37 files changed, 1194 insertions, 522 deletions
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index e75d5c53e97b..ff090ef1ea2c 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -428,11 +428,13 @@ void sta_set_rate_info_tx(struct sta_info *sta,
                rinfo->legacy = DIV_ROUND_UP(brate, 1 << shift);
        }
        if (rate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
-                rinfo->flags |= RATE_INFO_FLAGS_40_MHZ_WIDTH;
+                rinfo->bw = RATE_INFO_BW_40;
-        if (rate->flags & IEEE80211_TX_RC_80_MHZ_WIDTH)
+        else if (rate->flags & IEEE80211_TX_RC_80_MHZ_WIDTH)
-                rinfo->flags |= RATE_INFO_FLAGS_80_MHZ_WIDTH;
+                rinfo->bw = RATE_INFO_BW_80;
-        if (rate->flags & IEEE80211_TX_RC_160_MHZ_WIDTH)
+        else if (rate->flags & IEEE80211_TX_RC_160_MHZ_WIDTH)
-                rinfo->flags |= RATE_INFO_FLAGS_160_MHZ_WIDTH;
+                rinfo->bw = RATE_INFO_BW_160;
+        else
+                rinfo->bw = RATE_INFO_BW_20;
        if (rate->flags & IEEE80211_TX_RC_SHORT_GI)
                rinfo->flags |= RATE_INFO_FLAGS_SHORT_GI;
 }
@@ -459,16 +461,21 @@ void sta_set_rate_info_rx(struct sta_info *sta, struct rate_info *rinfo)
                rinfo->legacy = DIV_ROUND_UP(brate, 1 << shift);
        }
-        if (sta->last_rx_rate_flag & RX_FLAG_40MHZ)
-                rinfo->flags |= RATE_INFO_FLAGS_40_MHZ_WIDTH;
        if (sta->last_rx_rate_flag & RX_FLAG_SHORT_GI)
                rinfo->flags |= RATE_INFO_FLAGS_SHORT_GI;
-        if (sta->last_rx_rate_vht_flag & RX_VHT_FLAG_80MHZ)
-                rinfo->flags |= RATE_INFO_FLAGS_80_MHZ_WIDTH;
+        if (sta->last_rx_rate_flag & RX_FLAG_5MHZ)
-        if (sta->last_rx_rate_vht_flag & RX_VHT_FLAG_80P80MHZ)
+                rinfo->bw = RATE_INFO_BW_5;
-                rinfo->flags |= RATE_INFO_FLAGS_80P80_MHZ_WIDTH;
+        else if (sta->last_rx_rate_flag & RX_FLAG_10MHZ)
-        if (sta->last_rx_rate_vht_flag & RX_VHT_FLAG_160MHZ)
+                rinfo->bw = RATE_INFO_BW_10;
-                rinfo->flags |= RATE_INFO_FLAGS_160_MHZ_WIDTH;
+        else if (sta->last_rx_rate_flag & RX_FLAG_40MHZ)
+                rinfo->bw = RATE_INFO_BW_40;
+        else if (sta->last_rx_rate_vht_flag & RX_VHT_FLAG_80MHZ)
+                rinfo->bw = RATE_INFO_BW_80;
+        else if (sta->last_rx_rate_vht_flag & RX_VHT_FLAG_160MHZ)
+                rinfo->bw = RATE_INFO_BW_160;
+        else
+                rinfo->bw = RATE_INFO_BW_20;
 }
 static int ieee80211_dump_station(struct wiphy *wiphy, struct net_device *dev,
@@ -678,7 +685,8 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
                      BSS_CHANGED_BEACON_ENABLED |
                      BSS_CHANGED_BEACON |
                      BSS_CHANGED_SSID |
-                      BSS_CHANGED_P2P_PS;
+                      BSS_CHANGED_P2P_PS |
+                      BSS_CHANGED_TXPOWER;
        int err;
        old = sdata_dereference(sdata->u.ap.beacon, sdata);
@@ -2556,7 +2564,7 @@ static int ieee80211_start_roc_work(struct ieee80211_local *local,
        /* if there's one pending or we're scanning, queue this one */
        if (!list_empty(&local->roc_list) ||
-            local->scanning || local->radar_detect_enabled)
+            local->scanning || ieee80211_is_radar_required(local))
                goto out_check_combine;
        /* if not HW assist, just queue & schedule work */
@@ -3664,7 +3672,7 @@ static int ieee80211_del_tx_ts(struct wiphy *wiphy, struct net_device *dev,
                 * queues.
                 */
                synchronize_net();
-                ieee80211_flush_queues(local, sdata);
+                ieee80211_flush_queues(local, sdata, false);
                /* restore the normal QoS parameters
                 * (unconditionally to avoid races)
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index da1c12c34487..35b11e11e0c4 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -388,7 +388,7 @@ ieee80211_find_chanctx(struct ieee80211_local *local,
        return NULL;
 }
-static bool ieee80211_is_radar_required(struct ieee80211_local *local)
+bool ieee80211_is_radar_required(struct ieee80211_local *local)
 {
        struct ieee80211_sub_if_data *sdata;
@@ -406,6 +406,34 @@ static bool ieee80211_is_radar_required(struct ieee80211_local *local)
        return false;
 }
+static bool
+ieee80211_chanctx_radar_required(struct ieee80211_local *local,
+                                 struct ieee80211_chanctx *ctx)
+{
+        struct ieee80211_chanctx_conf *conf = &ctx->conf;
+        struct ieee80211_sub_if_data *sdata;
+        bool required = false;
+        lockdep_assert_held(&local->chanctx_mtx);
+        lockdep_assert_held(&local->mtx);
+        rcu_read_lock();
+        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+                if (!ieee80211_sdata_running(sdata))
+                        continue;
+                if (rcu_access_pointer(sdata->vif.chanctx_conf) != conf)
+                        continue;
+                if (!sdata->radar_required)
+                        continue;
+                required = true;
+                break;
+        }
+        rcu_read_unlock();
+        return required;
+}
 static struct ieee80211_chanctx *
 ieee80211_alloc_chanctx(struct ieee80211_local *local,
                        const struct cfg80211_chan_def *chandef,
@@ -425,7 +453,7 @@ ieee80211_alloc_chanctx(struct ieee80211_local *local,
        ctx->conf.rx_chains_static = 1;
        ctx->conf.rx_chains_dynamic = 1;
        ctx->mode = mode;
-        ctx->conf.radar_enabled = ieee80211_is_radar_required(local);
+        ctx->conf.radar_enabled = false;
        ieee80211_recalc_chanctx_min_def(local, ctx);
        return ctx;
@@ -567,16 +595,15 @@ static void ieee80211_recalc_radar_chanctx(struct ieee80211_local *local,
        bool radar_enabled;
        lockdep_assert_held(&local->chanctx_mtx);
-        /* for setting local->radar_detect_enabled */
+        /* for ieee80211_is_radar_required */
        lockdep_assert_held(&local->mtx);
-        radar_enabled = ieee80211_is_radar_required(local);
+        radar_enabled = ieee80211_chanctx_radar_required(local, chanctx);
        if (radar_enabled == chanctx->conf.radar_enabled)
                return;
        chanctx->conf.radar_enabled = radar_enabled;
-        local->radar_detect_enabled = chanctx->conf.radar_enabled;
        if (!local->use_chanctx) {
                local->hw.conf.radar_enabled = chanctx->conf.radar_enabled;
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index 54a189f0393e..eeb0bbd69d98 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -303,8 +303,6 @@ static ssize_t hwflags_read(struct file *file, char __user *user_buf,
                sf += scnprintf(buf + sf, mxln - sf, "SUPPORTS_DYNAMIC_PS\n");
        if (local->hw.flags & IEEE80211_HW_MFP_CAPABLE)
                sf += scnprintf(buf + sf, mxln - sf, "MFP_CAPABLE\n");
-        if (local->hw.flags & IEEE80211_HW_SUPPORTS_UAPSD)
-                sf += scnprintf(buf + sf, mxln - sf, "SUPPORTS_UAPSD\n");
        if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
                sf += scnprintf(buf + sf, mxln - sf,
                                "REPORTS_TX_ACK_STATUS\n");
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 2ebc9ead9695..fdeda17b8dd2 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -639,6 +639,21 @@ static inline void drv_sta_rate_tbl_update(struct ieee80211_local *local,
        trace_drv_return_void(local);
 }
+static inline void drv_sta_statistics(struct ieee80211_local *local,
+                                      struct ieee80211_sub_if_data *sdata,
+                                      struct ieee80211_sta *sta,
+                                      struct station_info *sinfo)
+{
+        sdata = get_bss_sdata(sdata);
+        if (!check_sdata_in_driver(sdata))
+                return;
+        trace_drv_sta_statistics(local, sdata, sta);
+        if (local->ops->sta_statistics)
+                local->ops->sta_statistics(&local->hw, &sdata->vif, sta, sinfo);
+        trace_drv_return_void(local);
+}
 static inline int drv_conf_tx(struct ieee80211_local *local,
                              struct ieee80211_sub_if_data *sdata, u16 ac,
                              const struct ieee80211_tx_queue_params *params)
@@ -966,21 +981,6 @@ drv_allow_buffered_frames(struct ieee80211_local *local,
        trace_drv_return_void(local);
 }
-static inline int drv_get_rssi(struct ieee80211_local *local,
-                                struct ieee80211_sub_if_data *sdata,
-                                struct ieee80211_sta *sta,
-                                s8 *rssi_dbm)
-{
-        int ret;
-        might_sleep();
-        ret = local->ops->get_rssi(&local->hw, &sdata->vif, sta, rssi_dbm);
-        trace_drv_get_rssi(local, sta, *rssi_dbm, ret);
-        return ret;
-}
 static inline void drv_mgd_prepare_tx(struct ieee80211_local *local,
                                      struct ieee80211_sub_if_data *sdata)
 {
diff --git a/net/mac80211/ethtool.c b/net/mac80211/ethtool.c
index ebfc8091557b..52bcea6ad9e8 100644
--- a/net/mac80211/ethtool.c
+++ b/net/mac80211/ethtool.c
@@ -117,16 +117,16 @@ static void ieee80211_get_stats(struct net_device *dev,
                data[i++] = sta->sta_state;
-                if (sinfo.filled & STATION_INFO_TX_BITRATE)
+                if (sinfo.filled & BIT(NL80211_STA_INFO_TX_BITRATE))
                        data[i] = 100000 *
                                cfg80211_calculate_bitrate(&sinfo.txrate);
                i++;
-                if (sinfo.filled & STATION_INFO_RX_BITRATE)
+                if (sinfo.filled & BIT(NL80211_STA_INFO_RX_BITRATE))
                        data[i] = 100000 *
                                cfg80211_calculate_bitrate(&sinfo.rxrate);
                i++;
-                if (sinfo.filled & STATION_INFO_SIGNAL_AVG)
+                if (sinfo.filled & BIT(NL80211_STA_INFO_SIGNAL_AVG))
                        data[i] = (u8)sinfo.signal_avg;
                i++;
        } else {
@@ -175,24 +175,24 @@ do_survey:
                data[i++] = (u8)survey.noise;
        else
                data[i++] = -1LL;
-        if (survey.filled & SURVEY_INFO_CHANNEL_TIME)
+        if (survey.filled & SURVEY_INFO_TIME)
-                data[i++] = survey.channel_time;
+                data[i++] = survey.time;
        else
                data[i++] = -1LL;
-        if (survey.filled & SURVEY_INFO_CHANNEL_TIME_BUSY)
+        if (survey.filled & SURVEY_INFO_TIME_BUSY)
-                data[i++] = survey.channel_time_busy;
+                data[i++] = survey.time_busy;
        else
                data[i++] = -1LL;
-        if (survey.filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY)
+        if (survey.filled & SURVEY_INFO_TIME_EXT_BUSY)
-                data[i++] = survey.channel_time_ext_busy;
+                data[i++] = survey.time_ext_busy;
        else
                data[i++] = -1LL;
-        if (survey.filled & SURVEY_INFO_CHANNEL_TIME_RX)
+        if (survey.filled & SURVEY_INFO_TIME_RX)
-                data[i++] = survey.channel_time_rx;
+                data[i++] = survey.time_rx;
        else
                data[i++] = -1LL;
-        if (survey.filled & SURVEY_INFO_CHANNEL_TIME_TX)
+        if (survey.filled & SURVEY_INFO_TIME_TX)
-                data[i++] = survey.channel_time_tx;
+                data[i++] = survey.time_tx;
        else
                data[i++] = -1LL;
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 509bc157ce55..b606b53a49a7 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -1069,9 +1069,16 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                }
                if (sta && rates_updated) {
-                        drv_sta_rc_update(local, sdata, &sta->sta,
+                        u32 changed = IEEE80211_RC_SUPP_RATES_CHANGED;
-                                          IEEE80211_RC_SUPP_RATES_CHANGED);
+                        u8 rx_nss = sta->sta.rx_nss;
+                        /* Force rx_nss recalculation */
+                        sta->sta.rx_nss = 0;
                        rate_control_rate_init(sta);
+                        if (sta->sta.rx_nss != rx_nss)
+                                changed |= IEEE80211_RC_NSS_CHANGED;
+                        drv_sta_rc_update(local, sdata, &sta->sta, changed);
                }
                rcu_read_unlock();
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index cc6e964d9837..156ea79e0157 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1168,8 +1168,6 @@ struct ieee80211_local {
        /* wowlan is enabled -- don't reconfig on resume */
        bool wowlan;
-        /* DFS/radar detection is enabled */
-        bool radar_detect_enabled;
        struct work_struct radar_detected_work;
        /* number of RX chains the hardware has */
@@ -1704,6 +1702,7 @@ ieee80211_vht_cap_ie_to_sta_vht_cap(struct ieee80211_sub_if_data *sdata,
                                    struct ieee80211_supported_band *sband,
                                    const struct ieee80211_vht_cap *vht_cap_ie,
                                    struct sta_info *sta);
+enum ieee80211_sta_rx_bandwidth ieee80211_sta_cap_rx_bw(struct sta_info *sta);
 enum ieee80211_sta_rx_bandwidth ieee80211_sta_cur_vht_bw(struct sta_info *sta);
 void ieee80211_sta_set_rx_nss(struct sta_info *sta);
 u32 __ieee80211_vht_handle_opmode(struct ieee80211_sub_if_data *sdata,
@@ -1881,10 +1880,10 @@ void ieee80211_add_pending_skb(struct ieee80211_local *local,
 void ieee80211_add_pending_skbs(struct ieee80211_local *local,
                                struct sk_buff_head *skbs);
 void ieee80211_flush_queues(struct ieee80211_local *local,
-                            struct ieee80211_sub_if_data *sdata);
+                            struct ieee80211_sub_if_data *sdata, bool drop);
 void __ieee80211_flush_queues(struct ieee80211_local *local,
                              struct ieee80211_sub_if_data *sdata,
-                              unsigned int queues);
+                              unsigned int queues, bool drop);
 void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
                         u16 transaction, u16 auth_alg, u16 status,
@@ -1981,6 +1980,7 @@ void ieee80211_recalc_smps_chanctx(struct ieee80211_local *local,
                                   struct ieee80211_chanctx *chanctx);
 void ieee80211_recalc_chanctx_min_def(struct ieee80211_local *local,
                                      struct ieee80211_chanctx *ctx);
+bool ieee80211_is_radar_required(struct ieee80211_local *local);
 void ieee80211_dfs_cac_timer(unsigned long data);
 void ieee80211_dfs_cac_timer_work(struct work_struct *work);
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 417355390873..677422e11e07 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -93,7 +93,7 @@ static u32 __ieee80211_idle_on(struct ieee80211_local *local)
        if (local->hw.conf.flags & IEEE80211_CONF_IDLE)
                return 0;
-        ieee80211_flush_queues(local, NULL);
+        ieee80211_flush_queues(local, NULL, false);
        local->hw.conf.flags |= IEEE80211_CONF_IDLE;
        return IEEE80211_CONF_CHANGE_IDLE;
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 0bb7038121ac..f8d9f0ee59bf 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -140,7 +140,8 @@ static int ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
        if (!ret) {
                key->flags |= KEY_FLAG_UPLOADED_TO_HARDWARE;
-                if (!(key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC))
+                if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) ||
+                      (key->conf.flags & IEEE80211_KEY_FLAG_RESERVE_TAILROOM)))
                        sdata->crypto_tx_tailroom_needed_cnt--;
                WARN_ON((key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) &&
@@ -188,7 +189,8 @@ static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
        sta = key->sta;
        sdata = key->sdata;
-        if (!(key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC))
+        if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) ||
+              (key->conf.flags & IEEE80211_KEY_FLAG_RESERVE_TAILROOM)))
                increment_tailroom_need_count(sdata);
        ret = drv_set_key(key->local, DISABLE_KEY, sdata,
@@ -884,7 +886,8 @@ void ieee80211_remove_key(struct ieee80211_key_conf *keyconf)
