34 files changed, 1779 insertions, 380 deletions

diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 43dd7525bfcb..31fc2247bc37 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -395,9 +395,13 @@ void sta_set_rate_info_tx(struct sta_info *sta,
                 rinfo->nss = ieee80211_rate_get_vht_nss(rate);
         } else {
                 struct ieee80211_supported_band *sband;
+                int shift = ieee80211_vif_get_shift(&sta->sdata->vif);
+                u16 brate;
+
                 sband = sta->local->hw.wiphy->bands[
                                 ieee80211_get_sdata_band(sta->sdata)];
-                rinfo->legacy = sband->bitrates[rate->idx].bitrate;
+                brate = sband->bitrates[rate->idx].bitrate;
+                rinfo->legacy = DIV_ROUND_UP(brate, 1 << shift);
         }
         if (rate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
                 rinfo->flags |= RATE_INFO_FLAGS_40_MHZ_WIDTH;
@@ -422,11 +426,13 @@ void sta_set_rate_info_rx(struct sta_info *sta, struct rate_info *rinfo)
                 rinfo->mcs = sta->last_rx_rate_idx;
         } else {
                 struct ieee80211_supported_band *sband;
+                int shift = ieee80211_vif_get_shift(&sta->sdata->vif);
+                u16 brate;
 
                 sband = sta->local->hw.wiphy->bands[
                                 ieee80211_get_sdata_band(sta->sdata)];
-                rinfo->legacy =
-                        sband->bitrates[sta->last_rx_rate_idx].bitrate;
+                brate = sband->bitrates[sta->last_rx_rate_idx].bitrate;
+                rinfo->legacy = DIV_ROUND_UP(brate, 1 << shift);
         }
 
         if (sta->last_rx_rate_flag & RX_FLAG_40MHZ)
@@ -856,8 +862,8 @@ static int ieee80211_set_probe_resp(struct ieee80211_sub_if_data *sdata,
         return 0;
 }
 
-static int ieee80211_assign_beacon(struct ieee80211_sub_if_data *sdata,
-                                   struct cfg80211_beacon_data *params)
+int ieee80211_assign_beacon(struct ieee80211_sub_if_data *sdata,
+                            struct cfg80211_beacon_data *params)
 {
         struct beacon_data *new, *old;
         int new_head_len, new_tail_len;
@@ -1020,6 +1026,12 @@ static int ieee80211_change_beacon(struct wiphy *wiphy, struct net_device *dev,
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
+        /* don't allow changing the beacon while CSA is in place - offset
+         * of channel switch counter may change
+         */
+        if (sdata->vif.csa_active)
+                return -EBUSY;
+
         old = rtnl_dereference(sdata->u.ap.beacon);
         if (!old)
                 return -ENOENT;
@@ -1044,6 +1056,10 @@ static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
                 return -ENOENT;
         old_probe_resp = rtnl_dereference(sdata->u.ap.probe_resp);
 
+        /* abort any running channel switch */
+        sdata->vif.csa_active = false;
+        cancel_work_sync(&sdata->csa_finalize_work);
+
         /* turn off carrier for this interface and dependent VLANs */
         list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
                 netif_carrier_off(vlan->dev);
@@ -1192,8 +1208,6 @@ static int sta_apply_parameters(struct ieee80211_local *local,
                                 struct station_parameters *params)
 {
         int ret = 0;
-        u32 rates;
-        int i, j;
         struct ieee80211_supported_band *sband;
         struct ieee80211_sub_if_data *sdata = sta->sdata;
         enum ieee80211_band band = ieee80211_get_sdata_band(sdata);
@@ -1286,16 +1300,10 @@ static int sta_apply_parameters(struct ieee80211_local *local,
                 sta->listen_interval = params->listen_interval;
 
         if (params->supported_rates) {
-                rates = 0;
-
-                for (i = 0; i < params->supported_rates_len; i++) {
-                        int rate = (params->supported_rates[i] & 0x7f) * 5;
-                        for (j = 0; j < sband->n_bitrates; j++) {
-                                if (sband->bitrates[j].bitrate == rate)
-                                        rates |= BIT(j);
-                        }
-                }
-                sta->sta.supp_rates[band] = rates;
+                ieee80211_parse_bitrates(&sdata->vif.bss_conf.chandef,
+                                         sband, params->supported_rates,
+                                         params->supported_rates_len,
+                                         &sta->sta.supp_rates[band]);
         }
 
         if (params->ht_capa)
@@ -1958,18 +1966,11 @@ static int ieee80211_change_bss(struct wiphy *wiphy,
         }
 
         if (params->basic_rates) {
-                int i, j;
-                u32 rates = 0;
-                struct ieee80211_supported_band *sband = wiphy->bands[band];
-
-                for (i = 0; i < params->basic_rates_len; i++) {
-                        int rate = (params->basic_rates[i] & 0x7f) * 5;
-                        for (j = 0; j < sband->n_bitrates; j++) {
-                                if (sband->bitrates[j].bitrate == rate)
-                                        rates |= BIT(j);
-                        }
-                }
-                sdata->vif.bss_conf.basic_rates = rates;
+                ieee80211_parse_bitrates(&sdata->vif.bss_conf.chandef,
+                                         wiphy->bands[band],
+                                         params->basic_rates,
+                                         params->basic_rates_len,
+                                         &sdata->vif.bss_conf.basic_rates);
                 changed |= BSS_CHANGED_BASIC_RATES;
         }
 
@@ -2786,6 +2787,178 @@ static int ieee80211_start_radar_detection(struct wiphy *wiphy,
         return 0;
 }
 
+static struct cfg80211_beacon_data *
+cfg80211_beacon_dup(struct cfg80211_beacon_data *beacon)
+{
+        struct cfg80211_beacon_data *new_beacon;
+        u8 *pos;
+        int len;
+
+        len = beacon->head_len + beacon->tail_len + beacon->beacon_ies_len +
+              beacon->proberesp_ies_len + beacon->assocresp_ies_len +
+              beacon->probe_resp_len;
+
+        new_beacon = kzalloc(sizeof(*new_beacon) + len, GFP_KERNEL);
+        if (!new_beacon)
+                return NULL;
+
+        pos = (u8 *)(new_beacon + 1);
+        if (beacon->head_len) {
+                new_beacon->head_len = beacon->head_len;
+                new_beacon->head = pos;
+                memcpy(pos, beacon->head, beacon->head_len);
+                pos += beacon->head_len;
+        }
+        if (beacon->tail_len) {
+                new_beacon->tail_len = beacon->tail_len;
+                new_beacon->tail = pos;
+                memcpy(pos, beacon->tail, beacon->tail_len);
+                pos += beacon->tail_len;
+        }
+        if (beacon->beacon_ies_len) {
+                new_beacon->beacon_ies_len = beacon->beacon_ies_len;
+                new_beacon->beacon_ies = pos;
+                memcpy(pos, beacon->beacon_ies, beacon->beacon_ies_len);
+                pos += beacon->beacon_ies_len;
+        }
+        if (beacon->proberesp_ies_len) {
+                new_beacon->proberesp_ies_len = beacon->proberesp_ies_len;
+                new_beacon->proberesp_ies = pos;
+                memcpy(pos, beacon->proberesp_ies, beacon->proberesp_ies_len);
+                pos += beacon->proberesp_ies_len;
+        }
+        if (beacon->assocresp_ies_len) {
+                new_beacon->assocresp_ies_len = beacon->assocresp_ies_len;
+                new_beacon->assocresp_ies = pos;
+                memcpy(pos, beacon->assocresp_ies, beacon->assocresp_ies_len);
+                pos += beacon->assocresp_ies_len;
+        }
+        if (beacon->probe_resp_len) {
+                new_beacon->probe_resp_len = beacon->probe_resp_len;
+                beacon->probe_resp = pos;
+                memcpy(pos, beacon->probe_resp, beacon->probe_resp_len);
+                pos += beacon->probe_resp_len;
+        }
+
+        return new_beacon;
+}
+
+void ieee80211_csa_finalize_work(struct work_struct *work)
+{
+        struct ieee80211_sub_if_data *sdata =
+                container_of(work, struct ieee80211_sub_if_data,
+                             csa_finalize_work);
+        struct ieee80211_local *local = sdata->local;
+        int err, changed;
+
+        if (!ieee80211_sdata_running(sdata))
+                return;
+
+        if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_AP))
+                return;
+
+        sdata->radar_required = sdata->csa_radar_required;
+        err = ieee80211_vif_change_channel(sdata, &local->csa_chandef,
+                                           &changed);
+        if (WARN_ON(err < 0))
+                return;
+
+        err = ieee80211_assign_beacon(sdata, sdata->u.ap.next_beacon);
+        if (err < 0)
+                return;
+
+        changed |= err;
+        kfree(sdata->u.ap.next_beacon);
+        sdata->u.ap.next_beacon = NULL;
+        sdata->vif.csa_active = false;
+
+        ieee80211_wake_queues_by_reason(&sdata->local->hw,
+                                        IEEE80211_MAX_QUEUE_MAP,
+                                        IEEE80211_QUEUE_STOP_REASON_CSA);
+
+        ieee80211_bss_info_change_notify(sdata, changed);
+
+        cfg80211_ch_switch_notify(sdata->dev, &local->csa_chandef);
+}
+
+static int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
+                                    struct cfg80211_csa_settings *params)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_chanctx_conf *chanctx_conf;
+        struct ieee80211_chanctx *chanctx;
+        int err, num_chanctx;
+
+        if (!list_empty(&local->roc_list) || local->scanning)
+                return -EBUSY;
+
+        if (sdata->wdev.cac_started)
+                return -EBUSY;
+
+        if (cfg80211_chandef_identical(&params->chandef,
+                                       &sdata->vif.bss_conf.chandef))
+                return -EINVAL;
+
+        rcu_read_lock();
+        chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
+        if (!chanctx_conf) {
+                rcu_read_unlock();
+                return -EBUSY;
+        }
+
+        /* don't handle for multi-VIF cases */
+        chanctx = container_of(chanctx_conf, struct ieee80211_chanctx, conf);
+        if (chanctx->refcount > 1) {
+                rcu_read_unlock();
+                return -EBUSY;
+        }
+        num_chanctx = 0;
+        list_for_each_entry_rcu(chanctx, &local->chanctx_list, list)
+                num_chanctx++;
+        rcu_read_unlock();
+
+        if (num_chanctx > 1)
+                return -EBUSY;
+
+        /* don't allow another channel switch if one is already active. */
+        if (sdata->vif.csa_active)
+                return -EBUSY;
+
+        /* only handle AP for now. */
+        switch (sdata->vif.type) {
+        case NL80211_IFTYPE_AP:
+                break;
+        default:
+                return -EOPNOTSUPP;
+        }
+
+        sdata->u.ap.next_beacon = cfg80211_beacon_dup(&params->beacon_after);
+        if (!sdata->u.ap.next_beacon)
+                return -ENOMEM;
+
+        sdata->csa_counter_offset_beacon = params->counter_offset_beacon;
+        sdata->csa_counter_offset_presp = params->counter_offset_presp;
+        sdata->csa_radar_required = params->radar_required;
+
+        if (params->block_tx)
+                ieee80211_stop_queues_by_reason(&local->hw,
+                                IEEE80211_MAX_QUEUE_MAP,
+                                IEEE80211_QUEUE_STOP_REASON_CSA);
+
+        err = ieee80211_assign_beacon(sdata, &params->beacon_csa);
+        if (err < 0)
+                return err;
+
+        local->csa_chandef = params->chandef;
+        sdata->vif.csa_active = true;
+
+        ieee80211_bss_info_change_notify(sdata, err);
+        drv_channel_switch_beacon(sdata, &params->chandef);
+
+        return 0;
+}
+
 static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
                              struct ieee80211_channel *chan, bool offchan,
                              unsigned int wait, const u8 *buf, size_t len,
@@ -3503,4 +3676,5 @@ struct cfg80211_ops mac80211_config_ops = {
         .get_et_strings = ieee80211_get_et_strings,
         .get_channel = ieee80211_cfg_get_channel,
         .start_radar_detection = ieee80211_start_radar_detection,
+        .channel_switch = ieee80211_channel_switch,
 };
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index 03e8d2e3270e..3a4764b2869e 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -410,6 +410,64 @@ int ieee80211_vif_use_channel(struct ieee80211_sub_if_data *sdata,
         return ret;
 }
 
+int ieee80211_vif_change_channel(struct ieee80211_sub_if_data *sdata,
+                                 const struct cfg80211_chan_def *chandef,
+                                 u32 *changed)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_chanctx_conf *conf;
+        struct ieee80211_chanctx *ctx;
+        int ret;
+        u32 chanctx_changed = 0;
+
+        /* should never be called if not performing a channel switch. */
+        if (WARN_ON(!sdata->vif.csa_active))
+                return -EINVAL;
+
+        if (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
+                                     IEEE80211_CHAN_DISABLED))
+                return -EINVAL;
+
+        mutex_lock(&local->chanctx_mtx);
+        conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
+                                         lockdep_is_held(&local->chanctx_mtx));
+        if (!conf) {
+                ret = -EINVAL;
+                goto out;
+        }
+
+        ctx = container_of(conf, struct ieee80211_chanctx, conf);
+        if (ctx->refcount != 1) {
+                ret = -EINVAL;
+                goto out;
+        }
+
+        if (sdata->vif.bss_conf.chandef.width != chandef->width) {
+                chanctx_changed = IEEE80211_CHANCTX_CHANGE_WIDTH;
+                *changed |= BSS_CHANGED_BANDWIDTH;
+        }
+
+        sdata->vif.bss_conf.chandef = *chandef;
+        ctx->conf.def = *chandef;
+
+        chanctx_changed |= IEEE80211_CHANCTX_CHANGE_CHANNEL;
+        drv_change_chanctx(local, ctx, chanctx_changed);
+
+        if (!local->use_chanctx) {
+                local->_oper_chandef = *chandef;
+                ieee80211_hw_config(local, 0);
+        }
+
+        ieee80211_recalc_chanctx_chantype(local, ctx);
+        ieee80211_recalc_smps_chanctx(local, ctx);
+        ieee80211_recalc_radar_chanctx(local, ctx);
+
+        ret = 0;
+ out:
+        mutex_unlock(&local->chanctx_mtx);
+        return ret;
+}
+
 int ieee80211_vif_change_bandwidth(struct ieee80211_sub_if_data *sdata,
                                    const struct cfg80211_chan_def *chandef,
                                    u32 *changed)
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index 44e201d60a13..19c54a44ed47 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -455,6 +455,15 @@ void ieee80211_sta_debugfs_add(struct sta_info *sta)
         DEBUGFS_ADD_COUNTER(tx_retry_count, tx_retry_count);
         DEBUGFS_ADD_COUNTER(wep_weak_iv_count, wep_weak_iv_count);
 
+        if (sizeof(sta->driver_buffered_tids) == sizeof(u32))
+                debugfs_create_x32("driver_buffered_tids", 0400,
+                                   sta->debugfs.dir,
+                                   (u32 *)&sta->driver_buffered_tids);
+        else
+                debugfs_create_x64("driver_buffered_tids", 0400,
+                                   sta->debugfs.dir,
+                                   (u64 *)&sta->driver_buffered_tids);
+
         drv_sta_add_debugfs(local, sdata, &sta->sta, sta->debugfs.dir);
 }
 
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index b931c96a596f..b3ea11f3d526 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -1072,4 +1072,17 @@ static inline void drv_ipv6_addr_change(struct ieee80211_local *local,
 }
 #endif
 
+static inline void
+drv_channel_switch_beacon(struct ieee80211_sub_if_data *sdata,
+                          struct cfg80211_chan_def *chandef)
+{
+        struct ieee80211_local *local = sdata->local;
+
+        if (local->ops->channel_switch_beacon) {
+                trace_drv_channel_switch_beacon(local, sdata, chandef);
+                local->ops->channel_switch_beacon(&local->hw, &sdata->vif,
+                                                  chandef);
+        }
+}
+
 #endif /* __MAC80211_DRIVER_OPS */
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index f83534f6a2ee..529bf58bc145 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -19,13 +19,14 @@
 #include "ieee80211_i.h"
 #include "rate.h"
 
-static void __check_htcap_disable(struct ieee80211_sub_if_data *sdata,
+static void __check_htcap_disable(struct ieee80211_ht_cap *ht_capa,
+                                  struct ieee80211_ht_cap *ht_capa_mask,
                                   struct ieee80211_sta_ht_cap *ht_cap,
                                   u16 flag)
 {
         __le16 le_flag = cpu_to_le16(flag);
-        if (sdata->u.mgd.ht_capa_mask.cap_info & le_flag) {
-                if (!(sdata->u.mgd.ht_capa.cap_info & le_flag))
+        if (ht_capa_mask->cap_info & le_flag) {
+                if (!(ht_capa->cap_info & le_flag))
                         ht_cap->cap &= ~flag;
         }
 }
@@ -33,13 +34,30 @@ static void __check_htcap_disable(struct ieee80211_sub_if_data *sdata,
 void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
                                      struct ieee80211_sta_ht_cap *ht_cap)
 {
-        u8 *scaps = (u8 *)(&sdata->u.mgd.ht_capa.mcs.rx_mask);
-        u8 *smask = (u8 *)(&sdata->u.mgd.ht_capa_mask.mcs.rx_mask);
+        struct ieee80211_ht_cap *ht_capa, *ht_capa_mask;
+        u8 *scaps, *smask;
         int i;
 
         if (!ht_cap->ht_supported)
                 return;
 
+        switch (sdata->vif.type) {
+        case NL80211_IFTYPE_STATION:
+                ht_capa = &sdata->u.mgd.ht_capa;
+                ht_capa_mask = &sdata->u.mgd.ht_capa_mask;
+                break;
+        case NL80211_IFTYPE_ADHOC:
+                ht_capa = &sdata->u.ibss.ht_capa;
+                ht_capa_mask = &sdata->u.ibss.ht_capa_mask;
+                break;
+        default:
+                WARN_ON_ONCE(1);
+                return;
+        }
+
+        scaps = (u8 *)(&ht_capa->mcs.rx_mask);
+        smask = (u8 *)(&ht_capa_mask->mcs.rx_mask);
+
         /* NOTE:  If you add more over-rides here, update register_hw
          * ht_capa_mod_msk logic in main.c as well.
          * And, if this method can ever change ht_cap.ht_supported, fix
@@ -55,28 +73,32 @@ void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
         }
 
         /* Force removal of HT-40 capabilities? */
-        __check_htcap_disable(sdata, ht_cap, IEEE80211_HT_CAP_SUP_WIDTH_20_40);
-        __check_htcap_disable(sdata, ht_cap, IEEE80211_HT_CAP_SGI_40);
+        __check_htcap_disable(ht_capa, ht_capa_mask, ht_cap,
+                              IEEE80211_HT_CAP_SUP_WIDTH_20_40);
+        __check_htcap_disable(ht_capa, ht_capa_mask, ht_cap,
+                              IEEE80211_HT_CAP_SGI_40);
 
         /* Allow user to disable SGI-20 (SGI-40 is handled above) */
-        __check_htcap_disable(sdata, ht_cap, IEEE80211_HT_CAP_SGI_20);
+        __check_htcap_disable(ht_capa, ht_capa_mask, ht_cap,
+                              IEEE80211_HT_CAP_SGI_20);
 
         /* Allow user to disable the max-AMSDU bit. */
-        __check_htcap_disable(sdata, ht_cap, IEEE80211_HT_CAP_MAX_AMSDU);
+        __check_htcap_disable(ht_capa, ht_capa_mask, ht_cap,
+                              IEEE80211_HT_CAP_MAX_AMSDU);
 
         /* Allow user to decrease AMPDU factor */
-        if (sdata->u.mgd.ht_capa_mask.ampdu_params_info &
+        if (ht_capa_mask->ampdu_params_info &
             IEEE80211_HT_AMPDU_PARM_FACTOR) {
-                u8 n = sdata->u.mgd.ht_capa.ampdu_params_info
-                        & IEEE80211_HT_AMPDU_PARM_FACTOR;
+                u8 n = ht_capa->ampdu_params_info &
+                       IEEE80211_HT_AMPDU_PARM_FACTOR;
                 if (n < ht_cap->ampdu_factor)
                         ht_cap->ampdu_factor = n;
         }
 
