_DISABLED)
+        if (!new_ch || new_ch->flags & IEEE80211_CHAN_DISABLED) {
+                sdata_info(sdata,
+                           "AP %pM switches to unsupported channel (%d MHz), disconnecting\n",
+                           ifmgd->associated->bssid, new_freq);
+                ieee80211_queue_work(&sdata->local->hw,
+                                     &ifmgd->csa_connection_drop_work);
                 return;
+        }
 
         sdata->local->csa_channel = new_ch;
 
+        ifmgd->flags |= IEEE80211_STA_CSA_RECEIVED;
+
+        if (sw_elem->mode)
+                ieee80211_stop_queues_by_reason(&sdata->local->hw,
+                                IEEE80211_QUEUE_STOP_REASON_CSA);
+
         if (sdata->local->ops->channel_switch) {
                 /* use driver's channel switch callback */
-                struct ieee80211_channel_switch ch_switch;
-                memset(&ch_switch, 0, sizeof(ch_switch));
-                ch_switch.timestamp = timestamp;
-                if (sw_elem->mode) {
-                        ch_switch.block_tx = true;
-                        ieee80211_stop_queues_by_reason(&sdata->local->hw,
-                                        IEEE80211_QUEUE_STOP_REASON_CSA);
-                }
-                ch_switch.channel = new_ch;
-                ch_switch.count = sw_elem->count;
-                ifmgd->flags |= IEEE80211_STA_CSA_RECEIVED;
+                struct ieee80211_channel_switch ch_switch = {
+                        .timestamp = timestamp,
+                        .block_tx = sw_elem->mode,
+                        .channel = new_ch,
+                        .count = sw_elem->count,
+                };
+
                 drv_channel_switch(sdata->local, &ch_switch);
                 return;
         }
 
         /* channel switch handled in software */
-        if (sw_elem->count <= 1) {
+        if (sw_elem->count <= 1)
                 ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
-        } else {
-                if (sw_elem->mode)
-                        ieee80211_stop_queues_by_reason(&sdata->local->hw,
-                                        IEEE80211_QUEUE_STOP_REASON_CSA);
-                ifmgd->flags |= IEEE80211_STA_CSA_RECEIVED;
+        else
                 mod_timer(&ifmgd->chswitch_timer,
-                          jiffies +
-                          msecs_to_jiffies(sw_elem->count *
-                                           cbss->beacon_interval));
-        }
+                          TU_TO_EXP_TIME(sw_elem->count *
+                                         cbss->beacon_interval));
 }
 
 static void ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
-                                        u16 capab_info, u8 *pwr_constr_elem,
-                                        u8 pwr_constr_elem_len)
+                                        struct ieee80211_channel *channel,
+                                        const u8 *country_ie, u8 country_ie_len,
+                                        const u8 *pwr_constr_elem)
 {
-        struct ieee80211_conf *conf = &sdata->local->hw.conf;
+        struct ieee80211_country_ie_triplet *triplet;
+        int chan = ieee80211_frequency_to_channel(channel->center_freq);
+        int i, chan_pwr, chan_increment, new_ap_level;
+        bool have_chan_pwr = false;
 
-        if (!(capab_info & WLAN_CAPABILITY_SPECTRUM_MGMT))
+        /* Invalid IE */
+        if (country_ie_len % 2 || country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN)
                 return;
 
-        /* Power constraint IE length should be 1 octet */
-        if (pwr_constr_elem_len != 1)
-                return;
+        triplet = (void *)(country_ie + 3);
+        country_ie_len -= 3;
+
+        switch (channel->band) {
+        default:
+                WARN_ON_ONCE(1);
+                /* fall through */
+        case IEEE80211_BAND_2GHZ:
+        case IEEE80211_BAND_60GHZ:
+                chan_increment = 1;
+                break;
+        case IEEE80211_BAND_5GHZ:
+                chan_increment = 4;
+                break;
+        }
+
+        /* find channel */
+        while (country_ie_len >= 3) {
+                u8 first_channel = triplet->chans.first_channel;
 