        if (key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) {
                key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
-                if (!(key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC))
+                if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) ||
+                      (key->conf.flags & IEEE80211_KEY_FLAG_RESERVE_TAILROOM)))
                        increment_tailroom_need_count(key->sdata);
        }
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 6ab99da38db9..d9ce33663c73 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -916,10 +916,6 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                }
        }
-        WARN((local->hw.flags & IEEE80211_HW_SUPPORTS_UAPSD)
-             && (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK),
-             "U-APSD not supported with HW_PS_NULLFUNC_STACK\n");
        /*
         * Calculate scan IE length -- we need this to alloc
         * memory and to subtract from the driver limit. It
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index b488e1859b18..fa94ca15ba95 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -523,6 +523,13 @@ void mesh_neighbour_update(struct ieee80211_sub_if_data *sdata,
            sdata->u.mesh.mshcfg.auto_open_plinks &&
            rssi_threshold_check(sdata, sta))
                changed = mesh_plink_open(sta);
+        else if (sta->plink_state == NL80211_PLINK_LISTEN &&
+                 (sdata->u.mesh.user_mpm ||
+                  sdata->u.mesh.security & IEEE80211_MESH_SEC_AUTHED))
+                cfg80211_notify_new_peer_candidate(sdata->dev, hw_addr,
+                                                   elems->ie_start,
+                                                   elems->total_len,
+                                                   GFP_ATOMIC);
        ieee80211_mps_frame_release(sta, elems);
 out:
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 2c36c4765f47..1875181ebd94 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -157,14 +157,18 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
 {
        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
        struct cfg80211_chan_def vht_chandef;
+        struct ieee80211_sta_ht_cap sta_ht_cap;
        u32 ht_cfreq, ret;
+        memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));
+        ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);
        chandef->chan = channel;
        chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
        chandef->center_freq1 = channel->center_freq;
        chandef->center_freq2 = 0;
-        if (!ht_cap || !ht_oper || !sband->ht_cap.ht_supported) {
+        if (!ht_cap || !ht_oper || !sta_ht_cap.ht_supported) {
                ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
                goto out;
        }
@@ -198,7 +202,7 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
        }
        /* check 40 MHz support, if we have it */
-        if (sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
+        if (sta_ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) {
                switch (ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
                case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
                        chandef->width = NL80211_CHAN_WIDTH_40;
@@ -1054,8 +1058,6 @@ static void ieee80211_chswitch_post_beacon(struct ieee80211_sub_if_data *sdata)
                sdata->csa_block_tx = false;
        }
-        cfg80211_ch_switch_notify(sdata->dev, &sdata->reserved_chandef);
        sdata->vif.csa_active = false;
        ifmgd->csa_waiting_bcn = false;
@@ -1067,6 +1069,8 @@ static void ieee80211_chswitch_post_beacon(struct ieee80211_sub_if_data *sdata)
                                     &ifmgd->csa_connection_drop_work);
                return;
        }
+        cfg80211_ch_switch_notify(sdata->dev, &sdata->reserved_chandef);
 }
 void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success)
@@ -1284,8 +1288,11 @@ ieee80211_find_80211h_pwr_constr(struct ieee80211_sub_if_data *sdata,
                country_ie_len -= 3;
        }
-        if (have_chan_pwr)
+        if (have_chan_pwr && pwr_constr_elem)
                *pwr_reduction = *pwr_constr_elem;
+        else
+                *pwr_reduction = 0;
        return have_chan_pwr;
 }
@@ -1314,10 +1321,11 @@ static u32 ieee80211_handle_pwr_constr(struct ieee80211_sub_if_data *sdata,
        int chan_pwr = 0, pwr_reduction_80211h = 0;
        int pwr_level_cisco, pwr_level_80211h;
        int new_ap_level;
+        __le16 capab = mgmt->u.probe_resp.capab_info;
-        if (country_ie && pwr_constr_ie &&
+        if (country_ie &&
-            mgmt->u.probe_resp.capab_info &
+            (capab & cpu_to_le16(WLAN_CAPABILITY_SPECTRUM_MGMT) ||
-                cpu_to_le16(WLAN_CAPABILITY_SPECTRUM_MGMT)) {
+             capab & cpu_to_le16(WLAN_CAPABILITY_RADIO_MEASURE))) {
                has_80211h_pwr = ieee80211_find_80211h_pwr_constr(
                        sdata, channel, country_ie, country_ie_len,
                        pwr_constr_ie, &chan_pwr, &pwr_reduction_80211h);
@@ -1596,7 +1604,7 @@ void ieee80211_dynamic_ps_enable_work(struct work_struct *work)
                } else {
                        ieee80211_send_nullfunc(local, sdata, 1);
                        /* Flush to get the tx status of nullfunc frame */
-                        ieee80211_flush_queues(local, sdata);
+                        ieee80211_flush_queues(local, sdata, false);
                }
        }
@@ -2003,18 +2011,23 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
        /* disable per-vif ps */
        ieee80211_recalc_ps_vif(sdata);
-        /* flush out any pending frame (e.g. DELBA) before deauth/disassoc */
+        /*
+         * drop any frame before deauth/disassoc, this can be data or
+         * management frame. Since we are disconnecting, we should not
+         * insist sending these frames which can take time and delay
+         * the disconnection and possible the roaming.
+         */
        if (tx)
-                ieee80211_flush_queues(local, sdata);
+                ieee80211_flush_queues(local, sdata, true);
        /* deauthenticate/disassociate now */
        if (tx || frame_buf)
                ieee80211_send_deauth_disassoc(sdata, ifmgd->bssid, stype,
                                               reason, tx, frame_buf);
-        /* flush out frame */
+        /* flush out frame - make sure the deauth was actually sent */
        if (tx)
-                ieee80211_flush_queues(local, sdata);
+                ieee80211_flush_queues(local, sdata, false);
        /* clear bssid only after building the needed mgmt frames */
        memset(ifmgd->bssid, 0, ETH_ALEN);
@@ -2440,6 +2453,12 @@ static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata,
        sdata_assert_lock(sdata);
        if (!assoc) {
+                /*
+                 * we are not authenticated yet, the only timer that could be
+                 * running is the timeout for the authentication response which
+                 * which is not relevant anymore.
+                 */
+                del_timer_sync(&sdata->u.mgd.timer);
                sta_info_destroy_addr(sdata, auth_data->bss->bssid);
                memset(sdata->u.mgd.bssid, 0, ETH_ALEN);
@@ -2747,6 +2766,12 @@ static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,
        sdata_assert_lock(sdata);
        if (!assoc) {
+                /*
+                 * we are not associated yet, the only timer that could be
+                 * running is the timeout for the association response which
+                 * which is not relevant anymore.
+                 */
+                del_timer_sync(&sdata->u.mgd.timer);
                sta_info_destroy_addr(sdata, assoc_data->bss->bssid);
                memset(sdata->u.mgd.bssid, 0, ETH_ALEN);
@@ -4197,9 +4222,13 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
        struct ieee80211_bss *bss = (void *)cbss->priv;
        struct sta_info *new_sta = NULL;
-        bool have_sta = false;
+        struct ieee80211_supported_band *sband;
+        struct ieee80211_sta_ht_cap sta_ht_cap;
+        bool have_sta = false, is_override = false;
        int err;
+        sband = local->hw.wiphy->bands[cbss->channel->band];
        if (WARN_ON(!ifmgd->auth_data && !ifmgd->assoc_data))
                return -EINVAL;
@@ -4214,25 +4243,32 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
                if (!new_sta)
                        return -ENOMEM;
        }
+        memcpy(&sta_ht_cap, &sband->ht_cap, sizeof(sta_ht_cap));
+        ieee80211_apply_htcap_overrides(sdata, &sta_ht_cap);
+        is_override = (sta_ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) !=
+                      (sband->ht_cap.cap &
+                       IEEE80211_HT_CAP_SUP_WIDTH_20_40);
+        if (new_sta || is_override) {
+                err = ieee80211_prep_channel(sdata, cbss);
+                if (err) {
+                        if (new_sta)
+                                sta_info_free(local, new_sta);
+                        return -EINVAL;
+                }
+        }
        if (new_sta) {
                u32 rates = 0, basic_rates = 0;
                bool have_higher_than_11mbit;
                int min_rate = INT_MAX, min_rate_index = -1;
                struct ieee80211_chanctx_conf *chanctx_conf;
-                struct ieee80211_supported_band *sband;
                const struct cfg80211_bss_ies *ies;
-                int shift;
+                int shift = ieee80211_vif_get_shift(&sdata->vif);
                u32 rate_flags;
-                sband = local->hw.wiphy->bands[cbss->channel->band];
-                err = ieee80211_prep_channel(sdata, cbss);
-                if (err) {
-                        sta_info_free(local, new_sta);
-                        return -EINVAL;
-                }
-                shift = ieee80211_vif_get_shift(&sdata->vif);
                rcu_read_lock();
                chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
                if (WARN_ON(!chanctx_conf)) {
@@ -4668,8 +4704,13 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
                ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
        rcu_read_unlock();
+        if (WARN((sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_UAPSD) &&
+                 (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK),
+             "U-APSD not supported with HW_PS_NULLFUNC_STACK\n"))
+                sdata->vif.driver_flags &= ~IEEE80211_VIF_SUPPORTS_UAPSD;
        if (bss->wmm_used && bss->uapsd_supported &&
-            (sdata->local->hw.flags & IEEE80211_HW_SUPPORTS_UAPSD)) {
+            (sdata->vif.driver_flags & IEEE80211_VIF_SUPPORTS_UAPSD)) {
                assoc_data->uapsd = true;
                ifmgd->flags |= IEEE80211_STA_UAPSD_ENABLED;
        } else {
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index ff20b2ebdb30..683f0e3cb124 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -121,7 +121,7 @@ void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local)
        ieee80211_stop_queues_by_reason(&local->hw, IEEE80211_MAX_QUEUE_MAP,
                                        IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL,
                                        false);
-        ieee80211_flush_queues(local, NULL);
+        ieee80211_flush_queues(local, NULL, false);
        mutex_lock(&local->iflist_mtx);
        list_for_each_entry(sdata, &local->interfaces, list) {
@@ -398,7 +398,7 @@ void ieee80211_sw_roc_work(struct work_struct *work)
                ieee80211_roc_notify_destroy(roc, !roc->abort);
                if (started && !on_channel) {
-                        ieee80211_flush_queues(local, NULL);
+                        ieee80211_flush_queues(local, NULL, false);
                        local->tmp_channel = NULL;
                        ieee80211_hw_config(local, 0);
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index 4c5192e0d66c..8c8c67819072 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -41,7 +41,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
        /* flush out all packets */
        synchronize_net();
-        ieee80211_flush_queues(local, NULL);
+        ieee80211_flush_queues(local, NULL, true);
        local->quiescing = true;
        /* make quiescing visible to timers everywhere */
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index d51f6b1c549b..7c86a002df95 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -263,12 +263,12 @@ static inline unsigned int
 minstrel_get_retry_count(struct minstrel_rate *mr,
                         struct ieee80211_tx_info *info)
 {
-        unsigned int retry = mr->adjusted_retry_count;
+        u8 retry = mr->adjusted_retry_count;
        if (info->control.use_rts)
-                retry = max(2U, min(mr->stats.retry_count_rtscts, retry));
+                retry = max_t(u8, 2, min(mr->stats.retry_count_rtscts, retry));
        else if (info->control.use_cts_prot)
-                retry = max(2U, min(mr->retry_count_cts, retry));
+                retry = max_t(u8, 2, min(mr->retry_count_cts, retry));
        return retry;
 }
diff --git a/net/mac80211/rc80211_minstrel.h b/net/mac80211/rc80211_minstrel.h
index 97eca86a4af0..410efe620c57 100644
--- a/net/mac80211/rc80211_minstrel.h
+++ b/net/mac80211/rc80211_minstrel.h
@@ -33,8 +33,8 @@ minstrel_ewma(int old, int new, int weight)
 struct minstrel_rate_stats {
        /* current / last sampling period attempts/success counters */
-        unsigned int attempts, last_attempts;
+        u16 attempts, last_attempts;
-        unsigned int success, last_success;
+        u16 success, last_success;
        /* total attempts/success counters */
        u64 att_hist, succ_hist;
@@ -46,8 +46,8 @@ struct minstrel_rate_stats {
        unsigned int cur_prob, probability;
        /* maximum retry counts */
-        unsigned int retry_count;
+        u8 retry_count;
-        unsigned int retry_count_rtscts;
+        u8 retry_count_rtscts;
        u8 sample_skipped;
        bool retry_updated;
@@ -55,14 +55,15 @@ struct minstrel_rate_stats {
 struct minstrel_rate {
        int bitrate;
-        int rix;
+        s8 rix;
+        u8 retry_count_cts;
+        u8 adjusted_retry_count;
        unsigned int perfect_tx_time;
        unsigned int ack_time;
        int sample_limit;
-        unsigned int retry_count_cts;
-        unsigned int adjusted_retry_count;
        struct minstrel_rate_stats stats;
 };
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 683b10f46505..3d79d498e7f6 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -361,9 +361,6 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
                u16 known = local->hw.radiotap_vht_details;
                rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_VHT);
-                /* known field - how to handle 80+80? */
-                if (status->vht_flag & RX_VHT_FLAG_80P80MHZ)
-                        known &= ~IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH;
                put_unaligned_le16(known, pos);
                pos += 2;
                /* flags */
@@ -378,8 +375,6 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
                /* bandwidth */
                if (status->vht_flag & RX_VHT_FLAG_80MHZ)
                        *pos++ = 4;
-                else if (status->vht_flag & RX_VHT_FLAG_80P80MHZ)
-                        *pos++ = 0; /* marked not known above */
                else if (status->vht_flag & RX_VHT_FLAG_160MHZ)
                        *pos++ = 11;
                else if (status->flag & RX_FLAG_40MHZ)
@@ -2314,6 +2309,15 @@ ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
        if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
                return RX_DROP_MONITOR;
+        if (rx->sta) {
+                /* The security index has the same property as needed
+                 * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS
+                 * for non-QoS-data frames. Here we know it's a data
+                 * frame, so count MSDUs.
+                 */
+                rx->sta->rx_msdu[rx->security_idx]++;
+        }
        /*
         * Send unexpected-4addr-frame event to hostapd. For older versions,
         * also drop the frame to cooked monitor interfaces.