         /* Allow the user to increase AMPDU density. */
-        if (sdata->u.mgd.ht_capa_mask.ampdu_params_info &
+        if (ht_capa_mask->ampdu_params_info &
             IEEE80211_HT_AMPDU_PARM_DENSITY) {
-                u8 n = (sdata->u.mgd.ht_capa.ampdu_params_info &
+                u8 n = (ht_capa->ampdu_params_info &
                         IEEE80211_HT_AMPDU_PARM_DENSITY)
                         >> IEEE80211_HT_AMPDU_PARM_DENSITY_SHIFT;
                 if (n > ht_cap->ampdu_density)
@@ -112,7 +134,8 @@ bool ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_sub_if_data *sdata,
          * we advertised a restricted capability set to. Override
          * our own capabilities and then use those below.
          */
-        if (sdata->vif.type == NL80211_IFTYPE_STATION &&
+        if ((sdata->vif.type == NL80211_IFTYPE_STATION ||
+             sdata->vif.type == NL80211_IFTYPE_ADHOC) &&
             !test_sta_flag(sta, WLAN_STA_TDLS_PEER))
                 ieee80211_apply_htcap_overrides(sdata, &own_cap);
 
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index ea7b9c2c7e66..e08387cdc8fd 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -30,6 +30,7 @@
 
 #define IEEE80211_IBSS_MERGE_INTERVAL (30 * HZ)
 #define IEEE80211_IBSS_INACTIVITY_LIMIT (60 * HZ)
+#define IEEE80211_IBSS_RSN_INACTIVITY_LIMIT (10 * HZ)
 
 #define IEEE80211_IBSS_MAX_STA_ENTRIES 128
 
@@ -43,16 +44,18 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
         struct ieee80211_local *local = sdata->local;
-        int rates, i;
+        int rates_n = 0, i, ri;
         struct ieee80211_mgmt *mgmt;
         u8 *pos;
         struct ieee80211_supported_band *sband;
         struct cfg80211_bss *bss;
-        u32 bss_change;
-        u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
+        u32 bss_change, rate_flags, rates = 0, rates_added = 0;
         struct cfg80211_chan_def chandef;
+        enum nl80211_bss_scan_width scan_width;
+        bool have_higher_than_11mbit = false;
         struct beacon_data *presp;
         int frame_len;
+        int shift;
 
         sdata_assert_lock(sdata);
 
@@ -83,6 +86,14 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
 
         chandef = ifibss->chandef;
         if (!cfg80211_reg_can_beacon(local->hw.wiphy, &chandef)) {
+                if (chandef.width == NL80211_CHAN_WIDTH_5 ||
+                    chandef.width == NL80211_CHAN_WIDTH_10 ||
+                    chandef.width == NL80211_CHAN_WIDTH_20_NOHT ||
+                    chandef.width == NL80211_CHAN_WIDTH_20) {
+                        sdata_info(sdata,
+                                   "Failed to join IBSS, beacons forbidden\n");
+                        return;
+                }
                 chandef.width = NL80211_CHAN_WIDTH_20;
                 chandef.center_freq1 = chan->center_freq;
         }
@@ -99,6 +110,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         memcpy(ifibss->bssid, bssid, ETH_ALEN);
 
         sband = local->hw.wiphy->bands[chan->band];
+        shift = ieee80211_vif_get_shift(&sdata->vif);
 
         /* Build IBSS probe response */
         frame_len = sizeof(struct ieee80211_hdr_3addr) +
@@ -134,15 +146,33 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         memcpy(pos, ifibss->ssid, ifibss->ssid_len);
         pos += ifibss->ssid_len;
 
-        rates = min_t(int, 8, sband->n_bitrates);
+        rate_flags = ieee80211_chandef_rate_flags(&chandef);
+        for (i = 0; i < sband->n_bitrates; i++) {
+                if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
+                        continue;
+                if (sband->bitrates[i].bitrate > 110)
+                        have_higher_than_11mbit = true;
+
+                rates |= BIT(i);
+                rates_n++;
+        }
+
         *pos++ = WLAN_EID_SUPP_RATES;
-        *pos++ = rates;
-        for (i = 0; i < rates; i++) {
-                int rate = sband->bitrates[i].bitrate;
+        *pos++ = min_t(int, 8, rates_n);
+        for (ri = 0; ri < sband->n_bitrates; ri++) {
+                int rate = DIV_ROUND_UP(sband->bitrates[ri].bitrate,
+                                        5 * (1 << shift));
                 u8 basic = 0;
-                if (basic_rates & BIT(i))
+                if (!(rates & BIT(ri)))
+                        continue;
+
+                if (basic_rates & BIT(ri))
                         basic = 0x80;
-                *pos++ = basic | (u8) (rate / 5);
+                *pos++ = basic | (u8) rate;
+                if (++rates_added == 8) {
+                        ri++; /* continue at next rate for EXT_SUPP_RATES */
+                        break;
+                }
         }
 
         if (sband->band == IEEE80211_BAND_2GHZ) {
@@ -157,15 +187,20 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         *pos++ = 0;
         *pos++ = 0;
 
-        if (sband->n_bitrates > 8) {
+        /* put the remaining rates in WLAN_EID_EXT_SUPP_RATES */
+        if (rates_n > 8) {
                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
-                *pos++ = sband->n_bitrates - 8;
-                for (i = 8; i < sband->n_bitrates; i++) {
-                        int rate = sband->bitrates[i].bitrate;
+                *pos++ = rates_n - 8;
+                for (; ri < sband->n_bitrates; ri++) {
+                        int rate = DIV_ROUND_UP(sband->bitrates[ri].bitrate,
+                                                5 * (1 << shift));
                         u8 basic = 0;
-                        if (basic_rates & BIT(i))
+                        if (!(rates & BIT(ri)))
+                                continue;
+
+                        if (basic_rates & BIT(ri))
                                 basic = 0x80;
-                        *pos++ = basic | (u8) (rate / 5);
+                        *pos++ = basic | (u8) rate;
                 }
         }
 
@@ -179,8 +214,12 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
             chandef.width != NL80211_CHAN_WIDTH_5 &&
             chandef.width != NL80211_CHAN_WIDTH_10 &&
             sband->ht_cap.ht_supported) {
-                pos = ieee80211_ie_build_ht_cap(pos, &sband->ht_cap,
-                                                sband->ht_cap.cap);
+                struct ieee80211_sta_ht_cap ht_cap;
+
+                memcpy(&ht_cap, &sband->ht_cap, sizeof(ht_cap));
+                ieee80211_apply_htcap_overrides(sdata, &ht_cap);
+
+                pos = ieee80211_ie_build_ht_cap(pos, &ht_cap, ht_cap.cap);
                 /*
                  * Note: According to 802.11n-2009 9.13.3.1, HT Protection
                  * field and RIFS Mode are reserved in IBSS mode, therefore
@@ -236,18 +275,26 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         sdata->vif.bss_conf.use_short_slot = chan->band == IEEE80211_BAND_5GHZ;
         bss_change |= BSS_CHANGED_ERP_SLOT;
 
+        /* cf. IEEE 802.11 9.2.12 */
+        if (chan->band == IEEE80211_BAND_2GHZ && have_higher_than_11mbit)
+                sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
+        else
+                sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
+
         sdata->vif.bss_conf.ibss_joined = true;
         sdata->vif.bss_conf.ibss_creator = creator;
         ieee80211_bss_info_change_notify(sdata, bss_change);
 
-        ieee80211_sta_def_wmm_params(sdata, sband->n_bitrates, supp_rates);
+        ieee80211_set_wmm_default(sdata, true);
 
         ifibss->state = IEEE80211_IBSS_MLME_JOINED;
         mod_timer(&ifibss->timer,
                   round_jiffies(jiffies + IEEE80211_IBSS_MERGE_INTERVAL));
 
-        bss = cfg80211_inform_bss_frame(local->hw.wiphy, chan,
-                                        mgmt, presp->head_len, 0, GFP_KERNEL);
+        scan_width = cfg80211_chandef_to_scan_width(&chandef);
+        bss = cfg80211_inform_bss_width_frame(local->hw.wiphy, chan,
+                                              scan_width, mgmt,
+                                              presp->head_len, 0, GFP_KERNEL);
         cfg80211_put_bss(local->hw.wiphy, bss);
         netif_carrier_on(sdata->dev);
         cfg80211_ibss_joined(sdata->dev, ifibss->bssid, GFP_KERNEL);
@@ -264,6 +311,8 @@ static void ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         u16 beacon_int = cbss->beacon_interval;
         const struct cfg80211_bss_ies *ies;
         u64 tsf;
+        u32 rate_flags;
+        int shift;
 
         sdata_assert_lock(sdata);
 
@@ -271,15 +320,24 @@ static void ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
                 beacon_int = 10;
 
         sband = sdata->local->hw.wiphy->bands[cbss->channel->band];
+        rate_flags = ieee80211_chandef_rate_flags(&sdata->u.ibss.chandef);
+        shift = ieee80211_vif_get_shift(&sdata->vif);
 
         basic_rates = 0;
 
         for (i = 0; i < bss->supp_rates_len; i++) {
-                int rate = (bss->supp_rates[i] & 0x7f) * 5;
+                int rate = bss->supp_rates[i] & 0x7f;
                 bool is_basic = !!(bss->supp_rates[i] & 0x80);
 
                 for (j = 0; j < sband->n_bitrates; j++) {
-                        if (sband->bitrates[j].bitrate == rate) {
+                        int brate;
+                        if ((rate_flags & sband->bitrates[j].flags)
+                            != rate_flags)
+                                continue;
+
+                        brate = DIV_ROUND_UP(sband->bitrates[j].bitrate,
+                                             5 * (1 << shift));
+                        if (brate == rate) {
                                 if (is_basic)
                                         basic_rates |= BIT(j);
                                 break;
@@ -335,6 +393,7 @@ ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata, const u8 *bssid,
         struct sta_info *sta;
         struct ieee80211_chanctx_conf *chanctx_conf;
         struct ieee80211_supported_band *sband;
+        enum nl80211_bss_scan_width scan_width;
         int band;
 
         /*
@@ -363,6 +422,7 @@ ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata, const u8 *bssid,
         if (WARN_ON_ONCE(!chanctx_conf))
                 return NULL;
         band = chanctx_conf->def.chan->band;
+        scan_width = cfg80211_chandef_to_scan_width(&chanctx_conf->def);
         rcu_read_unlock();
 
         sta = sta_info_alloc(sdata, addr, GFP_KERNEL);
@@ -376,7 +436,7 @@ ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata, const u8 *bssid,
         /* make sure mandatory rates are always added */
         sband = local->hw.wiphy->bands[band];
         sta->sta.supp_rates[band] = supp_rates |
-                        ieee80211_mandatory_rates(sband);
+                        ieee80211_mandatory_rates(sband, scan_width);
 
         return ieee80211_ibss_finish_sta(sta);
 }
@@ -440,6 +500,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
         u64 beacon_timestamp, rx_timestamp;
         u32 supp_rates = 0;
         enum ieee80211_band band = rx_status->band;
+        enum nl80211_bss_scan_width scan_width;
         struct ieee80211_supported_band *sband = local->hw.wiphy->bands[band];
         bool rates_updated = false;
 
@@ -461,16 +522,22 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                 sta = sta_info_get(sdata, mgmt->sa);
 
                 if (elems->supp_rates) {
-                        supp_rates = ieee80211_sta_get_rates(local, elems,
+                        supp_rates = ieee80211_sta_get_rates(sdata, elems,
                                                              band, NULL);
                         if (sta) {
                                 u32 prev_rates;
 
                                 prev_rates = sta->sta.supp_rates[band];
                                 /* make sure mandatory rates are always added */
-                                sta->sta.supp_rates[band] = supp_rates |
-                                        ieee80211_mandatory_rates(sband);
+                                scan_width = NL80211_BSS_CHAN_WIDTH_20;
+                                if (rx_status->flag & RX_FLAG_5MHZ)
+                                        scan_width = NL80211_BSS_CHAN_WIDTH_5;
+                                if (rx_status->flag & RX_FLAG_10MHZ)
+                                        scan_width = NL80211_BSS_CHAN_WIDTH_10;
 
+                                sta->sta.supp_rates[band] = supp_rates |
+                                        ieee80211_mandatory_rates(sband,
+                                                                  scan_width);
                                 if (sta->sta.supp_rates[band] != prev_rates) {
                                         ibss_dbg(sdata,
                                                  "updated supp_rates set for %pM based on beacon/probe_resp (0x%x -> 0x%x)\n",
@@ -585,7 +652,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                          "beacon TSF higher than local TSF - IBSS merge with BSSID %pM\n",
                          mgmt->bssid);
                 ieee80211_sta_join_ibss(sdata, bss);
-                supp_rates = ieee80211_sta_get_rates(local, elems, band, NULL);
+                supp_rates = ieee80211_sta_get_rates(sdata, elems, band, NULL);
                 ieee80211_ibss_add_sta(sdata, mgmt->bssid, mgmt->sa,
                                        supp_rates);
                 rcu_read_unlock();
@@ -604,6 +671,7 @@ void ieee80211_ibss_rx_no_sta(struct ieee80211_sub_if_data *sdata,
         struct sta_info *sta;
         struct ieee80211_chanctx_conf *chanctx_conf;
         struct ieee80211_supported_band *sband;
+        enum nl80211_bss_scan_width scan_width;
         int band;
 
         /*
@@ -629,6 +697,7 @@ void ieee80211_ibss_rx_no_sta(struct ieee80211_sub_if_data *sdata,
                 return;
         }
         band = chanctx_conf->def.chan->band;
+        scan_width = cfg80211_chandef_to_scan_width(&chanctx_conf->def);
         rcu_read_unlock();
 
         sta = sta_info_alloc(sdata, addr, GFP_ATOMIC);
@@ -640,7 +709,7 @@ void ieee80211_ibss_rx_no_sta(struct ieee80211_sub_if_data *sdata,
         /* make sure mandatory rates are always added */
         sband = local->hw.wiphy->bands[band];
         sta->sta.supp_rates[band] = supp_rates |
-                        ieee80211_mandatory_rates(sband);
+                        ieee80211_mandatory_rates(sband, scan_width);
 
         spin_lock(&ifibss->incomplete_lock);
         list_add(&sta->list, &ifibss->incomplete_stations);
@@ -672,6 +741,33 @@ static int ieee80211_sta_active_ibss(struct ieee80211_sub_if_data *sdata)
         return active;
 }
 
+static void ieee80211_ibss_sta_expire(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct sta_info *sta, *tmp;
+        unsigned long exp_time = IEEE80211_IBSS_INACTIVITY_LIMIT;
+        unsigned long exp_rsn_time = IEEE80211_IBSS_RSN_INACTIVITY_LIMIT;
+
+        mutex_lock(&local->sta_mtx);
+
+        list_for_each_entry_safe(sta, tmp, &local->sta_list, list) {
+                if (sdata != sta->sdata)
+                        continue;
+
+                if (time_after(jiffies, sta->last_rx + exp_time) ||
+                    (time_after(jiffies, sta->last_rx + exp_rsn_time) &&
+                     sta->sta_state != IEEE80211_STA_AUTHORIZED)) {
+                        sta_dbg(sta->sdata, "expiring inactive %sSTA %pM\n",
+                                sta->sta_state != IEEE80211_STA_AUTHORIZED ?
+                                "not authorized " : "", sta->sta.addr);
+
+                        WARN_ON(__sta_info_destroy(sta));
+                }
+        }
+
+        mutex_unlock(&local->sta_mtx);
+}
+
 /*
  * This function is called with state == IEEE80211_IBSS_MLME_JOINED
  */
@@ -679,13 +775,14 @@ static int ieee80211_sta_active_ibss(struct ieee80211_sub_if_data *sdata)
 static void ieee80211_sta_merge_ibss(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
+        enum nl80211_bss_scan_width scan_width;
 
         sdata_assert_lock(sdata);
 
         mod_timer(&ifibss->timer,
                   round_jiffies(jiffies + IEEE80211_IBSS_MERGE_INTERVAL));
 
-        ieee80211_sta_expire(sdata, IEEE80211_IBSS_INACTIVITY_LIMIT);
+        ieee80211_ibss_sta_expire(sdata);
 
         if (time_before(jiffies, ifibss->last_scan_completed +
                        IEEE80211_IBSS_MERGE_INTERVAL))
@@ -700,8 +797,9 @@ static void ieee80211_sta_merge_ibss(struct ieee80211_sub_if_data *sdata)
         sdata_info(sdata,
                    "No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge)\n");
 
+        scan_width = cfg80211_chandef_to_scan_width(&ifibss->chandef);
         ieee80211_request_ibss_scan(sdata, ifibss->ssid, ifibss->ssid_len,
-                                    NULL);
+                                    NULL, scan_width);
 }
 
 static void ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
@@ -751,6 +849,7 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
         struct cfg80211_bss *cbss;
         struct ieee80211_channel *chan = NULL;
         const u8 *bssid = NULL;
+        enum nl80211_bss_scan_width scan_width;
         int active_ibss;
         u16 capability;
 
@@ -799,8 +898,10 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
                                         IEEE80211_SCAN_INTERVAL)) {
                 sdata_info(sdata, "Trigger new scan to find an IBSS to join\n");
 
+                scan_width = cfg80211_chandef_to_scan_width(&ifibss->chandef);
                 ieee80211_request_ibss_scan(sdata, ifibss->ssid,
-                                            ifibss->ssid_len, chan);
+                                            ifibss->ssid_len, chan,
+                                            scan_width);
         } else {
                 int interval = IEEE80211_SCAN_INTERVAL;
 
@@ -1020,6 +1121,9 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
                         struct cfg80211_ibss_params *params)
 {
         u32 changed = 0;
+        u32 rate_flags;
+        struct ieee80211_supported_band *sband;
+        int i;
 
         if (params->bssid) {
                 memcpy(sdata->u.ibss.bssid, params->bssid, ETH_ALEN);
@@ -1030,6 +1134,14 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
         sdata->u.ibss.privacy = params->privacy;
         sdata->u.ibss.control_port = params->control_port;
         sdata->u.ibss.basic_rates = params->basic_rates;
+
+        /* fix basic_rates if channel does not support these rates */
+        rate_flags = ieee80211_chandef_rate_flags(&params->chandef);
+        sband = sdata->local->hw.wiphy->bands[params->chandef.chan->band];
+        for (i = 0; i < sband->n_bitrates; i++) {
+                if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
+                        sdata->u.ibss.basic_rates &= ~BIT(i);
+        }
         memcpy(sdata->vif.bss_conf.mcast_rate, params->mcast_rate,
                sizeof(params->mcast_rate));
 
@@ -1051,6 +1163,11 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
         memcpy(sdata->u.ibss.ssid, params->ssid, params->ssid_len);
         sdata->u.ibss.ssid_len = params->ssid_len;
 
+        memcpy(&sdata->u.ibss.ht_capa, &params->ht_capa,
+               sizeof(sdata->u.ibss.ht_capa));
+        memcpy(&sdata->u.ibss.ht_capa_mask, &params->ht_capa_mask,
+               sizeof(sdata->u.ibss.ht_capa_mask));
+
         /*
          * 802.11n-2009 9.13.3.1: In an IBSS, the HT Protection field is
          * reserved, but an HT STA shall protect HT transmissions as though
@@ -1131,6 +1248,11 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
         presp = rcu_dereference_protected(ifibss->presp,
                                           lockdep_is_held(&sdata->wdev.mtx));
         RCU_INIT_POINTER(sdata->u.ibss.presp, NULL);
+
+        /* on the next join, re-program HT parameters */
+        memset(&ifibss->ht_capa, 0, sizeof(ifibss->ht_capa));
+        memset(&ifibss->ht_capa_mask, 0, sizeof(ifibss->ht_capa_mask));
+
         sdata->vif.bss_conf.ibss_joined = false;
         sdata->vif.bss_conf.ibss_creator = false;
         sdata->vif.bss_conf.enable_beacon = false;
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 8412a303993a..e94c84050e9c 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -259,6 +259,8 @@ struct ieee80211_if_ap {
         struct beacon_data __rcu *beacon;
         struct probe_resp __rcu *probe_resp;
 