-        if ((*pwr_constr_elem <= conf->channel->max_reg_power) &&
-            (*pwr_constr_elem != sdata->local->power_constr_level)) {
-                sdata->local->power_constr_level = *pwr_constr_elem;
-                ieee80211_hw_config(sdata->local, 0);
+                if (first_channel >= IEEE80211_COUNTRY_EXTENSION_ID)
+                        goto next;
+
+                for (i = 0; i < triplet->chans.num_channels; i++) {
+                        if (first_channel + i * chan_increment == chan) {
+                                have_chan_pwr = true;
+                                chan_pwr = triplet->chans.max_power;
+                                break;
+                        }
+                }
+                if (have_chan_pwr)
+                        break;
+
+ next:
+                triplet++;
+                country_ie_len -= 3;
         }
+
+        if (!have_chan_pwr)
+                return;
+
+        new_ap_level = max_t(int, 0, chan_pwr - *pwr_constr_elem);
+
+        if (sdata->local->ap_power_level == new_ap_level)
+                return;
+
+        sdata_info(sdata,
+                   "Limiting TX power to %d (%d - %d) dBm as advertised by %pM\n",
+                   new_ap_level, chan_pwr, *pwr_constr_elem,
+                   sdata->u.mgd.bssid);
+        sdata->local->ap_power_level = new_ap_level;
+        ieee80211_hw_config(sdata->local, 0);
 }
 
 void ieee80211_enable_dyn_ps(struct ieee80211_vif *vif)
@@ -1007,6 +1038,16 @@ void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency)
         ieee80211_change_ps(local);
 }
 
+void ieee80211_recalc_ps_vif(struct ieee80211_sub_if_data *sdata)
+{
+        bool ps_allowed = ieee80211_powersave_allowed(sdata);
+
+        if (sdata->vif.bss_conf.ps != ps_allowed) {
+                sdata->vif.bss_conf.ps = ps_allowed;
+                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_PS);
+        }
+}
+
 void ieee80211_dynamic_ps_disable_work(struct work_struct *work)
 {
         struct ieee80211_local *local =
@@ -1239,7 +1280,7 @@ static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
         }
 
         use_short_slot = !!(capab & WLAN_CAPABILITY_SHORT_SLOT_TIME);
-        if (sdata->local->hw.conf.channel->band == IEEE80211_BAND_5GHZ)
+        if (sdata->local->oper_channel->band == IEEE80211_BAND_5GHZ)
                 use_short_slot = true;
 
         if (use_protection != bss_conf->use_cts_prot) {
@@ -1307,9 +1348,11 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
 
         mutex_lock(&local->iflist_mtx);
         ieee80211_recalc_ps(local, -1);
-        ieee80211_recalc_smps(local);
         mutex_unlock(&local->iflist_mtx);
 
+        ieee80211_recalc_smps(local);
+        ieee80211_recalc_ps_vif(sdata);
+
         netif_tx_start_all_queues(sdata->dev);
         netif_carrier_on(sdata->dev);
 }
@@ -1356,7 +1399,7 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         sta = sta_info_get(sdata, ifmgd->bssid);
         if (sta) {
                 set_sta_flag(sta, WLAN_STA_BLOCK_BA);
-                ieee80211_sta_tear_down_BA_sessions(sta, tx);
+                ieee80211_sta_tear_down_BA_sessions(sta, false);
         }
         mutex_unlock(&local->sta_mtx);
 
@@ -1371,6 +1414,9 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         }
         local->ps_sdata = NULL;
 
+        /* disable per-vif ps */
+        ieee80211_recalc_ps_vif(sdata);
+
         /* flush out any pending frame (e.g. DELBA) before deauth/disassoc */
         if (tx)
                 drv_flush(local, false);
@@ -1401,7 +1447,7 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         memset(&ifmgd->ht_capa, 0, sizeof(ifmgd->ht_capa));
         memset(&ifmgd->ht_capa_mask, 0, sizeof(ifmgd->ht_capa_mask));
 