@@ -2598,7 +2602,7 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: {
                        struct ieee80211_supported_band *sband;
                        u8 chanwidth = mgmt->u.action.u.ht_notify_cw.chanwidth;
-                        enum ieee80211_sta_rx_bandwidth new_bw;
+                        enum ieee80211_sta_rx_bandwidth max_bw, new_bw;
                        /* If it doesn't support 40 MHz it can't change ... */
                        if (!(rx->sta->sta.ht_cap.cap &
@@ -2606,13 +2610,18 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                                goto handled;
                        if (chanwidth == IEEE80211_HT_CHANWIDTH_20MHZ)
-                                new_bw = IEEE80211_STA_RX_BW_20;
+                                max_bw = IEEE80211_STA_RX_BW_20;
                        else
-                                new_bw = ieee80211_sta_cur_vht_bw(rx->sta);
+                                max_bw = ieee80211_sta_cap_rx_bw(rx->sta);
+                        /* set cur_max_bandwidth and recalc sta bw */
+                        rx->sta->cur_max_bandwidth = max_bw;
+                        new_bw = ieee80211_sta_cur_vht_bw(rx->sta);
                        if (rx->sta->sta.bandwidth == new_bw)
                                goto handled;
+                        rx->sta->sta.bandwidth = new_bw;
                        sband = rx->local->hw.wiphy->bands[status->band];
                        rate_control_rate_update(local, sband, rx->sta,
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index ae842678b629..7807fa42ed3f 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -416,7 +416,7 @@ static int ieee80211_start_sw_scan(struct ieee80211_local *local,
        ieee80211_offchannel_stop_vifs(local);
        /* ensure nullfunc is transmitted before leaving operating channel */
-        ieee80211_flush_queues(local, NULL);
+        ieee80211_flush_queues(local, NULL, false);
        ieee80211_configure_filter(local);
@@ -432,7 +432,7 @@ static int ieee80211_start_sw_scan(struct ieee80211_local *local,
 static bool ieee80211_can_scan(struct ieee80211_local *local,
                               struct ieee80211_sub_if_data *sdata)
 {
-        if (local->radar_detect_enabled)
+        if (ieee80211_is_radar_required(local))
                return false;
        if (!list_empty(&local->roc_list))
@@ -505,7 +505,7 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
        lockdep_assert_held(&local->mtx);
-        if (local->scan_req)
+        if (local->scan_req || ieee80211_is_radar_required(local))
                return -EBUSY;
        if (!ieee80211_can_scan(local, sdata)) {
@@ -805,7 +805,7 @@ static void ieee80211_scan_state_resume(struct ieee80211_local *local,
        ieee80211_offchannel_stop_vifs(local);
        if (local->ops->flush) {
-                ieee80211_flush_queues(local, NULL);
+                ieee80211_flush_queues(local, NULL, false);
                *next_delay = 0;
        } else
                *next_delay = HZ / 10;
diff --git a/net/mac80211/spectmgmt.c b/net/mac80211/spectmgmt.c
index efeba56c913b..06e6ac8cc693 100644
--- a/net/mac80211/spectmgmt.c
+++ b/net/mac80211/spectmgmt.c
@@ -34,19 +34,15 @@ int ieee80211_parse_ch_switch_ie(struct ieee80211_sub_if_data *sdata,
        struct cfg80211_chan_def new_vht_chandef = {};
        const struct ieee80211_sec_chan_offs_ie *sec_chan_offs;
        const struct ieee80211_wide_bw_chansw_ie *wide_bw_chansw_ie;
-        const struct ieee80211_ht_operation *ht_oper;
        int secondary_channel_offset = -1;
        sec_chan_offs = elems->sec_chan_offs;
        wide_bw_chansw_ie = elems->wide_bw_chansw_ie;
-        ht_oper = elems->ht_operation;
        if (sta_flags & (IEEE80211_STA_DISABLE_HT |
                         IEEE80211_STA_DISABLE_40MHZ)) {
                sec_chan_offs = NULL;
                wide_bw_chansw_ie = NULL;
-                /* only used for bandwidth here */
-                ht_oper = NULL;
        }
        if (sta_flags & IEEE80211_STA_DISABLE_VHT)
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index a42f5b2b024d..79383ef0c264 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -116,7 +116,6 @@ static void __cleanup_single_sta(struct sta_info *sta)
                clear_sta_flag(sta, WLAN_STA_PS_DELIVER);
                atomic_dec(&ps->num_sta_ps);
-                sta_info_recalc_tim(sta);
        }
        for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
@@ -625,7 +624,7 @@ static unsigned long ieee80211_tids_for_ac(int ac)
        }
 }
-void sta_info_recalc_tim(struct sta_info *sta)
+static void __sta_info_recalc_tim(struct sta_info *sta, bool ignore_pending)
 {
        struct ieee80211_local *local = sta->local;
        struct ps_data *ps;
@@ -667,6 +666,9 @@ void sta_info_recalc_tim(struct sta_info *sta)
        if (ignore_for_tim == BIT(IEEE80211_NUM_ACS) - 1)
                ignore_for_tim = 0;
+        if (ignore_pending)
+                ignore_for_tim = BIT(IEEE80211_NUM_ACS) - 1;
        for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
                unsigned long tids;
@@ -695,7 +697,7 @@ void sta_info_recalc_tim(struct sta_info *sta)
        else
                __bss_tim_clear(ps->tim, id);
-        if (local->ops->set_tim) {
+        if (local->ops->set_tim && !WARN_ON(sta->dead)) {
                local->tim_in_locked_section = true;
                drv_set_tim(local, &sta->sta, indicate_tim);
                local->tim_in_locked_section = false;
@@ -705,6 +707,11 @@ out_unlock:
        spin_unlock_bh(&local->tim_lock);
 }
+void sta_info_recalc_tim(struct sta_info *sta)
+{
+        __sta_info_recalc_tim(sta, false);
+}
 static bool sta_info_buffer_expired(struct sta_info *sta, struct sk_buff *skb)
 {
        struct ieee80211_tx_info *info;
@@ -874,6 +881,7 @@ static void __sta_info_destroy_part2(struct sta_info *sta)
 {
        struct ieee80211_local *local = sta->local;
        struct ieee80211_sub_if_data *sdata = sta->sdata;
+        struct station_info sinfo = {};
        int ret;
        /*
@@ -887,6 +895,9 @@ static void __sta_info_destroy_part2(struct sta_info *sta)
        /* now keys can no longer be reached */
        ieee80211_free_sta_keys(local, sta);
+        /* disable TIM bit - last chance to tell driver */
+        __sta_info_recalc_tim(sta, true);
        sta->dead = true;
        local->num_sta--;
@@ -908,7 +919,8 @@ static void __sta_info_destroy_part2(struct sta_info *sta)
        sta_dbg(sdata, "Removed STA %pM\n", sta->sta.addr);
-        cfg80211_del_sta(sdata->dev, sta->sta.addr, GFP_KERNEL);
+        sta_set_sinfo(sta, &sinfo);
+        cfg80211_del_sta_sinfo(sdata->dev, sta->sta.addr, &sinfo, GFP_KERNEL);
        rate_control_remove_sta_debugfs(sta);
        ieee80211_sta_debugfs_remove(sta);
@@ -1243,10 +1255,11 @@ static void ieee80211_send_null_response(struct ieee80211_sub_if_data *sdata,
         * ends the poll/service period.
         */
        info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER |
-                       IEEE80211_TX_CTL_PS_RESPONSE |
                       IEEE80211_TX_STATUS_EOSP |
                       IEEE80211_TX_CTL_REQ_TX_STATUS;
+        info->control.flags |= IEEE80211_TX_CTRL_PS_RESPONSE;
        if (call_driver)
                drv_allow_buffered_frames(local, sta, BIT(tid), 1,
                                          reason, false);
@@ -1395,8 +1408,8 @@ ieee80211_sta_ps_deliver_response(struct sta_info *sta,
                         * STA may still remain is PS mode after this frame
                         * exchange.
                         */
-                        info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER |
+                        info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER;
-                                       IEEE80211_TX_CTL_PS_RESPONSE;
+                        info->control.flags |= IEEE80211_TX_CTRL_PS_RESPONSE;
                        /*
                         * Use MoreData flag to indicate whether there are
@@ -1743,7 +1756,6 @@ void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
        struct ieee80211_local *local = sdata->local;
        struct rate_control_ref *ref = NULL;
        struct timespec uptime;
-        u64 packets = 0;
        u32 thr = 0;
        int i, ac;
@@ -1752,49 +1764,76 @@ void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
        sinfo->generation = sdata->local->sta_generation;
-        sinfo->filled = STATION_INFO_INACTIVE_TIME |
+        drv_sta_statistics(local, sdata, &sta->sta, sinfo);
-                        STATION_INFO_RX_BYTES64 |
-                        STATION_INFO_TX_BYTES64 |
+        sinfo->filled |= BIT(NL80211_STA_INFO_INACTIVE_TIME) |
-                        STATION_INFO_RX_PACKETS |
+                         BIT(NL80211_STA_INFO_STA_FLAGS) |
-                        STATION_INFO_TX_PACKETS |
+                         BIT(NL80211_STA_INFO_BSS_PARAM) |
-                        STATION_INFO_TX_RETRIES |
+                         BIT(NL80211_STA_INFO_CONNECTED_TIME) |
-                        STATION_INFO_TX_FAILED |
+                         BIT(NL80211_STA_INFO_RX_DROP_MISC) |
-                        STATION_INFO_TX_BITRATE |
+                         BIT(NL80211_STA_INFO_BEACON_LOSS);
-                        STATION_INFO_RX_BITRATE |
-                        STATION_INFO_RX_DROP_MISC |
-                        STATION_INFO_BSS_PARAM |
-                        STATION_INFO_CONNECTED_TIME |
-                        STATION_INFO_STA_FLAGS |
-                        STATION_INFO_BEACON_LOSS_COUNT;
        ktime_get_ts(&uptime);
        sinfo->connected_time = uptime.tv_sec - sta->last_connected;
        sinfo->inactive_time = jiffies_to_msecs(jiffies - sta->last_rx);
-        sinfo->tx_bytes = 0;
-        for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+        if (!(sinfo->filled & (BIT(NL80211_STA_INFO_TX_BYTES64) |
-                sinfo->tx_bytes += sta->tx_bytes[ac];
+                               BIT(NL80211_STA_INFO_TX_BYTES)))) {
-                packets += sta->tx_packets[ac];
+                sinfo->tx_bytes = 0;
+                for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
+                        sinfo->tx_bytes += sta->tx_bytes[ac];
+                sinfo->filled |= BIT(NL80211_STA_INFO_TX_BYTES64);
+        }
+        if (!(sinfo->filled & BIT(NL80211_STA_INFO_TX_PACKETS))) {
+                sinfo->tx_packets = 0;
+                for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
+                        sinfo->tx_packets += sta->tx_packets[ac];
+                sinfo->filled |= BIT(NL80211_STA_INFO_TX_PACKETS);
+        }
+        if (!(sinfo->filled & (BIT(NL80211_STA_INFO_RX_BYTES64) |
+                               BIT(NL80211_STA_INFO_RX_BYTES)))) {
+                sinfo->rx_bytes = sta->rx_bytes;
+                sinfo->filled |= BIT(NL80211_STA_INFO_RX_BYTES64);
+        }
+        if (!(sinfo->filled & BIT(NL80211_STA_INFO_RX_PACKETS))) {
+                sinfo->rx_packets = sta->rx_packets;
+                sinfo->filled |= BIT(NL80211_STA_INFO_RX_PACKETS);
+        }
+        if (!(sinfo->filled & BIT(NL80211_STA_INFO_TX_RETRIES))) {
+                sinfo->tx_retries = sta->tx_retry_count;
+                sinfo->filled |= BIT(NL80211_STA_INFO_TX_RETRIES);
        }
-        sinfo->tx_packets = packets;
-        sinfo->rx_bytes = sta->rx_bytes;
+        if (!(sinfo->filled & BIT(NL80211_STA_INFO_TX_FAILED))) {
-        sinfo->rx_packets = sta->rx_packets;
+                sinfo->tx_failed = sta->tx_retry_failed;
-        sinfo->tx_retries = sta->tx_retry_count;
+                sinfo->filled |= BIT(NL80211_STA_INFO_TX_FAILED);
-        sinfo->tx_failed = sta->tx_retry_failed;
+        }
        sinfo->rx_dropped_misc = sta->rx_dropped;
        sinfo->beacon_loss_count = sta->beacon_loss_count;
        if ((sta->local->hw.flags & IEEE80211_HW_SIGNAL_DBM) ||
            (sta->local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC)) {
-                sinfo->filled |= STATION_INFO_SIGNAL | STATION_INFO_SIGNAL_AVG;
+                if (!(sinfo->filled & BIT(NL80211_STA_INFO_SIGNAL))) {
-                if (!local->ops->get_rssi ||
-                    drv_get_rssi(local, sdata, &sta->sta, &sinfo->signal))
                        sinfo->signal = (s8)sta->last_signal;
-                sinfo->signal_avg = (s8) -ewma_read(&sta->avg_signal);
+                        sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
+                }
+                if (!(sinfo->filled & BIT(NL80211_STA_INFO_SIGNAL_AVG))) {
+                        sinfo->signal_avg = (s8) -ewma_read(&sta->avg_signal);
+                        sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL_AVG);
+                }
        }
-        if (sta->chains) {
-                sinfo->filled |= STATION_INFO_CHAIN_SIGNAL |
+        if (sta->chains &&
-                                 STATION_INFO_CHAIN_SIGNAL_AVG;
+            !(sinfo->filled & (BIT(NL80211_STA_INFO_CHAIN_SIGNAL) |
+                               BIT(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)))) {
+                sinfo->filled |= BIT(NL80211_STA_INFO_CHAIN_SIGNAL) |
+                                 BIT(NL80211_STA_INFO_CHAIN_SIGNAL_AVG);
                sinfo->chains = sta->chains;
                for (i = 0; i < ARRAY_SIZE(sinfo->chain_signal); i++) {
@@ -1804,23 +1843,61 @@ void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
                }
        }
-        sta_set_rate_info_tx(sta, &sta->last_tx_rate, &sinfo->txrate);
+        if (!(sinfo->filled & BIT(NL80211_STA_INFO_TX_BITRATE))) {
-        sta_set_rate_info_rx(sta, &sinfo->rxrate);
+                sta_set_rate_info_tx(sta, &sta->last_tx_rate, &sinfo->txrate);
+                sinfo->filled |= BIT(NL80211_STA_INFO_TX_BITRATE);
+        }
+        if (!(sinfo->filled & BIT(NL80211_STA_INFO_RX_BITRATE))) {
+                sta_set_rate_info_rx(sta, &sinfo->rxrate);
+                sinfo->filled |= BIT(NL80211_STA_INFO_RX_BITRATE);
+        }
+        sinfo->filled |= BIT(NL80211_STA_INFO_TID_STATS);
+        for (i = 0; i < IEEE80211_NUM_TIDS + 1; i++) {
+                struct cfg80211_tid_stats *tidstats = &sinfo->pertid[i];
+                if (!(tidstats->filled & BIT(NL80211_TID_STATS_RX_MSDU))) {
+                        tidstats->filled |= BIT(NL80211_TID_STATS_RX_MSDU);
+                        tidstats->rx_msdu = sta->rx_msdu[i];
+                }
+                if (!(tidstats->filled & BIT(NL80211_TID_STATS_TX_MSDU))) {
+                        tidstats->filled |= BIT(NL80211_TID_STATS_TX_MSDU);
+                        tidstats->tx_msdu = sta->tx_msdu[i];
+                }
+                if (!(tidstats->filled &
+                                BIT(NL80211_TID_STATS_TX_MSDU_RETRIES)) &&
+                    local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) {
+                        tidstats->filled |=
+                                BIT(NL80211_TID_STATS_TX_MSDU_RETRIES);
+                        tidstats->tx_msdu_retries = sta->tx_msdu_retries[i];
+                }
+                if (!(tidstats->filled &
+                                BIT(NL80211_TID_STATS_TX_MSDU_FAILED)) &&
+                    local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) {
+                        tidstats->filled |=
+                                BIT(NL80211_TID_STATS_TX_MSDU_FAILED);
+                        tidstats->tx_msdu_failed = sta->tx_msdu_failed[i];
+                }
+        }
        if (ieee80211_vif_is_mesh(&sdata->vif)) {
 #ifdef CONFIG_MAC80211_MESH
-                sinfo->filled |= STATION_INFO_LLID |
+                sinfo->filled |= BIT(NL80211_STA_INFO_LLID) |
-                                 STATION_INFO_PLID |
+                                 BIT(NL80211_STA_INFO_PLID) |
-                                 STATION_INFO_PLINK_STATE |
+                                 BIT(NL80211_STA_INFO_PLINK_STATE) |
-                                 STATION_INFO_LOCAL_PM |
+                                 BIT(NL80211_STA_INFO_LOCAL_PM) |
-                                 STATION_INFO_PEER_PM |
+                                 BIT(NL80211_STA_INFO_PEER_PM) |
-                                 STATION_INFO_NONPEER_PM;
+                                 BIT(NL80211_STA_INFO_NONPEER_PM);
                sinfo->llid = sta->llid;
                sinfo->plid = sta->plid;
                sinfo->plink_state = sta->plink_state;
                if (test_sta_flag(sta, WLAN_STA_TOFFSET_KNOWN)) {
-                        sinfo->filled |= STATION_INFO_T_OFFSET;
+                        sinfo->filled |= BIT(NL80211_STA_INFO_T_OFFSET);
                        sinfo->t_offset = sta->t_offset;
                }
                sinfo->local_pm = sta->local_pm;
@@ -1869,7 +1946,7 @@ void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
                thr = drv_get_expected_throughput(local, &sta->sta);
        if (thr != 0) {
-                sinfo->filled |= STATION_INFO_EXPECTED_THROUGHPUT;
+                sinfo->filled |= BIT(NL80211_STA_INFO_EXPECTED_THROUGHPUT);
                sinfo->expected_throughput = thr;
        }
 }
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 4f052bb2a5ad..925e68fe64c7 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -346,6 +346,14 @@ struct ieee80211_tx_latency_stat {
 * @cipher_scheme: optional cipher scheme for this station
 * @last_tdls_pkt_time: holds the time in jiffies of last TDLS pkt ACKed
 * @reserved_tid: reserved TID (if any, otherwise IEEE80211_TID_UNRESERVED)
+ * @tx_msdu: MSDUs transmitted to this station, using IEEE80211_NUM_TID
+ *      entry for non-QoS frames
+ * @tx_msdu_retries: MSDU retries for transmissions to to this station,
+ *      using IEEE80211_NUM_TID entry for non-QoS frames
+ * @tx_msdu_failed: MSDU failures for transmissions to to this station,
+ *      using IEEE80211_NUM_TID entry for non-QoS frames
+ * @rx_msdu: MSDUs received from this station, using IEEE80211_NUM_TID
+ *      entry for non-QoS frames
 */
 struct sta_info {
        /* General information, mostly static */
@@ -416,6 +424,10 @@ struct sta_info {
        u32 last_rx_rate_vht_flag;
        u8 last_rx_rate_vht_nss;
        u16 tid_seq[IEEE80211_QOS_CTL_TID_MASK + 1];
+        u64 tx_msdu[IEEE80211_NUM_TIDS + 1];
+        u64 tx_msdu_retries[IEEE80211_NUM_TIDS + 1];
+        u64 tx_msdu_failed[IEEE80211_NUM_TIDS + 1];
+        u64 rx_msdu[IEEE80211_NUM_TIDS + 1];
        /*
         * Aggregation information, locked with lock.