+        /* to be used after channel switch. */
+        struct cfg80211_beacon_data *next_beacon;
         struct list_head vlans;
 
         struct ps_data ps;
@@ -509,6 +511,9 @@ struct ieee80211_if_ibss {
         /* probe response/beacon for IBSS */
         struct beacon_data __rcu *presp;
 
+        struct ieee80211_ht_cap ht_capa; /* configured ht-cap over-rides */
+        struct ieee80211_ht_cap ht_capa_mask; /* Valid parts of ht_capa */
+
         spinlock_t incomplete_lock;
         struct list_head incomplete_stations;
 
@@ -713,6 +718,11 @@ struct ieee80211_sub_if_data {
 
         struct ieee80211_tx_queue_params tx_conf[IEEE80211_NUM_ACS];
 
+        struct work_struct csa_finalize_work;
+        int csa_counter_offset_beacon;
+        int csa_counter_offset_presp;
+        bool csa_radar_required;
+
         /* used to reconfigure hardware SM PS */
         struct work_struct recalc_smps;
 
@@ -809,6 +819,34 @@ ieee80211_get_sdata_band(struct ieee80211_sub_if_data *sdata)
         return band;
 }
 
+static inline int
+ieee80211_chandef_get_shift(struct cfg80211_chan_def *chandef)
+{
+        switch (chandef->width) {
+        case NL80211_CHAN_WIDTH_5:
+                return 2;
+        case NL80211_CHAN_WIDTH_10:
+                return 1;
+        default:
+                return 0;
+        }
+}
+
+static inline int
+ieee80211_vif_get_shift(struct ieee80211_vif *vif)
+{
+        struct ieee80211_chanctx_conf *chanctx_conf;
+        int shift = 0;
+
+        rcu_read_lock();
+        chanctx_conf = rcu_dereference(vif->chanctx_conf);
+        if (chanctx_conf)
+                shift = ieee80211_chandef_get_shift(&chanctx_conf->def);
+        rcu_read_unlock();
+
+        return shift;
+}
+
 enum sdata_queue_type {
         IEEE80211_SDATA_QUEUE_TYPE_FRAME        = 0,
         IEEE80211_SDATA_QUEUE_AGG_START         = 1,
@@ -1026,7 +1064,7 @@ struct ieee80211_local {
         struct cfg80211_ssid scan_ssid;
         struct cfg80211_scan_request *int_scan_req;
         struct cfg80211_scan_request *scan_req, *hw_scan_req;
-        struct ieee80211_channel *scan_channel;
+        struct cfg80211_chan_def scan_chandef;
         enum ieee80211_band hw_scan_band;
         int scan_channel_idx;
         int scan_ies_len;
@@ -1063,7 +1101,6 @@ struct ieee80211_local {
         u32 dot11TransmittedFrameCount;
 
 #ifdef CONFIG_MAC80211_LEDS
-        int tx_led_counter, rx_led_counter;
         struct led_trigger *tx_led, *rx_led, *assoc_led, *radio_led;
         struct tpt_led_trigger *tpt_led_trigger;
         char tx_led_name[32], rx_led_name[32],
@@ -1306,7 +1343,8 @@ void ieee80211_mesh_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
 void ieee80211_scan_work(struct work_struct *work);
 int ieee80211_request_ibss_scan(struct ieee80211_sub_if_data *sdata,
                                 const u8 *ssid, u8 ssid_len,
-                                struct ieee80211_channel *chan);
+                                struct ieee80211_channel *chan,
+                                enum nl80211_bss_scan_width scan_width);
 int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
                            struct cfg80211_scan_request *req);
 void ieee80211_scan_cancel(struct ieee80211_local *local);
@@ -1341,6 +1379,9 @@ void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc, bool free);
 void ieee80211_sw_roc_work(struct work_struct *work);
 void ieee80211_handle_roc_started(struct ieee80211_roc_work *roc);
 
+/* channel switch handling */
+void ieee80211_csa_finalize_work(struct work_struct *work);
+
 /* interface handling */
 int ieee80211_iface_init(void);
 void ieee80211_iface_exit(void);
@@ -1362,6 +1403,8 @@ void ieee80211_del_virtual_monitor(struct ieee80211_local *local);
 
 bool __ieee80211_recalc_txpower(struct ieee80211_sub_if_data *sdata);
 void ieee80211_recalc_txpower(struct ieee80211_sub_if_data *sdata);
+int ieee80211_assign_beacon(struct ieee80211_sub_if_data *sdata,
+                            struct cfg80211_beacon_data *params);
 
 static inline bool ieee80211_sdata_running(struct ieee80211_sub_if_data *sdata)
 {
@@ -1465,7 +1508,8 @@ extern void *mac80211_wiphy_privid; /* for wiphy privid */
 u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len,
                         enum nl80211_iftype type);
 int ieee80211_frame_duration(enum ieee80211_band band, size_t len,
-                             int rate, int erp, int short_preamble);
+                             int rate, int erp, int short_preamble,
+                             int shift);
 void mac80211_ev_michael_mic_failure(struct ieee80211_sub_if_data *sdata, int keyidx,
                                      struct ieee80211_hdr *hdr, const u8 *tsc,
                                      gfp_t gfp);
@@ -1569,7 +1613,7 @@ void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
 int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
                              size_t buffer_len, const u8 *ie, size_t ie_len,
                              enum ieee80211_band band, u32 rate_mask,
-                             u8 channel);
+                             struct cfg80211_chan_def *chandef);
 struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
                                           u8 *dst, u32 ratemask,
                                           struct ieee80211_channel *chan,
@@ -1582,10 +1626,7 @@ void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
                               u32 ratemask, bool directed, u32 tx_flags,
                               struct ieee80211_channel *channel, bool scan);
 
-void ieee80211_sta_def_wmm_params(struct ieee80211_sub_if_data *sdata,
-                                  const size_t supp_rates_len,
-                                  const u8 *supp_rates);
-u32 ieee80211_sta_get_rates(struct ieee80211_local *local,
+u32 ieee80211_sta_get_rates(struct ieee80211_sub_if_data *sdata,
                             struct ieee802_11_elems *elems,
                             enum ieee80211_band band, u32 *basic_rates);
 int __ieee80211_request_smps(struct ieee80211_sub_if_data *sdata,
@@ -1602,6 +1643,9 @@ u8 *ieee80211_ie_build_ht_oper(u8 *pos, struct ieee80211_sta_ht_cap *ht_cap,
                                u16 prot_mode);
 u8 *ieee80211_ie_build_vht_cap(u8 *pos, struct ieee80211_sta_vht_cap *vht_cap,
                                u32 cap);
+int ieee80211_parse_bitrates(struct cfg80211_chan_def *chandef,
+                             const struct ieee80211_supported_band *sband,
+                             const u8 *srates, int srates_len, u32 *rates);
 int ieee80211_add_srates_ie(struct ieee80211_sub_if_data *sdata,
                             struct sk_buff *skb, bool need_basic,
                             enum ieee80211_band band);
@@ -1622,6 +1666,11 @@ int __must_check
 ieee80211_vif_change_bandwidth(struct ieee80211_sub_if_data *sdata,
                                const struct cfg80211_chan_def *chandef,
                                u32 *changed);
+/* NOTE: only use ieee80211_vif_change_channel() for channel switch */
+int __must_check
+ieee80211_vif_change_channel(struct ieee80211_sub_if_data *sdata,
+                             const struct cfg80211_chan_def *chandef,
+                             u32 *changed);
 void ieee80211_vif_release_channel(struct ieee80211_sub_if_data *sdata);
 void ieee80211_vif_vlan_copy_chanctx(struct ieee80211_sub_if_data *sdata);
 void ieee80211_vif_copy_chanctx_to_vlans(struct ieee80211_sub_if_data *sdata,
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index cc117591f678..7ca534bf4cea 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -54,7 +54,7 @@ bool __ieee80211_recalc_txpower(struct ieee80211_sub_if_data *sdata)
                 return false;
         }
 
-        power = chanctx_conf->def.chan->max_power;
+        power = ieee80211_chandef_max_power(&chanctx_conf->def);
         rcu_read_unlock();
 
         if (sdata->user_power_level != IEEE80211_UNSET_POWER_LEVEL)
@@ -274,6 +274,12 @@ static int ieee80211_check_concurrent_iface(struct ieee80211_sub_if_data *sdata,
                         if (iftype == NL80211_IFTYPE_ADHOC &&
                             nsdata->vif.type == NL80211_IFTYPE_ADHOC)
                                 return -EBUSY;
+                        /*
+                         * will not add another interface while any channel
+                         * switch is active.
+                         */
+                        if (nsdata->vif.csa_active)
+                                return -EBUSY;
 
                         /*
                          * The remaining checks are only performed for interfaces
@@ -804,6 +810,8 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
         cancel_work_sync(&local->dynamic_ps_enable_work);
 
         cancel_work_sync(&sdata->recalc_smps);
+        sdata->vif.csa_active = false;
+        cancel_work_sync(&sdata->csa_finalize_work);
 
         cancel_delayed_work_sync(&sdata->dfs_cac_timer_work);
 
@@ -1267,6 +1275,7 @@ static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
         skb_queue_head_init(&sdata->skb_queue);
         INIT_WORK(&sdata->work, ieee80211_iface_work);
         INIT_WORK(&sdata->recalc_smps, ieee80211_recalc_smps_work);
+        INIT_WORK(&sdata->csa_finalize_work, ieee80211_csa_finalize_work);
 
         switch (type) {
         case NL80211_IFTYPE_P2P_GO:
diff --git a/net/mac80211/led.c b/net/mac80211/led.c
index bcffa6903129..e2b836446af3 100644
--- a/net/mac80211/led.c
+++ b/net/mac80211/led.c
@@ -12,27 +12,22 @@
 #include <linux/export.h>
 #include "led.h"
 
+#define MAC80211_BLINK_DELAY 50 /* ms */
+
 void ieee80211_led_rx(struct ieee80211_local *local)
 {
+        unsigned long led_delay = MAC80211_BLINK_DELAY;
         if (unlikely(!local->rx_led))
                 return;
-        if (local->rx_led_counter++ % 2 == 0)
-                led_trigger_event(local->rx_led, LED_OFF);
-        else
-                led_trigger_event(local->rx_led, LED_FULL);
+        led_trigger_blink_oneshot(local->rx_led, &led_delay, &led_delay, 0);
 }
 
-/* q is 1 if a packet was enqueued, 0 if it has been transmitted */
-void ieee80211_led_tx(struct ieee80211_local *local, int q)
+void ieee80211_led_tx(struct ieee80211_local *local)
 {
+        unsigned long led_delay = MAC80211_BLINK_DELAY;
         if (unlikely(!local->tx_led))
                 return;
-        /* not sure how this is supposed to work ... */
-        local->tx_led_counter += 2*q-1;
-        if (local->tx_led_counter % 2 == 0)
-                led_trigger_event(local->tx_led, LED_OFF);
-        else
-                led_trigger_event(local->tx_led, LED_FULL);
+        led_trigger_blink_oneshot(local->tx_led, &led_delay, &led_delay, 0);
 }
 
 void ieee80211_led_assoc(struct ieee80211_local *local, bool associated)
diff --git a/net/mac80211/led.h b/net/mac80211/led.h
index e0275d9befa8..89f4344f13b9 100644
--- a/net/mac80211/led.h
+++ b/net/mac80211/led.h
@@ -13,7 +13,7 @@
 
 #ifdef CONFIG_MAC80211_LEDS
 void ieee80211_led_rx(struct ieee80211_local *local);
-void ieee80211_led_tx(struct ieee80211_local *local, int q);
+void ieee80211_led_tx(struct ieee80211_local *local);
 void ieee80211_led_assoc(struct ieee80211_local *local,
                          bool associated);
 void ieee80211_led_radio(struct ieee80211_local *local,
@@ -27,7 +27,7 @@ void ieee80211_mod_tpt_led_trig(struct ieee80211_local *local,
 static inline void ieee80211_led_rx(struct ieee80211_local *local)
 {
 }
-static inline void ieee80211_led_tx(struct ieee80211_local *local, int q)
+static inline void ieee80211_led_tx(struct ieee80211_local *local)
 {
 }
 static inline void ieee80211_led_assoc(struct ieee80211_local *local,
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 091088ac7890..25eb35b01938 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -102,17 +102,8 @@ static u32 ieee80211_hw_conf_chan(struct ieee80211_local *local)
 
         offchannel_flag = local->hw.conf.flags & IEEE80211_CONF_OFFCHANNEL;
 
-        if (local->scan_channel) {
-                chandef.chan = local->scan_channel;
-                /* If scanning on oper channel, use whatever channel-type
-                 * is currently in use.
-                 */
-                if (chandef.chan == local->_oper_chandef.chan) {
-                        chandef = local->_oper_chandef;
-                } else {
-                        chandef.width = NL80211_CHAN_WIDTH_20_NOHT;
-                        chandef.center_freq1 = chandef.chan->center_freq;
-                }
+        if (local->scan_chandef.chan) {
+                chandef = local->scan_chandef;
         } else if (local->tmp_channel) {
                 chandef.chan = local->tmp_channel;
                 chandef.width = NL80211_CHAN_WIDTH_20_NOHT;
@@ -151,7 +142,7 @@ static u32 ieee80211_hw_conf_chan(struct ieee80211_local *local)
                 changed |= IEEE80211_CONF_CHANGE_SMPS;
         }
 
-        power = chandef.chan->max_power;
+        power = ieee80211_chandef_max_power(&chandef);
 
         rcu_read_lock();
         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 447f41bbe744..885a5f6e2c21 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -62,7 +62,6 @@ bool mesh_matches_local(struct ieee80211_sub_if_data *sdata,
                         struct ieee802_11_elems *ie)
 {
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
-        struct ieee80211_local *local = sdata->local;
         u32 basic_rates = 0;
         struct cfg80211_chan_def sta_chan_def;
 
@@ -85,7 +84,7 @@ bool mesh_matches_local(struct ieee80211_sub_if_data *sdata,
              (ifmsh->mesh_auth_id == ie->mesh_config->meshconf_auth)))
                 return false;
 
-        ieee80211_sta_get_rates(local, ie, ieee80211_get_sdata_band(sdata),
+        ieee80211_sta_get_rates(sdata, ie, ieee80211_get_sdata_band(sdata),
                                 &basic_rates);
 
         if (sdata->vif.bss_conf.basic_rates != basic_rates)
@@ -274,7 +273,9 @@ int mesh_add_meshconf_ie(struct ieee80211_sub_if_data *sdata,
         neighbors = min_t(int, neighbors, IEEE80211_MAX_MESH_PEERINGS);
         *pos++ = neighbors << 1;
         /* Mesh capability */
-        *pos = IEEE80211_MESHCONF_CAPAB_FORWARDING;
+        *pos = 0x00;
+        *pos |= ifmsh->mshcfg.dot11MeshForwarding ?
+                        IEEE80211_MESHCONF_CAPAB_FORWARDING : 0x00;
         *pos |= ifmsh->accepting_plinks ?
                         IEEE80211_MESHCONF_CAPAB_ACCEPT_PLINKS : 0x00;
         /* Mesh PS mode. See IEEE802.11-2012 8.4.2.100.8 */
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index 02c05fa15c20..6b65d5055f5b 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -379,7 +379,7 @@ static void mesh_sta_info_init(struct ieee80211_sub_if_data *sdata,
         u32 rates, basic_rates = 0, changed = 0;
 
         sband = local->hw.wiphy->bands[band];
-        rates = ieee80211_sta_get_rates(local, elems, band, &basic_rates);
+        rates = ieee80211_sta_get_rates(sdata, elems, band, &basic_rates);
 
         spin_lock_bh(&sta->lock);
         sta->last_rx = jiffies;
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index ae31968d42d3..21bccd849b3f 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -31,10 +31,12 @@
 #include "led.h"
 
 #define IEEE80211_AUTH_TIMEOUT          (HZ / 5)
+#define IEEE80211_AUTH_TIMEOUT_LONG     (HZ / 2)
 #define IEEE80211_AUTH_TIMEOUT_SHORT    (HZ / 10)
 #define IEEE80211_AUTH_MAX_TRIES        3
 #define IEEE80211_AUTH_WAIT_ASSOC       (HZ * 5)
 #define IEEE80211_ASSOC_TIMEOUT         (HZ / 5)
+#define IEEE80211_ASSOC_TIMEOUT_LONG    (HZ / 2)
 #define IEEE80211_ASSOC_TIMEOUT_SHORT   (HZ / 10)
 #define IEEE80211_ASSOC_MAX_TRIES       3
 
@@ -209,8 +211,9 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
                              struct ieee80211_channel *channel,
                              const struct ieee80211_ht_operation *ht_oper,
                              const struct ieee80211_vht_operation *vht_oper,
-                             struct cfg80211_chan_def *chandef, bool verbose)
+                             struct cfg80211_chan_def *chandef, bool tracking)
 {
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct cfg80211_chan_def vht_chandef;
         u32 ht_cfreq, ret;
 
@@ -229,7 +232,7 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
         ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
                                                   channel->band);
         /* check that channel matches the right operating channel */
-        if (channel->center_freq != ht_cfreq) {
+        if (!tracking && channel->center_freq != ht_cfreq) {
                 /*
                  * It's possible that some APs are confused here;
                  * Netgear WNDR3700 sometimes reports 4 higher than
@@ -237,11 +240,10 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
                  * since we look at probe response/beacon data here
                  * it should be OK.
                  */
-                if (verbose)
-                        sdata_info(sdata,
-                                   "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
-                                   channel->center_freq, ht_cfreq,
-                                   ht_oper->primary_chan, channel->band);
+                sdata_info(sdata,
+                           "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
+                           channel->center_freq, ht_cfreq,
+                           ht_oper->primary_chan, channel->band);
                 ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
                 goto out;
         }
@@ -295,7 +297,7 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
                                 channel->band);
                 break;
         default:
-                if (verbose)
+                if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
                         sdata_info(sdata,
                                    "AP VHT operation IE has invalid channel width (%d), disable VHT\n",
                                    vht_oper->chan_width);
@@ -304,7 +306,7 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
         }
 
         if (!cfg80211_chandef_valid(&vht_chandef)) {
-                if (verbose)
+                if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
                         sdata_info(sdata,
                                    "AP VHT information is invalid, disable VHT\n");
                 ret = IEEE80211_STA_DISABLE_VHT;
@@ -317,7 +319,7 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
         }
 
         if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
-                if (verbose)
+                if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
                         sdata_info(sdata,
                                    "AP VHT information doesn't match HT, disable VHT\n");
                 ret = IEEE80211_STA_DISABLE_VHT;
@@ -333,18 +335,27 @@ out:
         if (ret & IEEE80211_STA_DISABLE_VHT)
                 vht_chandef = *chandef;
 
+        /*
+         * Ignore the DISABLED flag when we're already connected and only
+         * tracking the APs beacon for bandwidth changes - otherwise we
+         * might get disconnected here if we connect to an AP, update our
+         * regulatory information based on the AP's country IE and the
+         * information we have is wrong/outdated and disables the channel
+         * that we're actually using for the connection to the AP.
+         */
         while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
-                                        IEEE80211_CHAN_DISABLED)) {
+                                        tracking ? 0 :
+                                                   IEEE80211_CHAN_DISABLED)) {
                 if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
                         ret = IEEE80211_STA_DISABLE_HT |
                               IEEE80211_STA_DISABLE_VHT;
-                        goto out;
+                        break;
                 }
 
                 ret |= chandef_downgrade(chandef);
         }
 
-        if (chandef->width != vht_chandef.width && verbose)
+        if (chandef->width != vht_chandef.width && !tracking)
                 sdata_info(sdata,
                            "capabilities/regulatory prevented using AP HT/VHT configuration, downgraded\n");
 