-        local->power_constr_level = 0;
+        local->ap_power_level = 0;
 
         del_timer_sync(&local->dynamic_ps_timer);
         cancel_work_sync(&local->dynamic_ps_enable_work);
@@ -1542,7 +1588,8 @@ static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
                         ssid_len = ssid[1];
 
                 ieee80211_send_probe_req(sdata, dst, ssid + 2, ssid_len, NULL,
-                                         0, (u32) -1, true, false);
+                                         0, (u32) -1, true, false,
+                                         ifmgd->associated->channel);
         }
 
         ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms);
@@ -1645,19 +1692,21 @@ struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
                 ssid_len = ssid[1];
 
         skb = ieee80211_build_probe_req(sdata, cbss->bssid,
-                                        (u32) -1, ssid + 2, ssid_len,
+                                        (u32) -1,
+                                        sdata->local->oper_channel,
+                                        ssid + 2, ssid_len,
                                         NULL, 0, true);
 
         return skb;
 }
 EXPORT_SYMBOL(ieee80211_ap_probereq_get);
 
-static void __ieee80211_connection_loss(struct ieee80211_sub_if_data *sdata)
+static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata,
+                                   bool transmit_frame)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
-        u8 bssid[ETH_ALEN];
-        u8 frame_buf[DEAUTH_DISASSOC_LEN];
+        u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
 
         mutex_lock(&ifmgd->mtx);
         if (!ifmgd->associated) {
@@ -1665,27 +1714,24 @@ static void __ieee80211_connection_loss(struct ieee80211_sub_if_data *sdata)
                 return;
         }
 
-        memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
-
-        sdata_info(sdata, "Connection to AP %pM lost\n", bssid);
-
         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
                                WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY,
-                               false, frame_buf);
+                               transmit_frame, frame_buf);
+        ifmgd->flags &= ~IEEE80211_STA_CSA_RECEIVED;
         mutex_unlock(&ifmgd->mtx);
 
         /*
          * must be outside lock due to cfg80211,
          * but that's not a problem.
          */
-        cfg80211_send_deauth(sdata->dev, frame_buf, DEAUTH_DISASSOC_LEN);
+        cfg80211_send_deauth(sdata->dev, frame_buf, IEEE80211_DEAUTH_FRAME_LEN);
 
         mutex_lock(&local->mtx);
         ieee80211_recalc_idle(local);
         mutex_unlock(&local->mtx);
 }
 
-void ieee80211_beacon_connection_loss_work(struct work_struct *work)
+static void ieee80211_beacon_connection_loss_work(struct work_struct *work)
 {
         struct ieee80211_sub_if_data *sdata =
                 container_of(work, struct ieee80211_sub_if_data,
@@ -1701,10 +1747,24 @@ void ieee80211_beacon_connection_loss_work(struct work_struct *work)
                 rcu_read_unlock();
         }
 
-        if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
-                __ieee80211_connection_loss(sdata);
-        else
+        if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR) {
+                sdata_info(sdata, "Connection to AP %pM lost\n",
+                           ifmgd->bssid);
+                __ieee80211_disconnect(sdata, false);
+        } else {
                 ieee80211_mgd_probe_ap(sdata, true);
+        }
+}
+
+static void ieee80211_csa_connection_drop_work(struct work_struct *work)
+{
+        struct ieee80211_sub_if_data *sdata =
+                container_of(work, struct ieee80211_sub_if_data,
+                             u.mgd.csa_connection_drop_work);
+
+        ieee80211_wake_queues_by_reason(&sdata->local->hw,
+                                        IEEE80211_QUEUE_STOP_REASON_CSA);
+        __ieee80211_disconnect(sdata, true);
 }
 
 void ieee80211_beacon_loss(struct ieee80211_vif *vif)
@@ -2232,14 +2292,10 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                 mutex_unlock(&local->iflist_mtx);
         }
 
-        if (elems->ch_switch_elem && (elems->ch_switch_elem_len == 3) &&
-            (memcmp(mgmt->bssid, sdata->u.mgd.associated->bssid,
-                                                        ETH_ALEN) == 0)) {
-                struct ieee80211_channel_sw_ie *sw_elem =
-                        (struct ieee80211_channel_sw_ie *)elems->ch_switch_elem;
-                ieee80211_sta_process_chanswitch(sdata, sw_elem,
+        if (elems->ch_switch_ie &&
+            memcmp(mgmt->bssid, sdata->u.mgd.associated->bssid, ETH_ALEN) == 0)
+                ieee80211_sta_process_chanswitch(sdata, elems->ch_switch_ie,
                                                  bss, rx_status->mactime);
-        }
 }
 