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index bb146f377ee4..e679b7c9b160 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -664,13 +664,15 @@ void ieee80211_tx_status_noskb(struct ieee80211_hw *hw,
        struct ieee80211_supported_band *sband;
        int retry_count;
        int rates_idx;
-        bool acked;
+        bool acked, noack_success;
        rates_idx = ieee80211_tx_get_rates(hw, info, &retry_count);
        sband = hw->wiphy->bands[info->band];
        acked = !!(info->flags & IEEE80211_TX_STAT_ACK);
+        noack_success = !!(info->flags & IEEE80211_TX_STAT_NOACK_TRANSMITTED);
        if (pubsta) {
                struct sta_info *sta;
@@ -696,7 +698,7 @@ void ieee80211_tx_status_noskb(struct ieee80211_hw *hw,
                rate_control_tx_status_noskb(local, sband, sta, info);
        }
-        if (acked) {
+        if (acked || noack_success) {
                    local->dot11TransmittedFrameCount++;
                    if (!pubsta)
                            local->dot11MulticastTransmittedFrameCount++;
@@ -728,6 +730,7 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
        struct ieee80211_bar *bar;
        int rtap_len;
        int shift = 0;
+        int tid = IEEE80211_NUM_TIDS;
        rates_idx = ieee80211_tx_get_rates(hw, info, &retry_count);
@@ -771,7 +774,7 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                if ((info->flags & IEEE80211_TX_STAT_AMPDU_NO_BACK) &&
                    (ieee80211_is_data_qos(fc))) {
-                        u16 tid, ssn;
+                        u16 ssn;
                        u8 *qc;
                        qc = ieee80211_get_qos_ctl(hdr);
@@ -780,10 +783,14 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                                                & IEEE80211_SCTL_SEQ);
                        ieee80211_send_bar(&sta->sdata->vif, hdr->addr1,
                                           tid, ssn);
+                } else if (ieee80211_is_data_qos(fc)) {
+                        u8 *qc = ieee80211_get_qos_ctl(hdr);
+                        tid = qc[0] & 0xf;
                }
                if (!acked && ieee80211_is_back_req(fc)) {
-                        u16 tid, control;
+                        u16 control;
                        /*
                         * BAR failed, store the last SSN and retry sending
@@ -811,6 +818,12 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                        if (!acked)
                                sta->tx_retry_failed++;
                        sta->tx_retry_count += retry_count;
+                        if (ieee80211_is_data_present(fc)) {
+                                if (!acked)
+                                        sta->tx_msdu_failed[tid]++;
+                                sta->tx_msdu_retries[tid] += retry_count;
+                        }
                }
                rate_control_tx_status(local, sband, sta, skb);
@@ -856,10 +869,11 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
         * Fragments are passed to low-level drivers as separate skbs, so these
         * are actually fragments, not frames. Update frame counters only for
         * the first fragment of the frame. */
-        if (info->flags & IEEE80211_TX_STAT_ACK) {
+        if ((info->flags & IEEE80211_TX_STAT_ACK) ||
+            (info->flags & IEEE80211_TX_STAT_NOACK_TRANSMITTED)) {
                if (ieee80211_is_first_frag(hdr->seq_ctrl)) {
                        local->dot11TransmittedFrameCount++;
-                        if (is_multicast_ether_addr(hdr->addr1))
+                        if (is_multicast_ether_addr(ieee80211_get_DA(hdr)))
                                local->dot11MulticastTransmittedFrameCount++;
                        if (retry_count > 0)
                                local->dot11RetryCount++;
diff --git a/net/mac80211/tdls.c b/net/mac80211/tdls.c
index 55ddd77b865d..917088dfd696 100644
--- a/net/mac80211/tdls.c
+++ b/net/mac80211/tdls.c
@@ -68,17 +68,24 @@ ieee80211_tdls_add_subband(struct ieee80211_sub_if_data *sdata,
                ch = ieee80211_get_channel(sdata->local->hw.wiphy, i);
                if (ch) {
                        /* we will be active on the channel */
-                        u32 flags = IEEE80211_CHAN_DISABLED |
-                                    IEEE80211_CHAN_NO_IR;
                        cfg80211_chandef_create(&chandef, ch,
-                                                NL80211_CHAN_HT20);
+                                                NL80211_CHAN_NO_HT);
-                        if (cfg80211_chandef_usable(sdata->local->hw.wiphy,
+                        if (cfg80211_reg_can_beacon(sdata->local->hw.wiphy,
-                                                    &chandef, flags)) {
+                                                    &chandef,
+                                                    sdata->wdev.iftype)) {
                                ch_cnt++;
+                                /*
+                                 * check if the next channel is also part of
+                                 * this allowed range
+                                 */
                                continue;
                        }
                }
+                /*
+                 * we've reached the end of a range, with allowed channels
+                 * found
+                 */
                if (ch_cnt) {
                        u8 *pos = skb_put(skb, 2);
                        *pos++ = ieee80211_frequency_to_channel(subband_start);
@@ -89,6 +96,15 @@ ieee80211_tdls_add_subband(struct ieee80211_sub_if_data *sdata,
                }
        }
+        /* all channels in the requested range are allowed - add them here */
+        if (ch_cnt) {
+                u8 *pos = skb_put(skb, 2);
+                *pos++ = ieee80211_frequency_to_channel(subband_start);
+                *pos++ = ch_cnt;
+                subband_cnt++;
+        }
        return subband_cnt;
 }
@@ -912,7 +928,7 @@ ieee80211_tdls_mgmt_setup(struct wiphy *wiphy, struct net_device *dev,
                rcu_read_unlock();
        }
-        ieee80211_flush_queues(local, sdata);
+        ieee80211_flush_queues(local, sdata, false);
        ret = ieee80211_tdls_prep_mgmt_packet(wiphy, dev, peer, action_code,
                                              dialog_token, status_code,
@@ -952,7 +968,7 @@ ieee80211_tdls_mgmt_teardown(struct wiphy *wiphy, struct net_device *dev,
         */
        ieee80211_stop_vif_queues(local, sdata,
                                  IEEE80211_QUEUE_STOP_REASON_TDLS_TEARDOWN);
-        ieee80211_flush_queues(local, sdata);
+        ieee80211_flush_queues(local, sdata, false);
        ret = ieee80211_tdls_prep_mgmt_packet(wiphy, dev, peer, action_code,
                                              dialog_token, status_code,
@@ -1098,7 +1114,7 @@ int ieee80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev,
                 */
                tasklet_kill(&local->tx_pending_tasklet);
                /* flush a potentially queued teardown packet */
-                ieee80211_flush_queues(local, sdata);
+                ieee80211_flush_queues(local, sdata, false);
                ret = sta_info_destroy_addr(sdata, peer);
                break;
diff --git a/net/mac80211/trace.h b/net/mac80211/trace.h
index 8e461a02c6a8..263a9561eb26 100644
--- a/net/mac80211/trace.h
+++ b/net/mac80211/trace.h
@@ -825,6 +825,13 @@ DECLARE_EVENT_CLASS(sta_event,
        )
 );
+DEFINE_EVENT(sta_event, drv_sta_statistics,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata,
+                 struct ieee80211_sta *sta),
+        TP_ARGS(local, sdata, sta)
+);
 DEFINE_EVENT(sta_event, drv_sta_add,
        TP_PROTO(struct ieee80211_local *local,
                 struct ieee80211_sub_if_data *sdata,
@@ -1329,32 +1336,6 @@ DEFINE_EVENT(release_evt, drv_allow_buffered_frames,
        TP_ARGS(local, sta, tids, num_frames, reason, more_data)
 );
-TRACE_EVENT(drv_get_rssi,
-        TP_PROTO(struct ieee80211_local *local, struct ieee80211_sta *sta,
-                 s8 rssi, int ret),
-        TP_ARGS(local, sta, rssi, ret),
-        TP_STRUCT__entry(
-                LOCAL_ENTRY
-                STA_ENTRY
-                __field(s8, rssi)
-                __field(int, ret)
-        ),
-        TP_fast_assign(
-                LOCAL_ASSIGN;
-                STA_ASSIGN;
-                __entry->rssi = rssi;
-                __entry->ret = ret;
-        ),
-        TP_printk(
-                LOCAL_PR_FMT STA_PR_FMT " rssi:%d ret:%d",
-                LOCAL_PR_ARG, STA_PR_ARG, __entry->rssi, __entry->ret
-        )
-);
 DEFINE_EVENT(local_sdata_evt, drv_mgd_prepare_tx,
        TP_PROTO(struct ieee80211_local *local,
                 struct ieee80211_sub_if_data *sdata),
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 058686a721a1..02ed6f60629a 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -815,6 +815,8 @@ ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx)
                /* for pure STA mode without beacons, we can do it */
                hdr->seq_ctrl = cpu_to_le16(tx->sdata->sequence_number);
                tx->sdata->sequence_number += 0x10;
+                if (tx->sta)
+                        tx->sta->tx_msdu[IEEE80211_NUM_TIDS]++;
                return TX_CONTINUE;
        }
@@ -831,6 +833,7 @@ ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx)
        qc = ieee80211_get_qos_ctl(hdr);
        tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
        seq = &tx->sta->tid_seq[tid];
+        tx->sta->tx_msdu[tid]++;
        hdr->seq_ctrl = cpu_to_le16(*seq);
@@ -3152,7 +3155,7 @@ int ieee80211_reserve_tid(struct ieee80211_sta *pubsta, u8 tid)
        }
        queues = BIT(sdata->vif.hw_queue[ieee802_1d_to_ac[tid]]);
-        __ieee80211_flush_queues(local, sdata, queues);
+        __ieee80211_flush_queues(local, sdata, queues, false);
        sta->reserved_tid = tid;
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 974ebe70f5b0..fbd37d43dfce 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -578,7 +578,7 @@ ieee80211_get_vif_queues(struct ieee80211_local *local,
 void __ieee80211_flush_queues(struct ieee80211_local *local,
                              struct ieee80211_sub_if_data *sdata,
-                              unsigned int queues)
+                              unsigned int queues, bool drop)
 {
        if (!local->ops->flush)
                return;
@@ -594,7 +594,7 @@ void __ieee80211_flush_queues(struct ieee80211_local *local,
                                        IEEE80211_QUEUE_STOP_REASON_FLUSH,
                                        false);
-        drv_flush(local, sdata, queues, false);
+        drv_flush(local, sdata, queues, drop);
        ieee80211_wake_queues_by_reason(&local->hw, queues,
                                        IEEE80211_QUEUE_STOP_REASON_FLUSH,
@@ -602,9 +602,9 @@ void __ieee80211_flush_queues(struct ieee80211_local *local,
 }
 void ieee80211_flush_queues(struct ieee80211_local *local,
-                            struct ieee80211_sub_if_data *sdata)
+                            struct ieee80211_sub_if_data *sdata, bool drop)
 {
-        __ieee80211_flush_queues(local, sdata, 0);
+        __ieee80211_flush_queues(local, sdata, 0, drop);
 }
 void ieee80211_stop_vif_queues(struct ieee80211_local *local,
@@ -1470,10 +1470,12 @@ static int ieee80211_build_preq_ies_band(struct ieee80211_local *local,
        /* Check if any channel in this sband supports at least 80 MHz */
        for (i = 0; i < sband->n_channels; i++) {
-                if (!(sband->channels[i].flags & IEEE80211_CHAN_NO_80MHZ)) {
+                if (sband->channels[i].flags & (IEEE80211_CHAN_DISABLED |
-                        have_80mhz = true;
+                                                IEEE80211_CHAN_NO_80MHZ))
-                        break;
+                        continue;
-                }
+                have_80mhz = true;
+                break;
        }
        if (sband->vht_cap.vht_supported && have_80mhz) {
@@ -1735,6 +1737,10 @@ int ieee80211_reconfig(struct ieee80211_local *local)
        struct cfg80211_sched_scan_request *sched_scan_req;
        bool sched_scan_stopped = false;
+        /* nothing to do if HW shouldn't run */
+        if (!local->open_count)
+                goto wake_up;
 #ifdef CONFIG_PM
        if (local->suspended)
                local->resuming = true;
@@ -1756,9 +1762,6 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                reconfig_due_to_wowlan = true;
        }
 #endif
-        /* everything else happens only if HW was up & running */
-        if (!local->open_count)
-                goto wake_up;
        /*
         * Upon resume hardware can sometimes be goofy due to
@@ -2042,7 +2045,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
         * If this is for hw restart things are still running.
         * We may want to change that later, however.