@@ -384,7 +395,7 @@ static int ieee80211_config_bw(struct ieee80211_sub_if_data *sdata,
 
         /* calculate new channel (type) based on HT/VHT operation IEs */
         flags = ieee80211_determine_chantype(sdata, sband, chan, ht_oper,
-                                             vht_oper, &chandef, false);
+                                             vht_oper, &chandef, true);
 
         /*
          * Downgrade the new channel if we associated with restricted
@@ -478,27 +489,6 @@ static int ieee80211_config_bw(struct ieee80211_sub_if_data *sdata,
 
 /* frame sending functions */
 
-static int ieee80211_compatible_rates(const u8 *supp_rates, int supp_rates_len,
-                                      struct ieee80211_supported_band *sband,
-                                      u32 *rates)
-{
-        int i, j, count;
-        *rates = 0;
-        count = 0;
-        for (i = 0; i < supp_rates_len; i++) {
-                int rate = (supp_rates[i] & 0x7F) * 5;
-
-                for (j = 0; j < sband->n_bitrates; j++)
-                        if (sband->bitrates[j].bitrate == rate) {
-                                *rates |= BIT(j);
-                                count++;
-                                break;
-                        }
-        }
-
-        return count;
-}
-
 static void ieee80211_add_ht_ie(struct ieee80211_sub_if_data *sdata,
                                 struct sk_buff *skb, u8 ap_ht_param,
                                 struct ieee80211_supported_band *sband,
@@ -617,12 +607,12 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_mgmt *mgmt;
         u8 *pos, qos_info;
         size_t offset = 0, noffset;
-        int i, count, rates_len, supp_rates_len;
+        int i, count, rates_len, supp_rates_len, shift;
         u16 capab;
         struct ieee80211_supported_band *sband;
         struct ieee80211_chanctx_conf *chanctx_conf;
         struct ieee80211_channel *chan;
-        u32 rates = 0;
+        u32 rate_flags, rates = 0;
 
         sdata_assert_lock(sdata);
 
@@ -633,8 +623,10 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
                 return;
         }
         chan = chanctx_conf->def.chan;
+        rate_flags = ieee80211_chandef_rate_flags(&chanctx_conf->def);
         rcu_read_unlock();
         sband = local->hw.wiphy->bands[chan->band];
+        shift = ieee80211_vif_get_shift(&sdata->vif);
 
         if (assoc_data->supp_rates_len) {
                 /*
@@ -643,17 +635,24 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
                  * in the association request (e.g. D-Link DAP 1353 in
                  * b-only mode)...
                  */
-                rates_len = ieee80211_compatible_rates(assoc_data->supp_rates,
-                                                       assoc_data->supp_rates_len,
-                                                       sband, &rates);
+                rates_len = ieee80211_parse_bitrates(&chanctx_conf->def, sband,
+                                                     assoc_data->supp_rates,
+                                                     assoc_data->supp_rates_len,
+                                                     &rates);
         } else {
                 /*
                  * In case AP not provide any supported rates information
                  * before association, we send information element(s) with
                  * all rates that we support.
                  */
-                rates = ~0;
-                rates_len = sband->n_bitrates;
+                rates_len = 0;
+                for (i = 0; i < sband->n_bitrates; i++) {
+                        if ((rate_flags & sband->bitrates[i].flags)
+                            != rate_flags)
+                                continue;
+                        rates |= BIT(i);
+                        rates_len++;
+                }
         }
 
         skb = alloc_skb(local->hw.extra_tx_headroom +
@@ -730,8 +729,9 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
         count = 0;
         for (i = 0; i < sband->n_bitrates; i++) {
                 if (BIT(i) & rates) {
-                        int rate = sband->bitrates[i].bitrate;
-                        *pos++ = (u8) (rate / 5);
+                        int rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
+                                                5 * (1 << shift));
+                        *pos++ = (u8) rate;
                         if (++count == 8)
                                 break;
                 }
@@ -744,8 +744,10 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
 
                 for (i++; i < sband->n_bitrates; i++) {
                         if (BIT(i) & rates) {
-                                int rate = sband->bitrates[i].bitrate;
-                                *pos++ = (u8) (rate / 5);
+                                int rate;
+                                rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
+                                                    5 * (1 << shift));
+                                *pos++ = (u8) rate;
                         }
                 }
         }
@@ -756,7 +758,8 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
                 *pos++ = WLAN_EID_PWR_CAPABILITY;
                 *pos++ = 2;
                 *pos++ = 0; /* min tx power */
-                *pos++ = chan->max_power; /* max tx power */
+                 /* max tx power */
+                *pos++ = ieee80211_chandef_max_power(&chanctx_conf->def);
 
                 /* 2. supported channels */
                 /* TODO: get this in reg domain format */
@@ -2432,15 +2435,16 @@ static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
                                 u8 *supp_rates, unsigned int supp_rates_len,
                                 u32 *rates, u32 *basic_rates,
                                 bool *have_higher_than_11mbit,
-                                int *min_rate, int *min_rate_index)
+                                int *min_rate, int *min_rate_index,
+                                int shift, u32 rate_flags)
 {
         int i, j;
 
         for (i = 0; i < supp_rates_len; i++) {
-                int rate = (supp_rates[i] & 0x7f) * 5;
+                int rate = supp_rates[i] & 0x7f;
                 bool is_basic = !!(supp_rates[i] & 0x80);
 
-                if (rate > 110)
+                if ((rate * 5 * (1 << shift)) > 110)
                         *have_higher_than_11mbit = true;
 
                 /*
@@ -2456,12 +2460,20 @@ static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
                         continue;
 
                 for (j = 0; j < sband->n_bitrates; j++) {
-                        if (sband->bitrates[j].bitrate == rate) {
+                        struct ieee80211_rate *br;
+                        int brate;
+
+                        br = &sband->bitrates[j];
+                        if ((rate_flags & br->flags) != rate_flags)
+                                continue;
+
+                        brate = DIV_ROUND_UP(br->bitrate, (1 << shift) * 5);
+                        if (brate == rate) {
                                 *rates |= BIT(j);
                                 if (is_basic)
                                         *basic_rates |= BIT(j);
-                                if (rate < *min_rate) {
-                                        *min_rate = rate;
+                                if ((rate * 5) < *min_rate) {
+                                        *min_rate = rate * 5;
                                         *min_rate_index = j;
                                 }
                                 break;
@@ -3394,10 +3406,13 @@ static int ieee80211_probe_auth(struct ieee80211_sub_if_data *sdata)
 
         if (tx_flags == 0) {
                 auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
-                ifmgd->auth_data->timeout_started = true;
+                auth_data->timeout_started = true;
                 run_again(sdata, auth_data->timeout);
         } else {
-                auth_data->timeout_started = false;
+                auth_data->timeout =
+                        round_jiffies_up(jiffies + IEEE80211_AUTH_TIMEOUT_LONG);
+                auth_data->timeout_started = true;
+                run_again(sdata, auth_data->timeout);
         }
 
         return 0;
@@ -3434,7 +3449,11 @@ static int ieee80211_do_assoc(struct ieee80211_sub_if_data *sdata)
                 assoc_data->timeout_started = true;
                 run_again(sdata, assoc_data->timeout);
         } else {
-                assoc_data->timeout_started = false;
+                assoc_data->timeout =
+                        round_jiffies_up(jiffies +
+                                         IEEE80211_ASSOC_TIMEOUT_LONG);
+                assoc_data->timeout_started = true;
+                run_again(sdata, assoc_data->timeout);
         }
 
         return 0;
@@ -3829,7 +3848,7 @@ static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
         ifmgd->flags |= ieee80211_determine_chantype(sdata, sband,
                                                      cbss->channel,
                                                      ht_oper, vht_oper,
-                                                     &chandef, true);
+                                                     &chandef, false);
 
         sdata->needed_rx_chains = min(ieee80211_ht_vht_rx_chains(sdata, cbss),
                                       local->rx_chains);
@@ -3884,27 +3903,40 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
                 if (!new_sta)
                         return -ENOMEM;
         }
-
         if (new_sta) {
                 u32 rates = 0, basic_rates = 0;
                 bool have_higher_than_11mbit;
                 int min_rate = INT_MAX, min_rate_index = -1;
+                struct ieee80211_chanctx_conf *chanctx_conf;
                 struct ieee80211_supported_band *sband;
                 const struct cfg80211_bss_ies *ies;
+                int shift;
+                u32 rate_flags;
 
                 sband = local->hw.wiphy->bands[cbss->channel->band];
 
                 err = ieee80211_prep_channel(sdata, cbss);
                 if (err) {
                         sta_info_free(local, new_sta);
-                        return err;
+                        return -EINVAL;
+                }
+                shift = ieee80211_vif_get_shift(&sdata->vif);
+
+                rcu_read_lock();
+                chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
+                if (WARN_ON(!chanctx_conf)) {
+                        rcu_read_unlock();
+                        return -EINVAL;
                 }
+                rate_flags = ieee80211_chandef_rate_flags(&chanctx_conf->def);
+                rcu_read_unlock();
 
                 ieee80211_get_rates(sband, bss->supp_rates,
                                     bss->supp_rates_len,
                                     &rates, &basic_rates,
                                     &have_higher_than_11mbit,
-                                    &min_rate, &min_rate_index);
+                                    &min_rate, &min_rate_index,
+                                    shift, rate_flags);
 
                 /*
                  * This used to be a workaround for basic rates missing
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index 30d58d2d13e2..ba63ac851c2b 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -232,37 +232,28 @@ static void rc_send_low_broadcast(s8 *idx, u32 basic_rates,
         /* could not find a basic rate; use original selection */
 }
 
-static inline s8
-rate_lowest_non_cck_index(struct ieee80211_supported_band *sband,
-                          struct ieee80211_sta *sta)
+static void __rate_control_send_low(struct ieee80211_hw *hw,
+                                    struct ieee80211_supported_band *sband,
+                                    struct ieee80211_sta *sta,
+                                    struct ieee80211_tx_info *info)
 {
         int i;
+        u32 rate_flags =
+                ieee80211_chandef_rate_flags(&hw->conf.chandef);
 
+        if ((sband->band == IEEE80211_BAND_2GHZ) &&
+            (info->flags & IEEE80211_TX_CTL_NO_CCK_RATE))
+                rate_flags |= IEEE80211_RATE_ERP_G;
+
+        info->control.rates[0].idx = 0;
         for (i = 0; i < sband->n_bitrates; i++) {
-                struct ieee80211_rate *srate = &sband->bitrates[i];
-                if ((srate->bitrate == 10) || (srate->bitrate == 20) ||
-                    (srate->bitrate == 55) || (srate->bitrate == 110))
+                if (!rate_supported(sta, sband->band, i))
                         continue;
 
-                if (rate_supported(sta, sband->band, i))
-                        return i;
+                info->control.rates[0].idx = i;
+                break;
         }
-
-        /* No matching rate found */
-        return 0;
-}
-
-static void __rate_control_send_low(struct ieee80211_hw *hw,
-                                    struct ieee80211_supported_band *sband,
-                                    struct ieee80211_sta *sta,
-                                    struct ieee80211_tx_info *info)
-{
-        if ((sband->band != IEEE80211_BAND_2GHZ) ||
-            !(info->flags & IEEE80211_TX_CTL_NO_CCK_RATE))
-                info->control.rates[0].idx = rate_lowest_index(sband, sta);
-        else
-                info->control.rates[0].idx =
-                        rate_lowest_non_cck_index(sband, sta);
+        WARN_ON_ONCE(i == sband->n_bitrates);
 
         info->control.rates[0].count =
                 (info->flags & IEEE80211_TX_CTL_NO_ACK) ?
@@ -585,6 +576,7 @@ static void rate_control_apply_mask(struct ieee80211_sub_if_data *sdata,
         u8 mcs_mask[IEEE80211_HT_MCS_MASK_LEN];
         bool has_mcs_mask;
         u32 mask;
+        u32 rate_flags;
         int i;
 
         /*
@@ -594,6 +586,12 @@ static void rate_control_apply_mask(struct ieee80211_sub_if_data *sdata,
          */
         mask = sdata->rc_rateidx_mask[info->band];
         has_mcs_mask = sdata->rc_has_mcs_mask[info->band];
+        rate_flags =
+                ieee80211_chandef_rate_flags(&sdata->vif.bss_conf.chandef);
+        for (i = 0; i < sband->n_bitrates; i++)
+                if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
+                        mask &= ~BIT(i);
+
         if (mask == (1 << sband->n_bitrates) - 1 && !has_mcs_mask)
                 return;
 
diff --git a/net/mac80211/rate.h b/net/mac80211/rate.h
index d35a5dd3fb13..5dedc56c94db 100644
--- a/net/mac80211/rate.h
+++ b/net/mac80211/rate.h
@@ -66,11 +66,12 @@ static inline void rate_control_rate_init(struct sta_info *sta)
         }
 
         sband = local->hw.wiphy->bands[chanctx_conf->def.chan->band];
-        rcu_read_unlock();
 
         ieee80211_sta_set_rx_nss(sta);
 
-        ref->ops->rate_init(ref->priv, sband, ista, priv_sta);
+        ref->ops->rate_init(ref->priv, sband, &chanctx_conf->def, ista,
+                            priv_sta);
+        rcu_read_unlock();
         set_sta_flag(sta, WLAN_STA_RATE_CONTROL);
 }
 
@@ -81,10 +82,21 @@ static inline void rate_control_rate_update(struct ieee80211_local *local,
         struct rate_control_ref *ref = local->rate_ctrl;
         struct ieee80211_sta *ista = &sta->sta;
         void *priv_sta = sta->rate_ctrl_priv;
+        struct ieee80211_chanctx_conf *chanctx_conf;
+
+        if (ref && ref->ops->rate_update) {
+                rcu_read_lock();
 
-        if (ref && ref->ops->rate_update)
-                ref->ops->rate_update(ref->priv, sband, ista,
-                                      priv_sta, changed);
+                chanctx_conf = rcu_dereference(sta->sdata->vif.chanctx_conf);
+                if (WARN_ON(!chanctx_conf)) {
+                        rcu_read_unlock();
+                        return;
+                }
+
+                ref->ops->rate_update(ref->priv, sband, &chanctx_conf->def,
+                                      ista, priv_sta, changed);
+                rcu_read_unlock();
+        }
         drv_sta_rc_update(local, sta->sdata, &sta->sta, changed);
 }
 
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index e6512e2ffd20..8b5f7ef7c0c9 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -383,14 +383,18 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
 static void
 calc_rate_durations(enum ieee80211_band band,
                     struct minstrel_rate *d,
-                    struct ieee80211_rate *rate)
+                    struct ieee80211_rate *rate,
+                    struct cfg80211_chan_def *chandef)
 {
         int erp = !!(rate->flags & IEEE80211_RATE_ERP_G);
+        int shift = ieee80211_chandef_get_shift(chandef);
 
         d->perfect_tx_time = ieee80211_frame_duration(band, 1200,
-                        rate->bitrate, erp, 1);
+                        DIV_ROUND_UP(rate->bitrate, 1 << shift), erp, 1,
+                        shift);
         d->ack_time = ieee80211_frame_duration(band, 10,
-                        rate->bitrate, erp, 1);
+                        DIV_ROUND_UP(rate->bitrate, 1 << shift), erp, 1,
+                        shift);
 }
 
 static void
@@ -418,21 +422,25 @@ init_sample_table(struct minstrel_sta_info *mi)
 
 static void
 minstrel_rate_init(void *priv, struct ieee80211_supported_band *sband,
-               struct ieee80211_sta *sta, void *priv_sta)
+                   struct cfg80211_chan_def *chandef,
+                   struct ieee80211_sta *sta, void *priv_sta)
 {
         struct minstrel_sta_info *mi = priv_sta;
         struct minstrel_priv *mp = priv;
         struct ieee80211_rate *ctl_rate;
         unsigned int i, n = 0;
         unsigned int t_slot = 9; /* FIXME: get real slot time */
+        u32 rate_flags;
 
         mi->sta = sta;
         mi->lowest_rix = rate_lowest_index(sband, sta);
         ctl_rate = &sband->bitrates[mi->lowest_rix];
         mi->sp_ack_dur = ieee80211_frame_duration(sband->band, 10,
                                 ctl_rate->bitrate,
-                                !!(ctl_rate->flags & IEEE80211_RATE_ERP_G), 1);
+                                !!(ctl_rate->flags & IEEE80211_RATE_ERP_G), 1,
+                                ieee80211_chandef_get_shift(chandef));
 
+        rate_flags = ieee80211_chandef_rate_flags(&mp->hw->conf.chandef);
         memset(mi->max_tp_rate, 0, sizeof(mi->max_tp_rate));
         mi->max_prob_rate = 0;
 
@@ -441,15 +449,22 @@ minstrel_rate_init(void *priv, struct ieee80211_supported_band *sband,
                 unsigned int tx_time = 0, tx_time_cts = 0, tx_time_rtscts = 0;
                 unsigned int tx_time_single;
                 unsigned int cw = mp->cw_min;
+                int shift;
 
                 if (!rate_supported(sta, sband->band, i))
                         continue;
+                if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
+                        continue;
+
                 n++;
                 memset(mr, 0, sizeof(*mr));
 
                 mr->rix = i;
-                mr->bitrate = sband->bitrates[i].bitrate / 5;
-                calc_rate_durations(sband->band, mr, &sband->bitrates[i]);
+                shift = ieee80211_chandef_get_shift(chandef);
+                mr->bitrate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
+                                           (1 << shift) * 5);
+                calc_rate_durations(sband->band, mr, &sband->bitrates[i],
+                                    chandef);
 
                 /* calculate maximum number of retransmissions before
                  * fallback (based on maximum segment size) */
@@ -547,6 +562,7 @@ minstrel_init_cck_rates(struct minstrel_priv *mp)
 {
         static const int bitrates[4] = { 10, 20, 55, 110 };
         struct ieee80211_supported_band *sband;
+        u32 rate_flags = ieee80211_chandef_rate_flags(&mp->hw->conf.chandef);
         int i, j;
 
         sband = mp->hw->wiphy->bands[IEEE80211_BAND_2GHZ];
@@ -559,6 +575,9 @@ minstrel_init_cck_rates(struct minstrel_priv *mp)
                 if (rate->flags & IEEE80211_RATE_ERP_G)
                         continue;
 
+                if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
+                        continue;
+
                 for (j = 0; j < ARRAY_SIZE(bitrates); j++) {
                         if (rate->bitrate != bitrates[j])
                                 continue;
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index f5aed963b22e..61569425b723 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -844,6 +844,7 @@ minstrel_ht_update_cck(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
 
 static void
 minstrel_ht_update_caps(void *priv, struct ieee80211_supported_band *sband,
+                        struct cfg80211_chan_def *chandef,
                         struct ieee80211_sta *sta, void *priv_sta)
 {
         struct minstrel_priv *mp = priv;
@@ -869,8 +870,9 @@ minstrel_ht_update_caps(void *priv, struct ieee80211_supported_band *sband,
         mi->sta = sta;
         mi->stats_update = jiffies;
 