 
@@ -2326,7 +2382,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
         if (baselen > len)
                 return;
 
-        if (rx_status->freq != local->hw.conf.channel->center_freq)
+        if (rx_status->freq != local->oper_channel->center_freq)
                 return;
 
         if (ifmgd->assoc_data && !ifmgd->assoc_data->have_beacon &&
@@ -2490,21 +2546,19 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
             !(ifmgd->flags & IEEE80211_STA_DISABLE_11N)) {
                 struct ieee80211_supported_band *sband;
 
-                sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+                sband = local->hw.wiphy->bands[local->oper_channel->band];
 
                 changed |= ieee80211_config_ht_tx(sdata, elems.ht_operation,
                                                   bssid, true);
         }
 
-        /* Note: country IE parsing is done for us by cfg80211 */
-        if (elems.country_elem) {
-                /* TODO: IBSS also needs this */
-                if (elems.pwr_constr_elem)
-                        ieee80211_handle_pwr_constr(sdata,
-                                le16_to_cpu(mgmt->u.probe_resp.capab_info),
-                                elems.pwr_constr_elem,
-                                elems.pwr_constr_elem_len);
-        }
+        if (elems.country_elem && elems.pwr_constr_elem &&
+            mgmt->u.probe_resp.capab_info &
+                                cpu_to_le16(WLAN_CAPABILITY_SPECTRUM_MGMT))
+                ieee80211_handle_pwr_constr(sdata, local->oper_channel,
+                                            elems.country_elem,
+                                            elems.country_elem_len,
+                                            elems.pwr_constr_elem);
 
         ieee80211_bss_info_change_notify(sdata, changed);
 }
@@ -2601,7 +2655,7 @@ static void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        u8 frame_buf[DEAUTH_DISASSOC_LEN];
+        u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
 
         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, reason,
                                false, frame_buf);
@@ -2611,7 +2665,7 @@ static void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
          * must be outside lock due to cfg80211,
          * but that's not a problem.
          */
-        cfg80211_send_deauth(sdata->dev, frame_buf, DEAUTH_DISASSOC_LEN);
+        cfg80211_send_deauth(sdata->dev, frame_buf, IEEE80211_DEAUTH_FRAME_LEN);
 
         mutex_lock(&local->mtx);
         ieee80211_recalc_idle(local);
@@ -2673,7 +2727,8 @@ static int ieee80211_probe_auth(struct ieee80211_sub_if_data *sdata)
                  * will not answer to direct packet in unassociated state.
                  */
                 ieee80211_send_probe_req(sdata, NULL, ssidie + 2, ssidie[1],
-                                         NULL, 0, (u32) -1, true, false);
+                                         NULL, 0, (u32) -1, true, false,
+                                         auth_data->bss->channel);
         }
 
         auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
@@ -2894,6 +2949,7 @@ void ieee80211_sta_quiesce(struct ieee80211_sub_if_data *sdata)
 
         cancel_work_sync(&ifmgd->monitor_work);
         cancel_work_sync(&ifmgd->beacon_connection_loss_work);
+        cancel_work_sync(&ifmgd->csa_connection_drop_work);
         if (del_timer_sync(&ifmgd->timer))
                 set_bit(TMR_RUNNING_TIMER, &ifmgd->timers_running);
 
@@ -2950,6 +3006,8 @@ void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
         INIT_WORK(&ifmgd->chswitch_work, ieee80211_chswitch_work);
         INIT_WORK(&ifmgd->beacon_connection_loss_work,
                   ieee80211_beacon_connection_loss_work);
+        INIT_WORK(&ifmgd->csa_connection_drop_work,
+                  ieee80211_csa_connection_drop_work);
         INIT_WORK(&ifmgd->request_smps_work, ieee80211_request_smps_work);
         setup_timer(&ifmgd->timer, ieee80211_sta_timer,
                     (unsigned long) sdata);
@@ -3000,41 +3058,17 @@ int ieee80211_max_network_latency(struct notifier_block *nb,
         return 0;
 }
 