         */
-        if (!local->suspended || reconfig_due_to_wowlan)
+        if (local->open_count && (!local->suspended || reconfig_due_to_wowlan))
                drv_reconfig_complete(local, IEEE80211_RECONFIG_TYPE_RESTART);
        if (!local->suspended)
@@ -2054,7 +2057,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
        mb();
        local->resuming = false;
-        if (!reconfig_due_to_wowlan)
+        if (local->open_count && !reconfig_due_to_wowlan)
                drv_reconfig_complete(local, IEEE80211_RECONFIG_TYPE_SUSPEND);
        list_for_each_entry(sdata, &local->interfaces, list) {
@@ -2538,7 +2541,9 @@ u64 ieee80211_calculate_rx_timestamp(struct ieee80211_local *local,
                ri.mcs = status->rate_idx;
                ri.flags |= RATE_INFO_FLAGS_MCS;
                if (status->flag & RX_FLAG_40MHZ)
-                        ri.flags |= RATE_INFO_FLAGS_40_MHZ_WIDTH;
+                        ri.bw = RATE_INFO_BW_40;
+                else
+                        ri.bw = RATE_INFO_BW_20;
                if (status->flag & RX_FLAG_SHORT_GI)
                        ri.flags |= RATE_INFO_FLAGS_SHORT_GI;
        } else if (status->flag & RX_FLAG_VHT) {
@@ -2546,13 +2551,13 @@ u64 ieee80211_calculate_rx_timestamp(struct ieee80211_local *local,
                ri.mcs = status->rate_idx;
                ri.nss = status->vht_nss;
                if (status->flag & RX_FLAG_40MHZ)
-                        ri.flags |= RATE_INFO_FLAGS_40_MHZ_WIDTH;
+                        ri.bw = RATE_INFO_BW_40;
-                if (status->vht_flag & RX_VHT_FLAG_80MHZ)
+                else if (status->vht_flag & RX_VHT_FLAG_80MHZ)
-                        ri.flags |= RATE_INFO_FLAGS_80_MHZ_WIDTH;
+                        ri.bw = RATE_INFO_BW_80;
-                if (status->vht_flag & RX_VHT_FLAG_80P80MHZ)
+                else if (status->vht_flag & RX_VHT_FLAG_160MHZ)
-                        ri.flags |= RATE_INFO_FLAGS_80P80_MHZ_WIDTH;
+                        ri.bw = RATE_INFO_BW_160;
-                if (status->vht_flag & RX_VHT_FLAG_160MHZ)
+                else
-                        ri.flags |= RATE_INFO_FLAGS_160_MHZ_WIDTH;
+                        ri.bw = RATE_INFO_BW_20;
                if (status->flag & RX_FLAG_SHORT_GI)
                        ri.flags |= RATE_INFO_FLAGS_SHORT_GI;
        } else {
@@ -2560,10 +2565,15 @@ u64 ieee80211_calculate_rx_timestamp(struct ieee80211_local *local,
                int shift = 0;
                int bitrate;
-                if (status->flag & RX_FLAG_10MHZ)
+                if (status->flag & RX_FLAG_10MHZ) {
                        shift = 1;
-                if (status->flag & RX_FLAG_5MHZ)
+                        ri.bw = RATE_INFO_BW_10;
+                } else if (status->flag & RX_FLAG_5MHZ) {
                        shift = 2;
+                        ri.bw = RATE_INFO_BW_5;
+                } else {
+                        ri.bw = RATE_INFO_BW_20;
+                }
                sband = local->hw.wiphy->bands[status->band];
                bitrate = sband->bitrates[status->rate_idx].bitrate;
diff --git a/net/mac80211/vht.c b/net/mac80211/vht.c
index bc9e8fc48785..85f9596da07b 100644
--- a/net/mac80211/vht.c
+++ b/net/mac80211/vht.c
@@ -269,51 +269,54 @@ ieee80211_vht_cap_ie_to_sta_vht_cap(struct ieee80211_sub_if_data *sdata,
        sta->sta.bandwidth = ieee80211_sta_cur_vht_bw(sta);
 }
-enum ieee80211_sta_rx_bandwidth ieee80211_sta_cur_vht_bw(struct sta_info *sta)
+enum ieee80211_sta_rx_bandwidth ieee80211_sta_cap_rx_bw(struct sta_info *sta)
 {
-        struct ieee80211_sub_if_data *sdata = sta->sdata;
+        struct ieee80211_sta_vht_cap *vht_cap = &sta->sta.vht_cap;
-        u32 cap = sta->sta.vht_cap.cap;
+        u32 cap_width;
-        enum ieee80211_sta_rx_bandwidth bw;
-        if (!sta->sta.vht_cap.vht_supported) {
+        if (!vht_cap->vht_supported)
-                bw = sta->sta.ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40 ?
+                return sta->sta.ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40 ?
-                                IEEE80211_STA_RX_BW_40 : IEEE80211_STA_RX_BW_20;
+                                IEEE80211_STA_RX_BW_40 :
-                goto check_max;
+                                IEEE80211_STA_RX_BW_20;
-        }
-        switch (sdata->vif.bss_conf.chandef.width) {
+        cap_width = vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
-        default:
-                WARN_ON_ONCE(1);
+        if (cap_width == IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ ||
-                /* fall through */
+            cap_width == IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ)
+                return IEEE80211_STA_RX_BW_160;
+        return IEEE80211_STA_RX_BW_80;
+}
+static enum ieee80211_sta_rx_bandwidth
+ieee80211_chan_width_to_rx_bw(enum nl80211_chan_width width)
+{
+        switch (width) {
        case NL80211_CHAN_WIDTH_20_NOHT:
        case NL80211_CHAN_WIDTH_20:
-                bw = IEEE80211_STA_RX_BW_20;
+                return IEEE80211_STA_RX_BW_20;
-                break;
        case NL80211_CHAN_WIDTH_40:
-                bw = sta->sta.ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40 ?
+                return IEEE80211_STA_RX_BW_40;
-                                IEEE80211_STA_RX_BW_40 : IEEE80211_STA_RX_BW_20;
+        case NL80211_CHAN_WIDTH_80:
-                break;
+                return IEEE80211_STA_RX_BW_80;
        case NL80211_CHAN_WIDTH_160:
-                if ((cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK) ==
-                                IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ) {
-                        bw = IEEE80211_STA_RX_BW_160;
-                        break;
-                }
-                /* fall through */
        case NL80211_CHAN_WIDTH_80P80:
-                if ((cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK) ==
+                return IEEE80211_STA_RX_BW_160;
-                                IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ) {
+        default:
-                        bw = IEEE80211_STA_RX_BW_160;
+                WARN_ON_ONCE(1);
-                        break;
+                return IEEE80211_STA_RX_BW_20;
-                }
-                /* fall through */
-        case NL80211_CHAN_WIDTH_80:
-                bw = IEEE80211_STA_RX_BW_80;
        }
+}
+enum ieee80211_sta_rx_bandwidth ieee80211_sta_cur_vht_bw(struct sta_info *sta)
+{
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
+        enum ieee80211_sta_rx_bandwidth bw;
+        bw = ieee80211_chan_width_to_rx_bw(sdata->vif.bss_conf.chandef.width);
+        bw = min(bw, ieee80211_sta_cap_rx_bw(sta));
+        bw = min(bw, sta->cur_max_bandwidth);
- check_max:
-        if (bw > sta->cur_max_bandwidth)
-                bw = sta->cur_max_bandwidth;
        return bw;
 }
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 53dda7728f86..3af0ecf1cc16 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -320,6 +320,20 @@ static void cfg80211_destroy_iface_wk(struct work_struct *work)
        rtnl_unlock();
 }
+static void cfg80211_sched_scan_stop_wk(struct work_struct *work)
+{
+        struct cfg80211_registered_device *rdev;
+        rdev = container_of(work, struct cfg80211_registered_device,
+                           sched_scan_stop_wk);
+        rtnl_lock();
+        __cfg80211_stop_sched_scan(rdev, false);
+        rtnl_unlock();
+}
 /* exported functions */
 struct wiphy *wiphy_new_nm(const struct cfg80211_ops *ops, int sizeof_priv,
@@ -406,6 +420,7 @@ use_default_name:
        INIT_LIST_HEAD(&rdev->destroy_list);
        spin_lock_init(&rdev->destroy_list_lock);
        INIT_WORK(&rdev->destroy_work, cfg80211_destroy_iface_wk);
+        INIT_WORK(&rdev->sched_scan_stop_wk, cfg80211_sched_scan_stop_wk);
 #ifdef CONFIG_CFG80211_DEFAULT_PS
        rdev->wiphy.flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT;
@@ -560,6 +575,14 @@ int wiphy_register(struct wiphy *wiphy)
                                       BIT(NL80211_IFTYPE_MONITOR)))
                wiphy->regulatory_flags |= REGULATORY_IGNORE_STALE_KICKOFF;
+        if (WARN_ON((wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED) &&
+                    (wiphy->regulatory_flags &
+                                        (REGULATORY_CUSTOM_REG |
+                                         REGULATORY_STRICT_REG |
+                                         REGULATORY_COUNTRY_IE_FOLLOW_POWER |
+                                         REGULATORY_COUNTRY_IE_IGNORE))))
+                return -EINVAL;
        if (WARN_ON(wiphy->coalesce &&
                    (!wiphy->coalesce->n_rules ||
                     !wiphy->coalesce->n_patterns) &&
@@ -778,6 +801,7 @@ void wiphy_unregister(struct wiphy *wiphy)
        flush_work(&rdev->event_work);
        cancel_delayed_work_sync(&rdev->dfs_update_channels_wk);
        flush_work(&rdev->destroy_work);
+        flush_work(&rdev->sched_scan_stop_wk);
 #ifdef CONFIG_PM
        if (rdev->wiphy.wowlan_config && rdev->ops->set_wakeup)
@@ -858,6 +882,7 @@ void __cfg80211_leave(struct cfg80211_registered_device *rdev,
                      struct wireless_dev *wdev)
 {
        struct net_device *dev = wdev->netdev;
+        struct cfg80211_sched_scan_request *sched_scan_req;
        ASSERT_RTNL();
        ASSERT_WDEV_LOCK(wdev);
@@ -868,7 +893,8 @@ void __cfg80211_leave(struct cfg80211_registered_device *rdev,
                break;
        case NL80211_IFTYPE_P2P_CLIENT:
        case NL80211_IFTYPE_STATION:
-                if (rdev->sched_scan_req && dev == rdev->sched_scan_req->dev)
+                sched_scan_req = rtnl_dereference(rdev->sched_scan_req);
+                if (sched_scan_req && dev == sched_scan_req->dev)
                        __cfg80211_stop_sched_scan(rdev, false);
 #ifdef CONFIG_CFG80211_WEXT
@@ -943,6 +969,7 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
        struct wireless_dev *wdev = dev->ieee80211_ptr;
        struct cfg80211_registered_device *rdev;
+        struct cfg80211_sched_scan_request *sched_scan_req;
        if (!wdev)
                return NOTIFY_DONE;
@@ -1007,8 +1034,9 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
                        ___cfg80211_scan_done(rdev, false);
                }
-                if (WARN_ON(rdev->sched_scan_req &&
+                sched_scan_req = rtnl_dereference(rdev->sched_scan_req);
-                            rdev->sched_scan_req->dev == wdev->netdev)) {
+                if (WARN_ON(sched_scan_req &&
+                            sched_scan_req->dev == wdev->netdev)) {
                        __cfg80211_stop_sched_scan(rdev, false);
                }
diff --git a/net/wireless/core.h b/net/wireless/core.h
index faa5b1609aae..801cd49c5a0c 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -36,6 +36,13 @@ struct cfg80211_registered_device {
         * the country on the country IE changed. */
        char country_ie_alpha2[2];
+        /*
+         * the driver requests the regulatory core to set this regulatory
+         * domain as the wiphy's. Only used for %REGULATORY_WIPHY_SELF_MANAGED
+         * devices using the regulatory_set_wiphy_regd() API
+         */
+        const struct ieee80211_regdomain *requested_regd;
        /* If a Country IE has been received this tells us the environment
         * which its telling us its in. This defaults to ENVIRON_ANY */
        enum environment_cap env;
@@ -63,7 +70,7 @@ struct cfg80211_registered_device {
        u32 bss_generation;
        struct cfg80211_scan_request *scan_req; /* protected by RTNL */
        struct sk_buff *scan_msg;
-        struct cfg80211_sched_scan_request *sched_scan_req;
+        struct cfg80211_sched_scan_request __rcu *sched_scan_req;
        unsigned long suspend_at;
        struct work_struct scan_done_wk;
        struct work_struct sched_scan_results_wk;
@@ -84,6 +91,8 @@ struct cfg80211_registered_device {
        struct list_head destroy_list;
        struct work_struct destroy_work;
+        struct work_struct sched_scan_stop_wk;
        /* must be last because of the way we do wiphy_priv(),
         * and it should at least be aligned to NETDEV_ALIGN */
        struct wiphy wiphy __aligned(NETDEV_ALIGN);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 7ca4b5133123..c5661c5ad8f3 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -59,13 +59,13 @@ enum nl80211_multicast_groups {
 };
 static const struct genl_multicast_group nl80211_mcgrps[] = {
-        [NL80211_MCGRP_CONFIG] = { .name = "config", },
+        [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
-        [NL80211_MCGRP_SCAN] = { .name = "scan", },
+        [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
-        [NL80211_MCGRP_REGULATORY] = { .name = "regulatory", },
+        [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
-        [NL80211_MCGRP_MLME] = { .name = "mlme", },
+        [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
-        [NL80211_MCGRP_VENDOR] = { .name = "vendor", },
+        [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
 #ifdef CONFIG_NL80211_TESTMODE
-        [NL80211_MCGRP_TESTMODE] = { .name = "testmode", }
+        [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
 #endif
 };
@@ -396,6 +396,7 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
        [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
        [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
        [NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN },
+        [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
 };
 /* policy for the key attributes */
@@ -1087,6 +1088,11 @@ static int nl80211_send_wowlan(struct sk_buff *msg,
                        return -ENOBUFS;
        }
+        if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
+            nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
+                        rdev->wiphy.wowlan->max_nd_match_sets))
+                return -ENOBUFS;
        if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
                return -ENOBUFS;
@@ -1701,6 +1707,15 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
                               rdev->wiphy.max_num_csa_counters))
                        goto nla_put_failure;
+                if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
+                    nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
+                        goto nla_put_failure;
+                if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
+                            sizeof(rdev->wiphy.ext_features),
+                            rdev->wiphy.ext_features))
+                        goto nla_put_failure;
                /* done */
                state->split_start = 0;
                break;
@@ -3563,6 +3578,7 @@ static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
        struct nlattr *rate;
        u32 bitrate;
        u16 bitrate_compat;
+        enum nl80211_attrs rate_flg;
        rate = nla_nest_start(msg, attr);
        if (!rate)
@@ -3579,12 +3595,36 @@ static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
            nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
                return false;
+        switch (info->bw) {
+        case RATE_INFO_BW_5:
+                rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
+                break;
+        case RATE_INFO_BW_10:
+                rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
+                break;
+        default:
+                WARN_ON(1);
+                /* fall through */
+        case RATE_INFO_BW_20:
+                rate_flg = 0;
+                break;
+        case RATE_INFO_BW_40:
+                rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
+                break;
+        case RATE_INFO_BW_80:
+                rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
+                break;
+        case RATE_INFO_BW_160:
+                rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
+                break;
+        }
+        if (rate_flg && nla_put_flag(msg, rate_flg))
+                return false;
        if (info->flags & RATE_INFO_FLAGS_MCS) {
                if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
                        return false;
-                if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
-                    nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
-                        return false;
                if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
                    nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
                        return false;
@@ -3593,18 +3633,6 @@ static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
                        return false;
                if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
                        return false;
-                if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
-                    nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
-                        return false;
-                if (info->flags & RATE_INFO_FLAGS_80_MHZ_WIDTH &&
-                    nla_put_flag(msg, NL80211_RATE_INFO_80_MHZ_WIDTH))
-                        return false;
-                if (info->flags & RATE_INFO_FLAGS_80P80_MHZ_WIDTH &&
-                    nla_put_flag(msg, NL80211_RATE_INFO_80P80_MHZ_WIDTH))
-                        return false;
-                if (info->flags & RATE_INFO_FLAGS_160_MHZ_WIDTH &&
-                    nla_put_flag(msg, NL80211_RATE_INFO_160_MHZ_WIDTH))
-                        return false;
                if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
                    nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