-        ack_dur = ieee80211_frame_duration(sband->band, 10, 60, 1, 1);
-        mi->overhead = ieee80211_frame_duration(sband->band, 0, 60, 1, 1) + ack_dur;
+        ack_dur = ieee80211_frame_duration(sband->band, 10, 60, 1, 1, 0);
+        mi->overhead = ieee80211_frame_duration(sband->band, 0, 60, 1, 1, 0);
+        mi->overhead += ack_dur;
         mi->overhead_rtscts = mi->overhead + 2 * ack_dur;
 
         mi->avg_ampdu_len = MINSTREL_FRAC(1, 1);
@@ -939,22 +941,25 @@ use_legacy:
         memset(&msp->legacy, 0, sizeof(msp->legacy));
         msp->legacy.r = msp->ratelist;
         msp->legacy.sample_table = msp->sample_table;
-        return mac80211_minstrel.rate_init(priv, sband, sta, &msp->legacy);
+        return mac80211_minstrel.rate_init(priv, sband, chandef, sta,
+                                           &msp->legacy);
 }
 
 static void
 minstrel_ht_rate_init(void *priv, struct ieee80211_supported_band *sband,
+                      struct cfg80211_chan_def *chandef,
                       struct ieee80211_sta *sta, void *priv_sta)
 {
-        minstrel_ht_update_caps(priv, sband, sta, priv_sta);
+        minstrel_ht_update_caps(priv, sband, chandef, sta, priv_sta);
 }
 
 static void
 minstrel_ht_rate_update(void *priv, struct ieee80211_supported_band *sband,
+                        struct cfg80211_chan_def *chandef,
                         struct ieee80211_sta *sta, void *priv_sta,
                         u32 changed)
 {
-        minstrel_ht_update_caps(priv, sband, sta, priv_sta);
+        minstrel_ht_update_caps(priv, sband, chandef, sta, priv_sta);
 }
 
 static void *
diff --git a/net/mac80211/rc80211_pid_algo.c b/net/mac80211/rc80211_pid_algo.c
index 502d3ecc4a79..958fad07b54c 100644
--- a/net/mac80211/rc80211_pid_algo.c
+++ b/net/mac80211/rc80211_pid_algo.c
@@ -293,6 +293,7 @@ rate_control_pid_get_rate(void *priv, struct ieee80211_sta *sta,
 
 static void
 rate_control_pid_rate_init(void *priv, struct ieee80211_supported_band *sband,
+                           struct cfg80211_chan_def *chandef,
                            struct ieee80211_sta *sta, void *priv_sta)
 {
         struct rc_pid_sta_info *spinfo = priv_sta;
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 2c5a79bd3777..6b85f95b9ba1 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -87,11 +87,13 @@ ieee80211_rx_radiotap_space(struct ieee80211_local *local,
         int len;
 
         /* always present fields */
-        len = sizeof(struct ieee80211_radiotap_header) + 9;
+        len = sizeof(struct ieee80211_radiotap_header) + 8;
 
-        /* allocate extra bitmap */
+        /* allocate extra bitmaps */
         if (status->vendor_radiotap_len)
                 len += 4;
+        if (status->chains)
+                len += 4 * hweight8(status->chains);
 
         if (ieee80211_have_rx_timestamp(status)) {
                 len = ALIGN(len, 8);
@@ -100,6 +102,10 @@ ieee80211_rx_radiotap_space(struct ieee80211_local *local,
         if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
                 len += 1;
 
+        /* antenna field, if we don't have per-chain info */
+        if (!status->chains)
+                len += 1;
+
         /* padding for RX_FLAGS if necessary */
         len = ALIGN(len, 2);
 
@@ -116,6 +122,11 @@ ieee80211_rx_radiotap_space(struct ieee80211_local *local,
                 len += 12;
         }
 
+        if (status->chains) {
+                /* antenna and antenna signal fields */
+                len += 2 * hweight8(status->chains);
+        }
+
         if (status->vendor_radiotap_len) {
                 if (WARN_ON_ONCE(status->vendor_radiotap_align == 0))
                         status->vendor_radiotap_align = 1;
@@ -145,8 +156,12 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
         struct ieee80211_radiotap_header *rthdr;
         unsigned char *pos;
+        __le32 *it_present;
+        u32 it_present_val;
         u16 rx_flags = 0;
-        int mpdulen;
+        u16 channel_flags = 0;
+        int mpdulen, chain;
+        unsigned long chains = status->chains;
 
         mpdulen = skb->len;
         if (!(has_fcs && (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)))
@@ -154,25 +169,39 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
 
         rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len);
         memset(rthdr, 0, rtap_len);
+        it_present = &rthdr->it_present;
 
         /* radiotap header, set always present flags */
-        rthdr->it_present =
-                cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
-                            (1 << IEEE80211_RADIOTAP_CHANNEL) |
-                            (1 << IEEE80211_RADIOTAP_ANTENNA) |
-                            (1 << IEEE80211_RADIOTAP_RX_FLAGS));
         rthdr->it_len = cpu_to_le16(rtap_len + status->vendor_radiotap_len);
+        it_present_val = BIT(IEEE80211_RADIOTAP_FLAGS) |
+                         BIT(IEEE80211_RADIOTAP_CHANNEL) |
+                         BIT(IEEE80211_RADIOTAP_RX_FLAGS);
 
-        pos = (unsigned char *)(rthdr + 1);
+        if (!status->chains)
+                it_present_val |= BIT(IEEE80211_RADIOTAP_ANTENNA);
+
+        for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
+                it_present_val |=
+                        BIT(IEEE80211_RADIOTAP_EXT) |
+                        BIT(IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE);
+                put_unaligned_le32(it_present_val, it_present);
+                it_present++;
+                it_present_val = BIT(IEEE80211_RADIOTAP_ANTENNA) |
+                                 BIT(IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
+        }
 
         if (status->vendor_radiotap_len) {
-                rthdr->it_present |=
-                        cpu_to_le32(BIT(IEEE80211_RADIOTAP_VENDOR_NAMESPACE)) |
-                        cpu_to_le32(BIT(IEEE80211_RADIOTAP_EXT));
-                put_unaligned_le32(status->vendor_radiotap_bitmap, pos);
-                pos += 4;
+                it_present_val |= BIT(IEEE80211_RADIOTAP_VENDOR_NAMESPACE) |
+                                  BIT(IEEE80211_RADIOTAP_EXT);
+                put_unaligned_le32(it_present_val, it_present);
+                it_present++;
+                it_present_val = status->vendor_radiotap_bitmap;
         }
 
+        put_unaligned_le32(it_present_val, it_present);
+
+        pos = (void *)(it_present + 1);
+
         /* the order of the following fields is important */
 
         /* IEEE80211_RADIOTAP_TSFT */
@@ -207,28 +236,35 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
                  */
                 *pos = 0;
         } else {
+                int shift = 0;
                 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
-                *pos = rate->bitrate / 5;
+                if (status->flag & RX_FLAG_10MHZ)
+                        shift = 1;
+                else if (status->flag & RX_FLAG_5MHZ)
+                        shift = 2;
+                *pos = DIV_ROUND_UP(rate->bitrate, 5 * (1 << shift));
         }
         pos++;
 
         /* IEEE80211_RADIOTAP_CHANNEL */
         put_unaligned_le16(status->freq, pos);
         pos += 2;
+        if (status->flag & RX_FLAG_10MHZ)
+                channel_flags |= IEEE80211_CHAN_HALF;
+        else if (status->flag & RX_FLAG_5MHZ)
+                channel_flags |= IEEE80211_CHAN_QUARTER;
+
         if (status->band == IEEE80211_BAND_5GHZ)
-                put_unaligned_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ,
-                                   pos);
+                channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ;
         else if (status->flag & (RX_FLAG_HT | RX_FLAG_VHT))
-                put_unaligned_le16(IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ,
-                                   pos);
+                channel_flags |= IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
         else if (rate && rate->flags & IEEE80211_RATE_ERP_G)
-                put_unaligned_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ,
-                                   pos);
+                channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ;
         else if (rate)
-                put_unaligned_le16(IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ,
-                                   pos);
+                channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ;
         else
-                put_unaligned_le16(IEEE80211_CHAN_2GHZ, pos);
+                channel_flags |= IEEE80211_CHAN_2GHZ;
+        put_unaligned_le16(channel_flags, pos);
         pos += 2;
 
         /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
@@ -242,9 +278,11 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
 
         /* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */
 
-        /* IEEE80211_RADIOTAP_ANTENNA */
-        *pos = status->antenna;
-        pos++;
+        if (!status->chains) {
+                /* IEEE80211_RADIOTAP_ANTENNA */
+                *pos = status->antenna;
+                pos++;
+        }
 
         /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */
 
@@ -341,6 +379,11 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
                 pos += 2;
         }
 
+        for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
+                *pos++ = status->chain_signal[chain];
+                *pos++ = chain;
+        }
+
         if (status->vendor_radiotap_len) {
                 /* ensure 2 byte alignment for the vendor field as required */
                 if ((pos - (u8 *)rthdr) & 1)
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 1b122a79b0d8..08afe74b98f4 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -66,6 +66,7 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
         struct cfg80211_bss *cbss;
         struct ieee80211_bss *bss;
         int clen, srlen;
+        enum nl80211_bss_scan_width scan_width;
         s32 signal = 0;
 
         if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
@@ -73,8 +74,15 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
         else if (local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC)
                 signal = (rx_status->signal * 100) / local->hw.max_signal;
 
-        cbss = cfg80211_inform_bss_frame(local->hw.wiphy, channel,
-                                         mgmt, len, signal, GFP_ATOMIC);
+        scan_width = NL80211_BSS_CHAN_WIDTH_20;
+        if (rx_status->flag & RX_FLAG_5MHZ)
+                scan_width = NL80211_BSS_CHAN_WIDTH_5;
+        if (rx_status->flag & RX_FLAG_10MHZ)
+                scan_width = NL80211_BSS_CHAN_WIDTH_10;
+
+        cbss = cfg80211_inform_bss_width_frame(local->hw.wiphy, channel,
+                                               scan_width, mgmt, len, signal,
+                                               GFP_ATOMIC);
         if (!cbss)
                 return NULL;
 
@@ -204,10 +212,29 @@ void ieee80211_scan_rx(struct ieee80211_local *local, struct sk_buff *skb)
                 ieee80211_rx_bss_put(local, bss);
 }
 
+static void
+ieee80211_prepare_scan_chandef(struct cfg80211_chan_def *chandef,
+                               enum nl80211_bss_scan_width scan_width)
+{
+        memset(chandef, 0, sizeof(*chandef));
+        switch (scan_width) {
+        case NL80211_BSS_CHAN_WIDTH_5:
+                chandef->width = NL80211_CHAN_WIDTH_5;
+                break;
+        case NL80211_BSS_CHAN_WIDTH_10:
+                chandef->width = NL80211_CHAN_WIDTH_10;
+                break;
+        default:
+                chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
+                break;
+        }
+}
+
 /* return false if no more work */
 static bool ieee80211_prep_hw_scan(struct ieee80211_local *local)
 {
         struct cfg80211_scan_request *req = local->scan_req;
+        struct cfg80211_chan_def chandef;
         enum ieee80211_band band;
         int i, ielen, n_chans;
 
@@ -229,11 +256,12 @@ static bool ieee80211_prep_hw_scan(struct ieee80211_local *local)
         } while (!n_chans);
 
         local->hw_scan_req->n_channels = n_chans;
+        ieee80211_prepare_scan_chandef(&chandef, req->scan_width);
 
         ielen = ieee80211_build_preq_ies(local, (u8 *)local->hw_scan_req->ie,
                                          local->hw_scan_ies_bufsize,
                                          req->ie, req->ie_len, band,
-                                         req->rates[band], 0);
+                                         req->rates[band], &chandef);
         local->hw_scan_req->ie_len = ielen;
         local->hw_scan_req->no_cck = req->no_cck;
 
@@ -280,7 +308,7 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted,
         rcu_assign_pointer(local->scan_sdata, NULL);
 
         local->scanning = 0;
-        local->scan_channel = NULL;
+        local->scan_chandef.chan = NULL;
 
         /* Set power back to normal operating levels. */
         ieee80211_hw_config(local, 0);
@@ -615,11 +643,34 @@ static void ieee80211_scan_state_set_channel(struct ieee80211_local *local,
 {
         int skip;
         struct ieee80211_channel *chan;
+        enum nl80211_bss_scan_width oper_scan_width;
 
         skip = 0;
         chan = local->scan_req->channels[local->scan_channel_idx];
 
-        local->scan_channel = chan;
+        local->scan_chandef.chan = chan;
+        local->scan_chandef.center_freq1 = chan->center_freq;
+        local->scan_chandef.center_freq2 = 0;
+        switch (local->scan_req->scan_width) {
+        case NL80211_BSS_CHAN_WIDTH_5:
+                local->scan_chandef.width = NL80211_CHAN_WIDTH_5;
+                break;
+        case NL80211_BSS_CHAN_WIDTH_10:
+                local->scan_chandef.width = NL80211_CHAN_WIDTH_10;
+                break;
+        case NL80211_BSS_CHAN_WIDTH_20:
+                /* If scanning on oper channel, use whatever channel-type
+                 * is currently in use.
+                 */
+                oper_scan_width = cfg80211_chandef_to_scan_width(
+                                        &local->_oper_chandef);
+                if (chan == local->_oper_chandef.chan &&
+                    oper_scan_width == local->scan_req->scan_width)
+                        local->scan_chandef = local->_oper_chandef;
+                else
+                        local->scan_chandef.width = NL80211_CHAN_WIDTH_20_NOHT;
+                break;
+        }
 
         if (ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL))
                 skip = 1;
@@ -659,7 +710,7 @@ static void ieee80211_scan_state_suspend(struct ieee80211_local *local,
                                          unsigned long *next_delay)
 {
         /* switch back to the operating channel */
-        local->scan_channel = NULL;
+        local->scan_chandef.chan = NULL;
         ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
 
         /* disable PS */
@@ -801,7 +852,8 @@ int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
 
 int ieee80211_request_ibss_scan(struct ieee80211_sub_if_data *sdata,
                                 const u8 *ssid, u8 ssid_len,
-                                struct ieee80211_channel *chan)
+                                struct ieee80211_channel *chan,
+                                enum nl80211_bss_scan_width scan_width)
 {
         struct ieee80211_local *local = sdata->local;
         int ret = -EBUSY;
@@ -851,6 +903,7 @@ int ieee80211_request_ibss_scan(struct ieee80211_sub_if_data *sdata,
 
         local->int_scan_req->ssids = &local->scan_ssid;
         local->int_scan_req->n_ssids = 1;
+        local->int_scan_req->scan_width = scan_width;
         memcpy(local->int_scan_req->ssids[0].ssid, ssid, IEEE80211_MAX_SSID_LEN);
         local->int_scan_req->ssids[0].ssid_len = ssid_len;
 
@@ -912,6 +965,7 @@ int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_sched_scan_ies sched_scan_ies = {};
+        struct cfg80211_chan_def chandef;
         int ret, i, iebufsz;
 
         iebufsz = 2 + IEEE80211_MAX_SSID_LEN +
@@ -939,10 +993,12 @@ int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
                         goto out_free;
                 }
 
+                ieee80211_prepare_scan_chandef(&chandef, req->scan_width);
+
                 sched_scan_ies.len[i] =
                         ieee80211_build_preq_ies(local, sched_scan_ies.ie[i],
                                                  iebufsz, req->ie, req->ie_len,
-                                                 i, (u32) -1, 0);
+                                                 i, (u32) -1, &chandef);
         }
 
         ret = drv_sched_scan_start(local, sdata, req, &sched_scan_ies);
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 43439203f4e4..368837fe3b80 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -235,7 +235,8 @@ static int ieee80211_tx_radiotap_len(struct ieee80211_tx_info *info)
 
         /* IEEE80211_RADIOTAP_RATE rate */
         if (info->status.rates[0].idx >= 0 &&
-            !(info->status.rates[0].flags & IEEE80211_TX_RC_MCS))
+            !(info->status.rates[0].flags & (IEEE80211_TX_RC_MCS |
+                                             IEEE80211_TX_RC_VHT_MCS)))
                 len += 2;
 
         /* IEEE80211_RADIOTAP_TX_FLAGS */
@@ -244,17 +245,23 @@ static int ieee80211_tx_radiotap_len(struct ieee80211_tx_info *info)
         /* IEEE80211_RADIOTAP_DATA_RETRIES */
         len += 1;
 
-        /* IEEE80211_TX_RC_MCS */
-        if (info->status.rates[0].idx >= 0 &&
-            info->status.rates[0].flags & IEEE80211_TX_RC_MCS)
-                len += 3;
+        /* IEEE80211_RADIOTAP_MCS
+         * IEEE80211_RADIOTAP_VHT */
+        if (info->status.rates[0].idx >= 0) {
+                if (info->status.rates[0].flags & IEEE80211_TX_RC_MCS)
+                        len += 3;
+                else if (info->status.rates[0].flags & IEEE80211_TX_RC_VHT_MCS)
+                        len = ALIGN(len, 2) + 12;
+        }
 
         return len;
 }
 
-static void ieee80211_add_tx_radiotap_header(struct ieee80211_supported_band
-                                             *sband, struct sk_buff *skb,
-                                             int retry_count, int rtap_len)
+static void
+ieee80211_add_tx_radiotap_header(struct ieee80211_local *local,
+                                 struct ieee80211_supported_band *sband,
+                                 struct sk_buff *skb, int retry_count,
+                                 int rtap_len, int shift)
 {
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
@@ -279,9 +286,13 @@ static void ieee80211_add_tx_radiotap_header(struct ieee80211_supported_band
 
         /* IEEE80211_RADIOTAP_RATE */
         if (info->status.rates[0].idx >= 0 &&
-            !(info->status.rates[0].flags & IEEE80211_TX_RC_MCS)) {
+            !(info->status.rates[0].flags & (IEEE80211_TX_RC_MCS |
+                                             IEEE80211_TX_RC_VHT_MCS))) {
+                u16 rate;
+
                 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
-                *pos = sband->bitrates[info->status.rates[0].idx].bitrate / 5;
+                rate = sband->bitrates[info->status.rates[0].idx].bitrate;
+                *pos = DIV_ROUND_UP(rate, 5 * (1 << shift));
                 /* padding for tx flags */
                 pos += 2;
         }
@@ -306,9 +317,12 @@ static void ieee80211_add_tx_radiotap_header(struct ieee80211_supported_band
         *pos = retry_count;
         pos++;
 
-        /* IEEE80211_TX_RC_MCS */
-        if (info->status.rates[0].idx >= 0 &&
-            info->status.rates[0].flags & IEEE80211_TX_RC_MCS) {
+        if (info->status.rates[0].idx < 0)
+                return;
+
+        /* IEEE80211_RADIOTAP_MCS
+         * IEEE80211_RADIOTAP_VHT */
+        if (info->status.rates[0].flags & IEEE80211_TX_RC_MCS) {
                 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS);
                 pos[0] = IEEE80211_RADIOTAP_MCS_HAVE_MCS |
                          IEEE80211_RADIOTAP_MCS_HAVE_GI |
@@ -321,8 +335,48 @@ static void ieee80211_add_tx_radiotap_header(struct ieee80211_supported_band
                         pos[1] |= IEEE80211_RADIOTAP_MCS_FMT_GF;
                 pos[2] = info->status.rates[0].idx;
                 pos += 3;
-        }
+        } else if (info->status.rates[0].flags & IEEE80211_TX_RC_VHT_MCS) {
+                u16 known = local->hw.radiotap_vht_details &
+                        (IEEE80211_RADIOTAP_VHT_KNOWN_GI |
+                         IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH);
+
+                rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_VHT);
+
+                /* required alignment from rthdr */
+                pos = (u8 *)rthdr + ALIGN(pos - (u8 *)rthdr, 2);
 