-static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
-                                     struct cfg80211_bss *cbss, bool assoc)
+static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
+                                  struct cfg80211_bss *cbss)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        struct ieee80211_bss *bss = (void *)cbss->priv;
-        struct sta_info *sta = NULL;
-        bool have_sta = false;
-        int err;
         int ht_cfreq;
         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
         const u8 *ht_oper_ie;
         const struct ieee80211_ht_operation *ht_oper = NULL;
         struct ieee80211_supported_band *sband;
 
-        if (WARN_ON(!ifmgd->auth_data && !ifmgd->assoc_data))
-                return -EINVAL;
-
-        if (assoc) {
-                rcu_read_lock();
-                have_sta = sta_info_get(sdata, cbss->bssid);
-                rcu_read_unlock();
-        }
-
-        if (!have_sta) {
-                sta = sta_info_alloc(sdata, cbss->bssid, GFP_KERNEL);
-                if (!sta)
-                        return -ENOMEM;
-        }
-
-        mutex_lock(&local->mtx);
-        ieee80211_recalc_idle(sdata->local);
-        mutex_unlock(&local->mtx);
-
-        /* switch to the right channel */
         sband = local->hw.wiphy->bands[cbss->channel->band];
 
         ifmgd->flags &= ~IEEE80211_STA_DISABLE_40MHZ;
@@ -3097,10 +3131,51 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
         local->oper_channel = cbss->channel;
         ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
 
-        if (sta) {
+        return 0;
+}
+
+static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
+                                     struct cfg80211_bss *cbss, bool assoc)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        struct ieee80211_bss *bss = (void *)cbss->priv;
+        struct sta_info *new_sta = NULL;
+        bool have_sta = false;
+        int err;
+
+        if (WARN_ON(!ifmgd->auth_data && !ifmgd->assoc_data))
+                return -EINVAL;
+
+        if (assoc) {
+                rcu_read_lock();
+                have_sta = sta_info_get(sdata, cbss->bssid);
+                rcu_read_unlock();
+        }
+
+        if (!have_sta) {
+                new_sta = sta_info_alloc(sdata, cbss->bssid, GFP_KERNEL);
+                if (!new_sta)
+                        return -ENOMEM;
+        }
+
+        mutex_lock(&local->mtx);
+        ieee80211_recalc_idle(sdata->local);
+        mutex_unlock(&local->mtx);
+
+        if (new_sta) {
                 u32 rates = 0, basic_rates = 0;
                 bool have_higher_than_11mbit;
                 int min_rate = INT_MAX, min_rate_index = -1;
+                struct ieee80211_supported_band *sband;
+
+                sband = local->hw.wiphy->bands[cbss->channel->band];
+
+                err = ieee80211_prep_channel(sdata, cbss);
+                if (err) {
+                        sta_info_free(local, new_sta);
+                        return err;
+                }
 
                 ieee80211_get_rates(sband, bss->supp_rates,
                                     bss->supp_rates_len,
@@ -3122,7 +3197,7 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
                         basic_rates = BIT(min_rate_index);
                 }
 
-                sta->sta.supp_rates[cbss->channel->band] = rates;
+                new_sta->sta.supp_rates[cbss->channel->band] = rates;
                 sdata->vif.bss_conf.basic_rates = basic_rates;
 
                 /* cf. IEEE 802.11 9.2.12 */
@@ -3145,10 +3220,10 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
                         BSS_CHANGED_BEACON_INT);
 
                 if (assoc)
-                        sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
+                        sta_info_pre_move_state(new_sta, IEEE80211_STA_AUTH);
 
-                err = sta_info_insert(sta);
-                sta = NULL;
+                err = sta_info_insert(new_sta);
+                new_sta = NULL;
                 if (err) {
                         sdata_info(sdata,
                                    "failed to insert STA entry for the AP (error %d)\n",
@@ -3302,9 +3377,13 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
         }
 