                        return false;
@@ -3640,8 +3668,8 @@ static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
        return true;
 }
-static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
+static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
-                                int flags,
+                                u32 seq, int flags,
                                struct cfg80211_registered_device *rdev,
                                struct net_device *dev,
                                const u8 *mac_addr, struct station_info *sinfo)
@@ -3649,7 +3677,7 @@ static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
        void *hdr;
        struct nlattr *sinfoattr, *bss_param;
-        hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
+        hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
        if (!hdr)
                return -1;
@@ -3661,115 +3689,77 @@ static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
        sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
        if (!sinfoattr)
                goto nla_put_failure;
-        if ((sinfo->filled & STATION_INFO_CONNECTED_TIME) &&
-            nla_put_u32(msg, NL80211_STA_INFO_CONNECTED_TIME,
+#define PUT_SINFO(attr, memb, type) do {                                \
-                        sinfo->connected_time))
+        if (sinfo->filled & BIT(NL80211_STA_INFO_ ## attr) &&           \
-                goto nla_put_failure;
+            nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr,            \
-        if ((sinfo->filled & STATION_INFO_INACTIVE_TIME) &&
+                             sinfo->memb))                              \
-            nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
+                goto nla_put_failure;                                   \
-                        sinfo->inactive_time))
+        } while (0)
-                goto nla_put_failure;
-        if ((sinfo->filled & (STATION_INFO_RX_BYTES |
+        PUT_SINFO(CONNECTED_TIME, connected_time, u32);
-                              STATION_INFO_RX_BYTES64)) &&
+        PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
+        if (sinfo->filled & (BIT(NL80211_STA_INFO_RX_BYTES) |
+                             BIT(NL80211_STA_INFO_RX_BYTES64)) &&
            nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
                        (u32)sinfo->rx_bytes))
                goto nla_put_failure;
-        if ((sinfo->filled & (STATION_INFO_TX_BYTES |
-                              STATION_INFO_TX_BYTES64)) &&
+        if (sinfo->filled & (BIT(NL80211_STA_INFO_TX_BYTES) |
+                             BIT(NL80211_STA_INFO_TX_BYTES64)) &&
            nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
                        (u32)sinfo->tx_bytes))
                goto nla_put_failure;
-        if ((sinfo->filled & STATION_INFO_RX_BYTES64) &&
-            nla_put_u64(msg, NL80211_STA_INFO_RX_BYTES64,
+        PUT_SINFO(RX_BYTES64, rx_bytes, u64);
-                        sinfo->rx_bytes))
+        PUT_SINFO(TX_BYTES64, tx_bytes, u64);
-                goto nla_put_failure;
+        PUT_SINFO(LLID, llid, u16);
-        if ((sinfo->filled & STATION_INFO_TX_BYTES64) &&
+        PUT_SINFO(PLID, plid, u16);
-            nla_put_u64(msg, NL80211_STA_INFO_TX_BYTES64,
+        PUT_SINFO(PLINK_STATE, plink_state, u8);
-                        sinfo->tx_bytes))
-                goto nla_put_failure;
-        if ((sinfo->filled & STATION_INFO_LLID) &&
-            nla_put_u16(msg, NL80211_STA_INFO_LLID, sinfo->llid))
-                goto nla_put_failure;
-        if ((sinfo->filled & STATION_INFO_PLID) &&
-            nla_put_u16(msg, NL80211_STA_INFO_PLID, sinfo->plid))
-                goto nla_put_failure;
-        if ((sinfo->filled & STATION_INFO_PLINK_STATE) &&
-            nla_put_u8(msg, NL80211_STA_INFO_PLINK_STATE,
-                       sinfo->plink_state))
-                goto nla_put_failure;
        switch (rdev->wiphy.signal_type) {
        case CFG80211_SIGNAL_TYPE_MBM:
-                if ((sinfo->filled & STATION_INFO_SIGNAL) &&
+                PUT_SINFO(SIGNAL, signal, u8);
-                    nla_put_u8(msg, NL80211_STA_INFO_SIGNAL,
+                PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
-                               sinfo->signal))
-                        goto nla_put_failure;
-                if ((sinfo->filled & STATION_INFO_SIGNAL_AVG) &&
-                    nla_put_u8(msg, NL80211_STA_INFO_SIGNAL_AVG,
-                               sinfo->signal_avg))
-                        goto nla_put_failure;
                break;
        default:
                break;
        }
-        if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL) {
+        if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL)) {
                if (!nl80211_put_signal(msg, sinfo->chains,
                                        sinfo->chain_signal,
                                        NL80211_STA_INFO_CHAIN_SIGNAL))
                        goto nla_put_failure;
        }
-        if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL_AVG) {
+        if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
                if (!nl80211_put_signal(msg, sinfo->chains,
                                        sinfo->chain_signal_avg,
                                        NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
                        goto nla_put_failure;
        }
-        if (sinfo->filled & STATION_INFO_TX_BITRATE) {
+        if (sinfo->filled & BIT(NL80211_STA_INFO_TX_BITRATE)) {
                if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
                                          NL80211_STA_INFO_TX_BITRATE))
                        goto nla_put_failure;
        }
-        if (sinfo->filled & STATION_INFO_RX_BITRATE) {
+        if (sinfo->filled & BIT(NL80211_STA_INFO_RX_BITRATE)) {
                if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
                                          NL80211_STA_INFO_RX_BITRATE))
                        goto nla_put_failure;
        }
-        if ((sinfo->filled & STATION_INFO_RX_PACKETS) &&
-            nla_put_u32(msg, NL80211_STA_INFO_RX_PACKETS,
+        PUT_SINFO(RX_PACKETS, rx_packets, u32);
-                        sinfo->rx_packets))
+        PUT_SINFO(TX_PACKETS, tx_packets, u32);
-                goto nla_put_failure;
+        PUT_SINFO(TX_RETRIES, tx_retries, u32);
-        if ((sinfo->filled & STATION_INFO_TX_PACKETS) &&
+        PUT_SINFO(TX_FAILED, tx_failed, u32);
-            nla_put_u32(msg, NL80211_STA_INFO_TX_PACKETS,
+        PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
-                        sinfo->tx_packets))
+        PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
-                goto nla_put_failure;
+        PUT_SINFO(LOCAL_PM, local_pm, u32);
-        if ((sinfo->filled & STATION_INFO_TX_RETRIES) &&
+        PUT_SINFO(PEER_PM, peer_pm, u32);
-            nla_put_u32(msg, NL80211_STA_INFO_TX_RETRIES,
+        PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
-                        sinfo->tx_retries))
-                goto nla_put_failure;
+        if (sinfo->filled & BIT(NL80211_STA_INFO_BSS_PARAM)) {
-        if ((sinfo->filled & STATION_INFO_TX_FAILED) &&
-            nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
-                        sinfo->tx_failed))
-                goto nla_put_failure;
-        if ((sinfo->filled & STATION_INFO_EXPECTED_THROUGHPUT) &&
-            nla_put_u32(msg, NL80211_STA_INFO_EXPECTED_THROUGHPUT,
-                        sinfo->expected_throughput))
-                goto nla_put_failure;
-        if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
-            nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
-                        sinfo->beacon_loss_count))
-                goto nla_put_failure;
-        if ((sinfo->filled & STATION_INFO_LOCAL_PM) &&
-            nla_put_u32(msg, NL80211_STA_INFO_LOCAL_PM,
-                        sinfo->local_pm))
-                goto nla_put_failure;
-        if ((sinfo->filled & STATION_INFO_PEER_PM) &&
-            nla_put_u32(msg, NL80211_STA_INFO_PEER_PM,
-                        sinfo->peer_pm))
-                goto nla_put_failure;
-        if ((sinfo->filled & STATION_INFO_NONPEER_PM) &&
-            nla_put_u32(msg, NL80211_STA_INFO_NONPEER_PM,
-                        sinfo->nonpeer_pm))
-                goto nla_put_failure;
-        if (sinfo->filled & STATION_INFO_BSS_PARAM) {
                bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
                if (!bss_param)
                        goto nla_put_failure;
@@ -3788,18 +3778,62 @@ static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
                nla_nest_end(msg, bss_param);
        }
-        if ((sinfo->filled & STATION_INFO_STA_FLAGS) &&
+        if ((sinfo->filled & BIT(NL80211_STA_INFO_STA_FLAGS)) &&
            nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
                    sizeof(struct nl80211_sta_flag_update),
                    &sinfo->sta_flags))
                goto nla_put_failure;
-        if ((sinfo->filled & STATION_INFO_T_OFFSET) &&
-                nla_put_u64(msg, NL80211_STA_INFO_T_OFFSET,
+        PUT_SINFO(T_OFFSET, t_offset, u64);
-                            sinfo->t_offset))
+        PUT_SINFO(RX_DROP_MISC, rx_dropped_misc, u64);
-                goto nla_put_failure;
+        PUT_SINFO(BEACON_RX, rx_beacon, u64);
+        PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
+#undef PUT_SINFO
+        if (sinfo->filled & BIT(NL80211_STA_INFO_TID_STATS)) {
+                struct nlattr *tidsattr;
+                int tid;
+                tidsattr = nla_nest_start(msg, NL80211_STA_INFO_TID_STATS);
+                if (!tidsattr)
+                        goto nla_put_failure;
+                for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
+                        struct cfg80211_tid_stats *tidstats;
+                        struct nlattr *tidattr;
+                        tidstats = &sinfo->pertid[tid];
+                        if (!tidstats->filled)
+                                continue;
+                        tidattr = nla_nest_start(msg, tid + 1);
+                        if (!tidattr)
+                                goto nla_put_failure;
+#define PUT_TIDVAL(attr, memb, type) do {                               \
+        if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) &&       \
+            nla_put_ ## type(msg, NL80211_TID_STATS_ ## attr,           \
+                             tidstats->memb))                           \
+                goto nla_put_failure;                                   \
+        } while (0)
+                        PUT_TIDVAL(RX_MSDU, rx_msdu, u64);
+                        PUT_TIDVAL(TX_MSDU, tx_msdu, u64);
+                        PUT_TIDVAL(TX_MSDU_RETRIES, tx_msdu_retries, u64);
+                        PUT_TIDVAL(TX_MSDU_FAILED, tx_msdu_failed, u64);
+#undef PUT_TIDVAL
+                        nla_nest_end(msg, tidattr);
+                }
+                nla_nest_end(msg, tidsattr);
+        }
        nla_nest_end(msg, sinfoattr);
-        if ((sinfo->filled & STATION_INFO_ASSOC_REQ_IES) &&
+        if (sinfo->assoc_req_ies_len &&
            nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
                    sinfo->assoc_req_ies))
                goto nla_put_failure;
@@ -3844,7 +3878,7 @@ static int nl80211_dump_station(struct sk_buff *skb,
                if (err)
                        goto out_err;
-                if (nl80211_send_station(skb,
+                if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
                                NETLINK_CB(cb->skb).portid,
                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
                                rdev, wdev->netdev, mac_addr,
@@ -3891,7 +3925,8 @@ static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
        if (!msg)
                return -ENOMEM;
-        if (nl80211_send_station(msg, info->snd_portid, info->snd_seq, 0,
+        if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
+                                 info->snd_portid, info->snd_seq, 0,
                                 rdev, dev, mac_addr, &sinfo) < 0) {
                nlmsg_free(msg);
                return -ENOBUFS;
@@ -5327,42 +5362,20 @@ static int nl80211_update_mesh_config(struct sk_buff *skb,
        return err;
 }
-static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
+static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
+                              struct sk_buff *msg)
 {
-        const struct ieee80211_regdomain *regdom;
-        struct sk_buff *msg;
-        void *hdr = NULL;
        struct nlattr *nl_reg_rules;
        unsigned int i;
-        if (!cfg80211_regdomain)
-                return -EINVAL;
-        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
-        if (!msg)
-                return -ENOBUFS;
-        hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
-                             NL80211_CMD_GET_REG);
-        if (!hdr)
-                goto put_failure;
-        if (reg_last_request_cell_base() &&
-            nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
-                        NL80211_USER_REG_HINT_CELL_BASE))
-                goto nla_put_failure;
-        rcu_read_lock();
-        regdom = rcu_dereference(cfg80211_regdomain);
        if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
            (regdom->dfs_region &&
             nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
-                goto nla_put_failure_rcu;
+                goto nla_put_failure;
        nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
        if (!nl_reg_rules)
-                goto nla_put_failure_rcu;
+                goto nla_put_failure;
        for (i = 0; i < regdom->n_reg_rules; i++) {
                struct nlattr *nl_reg_rule;
@@ -5377,7 +5390,7 @@ static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
                nl_reg_rule = nla_nest_start(msg, i);
                if (!nl_reg_rule)
-                        goto nla_put_failure_rcu;
+                        goto nla_put_failure;
                max_bandwidth_khz = freq_range->max_bandwidth_khz;
                if (!max_bandwidth_khz)
@@ -5398,13 +5411,74 @@ static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
                                power_rule->max_eirp) ||
                    nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
                                reg_rule->dfs_cac_ms))
-                        goto nla_put_failure_rcu;
+                        goto nla_put_failure;
                nla_nest_end(msg, nl_reg_rule);
        }
-        rcu_read_unlock();
        nla_nest_end(msg, nl_reg_rules);
+        return 0;
+nla_put_failure:
+        return -EMSGSIZE;
+}
+static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
+{
+        const struct ieee80211_regdomain *regdom = NULL;
+        struct cfg80211_registered_device *rdev;
+        struct wiphy *wiphy = NULL;
+        struct sk_buff *msg;
+        void *hdr;
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+        if (!msg)
+                return -ENOBUFS;
+        hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
+                             NL80211_CMD_GET_REG);
+        if (!hdr)
+                goto put_failure;
+        if (info->attrs[NL80211_ATTR_WIPHY]) {
+                bool self_managed;
+                rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
+                if (IS_ERR(rdev)) {
+                        nlmsg_free(msg);
+                        return PTR_ERR(rdev);
+                }
+                wiphy = &rdev->wiphy;
+                self_managed = wiphy->regulatory_flags &
+                               REGULATORY_WIPHY_SELF_MANAGED;
+                regdom = get_wiphy_regdom(wiphy);
+                /* a self-managed-reg device must have a private regdom */
+                if (WARN_ON(!regdom && self_managed)) {
+                        nlmsg_free(msg);
+                        return -EINVAL;
+                }
+                if (regdom &&
+                    nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
+                        goto nla_put_failure;
+        }
+        if (!wiphy && reg_last_request_cell_base() &&
+            nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
+                        NL80211_USER_REG_HINT_CELL_BASE))
+                goto nla_put_failure;
+        rcu_read_lock();
+        if (!regdom)
+                regdom = rcu_dereference(cfg80211_regdomain);
+        if (nl80211_put_regdom(regdom, msg))
+                goto nla_put_failure_rcu;
+        rcu_read_unlock();
        genlmsg_end(msg, hdr);
        return genlmsg_reply(msg, info);
@@ -5418,6 +5492,83 @@ put_failure:
        return -EMSGSIZE;
 }
+static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
+                               u32 seq, int flags, struct wiphy *wiphy,
+                               const struct ieee80211_regdomain *regdom)
+{
+        void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
+                                   NL80211_CMD_GET_REG);
+        if (!hdr)
+                return -1;
+        genl_dump_check_consistent(cb, hdr, &nl80211_fam);
+        if (nl80211_put_regdom(regdom, msg))
+                goto nla_put_failure;
+        if (!wiphy && reg_last_request_cell_base() &&
+            nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
+                        NL80211_USER_REG_HINT_CELL_BASE))
+                goto nla_put_failure;
+        if (wiphy &&
+            nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
+                goto nla_put_failure;