+                /* u16 known - IEEE80211_RADIOTAP_VHT_KNOWN_* */
+                put_unaligned_le16(known, pos);
+                pos += 2;
+
+                /* u8 flags - IEEE80211_RADIOTAP_VHT_FLAG_* */
+                if (info->status.rates[0].flags & IEEE80211_TX_RC_SHORT_GI)
+                        *pos |= IEEE80211_RADIOTAP_VHT_FLAG_SGI;
+                pos++;
+
+                /* u8 bandwidth */
+                if (info->status.rates[0].flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
+                        *pos = 1;
+                else if (info->status.rates[0].flags & IEEE80211_TX_RC_80_MHZ_WIDTH)
+                        *pos = 4;
+                else if (info->status.rates[0].flags & IEEE80211_TX_RC_160_MHZ_WIDTH)
+                        *pos = 11;
+                else /* IEEE80211_TX_RC_{20_MHZ_WIDTH,FIXME:DUP_DATA} */
+                        *pos = 0;
+                pos++;
+
+                /* u8 mcs_nss[4] */
+                *pos = (ieee80211_rate_get_vht_mcs(&info->status.rates[0]) << 4) |
+                        ieee80211_rate_get_vht_nss(&info->status.rates[0]);
+                pos += 4;
+
+                /* u8 coding */
+                pos++;
+                /* u8 group_id */
+                pos++;
+                /* u16 partial_aid */
+                pos += 2;
+        }
 }
 
 static void ieee80211_report_used_skb(struct ieee80211_local *local,
@@ -424,6 +478,7 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
         bool acked;
         struct ieee80211_bar *bar;
         int rtap_len;
+        int shift = 0;
 
         for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
                 if ((info->flags & IEEE80211_TX_CTL_AMPDU) &&
@@ -458,6 +513,8 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                 if (!ether_addr_equal(hdr->addr2, sta->sdata->vif.addr))
                         continue;
 
+                shift = ieee80211_vif_get_shift(&sta->sdata->vif);
+
                 if (info->flags & IEEE80211_TX_STATUS_EOSP)
                         clear_sta_flag(sta, WLAN_STA_SP);
 
@@ -557,7 +614,7 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
 
         rcu_read_unlock();
 
-        ieee80211_led_tx(local, 0);
+        ieee80211_led_tx(local);
 
         /* SNMP counters
          * Fragments are passed to low-level drivers as separate skbs, so these
@@ -624,7 +681,8 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                 dev_kfree_skb(skb);
                 return;
         }
-        ieee80211_add_tx_radiotap_header(sband, skb, retry_count, rtap_len);
+        ieee80211_add_tx_radiotap_header(local, sband, skb, retry_count,
+                                         rtap_len, shift);
 
         /* XXX: is this sufficient for BPF? */
         skb_set_mac_header(skb, 0);
diff --git a/net/mac80211/trace.h b/net/mac80211/trace.h
index c215fafd7a2f..1aba645882bd 100644
--- a/net/mac80211/trace.h
+++ b/net/mac80211/trace.h
@@ -1906,6 +1906,32 @@ TRACE_EVENT(api_radar_detected,
         )
 );
 
+TRACE_EVENT(drv_channel_switch_beacon,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata,
+                 struct cfg80211_chan_def *chandef),
+
+        TP_ARGS(local, sdata, chandef),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                VIF_ENTRY
+                CHANDEF_ENTRY
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                VIF_ASSIGN;
+                CHANDEF_ASSIGN(chandef);
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT VIF_PR_FMT " channel switch to " CHANDEF_PR_FMT,
+                LOCAL_PR_ARG, VIF_PR_ARG, CHANDEF_PR_ARG
+        )
+);
+
+
 #ifdef CONFIG_MAC80211_MESSAGE_TRACING
 #undef TRACE_SYSTEM
 #define TRACE_SYSTEM mac80211_msg
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 4105d0ca963e..0e42322aa6b1 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -40,12 +40,22 @@ static __le16 ieee80211_duration(struct ieee80211_tx_data *tx,
                                  struct sk_buff *skb, int group_addr,
                                  int next_frag_len)
 {
-        int rate, mrate, erp, dur, i;
+        int rate, mrate, erp, dur, i, shift = 0;
         struct ieee80211_rate *txrate;
         struct ieee80211_local *local = tx->local;
         struct ieee80211_supported_band *sband;
         struct ieee80211_hdr *hdr;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct ieee80211_chanctx_conf *chanctx_conf;
+        u32 rate_flags = 0;
+
+        rcu_read_lock();
+        chanctx_conf = rcu_dereference(tx->sdata->vif.chanctx_conf);
+        if (chanctx_conf) {
+                shift = ieee80211_chandef_get_shift(&chanctx_conf->def);
+                rate_flags = ieee80211_chandef_rate_flags(&chanctx_conf->def);
+        }
+        rcu_read_unlock();
 
         /* assume HW handles this */
         if (tx->rate.flags & IEEE80211_TX_RC_MCS)
@@ -122,8 +132,11 @@ static __le16 ieee80211_duration(struct ieee80211_tx_data *tx,
                 if (r->bitrate > txrate->bitrate)
                         break;
 
+                if ((rate_flags & r->flags) != rate_flags)
+                        continue;
+
                 if (tx->sdata->vif.bss_conf.basic_rates & BIT(i))
-                        rate = r->bitrate;
+                        rate = DIV_ROUND_UP(r->bitrate, 1 << shift);
 
                 switch (sband->band) {
                 case IEEE80211_BAND_2GHZ: {
@@ -150,7 +163,7 @@ static __le16 ieee80211_duration(struct ieee80211_tx_data *tx,
         if (rate == -1) {
                 /* No matching basic rate found; use highest suitable mandatory
                  * PHY rate */
-                rate = mrate;
+                rate = DIV_ROUND_UP(mrate, 1 << shift);
         }
 
         /* Don't calculate ACKs for QoS Frames with NoAck Policy set */
@@ -162,7 +175,8 @@ static __le16 ieee80211_duration(struct ieee80211_tx_data *tx,
                  * (10 bytes + 4-byte FCS = 112 bits) plus SIFS; rounded up
                  * to closest integer */
                 dur = ieee80211_frame_duration(sband->band, 10, rate, erp,
-                                tx->sdata->vif.bss_conf.use_short_preamble);
+                                tx->sdata->vif.bss_conf.use_short_preamble,
+                                shift);
 
         if (next_frag_len) {
                 /* Frame is fragmented: duration increases with time needed to
@@ -171,7 +185,8 @@ static __le16 ieee80211_duration(struct ieee80211_tx_data *tx,
                 /* next fragment */
                 dur += ieee80211_frame_duration(sband->band, next_frag_len,
                                 txrate->bitrate, erp,
-                                tx->sdata->vif.bss_conf.use_short_preamble);
+                                tx->sdata->vif.bss_conf.use_short_preamble,
+                                shift);
         }
 
         return cpu_to_le16(dur);
@@ -1257,6 +1272,10 @@ static bool __ieee80211_tx(struct ieee80211_local *local,
 
         switch (sdata->vif.type) {
         case NL80211_IFTYPE_MONITOR:
+                if (sdata->u.mntr_flags & MONITOR_FLAG_ACTIVE) {
+                        vif = &sdata->vif;
+                        break;
+                }
                 sdata = rcu_dereference(local->monitor_sdata);
                 if (sdata) {
                         vif = &sdata->vif;
@@ -1281,7 +1300,6 @@ static bool __ieee80211_tx(struct ieee80211_local *local,
                                     txpending);
 
         ieee80211_tpt_led_trig_tx(local, fc, led_len);
-        ieee80211_led_tx(local, 1);
 
         WARN_ON_ONCE(!skb_queue_empty(skbs));
 
@@ -2320,6 +2338,81 @@ static int ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata,
         return 0;
 }
 
+void ieee80211_csa_finish(struct ieee80211_vif *vif)
+{
+        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+
+        ieee80211_queue_work(&sdata->local->hw,
+                             &sdata->csa_finalize_work);
+}
+EXPORT_SYMBOL(ieee80211_csa_finish);
+
+static void ieee80211_update_csa(struct ieee80211_sub_if_data *sdata,
+                                 struct beacon_data *beacon)
+{
+        struct probe_resp *resp;
+        int counter_offset_beacon = sdata->csa_counter_offset_beacon;
+        int counter_offset_presp = sdata->csa_counter_offset_presp;
+
+        /* warn if the driver did not check for/react to csa completeness */
+        if (WARN_ON(((u8 *)beacon->tail)[counter_offset_beacon] == 0))
+                return;
+
+        ((u8 *)beacon->tail)[counter_offset_beacon]--;
+
+        if (sdata->vif.type == NL80211_IFTYPE_AP &&
+            counter_offset_presp) {
+                rcu_read_lock();
+                resp = rcu_dereference(sdata->u.ap.probe_resp);
+
+                /* if nl80211 accepted the offset, this should not happen. */
+                if (WARN_ON(!resp)) {
+                        rcu_read_unlock();
+                        return;
+                }
+                resp->data[counter_offset_presp]--;
+                rcu_read_unlock();
+        }
+}
+
+bool ieee80211_csa_is_complete(struct ieee80211_vif *vif)
+{
+        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+        struct beacon_data *beacon = NULL;
+        u8 *beacon_data;
+        size_t beacon_data_len;
+        int counter_beacon = sdata->csa_counter_offset_beacon;
+        int ret = false;
+
+        if (!ieee80211_sdata_running(sdata))
+                return false;
+
+        rcu_read_lock();
+        if (vif->type == NL80211_IFTYPE_AP) {
+                struct ieee80211_if_ap *ap = &sdata->u.ap;
+
+                beacon = rcu_dereference(ap->beacon);
+                if (WARN_ON(!beacon || !beacon->tail))
+                        goto out;
+                beacon_data = beacon->tail;
+                beacon_data_len = beacon->tail_len;
+        } else {
+                WARN_ON(1);
+                goto out;
+        }
+
+        if (WARN_ON(counter_beacon > beacon_data_len))
+                goto out;
+
+        if (beacon_data[counter_beacon] == 0)
+                ret = true;
+ out:
+        rcu_read_unlock();
+
+        return ret;
+}
+EXPORT_SYMBOL(ieee80211_csa_is_complete);
+
 struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                                          struct ieee80211_vif *vif,
                                          u16 *tim_offset, u16 *tim_length)
@@ -2350,6 +2443,9 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                 struct beacon_data *beacon = rcu_dereference(ap->beacon);
 
                 if (beacon) {
+                        if (sdata->vif.csa_active)
+                                ieee80211_update_csa(sdata, beacon);
+
                         /*
                          * headroom, head length,
                          * tail length and maximum TIM length
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 22654452a561..d23c5a705a68 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -107,7 +107,8 @@ void ieee80211_tx_set_protected(struct ieee80211_tx_data *tx)
 }
 
 int ieee80211_frame_duration(enum ieee80211_band band, size_t len,
-                             int rate, int erp, int short_preamble)
+                             int rate, int erp, int short_preamble,
+                             int shift)
 {
         int dur;
 
@@ -118,6 +119,9 @@ int ieee80211_frame_duration(enum ieee80211_band band, size_t len,
          *
          * rate is in 100 kbps, so divident is multiplied by 10 in the
          * DIV_ROUND_UP() operations.
+         *
+         * shift may be 2 for 5 MHz channels or 1 for 10 MHz channels, and
+         * is assumed to be 0 otherwise.
          */
 
         if (band == IEEE80211_BAND_5GHZ || erp) {
@@ -130,13 +134,23 @@ int ieee80211_frame_duration(enum ieee80211_band band, size_t len,
                  * TXTIME = T_PREAMBLE + T_SIGNAL + T_SYM x N_SYM + Signal Ext
                  *
                  * T_SYM = 4 usec
-                 * 802.11a - 17.5.2: aSIFSTime = 16 usec
+                 * 802.11a - 18.5.2: aSIFSTime = 16 usec
                  * 802.11g - 19.8.4: aSIFSTime = 10 usec +
                  *      signal ext = 6 usec
                  */
                 dur = 16; /* SIFS + signal ext */
-                dur += 16; /* 17.3.2.3: T_PREAMBLE = 16 usec */
-                dur += 4; /* 17.3.2.3: T_SIGNAL = 4 usec */
+                dur += 16; /* IEEE 802.11-2012 18.3.2.4: T_PREAMBLE = 16 usec */
+                dur += 4; /* IEEE 802.11-2012 18.3.2.4: T_SIGNAL = 4 usec */
+
+                /* IEEE 802.11-2012 18.3.2.4: all values above are:
+                 *  * times 4 for 5 MHz
+                 *  * times 2 for 10 MHz
+                 */
+                dur *= 1 << shift;
+
+                /* rates should already consider the channel bandwidth,
+                 * don't apply divisor again.
+                 */
                 dur += 4 * DIV_ROUND_UP((16 + 8 * (len + 4) + 6) * 10,
                                         4 * rate); /* T_SYM x N_SYM */
         } else {
@@ -168,7 +182,7 @@ __le16 ieee80211_generic_frame_duration(struct ieee80211_hw *hw,
 {
         struct ieee80211_sub_if_data *sdata;
         u16 dur;
-        int erp;
+        int erp, shift = 0;
         bool short_preamble = false;
 
         erp = 0;
@@ -177,10 +191,11 @@ __le16 ieee80211_generic_frame_duration(struct ieee80211_hw *hw,
                 short_preamble = sdata->vif.bss_conf.use_short_preamble;
                 if (sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
                         erp = rate->flags & IEEE80211_RATE_ERP_G;
+                shift = ieee80211_vif_get_shift(vif);
         }
 
         dur = ieee80211_frame_duration(band, frame_len, rate->bitrate, erp,
-                                       short_preamble);
+                                       short_preamble, shift);
 
         return cpu_to_le16(dur);
 }
@@ -194,7 +209,7 @@ __le16 ieee80211_rts_duration(struct ieee80211_hw *hw,
         struct ieee80211_rate *rate;
         struct ieee80211_sub_if_data *sdata;
         bool short_preamble;
-        int erp;
+        int erp, shift = 0, bitrate;
         u16 dur;
         struct ieee80211_supported_band *sband;
 
@@ -210,17 +225,20 @@ __le16 ieee80211_rts_duration(struct ieee80211_hw *hw,
                 short_preamble = sdata->vif.bss_conf.use_short_preamble;
                 if (sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
                         erp = rate->flags & IEEE80211_RATE_ERP_G;
+                shift = ieee80211_vif_get_shift(vif);
         }
 
+        bitrate = DIV_ROUND_UP(rate->bitrate, 1 << shift);
+
         /* CTS duration */
-        dur = ieee80211_frame_duration(sband->band, 10, rate->bitrate,
-                                       erp, short_preamble);
+        dur = ieee80211_frame_duration(sband->band, 10, bitrate,
+                                       erp, short_preamble, shift);
         /* Data frame duration */
-        dur += ieee80211_frame_duration(sband->band, frame_len, rate->bitrate,
-                                        erp, short_preamble);
+        dur += ieee80211_frame_duration(sband->band, frame_len, bitrate,
+                                        erp, short_preamble, shift);
         /* ACK duration */
-        dur += ieee80211_frame_duration(sband->band, 10, rate->bitrate,
-                                        erp, short_preamble);
+        dur += ieee80211_frame_duration(sband->band, 10, bitrate,
+                                        erp, short_preamble, shift);
 
         return cpu_to_le16(dur);
 }
@@ -235,7 +253,7 @@ __le16 ieee80211_ctstoself_duration(struct ieee80211_hw *hw,
         struct ieee80211_rate *rate;
         struct ieee80211_sub_if_data *sdata;
         bool short_preamble;
-        int erp;
+        int erp, shift = 0, bitrate;
         u16 dur;
         struct ieee80211_supported_band *sband;
 
@@ -250,15 +268,18 @@ __le16 ieee80211_ctstoself_duration(struct ieee80211_hw *hw,
                 short_preamble = sdata->vif.bss_conf.use_short_preamble;
                 if (sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
                         erp = rate->flags & IEEE80211_RATE_ERP_G;
+                shift = ieee80211_vif_get_shift(vif);
         }
 
+        bitrate = DIV_ROUND_UP(rate->bitrate, 1 << shift);
+
         /* Data frame duration */
-        dur = ieee80211_frame_duration(sband->band, frame_len, rate->bitrate,
-                                       erp, short_preamble);
+        dur = ieee80211_frame_duration(sband->band, frame_len, bitrate,
+                                       erp, short_preamble, shift);
         if (!(frame_txctl->flags & IEEE80211_TX_CTL_NO_ACK)) {
                 /* ACK duration */
-                dur += ieee80211_frame_duration(sband->band, 10, rate->bitrate,
-                                                erp, short_preamble);
+                dur += ieee80211_frame_duration(sband->band, 10, bitrate,
+                                                erp, short_preamble, shift);
         }
 
         return cpu_to_le16(dur);
@@ -1052,32 +1073,6 @@ void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata,
         }
 }
 
-void ieee80211_sta_def_wmm_params(struct ieee80211_sub_if_data *sdata,
-                                  const size_t supp_rates_len,
-                                  const u8 *supp_rates)
-{
-        struct ieee80211_chanctx_conf *chanctx_conf;
-        int i, have_higher_than_11mbit = 0;
-
-        /* cf. IEEE 802.11 9.2.12 */
-        for (i = 0; i < supp_rates_len; i++)
-                if ((supp_rates[i] & 0x7f) * 5 > 110)
-                        have_higher_than_11mbit = 1;
-
-        rcu_read_lock();
-        chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
-
-        if (chanctx_conf &&
-            chanctx_conf->def.chan->band == IEEE80211_BAND_2GHZ &&
-            have_higher_than_11mbit)
-                sdata->flags |= IEEE80211_SDATA_OPERATING_GMODE;
-        else
-                sdata->flags &= ~IEEE80211_SDATA_OPERATING_GMODE;
-        rcu_read_unlock();
-
-        ieee80211_set_wmm_default(sdata, true);
-}
-
 void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
                          u16 transaction, u16 auth_alg, u16 status,
                          const u8 *extra, size_t extra_len, const u8 *da,
@@ -1162,7 +1157,7 @@ void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
 int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
                              size_t buffer_len, const u8 *ie, size_t ie_len,
                              enum ieee80211_band band, u32 rate_mask,
-                             u8 channel)
+                             struct cfg80211_chan_def *chandef)
 {
         struct ieee80211_supported_band *sband;
         u8 *pos = buffer, *end = buffer + buffer_len;
@@ -1171,16 +1166,26 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
         u8 rates[32];
         int num_rates;
         int ext_rates_len;
+        int shift;
+        u32 rate_flags;
 
         sband = local->hw.wiphy->bands[band];
         if (WARN_ON_ONCE(!sband))
                 return 0;
 
+        rate_flags = ieee80211_chandef_rate_flags(chandef);
+        shift = ieee80211_chandef_get_shift(chandef);
+
         num_rates = 0;
         for (i = 0; i < sband->n_bitrates; i++) {
                 if ((BIT(i) & rate_mask) == 0)
                         continue; /* skip rate */
-                rates[num_rates++] = (u8) (sband->bitrates[i].bitrate / 5);
+                if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
+                        continue;
+
+                rates[num_rates++] =
+                        (u8) DIV_ROUND_UP(sband->bitrates[i].bitrate,
+                                          (1 << shift) * 5);
         }
 
         supp_rates_len = min_t(int, num_rates, 8);
@@ -1220,12 +1225,13 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
                 pos += ext_rates_len;
         }
 
-        if (channel && sband->band == IEEE80211_BAND_2GHZ) {
+        if (chandef->chan && sband->band == IEEE80211_BAND_2GHZ) {
                 if (end - pos < 3)
                         goto out_err;
                 *pos++ = WLAN_EID_DS_PARAMS;
                 *pos++ = 1;
-                *pos++ = channel;
+                *pos++ = ieee80211_frequency_to_channel(
+                                chandef->chan->center_freq);
         }
 
         /* insert custom IEs that go before HT */
@@ -1290,9 +1296,9 @@ struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
                                           bool directed)
 {
         struct ieee80211_local *local = sdata->local;
+        struct cfg80211_chan_def chandef;
         struct sk_buff *skb;
         struct ieee80211_mgmt *mgmt;
-        u8 chan_no;
         int ies_len;
 