         /* prepare assoc data */
-
-        ifmgd->flags &= ~IEEE80211_STA_DISABLE_11N;
-        ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
+        
+        /*
+         * keep only the 40 MHz disable bit set as it might have
+         * been set during authentication already, all other bits
+         * should be reset for a new connection
+         */
+        ifmgd->flags &= IEEE80211_STA_DISABLE_40MHZ;
 
         ifmgd->beacon_crc_valid = false;
 
@@ -3320,21 +3399,34 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
                     req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_TKIP ||
                     req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP104) {
                         ifmgd->flags |= IEEE80211_STA_DISABLE_11N;
+                        ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
                         netdev_info(sdata->dev,
-                                    "disabling HT due to WEP/TKIP use\n");
+                                    "disabling HT/VHT due to WEP/TKIP use\n");
                 }
         }
 
-        if (req->flags & ASSOC_REQ_DISABLE_HT)
+        if (req->flags & ASSOC_REQ_DISABLE_HT) {
                 ifmgd->flags |= IEEE80211_STA_DISABLE_11N;
+                ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
+        }
 
         /* Also disable HT if we don't support it or the AP doesn't use WMM */
         sband = local->hw.wiphy->bands[req->bss->channel->band];
         if (!sband->ht_cap.ht_supported ||
             local->hw.queues < IEEE80211_NUM_ACS || !bss->wmm_used) {
                 ifmgd->flags |= IEEE80211_STA_DISABLE_11N;
-                netdev_info(sdata->dev,
-                            "disabling HT as WMM/QoS is not supported\n");
+                if (!bss->wmm_used)
+                        netdev_info(sdata->dev,
+                                    "disabling HT as WMM/QoS is not supported by the AP\n");
+        }
+
+        /* disable VHT if we don't support it or the AP doesn't use WMM */
+        if (!sband->vht_cap.vht_supported ||
+            local->hw.queues < IEEE80211_NUM_ACS || !bss->wmm_used) {
+                ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
+                if (!bss->wmm_used)
+                        netdev_info(sdata->dev,
+                                    "disabling VHT as WMM/QoS is not supported by the AP\n");
         }
 
         memcpy(&ifmgd->ht_capa, &req->ht_capa, sizeof(ifmgd->ht_capa));
@@ -3456,7 +3548,7 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
                          struct cfg80211_deauth_request *req)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        u8 frame_buf[DEAUTH_DISASSOC_LEN];
+        u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
 
         mutex_lock(&ifmgd->mtx);
 
@@ -3471,17 +3563,21 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
                    req->bssid, req->reason_code);
 
         if (ifmgd->associated &&
-            ether_addr_equal(ifmgd->associated->bssid, req->bssid))
+            ether_addr_equal(ifmgd->associated->bssid, req->bssid)) {
                 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
                                        req->reason_code, true, frame_buf);
-        else
+        } else {
+                drv_mgd_prepare_tx(sdata->local, sdata);
                 ieee80211_send_deauth_disassoc(sdata, req->bssid,
                                                IEEE80211_STYPE_DEAUTH,
                                                req->reason_code, true,
                                                frame_buf);
+        }
+
         mutex_unlock(&ifmgd->mtx);
 
-        __cfg80211_send_deauth(sdata->dev, frame_buf, DEAUTH_DISASSOC_LEN);
+        __cfg80211_send_deauth(sdata->dev, frame_buf,
+                               IEEE80211_DEAUTH_FRAME_LEN);
 
         mutex_lock(&sdata->local->mtx);
         ieee80211_recalc_idle(sdata->local);
@@ -3495,7 +3591,7 @@ int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         u8 bssid[ETH_ALEN];
-        u8 frame_buf[DEAUTH_DISASSOC_LEN];
+        u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
 
         mutex_lock(&ifmgd->mtx);
 
@@ -3520,7 +3616,8 @@ int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
                                frame_buf);
         mutex_unlock(&ifmgd->mtx);
 
-        __cfg80211_send_disassoc(sdata->dev, frame_buf, DEAUTH_DISASSOC_LEN);
+        __cfg80211_send_disassoc(sdata->dev, frame_buf,
+                                 IEEE80211_DEAUTH_FRAME_LEN);
 
         mutex_lock(&sdata->local->mtx);
         ieee80211_recalc_idle(sdata->local);