+        if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
+            nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
+                goto nla_put_failure;
+        return genlmsg_end(msg, hdr);
+nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        return -EMSGSIZE;
+}
+static int nl80211_get_reg_dump(struct sk_buff *skb,
+                                struct netlink_callback *cb)
+{
+        const struct ieee80211_regdomain *regdom = NULL;
+        struct cfg80211_registered_device *rdev;
+        int err, reg_idx, start = cb->args[2];
+        rtnl_lock();
+        if (cfg80211_regdomain && start == 0) {
+                err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
+                                          NLM_F_MULTI, NULL,
+                                          rtnl_dereference(cfg80211_regdomain));
+                if (err < 0)
+                        goto out_err;
+        }
+        /* the global regdom is idx 0 */
+        reg_idx = 1;
+        list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
+                regdom = get_wiphy_regdom(&rdev->wiphy);
+                if (!regdom)
+                        continue;
+                if (++reg_idx <= start)
+                        continue;
+                err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
+                                          NLM_F_MULTI, &rdev->wiphy, regdom);
+                if (err < 0) {
+                        reg_idx--;
+                        break;
+                }
+        }
+        cb->args[2] = reg_idx;
+        err = skb->len;
+out_err:
+        rtnl_unlock();
+        return err;
+}
 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
 {
        struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
@@ -6069,6 +6220,7 @@ static int nl80211_start_sched_scan(struct sk_buff *skb,
        struct cfg80211_registered_device *rdev = info->user_ptr[0];
        struct net_device *dev = info->user_ptr[1];
        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_sched_scan_request *sched_scan_req;
        int err;
        if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
@@ -6078,27 +6230,32 @@ static int nl80211_start_sched_scan(struct sk_buff *skb,
        if (rdev->sched_scan_req)
                return -EINPROGRESS;
-        rdev->sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
+        sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
-                                                        info->attrs);
+                                                  info->attrs);
-        err = PTR_ERR_OR_ZERO(rdev->sched_scan_req);
+        err = PTR_ERR_OR_ZERO(sched_scan_req);
        if (err)
                goto out_err;
-        err = rdev_sched_scan_start(rdev, dev, rdev->sched_scan_req);
+        err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
        if (err)
                goto out_free;
-        rdev->sched_scan_req->dev = dev;
+        sched_scan_req->dev = dev;
-        rdev->sched_scan_req->wiphy = &rdev->wiphy;
+        sched_scan_req->wiphy = &rdev->wiphy;
+        if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
+                sched_scan_req->owner_nlportid = info->snd_portid;
+        rcu_assign_pointer(rdev->sched_scan_req, sched_scan_req);
        nl80211_send_sched_scan(rdev, dev,
                                NL80211_CMD_START_SCHED_SCAN);
        return 0;
 out_free:
-        kfree(rdev->sched_scan_req);
+        kfree(sched_scan_req);
 out_err:
-        rdev->sched_scan_req = NULL;
        return err;
 }
@@ -6481,12 +6638,17 @@ static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
 }
 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
-                                int flags, struct net_device *dev,
+                               int flags, struct net_device *dev,
-                                struct survey_info *survey)
+                               bool allow_radio_stats,
+                               struct survey_info *survey)
 {
        void *hdr;
        struct nlattr *infoattr;
+        /* skip radio stats if userspace didn't request them */
+        if (!survey->channel && !allow_radio_stats)
+                return 0;
        hdr = nl80211hdr_put(msg, portid, seq, flags,
                             NL80211_CMD_NEW_SURVEY_RESULTS);
        if (!hdr)
@@ -6499,7 +6661,8 @@ static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
        if (!infoattr)
                goto nla_put_failure;
-        if (nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
+        if (survey->channel &&
+            nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
                        survey->channel->center_freq))
                goto nla_put_failure;
@@ -6509,25 +6672,29 @@ static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
        if ((survey->filled & SURVEY_INFO_IN_USE) &&
            nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
                goto nla_put_failure;
-        if ((survey->filled & SURVEY_INFO_CHANNEL_TIME) &&
+        if ((survey->filled & SURVEY_INFO_TIME) &&
-            nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
+            nla_put_u64(msg, NL80211_SURVEY_INFO_TIME,
-                        survey->channel_time))
+                        survey->time))
+                goto nla_put_failure;
+        if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
+            nla_put_u64(msg, NL80211_SURVEY_INFO_TIME_BUSY,
+                        survey->time_busy))
                goto nla_put_failure;
-        if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY) &&
+        if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
-            nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
+            nla_put_u64(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
-                        survey->channel_time_busy))
+                        survey->time_ext_busy))
                goto nla_put_failure;
-        if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY) &&
+        if ((survey->filled & SURVEY_INFO_TIME_RX) &&
-            nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
+            nla_put_u64(msg, NL80211_SURVEY_INFO_TIME_RX,
-                        survey->channel_time_ext_busy))
+                        survey->time_rx))
                goto nla_put_failure;
-        if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_RX) &&
+        if ((survey->filled & SURVEY_INFO_TIME_TX) &&
-            nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
+            nla_put_u64(msg, NL80211_SURVEY_INFO_TIME_TX,
-                        survey->channel_time_rx))
+                        survey->time_tx))
                goto nla_put_failure;
-        if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_TX) &&
+        if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
-            nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
+            nla_put_u64(msg, NL80211_SURVEY_INFO_TIME_SCAN,
-                        survey->channel_time_tx))
+                        survey->time_scan))
                goto nla_put_failure;
        nla_nest_end(msg, infoattr);
@@ -6539,19 +6706,22 @@ static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
        return -EMSGSIZE;
 }
-static int nl80211_dump_survey(struct sk_buff *skb,
+static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
-                        struct netlink_callback *cb)
 {
        struct survey_info survey;
        struct cfg80211_registered_device *rdev;
        struct wireless_dev *wdev;
        int survey_idx = cb->args[2];
        int res;
+        bool radio_stats;
        res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
        if (res)
                return res;
+        /* prepare_wdev_dump parsed the attributes */
+        radio_stats = nl80211_fam.attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
        if (!wdev->netdev) {
                res = -EINVAL;
                goto out_err;
@@ -6569,13 +6739,9 @@ static int nl80211_dump_survey(struct sk_buff *skb,
                if (res)
                        goto out_err;
-                /* Survey without a channel doesn't make sense */
+                /* don't send disabled channels, but do send non-channel data */
-                if (!survey.channel) {
+                if (survey.channel &&
-                        res = -EINVAL;
+                    survey.channel->flags & IEEE80211_CHAN_DISABLED) {
-                        goto out;
-                }
-                if (survey.channel->flags & IEEE80211_CHAN_DISABLED) {
                        survey_idx++;
                        continue;
                }
@@ -6583,7 +6749,7 @@ static int nl80211_dump_survey(struct sk_buff *skb,
                if (nl80211_send_survey(skb,
                                NETLINK_CB(cb->skb).portid,
                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
-                                wdev->netdev, &survey) < 0)
+                                wdev->netdev, radio_stats, &survey) < 0)
                        goto out;
                survey_idx++;
        }
@@ -8599,6 +8765,48 @@ static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
        return 0;
 }
+static int nl80211_send_wowlan_nd(struct sk_buff *msg,
+                                  struct cfg80211_sched_scan_request *req)
+{
+        struct nlattr *nd, *freqs, *matches, *match;
+        int i;
+        if (!req)
+                return 0;
+        nd = nla_nest_start(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
+        if (!nd)
+                return -ENOBUFS;
+        if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL, req->interval))
+                return -ENOBUFS;
+        freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
+        if (!freqs)
+                return -ENOBUFS;
+        for (i = 0; i < req->n_channels; i++)
+                nla_put_u32(msg, i, req->channels[i]->center_freq);
+        nla_nest_end(msg, freqs);
+        if (req->n_match_sets) {
+                matches = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
+                for (i = 0; i < req->n_match_sets; i++) {
+                        match = nla_nest_start(msg, i);
+                        nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
+                                req->match_sets[i].ssid.ssid_len,
+                                req->match_sets[i].ssid.ssid);
+                        nla_nest_end(msg, match);
+                }
+                nla_nest_end(msg, matches);
+        }
+        nla_nest_end(msg, nd);
+        return 0;
+}
 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
 {
        struct cfg80211_registered_device *rdev = info->user_ptr[0];
@@ -8656,6 +8864,11 @@ static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
                                            rdev->wiphy.wowlan_config->tcp))
                        goto nla_put_failure;
+                if (nl80211_send_wowlan_nd(
+                            msg,
+                            rdev->wiphy.wowlan_config->nd_config))
+                        goto nla_put_failure;
                nla_nest_end(msg, nl_wowlan);
        }
@@ -10225,7 +10438,8 @@ static const struct genl_ops nl80211_ops[] = {
        },
        {
                .cmd = NL80211_CMD_GET_REG,
-                .doit = nl80211_get_reg,
+                .doit = nl80211_get_reg_do,
+                .dumpit = nl80211_get_reg_dump,
                .policy = nl80211_policy,
                .internal_flags = NL80211_FLAG_NEED_RTNL,
                /* can be retrieved by unprivileged users */
@@ -10939,25 +11153,9 @@ void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
                                NL80211_MCGRP_SCAN, GFP_KERNEL);
 }
-/*
+static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
- * This can happen on global regulatory changes or device specific settings
+                                          struct regulatory_request *request)
- * based on custom world regulatory domains.
- */
-void nl80211_send_reg_change_event(struct regulatory_request *request)
 {
-        struct sk_buff *msg;
-        void *hdr;
-        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
-        if (!msg)
-                return;
-        hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
-        if (!hdr) {
-                nlmsg_free(msg);
-                return;
-        }
        /* Userspace can always count this one always being set */
        if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
                goto nla_put_failure;
@@ -10983,8 +11181,46 @@ void nl80211_send_reg_change_event(struct regulatory_request *request)
                        goto nla_put_failure;
        }
-        if (request->wiphy_idx != WIPHY_IDX_INVALID &&
+        if (request->wiphy_idx != WIPHY_IDX_INVALID) {
-            nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
+                struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
+                if (wiphy &&
+                    nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
+                        goto nla_put_failure;
+                if (wiphy &&
+                    wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
+                    nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
+                        goto nla_put_failure;
+        }
+        return true;
+nla_put_failure:
+        return false;
+}
+/*
+ * This can happen on global regulatory changes or device specific settings
+ * based on custom regulatory domains.
+ */
+void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
+                                     struct regulatory_request *request)
+{
+        struct sk_buff *msg;
+        void *hdr;
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+        if (!msg)
+                return;
+        hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
+        if (!hdr) {
+                nlmsg_free(msg);
+                return;
+        }
+        if (nl80211_reg_change_event_fill(msg, request) == false)
                goto nla_put_failure;
        genlmsg_end(msg, hdr);
@@ -11523,7 +11759,7 @@ void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
        if (!msg)
                return;
-        if (nl80211_send_station(msg, 0, 0, 0,
+        if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
                                 rdev, dev, mac_addr, sinfo) < 0) {
                nlmsg_free(msg);
                return;
@@ -11534,12 +11770,16 @@ void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
 }
 EXPORT_SYMBOL(cfg80211_new_sta);
-void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp)
+void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
+                            struct station_info *sinfo, gfp_t gfp)
 {
        struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
        struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
        struct sk_buff *msg;
-        void *hdr;
+        struct station_info empty_sinfo = {};
+        if (!sinfo)
+                sinfo = &empty_sinfo;
        trace_cfg80211_del_sta(dev, mac_addr);
@@ -11547,27 +11787,16 @@ void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp)
        if (!msg)
                return;
-        hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
+        if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
-        if (!hdr) {
+                                 rdev, dev, mac_addr, sinfo) < 0) {
                nlmsg_free(msg);
                return;
        }
-        if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
-            nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
-                goto nla_put_failure;
-        genlmsg_end(msg, hdr);
        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
                                NL80211_MCGRP_MLME, gfp);
-        return;
- nla_put_failure:
-        genlmsg_cancel(msg, hdr);
-        nlmsg_free(msg);
 }
-EXPORT_SYMBOL(cfg80211_del_sta);
+EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
                          enum nl80211_connect_failed_reason reason,
@@ -12471,6 +12700,13 @@ static int nl80211_netlink_notify(struct notifier_block * nb,
        list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
                bool schedule_destroy_work = false;
+                bool schedule_scan_stop = false;
+                struct cfg80211_sched_scan_request *sched_scan_req =
+                        rcu_dereference(rdev->sched_scan_req);
+                if (sched_scan_req && notify->portid &&
+                    sched_scan_req->owner_nlportid == notify->portid)
+                        schedule_scan_stop = true;
                list_for_each_entry_rcu(wdev, &rdev->wdev_list, list) {
                        cfg80211_mlme_unregister_socket(wdev, notify->portid);
@@ -12501,6 +12737,12 @@ static int nl80211_netlink_notify(struct notifier_block * nb,
                                spin_unlock(&rdev->destroy_list_lock);
                                schedule_work(&rdev->destroy_work);
                        }
+                } else if (schedule_scan_stop) {
+                        sched_scan_req->owner_nlportid = 0;
+                        if (rdev->ops->sched_scan_stop &&
+                            rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
+                                schedule_work(&rdev->sched_scan_stop_wk);
                }
        }
diff --git a/net/wireless/nl80211.h b/net/wireless/nl80211.h
index 7ad70d6f0cc6..84d4edf1d545 100644
--- a/net/wireless/nl80211.h
+++ b/net/wireless/nl80211.h
@@ -17,7 +17,21 @@ void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
                             struct net_device *netdev, u32 cmd);
 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