         /*
@@ -1300,10 +1306,11 @@ struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
          * in order to maximize the chance that we get a response.  Some
          * badly-behaved APs don't respond when this parameter is included.
          */
+        chandef.width = sdata->vif.bss_conf.chandef.width;
         if (directed)
-                chan_no = 0;
+                chandef.chan = NULL;
         else
-                chan_no = ieee80211_frequency_to_channel(chan->center_freq);
+                chandef.chan = chan;
 
         skb = ieee80211_probereq_get(&local->hw, &sdata->vif,
                                      ssid, ssid_len, 100 + ie_len);
@@ -1313,7 +1320,7 @@ struct sk_buff *ieee80211_build_probe_req(struct ieee80211_sub_if_data *sdata,
         ies_len = ieee80211_build_preq_ies(local, skb_tail_pointer(skb),
                                            skb_tailroom(skb),
                                            ie, ie_len, chan->band,
-                                           ratemask, chan_no);
+                                           ratemask, &chandef);
         skb_put(skb, ies_len);
 
         if (dst) {
@@ -1347,16 +1354,19 @@ void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
         }
 }
 
-u32 ieee80211_sta_get_rates(struct ieee80211_local *local,
+u32 ieee80211_sta_get_rates(struct ieee80211_sub_if_data *sdata,
                             struct ieee802_11_elems *elems,
                             enum ieee80211_band band, u32 *basic_rates)
 {
         struct ieee80211_supported_band *sband;
         struct ieee80211_rate *bitrates;
         size_t num_rates;
-        u32 supp_rates;
-        int i, j;
-        sband = local->hw.wiphy->bands[band];
+        u32 supp_rates, rate_flags;
+        int i, j, shift;
+        sband = sdata->local->hw.wiphy->bands[band];
+
+        rate_flags = ieee80211_chandef_rate_flags(&sdata->vif.bss_conf.chandef);
+        shift = ieee80211_vif_get_shift(&sdata->vif);
 
         if (WARN_ON(!sband))
                 return 1;
@@ -1381,7 +1391,15 @@ u32 ieee80211_sta_get_rates(struct ieee80211_local *local,
                         continue;
 
                 for (j = 0; j < num_rates; j++) {
-                        if (bitrates[j].bitrate == own_rate) {
+                        int brate;
+                        if ((rate_flags & sband->bitrates[j].flags)
+                            != rate_flags)
+                                continue;
+
+                        brate = DIV_ROUND_UP(sband->bitrates[j].bitrate,
+                                             1 << shift);
+
+                        if (brate == own_rate) {
                                 supp_rates |= BIT(j);
                                 if (basic_rates && is_basic)
                                         *basic_rates |= BIT(j);
@@ -2004,18 +2022,56 @@ void ieee80211_ht_oper_to_chandef(struct ieee80211_channel *control_chan,
         cfg80211_chandef_create(chandef, control_chan, channel_type);
 }
 
+int ieee80211_parse_bitrates(struct cfg80211_chan_def *chandef,
+                             const struct ieee80211_supported_band *sband,
+                             const u8 *srates, int srates_len, u32 *rates)
+{
+        u32 rate_flags = ieee80211_chandef_rate_flags(chandef);
+        int shift = ieee80211_chandef_get_shift(chandef);
+        struct ieee80211_rate *br;
+        int brate, rate, i, j, count = 0;
+
+        *rates = 0;
+
+        for (i = 0; i < srates_len; i++) {
+                rate = srates[i] & 0x7f;
+
+                for (j = 0; j < sband->n_bitrates; j++) {
+                        br = &sband->bitrates[j];
+                        if ((rate_flags & br->flags) != rate_flags)
+                                continue;
+
+                        brate = DIV_ROUND_UP(br->bitrate, (1 << shift) * 5);
+                        if (brate == rate) {
+                                *rates |= BIT(j);
+                                count++;
+                                break;
+                        }
+                }
+        }
+        return count;
+}
+
 int ieee80211_add_srates_ie(struct ieee80211_sub_if_data *sdata,
                             struct sk_buff *skb, bool need_basic,
                             enum ieee80211_band band)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_supported_band *sband;
-        int rate;
+        int rate, shift;
         u8 i, rates, *pos;
         u32 basic_rates = sdata->vif.bss_conf.basic_rates;
+        u32 rate_flags;
 
+        shift = ieee80211_vif_get_shift(&sdata->vif);
+        rate_flags = ieee80211_chandef_rate_flags(&sdata->vif.bss_conf.chandef);
         sband = local->hw.wiphy->bands[band];
-        rates = sband->n_bitrates;
+        rates = 0;
+        for (i = 0; i < sband->n_bitrates; i++) {
+                if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
+                        continue;
+                rates++;
+        }
         if (rates > 8)
                 rates = 8;
 
@@ -2027,10 +2083,15 @@ int ieee80211_add_srates_ie(struct ieee80211_sub_if_data *sdata,
         *pos++ = rates;
         for (i = 0; i < rates; i++) {
                 u8 basic = 0;
+                if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
+                        continue;
+
                 if (need_basic && basic_rates & BIT(i))
                         basic = 0x80;
                 rate = sband->bitrates[i].bitrate;
-                *pos++ = basic | (u8) (rate / 5);
+                rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
+                                    5 * (1 << shift));
+                *pos++ = basic | (u8) rate;
         }
 
         return 0;
@@ -2042,12 +2103,22 @@ int ieee80211_add_ext_srates_ie(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_supported_band *sband;
-        int rate;
+        int rate, skip, shift;
         u8 i, exrates, *pos;
         u32 basic_rates = sdata->vif.bss_conf.basic_rates;
+        u32 rate_flags;
+
+        rate_flags = ieee80211_chandef_rate_flags(&sdata->vif.bss_conf.chandef);
+        shift = ieee80211_vif_get_shift(&sdata->vif);
 
         sband = local->hw.wiphy->bands[band];
-        exrates = sband->n_bitrates;
+        exrates = 0;
+        for (i = 0; i < sband->n_bitrates; i++) {
+                if ((rate_flags & sband->bitrates[i].flags) != rate_flags)
+                        continue;
+                exrates++;
+        }
+
         if (exrates > 8)
                 exrates -= 8;
         else
@@ -2060,12 +2131,19 @@ int ieee80211_add_ext_srates_ie(struct ieee80211_sub_if_data *sdata,
                 pos = skb_put(skb, exrates + 2);
                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
                 *pos++ = exrates;
+                skip = 0;
                 for (i = 8; i < sband->n_bitrates; i++) {
                         u8 basic = 0;
+                        if ((rate_flags & sband->bitrates[i].flags)
+                            != rate_flags)
+                                continue;
+                        if (skip++ < 8)
+                                continue;
                         if (need_basic && basic_rates & BIT(i))
                                 basic = 0x80;
-                        rate = sband->bitrates[i].bitrate;
-                        *pos++ = basic | (u8) (rate / 5);
+                        rate = DIV_ROUND_UP(sband->bitrates[i].bitrate,
+                                            5 * (1 << shift));
+                        *pos++ = basic | (u8) rate;
                 }
         }
         return 0;
@@ -2149,9 +2227,17 @@ u64 ieee80211_calculate_rx_timestamp(struct ieee80211_local *local,
                         ri.flags |= RATE_INFO_FLAGS_SHORT_GI;
         } else {
                 struct ieee80211_supported_band *sband;
+                int shift = 0;
+                int bitrate;
+
+                if (status->flag & RX_FLAG_10MHZ)
+                        shift = 1;
+                if (status->flag & RX_FLAG_5MHZ)
+                        shift = 2;
 
                 sband = local->hw.wiphy->bands[status->band];
-                ri.legacy = sband->bitrates[status->rate_idx].bitrate;
+                bitrate = sband->bitrates[status->rate_idx].bitrate;
+                ri.legacy = DIV_ROUND_UP(bitrate, (1 << shift));
         }
 
         rate = cfg80211_calculate_bitrate(&ri);
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 4f9f216665e9..67153964aad2 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -462,6 +462,14 @@ int wiphy_register(struct wiphy *wiphy)
                 return -EINVAL;
 #endif
 
+        if (WARN_ON(wiphy->coalesce &&
+                    (!wiphy->coalesce->n_rules ||
+                     !wiphy->coalesce->n_patterns) &&
+                    (!wiphy->coalesce->pattern_min_len ||
+                     wiphy->coalesce->pattern_min_len >
+                        wiphy->coalesce->pattern_max_len)))
+                return -EINVAL;
+
         if (WARN_ON(wiphy->ap_sme_capa &&
                     !(wiphy->flags & WIPHY_FLAG_HAVE_AP_SME)))
                 return -EINVAL;
@@ -668,6 +676,7 @@ void wiphy_unregister(struct wiphy *wiphy)
                 rdev_set_wakeup(rdev, false);
 #endif
         cfg80211_rdev_free_wowlan(rdev);
+        cfg80211_rdev_free_coalesce(rdev);
 }
 EXPORT_SYMBOL(wiphy_unregister);
 
@@ -765,6 +774,7 @@ void cfg80211_leave(struct cfg80211_registered_device *rdev,
                 cfg80211_leave_mesh(rdev, dev);
                 break;
         case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_P2P_GO:
                 cfg80211_stop_ap(rdev, dev);
                 break;
         default:
diff --git a/net/wireless/core.h b/net/wireless/core.h
index a6b45bf00f33..9ad43c619c54 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -79,6 +79,8 @@ struct cfg80211_registered_device {
         /* netlink port which started critical protocol (0 means not started) */
         u32 crit_proto_nlportid;
 
+        struct cfg80211_coalesce *coalesce;
+
         /* must be last because of the way we do wiphy_priv(),
          * and it should at least be aligned to NETDEV_ALIGN */
         struct wiphy wiphy __aligned(NETDEV_ALIGN);
diff --git a/net/wireless/mesh.c b/net/wireless/mesh.c
index 30c49202ee4d..0553fd4d85ae 100644
--- a/net/wireless/mesh.c
+++ b/net/wireless/mesh.c
@@ -167,9 +167,12 @@ int __cfg80211_join_mesh(struct cfg80211_registered_device *rdev,
          * basic rates
          */
         if (!setup->basic_rates) {
+                enum nl80211_bss_scan_width scan_width;
                 struct ieee80211_supported_band *sband =
                                 rdev->wiphy.bands[setup->chandef.chan->band];
-                setup->basic_rates = ieee80211_mandatory_rates(sband);
+                scan_width = cfg80211_chandef_to_scan_width(&setup->chandef);
+                setup->basic_rates = ieee80211_mandatory_rates(sband,
+                                                               scan_width);
         }
 
         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &setup->chandef))
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 25d217d90807..adf1e98f4c3e 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -349,6 +349,11 @@ static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
                                   .len = IEEE80211_MAX_DATA_LEN },
         [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
+        [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
+        [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
+        [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
+        [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_U16 },
+        [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_U16 },
 };
 
 /* policy for the key attributes */
@@ -403,6 +408,14 @@ nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 };
 
+/* policy for coalesce rule attributes */
+static const struct nla_policy
+nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
+        [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
+        [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
+        [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
+};
+
 /* policy for GTK rekey offload attributes */
 static const struct nla_policy
 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
@@ -441,10 +454,12 @@ static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
                         goto out_unlock;
                 }
                 *rdev = wiphy_to_dev((*wdev)->wiphy);
-                cb->args[0] = (*rdev)->wiphy_idx;
+                /* 0 is the first index - add 1 to parse only once */
+                cb->args[0] = (*rdev)->wiphy_idx + 1;
                 cb->args[1] = (*wdev)->identifier;
         } else {
-                struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0]);
+                /* subtract the 1 again here */
+                struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
                 struct wireless_dev *tmp;
 
                 if (!wiphy) {
@@ -974,7 +989,7 @@ static int nl80211_send_wowlan(struct sk_buff *msg,
                 return -ENOBUFS;
 
         if (dev->wiphy.wowlan->n_patterns) {
-                struct nl80211_wowlan_pattern_support pat = {
+                struct nl80211_pattern_support pat = {
                         .max_patterns = dev->wiphy.wowlan->n_patterns,
                         .min_pattern_len = dev->wiphy.wowlan->pattern_min_len,
                         .max_pattern_len = dev->wiphy.wowlan->pattern_max_len,
@@ -995,6 +1010,27 @@ static int nl80211_send_wowlan(struct sk_buff *msg,
 }
 #endif
 
+static int nl80211_send_coalesce(struct sk_buff *msg,
+                                 struct cfg80211_registered_device *dev)
+{
+        struct nl80211_coalesce_rule_support rule;
+
+        if (!dev->wiphy.coalesce)
+                return 0;
+
+        rule.max_rules = dev->wiphy.coalesce->n_rules;
+        rule.max_delay = dev->wiphy.coalesce->max_delay;
+        rule.pat.max_patterns = dev->wiphy.coalesce->n_patterns;
+        rule.pat.min_pattern_len = dev->wiphy.coalesce->pattern_min_len;
+        rule.pat.max_pattern_len = dev->wiphy.coalesce->pattern_max_len;
+        rule.pat.max_pkt_offset = dev->wiphy.coalesce->max_pkt_offset;
+
+        if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
+                return -ENOBUFS;
+
+        return 0;
+}
+
 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
                                       struct ieee80211_supported_band *sband)
 {
@@ -1393,6 +1429,8 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
                 if (state->split) {
                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
+                        if (dev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
+                                CMD(channel_switch, CHANNEL_SWITCH);
                 }
 
 #ifdef CONFIG_NL80211_TESTMODE
@@ -1513,6 +1551,12 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
                             dev->wiphy.vht_capa_mod_mask))
                         goto nla_put_failure;
 
+                state->split_start++;
+                break;
+        case 10:
+                if (nl80211_send_coalesce(msg, dev))
+                        goto nla_put_failure;
+
                 /* done */
                 state->split_start = 0;
                 break;
@@ -5578,6 +5622,111 @@ static int nl80211_start_radar_detection(struct sk_buff *skb,
         return err;
 }
 
+static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev = info->user_ptr[0];
+        struct net_device *dev = info->user_ptr[1];
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_csa_settings params;
+        /* csa_attrs is defined static to avoid waste of stack size - this
+         * function is called under RTNL lock, so this should not be a problem.
+         */
+        static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
+        u8 radar_detect_width = 0;
+        int err;
+
+        if (!rdev->ops->channel_switch ||
+            !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
+                return -EOPNOTSUPP;
+
+        /* may add IBSS support later */
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
+                return -EOPNOTSUPP;
+
+        memset(&params, 0, sizeof(params));
+
+        if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
+            !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
+                return -EINVAL;
+
+        /* only important for AP, IBSS and mesh create IEs internally */
+        if (!info->attrs[NL80211_ATTR_CSA_IES])
+                return -EINVAL;
+
+        /* useless if AP is not running */
+        if (!wdev->beacon_interval)
+                return -EINVAL;
+
+        params.count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
+
+        err = nl80211_parse_beacon(info->attrs, &params.beacon_after);
+        if (err)
+                return err;
+
+        err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
+                               info->attrs[NL80211_ATTR_CSA_IES],
+                               nl80211_policy);
+        if (err)
+                return err;
+
+        err = nl80211_parse_beacon(csa_attrs, &params.beacon_csa);
+        if (err)
+                return err;
+
+        if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
+                return -EINVAL;
+
+        params.counter_offset_beacon =
+                nla_get_u16(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
+        if (params.counter_offset_beacon >= params.beacon_csa.tail_len)
+                return -EINVAL;
+
+        /* sanity check - counters should be the same */
+        if (params.beacon_csa.tail[params.counter_offset_beacon] !=
+            params.count)
+                return -EINVAL;
+
+        if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
+                params.counter_offset_presp =
+                        nla_get_u16(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
+                if (params.counter_offset_presp >=
+                    params.beacon_csa.probe_resp_len)
+                        return -EINVAL;
+
+                if (params.beacon_csa.probe_resp[params.counter_offset_presp] !=
+                    params.count)
+                        return -EINVAL;
+        }
+
+        err = nl80211_parse_chandef(rdev, info, &params.chandef);
+        if (err)
+                return err;
+
+        if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef))
+                return -EINVAL;
+
+        err = cfg80211_chandef_dfs_required(wdev->wiphy, &params.chandef);
+        if (err < 0) {
+                return err;
+        } else if (err) {
+                radar_detect_width = BIT(params.chandef.width);
+                params.radar_required = true;
+        }
+
+        err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
+                                           params.chandef.chan,
+                                           CHAN_MODE_SHARED,
+                                           radar_detect_width);
+        if (err)
+                return err;
+
+        if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
+                params.block_tx = true;
+
+        return rdev_channel_switch(rdev, dev, &params);
+}
+
 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
                             u32 seq, int flags,
                             struct cfg80211_registered_device *rdev,
@@ -5639,6 +5788,7 @@ static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
                 goto nla_put_failure;
         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
+            nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
                         jiffies_to_msecs(jiffies - intbss->ts)))
                 goto nla_put_failure;
@@ -6319,6 +6469,8 @@ static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
                 return -EINVAL;
 
         switch (ibss.chandef.width) {
+        case NL80211_CHAN_WIDTH_5:
+        case NL80211_CHAN_WIDTH_10:
         case NL80211_CHAN_WIDTH_20_NOHT:
                 break;
         case NL80211_CHAN_WIDTH_20:
@@ -6346,6 +6498,19 @@ static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
                         return err;
         }
 
+        if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
+                memcpy(&ibss.ht_capa_mask,
+                       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
+                       sizeof(ibss.ht_capa_mask));
+
+        if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
+                if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
+                        return -EINVAL;
+                memcpy(&ibss.ht_capa,
+                       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
+                       sizeof(ibss.ht_capa));
+        }
+
         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
@@ -7593,12 +7758,11 @@ static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
                 if (!nl_pat)
                         return -ENOBUFS;
                 pat_len = wowlan->patterns[i].pattern_len;
-                if (nla_put(msg, NL80211_WOWLAN_PKTPAT_MASK,
-                            DIV_ROUND_UP(pat_len, 8),
+                if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
                             wowlan->patterns[i].mask) ||
-                    nla_put(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
-                            pat_len, wowlan->patterns[i].pattern) ||
-                    nla_put_u32(msg, NL80211_WOWLAN_PKTPAT_OFFSET,
+                    nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
+                            wowlan->patterns[i].pattern) ||
+                    nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
                                 wowlan->patterns[i].pkt_offset))
                         return -ENOBUFS;
                 nla_nest_end(msg, nl_pat);
@@ -7939,7 +8103,7 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
                 struct nlattr *pat;
                 int n_patterns = 0;
                 int rem, pat_len, mask_len, pkt_offset;
-                struct nlattr *pat_tb[NUM_NL80211_WOWLAN_PKTPAT];
+                struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
 
                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
                                     rem)
@@ -7958,26 +8122,25 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
 
                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
                                     rem) {
-                        nla_parse(pat_tb, MAX_NL80211_WOWLAN_PKTPAT,
-                                  nla_data(pat), nla_len(pat), NULL);
+                        nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
+                                  nla_len(pat), NULL);
                         err = -EINVAL;
-                        if (!pat_tb[NL80211_WOWLAN_PKTPAT_MASK] ||
-                            !pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN])
+                        if (!pat_tb[NL80211_PKTPAT_MASK] ||
+                            !pat_tb[NL80211_PKTPAT_PATTERN])
                                 goto error;
-                        pat_len = nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]);
+                        pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
                         mask_len = DIV_ROUND_UP(pat_len, 8);
-                        if (nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]) !=
-                            mask_len)
+                        if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
                                 goto error;
                         if (pat_len > wowlan->pattern_max_len ||
                             pat_len < wowlan->pattern_min_len)
                                 goto error;
 
-                        if (!pat_tb[NL80211_WOWLAN_PKTPAT_OFFSET])
+                        if (!pat_tb[NL80211_PKTPAT_OFFSET])
                                 pkt_offset = 0;
                         else
                                 pkt_offset = nla_get_u32(
-                                        pat_tb[NL80211_WOWLAN_PKTPAT_OFFSET]);
+                                        pat_tb[NL80211_PKTPAT_OFFSET]);
                         if (pkt_offset > wowlan->max_pkt_offset)
                                 goto error;
                         new_triggers.patterns[i].pkt_offset = pkt_offset;
@@ -7991,11 +8154,11 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
                         new_triggers.patterns[i].pattern =
                                 new_triggers.patterns[i].mask + mask_len;
                         memcpy(new_triggers.patterns[i].mask,
-                               nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]),
+                               nla_data(pat_tb[NL80211_PKTPAT_MASK]),
                                mask_len);
                         new_triggers.patterns[i].pattern_len = pat_len;
                         memcpy(new_triggers.patterns[i].pattern,
-                               nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]),
+                               nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
                                pat_len);
                         i++;
                 }
@@ -8034,6 +8197,264 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
 }
 #endif
 
+static int nl80211_send_coalesce_rules(struct sk_buff *msg,
+                                       struct cfg80211_registered_device *rdev)
+{
+        struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
+        int i, j, pat_len;
+        struct cfg80211_coalesce_rules *rule;
+
+        if (!rdev->coalesce->n_rules)
+                return 0;
+
+        nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
+        if (!nl_rules)
+                return -ENOBUFS;
+
+        for (i = 0; i < rdev->coalesce->n_rules; i++) {
+                nl_rule = nla_nest_start(msg, i + 1);
+                if (!nl_rule)
+                        return -ENOBUFS;
+
+                rule = &rdev->coalesce->rules[i];
+                if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
+                                rule->delay))
+                        return -ENOBUFS;
+
+                if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
+                                rule->condition))
+                        return -ENOBUFS;
+
+                nl_pats = nla_nest_start(msg,
+                                NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
+                if (!nl_pats)
+                        return -ENOBUFS;
+
+                for (j = 0; j < rule->n_patterns; j++) {
+                        nl_pat = nla_nest_start(msg, j + 1);
+                        if (!nl_pat)
+                                return -ENOBUFS;
+                        pat_len = rule->patterns[j].pattern_len;
+                        if (nla_put(msg, NL80211_PKTPAT_MASK,
+                                    DIV_ROUND_UP(pat_len, 8),
+                                    rule->patterns[j].mask) ||
+                            nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
+                                    rule->patterns[j].pattern) ||
+                            nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
+                                        rule->patterns[j].pkt_offset))
+                                return -ENOBUFS;
+                        nla_nest_end(msg, nl_pat);
+                }
+                nla_nest_end(msg, nl_pats);
+                nla_nest_end(msg, nl_rule);
+        }
+        nla_nest_end(msg, nl_rules);
+
+        return 0;
+}
+
+static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev = info->user_ptr[0];
+        struct sk_buff *msg;
+        void *hdr;
+
+        if (!rdev->wiphy.coalesce)
+                return -EOPNOTSUPP;
+
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+        if (!msg)
+                return -ENOMEM;
+
+        hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
+                             NL80211_CMD_GET_COALESCE);
+        if (!hdr)
+                goto nla_put_failure;
+
+        if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
+                goto nla_put_failure;
+
+        genlmsg_end(msg, hdr);
+        return genlmsg_reply(msg, info);
+
+nla_put_failure:
+        nlmsg_free(msg);
+        return -ENOBUFS;
+}
+
+void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
+{
+        struct cfg80211_coalesce *coalesce = rdev->coalesce;
+        int i, j;
+        struct cfg80211_coalesce_rules *rule;
+
+        if (!coalesce)
+                return;
+
+        for (i = 0; i < coalesce->n_rules; i++) {
+                rule = &coalesce->rules[i];
+                for (j = 0; j < rule->n_patterns; j++)
+                        kfree(rule->patterns[j].mask);
+                kfree(rule->patterns);
+        }
+        kfree(coalesce->rules);
+        kfree(coalesce);
+        rdev->coalesce = NULL;
+}
+
+static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
+                                       struct nlattr *rule,
+                                       struct cfg80211_coalesce_rules *new_rule)
+{
+        int err, i;
+        const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
+        struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
+        int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
+        struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
+
+        err = nla_parse(tb, NL80211_ATTR_COALESCE_RULE_MAX, nla_data(rule),
+                        nla_len(rule), nl80211_coalesce_policy);
+        if (err)
+                return err;
+
+        if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
+                new_rule->delay =
+                        nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
+        if (new_rule->delay > coalesce->max_delay)
+                return -EINVAL;
+
+        if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
+                new_rule->condition =
+                        nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
+        if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH &&
+            new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH)
+                return -EINVAL;
+
+        if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
+                return -EINVAL;
+
+        nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
+                            rem)
+                n_patterns++;
+        if (n_patterns > coalesce->n_patterns)
+                return -EINVAL;
+
+        new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
+                                     GFP_KERNEL);
+        if (!new_rule->patterns)
+                return -ENOMEM;
+
+        new_rule->n_patterns = n_patterns;
+        i = 0;
+
+        nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
+                            rem) {
+                nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
+                          nla_len(pat), NULL);
+                if (!pat_tb[NL80211_PKTPAT_MASK] ||
+                    !pat_tb[NL80211_PKTPAT_PATTERN])
+                        return -EINVAL;
+                pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
+                mask_len = DIV_ROUND_UP(pat_len, 8);
+                if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
+                        return -EINVAL;
+                if (pat_len > coalesce->pattern_max_len ||
+                    pat_len < coalesce->pattern_min_len)
+                        return -EINVAL;
+
+                if (!pat_tb[NL80211_PKTPAT_OFFSET])
+                        pkt_offset = 0;
+                else
+                        pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
+                if (pkt_offset > coalesce->max_pkt_offset)
+                        return -EINVAL;
+                new_rule->patterns[i].pkt_offset = pkt_offset;
+
+                new_rule->patterns[i].mask =
+                        kmalloc(mask_len + pat_len, GFP_KERNEL);
+                if (!new_rule->patterns[i].mask)
+                        return -ENOMEM;
+                new_rule->patterns[i].pattern =
+                        new_rule->patterns[i].mask + mask_len;
+                memcpy(new_rule->patterns[i].mask,
+                       nla_data(pat_tb[NL80211_PKTPAT_MASK]), mask_len);
+                new_rule->patterns[i].pattern_len = pat_len;
+                memcpy(new_rule->patterns[i].pattern,
+                       nla_data(pat_tb[NL80211_PKTPAT_PATTERN]), pat_len);
+                i++;
+        }
+
+        return 0;
+}
+
+static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev = info->user_ptr[0];
+        const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
+        struct cfg80211_coalesce new_coalesce = {};
+        struct cfg80211_coalesce *n_coalesce;
+        int err, rem_rule, n_rules = 0, i, j;
+        struct nlattr *rule;
+        struct cfg80211_coalesce_rules *tmp_rule;
+
+        if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
+                return -EOPNOTSUPP;
+
+        if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
+                cfg80211_rdev_free_coalesce(rdev);
+                rdev->ops->set_coalesce(&rdev->wiphy, NULL);
+                return 0;
+        }
+
+        nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
+                            rem_rule)
+                n_rules++;
+        if (n_rules > coalesce->n_rules)
+                return -EINVAL;
+
+        new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
+                                     GFP_KERNEL);
+        if (!new_coalesce.rules)
+                return -ENOMEM;
+
+        new_coalesce.n_rules = n_rules;
+        i = 0;
+
+        nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
+                            rem_rule) {
+                err = nl80211_parse_coalesce_rule(rdev, rule,
+                                                  &new_coalesce.rules[i]);
+                if (err)
+                        goto error;
+
+                i++;
+        }
+
+        err = rdev->ops->set_coalesce(&rdev->wiphy, &new_coalesce);
+        if (err)
+                goto error;
+
+        n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
+        if (!n_coalesce) {
+                err = -ENOMEM;
+                goto error;
+        }
+        cfg80211_rdev_free_coalesce(rdev);
+        rdev->coalesce = n_coalesce;
+
+        return 0;
+error:
+        for (i = 0; i < new_coalesce.n_rules; i++) {
+                tmp_rule = &new_coalesce.rules[i];
+                for (j = 0; j < tmp_rule->n_patterns; j++)
+                        kfree(tmp_rule->patterns[j].mask);
+                kfree(tmp_rule->patterns);
+        }
+        kfree(new_coalesce.rules);
+
+        return err;
+}
+
 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
 {
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
@@ -9041,7 +9462,30 @@ static struct genl_ops nl80211_ops[] = {
                 .flags = GENL_ADMIN_PERM,
                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
-        }
+        },
+        {
+                .cmd = NL80211_CMD_GET_COALESCE,
+                .doit = nl80211_get_coalesce,
+                .policy = nl80211_policy,
+                .internal_flags = NL80211_FLAG_NEED_WIPHY |
+                                  NL80211_FLAG_NEED_RTNL,
+        },
+        {
+                .cmd = NL80211_CMD_SET_COALESCE,
+                .doit = nl80211_set_coalesce,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+                .internal_flags = NL80211_FLAG_NEED_WIPHY |
+                                  NL80211_FLAG_NEED_RTNL,
+        },
+        {
+                .cmd = NL80211_CMD_CHANNEL_SWITCH,
+                .doit = nl80211_channel_switch,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
+                                  NL80211_FLAG_NEED_RTNL,
+        },
 };
 
 static struct genl_multicast_group nl80211_mlme_mcgrp = {
diff --git a/net/wireless/nl80211.h b/net/wireless/nl80211.h
index a4073e808c13..44341bf53cfc 100644
--- a/net/wireless/nl80211.h
+++ b/net/wireless/nl80211.h
@@ -74,4 +74,6 @@ nl80211_radar_notify(struct cfg80211_registered_device *rdev,
                      enum nl80211_radar_event event,
                      struct net_device *netdev, gfp_t gfp);
 
+void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev);
+
 #endif /* __NET_WIRELESS_NL80211_H */
diff --git a/net/wireless/rdev-ops.h b/net/wireless/rdev-ops.h
index 9f15f0ac824d..de870d4d0bcc 100644
--- a/net/wireless/rdev-ops.h
+++ b/net/wireless/rdev-ops.h
@@ -923,4 +923,16 @@ static inline void rdev_crit_proto_stop(struct cfg80211_registered_device *rdev,
         trace_rdev_return_void(&rdev->wiphy);
 }
 
+static inline int rdev_channel_switch(struct cfg80211_registered_device *rdev,
+                                      struct net_device *dev,
+                                      struct cfg80211_csa_settings *params)
+{
+        int ret;
+
+        trace_rdev_channel_switch(&rdev->wiphy, dev, params);
+        ret = rdev->ops->channel_switch(&rdev->wiphy, dev, params);
+        trace_rdev_return_int(&rdev->wiphy, ret);
+        return ret;
+}
+
 #endif /* __CFG80211_RDEV_OPS */
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index ae8c186b50d6..ad1e4068ce06 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -651,6 +651,8 @@ static bool cfg80211_combine_bsses(struct cfg80211_registered_device *dev,
                         continue;
                 if (bss->pub.channel != new->pub.channel)
                         continue;
+                if (bss->pub.scan_width != new->pub.scan_width)
+                        continue;
                 if (rcu_access_pointer(bss->pub.beacon_ies))
                         continue;
                 ies = rcu_access_pointer(bss->pub.ies);
@@ -870,11 +872,12 @@ cfg80211_get_bss_channel(struct wiphy *wiphy, const u8 *ie, size_t ielen,
 
 /* Returned bss is reference counted and must be cleaned up appropriately. */
 struct cfg80211_bss*
-cfg80211_inform_bss(struct wiphy *wiphy,
-                    struct ieee80211_channel *channel,
-                    const u8 *bssid, u64 tsf, u16 capability,
-                    u16 beacon_interval, const u8 *ie, size_t ielen,
-                    s32 signal, gfp_t gfp)
+cfg80211_inform_bss_width(struct wiphy *wiphy,
+                          struct ieee80211_channel *channel,
+                          enum nl80211_bss_scan_width scan_width,
+                          const u8 *bssid, u64 tsf, u16 capability,
+                          u16 beacon_interval, const u8 *ie, size_t ielen,
+                          s32 signal, gfp_t gfp)
 {
         struct cfg80211_bss_ies *ies;
         struct cfg80211_internal_bss tmp = {}, *res;
@@ -892,6 +895,7 @@ cfg80211_inform_bss(struct wiphy *wiphy,
 
         memcpy(tmp.pub.bssid, bssid, ETH_ALEN);
         tmp.pub.channel = channel;
+        tmp.pub.scan_width = scan_width;
         tmp.pub.signal = signal;
         tmp.pub.beacon_interval = beacon_interval;
         tmp.pub.capability = capability;
@@ -924,14 +928,15 @@ cfg80211_inform_bss(struct wiphy *wiphy,
         /* cfg80211_bss_update gives us a referenced result */
         return &res->pub;
 }
-EXPORT_SYMBOL(cfg80211_inform_bss);
+EXPORT_SYMBOL(cfg80211_inform_bss_width);
 
 /* Returned bss is reference counted and must be cleaned up appropriately. */
 struct cfg80211_bss *
-cfg80211_inform_bss_frame(struct wiphy *wiphy,
-                          struct ieee80211_channel *channel,
-                          struct ieee80211_mgmt *mgmt, size_t len,
-                          s32 signal, gfp_t gfp)
+cfg80211_inform_bss_width_frame(struct wiphy *wiphy,
+                                struct ieee80211_channel *channel,
+                                enum nl80211_bss_scan_width scan_width,
+                                struct ieee80211_mgmt *mgmt, size_t len,
+                                s32 signal, gfp_t gfp)
 {
         struct cfg80211_internal_bss tmp = {}, *res;
         struct cfg80211_bss_ies *ies;
@@ -941,7 +946,8 @@ cfg80211_inform_bss_frame(struct wiphy *wiphy,
         BUILD_BUG_ON(offsetof(struct ieee80211_mgmt, u.probe_resp.variable) !=
                         offsetof(struct ieee80211_mgmt, u.beacon.variable));
 
-        trace_cfg80211_inform_bss_frame(wiphy, channel, mgmt, len, signal);
+        trace_cfg80211_inform_bss_width_frame(wiphy, channel, scan_width, mgmt,
+                                              len, signal);
 
         if (WARN_ON(!mgmt))
                 return NULL;
@@ -976,6 +982,7 @@ cfg80211_inform_bss_frame(struct wiphy *wiphy,
         
         memcpy(tmp.pub.bssid, mgmt->bssid, ETH_ALEN);
         tmp.pub.channel = channel;
+        tmp.pub.scan_width = scan_width;
         tmp.pub.signal = signal;
         tmp.pub.beacon_interval = le16_to_cpu(mgmt->u.probe_resp.beacon_int);
         tmp.pub.capability = le16_to_cpu(mgmt->u.probe_resp.capab_info);
@@ -991,7 +998,7 @@ cfg80211_inform_bss_frame(struct wiphy *wiphy,
         /* cfg80211_bss_update gives us a referenced result */
         return &res->pub;
 }
-EXPORT_SYMBOL(cfg80211_inform_bss_frame);
+EXPORT_SYMBOL(cfg80211_inform_bss_width_frame);
 
 void cfg80211_ref_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
 {
diff --git a/net/wireless/trace.h b/net/wireless/trace.h
index e1534baf2ebb..f0ebdcd394ef 100644
--- a/net/wireless/trace.h
+++ b/net/wireless/trace.h
@@ -1841,6 +1841,39 @@ TRACE_EVENT(rdev_crit_proto_stop,
                   WIPHY_PR_ARG, WDEV_PR_ARG)
 );
 
+TRACE_EVENT(rdev_channel_switch,
+        TP_PROTO(struct wiphy *wiphy, struct net_device *netdev,
+                 struct cfg80211_csa_settings *params),
+        TP_ARGS(wiphy, netdev, params),
+        TP_STRUCT__entry(
+                WIPHY_ENTRY
+                NETDEV_ENTRY
+                CHAN_DEF_ENTRY
+                __field(u16, counter_offset_beacon)
+                __field(u16, counter_offset_presp)
+                __field(bool, radar_required)
+                __field(bool, block_tx)
+                __field(u8, count)
+        ),
+        TP_fast_assign(
+                WIPHY_ASSIGN;
+                NETDEV_ASSIGN;
+                CHAN_DEF_ASSIGN(&params->chandef);
+                __entry->counter_offset_beacon = params->counter_offset_beacon;
+                __entry->counter_offset_presp = params->counter_offset_presp;
+                __entry->radar_required = params->radar_required;
+                __entry->block_tx = params->block_tx;
+                __entry->count = params->count;
+        ),
+        TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT ", " CHAN_DEF_PR_FMT
+                  ", block_tx: %d, count: %u, radar_required: %d"
+                  ", counter offsets (beacon/presp): %u/%u",
+                  WIPHY_PR_ARG, NETDEV_PR_ARG, CHAN_DEF_PR_ARG,
+                  __entry->block_tx, __entry->count, __entry->radar_required,
+                  __entry->counter_offset_beacon,
+                  __entry->counter_offset_presp)
+);
+
 /*************************************************************
  *           cfg80211 exported functions traces              *
  *************************************************************/
@@ -2391,26 +2424,30 @@ TRACE_EVENT(cfg80211_get_bss,
                   __entry->capa_mask, __entry->capa_val)
 );
 
-TRACE_EVENT(cfg80211_inform_bss_frame,
+TRACE_EVENT(cfg80211_inform_bss_width_frame,
         TP_PROTO(struct wiphy *wiphy, struct ieee80211_channel *channel,
+                 enum nl80211_bss_scan_width scan_width,
                  struct ieee80211_mgmt *mgmt, size_t len,
                  s32 signal),
-        TP_ARGS(wiphy, channel, mgmt, len, signal),
+        TP_ARGS(wiphy, channel, scan_width, mgmt, len, signal),
         TP_STRUCT__entry(
                 WIPHY_ENTRY
                 CHAN_ENTRY
+                __field(enum nl80211_bss_scan_width, scan_width)
                 __dynamic_array(u8, mgmt, len)
                 __field(s32, signal)
         ),
         TP_fast_assign(
                 WIPHY_ASSIGN;
                 CHAN_ASSIGN(channel);
+                __entry->scan_width = scan_width;
                 if (mgmt)
                         memcpy(__get_dynamic_array(mgmt), mgmt, len);
                 __entry->signal = signal;
         ),
-        TP_printk(WIPHY_PR_FMT ", " CHAN_PR_FMT "signal: %d",
-                  WIPHY_PR_ARG, CHAN_PR_ARG, __entry->signal)
+        TP_printk(WIPHY_PR_FMT ", " CHAN_PR_FMT "(scan_width: %d) signal: %d",
+                  WIPHY_PR_ARG, CHAN_PR_ARG, __entry->scan_width,
+                  __entry->signal)
 );
 
 DECLARE_EVENT_CLASS(cfg80211_bss_evt,
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 74458b7f61eb..ce090c1c5e4f 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -33,7 +33,8 @@ ieee80211_get_response_rate(struct ieee80211_supported_band *sband,
 }
 EXPORT_SYMBOL(ieee80211_get_response_rate);
 
-u32 ieee80211_mandatory_rates(struct ieee80211_supported_band *sband)
+u32 ieee80211_mandatory_rates(struct ieee80211_supported_band *sband,
+                              enum nl80211_bss_scan_width scan_width)
 {
         struct ieee80211_rate *bitrates;
         u32 mandatory_rates = 0;
@@ -43,10 +44,15 @@ u32 ieee80211_mandatory_rates(struct ieee80211_supported_band *sband)
         if (WARN_ON(!sband))
                 return 1;
 
-        if (sband->band == IEEE80211_BAND_2GHZ)
-                mandatory_flag = IEEE80211_RATE_MANDATORY_B;
-        else
+        if (sband->band == IEEE80211_BAND_2GHZ) {
+                if (scan_width == NL80211_BSS_CHAN_WIDTH_5 ||
+                    scan_width == NL80211_BSS_CHAN_WIDTH_10)
+                        mandatory_flag = IEEE80211_RATE_MANDATORY_G;
+                else
+                        mandatory_flag = IEEE80211_RATE_MANDATORY_B;
+        } else {
                 mandatory_flag = IEEE80211_RATE_MANDATORY_A;
+        }
 
         bitrates = sband->bitrates;
         for (i = 0; i < sband->n_bitrates; i++)