                                     struct net_device *netdev);
-void nl80211_send_reg_change_event(struct regulatory_request *request);
+void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
+                                     struct regulatory_request *request);
+static inline void
+nl80211_send_reg_change_event(struct regulatory_request *request)
+{
+        nl80211_common_reg_change_event(NL80211_CMD_REG_CHANGE, request);
+}
+static inline void
+nl80211_send_wiphy_reg_change_event(struct regulatory_request *request)
+{
+        nl80211_common_reg_change_event(NL80211_CMD_WIPHY_REG_CHANGE, request);
+}
 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
                          struct net_device *netdev,
                          const u8 *buf, size_t len, gfp_t gfp);
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 7b8309840d4e..886cc7cb5566 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -109,7 +109,7 @@ static struct regulatory_request core_request_world = {
 * protected by RTNL (and can be accessed with RCU protection)
 */
 static struct regulatory_request __rcu *last_request =
-        (void __rcu *)&core_request_world;
+        (void __force __rcu *)&core_request_world;
 /* To trigger userspace events */
 static struct platform_device *reg_pdev;
@@ -142,7 +142,7 @@ static const struct ieee80211_regdomain *get_cfg80211_regdom(void)
        return rtnl_dereference(cfg80211_regdomain);
 }
-static const struct ieee80211_regdomain *get_wiphy_regdom(struct wiphy *wiphy)
+const struct ieee80211_regdomain *get_wiphy_regdom(struct wiphy *wiphy)
 {
        return rtnl_dereference(wiphy->regd);
 }
@@ -1307,6 +1307,9 @@ static bool ignore_reg_update(struct wiphy *wiphy,
 {
        struct regulatory_request *lr = get_last_request();
+        if (wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED)
+                return true;
        if (!lr) {
                REG_DBG_PRINT("Ignoring regulatory request set by %s "
                              "since last_request is not set\n",
@@ -1683,8 +1686,12 @@ static void handle_channel_custom(struct wiphy *wiphy,
        if (IS_ERR(reg_rule)) {
                REG_DBG_PRINT("Disabling freq %d MHz as custom regd has no rule that fits it\n",
                              chan->center_freq);
-                chan->orig_flags |= IEEE80211_CHAN_DISABLED;
+                if (wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED) {
-                chan->flags = chan->orig_flags;
+                        chan->flags |= IEEE80211_CHAN_DISABLED;
+                } else {
+                        chan->orig_flags |= IEEE80211_CHAN_DISABLED;
+                        chan->flags = chan->orig_flags;
+                }
                return;
        }
@@ -1709,7 +1716,13 @@ static void handle_channel_custom(struct wiphy *wiphy,
        chan->dfs_state = NL80211_DFS_USABLE;
        chan->beacon_found = false;
-        chan->flags |= map_regdom_flags(reg_rule->flags) | bw_flags;
+        if (wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED)
+                chan->flags = chan->orig_flags | bw_flags |
+                              map_regdom_flags(reg_rule->flags);
+        else
+                chan->flags |= map_regdom_flags(reg_rule->flags) | bw_flags;
        chan->max_antenna_gain = (int) MBI_TO_DBI(power_rule->max_antenna_gain);
        chan->max_reg_power = chan->max_power =
                (int) MBM_TO_DBM(power_rule->max_eirp);
@@ -2095,6 +2108,26 @@ out_free:
        reg_free_request(reg_request);
 }
+static bool reg_only_self_managed_wiphys(void)
+{
+        struct cfg80211_registered_device *rdev;
+        struct wiphy *wiphy;
+        bool self_managed_found = false;
+        ASSERT_RTNL();
+        list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
+                wiphy = &rdev->wiphy;
+                if (wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED)
+                        self_managed_found = true;
+                else
+                        return false;
+        }
+        /* make sure at least one self-managed wiphy exists */
+        return self_managed_found;
+}
 /*
 * Processes regulatory hints, this is all the NL80211_REGDOM_SET_BY_*
 * Regulatory hints come on a first come first serve basis and we
@@ -2126,6 +2159,11 @@ static void reg_process_pending_hints(void)
        spin_unlock(&reg_requests_lock);
+        if (reg_only_self_managed_wiphys()) {
+                reg_free_request(reg_request);
+                return;
+        }
        reg_process_hint(reg_request);
 }
@@ -2153,11 +2191,52 @@ static void reg_process_pending_beacon_hints(void)
        spin_unlock_bh(&reg_pending_beacons_lock);
 }
+static void reg_process_self_managed_hints(void)
+{
+        struct cfg80211_registered_device *rdev;
+        struct wiphy *wiphy;
+        const struct ieee80211_regdomain *tmp;
+        const struct ieee80211_regdomain *regd;
+        enum ieee80211_band band;
+        struct regulatory_request request = {};
+        list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
+                wiphy = &rdev->wiphy;
+                spin_lock(&reg_requests_lock);
+                regd = rdev->requested_regd;
+                rdev->requested_regd = NULL;
+                spin_unlock(&reg_requests_lock);
+                if (regd == NULL)
+                        continue;
+                tmp = get_wiphy_regdom(wiphy);
+                rcu_assign_pointer(wiphy->regd, regd);
+                rcu_free_regdom(tmp);
+                for (band = 0; band < IEEE80211_NUM_BANDS; band++)
+                        handle_band_custom(wiphy, wiphy->bands[band], regd);
+                reg_process_ht_flags(wiphy);
+                request.wiphy_idx = get_wiphy_idx(wiphy);
+                request.alpha2[0] = regd->alpha2[0];
+                request.alpha2[1] = regd->alpha2[1];
+                request.initiator = NL80211_REGDOM_SET_BY_DRIVER;
+                nl80211_send_wiphy_reg_change_event(&request);
+        }
+        reg_check_channels();
+}
 static void reg_todo(struct work_struct *work)
 {
        rtnl_lock();
        reg_process_pending_hints();
        reg_process_pending_beacon_hints();
+        reg_process_self_managed_hints();
        rtnl_unlock();
 }
@@ -2438,6 +2517,8 @@ static void restore_regulatory_settings(bool reset_user)
        world_alpha2[1] = cfg80211_world_regdom->alpha2[1];
        list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
+                if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED)
+                        continue;
                if (rdev->wiphy.regulatory_flags & REGULATORY_CUSTOM_REG)
                        restore_custom_reg_settings(&rdev->wiphy);
        }
@@ -2841,10 +2922,79 @@ int set_regdom(const struct ieee80211_regdomain *rd)
        return 0;
 }
+static int __regulatory_set_wiphy_regd(struct wiphy *wiphy,
+                                       struct ieee80211_regdomain *rd)
+{
+        const struct ieee80211_regdomain *regd;
+        const struct ieee80211_regdomain *prev_regd;
+        struct cfg80211_registered_device *rdev;
+        if (WARN_ON(!wiphy || !rd))
+                return -EINVAL;
+        if (WARN(!(wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED),
+                 "wiphy should have REGULATORY_WIPHY_SELF_MANAGED\n"))
+                return -EPERM;
+        if (WARN(!is_valid_rd(rd), "Invalid regulatory domain detected\n")) {
+                print_regdomain_info(rd);
+                return -EINVAL;
+        }
+        regd = reg_copy_regd(rd);
+        if (IS_ERR(regd))
+                return PTR_ERR(regd);
+        rdev = wiphy_to_rdev(wiphy);
+        spin_lock(&reg_requests_lock);
+        prev_regd = rdev->requested_regd;
+        rdev->requested_regd = regd;
+        spin_unlock(&reg_requests_lock);
+        kfree(prev_regd);
+        return 0;
+}
+int regulatory_set_wiphy_regd(struct wiphy *wiphy,
+                              struct ieee80211_regdomain *rd)
+{
+        int ret = __regulatory_set_wiphy_regd(wiphy, rd);
+        if (ret)
+                return ret;
+        schedule_work(&reg_work);
+        return 0;
+}
+EXPORT_SYMBOL(regulatory_set_wiphy_regd);
+int regulatory_set_wiphy_regd_sync_rtnl(struct wiphy *wiphy,
+                                        struct ieee80211_regdomain *rd)
+{
+        int ret;
+        ASSERT_RTNL();
+        ret = __regulatory_set_wiphy_regd(wiphy, rd);
+        if (ret)
+                return ret;
+        /* process the request immediately */
+        reg_process_self_managed_hints();
+        return 0;
+}
+EXPORT_SYMBOL(regulatory_set_wiphy_regd_sync_rtnl);
 void wiphy_regulatory_register(struct wiphy *wiphy)
 {
        struct regulatory_request *lr;
+        /* self-managed devices ignore external hints */
+        if (wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED)
+                wiphy->regulatory_flags |= REGULATORY_DISABLE_BEACON_HINTS |
+                                           REGULATORY_COUNTRY_IE_IGNORE;
        if (!reg_dev_ignore_cell_hint(wiphy))
                reg_num_devs_support_basehint++;
diff --git a/net/wireless/reg.h b/net/wireless/reg.h
index 5e48031ccb9a..4b45d6e61d24 100644
--- a/net/wireless/reg.h
+++ b/net/wireless/reg.h
@@ -38,6 +38,7 @@ unsigned int reg_get_max_bandwidth(const struct ieee80211_regdomain *rd,
                                   const struct ieee80211_reg_rule *rule);
 bool reg_last_request_cell_base(void);
+const struct ieee80211_regdomain *get_wiphy_regdom(struct wiphy *wiphy);
 /**
 * regulatory_hint_found_beacon - hints a beacon was found on a channel
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index bda39f149810..c705c3e2b751 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -257,7 +257,7 @@ void __cfg80211_sched_scan_results(struct work_struct *wk)
        rtnl_lock();
-        request = rdev->sched_scan_req;
+        request = rtnl_dereference(rdev->sched_scan_req);
        /* we don't have sched_scan_req anymore if the scan is stopping */
        if (request) {
@@ -279,7 +279,8 @@ void cfg80211_sched_scan_results(struct wiphy *wiphy)
 {
        trace_cfg80211_sched_scan_results(wiphy);
        /* ignore if we're not scanning */
-        if (wiphy_to_rdev(wiphy)->sched_scan_req)
+        if (rcu_access_pointer(wiphy_to_rdev(wiphy)->sched_scan_req))
                queue_work(cfg80211_wq,
                           &wiphy_to_rdev(wiphy)->sched_scan_results_wk);
 }
@@ -308,6 +309,7 @@ EXPORT_SYMBOL(cfg80211_sched_scan_stopped);
 int __cfg80211_stop_sched_scan(struct cfg80211_registered_device *rdev,
                               bool driver_initiated)
 {
+        struct cfg80211_sched_scan_request *sched_scan_req;
        struct net_device *dev;
        ASSERT_RTNL();
@@ -315,7 +317,8 @@ int __cfg80211_stop_sched_scan(struct cfg80211_registered_device *rdev,
        if (!rdev->sched_scan_req)
                return -ENOENT;
-        dev = rdev->sched_scan_req->dev;
+        sched_scan_req = rtnl_dereference(rdev->sched_scan_req);
+        dev = sched_scan_req->dev;
        if (!driver_initiated) {
                int err = rdev_sched_scan_stop(rdev, dev);
@@ -325,8 +328,8 @@ int __cfg80211_stop_sched_scan(struct cfg80211_registered_device *rdev,
        nl80211_send_sched_scan(rdev, dev, NL80211_CMD_SCHED_SCAN_STOPPED);
-        kfree(rdev->sched_scan_req);
+        RCU_INIT_POINTER(rdev->sched_scan_req, NULL);
-        rdev->sched_scan_req = NULL;
+        kfree_rcu(sched_scan_req, rcu_head);
        return 0;
 }
diff --git a/net/wireless/trace.h b/net/wireless/trace.h
index ad38910f7036..b17b3692f8c2 100644
--- a/net/wireless/trace.h
+++ b/net/wireless/trace.h
@@ -1604,11 +1604,12 @@ TRACE_EVENT(rdev_return_int_survey_info,
                WIPHY_ENTRY
                CHAN_ENTRY
                __field(int, ret)
-                __field(u64, channel_time)
+                __field(u64, time)
-                __field(u64, channel_time_busy)
+                __field(u64, time_busy)
-                __field(u64, channel_time_ext_busy)
+                __field(u64, time_ext_busy)
-                __field(u64, channel_time_rx)
+                __field(u64, time_rx)
-                __field(u64, channel_time_tx)
+                __field(u64, time_tx)
+                __field(u64, time_scan)
                __field(u32, filled)
                __field(s8, noise)
        ),
@@ -1616,22 +1617,24 @@ TRACE_EVENT(rdev_return_int_survey_info,
                WIPHY_ASSIGN;
                CHAN_ASSIGN(info->channel);
                __entry->ret = ret;
-                __entry->channel_time = info->channel_time;
+                __entry->time = info->time;
-                __entry->channel_time_busy = info->channel_time_busy;
+                __entry->time_busy = info->time_busy;
-                __entry->channel_time_ext_busy = info->channel_time_ext_busy;
+                __entry->time_ext_busy = info->time_ext_busy;
-                __entry->channel_time_rx = info->channel_time_rx;
+                __entry->time_rx = info->time_rx;
-                __entry->channel_time_tx = info->channel_time_tx;
+                __entry->time_tx = info->time_tx;
+                __entry->time_scan = info->time_scan;
                __entry->filled = info->filled;
                __entry->noise = info->noise;
        ),
        TP_printk(WIPHY_PR_FMT ", returned: %d, " CHAN_PR_FMT
                  ", channel time: %llu, channel time busy: %llu, "
                  "channel time extension busy: %llu, channel time rx: %llu, "
-                  "channel time tx: %llu, filled: %u, noise: %d",
+                  "channel time tx: %llu, scan time: %llu, filled: %u, noise: %d",
                  WIPHY_PR_ARG, __entry->ret, CHAN_PR_ARG,
-                  __entry->channel_time, __entry->channel_time_busy,
+                  __entry->time, __entry->time_busy,
-                  __entry->channel_time_ext_busy, __entry->channel_time_rx,
+                  __entry->time_ext_busy, __entry->time_rx,
-                  __entry->channel_time_tx, __entry->filled, __entry->noise)
+                  __entry->time_tx, __entry->time_scan,
+                  __entry->filled, __entry->noise)
 );
 TRACE_EVENT(rdev_tdls_oper,
diff --git a/net/wireless/util.c b/net/wireless/util.c
index d0ac795445b7..3535e8ade48f 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -1073,10 +1073,24 @@ static u32 cfg80211_calculate_bitrate_vht(struct rate_info *rate)
        if (WARN_ON_ONCE(rate->mcs > 9))
                return 0;
-        idx = rate->flags & (RATE_INFO_FLAGS_160_MHZ_WIDTH |
+        switch (rate->bw) {
-                             RATE_INFO_FLAGS_80P80_MHZ_WIDTH) ? 3 :
+        case RATE_INFO_BW_160:
-                  rate->flags & RATE_INFO_FLAGS_80_MHZ_WIDTH ? 2 :
+                idx = 3;
-                  rate->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH ? 1 : 0;
+                break;
+        case RATE_INFO_BW_80:
+                idx = 2;
+                break;
+        case RATE_INFO_BW_40:
+                idx = 1;
+                break;
+        case RATE_INFO_BW_5:
+        case RATE_INFO_BW_10:
+        default:
+                WARN_ON(1);
+                /* fall through */
+        case RATE_INFO_BW_20:
+                idx = 0;
+        }
        bitrate = base[idx][rate->mcs];
        bitrate *= rate->nss;
@@ -1107,8 +1121,7 @@ u32 cfg80211_calculate_bitrate(struct rate_info *rate)
        modulation = rate->mcs & 7;
        streams = (rate->mcs >> 3) + 1;
-        bitrate = (rate->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) ?
+        bitrate = (rate->bw == RATE_INFO_BW_40) ? 13500000 : 6500000;
-                        13500000 : 6500000;
        if (modulation < 4)
                bitrate *= (modulation + 1);
diff --git a/net/wireless/wext-compat.c b/net/wireless/wext-compat.c
index 0f47948c572f..5b24d39d7903 100644
--- a/net/wireless/wext-compat.c
+++ b/net/wireless/wext-compat.c
@@ -1300,7 +1300,7 @@ static int cfg80211_wext_giwrate(struct net_device *dev,
        if (err)
                return err;
-        if (!(sinfo.filled & STATION_INFO_TX_BITRATE))
+        if (!(sinfo.filled & BIT(NL80211_STA_INFO_TX_BITRATE)))
                return -EOPNOTSUPP;
        rate->value = 100000 * cfg80211_calculate_bitrate(&sinfo.txrate);
@@ -1340,7 +1340,7 @@ static struct iw_statistics *cfg80211_wireless_stats(struct net_device *dev)
        switch (rdev->wiphy.signal_type) {
        case CFG80211_SIGNAL_TYPE_MBM:
-                if (sinfo.filled & STATION_INFO_SIGNAL) {
+                if (sinfo.filled & BIT(NL80211_STA_INFO_SIGNAL)) {
                        int sig = sinfo.signal;
                        wstats.qual.updated |= IW_QUAL_LEVEL_UPDATED;
                        wstats.qual.updated |= IW_QUAL_QUAL_UPDATED;
@@ -1354,7 +1354,7 @@ static struct iw_statistics *cfg80211_wireless_stats(struct net_device *dev)
                        break;
                }
        case CFG80211_SIGNAL_TYPE_UNSPEC:
-                if (sinfo.filled & STATION_INFO_SIGNAL) {
+                if (sinfo.filled & BIT(NL80211_STA_INFO_SIGNAL)) {
                        wstats.qual.updated |= IW_QUAL_LEVEL_UPDATED;
                        wstats.qual.updated |= IW_QUAL_QUAL_UPDATED;
                        wstats.qual.level = sinfo.signal;
@@ -1367,9 +1367,9 @@ static struct iw_statistics *cfg80211_wireless_stats(struct net_device *dev)
        }
        wstats.qual.updated |= IW_QUAL_NOISE_INVALID;
-        if (sinfo.filled & STATION_INFO_RX_DROP_MISC)
+        if (sinfo.filled & BIT(NL80211_STA_INFO_RX_DROP_MISC))
                wstats.discard.misc = sinfo.rx_dropped_misc;
-        if (sinfo.filled & STATION_INFO_TX_FAILED)
+        if (sinfo.filled & BIT(NL80211_STA_INFO_TX_FAILED))
                wstats.discard.retries = sinfo.tx_failed;
        return &wstats;